chore: bump up all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@clack/prompts (source)	^0.9.0 -> ^0.10.0					dependencies	minor
@graphql-codegen/cli (source)	5.0.3 -> 5.0.4					devDependencies	patch
@napi-rs/cli	3.0.0-alpha.68 -> 3.0.0-alpha.70					devDependencies	patch
@playwright/test (source)	=1.49.1 -> =1.50.1					devDependencies	minor
@playwright/test (source)	=1.49.1 -> =1.50.1					dependencies	minor
@shoelace-style/shoelace	2.19.1 -> 2.20.0					dependencies	minor
@vitest/browser (source)	3.0.4 -> 3.0.5					devDependencies	patch
@vitest/coverage-istanbul (source)	3.0.2 -> 3.0.5					devDependencies	patch
@vitest/ui (source)	3.0.2 -> 3.0.5					devDependencies	patch
apollographql/apollo-ios	from: "1.16.0" -> from: "1.17.0"						minor
gradle (source)	8.12 -> 8.12.1						patch
lucide-react (source)	^0.473.0 -> ^0.474.0					dependencies	minor
node (source)	22.13.0 -> 22.13.1						patch
playwright (source)	=1.49.1 -> =1.50.1					devDependencies	minor
react-email (source)	3.0.4 -> 3.0.6					devDependencies	patch
swr (source)	2.3.0 -> 2.3.2					dependencies	patch
vite (source)	6.0.9 -> 6.1.0					resolutions	minor
com.apollographql.apollo	4.1.0 -> 4.1.1					plugin	patch
com.apollographql.apollo:apollo-api	4.1.0 -> 4.1.1					dependencies	patch
com.apollographql.apollo:apollo-runtime	4.1.0 -> 4.1.1					dependencies	patch
org.jetbrains.kotlin.jvm (source)	2.1.0 -> 2.1.10					plugin	patch
org.jetbrains.kotlin.android (source)	2.1.0 -> 2.1.10					plugin	patch

---

Release Notes

natemoo-re/clack (@​clack/prompts)

v0.10.0

Compare Source

Minor Changes

• 613179d: Adds a new indicator option to spinner, which supports the original "dots" loading animation or a new "timer" loading animation.

  import * as p from "@​clack/prompts";
  
  const spin = p.spinner({ indicator: "timer" });
  spin.start("Loading");
  await sleep(3000);
  spin.stop("Loaded");

• a38b2bc: Adds stream API which provides the same methods as log, but for iterable (even async) message streams. This is particularly useful for AI responses which are dynamically generated by LLMs.

  import * as p from "@​clack/prompts";
  
  await p.stream.step(
    (async function* () {
      yield* generateLLMResponse(question);
    })()
  );

dotansimha/graphql-code-generator (@​graphql-codegen/cli)

v5.0.4

Compare Source

Patch Changes

• #​10248 72eb86f Thanks @​renovate! - dependencies updates:

  • Updated dependency @whatwg-node/fetch@^0.10.0 ↗︎ (from ^0.9.20, in dependencies)

• #​10227 6f1741a Thanks @​eddeee888! - Fix schema pointers type to allow an array of pointers

• Updated dependencies [8737dd8, ed71811]:

  • @​graphql-codegen/client-preset@​4.6.0

napi-rs/napi-rs (@​napi-rs/cli)

v3.0.0-alpha.70

Compare Source

v3.0.0-alpha.69

Compare Source

microsoft/playwright (@​playwright/test)

v1.50.1

Compare Source

v1.50.0

Compare Source

Test runner

• New option timeout allows specifying a maximum run time for an individual test step. A timed-out step will fail the execution of the test.

  test('some test', async ({ page }) => {
    await test.step('a step', async () => {
      // This step can time out separately from the test
    }, { timeout: 1000 });
  });

• New method test.step.skip() to disable execution of a test step.

  test('some test', async ({ page }) => {
    await test.step('before running step', async () => {
      // Normal step
    });
  
    await test.step.skip('not yet ready', async () => {
      // This step is skipped
    });
  
    await test.step('after running step', async () => {
      // This step still runs even though the previous one was skipped
    });
  });

• Expanded expect(locator).toMatchAriaSnapshot() to allow storing of aria snapshots in separate YAML files.

• Added method expect(locator).toHaveAccessibleErrorMessage() to assert the Locator points to an element with a given aria errormessage.

• Option testConfig.updateSnapshots added the configuration enum changed. changed updates only the snapshots that have changed, whereas all now updates all snapshots, regardless of whether there are any differences.

• New option testConfig.updateSourceMethod defines the way source code is updated when testConfig.updateSnapshots is configured. Added overwrite and 3-way modes that write the changes into source code, on top of existing patch mode that creates a patch file.

  npx playwright test --update-snapshots=changed --update-source-method=3way

• Option testConfig.webServer added a gracefulShutdown field for specifying a process kill signal other than the default SIGKILL.

• Exposed testStep.attachments from the reporter API to allow retrieval of all attachments created by that step.

UI updates

• Updated default HTML reporter to improve display of attachments.
• New button for picking elements to produce aria snapshots.
• Additional details (such as keys pressed) are now displayed alongside action API calls in traces.
• Display of canvas content in traces is error-prone. Display is now disabled by default, and can be enabled via the Display canvas content UI setting.
• Call and Network panels now display additional time information.

Breaking

• expect(locator).toBeEditable() and locator.isEditable() now throw if the target element is not <input>, <select>, or a number of other editable elements.
• Option testConfig.updateSnapshots now updates all snapshots when set to all, rather than only the failed/changed snapshots. Use the new enum changed to keep the old functionality of only updating the changed snapshots.

Browser Versions

• Chromium 133.0.6943.16
• Mozilla Firefox 134.0
• WebKit 18.2

This version was also tested against the following stable channels:

• Google Chrome 132
• Microsoft Edge 132

shoelace-style/shoelace (@​shoelace-style/shoelace)

v2.20.0

Compare Source

Commits

• 7fd18d1: Modify ja.ts (#​2329) (jz5) #​2329
• c16c533: update changelog (Cory LaViska)
• 7f88bb3: Svelte documentation: adding Two-way Binding example in (#​2327) (Emanuel Saramago) #​2327
• b5e82d6: update docs (Cory LaViska)
• 81e94f2: Only trigger defaultslotchange of select after initialization (#​2318) (Susanne Kirchner) #​2318
• f0c93d0: update changelog (Cory LaViska)
• 6761fdc: Merge branch 'next' of https://github.com/shoelace-style/shoelace into next (Cory LaViska)
• b0399ca: fix tabbable for radios (#​2357) (Konnor Rogers) #​2357
• 372ba1f: fix ssr for sl-alert and scrollend-polyfill (#​2359) (Christian Schilling) #​2359
• 69cf94b: Explain why dividers don't show if you use TailwindCSS and add a workaround. (#​2356) (Marcus) #​2356
• b5f308c: move to section (Cory LaViska)
• cb6460c: update action (Cory LaViska)
• d93ee89: add changelog check (Cory LaViska)
• 0bc6d8c: fix error (Cory LaViska)
• c3b1fb9: try again (Cory LaViska)
• fce7f7c: fix comment (Cory LaViska)
• afc2b06: sigh (Cory LaViska)
• 03f8464: ahem (Cory LaViska)
• 471e6cc: somebody save me (Cory LaViska)
• c858a3a: yaml was a mistake (Cory LaViska)
• 5e11687: save me tarides (Cory LaViska)
• 4530ba3: welp (Cory LaViska)
• d674577: not today i guess (Cory LaViska)
• ca8a12b: maybe, just maybe (Cory LaViska)
• 74dafea: somebody save me (Cory LaViska)
• 39e4557: ok konnor (Cory LaViska)
• d45e6df: revert (Cory LaViska)
• e3b117d: i'll get you next time gadget! next time... (Cory LaViska)
• a7aadc9: SlSplitPanel snap improvements. (#​2340) (Auri Collings) #​2340
• bb8f16a: fix code field (Cory LaViska)
• ee7aa09: update changelog (Cory LaViska)
• ff34da1: prettier (Cory LaViska)
• de371b3: update version (Cory LaViska)
• 960de96: 2.20.0 (Cory LaViska)

vitest-dev/vitest (@​vitest/browser)

v3.0.5

Compare Source

This release includes security patches for:

• Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964

🚀 Features

• ui: Insert message "no tests found" in ui - by @​DevJoaoLopes in https://github.com/vitest-dev/vitest/issues/7366 (92da4)

🐞 Bug Fixes

• Validate websocket request - by @​hi-ogawa and @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/7317 (191ef)
• Don't toggle cli cursor on non-TTY - by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/7336 (3c805)
• vite-node: Differentiate file url with hash and query - by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7365 (926ca)

View changes on GitHub

apollographql/apollo-ios (apollographql/apollo-ios)

v1.17.0

Compare Source

New

• Add suffix to schema type filenames (#​2598): When fragments were named the same as schema types code generation would produce two files with the same name, but at different paths, for each respective type. This would cause a build error in Xcode. There is a new codegen configuration option (appendSchemaTypeFilenameSuffix) to add a suffix to schema generated filenames and prevent the build error. See PR #​580.
• Specify caching fields with typePolicy directive (#​554): The @typePolicy directive lets you specify an object's cache ID using key fields of the response object. See the documentation for full details. Thank you to @​x-sheep for the contribution.
• Emit Identifiable conformance on SelectionSet (#​584): If the @typePolicy of a type uses a keyField of id the selection set will emit conformance to Swifts Identifiable protocol. Thank you to @​x-sheep for the contribution.

Improvement

• Improved performance of code generation on operations with many nested fragments (#​3434): When fragment field merging is disabled the fragment selection trees are no longer merged into the EntitySelectionSet while building operations. See PR #​571.

Fixed

• Defer metadata extension (#​3505): Metadata extensions for deferred selection sets were incorrectly generated inside the namespace extension for embeddedInTarget and other module types. See PR #​581.
• DataDict initialization of deferredFragments for named fragments (#​587): When deferred fragments are named fragments the deferred type should be the fragment generated definition name.

v1.16.1

Compare Source

Fixed

• Web socket data race crash fixed (#​578): A data race in the web socket layer was causing crashes in some rare circumstances.

• Added support for GraphQL over HTTP media type(#​558): Apollo iOS now supports the content-type header with a type of application/graphql-response+json.

gradle/gradle (gradle)

v8.12.1

Compare Source

lucide-icons/lucide (lucide-react)

v0.474.0: New icons 0.474.0

Compare Source

Modified Icons 🔨

• expand (#​2677) by @​jguddas

nodejs/node (node)

v22.13.1

Compare Source

resend/react-email (react-email)

v3.0.6

Compare Source

Patch Changes

• c6fcd94: Fix preview server crashing without React 19

v3.0.5

Compare Source

Patch Changes

• 7337d04: Fix emails being re-rendered each time there is navigation in the preview server

vercel/swr (swr)

v2.3.2

Compare Source

v2.3.1

Compare Source

Fixes

• fix: missing throwOnError in SWRMutationHook options by @​Ram4GB in https://github.com/vercel/swr/pull/3054
• fix: sever env detection for deno by @​elrrrrrrr in https://github.com/vercel/swr/pull/4064
• keepPreviousData: return fallback instead of undefined value by @​dvoytenko in https://github.com/vercel/swr/pull/4084

Misc

• ci: update pnpm setup and lock pnpm vesion by @​huozhi in https://github.com/vercel/swr/pull/4085
• build: bump bundler by @​huozhi in https://github.com/vercel/swr/pull/4086
• refactor: type improvement of useSWRHandler by @​samuel871211 in https://github.com/vercel/swr/pull/4075

New Contributors

• @​Ram4GB made their first contribution in https://github.com/vercel/swr/pull/3054
• @​elrrrrrrr made their first contribution in https://github.com/vercel/swr/pull/4064
• @​dvoytenko made their first contribution in https://github.com/vercel/swr/pull/4084
• @​samuel871211 made their first contribution in https://github.com/vercel/swr/pull/4075

Full Changelog: vercel/swr@v2.3.0...v2.3.1

vitejs/vite (vite)

v6.1.0

Compare Source

• refactor: deprecate vite optimize command (#​19348) (6e0e3c0), closes #​19348
• feat: show hosts in cert in CLI (#​19317) (a5e306f), closes #​19317
• feat: support for env var for defining allowed hosts (#​19325) (4d88f6c), closes #​19325
• feat: use native runtime to import the config (#​19178) (7c2a794), closes #​19178
• fix: avoid builtStart during vite optimize (#​19356) (fdb36e0), closes #​19356
• fix(build): fix stale build manifest on watch rebuild (#​19361) (fcd5785), closes #​19361

v6.0.11

Compare Source

• fix: preview.allowedHosts with specific values was not respected (#​19246) (aeb3ec8), closes #​19246
• fix: allow CORS from loopback addresses by default (#​19249) (3d03899), closes #​19249

v6.0.10

Compare Source

• fix: try parse server.origin URL (#​19241) (2495022), closes #​19241

apollographql/apollo-kotlin (com.apollographql.apollo)

v4.1.1

2025-01-24

Kotlin 2.1.0 (#​6291)

The artifacts are now compiled with Kotlin 2.1.0. This change should be transparent for JVM and Android users thanks to languageVersion but requires klib consumers (native + JS) to update their KGP version to 2.1.0.

Rover LSP support in the IntelliJ plugin (#​6274)

The IntelliJ plugin now has a dedicated mode for backend developers that uses Rover LSP (Language Server Protocol) to parse federation and connectors directives. This mode is only available when using IntelliJ Ultimate and other IDEs with LSP support. It is recommended for subgraphs authors.

Gradle isolated projects support (#​6351)

This release supports Gradle isolated projects for shorter configuration times.

Contributors 💙💙

Many thanks to @​jvanderwee, @​varahash, @​whyoleg, @​StylianosGakis and @​scana for all the contributions and help in this release 💙!

👷‍♂️ All changes

• [all] Do not set the license URL in the POMs (#​6247)
• [all] Bump Kotlin to 2.1.0 (#​6291)
• [all] Bump atomicfu (#​6245)
• [intellij-plugin] Play nice with IDEs without Kotlin/Gradle (#​6358)
• [intellij-plugin] Reduce usage of GradleExecutionHelper (#​6355)
• [intellij-plugin] Use our own executeOnPooledThread instead of Android Plugin's (#​6310)
• [intellij-plugin] Make Java and Kotlin dependencies optional (#​6304)
• [intellij-plugin] Pass arguments to rover (#​6303)
• [intellij-plugin] Move Rover settings to own section and add note about needing v0.27.0+ (#​6278)
• [intellij-plugin] Remove untilBuild (#​6279)
• [intellij-plugin] Add support for the Apollo LSP via Rover (#​6274)
• [intellij-plugin] Don't reference AdbShellCommandsUtil.executeCommandBlocking that's been removed (#​6268)
• [intellij-plugin] Make verifyPlugin fail on certain problems (#​6256)
• [intellij-plugin] Do not use internal symbol (#​6255)
• [intellij-plugin] Add explicit dependency to com.intellij.modules.json (#​6254)
• [gradle-plugin] Add a fail-safe mode to disable 2-step introspection and use minimal introspection query (#​6360)
• [gradle-plugin] Isolated Projects support (#​6351)
• [gradle-plugin] expose the outgoing variants (#​6329)
• [gradle-plugin] Better Gradle error message (#​6326)
• [gradle-plugin] Fix classloader caching. Many thanks @​scana for catching this (#​6309)
• [gradle-plugin] Manage our classloaders manually (#​6305)
• [gradle-plugin] Only call onSchema() once in multi-module scenrios (#​6252)
• [runtime] Copy executionContext inside HttpRequest.newBuilder (#​6350)
• [runtime] Apple HttpEngine: lock the handlers map (#​6348)
• [runtime] Allow to initialize WebSocketEngine lazily (#​6290)
• [runtime] Remove CloseableBackgroundDispatcher and bump coroutines version (#​6286)
• [runtime] Override JsonNumber.toString() (#​6273)
• [runtime] Implement ApolloWebSocketClosedException on darwin targets and update docs (#​6275)
• [ast] Make deprecation.reason non-nullable (#​6311)
• [ast] Allow multiple @​link schema extensions (#​6284)
• [normalized-cache] Add ApolloStore.ALL_KEYS to notify all watchers (#​6337)
• [http-cache] HTTP cache: do not remove cached entries on transport errors (#​6314)
• [execution] Add apollo-execution (#​6356)

JetBrains/kotlin (org.jetbrains.kotlin.jvm)

v2.1.10

Compiler

• KT-73858 Compose / iOS: NullPointerException on building
• KT-73454 K2: Fix type parameters mapping for typealiases with inner RHS
• KT-73043 K2 Compiler does not allow references to inner constructors with typealiases
• KT-74040 Compilation of inner class usage does not check the visibility of parent class during compilation in different rounds
• KT-73339 K2: "VerifyError: Bad type on operand stack" because of missing implicit cast on generic field receiver with star projection
• KT-72585 K2: Compilation failure when upgrading to Kotlin 2.0.20+: Cannot replace top-level type with star projection: S
• KT-73399 compile-time JVM codegen failure on a KProperty argument of a KSuspendFunction parameter
• KT-72725 KMP: Unsupported actualization of inherited java field in expect class
• KT-73153 K2: Standalone diagnostics on type arguments are not reported

Compose compiler

• CMP-5680 Compose compiler: unexpected stability warnings for classes compiled with 2.0.10
• b/381407900 Avoid adding Compose annotations on synthetic classes

IR. Inlining

• KT-73981 Cherry-pick the fix for KT-73482 to 2.1.10

JavaScript

• KT-70778 Kotlin Js companion is undefined in production build
• KT-73130 KJS: Missed break for do/while in generated JS code
• KT-58797 Optimize the code generated for objects on JS and Wasm backends

Klibs

• KT-70146 [KLIB Resolve] Don't fail on nonexistent transitive dependency
• KT-73951 Workaround for "Partial linkage engine may not patch some discrepancies in IR when compiling Kotlin/Native static caches" in 2.1.10

Native

• KT-73559 K/Native: AndroidNativeArm64 linking fails starting from Kotlin 2.1.0

Tools. CLI

• KT-73967 JDK 25: "IllegalArgumentException: 25-ea" with EA builds

Tools. Daemon

• KT-73311 "Unable to release compile session, maybe daemon is already down" flakiness

Tools. Gradle

• KT-73728 'generatePomFileForMavenPublication' creates pom with dependencies with 'unspecified' version

Tools. Gradle. Multiplatform

• KT-73620 KMP 2.1.0: Transitive dependency is broken when setting publication groupId

Tools. Gradle. Native

• KT-73572 [Gradle] kotlin.native.cacheKind=none doesn't work anymore
• KT-71419 Light bundle KGP IT run against a stable K/N version

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[graphite-app]

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

• merge - adds this PR to the back of the merge queue
• hotfix - for urgent hot fixes, skip the queue and merge this PR next

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 53.44%. Comparing base (d3843d8) to head (f00fb32).
Report is 2 commits behind head on canary.

Additional details and impacted files

@@            Coverage Diff             @@
##           canary    #9810      +/-   ##
==========================================
- Coverage   53.65%   53.44%   -0.21%     
==========================================
  Files        2261     2261              
  Lines      103821   103821              
  Branches    17243    17197      -46     
==========================================
- Hits        55702    55488     -214     
- Misses      46207    46971     +764     
+ Partials     1912     1362     -550     

Flag	Coverage Δ
server-test	77.16% <ø> (-0.69%)	⬇️
unittest	31.84% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[graphite-app]

Merge activity

• Jan 21, 10:02 AM EST: A user added this pull request to the Graphite merge queue.
• Jan 21, 10:38 AM EST: The Graphite merge queue couldn't merge this PR because it was not satisfying all requirements (Failed CI: '3, 2, 1 Launch', 'E2E Test (3)', 'Unit Test (1)', 'Unit Test (2)', 'Unit Test (3)', 'Unit Test (4)', 'Unit Test (5)').
• Feb 5, 11:56 PM EST: The merge label 'merge' was detected. This PR will be added to the Graphite merge queue once it meets the requirements.
• Feb 5, 11:56 PM EST: A user added this pull request to the Graphite merge queue.
• Feb 6, 12:24 AM EST: A user merged this pull request with the Graphite merge queue.

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher

View full report↗︎

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.