build: update all non-major dependencies (main)

[angular-robot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@oxc-project/types (source)	0.144.0 → 0.145.0
@vitest/coverage-v8 (source)	4.1.10 → 4.1.11
karma-jasmine-html-reporter	~2.2.0 → ~2.3.0
less (source)	4.8.1 → 4.9.0
magic-string	1.1.1 → 1.2.1
open	11.0.0 → 11.0.1
oxc-parser (source)	0.144.0 → 0.145.0
puppeteer (source)	25.6.0 → 25.8.0
verdaccio (source)	6.9.2 → 6.10.0
vitest (source)	4.1.10 → 4.1.11

---

• If you want to rebase/retry this PR, check this box

---

Release Notes

oxc-project/oxc (@​oxc-project/types)

v0.145.0

🐛 Bug Fixes

• 0c68b7f estree: Emit decorators on FormalParameterRest (#​25582) (camc314)

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.11

Compare Source

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in #​10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in #​10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in #​10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in #​10974 (fe5a1)

    View changes on GitHub

dfederm/karma-jasmine-html-reporter (karma-jasmine-html-reporter)

v2.3.0

Compare Source

Add Jasmine 7 compatibility

Full Changelog: dfederm/karma-jasmine-html-reporter@v2.2.0...v2.3.0

less/less.js (less)

v4.9.0

Compare Source

Changes

• #​4488 feat: support [...] lookups in @{...} interpolation (@​matthew-dean)
• #​4486 fix: prevent reparsing escape() results (@​snowyukitty)
• #​4481 fix: keep the media type first when flattening nested @​media queries (@​Lfan-ke)

Rich-Harris/magic-string (magic-string)

v1.2.1

Compare Source

Bug Fixes

• count separators in Bundle#isEmpty (#​327) (0bc98c9), closes Bundle#isEmpty
• throw instead of corrupting the chunk list on an overlapping move (#​326) (9a9207c)

v1.2.0

Compare Source

Features

• introduce MagicStringError with concise, consistent messages (#​324) (57080e7)

1.1.1 (2026-08-12)

Bug Fixes

• count separators in Bundle#length (#​322) (b66f1e5), closes Bundle#length
• use a source's own separator in Bundle sourcemaps (#​323) (58b4118)
• validate update() range and show indices in range errors (#​318) (7c0b663)

sindresorhus/open (open)

v11.0.1

Compare Source

• Fix WSL failure when the working directory is unreachable from Windows 6ac3fe4

---

oxc-project/oxc (oxc-parser)

v0.145.0

🐛 Bug Fixes

• db44651 napi: Disable reuseWorker in browser bindings (#​25640) (leaysgur)
• 0c68b7f estree: Emit decorators on FormalParameterRest (#​25582) (camc314)

puppeteer/puppeteer (puppeteer)

v25.8.0

Compare Source

🎉 Features

• support followSymlinks option (#​15335) (af6a23d)

🛠️ Fixes

• computeSystemExecutablePath support validatePath (#​15340) (73da9a4)
• launch browsers in detached mode on Windows to fix flakiness (#​15339) (8e1022b)
• remove redundant overwrite and file access from ScreenRecorder (#​15352) (61a1675)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 3.2.0 to 3.2.1

v25.7.0

Compare Source

🎉 Features

• roll to Chrome 152.0.7977.42 (#​15330) (0c187db)
• tracing: support bufferSize option in tracing.start (#​15328) (987f146)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • puppeteer-core bumped from 25.6.0 to 25.7.0

🛠️ Fixes

• logger calling causing crashes (#​15338) (eb874a5)
• roll to Firefox 153.0.4 (#​15329) (df5a524)

🏗️ Refactor

• use Desposable stacks to track listeners (#​15332) (df2d719)

verdaccio/verdaccio (verdaccio)

v6.10.0

Compare Source

Minor Changes

• 51c2733: Expose the optional legacy authentication cache for Verdaccio 6.x through server.legacyAuthCache.

  This feature is intended for performance-sensitive installations that still use legacy bearer tokens. When enabled, Verdaccio caches successful legacy token authentication results for a short period of time, so repeated requests using the same token do not need to run password verification through the authentication plugin every time. Concurrent requests for the same legacy token can also share the same in-flight authentication result.

  The cache is disabled by default, so existing installations keep their current authentication behavior unless they explicitly opt in. Basic authentication is not cached. If the cache is enabled, changed or revoked credentials may remain valid until the cached entry expires.

  Enable it in config.yaml:

  server:
    legacyAuthCache:
      enabled: true
      ttlMs: 15000
      maxEntries: 1000

  Options:

  • enabled: enables the legacy token authentication cache. Default: false.
  • ttlMs: time in milliseconds before a cached validation expires. Default: 15000.
  • maxEntries: maximum number of cached legacy tokens. Default: 1000.

  See #​6147 and the original 8.x backport in #​6143.

v6.9.3

Compare Source

Patch Changes

• 3c8f391: Reject wildcard characters in package and tarball path validation.

• ebc08ba: Update verdaccio dependencies to the latest npm dist-tag (@verdaccio/ui-theme tracks next-9):

  This dependency refresh includes @verdaccio/package-filter 13.2.0 with excludeDeprecated support from #​6142 by @​jotadeveloper, based on the original work by @​davidus27. It also includes the @verdaccio/ui-theme update containing the homepage action hover fix from #​6135 by @​pranshuchittora.

  • @verdaccio/auth: 8.1.1 → 8.1.2
  • @verdaccio/config: 8.2.1 → 8.2.2
  • @verdaccio/core: 8.2.1 → 8.2.2
  • @verdaccio/hooks: 8.1.2 → 8.1.3
  • @verdaccio/loaders: 8.1.1 → 8.1.2
  • @verdaccio/local-storage-legacy: 11.4.1 → 11.4.2
  • @verdaccio/logger: 8.1.1 → 8.1.2
  • @verdaccio/middleware: 8.1.1 → 8.1.2
  • @verdaccio/package-filter: 13.1.1 → 13.2.0
  • @verdaccio/signature: 8.1.1 → 8.1.2
  • @verdaccio/tarball: 13.1.1 → 13.1.2
  • @verdaccio/ui-theme: 9.0.0-next-9.23 → 9.0.0-next-9.26
  • @verdaccio/url: 13.1.1 → 13.1.2
  • @verdaccio/utils: 8.2.1 → 8.2.2
  • verdaccio-audit: 13.1.1 → 13.1.2
  • verdaccio-htpasswd: 13.1.1 → 13.1.2

[gemini-code-assist]

Code Review

This pull request updates various dependency versions across multiple package.json files in the workspace, including vitest, magic-string, less, puppeteer, and oxc-parser. There are no review comments, and I have no feedback to provide.

[alan-agius4]

This PR was merged into the repository. The changes were merged into the following branches:

• main: deac1b6