chore(deps): bump the npm-production group with 11 updates

[dependabot]

Bumps the npm-production group with 11 updates:

Package	From	To
typescript-eslint	8.70.1	8.71.1
@opentelemetry/api-logs	0.222.0	0.223.0
@opentelemetry/sdk-logs	0.222.0	0.223.0
@opentelemetry/sdk-node	0.222.0	0.223.0
@opentelemetry/sdk-trace-node	2.11.0	2.12.0
express-rate-limit	8.7.0	8.7.1
playwright	1.63.0	1.64.0
element-plus	2.14.6	2.14.7
sass	1.105.0	1.105.1
vue-echarts	8.3.0	8.3.2
vue-router	5.3.1	5.4.0

Updates typescript-eslint from 8.70.1 to 8.71.1

Release notes

Sourced from typescript-eslint's releases.

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

• eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)
• eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
• eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
• eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
• eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
• eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
• project-service: throttle cleanup when opening files (#12934)
• type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.0

8.71.0 (2026-09-28)

🚀 Features

• eslint-plugin: [no-unsafe-enum-assignment] add rule (#12732)

🩹 Fixes

• eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#12885)
• eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)
• eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#12832)
• eslint-plugin: [no-misused-promises] handle a return outside of any function (#12912)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Fatih Çakır @​wfatih
• Josh Goldberg
• Josh Goldberg ✨
• Zamiell @​Zamiell

See GitHub Releases for more information.

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.71.1 (2026-10-05)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.0 (2026-09-28)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• d57b8da chore(release): publish 8.71.1
• 8695664 chore(release): publish 8.71.0
• See full diff in compare view

Updates @opentelemetry/api-logs from 0.222.0 to 0.223.0

Release notes

Sourced from @​opentelemetry/api-logs's releases.

experimental/v0.223.0

0.223.0

💥 Breaking Changes

• chore(web-common)!: clean up and deprecate network span utils #7114
  • These utilities were long planned for removal. They were moved from the sdk-trace-web package and are currently only used by the (deprecated) instrumentation-fetch and instrumentation-xml-http-request packages.
  • Drop the skipOldSemconvContentLengthAttrs vestigial option from addSpanNetworkEvents().

🏠 Internal

• refactor(web-common, instrumentation-fetch, instrumentation-xml-http-request): move utils from @opentelemetry/sdk-trace-web into @opentelemetry/web-common and use them in @opentelemetry/instrumentation-fetch and @opentelemetry/instrumentation-xml-http-request. With this change the instrumentations do not depend on SDK packages and the utils are kept in a shared package so we avoid code duplication.

Commits

• 92b844e chore: prepare next v2.x release (#7151)
• a859aff fix(web-common): export getElementXPath utility (#7124)
• 2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
• d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
• 5bd476e chore: move context manager to sdk-trace (#7086)
• 554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
• 788922c ci: support maintenance branch releases (#7036)
• See full diff in compare view

Updates @opentelemetry/sdk-logs from 0.222.0 to 0.223.0

Release notes

Sourced from @​opentelemetry/sdk-logs's releases.

experimental/v0.223.0

0.223.0

💥 Breaking Changes

• chore(web-common)!: clean up and deprecate network span utils #7114
  • These utilities were long planned for removal. They were moved from the sdk-trace-web package and are currently only used by the (deprecated) instrumentation-fetch and instrumentation-xml-http-request packages.
  • Drop the skipOldSemconvContentLengthAttrs vestigial option from addSpanNetworkEvents().

🏠 Internal

• refactor(web-common, instrumentation-fetch, instrumentation-xml-http-request): move utils from @opentelemetry/sdk-trace-web into @opentelemetry/web-common and use them in @opentelemetry/instrumentation-fetch and @opentelemetry/instrumentation-xml-http-request. With this change the instrumentations do not depend on SDK packages and the utils are kept in a shared package so we avoid code duplication.

Commits

• 92b844e chore: prepare next v2.x release (#7151)
• a859aff fix(web-common): export getElementXPath utility (#7124)
• 2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
• d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
• 5bd476e chore: move context manager to sdk-trace (#7086)
• 554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
• 788922c ci: support maintenance branch releases (#7036)
• See full diff in compare view

Updates @opentelemetry/sdk-node from 0.222.0 to 0.223.0

Release notes

Sourced from @​opentelemetry/sdk-node's releases.

experimental/v0.223.0

0.223.0

💥 Breaking Changes

• chore(web-common)!: clean up and deprecate network span utils #7114
  • These utilities were long planned for removal. They were moved from the sdk-trace-web package and are currently only used by the (deprecated) instrumentation-fetch and instrumentation-xml-http-request packages.
  • Drop the skipOldSemconvContentLengthAttrs vestigial option from addSpanNetworkEvents().

🏠 Internal

• refactor(web-common, instrumentation-fetch, instrumentation-xml-http-request): move utils from @opentelemetry/sdk-trace-web into @opentelemetry/web-common and use them in @opentelemetry/instrumentation-fetch and @opentelemetry/instrumentation-xml-http-request. With this change the instrumentations do not depend on SDK packages and the utils are kept in a shared package so we avoid code duplication.

Commits

• 92b844e chore: prepare next v2.x release (#7151)
• a859aff fix(web-common): export getElementXPath utility (#7124)
• 2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
• d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
• 5bd476e chore: move context manager to sdk-trace (#7086)
• 554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
• 788922c ci: support maintenance branch releases (#7036)
• See full diff in compare view

Updates @opentelemetry/sdk-trace-node from 2.11.0 to 2.12.0

Release notes

Sourced from @​opentelemetry/sdk-trace-node's releases.

v2.12.0

2.12.0

🚀 Features

• chore(sdk-trace): add StackContextManager in @opentelemetry/sdk-trace package #7086

🏠 Internal

• feat(ci): support releasing from maintenance branches #6767 @​pichlermarc
  • The API documentation site is only redeployed for releases whose commit is reachable from main, so a maintenance release no longer overwrites it.

Changelog

Sourced from @​opentelemetry/sdk-trace-node's changelog.

2.12.0

🏠 Internal

• chore(sdk-trace): add StackContextManager in @opentelemetry/sdk-trace package #7086
• feat(ci): support releasing from maintenance branches #6767 @​pichlermarc
  • The API documentation site is only redeployed for releases whose commit is reachable from main, so a maintenance release no longer overwrites it.

Commits

• 92b844e chore: prepare next v2.x release (#7151)
• a859aff fix(web-common): export getElementXPath utility (#7124)
• 2bd5a73 chore(web-common)!: deprecate addSpanNetworkEvents() et al instrumentation-...
• d60f05e doc(sdk-trace): add description for StackContextManager (#7089)
• 5bd476e chore: move context manager to sdk-trace (#7086)
• 554c0c6 chore: move sdk-trace-web utils to web-common (#7058)
• 788922c ci: support maintenance branch releases (#7036)
• See full diff in compare view

Updates express-rate-limit from 8.7.0 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

Commits

• c2e30b3 8.7.1
• b40a390 v8.7.1 changelog
• ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
• 11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
• 92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
• 0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
• 9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
• 7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
• 7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
• 784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
• Additional commits viewable in compare view

Updates playwright from 1.63.0 to 1.64.0

Release notes

Sourced from playwright's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits

• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
• 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
• 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
• 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
• dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
• Additional commits viewable in compare view

Updates element-plus from 2.14.6 to 2.14.7

Release notes

Sourced from element-plus's releases.

2.14.7

2026-09-30

Bug fixes

• Build restore workspace context for package publishing (#24934 by @​rzzf)

• Components [time-picker] avoid triggering change twice when clearing (#24841 by @​patienry)

• Improvement(components): [image-viewer] add grab cursor to image viewer (#24903 by @​ixyzorg)

Changelog

Sourced from element-plus's changelog.

2.14.7

2026-09-30

Bug fixes

• Build restore workspace context for package publishing (#24934 by @​rzzf)
• Components [time-picker] avoid triggering change twice when clearing (#24841 by @​patienry)
• Improvement(components): [image-viewer] add grab cursor to image viewer (#24903 by @​ixyzorg)

Commits

• 77d5c32 Merge pull request #24942 from element-plus/dev
• ff6b12d chore: Update changelog 2.14.7 (#24943)
• 307b91c fix(components): [time-picker] avoid triggering change twice when clearing ...
• f78ce0a chore(deps): update all patch devdependencies to ^5.0.2 (#24925)
• 95b63f3 chore(deps): update dawidd6/action-download-artifact action to v27 (#24938)
• 06efb57 chore(deps): update pnpm to v12.8.1 (#24937)
• 1bfc79c chore(deps): update dependency lint-staged to v17.6.0 (#24931)
• 80af5a1 fix(build): restore workspace context for package publishing (#24934)
• 92d3e8f chore(deps): update dependency @​types/node to ^24.19.0 (#24930)
• 7780bc6 chore(deps): update dawidd6/action-download-artifact action to v25 (#24932)
• Additional commits viewable in compare view

Updates sass from 1.105.0 to 1.105.1

Release notes

Sourced from sass's releases.

Dart Sass 1.105.1

To install Sass 1.105.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Improve error messages for @extends across different media queries.

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.105.1

• Improve error messages for @extends across different media queries.

Commits

• db3c666 Merge pull request #2869 from sass/extend-media-errors
• 2ac4515 Improve span boundaries for media queries and selectors
• 706cfbf Fix InterpolationMap._expandInterpolationSpanRight()
• 792a948 Bump bufbuild/buf-action from 1.5.0 to 1.6.0 in /.github/util/initialize (#2870)
• 61ab702 Improve errors for @extend across media queries
• 288d4e2 Auto-merge dependabot PRs as the Sass bot account (#2866)
• See full diff in compare view

Updates vue-echarts from 8.3.0 to 8.3.2

Release notes

Sourced from vue-echarts's releases.

v8.3.2

Fixes

• Fixed autoresize interrupting chart animations in containers with fractional pixel dimensions.

v8.3.1

Fixes

• Fixed TypeScript declaration errors when re-exporting or wrapping chart and graphic components.
• Fixed graphic updates when elements move between groups or use numeric IDs.
• Fixed hydration of server-rendered graphic charts with Vue 3.3.
• Fixed missed chart events when listeners and the theme change together.
• Fixed charts failing to shrink in flex-column layouts and backgrounds overflowing rounded corners.

Changelog

Sourced from vue-echarts's changelog.

8.3.2

Fixes

• Fixed autoresize interrupting chart animations in containers with fractional pixel dimensions.

8.3.1

Fixes

• Fixed TypeScript declaration errors when re-exporting or wrapping chart and graphic components.
• Fixed graphic updates when elements move between groups or use numeric IDs.
• Fixed hydration of server-rendered graphic charts with Vue 3.3.
• Fixed missed chart events when listeners and the theme change together.
• Fixed charts failing to shrink in flex-column layouts and backgrounds overflowing rounded corners.

Commits

• e05317c chore(release): prepare v8.3.2
• afdd52b fix(autoresize): preserve animations at fractional container sizes
• ea10fb6 chore(deps): update vitest to ^5.0.2
• 06a3316 chore(release): prepare v8.3.1 (#1065)
• 5c8e622 fix(types): clarify public component types and graphic declaration emit (#1064)
• e31dad5 fix(types): export component types needed for consumer declaration emit (#1060)
• e2d6c40 chore(deps): update vitest to ^5.0.1 (#1063)
• 621d1cd chore(deps): update all non-major dependencies (#1062)
• e86800b chore(deps): update pnpm to v12.4.0 (#1059)
• 0c8d0ab chore(deps): update dependency vitest-browser-vue to ^3.1.0 (#1058)
• Additional commits viewable in compare view

Updates vue-router from 5.3.1 to 5.4.0

Release notes

Sourced from vue-router's releases.

v5.4.0

   🚨 Breaking Changes

• experimental: Normalize query values to arrays  -  by @​posva in vuejs/router#2824 (f1fbc)

   🚀 Features

• Accept a prebuilt matcher in createRouter  -  by @​danielroe in vuejs/router#2804 (9de96)
• UseScrollRestoration and onRouteRendered  -  by @​posva in vuejs/router#2805 (e3dde)
• Diagnose experimental beforeEnter migration  -  by @​posva (b695c)
• experimental:
  • Warn about legacy optional param removal  -  by @​posva in vuejs/router#2818 (c2f92)
  • Extract hash params with definePage  -  by @​posva (dbf2d)
  • Configure required and default hash params  -  by @​posva (cef5c)
  • Never decode the hash, protect-only encoding  -  by @​posva in vuejs/router#2760 (aca2c)
  • Allow custom regexp for path params in definePage  -  by @​posva in vuejs/router#2822 (3a192)
• router:
  • Restore hashes and top by default  -  by @​posva (7c385)

   🐞 Bug Fixes

• Resolve experimental guard redirects against target on history navigation  -  by @​posva (2c5fb)
• experimental:
  • Keep declared case of static prefix in MatcherPatternPathStar.build()  -  by @​contactjawad in vuejs/router#2798 (4dc6b)
  • Make hash params optional and nullable  -  by @​posva (d9a4c)
  • Exclude defaults from required hash params  -  by @​posva (346e2)
  • Align hash parameter parsing with queries  -  by @​posva (cf251)
  • Keep last hash param instead of throwing  -  by @​posva (d1e8a)
  • Disallow required with a default for query params  -  by @​posva (f60e9)
  • Make query params with a default optional on push  -  by @​posva (fb604)
  • Do not inherit params, query, or hash on redirects  -  by @​posva (02a92)
• history:
  • Invalidate obsolete scroll positions  -  by @​posva and @​liuly0322 in vuejs/router#2814 (071f1)
• unplugin:
  • Sanitize named view in definePage import  -  by @​giaBaoJS in vuejs/router#2809 (0711d)
  • Keep hex character codes in param segments regexp  -  by @​kwy404 in vuejs/router#2811 (07663)

   🏎 Performance

• unplugin: Cache merged route overrides  -  by @​posva in vuejs/router#2821 (732b7)

    View changes on GitHub

Commits

• 596d481 release: vue-router@5.4.0
• 2970e8e chore: fix back extends
• 16a62f8 chore(deps): upgrade dependencies (#2828)
• b810a7e chore: remove unused types
• a0efbde docs: adapt
• 2c5fbd6 fix: resolve experimental guard redirects against target on history navigation
• 6ef3163 refactor: allow undefined on optional param
• 8e89a60 chore: comment
• 72ceb99 refactor: absolute position
• 57dd1d6 refactor: allow guards to return relative location
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

• Chores
  • Updated backend and frontend package dependencies, including observability, rate limiting, browser testing, and UI packages.
  • Updated TypeScript linting tool versions across the project.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 336cd808-cc0e-4d0d-b796-27ba009f7026

---

📥 Commits

Reviewing files that changed from the base of the PR and between 241a35f and b6a0fd1.

---

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

---

📒 Files selected for processing (6)

• apps/backend-node/package.json
• apps/frontend/package.json
• package.json
• packages/cli/package.json
• packages/shared-config/package.json
• packages/shared/package.json

---

 _________________________
< Loose code sinks ships. >
 -------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}