## [1.1.12] - 2026-08-23 ### Changed - update all non-major dependencies (#47) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@vitest/coverage-v8](https://vitest.dev/guide/coverage) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8)) | [`4.1.10` → `4.1.11`](https://renovatebot.com/diffs/npm/@vitest%2fcoverage-v8/4.1.10/4.1.11) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2fcoverage-v8/4.1.11?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2fcoverage-v8/4.1.10/4.1.11?slim=true) | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | [`5.10.1` → `5.11.0`](https://renovatebot.com/diffs/npm/fast-xml-parser/5.10.1/5.11.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-xml-parser/5.11.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-xml-parser/5.10.1/5.11.0?slim=true) | | [happy-dom](https://github.com/capricorn86/happy-dom) | [`20.11.2` → `20.11.6`](https://renovatebot.com/diffs/npm/happy-dom/20.11.2/20.11.6) | ![age](https://developer.mend.io/api/mc/badges/age/npm/happy-dom/20.11.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/happy-dom/20.11.2/20.11.6?slim=true) | | [hls.js](https://github.com/video-dev/hls.js) | [`1.7.0` → `1.7.1`](https://renovatebot.com/diffs/npm/hls.js/1.7.0/1.7.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/hls.js/1.7.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/hls.js/1.7.0/1.7.1?slim=true) | | [mediasoup](https://mediasoup.org) ([source](https://github.com/versatica/mediasoup)) | [`3.24.2` → `3.26.0`](https://renovatebot.com/diffs/npm/mediasoup/3.24.2/3.26.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/mediasoup/3.26.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/mediasoup/3.24.2/3.26.0?slim=true) | | [openid-client](https://github.com/panva/openid-client) | [`6.8.5` → `6.8.7`](https://renovatebot.com/diffs/npm/openid-client/6.8.5/6.8.7) | ![age](https://developer.mend.io/api/mc/badges/age/npm/openid-client/6.8.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/openid-client/6.8.5/6.8.7?slim=true) | | [vitest](https://vitest.dev) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) | [`4.1.10` → `4.1.11`](https://renovatebot.com/diffs/npm/vitest/4.1.10/4.1.11) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/4.1.11?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/4.1.10/4.1.11?slim=true) | --- ### Release Notes
vitest-dev/vitest (@​vitest/coverage-v8) ### [`v4.1.11`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.11) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.10...v4.1.11) #####    🐞 Bug Fixes - Revive global concurrency limit for test lifecycle \[backport to v4]  -  by [@​sheremet-va](https://github.com/sheremet-va) and [@​hi-ogawa](https://github.com/hi-ogawa) in [#​10992](https://github.com/vitest-dev/vitest/issues/10992) [(5146d)](https://github.com/vitest-dev/vitest/commit/5146df80b) - **browser**: - Encode iframeId in tester iframe URL \[backport to v4]  -  by [@​sheremet-va](https://github.com/sheremet-va), **Pduhard** and **Claude Opus 4.8** in [#​10955](https://github.com/vitest-dev/vitest/issues/10955) [(10b2c)](https://github.com/vitest-dev/vitest/commit/10b2cd201) - Trigger playwright/chromium gc on lower disk availability \[backport to v4]  -  by [@​hi-ogawa](https://github.com/hi-ogawa), **Hiroshi Ogawa** and **OpenCode** in [#​10951](https://github.com/vitest-dev/vitest/issues/10951) [(9851d)](https://github.com/vitest-dev/vitest/commit/9851dbc41) - **mocker**: - Restrict redirect mocks to the fs allowlist \[backport to v4]  -  by [@​sheremet-va](https://github.com/sheremet-va) in [#​10974](https://github.com/vitest-dev/vitest/issues/10974) [(fe5a1)](https://github.com/vitest-dev/vitest/commit/fe5a11d3c) #####     [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.10...v4.1.11)
NaturalIntelligence/fast-xml-parser (fast-xml-parser) ### [`v5.11.0`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.11.0) [Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.1...v5.11.0) #### What's Changed - add support for endIndex in node metadata (5.x edition) by [@​Wain-PC](https://github.com/Wain-PC) in [#​850](https://github.com/NaturalIntelligence/fast-xml-parser/pull/850) - fix: don't crash on a closing tag with no matching opening tag by [@​hdimer](https://github.com/hdimer) in [#​861](https://github.com/NaturalIntelligence/fast-xml-parser/pull/861) #### New Contributors - [@​Wain-PC](https://github.com/Wain-PC) made their first contribution in [#​850](https://github.com/NaturalIntelligence/fast-xml-parser/pull/850) - [@​hdimer](https://github.com/hdimer) made their first contribution in [#​861](https://github.com/NaturalIntelligence/fast-xml-parser/pull/861) **Full Changelog**:
capricorn86/happy-dom (happy-dom) ### [`v20.11.6`](https://github.com/capricorn86/happy-dom/releases/tag/v20.11.6) [Compare Source](https://github.com/capricorn86/happy-dom/compare/v20.11.5...v20.11.6) ##### :construction\_worker\_man: Patch fixes - Updates docs for the global-registrator package - By **[@​capricorn86](https://github.com/capricorn86)** in task [#​2300](https://github.com/capricorn86/happy-dom/issues/2300) ### [`v20.11.5`](https://github.com/capricorn86/happy-dom/releases/tag/v20.11.5) [Compare Source](https://github.com/capricorn86/happy-dom/compare/v20.11.4...v20.11.5) ##### :construction\_worker\_man: Patch fixes - Allow explicit element types for querySelector (e.g. `querySelector(".my-input")`) - By **[@​cyphercodes](https://github.com/cyphercodes)** ### [`v20.11.4`](https://github.com/capricorn86/happy-dom/releases/tag/v20.11.4) [Compare Source](https://github.com/capricorn86/happy-dom/compare/v20.11.3...v20.11.4) ##### :construction\_worker\_man: Patch fixes - Fixes the CORS check `fetch()` to match origins instead of host and protocol - By **[@​rexxars](https://github.com/rexxars)** in task [#​1490](https://github.com/capricorn86/happy-dom/issues/1490) ### [`v20.11.3`](https://github.com/capricorn86/happy-dom/releases/tag/v20.11.3) [Compare Source](https://github.com/capricorn86/happy-dom/compare/v20.11.2...v20.11.3) ##### :construction\_worker\_man: Patch fixes - Make document.links return a live HTMLCollection - By **[@​bangseongbeom](https://github.com/bangseongbeom)** in task [#​2299](https://github.com/capricorn86/happy-dom/issues/2299) - Copy labels array to prevent mutation of cached querySelectorAll result - By **[@​mixelburg](https://github.com/mixelburg)** in task [#​2226](https://github.com/capricorn86/happy-dom/issues/2226)
video-dev/hls.js (hls.js) ### [`v1.7.1`](https://github.com/video-dev/hls.js/releases/tag/v1.7.1) [Compare Source](https://github.com/video-dev/hls.js/compare/v1.7.0...v1.7.1) ### Summary HLS.js v1.7.1 includes bug fixes and improvements over the previous release. #### Changes Since The Last Release - Fix Interstitial snap-out at live edge and `BUFFER_APPEND_NO_PROGRESS` false positives ([#​7979](https://github.com/video-dev/hls.js/issues/7979)) [@​robwalch](https://github.com/robwalch) - Workaround issue where `ManagedMediaSource` does not emit "startstreaming" when seeking ([#​7984](https://github.com/video-dev/hls.js/issues/7984)) - Fix permanent stall loading fragment-hint parts of encrypted low-latency streams ([#​7976](https://github.com/video-dev/hls.js/issues/7976)) [@​zaki699-blip](https://github.com/zaki699-blip) - Document decode timebase change in MIGRATING ([#​7986](https://github.com/video-dev/hls.js/issues/7986)) [@​robwalch](https://github.com/robwalch) #### Demo Page #### API and Breaking Changes No public exports were removed and no runtime behavior changes are required to upgrade from v1.6 to v1.7. TypeScript consumers might see new compile errors where previously loose types have been narrowed. Each is listed with upgrade guidance in the migration guide: Some exported type dependencies ("eventemitter3", "[@​svta/cml-cmcd](https://github.com/svta/cml-cmcd)", "[@​svta/cml-utils](https://github.com/svta/cml-utils)", "[@​svta/cml-structured-field-values](https://github.com/svta/cml-structured-field-values)") have not been bundled with hls.d.ts. Please file an issue if this is blocking you from upgrading. #### Feedback Please provide feedback via [Issues in GitHub](https://github.com/video-dev/hls.js/issues/new/choose). For more details on how to contribute to HLS.js, see our [CONTRIBUTING guide](https://github.com/video-dev/hls.js/blob/master/CONTRIBUTING.md).
versatica/mediasoup (mediasoup) ### [`v3.26.0`](https://github.com/versatica/mediasoup/blob/HEAD/CHANGELOG.md#3260) [Compare Source](https://github.com/versatica/mediasoup/compare/3.25.0...3.26.0) - **Breaking change:** Simulcast and SVC: Limit temporal layer to the preferred one ([PR #​1892](https://github.com/versatica/mediasoup/pull/1892)). ### [`v3.25.0`](https://github.com/versatica/mediasoup/blob/HEAD/CHANGELOG.md#3250) [Compare Source](https://github.com/versatica/mediasoup/compare/3.24.2...3.25.0) - Worker: Fix undefined behavior in `RtpStreamRecv::UpdateScore()` when no packets were received ([PR #​1886](https://github.com/versatica/mediasoup/pull/1886)). - SCTP: Fix `SackChunk::GetValidatedGapAckBlocks()` returning a bogus gap-ack-block ([PR #​1891](https://github.com/versatica/mediasoup/pull/1891)). - Do not make generated RTCP Sender Reports depend on RTP packet arrival time ([issue #​1881](https://github.com/versatica/mediasoup/issues/1881)): - `RemoteClockOffsetEstimator` class ([PR #​1882](https://github.com/versatica/mediasoup/pull/1882)). - Prepare `RtpStream` classes for capture time based RTCP Sender Reports ([PR #​1883](https://github.com/versatica/mediasoup/pull/1883), [PR #​1888](https://github.com/versatica/mediasoup/pull/1888)). - `RemoteCaptureTimeEstimator` class ([PR #​1884](https://github.com/versatica/mediasoup/pull/1884)). - Estimate the capture instant of each received RTP packet ([PR #​1885](https://github.com/versatica/mediasoup/pull/1885)). - Generate RTCP Sender Reports based on the capture instant of the media rather than on the packet arrival time ([PR #​1887](https://github.com/versatica/mediasoup/pull/1887)). - `SimulcastProducerStreamManager`: Apply new capture time logic and fix 'abs-capture-time' rewriting ([PR #​1889](https://github.com/versatica/mediasoup/pull/1889)).
panva/openid-client (openid-client) ### [`v6.8.7`](https://github.com/panva/openid-client/blob/HEAD/CHANGELOG.md#687-2026-08-20) [Compare Source](https://github.com/panva/openid-client/compare/v6.8.6...v6.8.7) ##### Fixes - allow destructuring the claims helper ([38bd8c0](https://github.com/panva/openid-client/commit/38bd8c052a7e1e6d0e2beda14d35fb38b9b26d4c)), references [#​887](https://github.com/panva/openid-client/issues/887) ### [`v6.8.6`](https://github.com/panva/openid-client/blob/HEAD/CHANGELOG.md#686-2026-08-18) [Compare Source](https://github.com/panva/openid-client/compare/v6.8.5...v6.8.6) ##### Fixes - avoid undefined user-agent in fetchProtectedResource ([492c3c3](https://github.com/panva/openid-client/commit/492c3c36aad1ac324661b808b32bc17a35d22665)), references [#​885](https://github.com/panva/openid-client/issues/885)
--- - [ ] If you want to rebase/retry this PR, check this box ## [1.1.11] - 2026-08-19 ### Changed - remove unused broadcastToSession export (#45) ## Removed - `broadcastToSession` from `server/plugins/websocket.js` — an exported but never-imported, never-called dead-code function. Its dependencies (`getSessionConnections`, `addSessionConnection`, `removeSessionConnection`) are retained since they remain actively used for per-session connection tracking within the plugin. ## Notes - Full repository search confirms zero remaining references to `broadcastToSession`. - ESLint passes; full test suite passes (50 files, 406 tests). Closes #40 ## [1.1.10] - 2026-08-14 ### Changed - update dependencies and fix security vulnerabilities (#44) ## Summary Updates all out-of-date dependencies and applies `npm audit fix` to resolve 14 security vulnerabilities (3 critical, 8 high). ### Dependency Updates | Package | Current → Latest | |---|---| | `nuxt` | 4.4.8 → 4.5.2 | | `mediasoup` | 3.20.9 → 3.24.2 | | `mediasoup-client` | 3.21.0 → 3.22.0 | | `hls.js` | 1.6.16 → 1.7.0 | | `vue` | 3.5.38 → 3.5.41 | | `vue-router` | 5.1.0 → 5.2.0 | | `@nuxt/icon` | 2.2.3 → 2.5.0 | | `eslint` | 10.5.0 → 10.8.1 | | `vitest` / `@vitest/coverage-v8` | 4.1.9 → 4.1.10 | | `ws` | 8.21.0 → 8.21.3 | | `openid-client` | 6.8.4 → 6.8.5 | | `fast-xml-parser` | 5.9.3 → 5.10.1 | | `happy-dom` | 20.10.6 → 20.11.2 | | `@playwright/test` | 1.61.1 → 1.62.1 | | `@nuxt/eslint` | 1.16.0 → 1.17.0 | | `@nuxt/test-utils` | 4.0.3 → 4.1.0 | | `@iconify-json/tabler` | 1.2.35 → 1.2.38 | ### Security Audit Fixes (`npm audit fix`) - **`@nuxt/devtools`** (critical): Unauthenticated DevTools RPC allows arbitrary command execution on the developer's host - **`tar`** (critical): Multiple process-crash/DoS vulnerabilities via crafted tar archives - **`esbuild`** (high): Arbitrary file read when running dev server on Windows - **`brace-expansion`** (high): Multiple DoS vectors (memory exhaustion, process hang) - **`flatted`** (high): Prototype pollution via `parse()` - **`svgo`** (high): `removeScripts` plugin leaves executable scripts intact ### Verification - All 406 tests pass (3 skipped) - Lint clean (`eslint . --max-warnings 0`) - `npm audit` reports 0 vulnerabilities ## [1.1.9] - 2026-08-13 ### Changed - update dependency fast-xml-parser to v5.10.1 [security] (#42) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | [`5.9.3` → `5.10.1`](https://renovatebot.com/diffs/npm/fast-xml-parser/5.9.3/5.10.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-xml-parser/5.10.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-xml-parser/5.9.3/5.10.1?slim=true) | --- ### fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits [GHSA-8r6m-32jq-jx6q](https://github.com/advisories/GHSA-8r6m-32jq-jx6q)
More information #### Details ##### Impact `fast-xml-parser` processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to `@nodable/entities` through `addInputEntities()`. `addInputEntities()` resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation. This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. ##### Workarounds - Manually check if multiple DOCTYPEs are not present in input contents - Update to v5.10.1 - Keep `processEntity` flag off #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q](https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q) - [https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f](https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f) - [https://github.com/NaturalIntelligence/fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) - [https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-8r6m-32jq-jx6q) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
--- ### Release Notes
NaturalIntelligence/fast-xml-parser (fast-xml-parser) ### [`v5.10.1`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1) [Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.0...v5.10.1) **Full Changelog**: ### [`v5.10.0`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.0) [Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.9.3...v5.10.0) #### What's Changed - Bump actions/checkout from 6.0.3 to 7.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​849](https://github.com/NaturalIntelligence/fast-xml-parser/pull/849) - Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​848](https://github.com/NaturalIntelligence/fast-xml-parser/pull/848) **Full Changelog**:
--- - [ ] If you want to rebase/retry this PR, check this box ## [1.1.8] - 2026-08-13 ### Changed - update https://git.keligrubb.com/actions/setup-node action to v7 (#38) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://git.keligrubb.com/actions/setup-node](https://git.keligrubb.com/actions/setup-node) | action | major | `v6` → `v7` | --- ### Release Notes
actions/setup-node (https://git.keligrubb.com/actions/setup-node) ### [`v7.0.0`](https://git.keligrubb.com/actions/setup-node/compare/v7...v7) [Compare Source](https://git.keligrubb.com/actions/setup-node/compare/v7...v7) ### [`v7`](https://git.keligrubb.com/actions/setup-node/compare/v6.5.0...v7) [Compare Source](https://git.keligrubb.com/actions/setup-node/compare/v6.5.0...v7)
--- - [ ] If you want to rebase/retry this PR, check this box ## [1.1.7] - 2026-08-13 ### Changed - update dependency supercluster to v9 (#41) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [supercluster](https://github.com/mapbox/supercluster) | [`^8.0.1` → `^9.0.0`](https://renovatebot.com/diffs/npm/supercluster/8.0.1/9.0.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/supercluster/9.0.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/supercluster/8.0.1/9.0.0?slim=true) | --- ### Release Notes
mapbox/supercluster (supercluster) ### [`v9.0.0`](https://github.com/mapbox/supercluster/releases/tag/v9.0.0) [Compare Source](https://github.com/mapbox/supercluster/compare/v8.0.1...v9.0.0) - Radically optimize **memory footprint and performance** — on a sample 1M points index, Supercluster now uses 94% less transient allocation, 57% lower peak heap, 65% less retained memory, and runs 23% faster. [#​258](https://github.com/mapbox/supercluster/issues/258) - Improve internal coordinate precision by 6 bits (64 times). - ⚠️ Breaking: hard-cap `maxZoom` at 30 (it wasn't practical to use it on higher zooms anyway). - Add support for `MultiPoint` features. [#​263](https://github.com/mapbox/supercluster/issues/263)
--- - [ ] If you want to rebase/retry this PR, check this box ## [1.1.6] - 2026-06-24 ### Changed - Add ADS-B, AIS, and ALPR map layers with live CoT streaming (#36) ## Summary - **ADS-B & AIS:** OpenSky and AISStream OSINT feeds upsert into the CoT store; tactical tracks still arrive via adsbcot/aiscot on `:8089`. Map clients subscribe via `GET /api/cot/stream` (SSE) with viewport bbox filtering and Air / Surface / Team layer toggles. - **ALPR (Flock/OSM):** Toggleable license-plate reader layer sourced from OpenStreetMap, with SQLite cache, Overpass fallback, tiled viewport fetching, and clustered markers with direction cones. - **Map performance:** Ring-based tile selection (fixes zoom-out crash), immutable tile cache, incremental marker sync, split cluster load/query, and padded SSE bbox to reduce reconnect churn. ## Docs - `docs/tracking.md` — ADS-B/AIS accuracy tiers, freshness, self-hosted receivers, optional OSINT API keys - `docs/map-and-cameras.md` — ALPR layer and map behavior updates ## [1.1.5] - 2026-06-21 ### Changed - update https://git.keligrubb.com/actions/checkout action to v7 (#35) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://git.keligrubb.com/actions/checkout](https://git.keligrubb.com/actions/checkout) | action | major | `v6` → `v7` | --- ### Release Notes
actions/checkout (https://git.keligrubb.com/actions/checkout) ### [`v7.0.0`](https://git.keligrubb.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](https://git.keligrubb.com/actions/checkout/compare/v7...v7) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2454](https://github.com/actions/checkout/pull/2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2458](https://github.com/actions/checkout/pull/2458) - Bump flatted from 3.3.1 to 3.4.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2460](https://github.com/actions/checkout/pull/2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2461](https://github.com/actions/checkout/pull/2461) - Bump [@​actions/core](https://github.com/actions/core) and [@​actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2459](https://github.com/actions/checkout/pull/2459) - upgrade module to esm and update dependencies by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2463](https://github.com/actions/checkout/pull/2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2462](https://github.com/actions/checkout/pull/2462) ### [`v7`](https://git.keligrubb.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](https://git.keligrubb.com/actions/checkout/compare/v6.0.3...v7) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2454](https://github.com/actions/checkout/pull/2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2458](https://github.com/actions/checkout/pull/2458) - Bump flatted from 3.3.1 to 3.4.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2460](https://github.com/actions/checkout/pull/2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2461](https://github.com/actions/checkout/pull/2461) - Bump [@​actions/core](https://github.com/actions/core) and [@​actions/tool-cache](https://github.com/actions/tool-cache) and Remove uuid by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2459](https://github.com/actions/checkout/pull/2459) - upgrade module to esm and update dependencies by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2463](https://github.com/actions/checkout/pull/2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2462](https://github.com/actions/checkout/pull/2462)
--- - [ ] If you want to rebase/retry this PR, check this box ## [1.1.4] - 2026-04-29 ### Changed - update all non-major dependencies (#31) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@vitest/coverage-v8](https://vitest.dev/guide/coverage) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8)) | [`4.1.4` → `4.1.5`](https://renovatebot.com/diffs/npm/@vitest%2fcoverage-v8/4.1.4/4.1.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2fcoverage-v8/4.1.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2fcoverage-v8/4.1.4/4.1.5?slim=true) | | [@vue/test-utils](https://github.com/vuejs/test-utils) | [`2.4.6` → `2.4.8`](https://renovatebot.com/diffs/npm/@vue%2ftest-utils/2.4.6/2.4.8) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@vue%2ftest-utils/2.4.8?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vue%2ftest-utils/2.4.6/2.4.8?slim=true) | | [eslint](https://eslint.org) ([source](https://github.com/eslint/eslint)) | [`10.2.0` → `10.2.1`](https://renovatebot.com/diffs/npm/eslint/10.2.0/10.2.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/eslint/10.2.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint/10.2.0/10.2.1?slim=true) | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | [`5.6.0` → `5.7.2`](https://renovatebot.com/diffs/npm/fast-xml-parser/5.6.0/5.7.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-xml-parser/5.7.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-xml-parser/5.6.0/5.7.2?slim=true) | | [mediasoup](https://mediasoup.org) ([source](https://github.com/versatica/mediasoup)) | [`3.19.19` → `3.19.21`](https://renovatebot.com/diffs/npm/mediasoup/3.19.19/3.19.21) | ![age](https://developer.mend.io/api/mc/badges/age/npm/mediasoup/3.19.21?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/mediasoup/3.19.19/3.19.21?slim=true) | | [mediasoup-client](https://mediasoup.org) ([source](https://github.com/versatica/mediasoup-client)) | [`3.18.8` → `3.19.0`](https://renovatebot.com/diffs/npm/mediasoup-client/3.18.8/3.19.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/mediasoup-client/3.19.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/mediasoup-client/3.18.8/3.19.0?slim=true) | | [vitest](https://vitest.dev) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) | [`4.1.4` → `4.1.5`](https://renovatebot.com/diffs/npm/vitest/4.1.4/4.1.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/4.1.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/4.1.4/4.1.5?slim=true) | | [vue](https://vuejs.org/) ([source](https://github.com/vuejs/core)) | [`3.5.32` → `3.5.33`](https://renovatebot.com/diffs/npm/vue/3.5.32/3.5.33) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vue/3.5.33?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vue/3.5.32/3.5.33?slim=true) | | [vue-router](https://router.vuejs.org) ([source](https://github.com/vuejs/router)) | [`5.0.4` → `5.0.6`](https://renovatebot.com/diffs/npm/vue-router/5.0.4/5.0.6) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vue-router/5.0.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vue-router/5.0.4/5.0.6?slim=true) | --- ### Release Notes
vitest-dev/vitest (@​vitest/coverage-v8) ### [`v4.1.5`](https://github.com/vitest-dev/vitest/releases/tag/v4.1.5) [Compare Source](https://github.com/vitest-dev/vitest/compare/v4.1.4...v4.1.5) #####    🚀 Experimental Features - **coverage**: Istanbul to support `instrumenter` option  -  by [@​BartWaardenburg](https://github.com/BartWaardenburg) and [@​AriPerkkio](https://github.com/AriPerkkio) in [#​10119](https://github.com/vitest-dev/vitest/issues/10119) [(0e0ff)](https://github.com/vitest-dev/vitest/commit/0e0ff41c7) #####    🐞 Bug Fixes - \--project negation excludes browser instances  -  by [@​felamaslen](https://github.com/felamaslen) in [#​10131](https://github.com/vitest-dev/vitest/issues/10131) [(9423d)](https://github.com/vitest-dev/vitest/commit/9423dc084) - Project color label on html reporter  -  by [@​hi-ogawa](https://github.com/hi-ogawa) in [#​10142](https://github.com/vitest-dev/vitest/issues/10142) [(596f7)](https://github.com/vitest-dev/vitest/commit/596f73986) - Fix `vi.defineHelper` called as object method  -  by [@​hi-ogawa](https://github.com/hi-ogawa) in [#​10163](https://github.com/vitest-dev/vitest/issues/10163) [(122c2)](https://github.com/vitest-dev/vitest/commit/122c25b5b) - Alias `agent` reporter to `minimal`  -  by [@​sheremet-va](https://github.com/sheremet-va) in [#​10157](https://github.com/vitest-dev/vitest/issues/10157) [(663b9)](https://github.com/vitest-dev/vitest/commit/663b99fe3) - Respect diff config options in soft assertions  -  by [@​Copilot](https://github.com/Copilot), **sheremet-va** and [@​sheremet-va](https://github.com/sheremet-va) in [#​8696](https://github.com/vitest-dev/vitest/issues/8696) [(9787d)](https://github.com/vitest-dev/vitest/commit/9787dedad) - Respect diff config options in soft assertions "  -  by [@​sheremet-va](https://github.com/sheremet-va) in [#​8696](https://github.com/vitest-dev/vitest/issues/8696) [(7dc6d)](https://github.com/vitest-dev/vitest/commit/7dc6d54fd) - **ast-collect**: Recognize \_*vi\_import* prefix in static test discovery  -  by [@​Yejneshwar](https://github.com/Yejneshwar) in [#​10129](https://github.com/vitest-dev/vitest/issues/10129) [(32546)](https://github.com/vitest-dev/vitest/commit/325463ab2) - **coverage**: Descriptive error message when reports directory is removed during test run  -  by [@​DaveT1991](https://github.com/DaveT1991) and [@​AriPerkkio](https://github.com/AriPerkkio) in [#​10117](https://github.com/vitest-dev/vitest/issues/10117) [(14133)](https://github.com/vitest-dev/vitest/commit/1413382e1) - **snapshot**: Increase default snapshot max output length  -  by [@​hi-ogawa](https://github.com/hi-ogawa) and **Codex** in [#​10150](https://github.com/vitest-dev/vitest/issues/10150) [(21e66)](https://github.com/vitest-dev/vitest/commit/21e66ff63) - **ui**: Fix jsx/tsx syntax highlight  -  by [@​hi-ogawa](https://github.com/hi-ogawa) in [#​10152](https://github.com/vitest-dev/vitest/issues/10152) [(f1b1f)](https://github.com/vitest-dev/vitest/commit/f1b1f6c7b) - **web-worker**: Support MessagePort objects referenced inside postMessage data  -  by [@​whitphx](https://github.com/whitphx) and **Claude Opus 4.6 (1M context)** in [#​9927](https://github.com/vitest-dev/vitest/issues/9927) and [#​10124](https://github.com/vitest-dev/vitest/issues/10124) [(7ad7d)](https://github.com/vitest-dev/vitest/commit/7ad7d39af) - **api**: Make test-specification options writable  -  by [@​sheremet-va](https://github.com/sheremet-va) in [#​10154](https://github.com/vitest-dev/vitest/issues/10154) [(6abd5)](https://github.com/vitest-dev/vitest/commit/6abd557b7) #####     [View changes on GitHub](https://github.com/vitest-dev/vitest/compare/v4.1.4...v4.1.5)
vuejs/test-utils (@​vue/test-utils) ### [`v2.4.8`](https://github.com/vuejs/test-utils/releases/tag/v2.4.8) [Compare Source](https://github.com/vuejs/test-utils/compare/v2.4.7...v2.4.8) [compare changes](https://github.com/vuejs/test-utils/compare/v2.4.7...v2.4.8) ##### 🩹 Fixes - Correct declaration entrypoint ([#​2826](https://github.com/vuejs/test-utils/pull/2826)) ##### 🤖 CI - Enable pkg.pr.new ([#​2827](https://github.com/vuejs/test-utils/pull/2827)) ##### ❤️ Contributors - Cédric Exbrayat ([@​cexbrayat](https://github.com/cexbrayat)) - Daniel Roe ([@​danielroe](https://github.com/danielroe)) ### [`v2.4.7`](https://github.com/vuejs/test-utils/releases/tag/v2.4.7) [Compare Source](https://github.com/vuejs/test-utils/compare/v2.4.6...v2.4.7) [compare changes](https://github.com/vuejs/test-utils/compare/v2.4.6...v2.4.7) ##### 🚀 Enhancements - Add Chinese docs translation ([#​2552](https://github.com/vuejs/test-utils/pull/2552)) - SetData()/shallowMount with initialData for components using the Composition API /