[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@playwright/test (source)	1.64.1 → 1.65.1			devDependencies	minor
@tailwindcss/vite (source)	4.3.3 → 4.3.5			devDependencies	patch
@vitejs/plugin-react (source)	6.1.2 → 6.3.0			devDependencies	minor
alpine (source)	3.24.3 → 3.24.4			final	patch
docker/dockerfile	1.28.0 → 1.29.0			syntax	minor
github.com/bluenviron/gohlslib/v2	v2.4.6 → v2.4.8			require	patch
github.com/go-jose/go-jose/v4	v4.1.6 → v4.1.9			require	patch
go	1.27.3 → 1.27.4			tools	patch
golang (source)	1.27.3-alpine3.24 → 1.27.4-alpine3.24			stage	patch
golang.org/x/net	v0.61.0 → v0.62.0			require	minor
golang.org/x/oauth2	v0.37.0 → v0.38.0			require	minor
golang.org/x/sync	v0.24.0 → v0.25.0			require	minor
hls.js	1.7.3 → 1.7.4			dependencies	patch
lucide-react (source)	1.61.0 → 1.73.0			dependencies	minor
modernc.org/sqlite	v1.61.0 → v1.62.0			require	minor
motion	14.6.0 → 14.14.0			dependencies	minor
node (source)	26.12.1 → 26.13.1			tools	minor
prettier (source)	3.9.10 → 3.10.1			devDependencies	minor
tailwindcss (source)	4.3.3 → 4.3.5			devDependencies	patch
vite (source)	8.3.5 → 8.3.8			devDependencies	patch

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

microsoft/playwright (@​playwright/test)

v1.65.1

Compare Source

Bug Fixes

• #​43936 [Regression]: decorated class with a static field fails to load in 1.65 ("_initClass is not a function") with useDefineForClassFields: false
• #​43934 [Bug]: Test locations are one column off under Bun 1.4.4+

Browser Versions

• Chromium 159.0.8154.6
• Mozilla Firefox 159.0
• WebKit 27.2

v1.65.0

Compare Source

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

• There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
• Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
• Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
• Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  reporter: [
    ['failures'],
    ['html', { onlyFailures: true }],
  ],
});

🎯 Test runner

• New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

  test('restart the server', { lock: '-exclusive-' }, async () => {
    // No other test runs while this one is running.
  });

• test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

  test('upload a file', async ({ page }) => {
    test.skip('Not implemented yet');
  });

• New PLAYWRIGHT_TRANSFORM_CACHE_DIR environment variable sets the directory for transpiled test files, for example on a Linux machine shared with other users.

New APIs

• New options timeout and signal in cdpSession.send().
• New testRun.mode() returns the execution mode of a suite during reporter.preprocess().

Notable Changes ⚠️

• TypeScript class fields now follow useDefineForClassFields from your tsconfig.json, the same as tsc. It is enabled for ES2022 and later targets, and when target is not specified. A field initializer that reads a constructor parameter property now fails, because the initializer runs first:

  class LoginPage {
    // TypeError: Cannot read properties of undefined (reading 'getByRole')
    readonly submit = this.page.getByRole('button', { name: 'Submit' });
  
    constructor(private readonly page: Page) {}
  }

  Move the initialization to the constructor, or set "useDefineForClassFields": false in your tsconfig.json.

• Actions such as locator.click(), locator.check(), locator.tap(), locator.fill(), locator.clear() and locator.selectOption() now wait for the element to be not inert. An action on an element with the inert attribute, or inside such an element, now times out if the element stays inert.

• A sharded run now fails with "No tests found" when no tests match across all shards. Pass --pass-with-no-tests to allow this. An empty shard still passes when other shards have tests.

• Cookie matching now follows RFC 6265. With a URL, browserContext.cookies() and apiRequestContext.cookies() no longer return host-only cookies for subdomains or Path=/api cookies for /apiv2, and a Path=/foo/ cookie does not match /foo. APIRequestContext sends a cookie without a name as Cookie: x instead of Cookie: =x, and stores Set-Cookie: token as a cookie without a name.

• Proxy credentials are no longer sent to websites. The credentials in the proxy option now answer only proxy challenges. To authenticate on a website, use httpCredentials.

• Text that the browser does not render, such as text that is not assigned to a slot or text directly inside a closed <details>, is no longer part of accessible names and aria snapshots. This can change the results of page.getByRole() with a name, locator.ariaSnapshot() and expect(locator).toMatchAriaSnapshot().

• String and URLSearchParams values of the params option in APIRequestContext requests are now appended to the query that the URL already has, instead of replacing it.

• .css, .less and .scss imports in test files now load as empty modules instead of being removed, so the imported file must exist.

• The blob reporter again deletes the content of its output directory before it writes the report. Playwright 1.64 kept reports with other names.

• Test locations of imported calls such as test( in CommonJS output now point to the start of the callee, for example a.spec.ts:3:7 instead of a.spec.ts:3:11. This is the same as in ESM.

Announcements

• ⚠️ Playwright no longer tests on Node.js 20. Use Node.js 22, 24 or 26, as listed in the system requirements.
• 🐳 Docker images now include Node.js 26 instead of Node.js 24, and the latest patch of Chromium on the same branch.

Browser Versions

• Chromium 158.0.8127.18
• Mozilla Firefox 159.0
• WebKit 27.2

This version was also tested against the following stable channels:

• Google Chrome 157
• Microsoft Edge 156

tailwindlabs/tailwindcss (@​tailwindcss/vite)

v4.3.5

Compare Source

Fixed

• Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#​20663)
• Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#​20658, #​20666)
• Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#​20667)
• Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#​20660)
• Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#​20665)
• Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#​20487)
• Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#​20632)

v4.3.4

Compare Source

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#​20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#​20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#​20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#​20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#​20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#​20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#​20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#​20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#​20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#​20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#​20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#​20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#​20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#​20408)
• Drop invalid UTF-8 candidates during class detection (#​20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#​20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#​20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#​20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#​20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#​20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#​20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#​20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#​20508)
• Improve style invalidation performance of group-* and peer-* variants (#​20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#​20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#​20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#​20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#​20563)
• Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#​20563)
• Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#​20569)
• Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#​20516)
• Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#​20561)
• Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#​20547, #​20572)
• Underline the correct occurrence of an unsupported data type in --value(…) warnings (#​20554)
• Canonicalization: prefer an existing candidate when collapsing utilities over another utility with the same default theme value (e.g. text-foreground text-primary → text-primary, not text-card-checked-border) (#​20540)
• Canonicalization: don't collapse utilities into a utility that uses another theme variable with the same default value (e.g. mt-card mb-card → my-card, not my-4) (#​20574)
• Ensure @tailwindcss/postcss rewrites relative url(…)s of stylesheets that are inlined before it runs (e.g. @imports in Vite) in optimized builds (#​20576)
• Drop nested rules that put a combinator after a pseudo-element when using pseudo-element variants (e.g. selection:* on a utility with a nested & > * rule) (#​20575)
• Don't generate CSS for arbitrary values with unbalanced parentheses or brackets (e.g. w-[calc(1px] or [--x:a[b]) (#​20577)
• Canonicalization: prevent collapse: true from taking exponentially longer when classes are linked through a utility that sets many properties (e.g. sr-only) (#​20558)
• Ensure & is substituted inside :-moz-any(…) and :-webkit-any(…) in custom variants (e.g. @custom-variant firefox (:-moz-any(&));) (#​20486)
• Ensure the standalone macOS binaries have a valid code signature, so macOS 27 no longer kills them at launch (#​20578)
• Ensure @tailwindcss/turbopack and @tailwindcss/webpack rebuild when the input CSS changes (e.g. next dev with Turbopack no longer serves the CSS of the previous edit) (#​20582)
• Canonicalization: don't drop a utility that sets a --tw-* variable when an unrelated property has the same value (e.g. link mt-4 no longer becomes mt-4 when link sets margin-top: 16px and --tw-translate-x: 16px) (#​20593)
• Decode single-digit hexadecimal escapes in theme variable and @utility names as the CSS spec does (e.g. @theme { --color-\0: red; } no longer registers --color-0) (#​20591)
• Don't treat !important inside strings, comments or url() in declaration values as the important flag (e.g. content: "a !important b") (#​20627)
• Parse a custom property at the end of the input when it has no trailing ; (e.g. --foo: bar as the last declaration) (#​20653)
• Keep a declaration without a ; at the end of the CSS input (e.g. color: red) (#​20655)

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.3.0

Compare Source

Make reactCompilerPreset work with @rolldown/plugin-babel's parallel option (#​1549)

reactCompilerPreset now refers to its Babel preset by module path instead of by function, so it can be sent to worker threads.

v6.2.1

Compare Source

Fix refreshInclude and refreshExclude options not working (#​1543)

Fix mistake from #​1516

v6.2.0

Compare Source

Add refreshInclude and refreshExclude options (#​1516)

Add refreshInclude and refreshExclude options to skip fast refresh for certain files that won't run in the browser.

Expand oxc-transform-react peer dependency range (#​1540)

The peer dependency version range for oxc-transform-react was expanded from ^0.152.0 to >=0.152.0 <0.157.0.

Expand @rolldown/plugin-babel peer dependency range (#​1541)

The peer dependency version range for @rolldown/plugin-babel was expanded from ^0.1.7 || ^0.2.0 to ^0.1.7 || ^0.2.0 || ^0.3.0.

bluenviron/gohlslib (github.com/bluenviron/gohlslib/v2)

v2.4.8

Compare Source

v2.4.7

Compare Source

go-jose/go-jose (github.com/go-jose/go-jose/v4)

v4.1.9

Compare Source

Fixed

• OpaqueSigner now supports unrecognized public key types again (#​325, fixes a regression in v4.1.5)
• Parsing a JWK with an unsupported elliptic curve, or a too-big RSA modulus, now returns ErrUnsupportedKeyType (#​327)

Full Changelog: go-jose/go-jose@v4.1.8...v4.1.9

v4.1.8

Compare Source

Added

• ML-DSA support by @​james-d-elliott in #​282 🎉

v4.1.7

Compare Source

Fixed Security Issues

• Thumbprint: reject invalid RSA key (#​317) - GHSA-r39w-98wm-9pp6
• json: backport stdlib fix for embedded unexported field (#​318) - GHSA-27pc-rm86-68pq
• Detect if headers are set by presence in the map (#​319) - GHSA-p9j4-2j95-j4rv
• limit RSA size in certificate verify (#​315) - GHSA-v6h2-qj3f-2h6v
• Limit recipients and signatures in JWE/JWS (#​316) - GHSA-c67m-wr4h-2ccg

Fixed

• jwk: fix bug in x5c parsing (#​311)
• reject base64-encoded "null" in protected headers (#​309)

Deprecated

• deprecate ParseEncrypted / ParseSigned (#​222)

golang/go (go)

v1.27.4

Compare Source

video-dev/hls.js (hls.js)

v1.7.4

Compare Source

Summary

HLS.js v1.7.4 includes bug fixes and improvements over the last release.

Changes Since The Last Release

Bug fixes and improvements

Low-latency HLS

• Fix skipping unloaded trailing parts at fragment boundaries (#​8055) @​darfink
• Advance part loading once all parts of a fragment are loaded (#​8134, follow-up to #​8055) @​robwalch
• Adjust playlist position using first part start PTS (#​8105, fixes #​8098)
• Fix repeated audio buffer flushing when setting nextAudioTrack during Low-Latency HLS part loading (#​8104)
• Fix LL-HLS subtitle stall from one-ULP rounding in final-part comparison (#​8057, fixes #​8051) @​akashchamp

Content protection (DRM / EME)

• Reuse attached MediaKeys across loadSource (#​8095, fixes #​8092) @​krseager
• Reuse attached MediaKeys when loadSource re-attaches media, and serialize setMediaKeys calls (#​8120, fixes #​8092) @​matvp91
  • Introduces experimental, opt-in only, reuseKeySessions configuration option
• Keep pending setMediaKeys when the same keys are requested while media is detached (#​8076)
• FairPlay Streaming: reset MediaKeys when changing the MediaSource (#​8131) @​robwalch

Interstitials

• Set a schedule position when interstitial fallback happens with nothing playing (#​8088) @​Arthur031221
• Trigger INTERSTITIAL_ENDED for unresolved interstitials (empty asset-list, or removed from schedule while loading) (#​8090, fixes #​8082) @​robwalch

Alternate audio

• Prevent loop loading of audio in the next discontinuity (f86f247) @​robwalch
• Complete audio track switch when switching back to the currently playing track (#​8093, fixes #​8089) @​krseager
• Defer main BUFFER_EOS while an alternate audio track switch is in progress (#​8053) @​brandonocasey

Subtitles & captions (WebVTT / IMSC1)

• Keep frames in IMSC1 clock times and apply frameRateMultiplier (#​8086) @​luantaraschi
• Keep the text before and between nested spans in IMSC1 cues (#​8060, fixes #​8069)
• Fix IMSC1 and subtitle loading after interstitial media detach, including IMSC1 parsing without a known initPTS (#​8077) @​matvp91
• Make subtitle-stream-controller tracksBuffered a sparse array (#​8108, follow-up to #​8077) @​robwalch
• Keep no-break space lines in WebVTT cues (#​8061, fixes #​5337) @​lagudafuadtosin

Fragment loading & stream controllers

• Fix bytes/bits mismatch in isFragmentNearlyDownloaded and handle unknown fragment length (#​8097, fixes #​8096) @​krseager
• Dispatch errors for dependent fragments to ensure reload (#​8127, fixes #​8118) @​robwalch
• Improve writing of all stream controllers' lastCurrentTime on tick end (#​8116, follow-up to #​8115)
• Keep stream controllers STOPPED when stopLoad() aborts a fragment load (#​8125, fixes #​8119) @​BeyondITL-Mossaddique
• Load the start fragment again when its request is aborted before anything is buffered (#​8115, fixes #​8109) @​b84330808

MediaSource & buffering

• Mark fragments as gaps on SourceBuffer errors (#​8045, fixes #​8035) @​hongjun-bae
• Detach instead of resetting MediaSource when the media element switched to another source (#​8085, fixes #​8073) @​lpommers
• Cancel async end-of-stream operation when ended state is no longer true (#​8128, fixes #​8122) @​robwalch

Playlist loading & parsing

• Do not wait for previously loaded playlist to reload on switch unless stale (#​8107, fixes #​8091) @​robwalch
• Fix parsing of #EXTINF durations without digits after the decimal point (#​8113, fixes #​8112) @​Enesuygurs
• Only re-align discontinuity counts forward when merging playlists (#​8048) @​hongjun-bae

Demuxing, remuxing & timestamps

• Fix parameter set truncation, a v1.7.0 regression introduced in a03d5b1 (#​8049, fixes #​8043) @​robwalch
• Keep the timing of later progressive chunks of a segment (#​8058, fixes #​6764) @​lagudafuadtosin
• Anchor initPTS on video PTS at discontinuities reached in sequence (#​8083, fixes #​8064) @​littlespex
• Reset TS video parser when contiguity is reset (#​8081) @​pserb
• Keep injected silent audio frames from starting before initPTS (#​8110) @​stevan-borus

Documentation

• Update the README introduction for 2026 (#​8111) @​robwalch
• Update README player integrations (7718b9f)

CI

• Use wrangler pages deploy instead of the deprecated pages publish (#​8114) @​jasontd92

Demo Page

https://ff9f8343.hls-js-dev.pages.dev/demo/

API and Breaking Changes

While breaking changes are not expected between minor versions, if you are upgrading from version v1.16 or lower, see the MIGRATING guide for changes.

The new (experimental) reuseKeySessions option (default false) keeps key sessions open across loadSource() calls, so keys that match an open session don't need a new license request.

Feedback

Please provide feedback via Issues in GitHub. For more details on how to contribute to HLS.js, see our CONTRIBUTING guide.

lucide-icons/lucide (lucide-react)

v1.73.0: Version 1.73.0

Compare Source

What's Changed

• fix(lucide-react-native): include license banner once instead of in every module by @​daud4653 in #​5194
• feat(lab): added trap icon by @​rrod497 in #​4427
• feat(icons): added graph-ring icon by @​Carl-Lambert in #​5195
• feat(icons): added layout-grid-plus icon by @​AleksejDix in #​3720
• feat(icons): added cap icon by @​Flaig82 in #​3802
• chore(angular): stop tracking the ng-packagr build cache by @​lx3133584 in #​5202

New Contributors

• @​daud4653 made their first contribution in #​5194
• @​Flaig82 made their first contribution in #​3802

Full Changelog: lucide-icons/lucide@1.72.0...1.73.0

v1.72.0: Version 1.72.0

Compare Source

What's Changed

• feat(site): add keyboard shortcuts to the icons page by @​PrimeTestLab in #​5035
• feat(icons): added mound-shovel icon by @​jwlinqx in #​4329
• feat(icons): added text-pen icon by @​rrod497 in #​4937
• feat(icons): flipped route icon, added route-arrow-right icon by @​samuelalake in [#​47

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
github.com/asticode/go-astits	v1.16.0 -> v1.17.0
modernc.org/libc	v1.79.0 -> v1.80.1