build(deps-dev): bump jsdom from 25.0.1 to 30.1.2 by dependabot[bot] · Pull Request #405 · saquibrashid/nextup

dependabot · 2026-09-29T19:46:03Z

Bumps jsdom from 25.0.1 to 30.1.2.

Release notes

v30.1.2

Updated URLs to support Unicode v18.0.0 in internationalized domain names.

Reduced package size and memory use for CSS property definitions. (@scttcper)

Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@cmdcolin)

Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@scttcper)

Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.

Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.

Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@asamuzaK)

Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@asamuzaK)

Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.

Fixed a memory leak where stylesheet parsing retained the last parsed stylesheet's window after window.close().

Fixed memory growth from long-lived MutationObserver instances retaining bookkeeping for garbage-collected nodes. (@scttcper)

Fixed retained select.selectedOptions collections becoming stale after selection changes and form resets.

Fixed rejection of negative CSS sizing values, including for 'min-width', 'min-height', 'max-width', and 'max-height', which regressed in v30.1.0.

Fixed handling of deeply nested color-mix() expressions, including exceptions during color resolution. (@asamuzaK)

v30.1.1

Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0. (@asamuzaK)

Fixed focus and blur behavior across frames, and focusing the document's viewport through document.documentElement.focus(). (@asamuzaK)

Fixed focus targets removed or disabled by blur listeners becoming active, and text selections made by focus and blur listeners being overwritten. (@asamuzaK)

Fixed element.focus() incorrectly focusing disabled form controls and <input type="hidden"> elements with tabindex="". (@scttcper)

Fixed invalid style.setProperty() calls changing existing !important priorities, serialized styles, or mutation records. (@FedgeNo)

Fixed !important handling when updating CSS longhands after shorthands, using variables or CSS-wide keywords, and assigning style properties directly. (@FedgeNo)

Fixed <noscript> parsing with includeNodeLocations: true or inside frames to honor the runScripts option.

Fixed the storageQuota option being ignored by frames.

Fixed encoding detection of HTML and XML byte input to honor XML encoding declarations and detect UTF-16 without a byte order mark.

Fixed exceptions caused by truncated charset parameters in <meta> elements, and encoding detection incorrectly using incomplete <meta> tags. (@FedgeNo)

Fixed XML serialization errors for namespaces named constructor, toString, __proto__, or "null", and incorrect reuse of namespace prefixes declared on sibling elements.

Fixed element.innerHTML and element.outerHTML in XML documents to reject invalid characters in attribute values and avoid stack overflows on large strings.

Fixed selector matching for :lang(), :nth-child(... of ...) after mutations, and :has() with duplicate IDs or nested logical pseudo-classes. (@asamuzaK)

v30.1.0

jsdom is feeling the AGI!

This release is dedicated to @scttcper, who unleashed @codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

Added named access to elements on document, such as document.myForm for <form name="myForm">. (@vojtisprime11)

Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.

Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.

Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@scttcper, @erezrokah)

Improved performance of getComputedStyle(), style changes, and CSS serialization. (@scttcper, @jhult)

Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@scttcper)

Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@scttcper)

Changed window.close() to preserve access to the document and its DOM through retained references.

Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@asamuzaK)

Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@asamuzaK)

... (truncated)

Commits

a23bfb7 30.1.2
64a75d2 Update dependencies and dev dependencies
7bf9653 Invalidate styles after CSSOM and control state changes
fe9009c Update focused area handling
a8d28b3 Release windows retained by stylesheet parsing
05a2c01 Deduplicate generated CSS property metadata
1efa190 Reduce generated CSS property data
a372e12 Avoid Document named-property rebuilds after irrelevant tree mutations
b2cd235 Update css-color
0542d2b Release idle MutationObserver bookkeeping
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for jsdom since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

dependabot · 2026-09-29T19:46:04Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

saquibrashid · 2026-10-08T03:52:00Z

@dependabot rebase

dependabot · 2026-10-08T03:52:04Z

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

saquibrashid · 2026-10-08T04:05:23Z

@dependabot recreate

dependabot · 2026-10-08T04:16:15Z

Dependabot can't authenticate to a private package registry. Because of this, Dependabot cannot update this pull request.

saquibrashid · 2026-10-08T04:29:40Z

@dependabot recreate

dependabot · 2026-10-08T04:40:34Z

Dependabot can't authenticate to a private package registry. Because of this, Dependabot cannot update this pull request.

…ry (#416) `package-lock.json` carried 442 `resolved` URLs naming `ms-feed-*.pkgs.visualstudio.com`, the internal Microsoft proxy feed. They entered through a local `npm install` on a Microsoft-managed machine, which is exactly the hazard `docs/runbooks/update-dependencies.md` section 6 warns about. The consequence was NOT cosmetic. Dependabot treats that host as a private registry it has no credential for, and refuses the whole update: Dependabot can't authenticate to a private package registry. Because of this, Dependabot cannot update this pull request. So #403 (openai), #404 (@azure/storage-blob) and #405 (jsdom) could not rebase or recreate, and every future bump touching those packages would have failed the same way. CI never showed it: the `1es-public` feed is anonymously readable, so GitHub runners install from it happily and all 13 jobs stay green. The only symptom was `Dependabot Updates` workflow runs ending in `failure`. The change is a host-prefix rewrite and nothing else: https://ms-feed-N.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/<pkg>/-/<file>.tgz -> https://registry.npmjs.org/<pkg>/-/<file>.tgz No `npm install` was run, so no version moved and no transitive dependency changed. No `integrity` hash changed either - it is the same tarball at its public address, so the recorded hash stays valid. The sha1/sha512 populations are identical before and after (412 / 135), which is the point: regenerating the lockfile here would have DOWNGRADED sha512 entries to sha1 (section 6), so this deliberately does not do that. Verified: every one of the 884 changed lines is a `resolved` line, the file still parses, and `check:deps` + `check:licences` pass. Docs: adds runbook section 6a for the lockout and its repair, and corrects the `sha1-` / `ms-feed-*` correlation in section 6 in place - sha1 hashes and public URLs now coexist, so that correlation is no longer a valid test. Unblocks #403, #404, #405. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c372e6ba-4c3f-419a-9f77-b9e23adfc874

saquibrashid · 2026-10-08T13:31:37Z

@dependabot recreate

saquibrashid · 2026-10-08T13:54:51Z

Blocked by vitest, not by anything in this repo — hold until vitest ≥ 5.0.3

This bump is correct but ordered wrong. 10 web tests fail across the image-ingest
paths (pasteCapture, imageDropzone, guidedUpload, uploadCheckpoint,
captureIntake) with:

TypeError: Cannot read properties of undefined (reading '_bytes')
    at Object.makeCompatBlob (node_modules/vitest/dist/chunks/index.*.js)
    at Function.createObjectURL (node_modules/vitest/dist/chunks/index.*.js)
    at apps/web/src/components/ScreenshotPreview.tsx:28:27

⚠ The failing frame is Vitest's, not ours. jsdom 30.1 moved the Blob internals
behind private fields; Vitest's jsdom-compat shim for URL.createObjectURL still reads
the old _bytes property and gets undefined. Nothing in ScreenshotPreview.tsx is
wrong — it just calls URL.createObjectURL, and every ingest path renders a preview,
which is why the failures cluster there (REQ-001/REQ-004, product invariant 16).

Fixed upstream in vitest v5.0.3:

jsdom: Support Blob on jsdom 30.1 — vitest-dev/vitest#11379

This repo is on vitest 5.0.0 (^5.0.0, lockfile-pinned), so the fix is not present.
@vitest/coverage-v8 moves with it — they are grouped in .github/dependabot.yml for
exactly this reason.

Required order

vitest + @vitest/coverage-v8 → 5.0.3 (the vitest group).
Then rebase this PR; it should go green with no source change.

⚠ Do not "fix" this by mocking URL.createObjectURL in the web setup file. The
suggestion appears in search results for this error, and here it would blind the whole
ingest preview surface — the tests would pass while asserting nothing about the behaviour
they exist to protect.

⚠ Equally, do not pin jsdom back to 30.0.x in package.json to make this mergeable.
That trades a clean ordering problem for a permanent pin with no exit criterion.

Leaving this open and blocked rather than closing it, so the ordering is not rediscovered.

Context: the reason this PR could not be rebased or recreated for the past week was a
separate defect — internal proxy-feed URLs in package-lock.json locked Dependabot out
entirely. That is fixed in #416 and tracked in #417, which is why this PR now produces
real test results instead of an authentication failure.

dependabot · 2026-10-08T15:26:51Z

A newer version of jsdom exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

saquibrashid · 2026-10-08T15:45:01Z

@dependabot rebase

dependabot · 2026-10-08T15:45:05Z

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

saquibrashid · 2026-10-08T15:46:52Z

@dependabot recreate

Bumps [jsdom](https://github.com/jsdom/jsdom) from 25.0.1 to 30.1.2. - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](jsdom/jsdom@v25.0.1...v30.1.2) --- updated-dependencies: - dependency-name: jsdom dependency-version: 30.1.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Generated from the updated lockfile by .github/workflows/dependabot-notices.yml. Dependabot changes the installed tree but cannot run the repo script that regenerates this file, so every bump would otherwise fail check:licences and T-LICENSE-001c for a reason unrelated to the dependency being bumped.

…426) jsdom >= 28 drops the separator space between a text node and an adjacent inline element when computing an accessible name, so `All<span class="sr-only"> statuses</span>` in FilterBar.tsx is named "Allstatuses" and the filters trigger is named "Filters4 active". accname 1.2 step 2I says to append with a space, and Chrome, Firefox and Safari all do. The markup is correct and CI proves it: on the same commit where `4 - test:unit + coverage` and `6 - test:web` went red (T-PHONE-005a, T-PHONE-005b, T-UX-145c, T-TOOLBAR-002b, T-AVREV-009a), the Playwright real-browser job `9 - test:a11y` passed. Reshaping FilterBar.tsx to satisfy jsdom would make the real accessible name worse in order to make a non-conformant simulation agree. No dependency bump clears this. The space logic lives in dom-accessibility-api, not jsdom; its latest release (0.7.1) contains no fix, and @testing-library/dom pins ^0.5.9 so 0.7.x is unreachable. Upstream jsdom#4091 is closed not_planned on process grounds (the repro used a third-party library), not on the merits. Capped by version at >=28 rather than by update-type, like @types/node: 26 is known good, so the cap stays as small as the evidence supports. Also corrects in place the now-false dependabot.yml comment claiming jsdom carries no ignore, keeping the superseded text struck through below it. Note: the separate `_bytes` failure that first blocked PR #405 was a real vitest/jsdom incompatibility and is FIXED, not held - vitest 5.0.3 (#420) resolved it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c372e6ba-4c3f-419a-9f77-b9e23adfc874

dependabot · 2026-10-08T17:27:03Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

…-011) (#431) Closes #417. main once carried 442 "resolved" URLs naming ms-feed-*.pkgs.visualstudio.com, written by a local `npm install` on a Microsoft-managed machine. That both published an internal host from a public repository and SILENTLY DISABLED dependabot for every affected package -- #403/#404/#405 could neither rebase nor recreate for nine days -- while all twelve CI jobs stayed green, because the 1es-public feed is anonymously readable. Repaired in #416; this closes the three open questions #417 left. Q1, a CI gate: tools/check-lockfile-registry.mjs + npm run check:lockfile, asserted by T-CI-011 in tests/infra/lockfileRegistry.spec.ts and run in the "3 . audit" job. An ALLOW-list of registry.npmjs.org, not an ms-feed-* denylist: the next proxy to leak in will have a different hostname. It keys on the URL, never on sha1- -- after #416 the two populations no longer correlate (~412 sha1- hashes, zero proxy URLs), so a sha1- check would fail the clean tree, which is why runbook section 6 still declines that one. Q2, other leaks of the internal host: the same gate fails on any committed .npmrc, whatever it contains. .npmrc is not gitignored, so one would be a real and visible risk; machine-specific registry config belongs in ~/.npmrc. Q3, the local-install story: runbook sections 2 and 4 both instructed a local `npm install`, which is the action that CAUSES this defect and contradicted sections 6/6a. Both corrected in place with the superseded text struck through below (F-001 rule). Section 6a's "No CI gate" conclusion is likewise corrected: it was sound for sha1- and wrongly extended to the resolved URL. Verified end-to-end against the real contamination: pointed at the lockfile of a branch that still carries it, the gate reports 447 entries across four hosts collapsed to four lines, and exits 1. WARNING for anyone with in-flight branches: 194 of 198 local branches in this clone are still contaminated and will now fail CI. Apply the section 6a host rewrite before pushing; it needs no install, no version change and no integrity change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c372e6ba-4c3f-419a-9f77-b9e23adfc874

This was referenced Oct 8, 2026

fix(deps): point package-lock resolved URLs back at the public registry #416

Merged

Lockfile leaked internal proxy-feed URLs, silently disabling Dependabot #417

Closed

dependabot Bot changed the title ~~build(deps-dev): bump jsdom from 25.0.1 to 30.1.1~~ build(deps-dev): bump jsdom from 25.0.1 to 30.1.2 Oct 8, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/jsdom-30.1.1 branch from aa45f82 to c19abfb Compare October 8, 2026 13:32

dependabot Bot force-pushed the dependabot/npm_and_yarn/jsdom-30.1.1 branch from 79f70a0 to 1102111 Compare October 8, 2026 15:47

saquibrashid mentioned this pull request Oct 8, 2026

chore(deps): hold jsdom at 25 for the accname whitespace regression #426

Merged

saquibrashid closed this in #426 Oct 8, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/jsdom-30.1.1 branch October 8, 2026 17:27

This was referenced Oct 8, 2026

chore(deps): tighten the jsdom cap to >=27, measured not assumed #429

Merged

feat(ci): gate lockfiles against private-registry resolved URLs (T-CI-011) #431

Merged

Conversation

dependabot Bot commented on behalf of github Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v30.1.2

v30.1.1

v30.1.0

Uh oh!

dependabot Bot commented on behalf of github Sep 29, 2026

Labels

Uh oh!

saquibrashid commented Oct 8, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 8, 2026

Uh oh!

saquibrashid commented Oct 8, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 8, 2026

Uh oh!

saquibrashid commented Oct 8, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 8, 2026

Uh oh!

saquibrashid commented Oct 8, 2026

Uh oh!

saquibrashid commented Oct 8, 2026

Blocked by vitest, not by anything in this repo — hold until vitest ≥ 5.0.3

Required order

Uh oh!

dependabot Bot commented on behalf of github Oct 8, 2026

Uh oh!

saquibrashid commented Oct 8, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 8, 2026

Uh oh!

saquibrashid commented Oct 8, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 8, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 29, 2026 •

edited

Loading