build(deps-dev): bump the npm-development group across 1 directory with 6 updates

[dependabot]

Bumps the npm-development group with 5 updates in the /apps/web directory:

Package	From	To
@playwright/test	1.62.0	1.63.0
@testing-library/react	16.3.2	16.3.3
@types/react	19.2.17	19.2.18
@types/react-dom	19.2.3	19.2.7
@vitest/coverage-v8	4.1.10	4.1.11

Updates @playwright/test from 1.62.0 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

Updates @types/react-dom from 19.2.3 to 19.2.7

Commits

• See full diff in compare view

Updates @vitest/coverage-v8 from 4.1.10 to 4.1.11

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• See full diff in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cursor]

Approved. Cursor Security Agent completed with no findings that need human review; Cursor Bugbot was not present on this PR. adriannoes is already assigned as reviewer; no additional reviewers were added.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Summary

ASAP Protocol is a production agent-to-agent stack: Python 3.13 / FastAPI / Pydantic in src/asap, with a Next.js 16 App Router site under apps/web. This Dependabot PR only touches web devDependencies (apps/web/package.json and package-lock.json, +76/−94). It is a grouped monthly bump: Playwright 1.63.0, Testing Library 16.3.3, React type packages, and Vitest 4.1.11. No application code, production dependencies, or Python lockfile changes.

Lockfile versions are internally consistent (@playwright/test / playwright / playwright-core all 1.63.0; the Vitest family all 4.1.11, with registry integrity hashes). quality (web) (lint, tsc, next build, both npm audits) and test (web) are green on this head. No merge blockers in the diff.

Must Fix

None.

Should Fix

1. Raise the Vitest caret so GHSA-82fw cannot regress. apps/web/package.json moves @vitest/coverage-v8 to ^4.1.11 (line 84) but leaves vitest at ^4.1.6 (line 96). The lockfile correctly pins vitest and @vitest/mocker at 4.1.11, which patches GHSA-82fw-gwwq-j7x9 / CVE-2026-84373 (medium, CVSS 5.9: path traversal via redirect mocks). A later npm update inside the old range can land 4.1.10 again. Set vitest to ^4.1.11 so the floor matches the coverage-v8 peer. This app uses environment: 'jsdom' in vitest.config.ts and does not enable @vitest/browser or export mockerPlugin, so practical risk here is low; npm ci already installs the patched lockfile.

2. Local Playwright browsers after 1.63.0. 1.63.0 ships Chromium 153 / Firefox 155 / WebKit 26.6. Required CI does not run Playwright (quality (web) and test (web) cover lint/tsc/build/audit and Vitest only). After merge, local npm run test:e2e needs npx playwright install as documented in apps/web/docs/playwright-e2e.md. Not a merge blocker.

Nice to Have

• Playwright 1.63 drops Ubuntu 20.04 and stops updating @playwright/experimental-ct-*. CI is ubuntu-latest; this repo does not use the experimental CT packages. No action.
• playwright 1.63 dropped the darwin-only optional fsevents@2.3.2 edge. Vite still carries fsevents@2.3.3. Expected, and Linux CI is unaffected.
• apps/web/pnpm-lock.yaml still lists Playwright 1.58.2 / Next 16.2.4. Pre-existing; CI uses npm + package-lock.json.

Positive Highlights

• Grouped npm-development update with no production graph churn. next and eslint-config-next stay aligned at 16.3.4 (the #330 linter/runtime skew is gone on this base).
• Vitest 4.1.11 closes GHSA-82fw. @testing-library/react 16.3.3 fixes act() re-entrancy (testing-library/react-testing-library#1468).
• Playwright 1.62 → 1.63 is additive for this tree: no :visible CSS, no frameLocator() without a selector, no experimental component-testing packages. playwright.config.ts (fullyParallel, Chromium/Firefox/WebKit/Mobile Chrome) does not need changes for the new lock/visible-locator APIs.
• quality (web) passed including the next build step added on the #339 base, plus npm audit --omit=dev --audit-level=moderate and npm audit --audit-level=high. test (web) passed Vitest and coverage thresholds.

CI at review

Check	Result
quality (web)	pass (lint, tsc, next build, both audits)
test (web)	pass
quality (python)	pass
security	pass
lint transport growth (D4)	pass
test (python) / coverage	still running; not in this diff

  

_{Sent by Cursor Automation: Adrianno’s personal code review}

[cursor]

@vitest/coverage-v8 4.1.11 peers vitest@4.1.11. The lockfile already resolves vitest and @vitest/mocker to 4.1.11 (GHSA-82fw-gwwq-j7x9 / CVE-2026-84373). package.json still has "vitest": "^4.1.6" a few lines below, which still admits 4.1.10. Raise that caret to ^4.1.11 so a later lock refresh cannot regress the mocker path-traversal fix.

Not a merge blocker: this app runs Vitest in jsdom, not browser mode, and npm ci uses the lockfile.

[adriannoes]

Superseded by human-authored #349 (GitHub Actions + apps/web npm groups rewritten onto development; no Dependabot authorship). Closing this bot PR without merging.

[adriannoes]

Closing as superseded by #349.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml