chore(deps): bump the frontend group across 1 directory with 5 updates

[dependabot]

Bumps the frontend group with 5 updates in the / directory:

Package	From	To
@tauri-apps/plugin-updater	2.10.1	2.12.0
@tauri-apps/cli	2.11.4	2.11.5
@types/node	26.4.0	26.6.2
playwright	1.62.1	1.63.0
svelte	5.57.0	5.57.1

Updates @tauri-apps/plugin-updater from 2.10.1 to 2.12.0

Release notes

Sourced from @​tauri-apps/plugin-updater's releases.

updater-js v2.12.0

[2.12.0]

• 1308bfa3 Breaking change: the allowDowngrades option was removed from the check command and is now read from the plugin configuration instead.

  Previously any code running in the webview could pass allowDowngrades: true to plugin:updater|check and relax the version check from "the update must be newer" to "the update must be different", overriding the comparator the application had configured on the Rust side. The flag is now an application-level setting:

  {
    "plugins": {
      "updater": {
        "allowDowngrades": true
      }
    }
  }

  It defaults to false, and is ignored when the application provides its own Builder::default_version_comparator, which continues to take precedence.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-updater@2.12.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.2kB README.md
npm notice 3.2kB dist-js/index.cjs
npm notice 3.0kB dist-js/index.d.ts
npm notice 3.2kB dist-js/index.js
npm notice 659B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-updater
npm notice version: 2.12.0
npm notice filename: tauri-apps-plugin-updater-2.12.0.tgz
npm notice package size: 3.9 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: f3b47d4bae20f5499efe043f4debb7c85f88b9b3
npm notice integrity: sha512-74+g7rSIHXQje[...]osT+6nphSa8Og==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2893838281
</tr></table> 

... (truncated)

Commits

• 5baf71a fix: pnpm audit
• 2393188 publish new versions (#3591)
• 1198a52 Merge commit from fork
• 1308bfa Merge commit from fork
• 690dcfd Merge commit from fork
• 67cd25a fix(single-instance): let the first instance come to front on Windows (#3592)
• 2df3d93 refactor(log): log webview location after double colon (#3574)
• 4b5c954 chore(deps): update dependency typescript-eslint to v8.70.0 (#3536)
• 3c5d267 publish new versions (#3567)
• c050e07 fix(store): apply_pending_auto_save can deadlock (#3572)
• Additional commits viewable in compare view

Updates @tauri-apps/cli from 2.11.4 to 2.11.5

Release notes

Sourced from @​tauri-apps/cli's releases.

@​tauri-apps/cli v2.11.5

[2.11.5]

Security fixes

• 5a87bab12 Record the app version in the trusted comment of updater signatures, so a signed artifact is bound to the version it was released as.

  An update endpoint response is not signed, and the signature only covers the downloaded artifact, so the announced version on its own does not prove which release the url and signature point at. minisign covers the trusted comment with its global signature, which lets the updater plugin compare the two and reject a response that pairs a version number with a different release. Enable requireSignedVersion in the updater plugin configuration to enforce this.

  tauri build fills the version in automatically, and tauri plugin add updater now enables requireSignedVersion for the project it is adding the plugin to. tauri signer sign gains an --app-version flag for signing updater artifacts by hand, and warns when it is omitted.

Dependencies

• Upgraded to tauri-cli@2.11.5

Commits

• 9452dde fix audit
• 7c2fe9f run covector version
• 7d71a8a add publish-hotfix workflow
• 5a87bab Merge commit from fork
• e901f1d Merge commit from fork
• 7cd7136 apply version updates (#15632)
• 44594d6 Revert "fix(deps): pin time to <0.3.52" (#15631)
• ca90b46 apply version updates (#15621)
• ba865f2 fix(windows): dpi getter leaks HDC handles (#15614)
• 0299da0 fix(deps): pin time to <0.3.52 (#15616)
• Additional commits viewable in compare view

Updates @types/node from 26.4.0 to 26.6.2

Commits

• See full diff in compare view

Updates playwright from 1.62.1 to 1.63.0

Release notes

Sourced from playwright's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates svelte from 5.57.0 to 5.57.1

Release notes

Sourced from svelte's releases.

svelte@5.57.1

Patch Changes

• fix: cancel deferred event listeners during cleanup (#18749)

• fix: preserve global CSS in components without scopable elements (#18793)

• fix: reduce SSR render result garbage collection (#18798)

• fix: resolve the fallback of an each block in the enclosing scope (#18803)

• perf: speed up parser interactions with Acorn or avoid them where possible (#18740)

• fix: prevent effect tree of batches from interfering with each other (#18508)

• fix: serialize input default values during server rendering (#18733)

• fix: remove WAS_MARKED flag in favor of Set (#18127)

• fix: throw set_context_after_init when setContext is called after an await during SSR (#18739)

• fix: make Object.hasOwn reactive for state proxy ownership changes (#18838)

• fix: keep $state.eager when used as a variable initializer (#18809)

• perf: avoid regex matching in parser where possible (#18736)

• fix: in non-async mode, only push variable to current_sources when active_reaction is updating (#18550)

• fix: recognise aria-braillelabel and aria-brailleroledescription as known ARIA attributes (#18765)

Changelog

Sourced from svelte's changelog.

5.57.1

Patch Changes

• fix: cancel deferred event listeners during cleanup (#18749)

• fix: preserve global CSS in components without scopable elements (#18793)

• fix: reduce SSR render result garbage collection (#18798)

• fix: resolve the fallback of an each block in the enclosing scope (#18803)

• perf: speed up parser interactions with Acorn or avoid them where possible (#18740)

• fix: prevent effect tree of batches from interfering with each other (#18508)

• fix: serialize input default values during server rendering (#18733)

• fix: remove WAS_MARKED flag in favor of Set (#18127)

• fix: throw set_context_after_init when setContext is called after an await during SSR (#18739)

• fix: make Object.hasOwn reactive for state proxy ownership changes (#18838)

• fix: keep $state.eager when used as a variable initializer (#18809)

• perf: avoid regex matching in parser where possible (#18736)

• fix: in non-async mode, only push variable to current_sources when active_reaction is updating (#18550)

• fix: recognise aria-braillelabel and aria-brailleroledescription as known ARIA attributes (#18765)

Commits

• 636eaaa Version Packages (#18750)
• 8030ff2 fix: remove incorrect special handling of :export pseudo-selectors (#18839)
• a72dc8e fix: make Object.hasOwn reactive for state proxies (#18838)
• 6eb720a chore: scope.js stops importing from the analysis visitors (#18787)
• e6ae460 chore: analysis and transform stop importing each other (#18786)
• 5981c06 chore: move parser helpers next to their users (#18785)
• f2ad10e fix: preserve global CSS without scopable elements (#18793)
• a8a9b02 fix: reduce SSR render result garbage collection (#18798)
• 6be176d fix: resolve the fallback of an each block in the enclosing scope (#18803)
• 34b13ac fix: keep $state.eager when used as a variable initializer (#18809)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.