TAB-976 Harden form fills against prompt context exfiltration#478
Conversation
This reverts commit 6def109.
There was a problem hiding this comment.
I think this is okay to land - though, it does break some form-filling stuff I was doing for automated survey testing. Not sure if we have any real customers relying on something similar.
The solution for the survey testing would be to use a separate companion agent to provide the survey answers in interactive mode. But that's probably a better design anyway, since that agent won't necessarily be exposed to prompt injection from the page itself as easily.
There was a problem hiding this comment.
Pull request overview
This PR introduces a structural “action firewall” to harden browser automation against prompt-context exfiltration by gating agent-driven form fills and form submissions using DOM-derived field metadata and provenance tracking (rather than payload text matching).
Changes:
- Add
FieldMetadata/FormSubmissionContextbrowser APIs and implement them in Playwright + Extension browsers. - Enforce a security policy in
webActionToolsto block unauthorized agent fills and to gate submit-like actions when a form contains unauthorized agent-filled refs. - Add unit/regression tests for firewall behavior, provenance requirements, and snapshot/provenance lifetime interactions.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/extension/src/background/ExtensionBrowser.ts | Adds DOM introspection helpers for field metadata + form submission context. |
| packages/core/src/browser/ariaBrowser.ts | Extends the AriaBrowser contract with metadata/submission context types and methods. |
| packages/core/src/browser/playwrightBrowser.ts | Implements the new browser APIs using Playwright locator.evaluate. |
| packages/core/src/security/actionFirewall.ts | Adds fill/submission assessment logic and constants. |
| packages/core/src/tools/webActionTools.ts | Integrates firewall checks + provenance tracking into tools (fill/click/enter). |
| packages/core/src/tools/interactiveTools.ts | Simplifies ApprovedRefs implementation (now a Set). |
| packages/core/src/webAgent.ts | Wires provenance sets into tool context; adjusts snapshot refresh policy for fill. |
| packages/core/src/core.ts | Re-exports the new browser types from the public core entrypoint. |
| packages/core/test/security/actionFirewall.test.ts | Adds unit coverage for the firewall’s allow/block decisions. |
| packages/core/test/tools/webActionTools.test.ts | Adds regression tests for blocked fills, submit gating, and provenance requirements. |
| packages/core/test/webAgent.test.ts | Adds regression coverage for snapshot stability after fill. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Bumps the aisdk group with 5 updates: | Package | From | To | | --- | --- | --- | | [@ai-sdk/google](https://github.com/vercel/ai/tree/HEAD/packages/google) | `3.0.67` | `3.0.72` | | [@ai-sdk/google-vertex](https://github.com/vercel/ai/tree/HEAD/packages/google-vertex) | `4.0.121` | `4.0.126` | | [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `3.0.61` | `3.0.63` | | [@ai-sdk/openai-compatible](https://github.com/vercel/ai/tree/HEAD/packages/openai-compatible) | `2.0.46` | `2.0.47` | | [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.175` | `6.0.177` | Updates `@ai-sdk/google` from 3.0.67 to 3.0.72 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/ai/blob/@ai-sdk/google@3.0.72/packages/google/CHANGELOG.md">@ai-sdk/google's changelog</a>.</em></p> <blockquote> <h2>3.0.72</h2> <h3>Patch Changes</h3> <ul> <li>b3642fe: feat(provider/google): support cancelling long-running Interactions API agents via AbortSignal, and process their intermittent stream</li> </ul> <h2>3.0.71</h2> <h3>Patch Changes</h3> <ul> <li> <p>59530cf: fix(google): emit Vertex no-args streaming tool calls and preserve thoughtSignature</p> <p>Vertex emits a no-args function call as a single chunk shaped <code>{ functionCall: { name: 'X' } }</code> with no <code>args</code>, no <code>partialArgs</code>, and no <code>willContinue</code>. The streaming parser had no branch for this shape, so the call was dropped along with any <code>thoughtSignature</code> it carried. For Gemini 3 thinking models this caused the next multi-turn step to 400 with <code>missing thought_signature</code>. The unary (<code>doGenerate</code>) path had the same drop.</p> <p>Both paths now emit the call as a complete tool call with <code>'{}'</code> input and propagate <code>thoughtSignature</code> provider metadata.</p> <p>Fixes <a href="https://github.com/vercel/ai/tree/HEAD/packages/google/issues/14847">#14847</a>.</p> </li> </ul> <h2>3.0.70</h2> <h3>Patch Changes</h3> <ul> <li>4f3f564: fix(provider/google): fix lack of image consistency when using Interactions API in stateless mode</li> </ul> <h2>3.0.69</h2> <h3>Patch Changes</h3> <ul> <li>bb377ba: fix(google): omit passing includeServerSideToolInvocations for Vertex tool_config</li> <li>Updated dependencies [f591416] <ul> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/4"><code>@4</code></a>.0.27</li> </ul> </li> </ul> <h2>3.0.68</h2> <h3>Patch Changes</h3> <ul> <li>e0f8c9e: feat(provider/google): add support for the Gemini Interactions API</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/ai/commit/d5bbdbc0eff8e684809c75469c53fd366e917b53"><code>d5bbdbc</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/google/issues/15174">#15174</a>)</li> <li><a href="https://github.com/vercel/ai/commit/b3642febbe666fc729dddd4387d27d78e214ee92"><code>b3642fe</code></a> Backport: feat(provider/google): support cancelling long-running Interactions...</li> <li><a href="https://github.com/vercel/ai/commit/e70aab94d6f3dac30d54ac3185259a9562051bd6"><code>e70aab9</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/google/issues/15138">#15138</a>)</li> <li><a href="https://github.com/vercel/ai/commit/59530cf46d795d824ac6f20cce1a3fe79e25eb8b"><code>59530cf</code></a> Backport: fix(google): emit no-args streaming tool calls and preserve thought...</li> <li><a href="https://github.com/vercel/ai/commit/02882860df29ae2aa8140003c87a493af80bef08"><code>0288286</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/google/issues/15105">#15105</a>)</li> <li><a href="https://github.com/vercel/ai/commit/e3ccdb5987c07459ffd9be56088c5ac9d142fba2"><code>e3ccdb5</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/google/issues/15094">#15094</a>)</li> <li><a href="https://github.com/vercel/ai/commit/4f3f56467eaf1cbe59ce3323985bf5bb94cdb898"><code>4f3f564</code></a> Backport: fix(provider/google): fix lack of image consistency when using Inte...</li> <li><a href="https://github.com/vercel/ai/commit/bb377baff6f97cb42b4f4731b344c6d8d19ceb79"><code>bb377ba</code></a> Backport: fix(google): omit passing includeServerSideToolInvocations for Vert...</li> <li><a href="https://github.com/vercel/ai/commit/3a6aef7522c0f056a508b8830a74677f5ec0e664"><code>3a6aef7</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/google/issues/15072">#15072</a>)</li> <li><a href="https://github.com/vercel/ai/commit/e0f8c9e9b431a655c0d68475342fe198277a7e02"><code>e0f8c9e</code></a> Backport: feat(provider/google): add support for the Gemini Interactions API ...</li> <li>See full diff in <a href="https://github.com/vercel/ai/commits/@ai-sdk/google@3.0.72/packages/google">compare view</a></li> </ul> </details> <br /> Updates `@ai-sdk/google-vertex` from 4.0.121 to 4.0.126 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/ai/blob/@ai-sdk/google-vertex@4.0.126/packages/google-vertex/CHANGELOG.md">@ai-sdk/google-vertex's changelog</a>.</em></p> <blockquote> <h2>4.0.126</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [b3642fe] <ul> <li><code>@ai-sdk/google</code><a href="https://github.com/3"><code>@3</code></a>.0.72</li> </ul> </li> </ul> <h2>4.0.125</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [59530cf] <ul> <li><code>@ai-sdk/google</code><a href="https://github.com/3"><code>@3</code></a>.0.71</li> </ul> </li> </ul> <h2>4.0.124</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [4f3f564] <ul> <li><code>@ai-sdk/google</code><a href="https://github.com/3"><code>@3</code></a>.0.70</li> </ul> </li> </ul> <h2>4.0.123</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [f591416]</li> <li>Updated dependencies [bb377ba] <ul> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/4"><code>@4</code></a>.0.27</li> <li><code>@ai-sdk/google</code><a href="https://github.com/3"><code>@3</code></a>.0.69</li> <li><code>@ai-sdk/anthropic</code><a href="https://github.com/3"><code>@3</code></a>.0.76</li> <li><code>@ai-sdk/openai-compatible</code><a href="https://github.com/2"><code>@2</code></a>.0.47</li> </ul> </li> </ul> <h2>4.0.122</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [e0f8c9e] <ul> <li><code>@ai-sdk/google</code><a href="https://github.com/3"><code>@3</code></a>.0.68</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/ai/commit/d5bbdbc0eff8e684809c75469c53fd366e917b53"><code>d5bbdbc</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/google-vertex/issues/15174">#15174</a>)</li> <li><a href="https://github.com/vercel/ai/commit/e70aab94d6f3dac30d54ac3185259a9562051bd6"><code>e70aab9</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/google-vertex/issues/15138">#15138</a>)</li> <li><a href="https://github.com/vercel/ai/commit/02882860df29ae2aa8140003c87a493af80bef08"><code>0288286</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/google-vertex/issues/15105">#15105</a>)</li> <li><a href="https://github.com/vercel/ai/commit/e3ccdb5987c07459ffd9be56088c5ac9d142fba2"><code>e3ccdb5</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/google-vertex/issues/15094">#15094</a>)</li> <li><a href="https://github.com/vercel/ai/commit/3a6aef7522c0f056a508b8830a74677f5ec0e664"><code>3a6aef7</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/google-vertex/issues/15072">#15072</a>)</li> <li>See full diff in <a href="https://github.com/vercel/ai/commits/@ai-sdk/google-vertex@4.0.126/packages/google-vertex">compare view</a></li> </ul> </details> <br /> Updates `@ai-sdk/openai` from 3.0.61 to 3.0.63 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/ai/blob/@ai-sdk/openai@3.0.63/packages/openai/CHANGELOG.md">@ai-sdk/openai's changelog</a>.</em></p> <blockquote> <h2>3.0.63</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [f591416] <ul> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/4"><code>@4</code></a>.0.27</li> </ul> </li> </ul> <h2>3.0.62</h2> <h3>Patch Changes</h3> <ul> <li>65edcca: feat: add allowedTools provider option for OpenAI Responses</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/ai/commit/e3ccdb5987c07459ffd9be56088c5ac9d142fba2"><code>e3ccdb5</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/15094">#15094</a>)</li> <li><a href="https://github.com/vercel/ai/commit/bf9de314a7e747019d73dedad7c840da25cc94d5"><code>bf9de31</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/15046">#15046</a>)</li> <li><a href="https://github.com/vercel/ai/commit/65edcca7edb360ea6c3fa703ff5662c893e9ec0b"><code>65edcca</code></a> Backport: feat(openai): add allowedTools provider option for Responses (<a href="https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/15044">#15044</a>)</li> <li>See full diff in <a href="https://github.com/vercel/ai/commits/@ai-sdk/openai@3.0.63/packages/openai">compare view</a></li> </ul> </details> <br /> Updates `@ai-sdk/openai-compatible` from 2.0.46 to 2.0.47 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/ai/blob/@ai-sdk/openai-compatible@2.0.47/packages/openai-compatible/CHANGELOG.md">@ai-sdk/openai-compatible's changelog</a>.</em></p> <blockquote> <h2>2.0.47</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [f591416] <ul> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/4"><code>@4</code></a>.0.27</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/ai/commit/e3ccdb5987c07459ffd9be56088c5ac9d142fba2"><code>e3ccdb5</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/openai-compatible/issues/15094">#15094</a>)</li> <li>See full diff in <a href="https://github.com/vercel/ai/commits/@ai-sdk/openai-compatible@2.0.47/packages/openai-compatible">compare view</a></li> </ul> </details> <br /> Updates `ai` from 6.0.175 to 6.0.177 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/ai/blob/ai@6.0.177/packages/ai/CHANGELOG.md">ai's changelog</a>.</em></p> <blockquote> <h2>6.0.177</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [5c73af8] <ul> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.112</li> </ul> </li> </ul> <h2>6.0.176</h2> <h3>Patch Changes</h3> <ul> <li>f591416: feat(ai): add toolMetadata for tool specific metdata</li> <li>Updated dependencies [f591416] <ul> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/4"><code>@4</code></a>.0.27</li> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.111</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/ai/commit/e70aab94d6f3dac30d54ac3185259a9562051bd6"><code>e70aab9</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/15138">#15138</a>)</li> <li><a href="https://github.com/vercel/ai/commit/e3ccdb5987c07459ffd9be56088c5ac9d142fba2"><code>e3ccdb5</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/15094">#15094</a>)</li> <li><a href="https://github.com/vercel/ai/commit/f591416195ac03f03d16c9f50e074586fa4c2088"><code>f591416</code></a> Backport: feat(ai): add toolMetadata for tool specific metdata (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/15053">#15053</a>)</li> <li><a href="https://github.com/vercel/ai/commit/008497419e76fbcbe460829fbd785539a0b41ad0"><code>0084974</code></a> Backport: feat(mcp): deprecate name and use clientName for MCPClient (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/15003">#15003</a>)</li> <li>See full diff in <a href="https://github.com/vercel/ai/commits/ai@6.0.177/packages/ai">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the react group with 2 updates: [react](https://github.com/facebook/react/tree/HEAD/packages/react) and [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom). Updates `react` from 19.2.5 to 19.2.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/react/releases">react's releases</a>.</em></p> <blockquote> <h2>19.2.6 (May 6th, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Type hardening and performance improvements (<a href="https://redirect.github.com/facebook/react/pull/36425">#36425</a> by <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> and <a href="https://github.com/unstubbable"><code>@unstubbable</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facebook/react/commit/eaf3e95ca92be7a23d3c9cc8ffd6f199a40be401"><code>eaf3e95</code></a> Version 19.2.6</li> <li>See full diff in <a href="https://github.com/facebook/react/commits/v19.2.6/packages/react">compare view</a></li> </ul> </details> <br /> Updates `react-dom` from 19.2.5 to 19.2.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/react/releases">react-dom's releases</a>.</em></p> <blockquote> <h2>19.2.6 (May 6th, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Type hardening and performance improvements (<a href="https://redirect.github.com/facebook/react/pull/36425">#36425</a> by <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> and <a href="https://github.com/unstubbable"><code>@unstubbable</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facebook/react/commit/eaf3e95ca92be7a23d3c9cc8ffd6f199a40be401"><code>eaf3e95</code></a> Version 19.2.6</li> <li>See full diff in <a href="https://github.com/facebook/react/commits/v19.2.6/packages/react-dom">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the devdependencies group with 3 updates: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) and [wxt](https://github.com/wxt-dev/wxt). Updates `@types/node` from 25.6.0 to 25.7.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Updates `vitest` from 4.1.5 to 4.1.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v4.1.6</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li><strong>browser</strong>: Provide project reference in <code>ToMatchScreenshotResolvePath</code> - by <a href="https://github.com/macarie"><code>@macarie</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10138">vitest-dev/vitest#10138</a> <a href="https://github.com/vitest-dev/vitest/commit/31882607c"><!-- raw HTML omitted -->(31882)<!-- raw HTML omitted --></a></li> <li>Global <code>sequence.concurrent: true</code> with top-level <code>test(..., { concurrent: false })</code> + depreacte <code>sequential</code> test API and options - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Codex</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10196">vitest-dev/vitest#10196</a> <a href="https://github.com/vitest-dev/vitest/commit/2847dfa2a"><!-- raw HTML omitted -->(2847d)<!-- raw HTML omitted --></a></li> <li><strong>browser</strong>: Simplify orchestrator otel carrier - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10285">vitest-dev/vitest#10285</a> <a href="https://github.com/vitest-dev/vitest/commit/18af98cee"><!-- raw HTML omitted -->(18af9)<!-- raw HTML omitted --></a></li> </ul> <h3> 🏎 Performance</h3> <ul> <li>Stringify diff objects only once - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10276">vitest-dev/vitest#10276</a> <a href="https://github.com/vitest-dev/vitest/commit/9f7b1528c"><!-- raw HTML omitted -->(9f7b1)<!-- raw HTML omitted --></a></li> </ul> <h5> <a href="https://github.com/vitest-dev/vitest/compare/v4.1.5...v4.1.6">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/a8fd24c1cad2320b19fcc651413c7d928423bdc1"><code>a8fd24c</code></a> chore: release v4.1.6</li> <li><a href="https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06"><code>18af98c</code></a> fix(browser): simplify orchestrator otel carrier (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10285">#10285</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/31882607cc67c7bf52ead13a606321ffdb06a857"><code>3188260</code></a> feat(browser): provide project reference in <code>ToMatchScreenshotResolvePath</code> (#...</li> <li>See full diff in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.6/packages/vitest">compare view</a></li> </ul> </details> <br /> Updates `wxt` from 0.20.25 to 0.20.26 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/wxt-dev/wxt/releases">wxt's releases</a>.</em></p> <blockquote> <h2>wxt v0.20.26</h2> <p><a href="https://github.com/wxt-dev/wxt/compare/wxt-v0.20.25...wxt-v0.20.26">compare changes</a></p> <h3>🚀 Enhancements</h3> <ul> <li>Add <code>default_state</code> option to popup actions (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2010">#2010</a>)</li> <li>Add content script <code>noScriptStartedPostMessage</code> option (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2265">#2265</a>)</li> </ul> <h3>🩹 Fixes</h3> <ul> <li>Use <code>manifestVersion</code> from CLI during manifest generation (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2306">#2306</a>)</li> <li>Modify command to support variadic positional args (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2317">#2317</a>)</li> <li>Bump <code>publish-browser-extension</code> to <code>v4.0.5</code>, to resolve Chrome Web Store submission issue (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2331">#2331</a>)</li> <li>Avoid errors when files are removed during build (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2343">#2343</a>)</li> <li><strong>manifest:</strong> Exclude <code>open_in_tab</code> from <code>options_ui</code> for Safari (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2311">#2311</a>)</li> </ul> <h3>📖 Documentation</h3> <ul> <li><strong>wxt-modules:</strong> Add logging examples/best practices (<a href="https://github.com/wxt-dev/wxt/commit/57e3748d">57e3748d</a>)</li> <li>Correct entrypoints icon example code (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2302">#2302</a>)</li> <li>Add types for components (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2273">#2273</a>)</li> <li>Fix JSDoc example formatting (<a href="https://github.com/wxt-dev/wxt/commit/2a8ec0d7">2a8ec0d7</a>)</li> <li>Remove unused code (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2275">#2275</a>)</li> <li>Fix horizontal scrollbar displaying on landing page (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2329">#2329</a>)</li> <li>Add Mimik extension to the list of extensions (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2319">#2319</a>)</li> <li>Added modrinth extras and pi-hole in one to showcase (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2337">#2337</a>)</li> <li>Added "QIE Wallet" to showcase (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2341">#2341</a>)</li> <li>Update Safari publishing instructions to match Apple docs (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2314">#2314</a>)</li> <li>Add "Redmine Time Tracking" to extension showcase (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2312">#2312</a>)</li> </ul> <h3>🏡 Chore</h3> <ul> <li>More JSDoc fixes (<a href="https://github.com/wxt-dev/wxt/commit/9b59f38c">9b59f38c</a>)</li> <li>Move <code>createFileReloader</code> into it's own file (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2307">#2307</a>)</li> <li>Remove ts-expect-error that are no longer needed (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2344">#2344</a>)</li> <li><strong>deps-dev:</strong> Bump typescript from 5.9.3 to 6.0.3 (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2325">#2325</a>)</li> <li><strong>deps-dev:</strong> Bump oxlint from 1.59.0 to 1.63.0 (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2356">#2356</a>)</li> <li>Use <code>catalog:</code> for dev dependencies (<a href="https://redirect.github.com/wxt-dev/wxt/pull/2357">#2357</a>)</li> </ul> <h3>❤️ Contributors</h3> <ul> <li>Jonathan Viney (<a href="https://github.com/jviney"><code>@jviney</code></a>)</li> <li>Rxliuli (<a href="https://github.com/rxliuli"><code>@rxliuli</code></a>)</li> <li>CrawlerCode (<a href="https://github.com/CrawlerCode"><code>@CrawlerCode</code></a>)</li> <li>Thomas Howlett (<a href="https://github.com/howlettt"><code>@howlettt</code></a>)</li> <li>Aaron (<a href="https://github.com/aklinker1"><code>@aklinker1</code></a>)</li> <li>Brian Zhou (<a href="https://github.com/aiktb"><code>@aiktb</code></a>)</li> <li>Soaib Haque (<a href="https://github.com/SoaibHaque"><code>@SoaibHaque</code></a>)</li> <li>Arthur <a href="mailto:creeperkatze.dev@gmail.com">creeperkatze.dev@gmail.com</a></li> <li>Luis Ortiz (<a href="https://github.com/KiryuuLight"><code>@KiryuuLight</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/wxt-dev/wxt/commit/6f14aa1c71b2142ff064d867d365ceba778a0afd"><code>6f14aa1</code></a> chore(release): wxt v0.20.26</li> <li><a href="https://github.com/wxt-dev/wxt/commit/f771e6a122aa19a4cbdf6e22a6a89354c6562dbe"><code>f771e6a</code></a> feat: Add content script <code>noScriptStartedPostMessage</code> option (<a href="https://redirect.github.com/wxt-dev/wxt/issues/2265">#2265</a>)</li> <li><a href="https://github.com/wxt-dev/wxt/commit/a0a23947b6b83db3c2ec66a469344b128333439d"><code>a0a2394</code></a> chore(deps): Upgrade vitest and related deps (<a href="https://redirect.github.com/wxt-dev/wxt/issues/2358">#2358</a>)</li> <li><a href="https://github.com/wxt-dev/wxt/commit/7b6f1dc88b418e79e5479a32d608b92a4989acb3"><code>7b6f1dc</code></a> fix(manifest): exclude <code>open_in_tab</code> from <code>options_ui</code> for Safari (<a href="https://redirect.github.com/wxt-dev/wxt/issues/2311">#2311</a>)</li> <li><a href="https://github.com/wxt-dev/wxt/commit/16f9e1705fc1e5be83a3d1402ed0f7a91b4f9783"><code>16f9e17</code></a> chore: Update codeowners</li> <li><a href="https://github.com/wxt-dev/wxt/commit/40e28b702d2e023d3e0c57657314806d060f9551"><code>40e28b7</code></a> docs: Add "Redmine Time Tracking" to extension showcase (<a href="https://redirect.github.com/wxt-dev/wxt/issues/2312">#2312</a>)</li> <li><a href="https://github.com/wxt-dev/wxt/commit/75f0b843f8367d049151d1c5cf8cfe2ebc4a44a3"><code>75f0b84</code></a> docs: update Safari publishing instructions to match Apple docs (<a href="https://redirect.github.com/wxt-dev/wxt/issues/2314">#2314</a>)</li> <li><a href="https://github.com/wxt-dev/wxt/commit/879338532515fed5f8b72000040c11b622635551"><code>8793385</code></a> chore: Use <code>catalog:</code> for dev dependencies (<a href="https://redirect.github.com/wxt-dev/wxt/issues/2357">#2357</a>)</li> <li><a href="https://github.com/wxt-dev/wxt/commit/4f861438535883f3fb42b3cd4b4670a561aed5bc"><code>4f86143</code></a> fix: avoid errors when files are removed during build (<a href="https://redirect.github.com/wxt-dev/wxt/issues/2343">#2343</a>)</li> <li><a href="https://github.com/wxt-dev/wxt/commit/498f74b21bb3fbfcc9e2cc77479da7a7e6b76099"><code>498f74b</code></a> chore(deps-dev): bump oxlint from 1.59.0 to 1.63.0 (<a href="https://redirect.github.com/wxt-dev/wxt/issues/2356">#2356</a>)</li> <li>Additional commits viewable in <a href="https://github.com/wxt-dev/wxt/compare/wxt-v0.20.25...wxt-v0.20.26">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) from 4.2.4 to 4.3.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/releases">tailwindcss's releases</a>.</em></p> <blockquote> <h2>v4.3.0</h2> <h3>Added</h3> <ul> <li>Add <code>@container-size</code> utility (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18901">#18901</a>)</li> <li>Add <code>scrollbar-{auto,thin,none}</code> utilities for <code>scrollbar-width</code>, and <code>scrollbar-thumb-*</code> / <code>scrollbar-track-*</code> color utilities for <code>scrollbar-color</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19981">#19981</a>, <a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20019">#20019</a>)</li> <li>Add <code>scrollbar-gutter-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20018">#20018</a>)</li> <li>Add <code>zoom-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20020">#20020</a>)</li> <li>Add <code>tab-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20022">#20022</a>)</li> <li>Allow using <code>@variant</code> with stacked variants (e.g. <code>@variant hover:focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Allow using <code>@variant</code> with compound variants (e.g. <code>@variant hover, focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Support <code>--default(…)</code> in <code>--value(…)</code> and <code>--modifier(…)</code> for functional <code>@Utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19989">#19989</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Ensure <code>@plugin</code> resolves package JavaScript entries instead of browser CSS entries when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19949">#19949</a>)</li> <li>Fix relative <code>@import</code> and <code>@plugin</code> paths resolving from the wrong directory when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19965">#19965</a>)</li> <li>Ensure CSS files containing <code>@variant</code> are processed by <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19966">#19966</a>)</li> <li>Resolve imports relative to <code>base</code> when <code>result.opts.from</code> is not provided when using <code>@tailwindcss/postcss</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19980">#19980</a>)</li> <li>Canonicalization: preserve significant <code>_</code> whitespace in arbitrary values (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. <code>w-[calc(100%---spacing(60))]</code> → <code>w-[calc(100%-(--spacing(60)))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. <code>-mt-[20in]</code> → <code>mt-[-20in]</code>, not <code>mt-[-1920px]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19988">#19988</a>)</li> <li>Canonicalization: migrate arbitrary <code>:has()</code> variants from <code>[&:has(…)]</code> to <code>has-[…]</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19991">#19991</a>)</li> <li>Upgrade: don’t migrate inline <code>style</code> attributes (e.g. <code>style="flex-grow: 1"</code> → <code>style="flex-grow: 1"</code>, not <code>style="grow: 1"</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19918">#19918</a>)</li> <li>Allow multiple <code>@Utility</code> definitions with the same name but different value types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19777">#19777</a>)</li> <li>Export missing <code>PluginWithConfig</code> type from <code>tailwindcss/plugin</code> to fix errors when inferring plugin config types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19707">#19707</a>)</li> <li>Ensure <code>start</code> and <code>end</code> legacy utilities without values do not generate CSS (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20003">#20003</a>)</li> <li>Ensure <code>--value(…)</code> is required in functional <code>@Utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20005">#20005</a>)</li> <li>Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. <code>-left-[(var(--a)+var(--b))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20011">#20011</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md">tailwindcss's changelog</a>.</em></p> <blockquote> <h2>[4.3.0] - 2026-05-08</h2> <h3>Added</h3> <ul> <li>Add <code>@container-size</code> utility (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18901">#18901</a>)</li> <li>Add <code>scrollbar-{auto,thin,none}</code> utilities for <code>scrollbar-width</code>, and <code>scrollbar-thumb-*</code> / <code>scrollbar-track-*</code> color utilities for <code>scrollbar-color</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19981">#19981</a>, <a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20019">#20019</a>)</li> <li>Add <code>scrollbar-gutter-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20018">#20018</a>)</li> <li>Add <code>zoom-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20020">#20020</a>)</li> <li>Add <code>tab-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20022">#20022</a>)</li> <li>Allow using <code>@variant</code> with stacked variants (e.g. <code>@variant hover:focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Allow using <code>@variant</code> with compound variants (e.g. <code>@variant hover, focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Support <code>--default(…)</code> in <code>--value(…)</code> and <code>--modifier(…)</code> for functional <code>@Utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19989">#19989</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Ensure <code>@plugin</code> resolves package JavaScript entries instead of browser CSS entries when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19949">#19949</a>)</li> <li>Fix relative <code>@import</code> and <code>@plugin</code> paths resolving from the wrong directory when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19965">#19965</a>)</li> <li>Ensure CSS files containing <code>@variant</code> are processed by <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19966">#19966</a>)</li> <li>Resolve imports relative to <code>base</code> when <code>result.opts.from</code> is not provided when using <code>@tailwindcss/postcss</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19980">#19980</a>)</li> <li>Canonicalization: preserve significant <code>_</code> whitespace in arbitrary values (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. <code>w-[calc(100%---spacing(60))]</code> → <code>w-[calc(100%-(--spacing(60)))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. <code>-mt-[20in]</code> → <code>mt-[-20in]</code>, not <code>mt-[-1920px]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19988">#19988</a>)</li> <li>Canonicalization: migrate arbitrary <code>:has()</code> variants from <code>[&:has(…)]</code> to <code>has-[…]</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19991">#19991</a>)</li> <li>Upgrade: don’t migrate inline <code>style</code> attributes (e.g. <code>style="flex-grow: 1"</code> → <code>style="flex-grow: 1"</code>, not <code>style="grow: 1"</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19918">#19918</a>)</li> <li>Allow multiple <code>@Utility</code> definitions with the same name but different value types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19777">#19777</a>)</li> <li>Export missing <code>PluginWithConfig</code> type from <code>tailwindcss/plugin</code> to fix errors when inferring plugin config types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19707">#19707</a>)</li> <li>Ensure <code>start</code> and <code>end</code> legacy utilities without values do not generate CSS (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20003">#20003</a>)</li> <li>Ensure <code>--value(…)</code> is required in functional <code>@Utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20005">#20005</a>)</li> <li>Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. <code>-left-[(var(--a)+var(--b))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20011">#20011</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/588bd7371f4cae96426e1387819b7fd1d99765f9"><code>588bd73</code></a> 4.3.0 (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20023">#20023</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/59936c6cbb69eae114bc52d0a3c9315b18c70a94"><code>59936c6</code></a> Add <code>tab-*</code> utilities (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20022">#20022</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/90a2373620200bf7e04d1d228a0d0a1c506e532a"><code>90a2373</code></a> add <code>zoom-*</code> utilities (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20020">#20020</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/2e1ccf7f115732032d2b079073dcb0009baf82a0"><code>2e1ccf7</code></a> Add <code>scrollbar-gutter-*</code> utilities (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20018">#20018</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/754e7512ca51db1f922dc67724cf85a0fde923a9"><code>754e751</code></a> Use non-existing example in tests (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20021">#20021</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/12eb5ae7b6026ff64c04f889b2221418d772da72"><code>12eb5ae</code></a> Cleanup noisy test output (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20015">#20015</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/4255671c5f792c42808ecd6b2dec27c16e3c559e"><code>4255671</code></a> Improve snapshot tests (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20013">#20013</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/8c779899bbc94f9f642db47cafdd363dd094984a"><code>8c77989</code></a> Ensure math operators are surrounded by whitespace in arbitrary values (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20011">#20011</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/b4db3b99d1bc6209a936df34914e0fc34b3e5095"><code>b4db3b9</code></a> Add scrollbar-width and scrollbar-color utilities (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/19981">#19981</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/08cad84bbe2002398655d7f981eae47379e07fc3"><code>08cad84</code></a> Support <code>--default(…)</code> in <code>--value(…)</code> and <code>--modifier(…)</code> to support fallbac...</li> <li>Additional commits viewable in <a href="https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/tailwindcss">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@hono/node-server](https://github.com/honojs/node-server) from 2.0.1 to 2.0.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/node-server/releases">@hono/node-server's releases</a>.</em></p> <blockquote> <h2>v2.0.2</h2> <h2>What's Changed</h2> <ul> <li>fix(serve-static): stop using file birthtime for Date header by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/350">honojs/node-server#350</a></li> <li>fix: handle serveStatic stream fallback backpressure by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/351">honojs/node-server#351</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/node-server/compare/v2.0.1...v2.0.2">https://github.com/honojs/node-server/compare/v2.0.1...v2.0.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/node-server/commit/808159c4d2ab71064b9d00f2723078ac1b8324d5"><code>808159c</code></a> 2.0.2</li> <li><a href="https://github.com/honojs/node-server/commit/1a9748edd8da1b2829744ca8a199785fb095a4f2"><code>1a9748e</code></a> fix: handle serveStatic stream fallback backpressure (<a href="https://redirect.github.com/honojs/node-server/issues/351">#351</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/54d1bcd11e2bd3dc334f0d0d3d77604acb17f602"><code>54d1bcd</code></a> fix(serve-static): stop using file birthtime for Date header (<a href="https://redirect.github.com/honojs/node-server/issues/350">#350</a>)</li> <li>See full diff in <a href="https://github.com/honojs/node-server/compare/v2.0.1...v2.0.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#470) Bumps [@ghostery/adblocker-playwright](https://github.com/ghostery/adblocker/tree/HEAD/packages/adblocker-playwright) from 2.15.0 to 2.17.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ghostery/adblocker/releases">@ghostery/adblocker-playwright's releases</a>.</em></p> <blockquote> <h2>v2.17.0</h2> <h4>:rocket: New Feature</h4> <ul> <li><code>@ghostery/adblocker</code> <ul> <li>feat: fast binary-level merging <a href="https://redirect.github.com/ghostery/adblocker/pull/5631">#5631</a> (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> </ul> </li> </ul> <h4>:house: Internal</h4> <ul> <li><code>@ghostery/adblocker</code> <ul> <li>Update local assets <a href="https://redirect.github.com/ghostery/adblocker/pull/5664">#5664</a> (<a href="mailto:ghostery-adblocker-bot@users.noreply.github.com">ghostery-adblocker-bot@users.noreply.github.com</a> <a href="https://github.com/ghostery-adblocker-bot%5Bbot%5D"><code>@ghostery-adblocker-bot[bot]</code></a>)</li> </ul> </li> </ul> <h4>:nut_and_bolt: Dependencies</h4> <ul> <li>Build(deps): Bump basic-ftp from 5.2.2 to 5.3.1 <a href="https://redirect.github.com/ghostery/adblocker/pull/5656">#5656</a> (<a href="https://github.com/dependabot%5Bbot%5D"><code>@dependabot[bot]</code></a>)</li> <li>Build(deps-dev): Bump <code>@types/chrome</code> from 0.1.40 to 0.1.42 <a href="https://redirect.github.com/ghostery/adblocker/pull/5661">#5661</a> (<a href="https://github.com/dependabot%5Bbot%5D"><code>@dependabot[bot]</code></a> <a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> <li><code>@ghostery/adblocker-content</code>, <code>@ghostery/adblocker-electron-example</code>, <code>@ghostery/adblocker-electron-preload</code>, <code>@ghostery/adblocker-electron</code>, <code>@ghostery/adblocker-extended-selectors</code>, <code>@ghostery/adblocker-playwright-example</code>, <code>@ghostery/adblocker-playwright</code>, <code>@ghostery/adblocker-puppeteer-example</code>, <code>@ghostery/adblocker-puppeteer</code>, <code>@ghostery/adblocker-webextension-cosmetics</code>, <code>@ghostery/adblocker-webextension-example</code>, <code>@ghostery/adblocker-webextension</code>, <code>@ghostery/adblocker</code> <ul> <li>Update dependencies <a href="https://redirect.github.com/ghostery/adblocker/pull/5665">#5665</a> (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> </ul> </li> <li><code>@ghostery/adblocker-content</code>, <code>@ghostery/adblocker-electron-example</code>, <code>@ghostery/adblocker-electron</code>, <code>@ghostery/adblocker-extended-selectors</code>, <code>@ghostery/adblocker-playwright-example</code>, <code>@ghostery/adblocker-puppeteer-example</code>, <code>@ghostery/adblocker-puppeteer</code>, <code>@ghostery/adblocker-webextension-cosmetics</code>, <code>@ghostery/adblocker-webextension</code>, <code>@ghostery/adblocker</code> <ul> <li>Build(deps): Bump <code>@types/node</code> from 25.6.0 to 25.6.2 <a href="https://redirect.github.com/ghostery/adblocker/pull/5660">#5660</a> (<a href="https://github.com/dependabot%5Bbot%5D"><code>@dependabot[bot]</code></a>)</li> </ul> </li> </ul> <h4>Authors: 4</h4> <ul> <li><a href="https://github.com/dependabot%5Bbot%5D"><code>@dependabot[bot]</code></a></li> <li><a href="https://github.com/ghostery-adblocker-bot%5Bbot%5D"><code>@ghostery-adblocker-bot[bot]</code></a></li> <li>Ghostery Adblocker Bot (<a href="mailto:ghostery-adblocker-bot@users.noreply.github.com">ghostery-adblocker-bot@users.noreply.github.com</a>)</li> <li>HoJeong Go (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> </ul> <h2>v2.16.0</h2> <h4>:running_woman: Performance</h4> <ul> <li><code>@ghostery/adblocker</code> <ul> <li>perf: slicing-by-8 technique from Kounavis and Berry <a href="https://redirect.github.com/ghostery/adblocker/pull/5648">#5648</a> (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> </ul> </li> </ul> <h4>:house: Internal</h4> <ul> <li>fix(ci): drop 26 from the test pipeline <a href="https://redirect.github.com/ghostery/adblocker/pull/5663">#5663</a> (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> <li>chore(ci): improve test time by skipping playwright deps <a href="https://redirect.github.com/ghostery/adblocker/pull/5662">#5662</a> (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> <li><code>@ghostery/adblocker</code> <ul> <li>Update local assets <a href="https://redirect.github.com/ghostery/adblocker/pull/5657">#5657</a> (<a href="mailto:ghostery-adblocker-bot@users.noreply.github.com">ghostery-adblocker-bot@users.noreply.github.com</a> <a href="https://github.com/seia-soto"><code>@seia-soto</code></a> <a href="https://github.com/ghostery-adblocker-bot%5Bbot%5D"><code>@ghostery-adblocker-bot[bot]</code></a>)</li> <li>Update local assets <a href="https://redirect.github.com/ghostery/adblocker/pull/5653">#5653</a> (<a href="mailto:ghostery-adblocker-bot@users.noreply.github.com">ghostery-adblocker-bot@users.noreply.github.com</a> <a href="https://github.com/ghostery-adblocker-bot%5Bbot%5D"><code>@ghostery-adblocker-bot[bot]</code></a>)</li> <li>Update local assets <a href="https://redirect.github.com/ghostery/adblocker/pull/5649">#5649</a> (<a href="mailto:ghostery-adblocker-bot@users.noreply.github.com">ghostery-adblocker-bot@users.noreply.github.com</a> <a href="https://github.com/ghostery-adblocker-bot%5Bbot%5D"><code>@ghostery-adblocker-bot[bot]</code></a>)</li> <li>Update local assets <a href="https://redirect.github.com/ghostery/adblocker/pull/5645">#5645</a> (<a href="mailto:ghostery-adblocker-bot@users.noreply.github.com">ghostery-adblocker-bot@users.noreply.github.com</a> <a href="https://github.com/ghostery-adblocker-bot%5Bbot%5D"><code>@ghostery-adblocker-bot[bot]</code></a>)</li> </ul> </li> <li><code>@ghostery/adblocker-content</code>, <code>@ghostery/adblocker-electron-example</code>, <code>@ghostery/adblocker-electron-preload</code>, <code>@ghostery/adblocker-electron</code>, <code>@ghostery/adblocker-extended-selectors</code>, <code>@ghostery/adblocker-playwright-example</code>, <code>@ghostery/adblocker-playwright</code>, <code>@ghostery/adblocker-puppeteer-example</code>, <code>@ghostery/adblocker-puppeteer</code>, <code>@ghostery/adblocker-webextension-cosmetics</code>, <code>@ghostery/adblocker-webextension-example</code>, <code>@ghostery/adblocker-webextension</code>, <code>@ghostery/adblocker</code> <ul> <li>ci: migrate to node26 and update dependencies <a href="https://redirect.github.com/ghostery/adblocker/pull/5654">#5654</a> (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> </ul> </li> </ul> <h4>Authors: 3</h4> <ul> <li><a href="https://github.com/ghostery-adblocker-bot%5Bbot%5D"><code>@ghostery-adblocker-bot[bot]</code></a></li> <li>Ghostery Adblocker Bot (<a href="mailto:ghostery-adblocker-bot@users.noreply.github.com">ghostery-adblocker-bot@users.noreply.github.com</a>)</li> <li>HoJeong Go (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ghostery/adblocker/blob/master/packages/adblocker-playwright/CHANGELOG.md">@ghostery/adblocker-playwright's changelog</a>.</em></p> <blockquote> <h1>v2.17.0 (Fri May 08 2026)</h1> <h4>:nut_and_bolt: Dependencies</h4> <ul> <li>Update dependencies <a href="https://redirect.github.com/ghostery/adblocker/pull/5665">#5665</a> (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> </ul> <h4>Authors: 1</h4> <ul> <li>HoJeong Go (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> </ul> <hr /> <h1>v2.16.0 (Fri May 08 2026)</h1> <h4>:house: Internal</h4> <ul> <li>ci: migrate to node26 and update dependencies <a href="https://redirect.github.com/ghostery/adblocker/pull/5654">#5654</a> (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> </ul> <h4>Authors: 1</h4> <ul> <li>HoJeong Go (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> </ul> <hr /> <h1>v2.14.2 (Mon Apr 27 2026)</h1> <h4>⚠️ Pushed to <code>master</code></h4> <ul> <li>Update dependencies (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> </ul> <h4>:house: Internal</h4> <ul> <li>internal: retire nodejs v20 <a href="https://redirect.github.com/ghostery/adblocker/pull/5582">#5582</a> (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> <li>internal: TypeScript 6.0 migration <a href="https://redirect.github.com/ghostery/adblocker/pull/5546">#5546</a> (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> <li>Housekeeping <a href="https://redirect.github.com/ghostery/adblocker/pull/5518">#5518</a> (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> </ul> <h4>:nut_and_bolt: Dependencies</h4> <ul> <li>Update dependencies <a href="https://redirect.github.com/ghostery/adblocker/pull/5619">#5619</a> (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> <li>Build(deps-dev): Bump tshy from 3.3.2 to 4.0.0 <a href="https://redirect.github.com/ghostery/adblocker/pull/5551">#5551</a> (<a href="https://github.com/dependabot%5Bbot%5D"><code>@dependabot[bot]</code></a>)</li> <li>Build(deps-dev): Bump nyc from 17.1.0 to 18.0.0 <a href="https://redirect.github.com/ghostery/adblocker/pull/5489">#5489</a> (<a href="https://github.com/dependabot%5Bbot%5D"><code>@dependabot[bot]</code></a>)</li> <li>Update dependencies <a href="https://redirect.github.com/ghostery/adblocker/pull/5486">#5486</a> (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> </ul> <h4>Authors: 2</h4> <ul> <li><a href="https://github.com/dependabot%5Bbot%5D"><code>@dependabot[bot]</code></a></li> <li>HoJeong Go (<a href="https://github.com/seia-soto"><code>@seia-soto</code></a>)</li> </ul> <hr /> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ghostery/adblocker/commit/13d1b5023445fe7dbad2a8dd1076c90a6cf1b06a"><code>13d1b50</code></a> Bump version to: v2.17.0 [skip ci]</li> <li><a href="https://github.com/ghostery/adblocker/commit/f2c70a01a28756fadbc3b6813208ff78de409055"><code>f2c70a0</code></a> Update CHANGELOG.md [skip ci]</li> <li><a href="https://github.com/ghostery/adblocker/commit/f23690c6fd286993accb97495a58ef5de64571ef"><code>f23690c</code></a> Update dependencies (<a href="https://github.com/ghostery/adblocker/tree/HEAD/packages/adblocker-playwright/issues/5665">#5665</a>)</li> <li><a href="https://github.com/ghostery/adblocker/commit/21afad2aa2acf060943664bb478fc56a5fe3461a"><code>21afad2</code></a> Bump version to: v2.16.0 [skip ci]</li> <li><a href="https://github.com/ghostery/adblocker/commit/bc9fe30add26be600258300f52e5913ba4c4bfa9"><code>bc9fe30</code></a> Update CHANGELOG.md [skip ci]</li> <li><a href="https://github.com/ghostery/adblocker/commit/cf0ee17b96ed8af2cd5dcaee6da374d4ac86c41f"><code>cf0ee17</code></a> ci: migrate to node26 and update dependencies (<a href="https://github.com/ghostery/adblocker/tree/HEAD/packages/adblocker-playwright/issues/5654">#5654</a>)</li> <li>See full diff in <a href="https://github.com/ghostery/adblocker/commits/v2.17.0/packages/adblocker-playwright">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) from 4.1.5 to 4.1.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">@vitest/coverage-v8's releases</a>.</em></p> <blockquote> <h2>v4.1.6</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li><strong>browser</strong>: Provide project reference in <code>ToMatchScreenshotResolvePath</code> - by <a href="https://github.com/macarie"><code>@macarie</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10138">vitest-dev/vitest#10138</a> <a href="https://github.com/vitest-dev/vitest/commit/31882607c"><!-- raw HTML omitted -->(31882)<!-- raw HTML omitted --></a></li> <li>Global <code>sequence.concurrent: true</code> with top-level <code>test(..., { concurrent: false })</code> + depreacte <code>sequential</code> test API and options - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Codex</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10196">vitest-dev/vitest#10196</a> <a href="https://github.com/vitest-dev/vitest/commit/2847dfa2a"><!-- raw HTML omitted -->(2847d)<!-- raw HTML omitted --></a></li> <li><strong>browser</strong>: Simplify orchestrator otel carrier - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10285">vitest-dev/vitest#10285</a> <a href="https://github.com/vitest-dev/vitest/commit/18af98cee"><!-- raw HTML omitted -->(18af9)<!-- raw HTML omitted --></a></li> </ul> <h3> 🏎 Performance</h3> <ul> <li>Stringify diff objects only once - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10276">vitest-dev/vitest#10276</a> <a href="https://github.com/vitest-dev/vitest/commit/9f7b1528c"><!-- raw HTML omitted -->(9f7b1)<!-- raw HTML omitted --></a></li> </ul> <h5> <a href="https://github.com/vitest-dev/vitest/compare/v4.1.5...v4.1.6">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/a8fd24c1cad2320b19fcc651413c7d928423bdc1"><code>a8fd24c</code></a> chore: release v4.1.6</li> <li>See full diff in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.6/packages/coverage-v8">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) from 4.2.4 to 4.3.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/releases">@tailwindcss/vite's releases</a>.</em></p> <blockquote> <h2>v4.3.0</h2> <h3>Added</h3> <ul> <li>Add <code>@container-size</code> utility (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18901">#18901</a>)</li> <li>Add <code>scrollbar-{auto,thin,none}</code> utilities for <code>scrollbar-width</code>, and <code>scrollbar-thumb-*</code> / <code>scrollbar-track-*</code> color utilities for <code>scrollbar-color</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19981">#19981</a>, <a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20019">#20019</a>)</li> <li>Add <code>scrollbar-gutter-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20018">#20018</a>)</li> <li>Add <code>zoom-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20020">#20020</a>)</li> <li>Add <code>tab-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20022">#20022</a>)</li> <li>Allow using <code>@variant</code> with stacked variants (e.g. <code>@variant hover:focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Allow using <code>@variant</code> with compound variants (e.g. <code>@variant hover, focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Support <code>--default(…)</code> in <code>--value(…)</code> and <code>--modifier(…)</code> for functional <code>@Utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19989">#19989</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Ensure <code>@plugin</code> resolves package JavaScript entries instead of browser CSS entries when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19949">#19949</a>)</li> <li>Fix relative <code>@import</code> and <code>@plugin</code> paths resolving from the wrong directory when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19965">#19965</a>)</li> <li>Ensure CSS files containing <code>@variant</code> are processed by <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19966">#19966</a>)</li> <li>Resolve imports relative to <code>base</code> when <code>result.opts.from</code> is not provided when using <code>@tailwindcss/postcss</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19980">#19980</a>)</li> <li>Canonicalization: preserve significant <code>_</code> whitespace in arbitrary values (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. <code>w-[calc(100%---spacing(60))]</code> → <code>w-[calc(100%-(--spacing(60)))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. <code>-mt-[20in]</code> → <code>mt-[-20in]</code>, not <code>mt-[-1920px]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19988">#19988</a>)</li> <li>Canonicalization: migrate arbitrary <code>:has()</code> variants from <code>[&:has(…)]</code> to <code>has-[…]</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19991">#19991</a>)</li> <li>Upgrade: don’t migrate inline <code>style</code> attributes (e.g. <code>style="flex-grow: 1"</code> → <code>style="flex-grow: 1"</code>, not <code>style="grow: 1"</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19918">#19918</a>)</li> <li>Allow multiple <code>@Utility</code> definitions with the same name but different value types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19777">#19777</a>)</li> <li>Export missing <code>PluginWithConfig</code> type from <code>tailwindcss/plugin</code> to fix errors when inferring plugin config types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19707">#19707</a>)</li> <li>Ensure <code>start</code> and <code>end</code> legacy utilities without values do not generate CSS (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20003">#20003</a>)</li> <li>Ensure <code>--value(…)</code> is required in functional <code>@Utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20005">#20005</a>)</li> <li>Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. <code>-left-[(var(--a)+var(--b))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20011">#20011</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md">@tailwindcss/vite's changelog</a>.</em></p> <blockquote> <h2>[4.3.0] - 2026-05-08</h2> <h3>Added</h3> <ul> <li>Add <code>@container-size</code> utility (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18901">#18901</a>)</li> <li>Add <code>scrollbar-{auto,thin,none}</code> utilities for <code>scrollbar-width</code>, and <code>scrollbar-thumb-*</code> / <code>scrollbar-track-*</code> color utilities for <code>scrollbar-color</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19981">#19981</a>, <a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20019">#20019</a>)</li> <li>Add <code>scrollbar-gutter-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20018">#20018</a>)</li> <li>Add <code>zoom-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20020">#20020</a>)</li> <li>Add <code>tab-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20022">#20022</a>)</li> <li>Allow using <code>@variant</code> with stacked variants (e.g. <code>@variant hover:focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Allow using <code>@variant</code> with compound variants (e.g. <code>@variant hover, focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Support <code>--default(…)</code> in <code>--value(…)</code> and <code>--modifier(…)</code> for functional <code>@Utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19989">#19989</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Ensure <code>@plugin</code> resolves package JavaScript entries instead of browser CSS entries when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19949">#19949</a>)</li> <li>Fix relative <code>@import</code> and <code>@plugin</code> paths resolving from the wrong directory when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19965">#19965</a>)</li> <li>Ensure CSS files containing <code>@variant</code> are processed by <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19966">#19966</a>)</li> <li>Resolve imports relative to <code>base</code> when <code>result.opts.from</code> is not provided when using <code>@tailwindcss/postcss</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19980">#19980</a>)</li> <li>Canonicalization: preserve significant <code>_</code> whitespace in arbitrary values (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. <code>w-[calc(100%---spacing(60))]</code> → <code>w-[calc(100%-(--spacing(60)))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. <code>-mt-[20in]</code> → <code>mt-[-20in]</code>, not <code>mt-[-1920px]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19988">#19988</a>)</li> <li>Canonicalization: migrate arbitrary <code>:has()</code> variants from <code>[&:has(…)]</code> to <code>has-[…]</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19991">#19991</a>)</li> <li>Upgrade: don’t migrate inline <code>style</code> attributes (e.g. <code>style="flex-grow: 1"</code> → <code>style="flex-grow: 1"</code>, not <code>style="grow: 1"</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19918">#19918</a>)</li> <li>Allow multiple <code>@Utility</code> definitions with the same name but different value types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19777">#19777</a>)</li> <li>Export missing <code>PluginWithConfig</code> type from <code>tailwindcss/plugin</code> to fix errors when inferring plugin config types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19707">#19707</a>)</li> <li>Ensure <code>start</code> and <code>end</code> legacy utilities without values do not generate CSS (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20003">#20003</a>)</li> <li>Ensure <code>--value(…)</code> is required in functional <code>@Utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20005">#20005</a>)</li> <li>Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. <code>-left-[(var(--a)+var(--b))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20011">#20011</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/588bd7371f4cae96426e1387819b7fd1d99765f9"><code>588bd73</code></a> 4.3.0 (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite/issues/20023">#20023</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/d194d4c3e656313421f1cfa1954db8f58eec0fcd"><code>d194d4c</code></a> docs: fix various typos in comments and documentation (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite/issues/19878">#19878</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/db27049caaae08978995f25b61f8336f543a4640"><code>db27049</code></a> fix(<code>@tailwindcss/vite</code>): include <a href="https://github.com/variant"><code>@variant</code></a> in feature detection (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite/issues/19966">#19966</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/5a799900d4b43ca4902398a38c6f0a5b37a98ed9"><code>5a79990</code></a> Always resolve relative files, relative to the current .css file (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite/issues/19965">#19965</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/f3fdda2a5cb9de50c897c79003aa58182cd9269b"><code>f3fdda2</code></a> fix(vite): avoid resolving JS plugins to browser CSS entries (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite/issues/19949">#19949</a>)</li> <li>See full diff in <a href="https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/@tailwindcss-vite">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [tailwind-merge](https://github.com/dcastil/tailwind-merge) from 3.5.0 to 3.6.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dcastil/tailwind-merge/releases">tailwind-merge's releases</a>.</em></p> <blockquote> <h2>v3.6.0</h2> <h3>New Features</h3> <ul> <li>Add support for Tailwind CSS v4.3 by <a href="https://github.com/dcastil"><code>@dcastil</code></a> in <a href="https://redirect.github.com/dcastil/tailwind-merge/pull/677">dcastil/tailwind-merge#677</a> <ul> <li>Add <code>postfixLookupClassGroups</code> option to config to support Tailwind utilities where a slash is part of the full class name, like named container queries</li> </ul> </li> <li>Add support for readonly array values by <a href="https://github.com/unional"><code>@unional</code></a> in <a href="https://redirect.github.com/dcastil/tailwind-merge/pull/652">dcastil/tailwind-merge#652</a></li> </ul> <h3>Documentation</h3> <ul> <li>Fix broken links in README by <a href="https://github.com/maurer2"><code>@maurer2</code></a> in <a href="https://redirect.github.com/dcastil/tailwind-merge/pull/662">dcastil/tailwind-merge#662</a></li> </ul> <h3>Other</h3> <ul> <li>Harden internal CI pipeline security by omitting git checkout by <a href="https://github.com/dcastil"><code>@dcastil</code></a>, suggested by <a href="https://github.com/kyletaylored"><code>@kyletaylored</code></a> in <a href="https://github.com/dcastil/tailwind-merge/commit/6b2499c10cf52bed42426d30b4219e90374b30d6">https://github.com/dcastil/tailwind-merge/commit/6b2499c10cf52bed42426d30b4219e90374b30d6</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dcastil/tailwind-merge/compare/v3.5.0...v3.6.0">https://github.com/dcastil/tailwind-merge/compare/v3.5.0...v3.6.0</a></p> <p>Thanks to <a href="https://github.com/brandonmcconnell"><code>@brandonmcconnell</code></a>, <a href="https://github.com/manavm1990"><code>@manavm1990</code></a>, <a href="https://github.com/langy"><code>@langy</code></a>, <a href="https://github.com/roboflow"><code>@roboflow</code></a>, <a href="https://github.com/syntaxfm"><code>@syntaxfm</code></a>, <a href="https://github.com/getsentry"><code>@getsentry</code></a>, <a href="https://github.com/codecov"><code>@codecov</code></a>, a private sponsor, <a href="https://github.com/block"><code>@block</code></a>, <a href="https://github.com/openclaw"><code>@openclaw</code></a>, <a href="https://github.com/sourcegraph"><code>@sourcegraph</code></a>, <a href="https://github.com/mike-healy"><code>@mike-healy</code></a> and more via <a href="https://github.com/thnxdev"><code>@thnxdev</code></a> for sponsoring tailwind-merge! ❤️</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dcastil/tailwind-merge/commit/d54f7e5713c653d0171971405344f7c6e44d418f"><code>d54f7e5</code></a> v3.6.0</li> <li><a href="https://github.com/dcastil/tailwind-merge/commit/638871a67a0a124ac9275eda77cd08b03f2f045e"><code>638871a</code></a> Update README to add info about Tailwind CSS v4.3 support</li> <li><a href="https://github.com/dcastil/tailwind-merge/commit/39fc7b5e915493e5eb3ddb1ca615f5b2eeff2540"><code>39fc7b5</code></a> Revert "v3.6.0"</li> <li><a href="https://github.com/dcastil/tailwind-merge/commit/bd8390f6ca387f93c9e989fb3fb09924fb843445"><code>bd8390f</code></a> v3.6.0</li> <li><a href="https://github.com/dcastil/tailwind-merge/commit/802877c6e31f9fb64c627e5e760729a16cd0a69b"><code>802877c</code></a> add v3.6.0 changelog</li> <li><a href="https://github.com/dcastil/tailwind-merge/commit/a35fedac7d1fc8756223da94290a83a32068d2ae"><code>a35feda</code></a> Merge pull request <a href="https://redirect.github.com/dcastil/tailwind-merge/issues/665">#665</a> from dcastil/renovate/rollup-plugin-babel-7.x</li> <li><a href="https://github.com/dcastil/tailwind-merge/commit/940389cf89ed0da277ff5c01b98fd619687926e9"><code>940389c</code></a> Merge pull request <a href="https://redirect.github.com/dcastil/tailwind-merge/issues/667">#667</a> from dcastil/renovate/release-drafter-release-drafter...</li> <li><a href="https://github.com/dcastil/tailwind-merge/commit/005af6df08cfbe2adac7ca6cb5a7be02b9261fbd"><code>005af6d</code></a> pin to specific version</li> <li><a href="https://github.com/dcastil/tailwind-merge/commit/5816ced627ebcaefd497ad8e4202baf750dd545c"><code>5816ced</code></a> implement breaking changes</li> <li><a href="https://github.com/dcastil/tailwind-merge/commit/17041e17c5b9c96fcb0f4758c718799cb3af14a6"><code>17041e1</code></a> Merge pull request <a href="https://redirect.github.com/dcastil/tailwind-merge/issues/676">#676</a> from dcastil/dependabot/npm_and_yarn/babel/plugin-tra...</li> <li>Additional commits viewable in <a href="https://github.com/dcastil/tailwind-merge/compare/v3.5.0...v3.6.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [playwright](https://github.com/microsoft/playwright) from 1.59.1 to 1.60.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/microsoft/playwright/releases">playwright's releases</a>.</em></p> <blockquote> <h2>v1.60.0</h2> <h2>🌐 HAR recording on Tracing</h2> <p><a href="https://playwright.dev/docs/api/class-tracing#tracing-start-har">tracing.startHar()</a> / <a href="https://playwright.dev/docs/api/class-tracing#tracing-stop-har">tracing.stopHar()</a> expose HAR recording as a first-class tracing API, with the same <code>content</code>, <code>mode</code> and <code>urlFilter</code> options as <code>recordHar</code>. The returned <a href="https://playwright.dev/docs/api/class-disposable">Disposable</a> makes it easy to scope a recording with <code>await using</code>:</p> <pre lang="js"><code>await using har = await context.tracing.startHar('trace.har'); const page = await context.newPage(); await page.goto('https://playwright.dev'); // HAR is finalized when `har` goes out of scope. </code></pre> <h2>🪝 Drop API</h2> <p>New <a href="https://playwright.dev/docs/api/class-locator#locator-drop">locator.drop()</a> simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches <code>dragenter</code>, <code>dragover</code>, and <code>drop</code> with a synthetic [DataTransfer] in the page context — works cross-browser and is great for testing upload zones:</p> <pre lang="js"><code>await page.locator('#dropzone').drop({ files: { name: 'note.txt', mimeType: 'text/plain', buffer: Buffer.from('hello') }, }); <p>await page.locator('#dropzone').drop({ data: { 'text/plain': 'hello world', 'text/uri-list': '<a href="https://example.com">https://example.com</a>', }, }); </code></pre></p> <h2>🎯 Aria snapshots</h2> <ul> <li><a href="https://playwright.dev/docs/api/class-pageassertions#page-assertions-to-match-aria-snapshot">expect(page).toMatchAriaSnapshot()</a> now works on a <a href="https://playwright.dev/docs/api/class-page">Page</a>, in addition to a <a href="https://playwright.dev/docs/api/class-locator">Locator</a> — equivalent to asserting against <code>page.locator('body')</code>.</li> <li>New <code>boxes</code> option on <a href="https://playwright.dev/docs/api/class-locator#locator-aria-snapshot">locator.ariaSnapshot()</a> / <a href="https://playwright.dev/docs/api/class-page#page-aria-snapshot">page.ariaSnapshot()</a> appends each element's bounding box as <code>[box=x,y,width,height]</code>, useful for AI consumption.</li> </ul> <h2>🛑 test.abort()</h2> <p>New <a href="https://playwright.dev/docs/api/class-test#test-abort">test.abort()</a> aborts the currently running test from a fixture, hook, or route handler with an optional message. Use it when you have detected an unrecoverable misuse and want to fail the test right away:</p> <pre lang="js"><code>test('does not publish to the shared page', async ({ page }) => { await page.route('**/publish', route => { test.abort('Tests must not publish to the shared page. Use the `clone` option.'); return route.abort(); }); // ... }); </code></pre> <h2>New APIs</h2> <h3>Browser, Context and Page</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/microsoft/playwright/commit/87bb9ddbd78f329df18c2b24847bc9409240cd07"><code>87bb9dd</code></a> cherry-pick(<a href="https://redirect.github.com/microsoft/playwright/issues/40747">#40747</a>): fix(yauzl): vendor yauzl with destroy-lifecycle fix</li> <li><a href="https://github.com/microsoft/playwright/commit/9a9c51cb7d1b39fab51ca288e59f8ca38fd19910"><code>9a9c51c</code></a> cherry-pick(<a href="https://redirect.github.com/microsoft/playwright/issues/40733">#40733</a>): chore(electron): revert <a href="https://redirect.github.com/microsoft/playwright/issues/40184">#40184</a> (move Electron API to a s...</li> <li><a href="https://github.com/microsoft/playwright/commit/4b3b628663031bcaaeca907e337892263524634d"><code>4b3b628</code></a> cherry-pick(<a href="https://redirect.github.com/microsoft/playwright/issues/40736">#40736</a>): Revert "feat(electron): add timeout option to electronAp...</li> <li><a href="https://github.com/microsoft/playwright/commit/f869f96bbe6607cc3b88b4ca96fd82f17b301b50"><code>f869f96</code></a> chore: bump version to v1.60.0 (<a href="https://redirect.github.com/microsoft/playwright/issues/40714">#40714</a>)</li> <li><a href="https://github.com/microsoft/playwright/commit/7eb6918afadfb0dd5c7e94ca9ffbddd84d8fbb39"><code>7eb6918</code></a> cherry-pick(<a href="https://redirect.github.com/microsoft/playwright/issues/40710">#40710</a>): docs: release notes v1.60</li> <li><a href="https://github.com/microsoft/playwright/commit/118d2aa6076d82840decca15d96b48611b08e392"><code>118d2aa</code></a> cherry-pick(<a href="https://redirect.github.com/microsoft/playwright/issues/40693">#40693</a>): chore(python): formdata path type</li> <li><a href="https://github.com/microsoft/playwright/commit/54012f5dcc586da2e5d6cccd75f13ca367b94579"><code>54012f5</code></a> chore(deps): bump ip-address and express-rate-limit (<a href="https://redirect.github.com/microsoft/playwright/issues/40680">#40680</a>)</li> <li><a href="https://github.com/microsoft/playwright/commit/9fa531da5677a3807d6e1dccd22c5137339a44f7"><code>9fa531d</code></a> fix(screencast): unblock frame ack when an async client disconnects (<a href="https://redirect.github.com/microsoft/playwright/issues/40674">#40674</a>)</li> <li><a href="https://github.com/microsoft/playwright/commit/3649db560ff943e724185784d34f7db131a11961"><code>3649db5</code></a> chore(mcp): bump default extension protocol to v2 (<a href="https://redirect.github.com/microsoft/playwright/issues/40678">#40678</a>)</li> <li><a href="https://github.com/microsoft/playwright/commit/bb6c00957f47ba04caad7fca75d426309a2d32d4"><code>bb6c009</code></a> chore(extension): mark 0.2.1 (<a href="https://redirect.github.com/microsoft/playwright/issues/40679">#40679</a>)</li> <li>Additional commits viewable in <a href="https://github.com/microsoft/playwright/compare/v1.59.1...v1.60.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…tent-prompt-injection
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Adds the design for caller-supplied trusted_hostnames and unsafe_mode bypasses on top of the existing prompt-injection action firewall, plus a non-interactive-mode remediation event that surfaces all enable paths to the user without leaking guidance to the model.
Task-by-task plan for the 2026-05-28 firewall-bypass-controls spec: hostname helpers, FirewallConfig + bypass branches, FormSubmissionContext submitterActionUrl, FIREWALL_BLOCKED_NON_INTERACTIVE event, web-tools plumbing, WebAgent option additions, config/CLI/env wiring, CLI remediation footer, docs, final validation.
Adds FirewallConfig interface (trustedHostnames + unsafeMode) to assessFill and assessFormSubmission with unsafeMode/trusted-hostname bypass paths. Forward-declares FormSubmissionContext.submitterActionUrl (null) across all implementations to unblock tests; Task 3 will populate the real value via Playwright. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… tools Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Builds a frozen FirewallConfig at construction and passes firewall and interactive into createWebActionTools, fixing the typecheck failure from Task 5. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… footer Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… at set time parseConfigValue now CSV-splits when given a known string[] key (trusted_hostnames, pw_cdp_endpoints), so `pilo config set trusted_hostnames a.com,b.com` persists the array form instead of a literal string that would later crash WebAgent. setConfigurationValue also normalizes each entry of trusted_hostnames via normalizeHostname before persisting, so a bad host fails at config set time rather than at the next agent run.
…tent-prompt-injection
These design/plan docs are internal planning artifacts, not project files, and should not ship in the open-source repo.
Operational fields (search/filter, comboboxes) are classified from page-controlled attributes, so an attacker page could label its collector field as a search box and submit agent-typed data to its own host. Operational agent-filled submissions are now allowed only when the form action (and any submitter formaction override) is on the current page's host; unknown page host fails closed. Approved (request_user_data) fields are unaffected.
The FIREWALL_BLOCKED_NON_INTERACTIVE event types were added to events.ts without regenerating the committed schema artifact. The new check:schemas CI step caught the drift.
A caller passing --url is consent to interact with that site, so the firewall now trusts the start URL's host for fills/submissions. Only the explicitly caller-provided startingUrl is trusted — not planner-chosen or agent-navigated URLs, which are model/page-influenced.
…tent-prompt-injection Resolve import conflict in packages/cli/src/utils.ts (keep both BROWSERS and FIELDS/PiloConfig — all are used). Add fail-safe action-firewall introspection (getFieldMetadata/getFormSubmissionContext) to main's new BiDiBrowser so it satisfies the extended AriaBrowser interface; real BiDi introspection is a follow-up.
lmorchard
left a comment
There was a problem hiding this comment.
Looks good, works for me, passes evals without significant regression 👍
Five import-block conflicts in ariaBrowser-importing files (core.ts, bidiBrowser.ts, playwrightBrowser.ts, ExtensionBrowser.ts) plus one substantive conflict in webAgent.ts. - Import conflicts resolved by unioning both sides' type imports (SearchPage*/FindElements* from this branch + FieldMetadata/ FormSubmission* from main). - webAgent.ts: main refactored the post-action page-refresh decision into `WebAgent.shouldRefreshPageSnapshotAfterAction`, backed by a `ACTIONS_WITHOUT_PAGE_REFRESH` set. This branch's inline check excluded `search_page` and `find_elements` from refresh (they don't mutate the page). Took main's refactor and extended the set to include both new actions, preserving the original behavior. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Summary
Two-part hardening against web-content prompt injection. The first part (structural firewall) is the original scope; the second part (caller controls) was added so the firewall is shippable for non-search workflows.
Part 1 — Structural action firewall
Part 2 — Caller-supplied controls
trustedHostnames/--trusted-hostnames/PILO_TRUSTED_HOSTNAMES: bypass both fill and submit gates for sites where the caller has accepted the data risk. Bypass applies only when the current page hostname AND every form-action hostname (formaction+ submitterformactionoverride) are all in the list.unsafeMode/--unsafe/PILO_UNSAFE_MODE: global firewall disable, with prominent data-risk warnings on every surface.FIREWALL_BLOCKED_NON_INTERACTIVEevent: when a block fires in non-interactive mode, the CLI prints a structured remediation footer listing all three enable paths (add hostname, switch to interactive, enable unsafe mode). The footer is user-facing only — the model never sees the remediation text, so injected page content cannot ask the user to enable a bypass.WebAgentconstruction AND atpilo config set trusted_hostnames ...(vianormalizeHostname), so bad entries surface immediately.parseConfigValuebug wherestring[]config fields (trusted_hostnames,pw_cdp_endpoints) were stored as raw strings instead of arrays.Design + plan
docs/superpowers/specs/2026-05-28-firewall-bypass-controls-design.mddocs/superpowers/plans/2026-05-28-firewall-bypass-controls.mdTest Plan
pnpm run formatpnpm run format:checkpnpm run typecheckpnpm -r run test(1352 tests across all packages)gitleaks protect -v/gitleaks detect -vpnpm exec tsx scripts/verify-prompt-injection-firewall.ts(local uncommitted verifier; passes on this branch and is designed to fail on main)