Bump the development_dependencies group across 1 directory with 15 updates

[dependabot]

Bumps the development_dependencies group with 15 updates in the / directory:

Package	From	To
@changesets/cli	2.31.0	2.31.1
@nx/eslint-plugin	22.7.7	22.7.8
@nx/workspace	22.7.7	22.7.8
json-stringify-deterministic	1.0.14	1.0.16
nx	22.7.7	22.7.8
oclif	4.23.27	4.24.0
pin-github-action	3.5.1	3.5.2
vitest	4.1.10	4.1.11
@oclif/plugin-commands	4.1.60	4.2.0
@oclif/plugin-plugins	5.4.84	5.5.1
@shopify/cli-hydrogen	13.0.3	13.0.4
@types/lodash	4.17.24	4.17.25
node-stream-zip	1.15.0	1.16.0
@playwright/test	1.61.1	1.62.1
tsx	4.23.1	4.23.12

Updates @changesets/cli from 2.31.0 to 2.31.1

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​2.31.1

Patch Changes

• #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

Changelog

Sourced from @​changesets/cli's changelog.

2.31.1

Patch Changes

• #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

Commits

• e8650b9 Version Packages (#2161)
• 15cf592 Fixed handling of the npm 12 info output (#2159)
• See full diff in compare view

Updates @nx/eslint-plugin from 22.7.7 to 22.7.8

Release notes

Sourced from @​nx/eslint-plugin's releases.

22.7.8 (2026-07-30)

🩹 Fixes

• angular-rspack: dispose stylesheet bundler so one-shot builds exit (#35869)
• core: use workspace package manager when fetching migrations via install (#35866)
• core: omit peer dependencies when installing packages to a temp dir (#36295)
• core: prevent shell injection in nx import (#36348)
• core: stop passing git revisions through a shell in affected commands (#36379)
• core: allow nx build scripts in generated pnpm-workspace.yaml (#35564)
• core: acknowledge @​swc/core build script in generated pnpm-workspace.yaml (#35608)
• core: keep real dependencies when omitting peers from npm temp installs (#36518, #36295)
• core: bump pinned axios and brace-expansion past vulnerable versions (#36507, #36474)
• detox: resolve jest versions locally instead of importing @​nx/jest internals (3ce3f6ab6e)
• docker: run release pipeline docker commands without a shell (#36505)
• js: exclude typescript 7 from supported versions on 22.7.x (dc804964e9)
• js: resolve the verdaccio bin through its package.json (#36479)
• misc: use default import for chalk in @​nx/workspace output.ts (#35523, #35521, #34111, #21201, #26667)
• repo: use default inputs instead of the '...' token in nx-dev on 22.7.x (#35530)
• repo: trust wix/brew tap so macOS detox CI can install applesimutils (#36146)
• testing: seed typescript before plugins in e2e workspaces to avoid TS7 stub (7f5ffbfcbc)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz
• Jack Hsu @​jaysoo
• Jason Jean @​FrozenPandaz
• Jonathan Garvey @​jdgarvey
• Miroslav Jonaš @​meeroslav

Commits

• See full diff in compare view

Updates @nx/workspace from 22.7.7 to 22.7.8

Release notes

Sourced from @​nx/workspace's releases.

22.7.8 (2026-07-30)

🩹 Fixes

• angular-rspack: dispose stylesheet bundler so one-shot builds exit (#35869)
• core: use workspace package manager when fetching migrations via install (#35866)
• core: omit peer dependencies when installing packages to a temp dir (#36295)
• core: prevent shell injection in nx import (#36348)
• core: stop passing git revisions through a shell in affected commands (#36379)
• core: allow nx build scripts in generated pnpm-workspace.yaml (#35564)
• core: acknowledge @​swc/core build script in generated pnpm-workspace.yaml (#35608)
• core: keep real dependencies when omitting peers from npm temp installs (#36518, #36295)
• core: bump pinned axios and brace-expansion past vulnerable versions (#36507, #36474)
• detox: resolve jest versions locally instead of importing @​nx/jest internals (3ce3f6ab6e)
• docker: run release pipeline docker commands without a shell (#36505)
• js: exclude typescript 7 from supported versions on 22.7.x (dc804964e9)
• js: resolve the verdaccio bin through its package.json (#36479)
• misc: use default import for chalk in @​nx/workspace output.ts (#35523, #35521, #34111, #21201, #26667)
• repo: use default inputs instead of the '...' token in nx-dev on 22.7.x (#35530)
• repo: trust wix/brew tap so macOS detox CI can install applesimutils (#36146)
• testing: seed typescript before plugins in e2e workspaces to avoid TS7 stub (7f5ffbfcbc)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz
• Jack Hsu @​jaysoo
• Jason Jean @​FrozenPandaz
• Jonathan Garvey @​jdgarvey
• Miroslav Jonaš @​meeroslav

Commits

• 36cd492 fix(core): acknowledge @​swc/core build script in generated pnpm-workspace.yaml
• 31a9bdc fix(core): allow nx build scripts in generated pnpm-workspace.yaml (#35564)
• 23d2a55 fix(misc): use default import for chalk in @​nx/workspace output.ts (#35523)
• See full diff in compare view

Updates json-stringify-deterministic from 1.0.14 to 1.0.16

Release notes

Sourced from json-stringify-deterministic's releases.

v1.0.16

Full Changelog: Kikobeats/json-stringify-deterministic@v1.0.15...v1.0.16

v1.0.15

What's Changed

• build(deps): bump actions/setup-node from 6 to 7 by @​dependabot[bot] in Kikobeats/json-stringify-deterministic#29

Full Changelog: Kikobeats/json-stringify-deterministic@v1.0.14...v1.0.15

Changelog

Sourced from json-stringify-deterministic's changelog.

1.0.16 (2026-08-03)

1.0.15 (2026-07-30)

Commits

• 9788765 chore(release): 1.0.16
• 82d6a3a ci(dependabot): ignore actions minor/patch
• 7569546 chore(release): 1.0.15
• bb1c82f build: contributors
• edc795d chore: improve npm search metadata
• 5fd9744 build(deps): bump actions/setup-node from 6 to 7 (#29)
• See full diff in compare view

Updates nx from 22.7.7 to 22.7.8

Release notes

Sourced from nx's releases.

22.7.8 (2026-07-30)

🩹 Fixes

• angular-rspack: dispose stylesheet bundler so one-shot builds exit (#35869)
• core: use workspace package manager when fetching migrations via install (#35866)
• core: omit peer dependencies when installing packages to a temp dir (#36295)
• core: prevent shell injection in nx import (#36348)
• core: stop passing git revisions through a shell in affected commands (#36379)
• core: allow nx build scripts in generated pnpm-workspace.yaml (#35564)
• core: acknowledge @​swc/core build script in generated pnpm-workspace.yaml (#35608)
• core: keep real dependencies when omitting peers from npm temp installs (#36518, #36295)
• core: bump pinned axios and brace-expansion past vulnerable versions (#36507, #36474)
• detox: resolve jest versions locally instead of importing @​nx/jest internals (3ce3f6ab6e)
• docker: run release pipeline docker commands without a shell (#36505)
• js: exclude typescript 7 from supported versions on 22.7.x (dc804964e9)
• js: resolve the verdaccio bin through its package.json (#36479)
• misc: use default import for chalk in @​nx/workspace output.ts (#35523, #35521, #34111, #21201, #26667)
• repo: use default inputs instead of the '...' token in nx-dev on 22.7.x (#35530)
• repo: trust wix/brew tap so macOS detox CI can install applesimutils (#36146)
• testing: seed typescript before plugins in e2e workspaces to avoid TS7 stub (7f5ffbfcbc)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz
• Jack Hsu @​jaysoo
• Jason Jean @​FrozenPandaz
• Jonathan Garvey @​jdgarvey
• Miroslav Jonaš @​meeroslav

Commits

• f7afd77 fix(core): bump pinned axios and brace-expansion past vulnerable versions (#3...
• 983413b fix(core): keep real dependencies when omitting peers from npm temp installs ...
• 4159295 fix(core): stop passing git revisions through a shell in affected commands (#...
• cf99649 fix(core): prevent shell injection in nx import (#36348)
• 74311e7 fix(core): omit peer dependencies when installing packages to a temp dir (#36...
• 84beebc fix(core): use workspace package manager when fetching migrations via install...
• See full diff in compare view

Updates oclif from 4.23.27 to 4.24.0

Release notes

Sourced from oclif's releases.

4.24.0

Features

• bumping to eslint v10 (W-23473845) (4ea4d88)

4.23.32

Bug Fixes

• deps: bump @​oclif/plugin-warn-if-update-available (e1304d2)

4.23.31

Bug Fixes

• deps: bump @​oclif/plugin-not-found from 3.2.87 to 3.2.93 (7a2a295)

4.23.30

Bug Fixes

• deps: bump fast-uri from 3.1.4 to 3.1.5 (6a99532)

4.23.29

Bug Fixes

• deps: bump fast-uri from 3.1.2 to 3.1.4 (75894c9)

4.23.28

Bug Fixes

• pinned certain tests to TS6 (W-23513992) (#2076) (536f8cd)

Changelog

Sourced from oclif's changelog.

4.24.0 (2026-08-24)

Features

• bumping to eslint v10 (W-23473845) (4ea4d88)

4.23.32 (2026-08-24)

Bug Fixes

• deps: bump @​oclif/plugin-warn-if-update-available (e1304d2)

4.23.31 (2026-08-24)

Bug Fixes

• deps: bump @​oclif/plugin-not-found from 3.2.87 to 3.2.93 (7a2a295)

4.23.30 (2026-08-06)

Bug Fixes

• deps: bump fast-uri from 3.1.4 to 3.1.5 (6a99532)

4.23.29 (2026-07-25)

Bug Fixes

• deps: bump fast-uri from 3.1.2 to 3.1.4 (75894c9)

4.23.28 (2026-07-20)

Bug Fixes

• pinned certain tests to TS6 (W-23513992) (#2076) (536f8cd)

Commits

• 9de14c1 chore(release): 4.24.0 [skip ci]
• 0ea2014 Merge pull request #2079 from oclif/d/W-23473845
• 4ea4d88 feat: bumping to eslint v10 (W-23473845)
• 70f92fa chore(release): 4.23.32 [skip ci]
• bebf92c Merge pull request #2065 from oclif/dependabot-npm_and_yarn-oclif-plugin-warn...
• e1304d2 fix(deps): bump @​oclif/plugin-warn-if-update-available
• 27e346c chore(release): 4.23.31 [skip ci]
• 6d2e292 Merge pull request #2073 from oclif/dependabot-npm_and_yarn-oclif-plugin-not-...
• 7a2a295 fix(deps): bump @​oclif/plugin-not-found from 3.2.87 to 3.2.93
• b6b6a8b chore(release): 4.23.30 [skip ci]
• Additional commits viewable in compare view

Updates pin-github-action from 3.5.1 to 3.5.2

Release notes

Sourced from pin-github-action's releases.

v3.5.2

What's Changed

• fix: support new self-repository syntax by @​ivorisoutdoors in mheap/pin-github-action#220
• Update dependencies by @​mheap in mheap/pin-github-action#221

New Contributors

• @​ivorisoutdoors made their first contribution in mheap/pin-github-action#220

Full Changelog: mheap/pin-github-action@v3.5.1...v3.5.2

Commits

• c20721a 3.5.2
• 76c85e4 Update dependencies (#221)
• a396b25 fix: support new self-repository syntax (#220)
• See full diff in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

Updates @oclif/plugin-commands from 4.1.60 to 4.2.0

Release notes

Sourced from @​oclif/plugin-commands's releases.

4.2.0

Features

• bumping eslint to v10 (W-23473845) (#1169) (67d4bf6)

4.1.63

Bug Fixes

• deps: bump @​oclif/core from 4.13.2 to 4.13.3 (#1168) (7406def)

4.1.62

Bug Fixes

• deps: bump @​oclif/core from 4.13.0 to 4.13.2 (#1162) (21c4688)

4.1.61

Bug Fixes

• deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1159) (f20466f)

Changelog

Sourced from @​oclif/plugin-commands's changelog.

4.2.0 (2026-08-24)

Features

• bumping eslint to v10 (W-23473845) (#1169) (67d4bf6)

4.1.63 (2026-08-08)

Bug Fixes

• deps: bump @​oclif/core from 4.13.2 to 4.13.3 (#1168) (7406def)

4.1.62 (2026-08-01)

Bug Fixes

• deps: bump @​oclif/core from 4.13.0 to 4.13.2 (#1162) (21c4688)

4.1.61 (2026-07-25)

Bug Fixes

• deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1159) (f20466f)

Commits

• dedb507 chore(release): 4.2.0 [skip ci]
• 67d4bf6 feat: bumping eslint to v10 (W-23473845) (#1169)
• df00e13 chore(dev-deps): bump @​oclif/test from 4.1.21 to 4.1.22 (#1170)
• afeef2b chore(dev-deps): bump @​oclif/plugin-help from 6.2.56 to 6.2.58 (#1171)
• 4addd2f chore(dev-deps): bump oclif from 4.23.29 to 4.23.30 (#1172)
• 12e5223 chore(dev-deps): bump @​types/lodash from 4.17.24 to 4.17.25 (#1165)
• 9ed7221 chore(dev-deps): bump mocha from 11.7.6 to 11.8.0 (#1166)
• a580534 chore(dev-deps): bump @​oclif/plugin-help from 6.2.55 to 6.2.56 (#1167)
• 2f728ee chore(release): 4.1.63 [skip ci]
• 7406def fix(deps): bump @​oclif/core from 4.13.2 to 4.13.3 (#1168)
• Additional commits viewable in compare view

Updates @oclif/plugin-plugins from 5.4.84 to 5.5.1

Release notes

Sourced from @​oclif/plugin-plugins's releases.

5.5.1

Bug Fixes

• use process.execPath for .js module spawning on all platforms @​W-21984392@ (8b24637)

5.5.0

Features

• bumping eslint to v10 (W-23473845) (#1384) (7f322bc)

5.4.87

Bug Fixes

• pass cwd to npmRunPathEnv to prevent PATH hijack @​W-23797722@ (5450125)

5.4.86

Bug Fixes

• deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1372) (ff69aa0)

5.4.85

Bug Fixes

• deps: bump fast-uri from 3.1.2 to 3.1.4 (#1376) (03d03cd)

Changelog

Sourced from @​oclif/plugin-plugins's changelog.

5.5.1 (2026-08-20)

Bug Fixes

• use process.execPath for .js module spawning on all platforms @​W-21984392@ (8b24637)

5.5.0 (2026-08-19)

Features

• bumping eslint to v10 (W-23473845) (#1384) (7f322bc)

5.4.87 (2026-08-14)

Bug Fixes

• pass cwd to npmRunPathEnv to prevent PATH hijack @​W-23797722@ (5450125)

5.4.86 (2026-07-25)

Bug Fixes

• deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1372) (ff69aa0)

5.4.85 (2026-07-25)

Bug Fixes

• deps: bump fast-uri from 3.1.2 to 3.1.4 (#1376) (03d03cd)

Commits

• 9ef077f chore(release): 5.5.1 [skip ci]
• 4f293dd Merge pull request #1383 from oclif/wr/fixSpawnEnoentOnUnixTarballs
• 19efab1 chore(release): 5.5.0 [skip ci]
• 7f322bc feat: bumping eslint to v10 (W-23473845) (#1384)
• f546045 chore(release): 5.4.87 [skip ci]
• f312141 Merge pull request #1386 from oclif/wr/passCwdToNpmRunPathEnv
• 5450125 fix: pass cwd to npmRunPathEnv to prevent PATH hijack @​W-23797722@
• 37bdd2e test: add spaces-in-path coverage for spawn fix
• 8b24637 fix: use process.execPath for .js module spawning on all platforms @​W-21984392@
• 6ee1695 chore(dev-deps): bump oclif from 4.23.28 to 4.23.29 (#1377)
• Additional commits viewable in compare view

Updates @shopify/cli-hydrogen from 13.0.3 to 13.0.4

Release notes

Sourced from @​shopify/cli-hydrogen's releases.

@​shopify/cli-hydrogen@​13.0.4

Patch Changes

• New flag --javascript-origin override to hydrogen customer-account-push. Not providing it still defaults to --dev-origin. (#3938) by @​fredericoo

• Fix local Hydrogen CLI discovery so shopify hydrogen customer-account-push resolves to the local command implementation. (#3941) by @​fredericoo

• Recommend the Shopify AI Toolkit in newly scaffolded storefronts. (#3887) by @​gonzaloriestra

• Updated dependencies [28eb887f4787ece9b03bceae089cf2f060a7af77]:

  • @​shopify/mini-oxygen@​4.2.2

Commits

• See full diff in compare view

Updates @types/lodash from 4.17.24 to 4.17.25

Commits

• See full diff in compare view

Updates node-stream-zip from 1.15.0 to 1.16.0

Changelog

Sourced from node-stream-zip's changelog.

v1.16.0 (2026-07-22)

+ fixed reading compressed entry size to prevent exploitation reported by @​DumDumSu
* updated dependencies

Commits

• 2d9da01 release 1.16.0
• d6646bf up deps
• b9b496a fixed reading compressed entry size
• a050b3f fixed tests
• 7c5d503 readme
• c7cd392 removed a duplicated test
• f58b5b8 node.js 14
• 74f30a3 node.js 12
• 571f55b node.js 12
• See full diff in compare view

Updates @playwright/test from 1.61.1 to 1.62.1

Release notes

Sourced from @​playwright/test's releases.

v1.62.1

Bug Fixes

• #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });
</tr></table>

... (truncated)

Commits

• 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
• 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
• 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
• 66c5cc9 chore: mark v1.62.1 (#42020)
• 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
• 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
• 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• Additional commits viewable in compare view

Updates tsx from 4.23.1 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

... (truncated)

Commits

• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• b94f46f fix: support data URLs in tsImport
• Additional commits viewable in compare view