chore(deps): bump the npm-root-nonbreaking group with 20 updates

[dependabot]

Bumps the npm-root-nonbreaking group with 20 updates:

Package	From	To
vscode-languageserver-protocol	3.18.0	3.18.2
@electron/rebuild	4.0.4	4.1.0
@playwright/test	1.60.0	1.61.1
@tailwindcss/postcss	4.3.0	4.3.2
@types/node	22.19.20	22.20.0
@typescript-eslint/eslint-plugin	8.60.1	8.62.1
@typescript-eslint/parser	8.60.1	8.62.1
electron	40.10.2	40.10.6
electron-builder	26.15.0	26.15.3
eslint-plugin-react-refresh	0.5.2	0.5.3
globals	17.6.0	17.7.0
postcss	8.5.15	8.5.16
tailwindcss	4.3.0	4.3.2
framer-motion	12.40.0	12.42.2
fumadocs-core	16.9.3	16.10.7
fumadocs-ui	16.9.3	16.10.7
next	16.2.7	16.2.10
@next/eslint-plugin-next	16.2.7	16.2.10
eslint-config-next	16.2.7	16.2.10
typescript-eslint	8.60.1	8.62.1

Updates vscode-languageserver-protocol from 3.18.0 to 3.18.2

Release notes

Sourced from vscode-languageserver-protocol's releases.

release/protocol/3.18.2

No release notes provided.

release/protocol/3.18.1

Changes:

• #1796: Make TextDocumentContentFeature a supported capability
• #1795: textDocumentContent capability/feature is still behind a proposed gate even though in 3.18 it's not flagged as proposed anymore
• #1794: Fix partial result type for textDocument/diagnostic request
• #1792: Update @​vscode/test-electron to version 3.0.0
• #1791: Refine notification assertions in delayOpenNotifications tests
• #1790: Update inline value documentation and clean up dependencies
• #1788: Update dependency versions in lock files
• #1787: Merge 3.18 release into main
• #1786: Shorten test dir path

This list of changes was auto generated.

Commits

• 20969f3 Prepare new release
• ba098d3 Update metaModel version to 3.18.0 (#1809)
• edd4c12 Merge 3.18.1 release into main (#1805)
• 14dbe29 Fix partial result type for textDocument/diagnostic request (#1794)
• e4e7d97 Update inline value documentation and clean up dependencies (#1790)
• 3c7721e Update dependency versions in lock files (#1788)
• dc94993 Merge 3.18 release into main (#1787)
• See full diff in compare view

Updates @electron/rebuild from 4.0.4 to 4.1.0

Release notes

Sourced from @​electron/rebuild's releases.

v4.1.0

4.1.0 (2026-07-01)

Features

• allow setting dist URL via ELECTRON_REBUILD_DIST_URL env var (#1287) (12a0a2b), closes #301

v4.0.6

4.0.6 (2026-06-28)

Bug Fixes

• honor explicit empty --prebuild-tag-prefix (#1284) (8bc2a49), closes #654

v4.0.5

4.0.5 (2026-06-27)

Bug Fixes

• add --platform CLI argument (#1285) (3e73e57), closes #1240

Commits

• 12a0a2b feat: allow setting dist URL via ELECTRON_REBUILD_DIST_URL env var (#1287)
• 3451934 docs: note that devDependencies aren't rebuilt by default (#1286)
• 8bc2a49 fix: honor explicit empty --prebuild-tag-prefix (#1284)
• 3e73e57 fix: add --platform CLI argument (#1285)
• da49ce1 chore(deps): bump tar from 7.5.13 to 7.5.16 in /test/fixture/napi-build-versi...
• d3f0aea chore(deps): bump undici from 6.25.0 to 6.27.0 (#1282)
• 7b74c30 chore(deps): bump undici from 6.26.0 to 6.27.0 in /test/fixture/workspace-tes...
• b7c52f6 chore(deps): bump tar from 7.5.13 to 7.5.16 in /test/fixture/native-app1 (#1280)
• c8edfa1 chore(deps): bump tar from 7.5.13 to 7.5.16 (#1279)
• fc8ab3f chore(deps): bump vite from 8.0.5 to 8.0.16 (#1276)
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates @playwright/test from 1.60.0 to 1.61.1

Release notes

Sourced from @​playwright/test's releases.

v1.61.1

Bug Fixes

• #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

... (truncated)

Commits

• 39e3553 cherry-pick(#41399): fix(test): load require-reached files as commonjs in syn...
• 4328122 chore: mark v1.61.1 (#41404)
• 2c29a94 fix(tracing): stop recording websocket frames outside of chunks (#41398)
• 4324b19 cherry-pick(#41367): fix(test): keep builtin expect matchers on base extend
• 041e7e3 cherry-pick(#41364): fix(har): WebSocket message timestamps should be in mi...
• b8a0fc3 cherry-pick(#41309, #43149): Revert "fix(firefox): treat `navigationCommitted...
• b5a3175 cherry-pick(#41319): fix(loader): support other node versions
• d4724a9 cherry-pick(#41290): feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image
• 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
• a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
• Additional commits viewable in compare view

Updates @tailwindcss/postcss from 4.3.0 to 4.3.2

Release notes

Sourced from @​tailwindcss/postcss's releases.

v4.3.2

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

v4.3.1

Added

• Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

• Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)
• Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)
• Allow @apply to be used with CSS mixins (#19427)
• Ensure not-* correctly negates @container queries, including style(…) queries (#20059)
• Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#20080)
• Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#20103)
• Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#20027)
• Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#20127)
• Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#20130)
• Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#20137)
• Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#20139)
• Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#20198)
• Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#19588)
• Allow @variant to be used inside addBase (#19480)
• Ensure @source globs with symlinks are preserved (#20203)
• Ensure later @source rules can re-include files excluded by earlier @source not rules (#20203)
• Upgrade: don't migrate empty class rules to invalid @utility rules (#20205)
• Ensure transitions between inset-shadow-none and other inset shadows work correctly (#20208)
• Ensure explicitly referenced @source directories are scanned even when ignored by git (#20214)
• Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#20217)
• Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#20221)
• Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#20228)

Changed

• Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#20196)

... (truncated)

Changelog

Sourced from @​tailwindcss/postcss's changelog.

[4.3.2] - 2026-06-26

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

[4.3.1] - 2026-06-12

Added

• Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

• Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)
• Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)
• Allow @apply to be used with CSS mixins (#19427)
• Ensure not-* correctly negates @container queries, including style(…) queries (#20059)
• Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#20080)
• Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#20103)
• Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#20027)
• Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#20127)
• Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#20130)
• Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#20137)
• Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#20139)
• Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#20198)
• Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#19588)
• Allow @variant to be used inside addBase (#19480)
• Ensure @source globs with symlinks are preserved (#20203)
• Ensure later @source rules can re-include files excluded by earlier @source not rules (#20203)
• Upgrade: don't migrate empty class rules to invalid @utility rules (#20205)
• Ensure transitions between inset-shadow-none and other inset shadows work correctly (#20208)
• Ensure explicitly referenced @source directories are scanned even when ignored by git (#20214)
• Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#20217)
• Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#20221)
• Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#20228)

Changed

... (truncated)

Commits

• 056a155 4.3.2 (#20281)
• 8a14a71 4.3.1 (#20226)
• 522288c Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#20228)
• 8dcdb66 Bump dependencies (#20095)
• See full diff in compare view

Updates @types/node from 22.19.20 to 22.20.0

Commits

• See full diff in compare view

Updates @typescript-eslint/eslint-plugin from 8.60.1 to 8.62.1

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.62.1

8.62.1 (2026-06-29)

🩹 Fixes

• eslint-plugin: [prefer-optional-chain] use suggestion instead of autofix for trailing binary operator (#12328)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] preserve boolean result in fixer for nullable true comparisons (#12365)
• eslint-plugin: [no-unnecessary-type-assertion] parenthesize object literal at left edge of expression statement (#12443, #12418)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger
• mdm317
• Patrick Aleite
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.0

8.62.0 (2026-06-22)

🚀 Features

• remove redundant package.json "files" (#12444)

🩹 Fixes

• add "files" to rule-schema-to-typescript-types (#12441)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.61.1

8.61.1 (2026-06-15)

🩹 Fixes

• eslint-plugin: [consistent-indexed-object-style] do not remove comments when fixing (#12396, #10577)
• eslint-plugin: [no-unnecessary-type-assertion] avoid false positive for template literal expressions (#12281)
• eslint-plugin: [no-unnecessary-type-assertion] wrap object literal in parens when removing TSTypeAssertion in arrow body (#12394, #12393)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] fix precedence bug in autofix (#12413)
• eslint-plugin: [no-unnecessary-template-expression] respect ECMAScript line terminators (#12388)

... (truncated)

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.62.1 (2026-06-29)

🩹 Fixes

• eslint-plugin: [no-unnecessary-type-assertion] parenthesize object literal at left edge of expression statement (#12443, #12418)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] preserve boolean result in fixer for nullable true comparisons (#12365)
• eslint-plugin: [prefer-optional-chain] use suggestion instead of autofix for trailing binary operator (#12328)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger
• mdm317
• Patrick Aleite
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.0 (2026-06-22)

🚀 Features

• remove redundant package.json "files" (#12444)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.61.1 (2026-06-15)

🩹 Fixes

• eslint-plugin: [no-unnecessary-template-expression] respect ECMAScript line terminators (#12388)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] fix precedence bug in autofix (#12413)
• eslint-plugin: [no-unnecessary-type-assertion] wrap object literal in parens when removing TSTypeAssertion in arrow body (#12394, #12393)
• eslint-plugin: [no-unnecessary-type-assertion] avoid false positive for template literal expressions (#12281)
• eslint-plugin: [consistent-indexed-object-style] do not remove comments when fixing (#12396, #10577)

❤️ Thank You

• Anas @​anasm266
• Deftera @​Deftera186
• Kirk Waiblinger @​kirkwaiblinger
• lumir
• Sarath Francis @​sarathfrancis90

... (truncated)

Commits

• 3ea32f4 chore(release): publish 8.62.1
• 4ecca6d fix(eslint-plugin): [no-unnecessary-type-assertion] parenthesize object liter...
• f3a7ec7 chore(eslint-plugin-internal): [no-dynamic-tests] restrict where noFormat can...
• 301f350 fix(eslint-plugin): [no-unnecessary-boolean-literal-compare] preserve boolean...
• ebce2d4 fix(eslint-plugin): [prefer-optional-chain] use suggestion instead of autofix...
• 54e2857 chore(release): publish 8.62.0
• 81e4c26 feat: remove redundant package.json "files" (#12444)
• b784054 chore: use stableTypeOrdering compiler option (#12427)
• aaad718 chore(release): publish 8.61.1
• 0cc8f35 fix(eslint-plugin): [no-unnecessary-template-expression] respect ECMAScript l...
• Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.60.1 to 8.62.1

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.62.1

8.62.1 (2026-06-29)

🩹 Fixes

• eslint-plugin: [prefer-optional-chain] use suggestion instead of autofix for trailing binary operator (#12328)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] preserve boolean result in fixer for nullable true comparisons (#12365)
• eslint-plugin: [no-unnecessary-type-assertion] parenthesize object literal at left edge of expression statement (#12443, #12418)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger
• mdm317
• Patrick Aleite
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.0

8.62.0 (2026-06-22)

🚀 Features

• remove redundant package.json "files" (#12444)

🩹 Fixes

• add "files" to rule-schema-to-typescript-types (#12441)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.61.1

8.61.1 (2026-06-15)

🩹 Fixes

• eslint-plugin: [consistent-indexed-object-style] do not remove comments when fixing (#12396, #10577)
• eslint-plugin: [no-unnecessary-type-assertion] avoid false positive for template literal expressions (#12281)
• eslint-plugin: [no-unnecessary-type-assertion] wrap object literal in parens when removing TSTypeAssertion in arrow body (#12394, #12393)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] fix precedence bug in autofix (#12413)
• eslint-plugin: [no-unnecessary-template-expression] respect ECMAScript line terminators (#12388)

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.62.1 (2026-06-29)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.0 (2026-06-22)

🚀 Features

• remove redundant package.json "files" (#12444)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.61.1 (2026-06-15)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.61.0 (2026-06-08)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 3ea32f4 chore(release): publish 8.62.1
• 54e2857 chore(release): publish 8.62.0
• 81e4c26 feat: remove redundant package.json "files" (#12444)
• aaad718 chore(release): publish 8.61.1
• 16a5b24 chore(release): publish 8.61.0
• See full diff in compare view

Updates electron from 40.10.2 to 40.10.6

Release notes

Sourced from electron's releases.

electron v40.10.6

Release Notes for v40.10.6

Fixes

• Fixed ProtocolResponse.url requests being made through the default session instead of the session the protocol handler was registered on when ProtocolResponse.session was not set. #52135 (Also in 41, 42, 43)

Other Changes

• Backported fixes from upstream Chromium. #52121
• Backported fixes from upstream Chromium. #52171

electron v40.10.5

Release Notes for v40.10.5

Other Changes

• Backported fixes from upstream Chromium. #51977

electron v40.10.4

Release Notes for v40.10.4

Other Changes

• Backported fixes from upstream Chromium and V8. #51937
• Backported fixes from upstream Chromium, Skia and Dawn. #51946

Documentation

• Documentation changes: #51928

electron v40.10.3

Release Notes for v40.10.3

Other Changes

• Security: backported fixes for CVE-2026-9110, CVE-2026-9111, CVE-2026-9112, CVE-2026-9113, CVE-2026-9114, CVE-2026-9115, CVE-2026-9116, CVE-2026-9117, CVE-2026-9118, CVE-2026-9119, CVE-2026-9120, CVE-2026-9121, CVE-2026-9122, CVE-2026-9124, CVE-2026-9126. #51907

Commits

• 8551115 build: register Electron.app with LaunchServices before macOS tests (#52185)
• 8973d71 test: fix lost-event race in custom-protocol-panel devtools fixture (#52192)
• a85e4ea chore: cherry-pick 1 changes from chromium (#52171)
• 00d93cb fix: use the registering session for ProtocolResponse.url requests (40-x-y) (...
• 92a5845 build: float siso patch and build siso on all platforms (40-x-y) (#52147)
• 62bb576 build: update name of generated publish pipeline segment (#52127)
• d7243d3 chore: cherry-pick 12 changes from chromium (#52121)
• 39c67e9 ci: calculate rerun apply patches date from first run attempt (#52073)
• 1354ea6 chore: cherry-pick 17 changes from chromium (#51977)
• f6d88ea ci: replace dorny/paths-filter usage (reland) (#52049)
• Additional commits viewable in compare view

Updates electron-builder from 26.15.0 to 26.15.3

Release notes

Sourced from electron-builder's releases.

electron-builder@26.15.3

What's Changed

• fix: add ELECTRON_BUILDER_BINARIES_ALLOW_HTTP opt-in for parsing env vars targeting non-localhost HTTP by @​mmaietta in electron-userland/electron-builder#9856
• docs: update docs and add build lifecycle page by @​mmaietta in electron-userland/electron-builder#9857
• chore(test): update vitest by @​mmaietta in electron-userland/electron-builder#9859
• fix(download): persist toolset archives in a predictable cache path by @​mmaietta in electron-userland/electron-builder#9861
• fix(publish): set x-amz-content-sha256: UNSIGNED-PAYLOAD before SigV4 signing by @​mmaietta in electron-userland/electron-builder#9863
• chore(deploy): Release (next) by @​electron-builder-release-bot[bot] in electron-userland/electron-builder#9858

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.2...electron-builder@26.15.3

electron-builder@26.15.2

What's Changed

• fix(mac): use native zip for macOS zip target to preserve .framework symlinks by @​mmaietta in electron-userland/electron-builder#9847
• fix: retry package install on transient network errors by @​mmaietta in electron-userland/electron-builder#9850
• fix(icons): replace png2icons with wasm-vips Lanczos3 resampling for high-quality icon conversion by @​mmaietta in electron-userland/electron-builder#9851
• chore(deploy): Release (next) by @​electron-builder-release-bot[bot] in electron-userland/electron-builder#9848

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.1...electron-builder@26.15.2

electron-builder@26.15.1

What's Changed

• fix: validate packages by @​regnete in electron-userland/electron-builder#9838
• chore: ci:validate, ci:test:fetch-cache simplification, and code cleanup by @​mmaietta in electron-userland/electron-builder#9840
• chore(tests): embed platform markers in generated test filenames to eliminate "unknown" timing in shard plan by @​mmaietta in electron-userland/electron-builder#9843
• chore(deps): update and unpin @​electron/rebuild package by @​mmaietta in electron-userland/electron-builder#9845
• chore(deploy): Release (next) by @​electron-builder-release-bot[bot] in electron-userland/electron-builder#9842

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.0...electron-builder@26.15.1

Changelog

Sourced from electron-builder's changelog.

26.15.3

Patch Changes

35bfdeb 9097daf

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agent-space-web	Ready	Preview, Comment	Jul 5, 2026 5:03am

[mogplex]

Mogplex PR Review

Status: No material issues found

Summary

• Dependabot grouped dependency bump ("npm-root-nonbreaking", 20 packages) touching package.json, web/package.json, and pnpm-lock.yaml. No application/source code changes.
• I independently verified the diff against the PR description: every version range matches, and the update covers exactly 20 distinct packages.

Verification

• Root package.json (13 lines): vscode-languageserver-protocol 3.18.0->3.18.2, @electron/rebuild 4.0.4->4.1.0, @playwright/test 1.60.0->1.61.1, @tailwindcss/postcss 4.3.0->4.3.2, @types/node 22.19.20->22.20.0, @typescript-eslint/eslint-plugin and @typescript-eslint/parser 8.60.1->8.62.1, electron 40.10.2->40.10.6, electron-builder 26.15.0->26.15.3, eslint-plugin-react-refresh 0.5.2->0.5.3, globals 17.6.0->17.7.0, postcss 8.5.15->8.5.16, tailwindcss 4.3.0->4.3.2.
• Web package.json (12 lines): framer-motion 12.40.0->12.42.2, fumadocs-core/fumadocs-ui 16.9.3->16.10.7, next/@next/eslint-plugin-next/eslint-config-next 16.2.7->16.2.10, typescript-eslint 8.60.1->8.62.1, plus shared dev-deps.
• Cross-manifest consistency: shared dev-deps (@tailwindcss/postcss 4.3.2, @types/node 22.20.0, postcss 8.5.16, tailwindcss 4.3.2, globals 17.7.0, typescript-eslint family 8.62.1) resolve to identical versions in both files — no version drift. A prior lockfile fetch confirmed the pnpm-lock.yaml importer entries resolve to these expected versions with no unexpected or suspicious packages. All bumps are semver minor/patch, consistent with the group's "nonbreaking" intent.

Critical issues: none.

Warnings: none that block merge.

Suggestions

• CI is the real validation gate. Even "nonbreaking" toolchain/framework bumps can change behavior: typescript-eslint 8.60->8.62 may surface new/changed lint diagnostics, and next / framer-motion / fumadocs-* affect the web build. Confirm build + lint + tests are green before merging.
• Security positives: electron 40.10.6 backports 15 Chromium CVEs (the 40.10.3 changelog lists CVE-2026-9110 through 9122, 9124, and 9126) plus a ProtocolResponse session fix; electron-builder 26.15.3 adds the ELECTRON_BUILDER_BINARIES_ALLOW_HTTP opt-in that keeps non-localhost HTTP disabled by default. Good reasons to land this.
• Supply-chain hygiene: Dependabot flags an install-script (prepare) change for @electron/rebuild 4.1.0. It is a first-party Electron-org package and the bump matches the published changelog (only feature: an ELECTRON_REBUILD_DIST_URL env var), so risk is low — noting, not blocking.

Uncertainties (flagged for honesty)

• pnpm-lock.yaml (~2000 changed lines) is machine-generated; confidence rests on Dependabot provenance, the importer-entry spot-check, and CI rather than an exhaustive line-by-line audit.
• I did not execute the build/tests; the "green CI" recommendation is a gate to confirm, not something I verified.

Verdict: APPROVE — clean, well-formed dependency-only update with all 20 version bumps verified against the manifests and no version drift; merge once CI is green.

Affected files:

• package.json
• web/package.json
• pnpm-lock.yaml

View check run