[dependabot]

Bumps the web-minor-and-patch group in /core/grantforge-web with 12 updates:

Package	From	To
pinia	4.0.3	4.1.0
vue	3.5.43	3.5.44
vue-i18n	11.4.12	11.4.16
@playwright/test	1.63.0	1.64.1
@vitejs/plugin-vue	6.0.9	6.0.10
eslint	10.11.0	10.13.0
eslint-plugin-vue	10.11.1	10.12.0
globals	17.12.0	17.13.0
typescript-eslint	8.71.0	8.72.1
vite	8.3.4	8.3.5
vitest	5.0.4	5.0.5
vue-tsc	3.3.11	3.3.13

Updates pinia from 4.0.3 to 4.1.0

Commits

• 270a217 release: pinia@4.1.0 @​pinia/testing@​2.0.2 @​pinia/nuxt@​1.0.3
• bf7ea46 feat: warn when disposing a replaced store (#3193)
• fddd7c5 test: unused
• 52fc965 feat: add getStores() (#3194)
• f48737e docs: fix links to heading anchors that use the wrong case (#3189)
• 668e881 refactor(nuxt): upgrade module for Nuxt 4.6 (#3188)
• a158186 fix(testing): notify shallow refs on initial state (#3187)
• 98587ca fix(nuxt): resolve default storesDirs against each layer (#3185)
• f4e0cb7 docs: fix dead Vue Devtools installation link (#3181)
• a4eb2c5 fix: trigger shallow refs patched via object syntax (fix #2861) (#3177)
• Additional commits viewable in compare view

Updates vue from 3.5.43 to 3.5.44

Release notes

Sourced from vue's releases.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.44 (2026-10-13)

Bug Fixes

• compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)
• compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723
• compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)
• compiler-dom: inject transition persisted for v-show in production (#15783) (89cb272)
• compiler-sfc: error when defineModel prop options reference a destructured prop (#15604) (38012a5), closes #15602
• custom-element: skip mounting an async custom element removed while its component loads (#15777) (0f8e7b4), closes #15775
• hydration: observe children of a display: contents root in hydrateOnVisible (#15773) (7f688e8)
• KeepAlive: unmount pruned current component when its vnode was cloned on mount (#15711) (92798ac), closes #15710
• reactivity: avoid mutating native array iterators (#15703) (7f9d45d), closes #15643
• reactivity: do not track deps in watcher callbacks run inside another effect (#15782) (db00fe9), closes #5009
• reactivity: once watcher should stop when its callback throws (#15755) (ae4bd94)
• reactivity: preserve shallow collection semantics (#15793) (b600466), closes #15792
• runtime-core: detect new prop keys when comparing full props (#15634) (702fa61), closes #15632
• runtime-core: keep async placeholder for block patching and pending component updates (#15554) (05ec25f), closes #15551
• runtime-core: only flush jobs queued by the root render itself (#15757) (0bea14b), closes #6728
• runtime-core: render nothing for an invalid v-for range in production (#15742) (ad19e7d)
• runtime-dom: preserve v-show display for unchanged style strings (#15794) (c0a6d3f)
• runtime-dom: treat playsinline as a boolean attribute (#15627) (a084e44)
• server-renderer: propagate async setup errors (#15857) (6930374), closes #15716
• ssr: honor falsy vnode content overrides (#15769) (c11c5c8)
• suspense: mount resolved async component with its own namespace (#15640) (2a086a2), closes #15639
• suspense: skip rendering async components unmounted while pending (4ab865a)
• teleport: move targetStart and keep children before targetAnchor (#15818) (d3c6e02), closes #15817
• transition-group: measure nested groups against their moving outer item (#15848) (1936c87), closes #5385 #1531
• transition: handle comment-wrapped component roots (#15853) (ff35014), closes #6080 #5500

Commits

• bf5f0dd release: v3.5.44
• 6930374 fix(server-renderer): propagate async setup errors (#15857)
• 8e8c547 chore(deps): update all non-major dependencies (#15585)
• 4cb0ca8 chore(deps): update playground (#15685)
• e38478f chore(deps): update dawidd6/action-download-artifact action to v27 (#15768)
• 1caed5a chore(deps): update compiler (#15586)
• a49f451 chore(deps): update lint (#15680)
• 219b858 chore(deps): update build (#15679)
• ff35014 fix(transition): handle comment-wrapped component roots (#15853)
• d084b90 fix(compiler-core): parenthesise v-for key in v-memo cache guard (#15724)
• Additional commits viewable in compare view

Updates vue-i18n from 11.4.12 to 11.4.16

Release notes

Sourced from vue-i18n's releases.

v11.4.16

What's Changed

🐛 Bug Fixes

• fix: read VUE_PROD_DEVTOOLS only when it is defined in the bundler builds, so that Node.js can run them in production by @​kazupon in intlify/vue-i18n#2735

Full Changelog: intlify/vue-i18n@v11.4.15...v11.4.16

v11.4.15

What's Changed

🐛 Bug Fixes

• fix: read only own properties in locale, key and plural rule lookups by @​kazupon in intlify/vue-i18n#2687
• fix: return a message that cannot be compiled as is, in development and production by @​kazupon in intlify/vue-i18n#2698
• fix: copy the i18n option of components instead of writing internal values into it by @​kazupon in intlify/vue-i18n#2700
• fix: name datetime and number formats in the warning when a format is not found by @​kazupon in intlify/vue-i18n#2703
• fix: make te() and tm() look up messages in the same way as t() by @​kazupon in intlify/vue-i18n#2705
• fix: read only own properties in the key-value message resolver by @​kazupon in intlify/vue-i18n#2707
• fix: do not read Object.prototype properties as named values, and ignore unknown linked modifiers by @​kazupon in intlify/vue-i18n#2711
• fix: do not write count and n into the named values of a plural call by @​kazupon in intlify/vue-i18n#2713
• fix: do not drop a flat key under a message AST with flatJson by @​kazupon in intlify/vue-i18n#2719
• fix: keep a flat key that ends with cacheKey under a message AST by @​kazupon in intlify/vue-i18n#2721
• fix: let Node.js ESM load the Node.js builds, so that SSR works in production by @​kazupon in intlify/vue-i18n#2729
• fix: keep a flat key that goes through a prop key or cacheKey of a message AST by @​kazupon in intlify/vue-i18n#2731

📝️ Documentations

• docs: explain that locales should be BCP 47 language tags by @​kazupon in intlify/vue-i18n#2696
• docs: describe the fallback of te(), and list te and $te as not included in petite-vue-i18n by @​kazupon in intlify/vue-i18n#2709

Full Changelog: intlify/vue-i18n@v11.4.14...v11.4.15

v11.4.14

What's Changed

🔒 Security Fixes

• fix(shared): neutralize srcdoc attribute in sanitizeTranslatedHtml by @​kazupon in intlify/vue-i18n#2679
• fix(core-base): escape both list and named values with escapeParameter by @​kazupon in intlify/vue-i18n#2680
• fix: ignore locales named after Object.prototype properties by @​kazupon in intlify/vue-i18n#2681

👕 Refactoring

• refactor(core-base): extract the resolved message format check by @​kazupon in intlify/vue-i18n#2674
• refactor(vue-i18n-core): remove dead branches in getCoreContext() by @​kazupon in intlify/vue-i18n#2675
• refactor(vue-i18n-core): share the fallbackContext handling in the composer by @​kazupon in intlify/vue-i18n#2676
• refactor(vue-i18n-core): simplify flat JSON handling in setLocaleMessage / mergeLocaleMessage by @​kazupon in intlify/vue-i18n#2677
• refactor(core-base): give the compile cache a proper type by @​kazupon in intlify/vue-i18n#2678

... (truncated)

Changelog

Sourced from vue-i18n's changelog.

v11.4.16 (2026-10-18T07:43:18.954Z)

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

• fix: read VUE_PROD_DEVTOOLS only when it is defined in the bundler builds, so that Node.js can run them in production by @​kazupon in intlify/vue-i18n#2735

Full Changelog: intlify/vue-i18n@v11.4.15...v11.4.16

v11.4.15 (2026-10-17T15:12:11.060Z)

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

• fix: read only own properties in locale, key and plural rule lookups by @​kazupon in intlify/vue-i18n#2687
• fix: return a message that cannot be compiled as is, in development and production by @​kazupon in intlify/vue-i18n#2698
• fix: copy the i18n option of components instead of writing internal values into it by @​kazupon in intlify/vue-i18n#2700
• fix: name datetime and number formats in the warning when a format is not found by @​kazupon in intlify/vue-i18n#2703
• fix: make te() and tm() look up messages in the same way as t() by @​kazupon in intlify/vue-i18n#2705
• fix: read only own properties in the key-value message resolver by @​kazupon in intlify/vue-i18n#2707
• fix: do not read Object.prototype properties as named values, and ignore unknown linked modifiers by @​kazupon in intlify/vue-i18n#2711
• fix: do not write count and n into the named values of a plural call by @​kazupon in intlify/vue-i18n#2713
• fix: do not drop a flat key under a message AST with flatJson by @​kazupon in intlify/vue-i18n#2719
• fix: keep a flat key that ends with cacheKey under a message AST by @​kazupon in intlify/vue-i18n#2721
• fix: let Node.js ESM load the Node.js builds, so that SSR works in production by @​kazupon in intlify/vue-i18n#2729
• fix: keep a flat key that goes through a prop key or cacheKey of a message AST by @​kazupon in intlify/vue-i18n#2731

📝️ Documentations

• docs: explain that locales should be BCP 47 language tags by @​kazupon in intlify/vue-i18n#2696
• docs: describe the fallback of te(), and list te and $te as not included in petite-vue-i18n by @​kazupon in intlify/vue-i18n#2709

Full Changelog: intlify/vue-i18n@v11.4.14...v11.4.15

v11.4.14 (2026-10-10T11:06:13.502Z)

This changelog is generated by GitHub Releases

... (truncated)

Commits

• ffe5249 release: v11.4.16
• 04defcb release: v11.4.15
• 3d8774f fix: let Node.js ESM load the Node.js builds, so that SSR works in production...
• 6bb9ebd release: v11.4.14
• f6b3e75 release: v11.4.13
• See full diff in compare view

Updates @playwright/test from 1.63.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• Additional commits viewable in compare view

Updates @vitejs/plugin-vue from 6.0.9 to 6.0.10

Release notes

Sourced from @​vitejs/plugin-vue's releases.

plugin-vue@6.0.10

Please refer to CHANGELOG.md for details.

Changelog

Sourced from @​vitejs/plugin-vue's changelog.

6.0.10 (2026-10-10)

Bug Fixes

• plugin-vue: compile transformed normal scripts outside vapor mode (#857) (7b63e3c)
• plugin-vue: correct AST reuse checks and allow Vue 3.6 RC (ccc06dd)

Documentation

• plugin-vue: clarify compiler initialization hooks (55d0cab)

Commits

• a03675e release: plugin-vue@6.0.10
• 7b63e3c fix(plugin-vue): compile transformed normal scripts outside vapor mode (#857)
• ccc06dd fix(plugin-vue): correct AST reuse checks and allow Vue 3.6 RC
• 55d0cab docs(plugin-vue): clarify compiler initialization hooks
• See full diff in compare view

Updates eslint from 10.11.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
• e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

v10.12.0

Features

• 4618052 feat: handle astral letters in new-cap (#21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])

... (truncated)

Commits

• 4637f98 10.13.0
• 96df05c Build: changelog update for 10.13.0
• 4783a68 docs: Update README
• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412)
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410)
• 317fcb3 chore: update ecosystem plugins (#21409)
• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238)
• 43f0ac9 docs: clarify parameter description in getText (#21287)
• a39d9fb feat: add globalThis to no-obj-calls (#21382)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365)
• Additional commits viewable in compare view

Updates eslint-plugin-vue from 10.11.1 to 10.12.0

Release notes

Sourced from eslint-plugin-vue's releases.

v10.12.0

New rules

• Added new vue/no-content-outside-block rule (#3119)
• Added new vue/no-define-model-default rule (#3146)
• Added new vue/no-props-shadow rule (#3118)

New rule options

• Added required option to vue/block-lang to report components that omit a required block entirely (#3125)
• Added ignoreMixins option to vue/require-explicit-emits rule (#3141)

Fixed false negatives (may result in more lint issues)

• Added support for refs detected by type information, such as refs returned from composables, to vue/no-ref-as-operand rule (#3144)
• Fixed vue/no-dupe-keys not reporting defineModel() names that collide with a prop, another model, or a <script setup> variable (#3163)
• Fixed vue/no-dupe-keys not reporting <script setup> variables that shadow a prop while aliasing a different one, such as const foo = toRef(props, 'bar') (#3124)
• Fixed vue/no-multi-spaces not reporting multiple spaces in the tags of some top-level blocks, e.g. <script setup> (#3162)
• Fixed vue/no-ref-as-operand and vue/no-ref-object-reactivity-loss to also check refs created with useTemplateRef() (#3154)
• Fixed vue/no-unused-properties not reporting unused non-props properties in components that use $props as a whole (e.g. v-bind="$props") (#3161)
• Fixed vue/padding-lines-in-component-definition to check every pair of adjacent properties, not only the first, when withinOption or withinEach is not set (#3155)
• Fixed vue/require-default-prop, vue/no-boolean-default, vue/no-required-prop-with-default and vue/require-valid-default-prop not handling defaults that are passed to withDefaults() by reference or spread instead of an inline object literal (#3114)

Fixed false positives (may result in fewer lint issues)

• Changed vue/singleline-html-element-content-newline and vue/multiline-html-element-content-newline rules to ignore router-link and nuxt-link elements by default (#3165)
• Fixed vue/no-undef-properties false positives for properties returned via ...toRefs(reactive({ ... })) from setup() (#3134)
• Fixed vue/require-typed-ref false positives when an explicit type annotation already applies to the ref() call (#3123)
• Fixed vue/v-if-else-key false positive for components with a bound :key (#3150)

Other changes

• Removed Reactivity Transform support from vue/no-ref-object-reactivity-loss, since the Reactivity Transform proposal was dropped from Vue (#3126)
• Changed vue/html-self-closing to treat Vue's special <slot> and \<template> elements as components (html.component option) instead of normal HTML elements (#3164)
• Changed vue/attributes-order rule to provide a suggestion instead of an autofix when the fix would move a binding across v-bind="object" (#3145)
• Improved performance of vue/no-reserved-component-names by no longer rebuilding its reserved name sets for every file (#3147)

Changelog

Sourced from eslint-plugin-vue's changelog.

10.12.0

New rules

• Added new vue/no-content-outside-block rule (#3119)
• Added new vue/no-define-model-default rule (#3146)
• Added new vue/no-props-shadow rule (#3118)

New rule options

• Added required option to vue/block-lang to report components that omit a required block entirely (#3125)
• Added ignoreMixins option to vue/require-explicit-emits rule (#3141)

Fixed false negatives (may result in more lint issues)

• Added support for refs detected by type information, such as refs returned from composables, to vue/no-ref-as-operand rule (#3144)
• Fixed vue/no-dupe-keys not reporting defineModel() names that collide with a prop, another model, or a <script setup> variable (#3163)
• Fixed vue/no-dupe-keys not reporting <script setup> variables that shadow a prop while aliasing a different one, such as const foo = toRef(props, 'bar') (#3124)
• Fixed vue/no-multi-spaces not reporting multiple spaces in the tags of some top-level blocks, e.g. <script setup> (#3162)
• Fixed vue/no-ref-as-operand and vue/no-ref-object-reactivity-loss to also check refs created with useTemplateRef() (#3154)
• Fixed vue/no-unused-properties not reporting unused non-props properties in components that use $props as a whole (e.g. v-bind="$props") (#3161)
• Fixed vue/padding-lines-in-component-definition to check every pair of adjacent properties, not only the first, when withinOption or withinEach is not set (#3155)
• Fixed vue/require-default-prop, vue/no-boolean-default, vue/no-required-prop-with-default and vue/require-valid-default-prop not handling defaults that are passed to withDefaults() by reference or spread instead of an inline object literal (#3114)

Fixed false positives (may result in fewer lint issues)

• Changed vue/singleline-html-element-content-newline and vue/multiline-html-element-content-newline rules to ignore router-link and nuxt-link elements by default (#3165)
• Fixed vue/no-undef-properties false positives for properties returned via ...toRefs(reactive({ ... })) from setup() (#3134)
• Fixed vue/require-typed-ref false positives when an explicit type annotation already applies to the ref() call (#3123)
• Fixed vue/v-if-else-key false positive for components with a bound :key (#3150)

Other changes

• Removed Reactivity Transform support from vue/no-ref-object-reactivity-loss, since the Reactivity Transform proposal was dropped from Vue (#3126)
• Changed vue/html-self-closing to treat Vue's special <slot> and \<template> elements as components (html.component option) instead of normal HTML elements (#3164)
• Changed vue/attributes-order rule to provide a suggestion instead of an autofix when the fix would move a binding across v-bind="object" (#3145)
• Improved performance of vue/no-reserved-component-names by no longer rebuilding its reserved name sets for every file (#3147)

Commits

• f2a0cb5 Version Packages (#3153)
• 9814050 fix(no-dupe-keys): detect defineModel() name collisions (#3163)
• 1741d59 fix(no-multi-spaces): check tags of all top-level blocks (#3162)
• d743582 fix(no-unused-properties): report unused non-props along $props (#3161)
• d2a1f76 fix(padding-lines-in-component-definition): check every property pair when `w...
• 2a7ad86 fix: recognize useTemplateRef() (#3154)
• 515614e fix(attributes-order): change unsafe autofix to suggestion (#3145)
• 9175cc5 feat: remove Reactivity Transform support (#3126)