chore(deps): Bump the "monthly-stack-maintenance" group with 6 updates across multiple ecosystems

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the monthly-stack-maintenance group with 65 updates in the / directory:

Package	From	To
@stryker-mutator/core	9.6.1	10.0.0
@stryker-mutator/jest-runner	9.6.1	10.0.0
@stryker-mutator/vitest-runner	9.6.1	10.0.0
esbuild	0.28.1	0.28.2
jest-environment-node	30.4.1	30.5.1
oxlint	1.76.0	1.83.0
publint	0.3.22	0.3.24
vite	8.1.5	8.3.0
yaml	2.9.0	2.9.1
@jest/globals	30.4.1	30.5.1
@rspack/cli	2.1.7	2.2.5
@rspack/core	2.1.7	2.2.5
@types/node	26.1.2	26.6.1
fast-check	4.9.0	4.10.1
jest	30.4.2	30.5.1
jest-environment-jsdom	30.4.1	30.5.1
puppeteer-core	25.4.0	25.11.0
tsx	4.23.1	4.23.13
tsdown	0.22.14	0.23.0
@clack/prompts	1.7.0	1.8.1
webpack	5.109.2	5.111.0
webpack-cli	7.2.2	7.2.3
chalk	5.6.2	6.0.0
@vitest/coverage-v8	4.1.11	5.0.1
vitest	4.1.11	5.0.1
joi	18.2.5	18.2.9
@libp2p/bootstrap	12.0.28	12.0.32
@libp2p/crypto	5.1.21	5.1.23
@libp2p/identify	4.1.11	4.1.14
@libp2p/interface	3.2.5	3.3.0
@libp2p/kad-dht	16.4.1	16.4.5
@libp2p/peer-id	6.0.13	6.0.15
@libp2p/ping	3.1.10	3.1.13
@libp2p/pnet	3.0.26	3.0.29
@libp2p/tcp	11.0.25	11.0.28
libp2p	3.3.7	3.3.11
mongodb	7.5.0	7.6.0
uuid	14.0.1	14.0.2
@noble/curves	2.2.0	2.4.0
@noble/hashes	2.2.0	2.4.0
ws	8.21.1	8.21.3
@babel/plugin-transform-modules-commonjs	7.29.7	8.0.1
@testing-library/dom	10.4.1	10.4.2
@testing-library/jest-dom	7.0.0	7.0.1
@testing-library/react	16.3.2	16.3.3
babel-jest	30.4.1	30.5.1
react	19.2.8	19.3.0
@types/react	19.2.17	19.3.0
react-dom	19.2.8	19.3.0
@types/react-dom	19.2.3	19.3.0
better-sqlite3	13.0.2	13.0.3
express-rate-limit	8.6.1	8.7.0
mysql2	3.23.2	3.24.4
jest-diff	30.4.1	30.5.1
@babel/runtime	7.29.7	8.0.5
@babel/core	7.29.7	8.0.5
@react-native/babel-preset	0.86.2	0.87.1
hermes-compiler	260318099.0.1	260318099.0.3
metro	0.87.0	0.87.1
metro-config	0.87.0	0.87.1
react-router	8.3.0	8.4.0
@shikijs/rehype	4.3.1	4.4.3
@types/react-dom	19.2.3	19.3.0
@vitejs/plugin-react	6.0.4	6.1.1
mermaid	11.16.1	12.0.0
rollup	4.62.3	4.63.3

Updates @stryker-mutator/core from 9.6.1 to 10.0.0

Release notes

Sourced from @​stryker-mutator/core's releases.

v10.0.0

10.0.0 (2026-08-14)

Bug Fixes

• deps: update babel monorepo to v7.29.7 (#6068) (c10cb94)
• deps: update dependency ajv to v8.20.0 (#5992) (0ead8ce)
• deps: update dependency angular-html-parser to ~10.10.0 (#6069) (82f4e1f)
• deps: update dependency angular-html-parser to ~10.11.0 (#6132) (81706f0)
• deps: update dependency angular-html-parser to ~10.6.0 (#5962) (4a47b39)
• deps: update dependency semver to v7.8.5 (#6075) (f66c2fc)
• deps: update dependency weapon-regex to v2 (#6077) (b357f40)
• deps: update mutation-testing-elements monorepo to v3.8.0 (#6095) (d62fd75)
• deps: update mutation-testing-elements monorepo to v3.8.4 (#6118) (29ede69)
• instrumenter: parse svelte template expressions as TS when file uses lang="ts" (#6024) (e81abcc)
• mocha-runner: prefer project-mocha over bundled mocha (#6138) (e602725), closes #6127
• vitest-runner: fix noisy vitest options & setup file warnings (#6098) (58c4b85)

Features

• babel: update babel to major version 8 (#6104) (291b7ea)
• core: save partial incremental report on unexpected exit (#5986) (d091b1a)
• empty-expression-mutator (#6012) (cc08738), closes #5765
• mocha-runner: support Mocha v12 (#6021) (8c949ff)
• mutant filtering (#6010) (ea5ac29)
• node: drop support for Node.js 20, require Node.js 22 or higher (#6002) (425cb9f)
• typescript-checker: add experimental support for TypeScript@7 (#6099) (3d35679)

BREAKING CHANGES

• node: Node.js 20 is no longer supported, please use Node.js 22 or higher.

Changelog

Sourced from @​stryker-mutator/core's changelog.

10.0.0 (2026-08-14)

Bug Fixes

• deps: update dependency ajv to v8.20.0 (#5992) (0ead8ce)
• deps: update mutation-testing-elements monorepo to v3.8.0 (#6095) (d62fd75)
• deps: update mutation-testing-elements monorepo to v3.8.4 (#6118) (29ede69)

Features

• babel: update babel to major version 8 (#6104) (291b7ea)
• core: save partial incremental report on unexpected exit (#5986) (d091b1a)
• empty-expression-mutator (#6012) (cc08738), closes #5765
• node: drop support for Node.js 20, require Node.js 22 or higher (#6002) (425cb9f)

BREAKING CHANGES

• node: Node.js 20 is no longer supported, please use Node.js 22 or higher.

Commits

• cb3bd8f v10.0.0
• aadfdc9 chore(deps): update typescript-eslint monorepo to v8.67.0 (#5984)
• 51b9fa5 chore(deps): update dependency @​types/node to v24.13.3 (#6122)
• 29ede69 fix(deps): update mutation-testing-elements monorepo to v3.8.4 (#6118)
• 291b7ea feat(babel): update babel to major version 8 (#6104)
• d62fd75 fix(deps): update mutation-testing-elements monorepo to v3.8.0 (#6095)
• cc08738 feat: empty-expression-mutator (#6012)
• 5deb03e chore(deps): update dependency @​types/node to v24.13.2 (#6058)
• 0ead8ce fix(deps): update dependency ajv to v8.20.0 (#5992)
• 6201b38 chore(deps): update dependency @​types/node to v24.12.4 (#6015)
• Additional commits viewable in compare view

Updates @stryker-mutator/jest-runner from 9.6.1 to 10.0.0

Release notes

Sourced from @​stryker-mutator/jest-runner's releases.

v10.0.0

10.0.0 (2026-08-14)

Bug Fixes

• deps: update babel monorepo to v7.29.7 (#6068) (c10cb94)
• deps: update dependency ajv to v8.20.0 (#5992) (0ead8ce)
• deps: update dependency angular-html-parser to ~10.10.0 (#6069) (82f4e1f)
• deps: update dependency angular-html-parser to ~10.11.0 (#6132) (81706f0)
• deps: update dependency angular-html-parser to ~10.6.0 (#5962) (4a47b39)
• deps: update dependency semver to v7.8.5 (#6075) (f66c2fc)
• deps: update dependency weapon-regex to v2 (#6077) (b357f40)
• deps: update mutation-testing-elements monorepo to v3.8.0 (#6095) (d62fd75)
• deps: update mutation-testing-elements monorepo to v3.8.4 (#6118) (29ede69)
• instrumenter: parse svelte template expressions as TS when file uses lang="ts" (#6024) (e81abcc)
• mocha-runner: prefer project-mocha over bundled mocha (#6138) (e602725), closes #6127
• vitest-runner: fix noisy vitest options & setup file warnings (#6098) (58c4b85)

Features

• babel: update babel to major version 8 (#6104) (291b7ea)
• core: save partial incremental report on unexpected exit (#5986) (d091b1a)
• empty-expression-mutator (#6012) (cc08738), closes #5765
• mocha-runner: support Mocha v12 (#6021) (8c949ff)
• mutant filtering (#6010) (ea5ac29)
• node: drop support for Node.js 20, require Node.js 22 or higher (#6002) (425cb9f)
• typescript-checker: add experimental support for TypeScript@7 (#6099) (3d35679)

BREAKING CHANGES

• node: Node.js 20 is no longer supported, please use Node.js 22 or higher.

Changelog

Sourced from @​stryker-mutator/jest-runner's changelog.

10.0.0 (2026-08-14)

Bug Fixes

• deps: update dependency semver to v7.8.5 (#6075) (f66c2fc)

Features

• node: drop support for Node.js 20, require Node.js 22 or higher (#6002) (425cb9f)

BREAKING CHANGES

• node: Node.js 20 is no longer supported, please use Node.js 22 or higher.

Commits

• cb3bd8f v10.0.0
• 133873e chore(deps): update jest monorepo (#6065)
• 51b9fa5 chore(deps): update dependency @​types/node to v24.13.3 (#6122)
• f66c2fc fix(deps): update dependency semver to v7.8.5 (#6075)
• 5deb03e chore(deps): update dependency @​types/node to v24.13.2 (#6058)
• 6201b38 chore(deps): update dependency @​types/node to v24.12.4 (#6015)
• 3821604 chore(deps): upgrade to TypeScript 6 (#6009)
• 425cb9f feat(node): drop support for Node.js 20, require Node.js 22 or higher (#6002)
• See full diff in compare view

Updates @stryker-mutator/vitest-runner from 9.6.1 to 10.0.0

Release notes

Sourced from @​stryker-mutator/vitest-runner's releases.

v10.0.0

10.0.0 (2026-08-14)

Bug Fixes

• deps: update babel monorepo to v7.29.7 (#6068) (c10cb94)
• deps: update dependency ajv to v8.20.0 (#5992) (0ead8ce)
• deps: update dependency angular-html-parser to ~10.10.0 (#6069) (82f4e1f)
• deps: update dependency angular-html-parser to ~10.11.0 (#6132) (81706f0)
• deps: update dependency angular-html-parser to ~10.6.0 (#5962) (4a47b39)
• deps: update dependency semver to v7.8.5 (#6075) (f66c2fc)
• deps: update dependency weapon-regex to v2 (#6077) (b357f40)
• deps: update mutation-testing-elements monorepo to v3.8.0 (#6095) (d62fd75)
• deps: update mutation-testing-elements monorepo to v3.8.4 (#6118) (29ede69)
• instrumenter: parse svelte template expressions as TS when file uses lang="ts" (#6024) (e81abcc)
• mocha-runner: prefer project-mocha over bundled mocha (#6138) (e602725), closes #6127
• vitest-runner: fix noisy vitest options & setup file warnings (#6098) (58c4b85)

Features

• babel: update babel to major version 8 (#6104) (291b7ea)
• core: save partial incremental report on unexpected exit (#5986) (d091b1a)
• empty-expression-mutator (#6012) (cc08738), closes #5765
• mocha-runner: support Mocha v12 (#6021) (8c949ff)
• mutant filtering (#6010) (ea5ac29)
• node: drop support for Node.js 20, require Node.js 22 or higher (#6002) (425cb9f)
• typescript-checker: add experimental support for TypeScript@7 (#6099) (3d35679)

BREAKING CHANGES

• node: Node.js 20 is no longer supported, please use Node.js 22 or higher.

Changelog

Sourced from @​stryker-mutator/vitest-runner's changelog.

10.0.0 (2026-08-14)

Bug Fixes

• vitest-runner: fix noisy vitest options & setup file warnings (#6098) (58c4b85)

Features

• empty-expression-mutator (#6012) (cc08738), closes #5765
• node: drop support for Node.js 20, require Node.js 22 or higher (#6002) (425cb9f)

BREAKING CHANGES

• node: Node.js 20 is no longer supported, please use Node.js 22 or higher.

Commits

• cb3bd8f v10.0.0
• ab2c3bd chore(deps): update react monorepo (#6162)
• 51b9fa5 chore(deps): update dependency @​types/node to v24.13.3 (#6122)
• d4612d0 chore(deps): update vitest monorepo to v4.1.10 (#6115)
• 58c4b85 fix(vitest-runner): fix noisy vitest options & setup file warnings (#6098)
• cc08738 feat: empty-expression-mutator (#6012)
• 5deb03e chore(deps): update dependency @​types/node to v24.13.2 (#6058)
• f2f7863 chore(deps): update vitest monorepo to v4.1.9 (#6053)
• 3f04a7f chore(deps): update dependency vite to v8 (#5905)
• b841209 chore(deps): update vitest monorepo to v4.1.8 (#6035)
• Additional commits viewable in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Updates jest-environment-node from 30.4.1 to 30.5.1

Release notes

Sourced from jest-environment-node's releases.

v30.5.1

Fixes

• [jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)
• [jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)
• [jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)
• [jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)
• [jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

• [jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

New Contributors

• @​HuzaifaChaudary made their first contribution in jestjs/jest#16413

Full Changelog: jestjs/jest@v30.5.0...v30.5.1

v30.5.0

On a personal note: King Harald V of Norway passed away this morning. He ascended the throne 35 years ago, two months before I was born. This release is dedicated to his memory. Hvil i fred 🇳🇴

---

This is a big release. It touches jest-runtime, jest-resolve and jest-haste-map in many places, and with this many changes there might be regressions 😬. If your suite behaves differently after upgrading, please open an issue.

Highlights

whenCalledWith

Mock functions can now configure return values per argument list, contributed by @​timkindberg (#16053):

const fn = jest.fn();
fn.whenCalledWith('apple').mockReturnValue('red');
fn.whenCalledWith('banana').mockReturnValue('yellow');
fn.whenCalledWith(expect.any(Number)).mockReturnValue('numeric');
fn('apple'); // 'red'
fn('banana'); // 'yellow'
fn(42); // 'numeric'
fn('grape'); // undefined

The returned object is a real Mock, so mockReturnValueOnce, mockResolvedValue, mockImplementation etc. all chain here too. Argument slots accept literals or any asymmetric matcher, with the same equality semantics as toHaveBeenCalledWith(). Calls that match nothing fall through to the base mock. See the Mock Functions docs for matching and precedence details.

Describe-level retries

jest.retryTimes() can now retry a whole describe block instead of a single test, contributed by @​soltonigiri (#16322). Each attempt reruns the block's beforeAll/afterAll hooks, child tests and nested describes, which helps when tests in a block depend on shared state:

</tr></table> 

... (truncated)

Changelog

Sourced from jest-environment-node's changelog.

30.5.1

Fixes

• [jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)
• [jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)
• [jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)
• [jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)
• [jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

• [jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

30.5.0

Features

• [@jest/expect-utils, jest-mock] Add mockFn.whenCalledWith(...args) for configuring return values per argument list, with first-class asymmetric-matcher support (#16053)
• [@jest/expect-utils] Export AsymmetricMatcher and FunctionParameters types (previously private to expect) (#16053)
• [jest-circus, jest-core, jest-jasmine2, jest-test-result, jest-types] --collectTests now expands test.each/describe.each cases and reports per-status counts (skipped/todo via the new wouldRun flag for selected tests) plus a summary line that match a real run, including under --testNamePattern and .only/fdescribe focus on both the circus and jasmine2 runners (#16259)
• [jest-circus, jest-environment, jest-runtime, jest-types] Add describe-level retries via jest.retryTimes(..., {entireDescribe: true}) (#16322)
• [jest-circus, jest-message-util, jest-reporters, jest-types] Add retryMessages to AssertionResult and export formatErrorStack, so the retry log renders nested cause and AggregateError sections with code frames instead of serialized [cause]:/[errors]: markers (#16316)
• [jest-circus, jest-types] Add unhandledErrorsDetailed to Circus.RunResult, so an unhandled rejection reports its cause chain and AggregateError entries with code frames instead of a pre-serialized stack (#16316)
• [jest-haste-map] Replace NodeWatcher and FSEventsWatcher with @parcel/watcher for the non-watchman watch path (#16188)
• [jest-resolve] Bump unrs-resolver to 1.12.1, remove jest-pnp-resolver and unnecessary checks (#15721)
• [jest-resolve] Honor Node's --preserve-symlinks / NODE_PRESERVE_SYMLINKS in the default resolver by passing symlinks: false to unrs-resolver (#16260)
• [jest-runtime] Apply automocking and manual __mocks__ files to synchronously evaluable ESM graphs on Node 24.9+ - static imports, dynamic import() and require() of an ESM file now generate an automock from the real module's namespace instead of failing with "Attempting to import a mock without a factory". Graphs that need async evaluation (top-level await) or an async-only resolver or transformer still throw (#16391)
• [jest-runtime] Route process.getBuiltinModule through the sandbox, so it returns the sandbox process and the hooked node:module instead of the host's (#16391)
• [jest-runtime] Throw an actionable error from module.register() and module.registerHooks() inside a test - the hooks attached to the loader running Jest itself, never saw the sandboxed requires they were meant for, and stayed registered for every later test file in the worker (#16391)
• [jest-runtime] Surface resolution and import-attribute errors in an ESM graph before executing any of its CJS dependencies on Node 24.9+, matching Node's run-nothing-on-a-broken-graph behavior; the legacy loader on older versions keeps its linking-time execution order (#16391)
• [jest-runtime] Throw ERR_SOURCE_PHASE_NOT_DEFINED with an actionable message for import source and import.source(), instead of failing at instantiation with V8's bare "Source phase import object is not defined" (#16391)
• [jest-runtime] Emit the JSON-without-import-attribute deprecation warning once per test file instead of once per worker, so it is no longer silently swallowed for every file after the first (#16391)
• [jest-runtime] Set import.meta.main to true in the test file and false in every module it loads, matching Node 24+ (#16367)
• [jest-runtime] Resolve the module-sync export condition, so a package that exposes its ESM entry point for require() loads the same file Node would (#16336)
• [jest-snapshot] Add external snapshot paths to custom reporter failure details (#16374)

Fixes

• [jest-console, jest-reporters] CustomConsole now buffers console output so TestResult.console is populated for reporters when verbose is enabled, while GitHubActionsReporter avoids replaying buffered output in verbose mode (#16155)
• [expect, jest-message-util, jest-pattern, jest-regex-util, jest-util] Revert node: protocol imports to restore webpack/browser-bundle compatibility (#16167)
• [expect] Widen toMatchObject and objectContaining parameter type from Record<string, unknown> to object so class instances are accepted (#16196)
• [jest-circus] Call a generator test body with the shared test context, so this matches what a regular test function receives (#16347)
• [jest-circus] Capture the error listeners of the parent process instead of the in-sandbox process, so listeners registered before the test file survive teardown and sandbox listeners no longer leak onto the parent (#16347)
• [jest-circus] Clear currentlyRunningTest after skipped and todo tests (#16342)
• [jest-circus] Prevent late done() callbacks from affecting later test or hook invocations (#16343)
• [jest-circus, jest-jasmine2] Honor --expand when formatting node:assert failures, instead of always collapsing the diff (#16347)
• [jest-circus, jest-jasmine2, jest-message-util] Serialize the inner errors of an AggregateError into failureMessages, retryReasons and unhandledErrors, so --json output and reporter annotations include them (#16316)
• [jest-circus, jest-snapshot] Keep snapshot state and counts correct when a test retries (#16344)
• [@jest/create-cache-key-function] Include the caller support flags in the generated key, so a transformer that emits ESM or CJS based on them no longer shares one cache entry between the two (#16331)

... (truncated)

Commits

• 9ab14fe v30.5.1
• be425a0 docs: explain globalsCleanup and point the JEST-01 warning at it (#16404)
• 912baa3 v30.5.0
• 5671583 fix: stop resolving lazy globals when setting up an environment (#16324)
• 5982001 fix: only warn about a conflicting globalsCleanup mode when one was set (#1...

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​eventsource@​1.1.15 ⏵ 3.0.0			-31	-29
	npm/​hermes-compiler@​260318099.0.1 ⏵ 260318099.0.3
	npm/​jest-environment-jsdom@​30.4.1 ⏵ 30.5.1				+1
	npm/​twilio@​6.0.2 ⏵ 6.1.1			+1	+5
	npm/​@​shikijs/​rehype@​4.3.1 ⏵ 4.4.3				-3
	npm/​jest@​30.4.2 ⏵ 30.5.1				+5
	npm/​@​stryker-mutator/​vitest-runner@​9.6.1 ⏵ 10.0.0	+1		+1
	npm/​metro-config@​0.87.0 ⏵ 0.87.1	+1			+2
	npm/​esbuild@​0.28.2
	npm/​@​babel/​plugin-transform-modules-commonjs@​8.0.1
	npm/​@​types/​react-dom@​19.2.3 ⏵ 19.3.0	+1		+1
	npm/​@​stryker-mutator/​jest-runner@​9.6.1 ⏵ 10.0.0	+1			+6
	npm/​metro@​0.87.0 ⏵ 0.87.1	+1		+1	+2
	npm/​@​babel/​runtime@​8.0.5
	npm/​@​libp2p/​pnet@​3.0.26 ⏵ 3.0.29	+3		+2
	npm/​react-router@​8.3.0 ⏵ 8.4.0			+1	+1
	npm/​@​types/​react@​19.2.17 ⏵ 19.3.0	+1		+1
	npm/​@​babel/​core@​8.0.5
	npm/​@​vitest/​coverage-v8@​4.1.11 ⏵ 5.0.1			+1
	npm/​vitest@​4.1.11 ⏵ 5.0.1	+1		+1
	npm/​joi@​18.2.5 ⏵ 18.2.9			+1	+2
	npm/​@​rspack/​core@​2.1.7 ⏵ 2.2.5			+1
	npm/​@​types/​node@​26.1.2 ⏵ 26.6.1	+1		+1
	npm/​@​react-native/​babel-preset@​0.86.2 ⏵ 0.87.1	+1
	npm/​tsx@​4.23.1 ⏵ 4.23.13			+1
	npm/​publint@​0.3.22 ⏵ 0.3.24	+1		+1	+9
	npm/​vite@​8.1.5 ⏵ 8.3.0	+1		+1
	npm/​chalk@​6.0.0
	npm/​react@​19.2.8 ⏵ 19.3.0	+1		+1
	npm/​@​rspack/​cli@​2.1.7 ⏵ 2.2.5	+3		+1	+1
	npm/​uuid@​11.1.1 ⏵ 14.0.2	+1
See 44 more rows in the dashboard

View full report

[ty-everett]

Maintainer disposition: defer this broad monthly upgrade until the coordinated release and first-party dependency reconciliation are complete. This is not merge-ready on 4c64c67. CI 35815541196 identifies newly introduced lodash-es@4.17.23 / GHSA-r5fr-rjxr-66jc (high), and container run 35815541172 fails wallet-infra because the upgraded eventsource package has no default export at src/index.ts:19. Repository controls also fail because the proposal changes the governed Stryker/fast-check/OpenTelemetry cohort without matching reviewed policy and migration evidence.

Preserve this proposal, then rebase on the published dependency graph. Resolve the vulnerable transitive graph without waiving Dependency Review, migrate and test EventSource imports/runtime behavior, and split major runtime/toolchain changes into reviewable compatibility cohorts with release notes and the affected package, browser/mobile, mutation, image and provenance gates. Do not reset baselines simply to match the proposed versions. Safe patch updates can be extracted first after the release freeze. The initial generated title understates the scope: the body includes 65 npm updates plus other ecosystems.