fix(deps): update all non-major dependencies - #299

v3.8.3

Compare Source

v0.11.6

Compare Source

Highlights

Faster DOM test environments with prebundling

Rstest can now prebundle supported jsdom and happy-dom test environments once and share the bundle across workers.

In a local 100-file / 1,000-test benchmark on Apple Silicon with Node.js 24 and four fork workers:

The feature is opt-in and falls back to native loading when prebundling is unsupported or fails. These benchmark results are directional and not a performance guarantee. See #​1663.

import { defineConfig } from '@rstest/core';

export default defineConfig({
  testEnvironment: {
    name: 'jsdom', // or 'happy-dom'
    prebundle: 'auto',
  },
});

What's Changed

New Features 🎉

• feat(playwright): support retry trace modes by @​9aoy in #​1657
• feat(core): add expect poll config by @​9aoy in #​1660
• feat(core): support prebundle test environments by @​9aoy in #​1663

Bug Fixes 🐞

• fix(core): skip environment resource tracking for worker-scoped environments by @​fi3ework in #​1645
• fix(core): improve GitHub Actions summaries by @​9aoy in #​1648
• fix(browser): run globalSetup in watch mode by @​9aoy in #​1643
• fix(core): support modern jsdom versions by @​9aoy in #​1652
• fix(core): remove full stack fallback message by @​9aoy in #​1658
• fix(browser): run globalSetup when listing tests by @​9aoy in #​1659
• fix(deps): relax core peer dependency ranges by @​9aoy in #​1662
• fix(core): force webpack runtime mode by @​9aoy in #​1665

Refactor 🔨

• refactor(adapter-rslib): replace tsconfck with get-tsconfig by @​9aoy in #​1649
• refactor(core): remove redundant worker count clamp by @​9aoy in #​1666
• refactor(core, browser): drive watch mode through the TestExecutor seam by @​fi3ework in #​1668
• refactor(browser): split hostController into scheduler modules by @​fi3ework in #​1669

Document 📖

• docs: document virtual module mocks by @​9aoy in #​1646
• docs: optimize browser setup in CI by @​9aoy in #​1653

Other Changes

• release: 0.11.5 by @​9aoy in #​1647
• chore(deps): update all non-major dependencies by @​renovate[bot] in #​1650
• chore(deps): update all non-major dependencies by @​renovate[bot] in #​1664
• ci: avoid duplicate VS Code unit tests by @​fi3ework in #​1671
• chore: include examples in unused checks by @​fi3ework in #​1673
• release: 0.11.6 by @​9aoy in #​1672

Full Changelog: web-infra-dev/rstest@v0.11.5...v0.11.6

v4.4.2

Compare Source

   🐞 Bug Fixes

• Unbreak CI after vite 8 bump and grammar/deps updates  -  by @​antfubot in #​1300 (c5d31)

   🏎 Performance

• core: Token split performance improvements  -  by @​amadeus in #​1301 (41896)

    View changes on GitHub

v20.11.2

Compare Source

👷‍♂️ Patch fixes

• MutationObserver callback being GC'd due to orphaned WeakRef - By @​mixelburg in task #​2264

v24.18.1: 24.18.1

Compare Source

Node.js 24.18.1

v11.21.0: pnpm 11.21

Compare Source

Minor Changes

• Added interactive group selection to pnpm update --global --interactive.

• Running pnpm setup, pnpm self-update, or a command that modifies the global installation (such as pnpm add --global) through sudo now prints a warning. pnpm keeps global packages and configuration in the invoking user's home directory, so running these commands as root silently operates on the root user's home directory instead of yours. They will fail with ERR_PNPM_SUDO_NOT_SUPPORTED in pnpm v12. Read-only global commands (such as pnpm bin --global) are unaffected.

Patch Changes

• Fixed pnpm failing to start under asynchronous Node.js module loaders when no .pnpmfile.mjs exists pnpm/pnpm#11701.

• Fixed minimumReleaseAge fallback for custom dist-tags so the selected version does not exceed the registry’s original tag target.

• Removing a dependency from package.json and reinstalling no longer re-resolves the dependency graph. The importer's entry is dropped from pnpm-lock.yaml, anything it made unreachable is pruned, and a catalog entry that loses its last referent is removed — all without registry access. Installs still fall back to a full resolution when a package that stays resolves a peer dependency through the removed one, since that would change the surviving package's entry rather than only prune.

• Changing a catalog entry to a different exact version no longer re-resolves the dependency graph. The package is replaced in pnpm-lock.yaml directly, reusing the same check the pnpm.overrides fast path applies: every locked dependency of the package must still satisfy the new version's manifest. Installs fall back to a full resolution when anything other than the catalog reaches the package — an importer that depends on it directly, or another package that depends on it — since the graph would then need both versions.

• Fixed a CI regression where github:owner/repo dependencies (and other shorthand Git specifiers) would fail to install with Permission denied (publickey) on CI runners that lack SSH keys. The Git resolver no longer records an SSH URL unless the user explicitly wrote one (e.g. git+ssh:// or git@host:...):

  • The repository visibility probe (an HTTP HEAD request) now retries transient failures such as 429 Too Many Requests, so host throttling of CI runners is no longer mistaken for a private repository.
  • For non-SSH specifiers, anonymous HTTPS git ls-remote access is now tried before SSH, so a public repository whose visibility probe fails still resolves to a portable HTTPS URL instead of an SSH URL that only works where SSH keys are configured.
  • When every probe fails, the resolver falls back to HTTPS for shorthand and HTTPS-style specifiers, and only guesses SSH when the user explicitly provided an SSH URL.
  • A repository that could not be confirmed public is no longer resolved to the host's anonymous archive URL (e.g. codeload.github.com, which would fail to download for a private repository); it stays a regular git resolution so installs can use ambient Git credentials such as credential helpers and tokens.

  Note that a private repository that is reachable both over authenticated HTTPS and over SSH now resolves to its HTTPS URL, where previous versions recorded the SSH URL.

  Fixes pnpm/pnpm#13276.

• ng build and nuxt build now work under the global virtual store: pnpm's built-in compatibility extensions add the tslib dependency that @angular/build uses without declaring and the unplugin dependency that @nuxt/vite-builder v4 uses without declaring.

• Fixed link: dependencies under enableGlobalVirtualStore so linked children are materialized and slots remain isolated by their resolved link targets.

• An install that skips resolution because pnpm-lock.yaml is already up to date now reacts fully to packages the lockfile removed — for example after pulling a lockfile in which a dependency was deleted. The hoist layer is recomputed, so a package that became hoistable when a direct dependency was removed is hoisted, and pendingBuilds entries for removed packages are dropped instead of staying pending forever.

• The held-back-update warning printed by pnpm update no longer fires when minimumReleaseAge is the actual reason a newer version was not picked. The warning's baseline now applies the same maturity cutoff as the pick itself, so it no longer wrongly attributes the hold-back to "your manifests and already installed dependencies" or recommends an override that would defeat the age gate. See #​13071.

• Checking whether ignoredOptionalDependencies is up to date no longer reorders the configured patterns. The check sorted them in place, which could move an ! exclusion ahead of the pattern it excludes from and flip which optional dependencies were ignored.

• Changing autoInstallPeers, dedupePeers, peersSuffixMaxLength, excludeLinksFromLockfile, or injectWorkspacePackages no longer re-resolves the dependency graph when the lockfile proves the setting cannot affect it: no package or project declares a peer dependency for the peer settings, and no project depends on a directory or on another workspace project for the link and injection settings. The new setting is recorded in pnpm-lock.yaml and the install proceeds from the existing resolution. Every other case still falls back to a full resolution.

• Adding, editing, or removing an entry in patchedDependencies no longer re-resolves the dependency graph. Resolution never reads a patch — it only records the patch file's hash against the package it matches — so the install now rewrites the affected entries in pnpm-lock.yaml and materializes the patched package from the store instead. Installs still fall back to a full resolution when the patched package is reachable as a peer dependency, and when the new configuration would leave a patch unused while allowUnusedPatches is off, so ERR_PNPM_UNUSED_PATCH is still reported.

• Resolving a private git repository no longer blocks on an interactive credential prompt: git ls-remote now fails fast with an authentication error when git has no credentials for the repository #​13522.

• Lockfile verification now honors offline mode by using cached registry metadata instead of reaching the registry. When the required metadata is not available locally, verification reports the same ERR_PNPM_NO_OFFLINE_META condition used by offline resolution.

• POSIX shell shims now follow symbolic links before computing basedir, preventing execution failures when a shim is invoked via an external symlink on PATH #​13405.

• The automatic packageManager version switch works again on registries whose tarball URLs point at a different host than the registry itself (load-balanced feed proxies, Artifactory-style mirrors). Package-manager entries are now always recorded with integrity-only resolutions — the download URL is derived from the trusted bootstrap registry instead — and entries persisted in an invalid shape by an earlier pnpm are discarded and re-resolved instead of failing every command #​13619.

• Registries that serve no npm signature metadata (private mirrors and feed proxies commonly strip dist.signatures) no longer break the automatic packageManager version switch and pnpm self-update #​13147. When the configured registry cannot provide a verifiable signature, pnpm now fetches the signature from registry.npmjs.org and verifies it against the same embedded npm keys over the installed integrity — which proves exactly the same thing. If no signature can be obtained from either source (for example, both are unreachable, or the registry publishes only a shasum), pnpm proceeds with a warning instead of failing, but only when the packages resolve through a registry configured in the user's own (non-project) configuration; the download stays pinned by the lockfile integrity, and a signature that exists but does not validate still fails the switch.

• pnpm fetch, and any install run with virtualStoreOnly, no longer writes a .pnp.cjs loader under nodeLinker: pnp. These installs populate the virtual store without linking the project, so the loader would have claimed the project resolves out of a store it was never linked into. The importer links and node_modules/.package-map.json were already skipped; the PnP loader now follows the same rule.

• Prevent pnpm from removing project files when modulesDir resolves to the project root.

• Speed up installs after adding ignoredOptionalDependencies patterns by removing newly ignored optional dependencies and pruning packages that are no longer reachable without resolving the dependency graph again.

• When a failed install re-copies a bin script from the store, rerunning pnpm install now reapplies the executable bit to the bin instead of leaving it non-executable #​12742.

• pnpm root -g and pnpm bin -g now print warnings to stderr instead of stdout, so their stdout stays a clean, machine-readable path. Previously, running either command with --global in a project that pins a package manager (e.g. via the packageManager field) printed a warning like [WARN] Using --global skips the package manager check for this project ahead of the path, breaking programs that capture the output as a path #​13672.

  In pnpm 12, pnpm root -g and pnpm prefix -g are now supported (they previously failed with ERR_PNPM_CLI_ROOT_GLOBAL_UNSUPPORTED / ERR_PNPM_CLI_PREFIX_GLOBAL_UNSUPPORTED), and the reporter output of dlx, create, config, sbom, with, store, prefix, root, and bin goes to stderr, matching pnpm 11.

• pnpm setup no longer makes Node.js print a MODULE_TYPELESS_PACKAGE_JSON warning about dist/worker.js on every command. The package.json it writes next to a standalone executable now declares "type": "module".

• pnpm update without saving no longer records a version that the manifest's range excludes. The kept range stays authoritative: a requested version outside it is skipped with a warning, and a requested range, a dist tag, or --latest resolves within it instead of past it. Previously each of these could write a lockfile entry that contradicted its own specifier, which the next pnpm install --frozen-lockfile rejected with ERR_PNPM_OUTDATED_LOCKFILE #​12764.

• pnpm version -r --json now outputs [] instead of human-readable text when no pending changes exist pnpm/pnpm#13217.

Platinum Sponsors

Gold Sponsors

v6.0.10

Compare Source

v1.97.1

Compare Source

==========================

• rustc: Fix miscompilation in LLVM optimization
  This backports an LLVM submodule bump to include the LLVM-side fix and a
  revert of the rustc change that is one known trigger for the bug. The rustc
  side revert should not be strictly necessary but is done out of abundance of caution.

v1.97.0

Compare Source

==========================

Language

• Consider Result<T, Uninhabited> and ControlFlow<Uninhabited, T> to be equivalent to T for must use lint
• Add allow-by-default dead_code_pub_in_binary lint for unused pub items in binary crates
• Stabilize the div32, lam-bh, lamcas, ld-seq-sa and scq target features
• Stabilize cfg(target_has_atomic_primitive_alignment)
• Allow trailing self in imports in more cases

Platform Support

• nvptx64-nvidia-cuda: drop support for old architectures and old ISAs

Refer to Rust's platform support page
for more information on Rust's tiered platform support.

Stabilized APIs

• Default for RepeatN
• Copy for ffi::FromBytesUntilNulError
• Send for std::fs::File on UEFI
• <{integer}>::isolate_highest_one
• <{integer}>::isolate_lowest_one
• <{integer}>::highest_one
• <{integer}>::lowest_one
• <{integer}>::bit_width
• NonZero<{integer}>::isolate_highest_one
• NonZero<{integer}>::isolate_lowest_one
• NonZero<{integer}>::highest_one
• NonZero<{integer}>::lowest_one
• NonZero<{integer}>::bit_width

These previously stable APIs are now stable in const contexts:

• char::is_control

Cargo

• Stabilize build.warnings config. This controls how lint warnings from local packages are treated. Useful for enforcing a warning-free build in CI, replacing -Dwarnings. docs
• Stabilize resolver.lockfile-path config. This allows specifying the path to the lockfile to use when resolving dependencies. Useful when working with read-only source directories. docs
• cargo-clean: Error when --target-dir doesn't look like a Cargo target directory. This prevents accidental deletion of non-target directories.
• Add -m shorthand for --manifest-path
• Remove curl dependency from crates-io crate

Rustdoc

• Stabilize --emit flag
• Stabilize --remap-path-prefix

Compatibility Notes

• Emit a future-compatibility warning when relying on f32: From<{float}> to constrain {float}
• Rust will use the v0 symbol mangling scheme by default. This may cause some tools (such as debuggers or profilers, especially with old versions) to fail to demangle symbols emitted by Rust. It may also cause the formatting of text in backtraces to change.
• Prevent deref coercions in pin!, in order to prevent unsoundness. The most likely case where this might impact users is: writing pin!(x) where x has type &mut T will now always correctly produce a value of type Pin<&mut &mut T>, instead of sometimes allowing a coercion that produces a value of type Pin<&mut T>. This coercion was previously incorrectly allowed since Rust 1.88.0.
• Deprecate std::char constants and functions
• Warn on linker output by default
• Remove hidden f64 methods which have been deprecated since 1.0
• report the varargs_without_pattern lint in deps
• Forbid passing generic arguments to module path segments even if the module reexports a generic enum variant
• Error on invalid macho link_section specifier
• The encoding of certain enums have changed. This is not a breaking change, as it only applies to enums without layout guarantees, but is noted here as we've seen people impacted from having made assumptions about the layout algorithm.
• Error on #[export_name = "..."] where the name is empty
• Syntactically reject tuple index shorthands in struct patterns
• validate #[link_name = "..."] & #[link(name = "...")] parameters
• On Windows, after calling shutdown on a socket to shut down the write side, attempting to write to the socket will now produce a BrokenPipe error rather than Other. Map WSAESHUTDOWN to io::ErrorKind::BrokenPipe

v1.96.1

Compare Source

===========================

• Cargo: fix timeout/retry behavior
• Cargo: apply patches for CVE-2025-15661, CVE-2026-55199, and CVE-2026-55200 to libssh2
• rustc: fix miscompilation in MIR optimization

v1.96.0

Compare Source

==========================

Language

• Allow passing expr metavariable to cfg
• Always coerce never types in tuple expressions
• Avoid incorrect inference guidance of function arguments in rare cases
• Support s390x vector registers in inline assembly
• Allow using constants of type ManuallyDrop as patterns (fixing a regression introduced in 1.94.0)

Compiler

• Enable link relaxation feature for LoongArch Linux targets
• Update riscv64gc-unknown-fuchsia baseline to RVA22 + vector

Libraries

• Support iterating over ranges of NonZero integers
• refactor 'valid for read/write' definition: exclude null; add that as an exception on individual methods instead
• Fix SGX delayed host lookup via ToSocketAddr

Stabilized APIs

• assert_matches!
• debug_assert_matches!
• From<T> for AssertUnwindSafe<T>
• From<T> for LazyCell<T, F>
• From<T> for LazyLock<T, F>
• core::range::RangeToInclusive
• core::range::RangeToInclusiveIter
• core::range::RangeFrom
• core::range::RangeFromIter
• core::range::Range
• core::range::RangeIter

Cargo

• Allow a dependency to specify both a git repository and an alternate registry. Just like with crates.io, the git repository will be used locally, but the registry version will be used when published.
• Added target.'cfg(..)'.rustdocflags support in configuration.
• Fixed CVE-2026-5222 and CVE-2026-5223.

Rustdoc

• Deprecation notes are now rendered like any other documentation. Previously they used the css white-space: pre-wrap; property and stripped any <p> elements from the rendered html, however this caused issues and unintuitive behavior. The new behavior should be more predictable, however some multi-line deprecation notes will now be rendered as as single lines. If this is undesirable, you can use the standard markdown method of forcing a linebreak, which is two spaces followed by a newline ("\n").
• Don't emit rustdoc missing_doc_code_examples lint on impl items
• Separate methods and associated functions in sidebar

Compatibility Notes

• Fix layout of #[repr(Int)] enums in some edge cases involving fields of uninhabited zero-sized types
• Prevent unsize-coercing into Pin<Foo> where Foo doesn't implement Deref. Some such coercions were previously allowed, but produce a type with no useful public API.
• rustc: Stop passing --allow-undefined on wasm targets
• Gate the accidentally stabilized #![reexport_test_harness_main] attribute
• Error on return-position-impl-trait-in-traits whose types are too private
• Report the uninhabited_static lint in dependencies and make it deny-by-default
• Distributed builds now contain non-split debuginfo for windows-gnu
  This appears to improve the quality of backtraces. This change has no effect on the defaults for the output of rustc/cargo on these targets.
• Check const generic arguments are correctly typed in more positions
• Remove -Csoft-float
• Importing structs with ::{self [as name]}, e.g., struct S {}; use S::{self as Other};, is now no longer permitted because {self} imports require a module parent.
• For export_name, link_name, and link_section attributes, if multiple of the same attribute is present, the first one now takes precedence.
• Update the minimum external LLVM to 21
• On avr targets, C's double type is 32-bit by default, so change c_double to f32 on avr targets to match. This is a breaking change, but necessary to make c_double match C's double.

Internal Changes

These changes do not affect any public interfaces of Rust, but they represent
significant improvements to the performance or internals of rustc and related
tools.

• JSON targets: aarch64 softfloat targets now have to have rustc_abi set to "softfloat"
• target specs: stricter checks for LLVM ABI values, and correlate that with cfg(target_abi)

v1.95.0

Compare Source

===========================

Language

• Stabilize if let guards on match arms
• irrefutable_let_patterns lint no longer lints on let chains
• Support importing path-segment keywords with renaming
• Stabilize inline assembly for PowerPC and PowerPC64
• const-eval: be more consistent in the behavior of padding during typed copies
• Const blocks are no longer evaluated to determine if expressions involving fallible operations can implicitly be constant-promoted.. Expressions whose ability to implicitly be promoted would depend on the result of a const block are no longer implicitly promoted.
• Make operational semantics of pattern matching independent of crate and module

Compiler

• Stabilize --remap-path-scope for controlling the scoping of how paths get remapped in the resulting binary
• Apply patches for CVE-2026-6042 and CVE-2026-40200 to vendored musl

Platform Support

• Promote powerpc64-unknown-linux-musl to Tier 2 with host tools
• Promote aarch64-apple-tvos to Tier 2
• Promote aarch64-apple-tvos-sim to Tier 2
• Promote aarch64-apple-watchos to Tier 2
• Promote aarch64-apple-watchos-sim to Tier 2
• Promote aarch64-apple-visionos to Tier 2
• Promote aarch64-apple-visionos-sim to Tier 2

Refer to Rust's platform support page
for more information on Rust's tiered platform support.

Libraries

• thread::scope: document how join interacts with TLS destructors
• Speed up str::contains on aarch64 targets with neon target feature enabled by default

Stabilized APIs

• MaybeUninit<[T; N]>: From<[MaybeUninit<T>; N]>
• MaybeUninit<[T; N]>: AsRef<[MaybeUninit<T>; N]>
• MaybeUninit<[T; N]>: AsRef<[MaybeUninit<T>]>
• MaybeUninit<[T; N]>: AsMut<[MaybeUninit<T>; N]>
• MaybeUninit<[T; N]>: AsMut<[MaybeUninit<T>]>
• [MaybeUninit<T>; N]: From<MaybeUninit<[T; N]>>
• Cell<[T; N]>: AsRef<[Cell<T>; N]>
• Cell<[T; N]>: AsRef<[Cell<T>]>
• Cell<[T]>: AsRef<[Cell<T>]>
• bool: TryFrom<{integer}>
• AtomicPtr::update
• AtomicPtr::try_update
• AtomicBool::update
• AtomicBool::try_update
• AtomicIn::update
• AtomicIn::try_update
• AtomicUn::update
• AtomicUn::try_update
• cfg_select!
• mod core::range
• core::range::RangeInclusive
• core::range::RangeInclusiveIter
• core::hint::cold_path
• <*const T>::as_ref_unchecked
• <*mut T>::as_ref_unchecked
• <*mut T>::as_mut_unchecked
• Vec::push_mut
• Vec::insert_mut
• VecDeque::push_front_mut
• VecDeque::push_back_mut
• VecDeque::insert_mut
• LinkedList::push_front_mut
• LinkedList::push_back_mut
• Layout::dangling_ptr
• Layout::repeat
• Layout::repeat_packed
• Layout::extend_packed

These previously stable APIs are now stable in const contexts:

• fmt::from_fn
• ControlFlow::is_break
• ControlFlow::is_continue

Rustdoc

• In search results, rank unstable items lower
• Add new "hide deprecated items" setting in rustdoc

Compatibility Notes

• Array coercions may now result in less inference constraints than before
• Importing $crate without renaming, i.e. use $crate::{self};, is now no longer permitted due to stricter error checking for self imports.
• const-eval: be more consistent in the behavior of padding during typed copies.
  In very rare cases, this may cause compilation errors due to bytes from parts of a pointer ending up in the padding bytes of a const or static.
• A future-incompatibility warning lint ambiguous_glob_imported_traits is now reported when using an ambiguously glob imported trait
• Check lifetime bounds of types mentioning only type parameters
• Report more visibility-related ambiguous import errors
• Deprecate Eq::assert_receiver_is_total_eq and emit future compatibility warnings on manual impls
• powerpc64: Use the ELF ABI version set in target spec instead of guessing (fixes the ELF ABI used by the OpenBSD target)
• Matching on a #[non_exhaustive] enum now reads the discriminant, even if the enum has only one variant. This can cause closures to capture values that they previously wouldn't.
• mut ref and mut ref mut patterns, part of the unstable Match Ergonomics 2024 RFC, were accidentally allowed on stable within struct pattern field shorthand. These patterns are now correctly feature-gated as unstable in this position.
• Add future-compatibility warning for derive helper attributes which conflict with built-in attributes
• JSON target specs have been destabilized and now require -Z unstable-options to use. Previously, they could not be used without

✂ Note

PR body was truncated to here.