Skip to content

build(deps): Bump the web-deps group across 1 directory with 3 updates - #48

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/web-deps-6b9e7984e2
Open

build(deps): Bump the web-deps group across 1 directory with 3 updates#48
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/web-deps-6b9e7984e2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the web-deps group with 3 updates in the /web directory: react-arborist, jsdom and vitest.

Updates react-arborist from 3.16.0 to 4.0.1

Release notes

Sourced from react-arborist's releases.

v4.0.1

Fixes

  • Dragging no longer makes the drag preview lag behind the pointer: hovers reach the store at most once per animation frame, and only rows whose drop highlight changes re-render. (The internal tree.state.nodes.drag.destinationParentId / destinationIndex fields moved to tree.state.dnd; use tree.dragDestinationParent / tree.dragDestinationIndex instead.) (#385)

v4.0.0

Breaking Changes

  • react-dnd and react-dnd-html5-backend are now peer dependencies instead of bundled dependencies — install them alongside react-arborist (npm install react-arborist react-dnd react-dnd-html5-backend). This fixes a global singleton conflict (#319) where apps that also used react-dnd ended up with two independent copies of the library, causing drag-and-drop to silently break or throw "Cannot have two HTML5 backends at the same time." Both peers must be v16 (^16), and both are required even when you pass your own dndBackend / dndManager, because the drag preview calls into react-dnd-html5-backend on every drag. react-dnd v16 is ESM-only, and react-arborist now ships a single ESM build too (the CommonJS dist/main build is gone), so import and require load the same copy instead of two copies with separate React contexts. require("react-arborist") from CommonJS relies on require(esm), unflagged from Node 22.12 — now the engines.node floor, which package managers check at install time, so installing v4 requires Node ≥ 22.12 even for bundler and browser consumers. CommonJS TypeScript projects on Node module resolution need module: "nodenext" (TypeScript ≥ 5.8) or "node20" (TypeScript ≥ 5.9); "node16" and "node18" report TS1479. Jest users must add react-arborist to the transformIgnorePatterns exception list alongside react-dnd (see the README). The package also declares an exports map: react-arborist and react-arborist/package.json resolve as before, but deep imports such as react-arborist/dist/module/... are no longer resolvable. The react and react-dom peer floor rises from 16.14 to 18: the build now imports react/jsx-runtime and useSyncExternalStore directly from React, which older versions can't provide to ESM consumers. (#371)

Fixes

  • @types/react-window is now a regular dependency instead of a dev dependency. react-arborist's public type declarations reference react-window types (onScroll, outerElementType, innerElementType, tree.list, scroll alignment), so without it TypeScript reported TS7016 under skipLibCheck: false and silently typed those as any otherwise. (#371)
Changelog

Sourced from react-arborist's changelog.

Version 4.0.1

Fixes

  • Dragging no longer makes the drag preview lag behind the pointer: hovers reach the store at most once per animation frame, and only rows whose drop highlight changes re-render. (The internal tree.state.nodes.drag.destinationParentId / destinationIndex fields moved to tree.state.dnd; use tree.dragDestinationParent / tree.dragDestinationIndex instead.) (#385)

Version 4.0.0

Breaking Changes

  • react-dnd and react-dnd-html5-backend are now peer dependencies instead of bundled dependencies — install them alongside react-arborist (npm install react-arborist react-dnd react-dnd-html5-backend). This fixes a global singleton conflict (#319) where apps that also used react-dnd ended up with two independent copies of the library, causing drag-and-drop to silently break or throw "Cannot have two HTML5 backends at the same time." Both peers must be v16 (^16), and both are required even when you pass your own dndBackend / dndManager, because the drag preview calls into react-dnd-html5-backend on every drag. react-dnd v16 is ESM-only, and react-arborist now ships a single ESM build too (the CommonJS dist/main build is gone), so import and require load the same copy instead of two copies with separate React contexts. require("react-arborist") from CommonJS relies on require(esm), unflagged from Node 22.12 — now the engines.node floor, which package managers check at install time, so installing v4 requires Node ≥ 22.12 even for bundler and browser consumers. CommonJS TypeScript projects on Node module resolution need module: "nodenext" (TypeScript ≥ 5.8) or "node20" (TypeScript ≥ 5.9); "node16" and "node18" report TS1479. Jest users must add react-arborist to the transformIgnorePatterns exception list alongside react-dnd (see the README). The package also declares an exports map: react-arborist and react-arborist/package.json resolve as before, but deep imports such as react-arborist/dist/module/... are no longer resolvable. The react and react-dom peer floor rises from 16.14 to 18: the build now imports react/jsx-runtime and useSyncExternalStore directly from React, which older versions can't provide to ESM consumers. (#371)

Fixes

  • @types/react-window is now a regular dependency instead of a dev dependency. react-arborist's public type declarations reference react-window types (onScroll, outerElementType, innerElementType, tree.list, scroll alignment), so without it TypeScript reported TS7016 under skipLibCheck: false and silently typed those as any otherwise. (#371)
Commits

Updates jsdom from 30.1.3 to 31.0.0

Release notes

Sourced from jsdom's releases.

v31.0.0

Breaking changes

  • Changed the optional canvas and image decoding backend from canvas to @napi-rs/canvas. Install @napi-rs/canvas v1.0.13 or later in the v1.x series alongside jsdom; installing canvas alone no longer enables this support. The new backend provides prebuilt Skia binaries on supported platforms, and rendering and encoded image bytes can differ. Projects using native canvas objects or custom font registration should follow the canvas migration guidance. Added WebP serialization through canvas.toDataURL() and canvas.toBlob(). Fixed image loading to wait for decoding before firing load, discard obsolete source requests, avoid refetching when dimensions change, and prevent failed images from drawing stale contents. Fixed canvas context and serialization behavior, including unsupported context types, read-only ctx.canvas, image-drawing exceptions, MIME type and quality normalization, and asynchronous null results from canvas.toBlob() for empty canvases or encoding failures. (@​Brooooooklyn)
  • Changed CSS parsing, selector matching, and computed styles to use a new integrated implementation, with substantially expanded support and faster selector queries and repeated style reads. This includes cascade layers, nesting, @scope, custom-property substitution and registration through @property and CSS.registerProperty(), typed attr(), conditional if(), shadow-tree styling with :host, ::slotted(), and ::part(), pseudo-element computed styles, and constructable stylesheets with document.adoptedStyleSheets and shadowRoot.adoptedStyleSheets. Fixed numerous cascade, shorthand, serialization, and default-style issues; computed declarations now stay live across DOM and stylesheet changes. CSS serialization and computed values can differ from previous releases.
  • Changed HTML and XML parsing to pause at blocking scripts until their required resources are ready. The JSDOM constructor, JSDOM.fromURL(), and JSDOM.fromFile() can now return partially parsed documents. Wait for DOMContentLoaded for the finished tree, or the window's load event for load-delaying resources, checking document.readyState first in case the event has already fired. XML syntax errors encountered after asynchronous parsing resumes are reported through the virtual console as "xml-parsing" errors.

Other changes

  • Added window.reportError(), which dispatches an error event and reports uncanceled errors to the virtual console. (@​sarankumar1325)
  • Added element.ariaBrailleLabel and element.ariaBrailleRoleDescription. (@​Kjubikstronk)
  • Fixed page-completion load events to fire only on the window. Use window.addEventListener("load", ...) or window.onload instead of listening on the document.
  • Fixed document.open(), including implicit calls from document.write(), to clear event listeners and handlers from the document, its descendants, and its window when replacing the input stream.
  • Fixed document.write() to process successive writes through the parser's input stream, preserve insertion points across nested scripts, and make completed text immediately visible. Script-created input streams now remain open until document.close().
  • Fixed dynamically inserted scripts to respect script.async = false execution order, use their source text and document from preparation time, and avoid executing after adoption into another document. Scripts parsed through inert fragment APIs no longer execute when subsequently inserted.
  • Fixed unrelated images, stylesheets, and frames being delayed behind scripts, and resource completion events firing before nested stylesheet imports finish. Cyclic imports no longer prevent completion, and <style> elements in shadow trees now fire load events.
  • Fixed window.stop() to cancel pending subresource and XMLHttpRequest requests in descendant frames and suppress completion events for canceled loads, while allowing subsequent requests to proceed.
  • Fixed repeated document.close() calls replaying readiness and load events, and incorrect iframe load events when reopening documents from event handlers.
  • Fixed memory leaks where pending request interceptor promises retained closed windows, introduced in v28.0.0.
  • Fixed focus remaining on elements that become non-focusable after DOM or style changes. Focus now moves asynchronously to the document's viewport, and element.blur() can release it immediately.
  • Fixed document.hasFocus() returning false before an element is focused or during focus transitions within the document, including inside frames.
  • Fixed \<template> parsing and template.innerHTML serialization in XML documents, including templates with namespace prefixes. (@​b84330808)
  • Fixed rect.toJSON() and performance.toJSON() to create their result objects in the method's realm instead of the host Node.js realm.
Commits
  • 825fa8e 31.0.0
  • 9f2e49a Add ariaBrailleLabel and ariaBrailleRoleDescription
  • 4c0a35e Flush text written with document.write()
  • fce11d3 Switch canvas support to @​napi-rs/canvas
  • 27614bf Fix document.hasFocus() during focus changes
  • 627ade2 Implement asynchronous focus fixup
  • 8bd17a2 Implement reportError()
  • 5ae66cf Update webidl2js and remove IDL workarounds
  • ce5a100 Align development scripts and CI
  • 9cc717f Adopt ESLint config v6 and oxfmt
  • Additional commits viewable in compare view

Updates vitest from 4.1.12 to 5.1.0

Release notes

Sourced from vitest's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): Bump the web-deps group across 1 directory with 3 updates
f52558b 
Bumps the web-deps group with 3 updates in the /web directory: [react-arborist](https://github.com/jameskerr/react-arborist), [jsdom](https://github.com/jsdom/jsdom) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `react-arborist` from 3.16.0 to 4.0.1
- [Release notes](https://github.com/jameskerr/react-arborist/releases)
- [Changelog](https://github.com/jameskerr/react-arborist/blob/main/CHANGELOG.md)
- [Commits](jameskerr/react-arborist@v3.16.0...v4.0.1)

Updates `jsdom` from 30.1.3 to 31.0.0
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.1.3...v31.0.0)

Updates `vitest` from 4.1.12 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

---
updated-dependencies:
- dependency-name: react-arborist
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: web-deps
- dependency-name: jsdom
  dependency-version: 31.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: web-deps
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: web-deps
...

Signed-off-by: dependabot[bot] <support@github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants