[saquibrashid]

What

Holds jsdom at 25 and records why, closing #405.

Why — and it is not the reason the red PR first suggested

PR #405 (jsdom 25.0.1 → 30.1.2) failed twice with the same surface symptom — "jobs 4 and 6 are red" — from two completely unrelated causes.

Round 1 — TypeError: Cannot read properties of undefined (reading '_bytes') — FIXED, not held. jsdom 30.1 moved Blob internals behind private fields while vitest's jsdom-compat shim still read _bytes. Resolved upstream by vitest@5.0.3 ("Support Blob on jsdom 30.1", vitest-dev/vitest#11379), taken in #420. All 10 of those failures are gone.

Round 2 — accessible-name whitespace — this is the hold. With vitest 5.0.3 in place, 5 different tests fail with one root cause:

Expected element to have accessible name:
  Filters 4 active
Received:
  Filters4 active

jsdom >= 28 drops the separator space between a text node and an adjacent inline element, so All<span className="sr-only"> statuses</span> (FilterBar.tsx, three sites) computes as Allstatuses. accname 1.2 step 2I says to append with a space, and Chrome, Firefox and Safari all do.

The markup is correct, and the same CI run proves it

On the identical commit where 4 · test:unit + coverage and 6 · test:web went red (T-PHONE-005a, T-PHONE-005b, T-UX-145c, T-TOOLBAR-002b, T-AVREV-009a), the job 9 · test:a11y passed — that suite is Playwright driving real browsers.

A split of that exact shape — jsdom red, real browsers green, one commit — is evidence that the test engine is wrong. Reshaping FilterBar.tsx to satisfy jsdom would make the real-browser accessible name worse in order to make a non-conformant simulation agree, so it was rejected.

No dependency bump clears this

The space logic lives in dom-accessibility-api, not jsdom. Its latest release (0.7.1, 2025-11-27) is a trusted-publishing change with no fix, and @testing-library/dom@10.4.1 pins dom-accessibility-api@^0.5.9, so 0.7.x is unreachable from this tree. Bumping testing-library will not help.

Upstream jsdom/jsdom#4091 is closed not_planned, but on process grounds — the repro used a third-party library, which that project declines to investigate — not on the merits. The behaviour is unadjudicated, so a clean no-third-party repro remains a live path to reopening it.

Changes

• .github/dependabot.yml — adds jsdom capped at versions: ['>=28'], with the evidence and a named exit criterion. Capped by version rather than by update-type, the same way @types/node is: 26 is known good (the upstream report reproduces clean on 26.1.0), so the cap stays as small as the evidence supports.
• .github/dependabot.yml — the existing RELEASED comment claimed jsdom "carries no ignore now", which this change makes false. Corrected in place with the superseded sentence struck through below it, per the repo's F-001 supersession rule for machine-executed instructions.
• docs/runbooks/update-dependencies.md §5 — a held-bump entry alongside Prisma 7 and Vitest 5, carrying both rounds so the next person does not re-litigate the _bytes half. Per §5: "a bump that was tried and rejected is more valuable written down than a bump nobody looked at."

Unblocked by: jsdom restoring accname 1.2 step 2I space separation, or dom-accessibility-api no longer depending on the old display default and @testing-library/dom widening its pin. To re-test: raise the cap, let Dependabot rebase, and watch those five named tests.

Validation

Command	Result
npm run format:check	passed — "All matched files use Prettier code style!"
npm run check:test-locations	passed — "385 spec files, 354 collected by Vitest, 31 owned by Playwright"
python -c "yaml.safe_load(...)" on .github/dependabot.yml	parses; ignore list resolves to @types/node >=23, typescript >=7.0.0 <7.1.0, jsdom >=28, plus the four Prisma/mssql major holds

No source or lockfile change, so the test suites are unaffected; CI runs them anyway. T-INFRA-018d reads package.json/.nvmrc/Dockerfile only and is not sensitive to the new ignore entry.

Closes #405