Bump the development_dependencies group across 1 directory with 15 updates

[dependabot]

Bumps the development_dependencies group with 15 updates in the / directory:

Package	From	To
@changesets/cli	2.31.0	2.31.1
@nx/eslint-plugin	22.7.7	22.7.8
@nx/workspace	22.7.7	22.7.8
json-stringify-deterministic	1.0.14	1.0.16
nx	22.7.7	22.7.8
oclif	4.23.27	4.23.30
pin-github-action	3.5.1	3.5.2
vitest	4.1.10	4.1.11
@oclif/plugin-commands	4.1.60	4.1.63
@oclif/plugin-plugins	5.4.84	5.5.1
@shopify/cli-hydrogen	13.0.3	13.0.4
@types/lodash	4.17.24	4.17.25
node-stream-zip	1.15.0	1.16.0
@playwright/test	1.61.1	1.62.1
tsx	4.23.1	4.23.12

Updates @changesets/cli from 2.31.0 to 2.31.1

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​2.31.1

Patch Changes

• #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

Changelog

Sourced from @​changesets/cli's changelog.

2.31.1

Patch Changes

• #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

Commits

• e8650b9 Version Packages (#2161)
• 15cf592 Fixed handling of the npm 12 info output (#2159)
• See full diff in compare view

Updates @nx/eslint-plugin from 22.7.7 to 22.7.8

Release notes

Sourced from @​nx/eslint-plugin's releases.

22.7.8 (2026-07-30)

🩹 Fixes

• angular-rspack: dispose stylesheet bundler so one-shot builds exit (#35869)
• core: use workspace package manager when fetching migrations via install (#35866)
• core: omit peer dependencies when installing packages to a temp dir (#36295)
• core: prevent shell injection in nx import (#36348)
• core: stop passing git revisions through a shell in affected commands (#36379)
• core: allow nx build scripts in generated pnpm-workspace.yaml (#35564)
• core: acknowledge @​swc/core build script in generated pnpm-workspace.yaml (#35608)
• core: keep real dependencies when omitting peers from npm temp installs (#36518, #36295)
• core: bump pinned axios and brace-expansion past vulnerable versions (#36507, #36474)
• detox: resolve jest versions locally instead of importing @​nx/jest internals (3ce3f6ab6e)
• docker: run release pipeline docker commands without a shell (#36505)
• js: exclude typescript 7 from supported versions on 22.7.x (dc804964e9)
• js: resolve the verdaccio bin through its package.json (#36479)
• misc: use default import for chalk in @​nx/workspace output.ts (#35523, #35521, #34111, #21201, #26667)
• repo: use default inputs instead of the '...' token in nx-dev on 22.7.x (#35530)
• repo: trust wix/brew tap so macOS detox CI can install applesimutils (#36146)
• testing: seed typescript before plugins in e2e workspaces to avoid TS7 stub (7f5ffbfcbc)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz
• Jack Hsu @​jaysoo
• Jason Jean @​FrozenPandaz
• Jonathan Garvey @​jdgarvey
• Miroslav Jonaš @​meeroslav

Commits

• See full diff in compare view

Updates @nx/workspace from 22.7.7 to 22.7.8

Release notes

Sourced from @​nx/workspace's releases.

22.7.8 (2026-07-30)

🩹 Fixes

• angular-rspack: dispose stylesheet bundler so one-shot builds exit (#35869)
• core: use workspace package manager when fetching migrations via install (#35866)
• core: omit peer dependencies when installing packages to a temp dir (#36295)
• core: prevent shell injection in nx import (#36348)
• core: stop passing git revisions through a shell in affected commands (#36379)
• core: allow nx build scripts in generated pnpm-workspace.yaml (#35564)
• core: acknowledge @​swc/core build script in generated pnpm-workspace.yaml (#35608)
• core: keep real dependencies when omitting peers from npm temp installs (#36518, #36295)
• core: bump pinned axios and brace-expansion past vulnerable versions (#36507, #36474)
• detox: resolve jest versions locally instead of importing @​nx/jest internals (3ce3f6ab6e)
• docker: run release pipeline docker commands without a shell (#36505)
• js: exclude typescript 7 from supported versions on 22.7.x (dc804964e9)
• js: resolve the verdaccio bin through its package.json (#36479)
• misc: use default import for chalk in @​nx/workspace output.ts (#35523, #35521, #34111, #21201, #26667)
• repo: use default inputs instead of the '...' token in nx-dev on 22.7.x (#35530)
• repo: trust wix/brew tap so macOS detox CI can install applesimutils (#36146)
• testing: seed typescript before plugins in e2e workspaces to avoid TS7 stub (7f5ffbfcbc)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz
• Jack Hsu @​jaysoo
• Jason Jean @​FrozenPandaz
• Jonathan Garvey @​jdgarvey
• Miroslav Jonaš @​meeroslav

Commits

• 36cd492 fix(core): acknowledge @​swc/core build script in generated pnpm-workspace.yaml
• 31a9bdc fix(core): allow nx build scripts in generated pnpm-workspace.yaml (#35564)
• 23d2a55 fix(misc): use default import for chalk in @​nx/workspace output.ts (#35523)
• See full diff in compare view

Updates json-stringify-deterministic from 1.0.14 to 1.0.16

Release notes

Sourced from json-stringify-deterministic's releases.

v1.0.16

Full Changelog: Kikobeats/json-stringify-deterministic@v1.0.15...v1.0.16

v1.0.15

What's Changed

• build(deps): bump actions/setup-node from 6 to 7 by @​dependabot[bot] in Kikobeats/json-stringify-deterministic#29

Full Changelog: Kikobeats/json-stringify-deterministic@v1.0.14...v1.0.15

Changelog

Sourced from json-stringify-deterministic's changelog.

1.0.16 (2026-08-03)

1.0.15 (2026-07-30)

Commits

• 9788765 chore(release): 1.0.16
• 82d6a3a ci(dependabot): ignore actions minor/patch
• 7569546 chore(release): 1.0.15
• bb1c82f build: contributors
• edc795d chore: improve npm search metadata
• 5fd9744 build(deps): bump actions/setup-node from 6 to 7 (#29)
• See full diff in compare view

Updates nx from 22.7.7 to 22.7.8

Release notes

Sourced from nx's releases.

22.7.8 (2026-07-30)

🩹 Fixes

• angular-rspack: dispose stylesheet bundler so one-shot builds exit (#35869)
• core: use workspace package manager when fetching migrations via install (#35866)
• core: omit peer dependencies when installing packages to a temp dir (#36295)
• core: prevent shell injection in nx import (#36348)
• core: stop passing git revisions through a shell in affected commands (#36379)
• core: allow nx build scripts in generated pnpm-workspace.yaml (#35564)
• core: acknowledge @​swc/core build script in generated pnpm-workspace.yaml (#35608)
• core: keep real dependencies when omitting peers from npm temp installs (#36518, #36295)
• core: bump pinned axios and brace-expansion past vulnerable versions (#36507, #36474)
• detox: resolve jest versions locally instead of importing @​nx/jest internals (3ce3f6ab6e)
• docker: run release pipeline docker commands without a shell (#36505)
• js: exclude typescript 7 from supported versions on 22.7.x (dc804964e9)
• js: resolve the verdaccio bin through its package.json (#36479)
• misc: use default import for chalk in @​nx/workspace output.ts (#35523, #35521, #34111, #21201, #26667)
• repo: use default inputs instead of the '...' token in nx-dev on 22.7.x (#35530)
• repo: trust wix/brew tap so macOS detox CI can install applesimutils (#36146)
• testing: seed typescript before plugins in e2e workspaces to avoid TS7 stub (7f5ffbfcbc)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz
• Jack Hsu @​jaysoo
• Jason Jean @​FrozenPandaz
• Jonathan Garvey @​jdgarvey
• Miroslav Jonaš @​meeroslav

Commits

• f7afd77 fix(core): bump pinned axios and brace-expansion past vulnerable versions (#3...
• 983413b fix(core): keep real dependencies when omitting peers from npm temp installs ...
• 4159295 fix(core): stop passing git revisions through a shell in affected commands (#...
• cf99649 fix(core): prevent shell injection in nx import (#36348)
• 74311e7 fix(core): omit peer dependencies when installing packages to a temp dir (#36...
• 84beebc fix(core): use workspace package manager when fetching migrations via install...
• See full diff in compare view

Updates oclif from 4.23.27 to 4.23.30

Release notes

Sourced from oclif's releases.

4.23.30

Bug Fixes

• deps: bump fast-uri from 3.1.4 to 3.1.5 (6a99532)

4.23.29

Bug Fixes

• deps: bump fast-uri from 3.1.2 to 3.1.4 (75894c9)

4.23.28

Bug Fixes

• pinned certain tests to TS6 (W-23513992) (#2076) (536f8cd)

Changelog

Sourced from oclif's changelog.

4.23.30 (2026-08-06)

Bug Fixes

• deps: bump fast-uri from 3.1.4 to 3.1.5 (6a99532)

4.23.29 (2026-07-25)

Bug Fixes

• deps: bump fast-uri from 3.1.2 to 3.1.4 (75894c9)

4.23.28 (2026-07-20)

Bug Fixes

• pinned certain tests to TS6 (W-23513992) (#2076) (536f8cd)

Commits

• b6b6a8b chore(release): 4.23.30 [skip ci]
• ca4c8fa Merge pull request #2078 from oclif/dependabot-npm_and_yarn-fast-uri-3.1.5
• 6a99532 fix(deps): bump fast-uri from 3.1.4 to 3.1.5
• 9aacfe5 chore(release): 4.23.29 [skip ci]
• e0d46cb Merge pull request #2077 from oclif/dependabot-npm_and_yarn-fast-uri-3.1.4
• 75894c9 fix(deps): bump fast-uri from 3.1.2 to 3.1.4
• 1ddad1c Merge pull request #2075 from MorielHarush/win-def
• 61edf2e aware users from defender
• b9ada83 chore(release): 4.23.28 [skip ci]
• 536f8cd fix: pinned certain tests to TS6 (W-23513992) (#2076)
• See full diff in compare view

Updates pin-github-action from 3.5.1 to 3.5.2

Release notes

Sourced from pin-github-action's releases.

v3.5.2

What's Changed

• fix: support new self-repository syntax by @​ivorisoutdoors in mheap/pin-github-action#220
• Update dependencies by @​mheap in mheap/pin-github-action#221

New Contributors

• @​ivorisoutdoors made their first contribution in mheap/pin-github-action#220

Full Changelog: mheap/pin-github-action@v3.5.1...v3.5.2

Commits

• c20721a 3.5.2
• 76c85e4 Update dependencies (#221)
• a396b25 fix: support new self-repository syntax (#220)
• See full diff in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

Updates @oclif/plugin-commands from 4.1.60 to 4.1.63

Release notes

Sourced from @​oclif/plugin-commands's releases.

4.1.63

Bug Fixes

• deps: bump @​oclif/core from 4.13.2 to 4.13.3 (#1168) (7406def)

4.1.62

Bug Fixes

• deps: bump @​oclif/core from 4.13.0 to 4.13.2 (#1162) (21c4688)

4.1.61

Bug Fixes

• deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1159) (f20466f)

Changelog

Sourced from @​oclif/plugin-commands's changelog.

4.1.63 (2026-08-08)

Bug Fixes

• deps: bump @​oclif/core from 4.13.2 to 4.13.3 (#1168) (7406def)

4.1.62 (2026-08-01)

Bug Fixes

• deps: bump @​oclif/core from 4.13.0 to 4.13.2 (#1162) (21c4688)

4.1.61 (2026-07-25)

Bug Fixes

• deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1159) (f20466f)

Commits

• 2f728ee chore(release): 4.1.63 [skip ci]
• 7406def fix(deps): bump @​oclif/core from 4.13.2 to 4.13.3 (#1168)
• e433679 chore(dev-deps): bump oclif from 4.23.28 to 4.23.29 (#1160)
• bee9900 chore(dev-deps): bump @​oclif/plugin-help from 6.2.53 to 6.2.55 (#1161)
• c8d05cd chore(release): 4.1.62 [skip ci]
• 21c4688 fix(deps): bump @​oclif/core from 4.13.0 to 4.13.2 (#1162)
• 623ff6c chore(dev-deps): bump @​oclif/test from 4.1.20 to 4.1.21 (#1163)
• 1de1310 chore(dev-deps): bump eslint-config-oclif from 6.0.177 to 6.0.179 (#1164)
• eb79ce9 chore(dev-deps): bump eslint-config-oclif from 6.0.176 to 6.0.177 (#1156)
• 84fa627 chore(dev-deps): bump oclif from 4.23.27 to 4.23.28 (#1157)
• Additional commits viewable in compare view

Updates @oclif/plugin-plugins from 5.4.84 to 5.5.1

Release notes

Sourced from @​oclif/plugin-plugins's releases.

5.5.1

Bug Fixes

• use process.execPath for .js module spawning on all platforms @​W-21984392@ (8b24637)

5.5.0

Features

• bumping eslint to v10 (W-23473845) (#1384) (7f322bc)

5.4.87

Bug Fixes

• pass cwd to npmRunPathEnv to prevent PATH hijack @​W-23797722@ (5450125)

5.4.86

Bug Fixes

• deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1372) (ff69aa0)

5.4.85

Bug Fixes

• deps: bump fast-uri from 3.1.2 to 3.1.4 (#1376) (03d03cd)

Changelog

Sourced from @​oclif/plugin-plugins's changelog.

5.5.1 (2026-08-20)

Bug Fixes

• use process.execPath for .js module spawning on all platforms @​W-21984392@ (8b24637)

5.5.0 (2026-08-19)

Features

• bumping eslint to v10 (W-23473845) (#1384) (7f322bc)

5.4.87 (2026-08-14)

Bug Fixes

• pass cwd to npmRunPathEnv to prevent PATH hijack @​W-23797722@ (5450125)

5.4.86 (2026-07-25)

Bug Fixes

• deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1372) (ff69aa0)

5.4.85 (2026-07-25)

Bug Fixes

• deps: bump fast-uri from 3.1.2 to 3.1.4 (#1376) (03d03cd)

Commits

• 9ef077f chore(release): 5.5.1 [skip ci]
• 4f293dd Merge pull request #1383 from oclif/wr/fixSpawnEnoentOnUnixTarballs
• 19efab1 chore(release): 5.5.0 [skip ci]
• 7f322bc feat: bumping eslint to v10 (W-23473845) (#1384)
• f546045 chore(release): 5.4.87 [skip ci]
• f312141 Merge pull request #1386 from oclif/wr/passCwdToNpmRunPathEnv
• 5450125 fix: pass cwd to npmRunPathEnv to prevent PATH hijack @​W-23797722@
• 37bdd2e test: add spaces-in-path coverage for spawn fix
• 8b24637 fix: use process.execPath for .js module spawning on all platforms @​W-21984392@
• 6ee1695 chore(dev-deps): bump oclif from 4.23.28 to 4.23.29 (#1377)
• Additional commits viewable in compare view

Updates @shopify/cli-hydrogen from 13.0.3 to 13.0.4

Release notes

Sourced from @​shopify/cli-hydrogen's releases.

@​shopify/cli-hydrogen@​13.0.4

Patch Changes

• New flag --javascript-origin override to hydrogen customer-account-push. Not providing it still defaults to --dev-origin. (#3938) by @​fredericoo

• Fix local Hydrogen CLI discovery so shopify hydrogen customer-account-push resolves to the local command implementation. (#3941) by @​fredericoo

• Recommend the Shopify AI Toolkit in newly scaffolded storefronts. (#3887) by @​gonzaloriestra

• Updated dependencies [28eb887f4787ece9b03bceae089cf2f060a7af77]:

  • @​shopify/mini-oxygen@​4.2.2

Commits

• See full diff in compare view

Updates @types/lodash from 4.17.24 to 4.17.25

Commits

• See full diff in compare view

Updates node-stream-zip from 1.15.0 to 1.16.0

Changelog

Sourced from node-stream-zip's changelog.

v1.16.0 (2026-07-22)

+ fixed reading compressed entry size to prevent exploitation reported by @​DumDumSu
* updated dependencies

Commits

• 2d9da01 release 1.16.0
• d6646bf up deps
• b9b496a fixed reading compressed entry size
• a050b3f fixed tests
• 7c5d503 readme
• c7cd392 removed a duplicated test
• f58b5b8 node.js 14
• 74f30a3 node.js 12
• 571f55b node.js 12
• See full diff in compare view

Updates @playwright/test from 1.61.1 to 1.62.1

Release notes

Sourced from @​playwright/test's releases.

v1.62.1

Bug Fixes

• #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });
</tr></table>

... (truncated)

Commits

• 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
• 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
• 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
• 66c5cc9 chore: mark v1.62.1 (#42020)
• 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
• 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
• 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• Additional commits viewable in compare view

Updates tsx from 4.23.1 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

... (truncated)

Commits

• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• b94f46f fix: support data URLs in tsImport
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions