chore(deps-dev): bump the development-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the development-dependencies group with 6 updates in the / directory:

Package	From	To
@electron/asar	3.4.1	4.3.0
electron	44.3.0	44.4.1
jsdom	30.0.1	30.1.0
prettier	3.9.6	3.9.7
typescript	6.0.3	7.0.2
vitest	5.0.0	5.0.1

Updates @electron/asar from 3.4.1 to 4.3.0

Release notes

Sourced from @​electron/asar's releases.

v4.3.0

4.3.0 (2026-08-18)

Features

• store duplicated file contents only once when packing (#465) (01bc908)

v4.2.1

4.2.1 (2026-07-21)

Bug Fixes

• add circular symlink detection and depth limit protection (#423) (fd0fcd8)
• add DoS validation for asar archive headers and file entries (#419) (51cd188)
• add header validation for ASAR archives (#421) (00e5293)
• add offset validation to readFileSync to prevent out-of-bounds reads (#420) (97c09cc)
• add path validation to prevent directory traversal attacks (#418) (de0689b)
• compute integrity over transformed bytes when a transform is applied (#450) (8c9be01), closes #277
• constrain extractFile reads to the unpacked directory (#451) (1f4b01d)
• improve symlink validation to prevent directory traversal attacks (#422) (c43f92b)
• replace commander with native Node.js parseArgs (#416) (42b25d0)
• resolve absolute symlink targets correctly when packing (#452) (0087cfa), closes #366

v4.2.0

4.2.0 (2026-03-31)

Features

• Revert "feat: add integrity digest management commands and functional… (#424) (49681b1), closes #380

v4.1.2

4.1.2 (2026-03-28)

Performance Improvements

• 5-7x faster packing, 15-20% faster extraction (#414) (79686b6), closes #417

v4.1.1

4.1.1 (2026-03-24)

Bug Fixes

• pickle resize overflow, stream flush race, integrity block boundary (#413) (f1f0a8f)

v4.1.0

... (truncated)

Commits

• 01bc908 feat: store duplicated file contents only once when packing (#465)
• 2bf3408 build(deps): bump postcss from 8.5.20 to 8.5.24 (#463)
• ab7bc41 build(deps): bump undici from 7.28.0 to 7.29.0 (#462)
• d934f9a build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#459)
• 1ce80a7 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#460)
• 9428c25 build(deps): bump brace-expansion from 5.0.7 to 5.0.8 (#461)
• c4354ae ci: stop setting the Opened project field (#456)
• 8e12da2 build(deps): bump postcss from 8.5.15 to 8.5.20 (#458)
• 4d5d687 build(deps): bump linkify-it from 5.0.1 to 5.0.2 (#457)
• 0959a13 build(deps): bump brace-expansion from 5.0.6 to 5.0.7 (#455)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​electron/asar since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates electron from 44.3.0 to 44.4.1

Release notes

Sourced from electron's releases.

electron v44.4.1

Release Notes for v44.4.1

Fixes

• Fixed default protocol client APIs falsely returning true on Windows. #53959 (Also in 43, 45)
• Fixed several object lifetime issues in Debugger, Menu, Tray, Notification, globalShortcut, utilityProcess, ServiceWorkerMain, WebFrameMain, webFrame, sharedTexture, systemPreferences, netLog, MessagePortMain, net.request and shell.openPath(). #53968 (Also in 45)

electron v44.4.0

Release Notes for v44.4.0

Features

• Added initiatorOrigin to webRequest and protocol handler requests, DownloadItem.getInitiatorOrigin(), and a trailing frame argument to the will-download and preconnect session events. #53703 (Also in 43, 45)

Fixes

• Added validation to protocol.registerSchemesAsPrivileged() to reject protocol names that do not conform to RFC 3986 URI scheme grammar. #53743 (Also in 45)
• Fixed a crash when a webContents navigated to the Chrome Web Store and the page invoked the unsupported chrome.webstorePrivate API. #53776 (Also in 45)
• Fixed a main-process crash when an app called loadURL() again right after a load failed because the renderer process exited before the page committed. #53943 (Also in 43, 45)
• Fixed a memory leak on Windows when app.getPreferredSystemLanguages() was called. #53868 (Also in 43, 45)
• Fixed a potential UAF in app.getPreferredSystemLanguages() on Windows. #53865 (Also in 43, 45)
• Fixed a renderer crash that could occur when printing from an iframe. #53762 (Also in 43, 45)
• Fixed a renderer crash when an iframe was removed right after loading with nodeIntegrationInSubFrames enabled and sandbox disabled, e.g. on pages that embed Meta Pixel. #53885 (Also in 42, 43, 45)
• Fixed a Windows renderer crash when no default locale could be determined. #53947
• Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled. #53749 (Also in 43, 45)
• Fixed helper executables on macOS starting a second app instance when launched without a process type, for example through child_process.fork() with the runAsNode fuse disabled; fork() now throws in that configuration. #53840 (Also in 45)
• Fixed V8 code caching for https scripts loaded by file:// and custom-scheme pages. #53745 (Also in 45)
• Fixed webContents emitting unresponsive right after the system wakes from sleep on Windows, and emitting responsive when a hung window was hidden rather than when it recovered. #53764 (Also in 45)
• Fixed webContents.capturePage() on offscreen windows returning an image resampled to the display's scale factor instead of rendered at the window's offscreen.deviceScaleFactor. #53816 (Also in 43, 45)
• Fixed Window Controls Overlay CSS environment variables and navigator.windowControlsOverlay not being populated for WebContentsViews in a BaseWindow. #53812 (Also in 45)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, libyuv, PDFium and V8. #53769
• Updated Node.js to v24.21.0. #53779

Commits

• 09d1a65 fix: cppgc object lifetime follow-ups (44-x-y) (#53968)
• 8f9454a test: gate specs on testing bindings (#53964)
• dc105cf fix: correct SUCCEEDED/FAILED usage on non-HRESULT return values (#53959)
• 1a37b33 test: isolate reporting API session (#53955)
• 81ef9c7 chore: cherry-pick 4b33582833e5 from chromium (#53947)
• b71433f fix: post navigations started while a dead renderer is torn down (#53943)
• 93a67b4 test: avoid exit race in utility process DNS spec (#53935)
• 8dbc0a0 perf: push preload paths to Node.js renderers instead of a sync IPC at startu...
• 6686ae6 docs: remove outdated Linux quirk documentation (#53921)
• 4cadda1 build: run webpack in production mode, minify only release bundles (#53917)
• Additional commits viewable in compare view

Updates jsdom from 30.0.1 to 30.1.0

Release notes

Sourced from jsdom's releases.

v30.1.0

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

• Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
• Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
• Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
• Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
• Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
• Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
• Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
• Changed window.close() to preserve access to the document and its DOM through retained references.
• Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
• Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)
• Fixed document.querySelector() failing to find a matching element when an earlier element has the same ID but does not match the rest of the selector. (@​vojtisprime11)
• Fixed :focus matching in shadow trees. (@​asamuzaK)
• Fixed DOM insertion and replacement, including valid document.replaceChildren() calls, invalid document element and doctype placements, and mutations during element.replaceWith().
• Fixed the ordering of script execution, custom element callbacks, iframe loading, and mutation observer notifications during DOM insertion, including in shadow trees.
• Fixed queued events and navigation continuing after window.close() or iframe removal, and prevented new scripts, resource loads, timers, and animation frames from starting in destroyed documents. (@​scttcper)
• Fixed parent documents waiting indefinitely for loading to finish when a child iframe removes itself during loading.
• Fixed request cancellation across redirects, during pending requestInterceptor() callbacks, and when reusing an XMLHttpRequest after aborting it.
• Fixed resource loading and JSDOM.fromURL() potentially hanging when response handling throws and response stream cleanup does not finish.
• Fixed successful cached resource loads being treated as aborted.
• Fixed getComputedStyle() and document.styleSheets using the wrong stylesheet order after inserting or updating <style> elements.
• Fixed getComputedStyle() ignoring nested @import and @media rules in imported stylesheets, and returning stale results after imports finish loading.
• Fixed style invalidation, stylesheet removal, and frame source updates in shadow trees.
• Fixed repeated getComputedStyle() calls changing case-sensitive background URLs, and inconsistent resolution of border shorthands containing system colors. (@​scttcper)
• Fixed computed border widths, including borderless elements incorrectly reporting 16px, which regressed in v30.0.0. (@​Alberto-BaseNet)
• Fixed getComputedStyle() to resolve 'font-weight' keywords to numeric values. (@​tianrking)
• Fixed getComputedStyle() to convert lengths to pixels inside CSS math functions containing percentages, and to resolve percentages in 'font-size' math functions. (@​soroushm)
• Fixed serialization of min() and max() containing nested calc(), which regressed in v30.0.0. (@​asamuzaK)
• Fixed CSS values mixing lengths or percentages with math functions, such as 'grid-template-columns' values containing both 100px and calc(). (@​rome-xi)
• Fixed parsing of 'background' and 'border' shorthands with adjacent components, such as url(a.png)no-repeat, including a crash when parsing inline styles. Also fixed handling of invalid shorthand assignments and escaped or unusual characters in CSS declarations. (@​asamuzaK)
• Fixed parsing of unitless zero values in 'flex' shorthands, such as 35 1 0, and rejection of negative 'flex-basis' lengths and percentages. (@​asamuzaK)
• Fixed shorthand style assignments producing extra mutation records and custom element callbacks for intermediate values. (@​scttcper)
• Fixed Range and Selection handling of CDATA sections, including boundary offsets and range cloning, extraction, deletion, insertion, and stringification. (@​scttcper)
• Fixed text.normalize() incorrectly removing the text node or merging its siblings. (@​scttcper)
• Fixed cloning and importing CDATA sections and processing instructions whose contents have been modified, and serialization of CDATA sections adopted into HTML documents.
• Fixed stale named-property collections on window, and incorrect named access from empty or namespaced id="" and name="" values. (@​scttcper)
• Fixed elements in documents created with DOMParser or document.implementation.createHTMLDocument() appearing as named properties on window and being retained in memory. (@​Iaotle)
• Fixed memory leaks from mutation observers retaining observed nodes, abort signals retaining removed event listeners, and storage event tracking retaining closed windows. (@​scttcper)
• Fixed storage events being sent to windows created after the storage change, and ensured surviving recipients still receive events when the source document is destroyed.
• Fixed attribute lookups after namespace prefix changes, and namespaced attributes incorrectly affecting ID lookups and element behavior. (@​scttcper)
• Fixed input.list in detached element trees. (@​scttcper)
• Fixed attr.ownerDocument after setting an attribute node on an element in another document or adopting its element. (@​Kjubikstronk)

... (truncated)

Commits

• 556b11f 30.1.0
• 9547fbf Tie queued tasks to document lifetime
• 3be65d9 Disable unused HTML reports in the WPT runner
• d555e61 Replace SymbolTree with a DOM-specific tree
• f28983d Clone CDATA and processing instructions without revalidation
• 33e4fa7 Invalidate computed styles after CSS imports load
• ec6fd5b Select storage event recipients at mutation time
• bcc037a Honor script type and legacy event attributes
• faa5c4f Preserve currentScript across nested scripts
• 8d7a37f Avoid quadratic HTML collection iteration
• Additional commits viewable in compare view

Updates prettier from 3.9.6 to 3.9.7

Release notes

Sourced from prettier's releases.

3.9.7

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.7

diff

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @​Austin1serb, @​giaBaoJS)

<!-- Input -->
- [x] short first line.
  second paragraph at six spaces that wraps
  onto another line here.

<!-- Prettier 3.9.6 -->

 
short first line.
second paragraph at six spaces that wraps
    onto another line here.



<!-- Prettier 3.9.7 -->

 
short first line.
second paragraph at six spaces that wraps
onto another line here.

JavaScript: Fix embedded template literal idempotency (#19725 by @​fisker)

// Input
const foo = html`
            <div>${getText({
            value,
            })}</div>
`;
// Prettier 3.9.6 (first format)
const foo = html&lt;div&gt; ${getText({ value, })} &lt;/div&gt;;
// Prettier 3.9.6 (second format)
const foo = html`
<div>
</tr></table>

... (truncated)

Commits

• 0449af3 Release 3.9.7
• 43cd5b0 Allow verify markdown test with mdx parser
• ab8c911 Fix test on Node.js v26 (#19927)
• 4a5adf9 Fix tests
• 3404375 Update @typescript-eslint/typescript-estree to v8.70.0
• c60f106 Angular: Support @boundary / @error error boundaries (#20015)
• 297117a Fix HTML block indentation drift in markdown list items (#19987)
• 0df4e49 Fix indentation drift for indented code blocks in list items (#19990)
• 9ef216d Fix Markdown task list indentation drift (#19647)
• 2158d48 Strip blockquote markers from a setext heading's continuation lines (#19878)
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates vitest from 5.0.0 to 5.0.1

Release notes

Sourced from vitest's releases.

v5.0.1

   🚀 Features

• ui:
  • Move trace attempts selector to viewer header  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11189 (5dc4b)
  • Add focused trace view layout mode  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in vitest-dev/vitest#11190 (376dc)

   🐞 Bug Fixes

• Exit 1 when vitest list fails collection  -  by @​hamed-bavar in vitest-dev/vitest#11145 and vitest-dev/vitest#11146 (6108b)
• Keep parse error details in static collection  -  by @​hamed-bavar in vitest-dev/vitest#11150 and vitest-dev/vitest#11151 (7c818)
• Avoid recursive prototype in automocking  -  by @​sheremet-va in vitest-dev/vitest#11195 (99fc5)
• Prevent false Vitest import resolution  -  by @​sheremet-va in vitest-dev/vitest#11196 (b426c)
• Keep metadata file when clearing the cache  -  by @​sheremet-va in vitest-dev/vitest#11199 (73614)
• Correct typos in error message and comments  -  by @​shinji00222 and Shinji in vitest-dev/vitest#11187 (115c3)
• Resolve ResolvedConfig exactOptionalPropertyTypes errors  -  by @​LukeAbby in vitest-dev/vitest#11175 (498fb)
• Share the server on self-referencing extends  -  by @​sheremet-va in vitest-dev/vitest#11034 (23dda)
• Warn when deprecated deps.optimizer.web is used  -  by @​im10furry in vitest-dev/vitest#11214 (2ce29)
• browser:
  • Avoid double quotes in config.define  -  by @​sheremet-va in vitest-dev/vitest#11198 (972e2)
• doctor:
  • Measure vm pools for custom environments  -  by @​sheremet-va in vitest-dev/vitest#11212 (91ab1)
• expect:
  • Correct return value in toMatchAriaSnapshot  -  by @​sheremet-va in vitest-dev/vitest#11208 (c119b)
• fakeTimers:
  • Force queueMicrotask and nextTick in toNotFake  -  by @​kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @​hi-ogawa in vitest-dev/vitest#11261 (a47d7)
• snapshot:
  • Report obsolete keys next to skipped tests  -  by @​hamed-bavar, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#11157 and vitest-dev/vitest#11158 (17e2b)
• types:
  • Make public declarations self-contained  -  by @​ZoeySigel in vitest-dev/vitest#11141 (45546)
• ui:
  • Fix collapse/expand suite with file name search  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11260 (0a712)
  • Fix explorer file summary count  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in vitest-dev/vitest#11125 (05982)
• utils:
  • Fix deepMerge to handle prototype  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11215 (4944c)

    View changes on GitHub

Commits

• 03630a5 chore: release v5.0.1 (#11275)
• a47d790 fix(fakeTimers): force queueMicrotask and nextTick in toNotFake (#11261)
• 2ce29d5 fix: warn when deprecated deps.optimizer.web is used (#11214)
• ccd6d05 docs: fix typecheck exclude default in documentation (#11223)
• 91ab158 fix(doctor): measure vm pools for custom environments (#11212)
• 23dda73 fix: share the server on self-referencing extends (#11034)
• 498fbe9 fix: resolve ResolvedConfig exactOptionalPropertyTypes errors (#11175)
• 115c3f6 fix: correct typos in error message and comments (#11187)
• 7361465 fix: keep metadata file when clearing the cache (#11199)
• 972e24b fix(browser): avoid double quotes in config.define (#11198)
• Additional commits viewable in compare view