chore(dev-deps): bump the dev-minor-patch group with 6 updates

[dependabot]

Bumps the dev-minor-patch group with 6 updates:

Package	From	To
@eslint/compat	2.0.5	2.1.0
@types/node	25.6.0	25.6.2
@vitest/eslint-plugin	1.6.16	1.6.17
fs-extra	11.3.4	11.3.5
nock	14.0.12	14.0.15
vite	8.0.10	8.0.11

Updates @eslint/compat from 2.0.5 to 2.1.0

Release notes

Sourced from @​eslint/compat's releases.

compat: v2.1.0

2.1.0 (2026-05-08)

Features

• Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

migrate-config: v2.1.0

2.1.0 (2026-05-08)

Features

• Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/config-helpers bumped from ^0.5.5 to ^0.6.0

migrate-config: v2.0.7

2.0.7 (2026-05-01)

Bug Fixes

• update espree to the latest (#437) (a8ff72f)

migrate-config: v2.0.6

2.0.6 (2026-04-08)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/compat bumped from ^2.0.4 to ^2.0.5
  • devDependencies
    • @​eslint/core bumped from ^1.2.0 to ^1.2.1

Changelog

Sourced from @​eslint/compat's changelog.

2.1.0 (2026-05-08)

Features

• Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

Commits

• b894953 chore: release main (#446)
• 334038d docs: Update README sponsors
• 9b51352 feat: Add new includeIgnoreFile() to config-helpers (#430)
• 70b6997 docs: Update README sponsors
• 35b6b94 chore: update TypeScript to v6 (#417)
• 7807d71 docs: Update README sponsors
• 57001ea docs: Update README sponsors
• 0b62133 docs: Update README sponsors
• See full diff in compare view

Updates @types/node from 25.6.0 to 25.6.2

Commits

• See full diff in compare view

Updates @vitest/eslint-plugin from 1.6.16 to 1.6.17

Release notes

Sourced from @​vitest/eslint-plugin's releases.

v1.6.17

   🐞 Bug Fixes

• Recommend toBeTypeOf instead of expectTypeOf in prefer-expect-type-of  -  by @​sheremet-va in vitest-dev/eslint-plugin-vitest#896 (a4bcd)
• no-standalone-expect: Allow expect inside vi.defineHelper callbacks  -  by @​nami8824 in vitest-dev/eslint-plugin-vitest#894 (fd8eb)

    View changes on GitHub

Commits

• 789966e chore: release v1.6.17
• a4bcdf5 fix: recommend toBeTypeOf instead of expectTypeOf in `prefer-expect-type-...
• fd8eb3c fix(no-standalone-expect): allow expect inside vi.defineHelper callbacks (#894)
• dbf423c refactor: simplify ParsedGeneralVitestFnCall type exclusion (#895)
• See full diff in compare view

Updates fs-extra from 11.3.4 to 11.3.5

Changelog

Sourced from fs-extra's changelog.

11.3.5 / 2026-05-06

• Fix ensureLink*/ensureSymlink* identical file detection on Windows (#1068)
• Fix error handling in timestamp preservation code (#1065, #1069)
• Fix potential file descriptor leak on error in synchronous timestamp preservation code (#1066)

Commits

• 8a88f58 11.3.5
• 81a1311 Mirror all utimesMillis() tests for utimesMillisSync() (#1070)
• b7ab7f8 Properly handle close errors in utimesMillis*() (#1069)
• 1c248ed Fix file descriptor leak in utimesMillisSync (#1066)
• a4000d6 Ensure all usages of areIdentical receive bigint stats (#1068)
• 1e9c57d Fix error handling in utimesMillis (#1065)
• See full diff in compare view

Updates nock from 14.0.12 to 14.0.15

Release notes

Sourced from nock's releases.

v14.0.15

14.0.15 (2026-05-07)

Bug Fixes

• Revert "fix(backport): apply body delay before the response end" (#2973) (de5450c), closes #2969

v14.0.14

14.0.14 (2026-04-30)

Bug Fixes

• backport: apply body delay before the response end (#2969) (215cd2a)

v14.0.13

14.0.13 (2026-04-20)

Bug Fixes

• types: align Definition with runtime; add rawHeaders, drop headers (#2955) (07fbfab)

Commits

• de5450c fix: Revert "fix(backport): apply body delay before the response end" (#2973)
• 215cd2a fix(backport): apply body delay before the response end (#2969)
• 07fbfab fix(types): align Definition with runtime; add rawHeaders, drop headers (#2955)
• fe2c3ea chore(deps-dev): bump lodash-es from 4.17.23 to 4.18.1 (#2961)
• ee49b4f chore(deps-dev): bump flatted from 3.2.5 to 3.4.2
• 11bf183 chore(deps-dev): bump undici from 6.23.0 to 6.24.1 (#2954)
• 6b80154 chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (#2960)
• 4cbf6cc chore(deps): bump tar and npm (#2952)
• See full diff in compare view

Updates vite from 8.0.10 to 8.0.11

Release notes

Sourced from vite's releases.

v8.0.11

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.11 (2026-05-07)

Features

• update rolldown to 1.0.0-rc.18 (#22360) (3f80524)

Bug Fixes

• deps: update all non-major dependencies (#22334) (672c962)
• deps: update all non-major dependencies (#22382) (5c0cfcb)
• glob: align hmr matcher options with glob enumeration (#22306) (30028f9)
• make separate object instance for each environment (#22276) (7c2aa3b)

Documentation

• create-vite: list react-compiler templates in README (#22347) (7c3a61f)
• explain mergeConfig skips null/undefined (#22325) (2151f70)
• mention native config loader in CLI options (#22348) (0420c5d)
• update evan's x handle (640202a)

Miscellaneous Chores

• deps: update dependency tsdown to ^0.21.10 (#22333) (3b51e05)
• deps: update rolldown-related dependencies (#22383) (555ff36)
• deps: update transitive packages to fix npm audit alerts (#22316) (86aee62)

Code Refactoring

• devtools integration (#22312) (3c8bf06)
• remove unnecessary async (#22296) (b31fd35)
• show direct path type in bad character warning (#22339) (0c162e9)

Tests

• create-vite: use short help alias (#22389) (994ab66)

Commits

• 66f3194 release: v8.0.11
• 5c0cfcb fix(deps): update all non-major dependencies (#22382)
• 555ff36 chore(deps): update rolldown-related dependencies (#22383)
• b31fd35 refactor: remove unnecessary async (#22296)
• 3c8bf06 refactor: devtools integration (#22312)
• 7c2aa3b fix: make separate object instance for each environment (#22276)
• 3f80524 feat: update rolldown to 1.0.0-rc.18 (#22360)
• 0c162e9 refactor: show direct path type in bad character warning (#22339)
• 672c962 fix(deps): update all non-major dependencies (#22334)
• 30028f9 fix(glob): align hmr matcher options with glob enumeration (#22306)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cli-web-cli	Ready	Preview, Comment	May 11, 2026 1:21pm

[ci-lockfile-regen]

Dependabot Fix Assessment

Packages: 6 dev-dependency bumps (minor/patch)

• @eslint/compat 2.0.5 → 2.1.0 (minor)
• @types/node 25.6.0 → 25.6.2 (patch)
• @vitest/eslint-plugin 1.6.16 → 1.6.17 (patch)
• fs-extra 11.3.4 → 11.3.5 (patch)
• nock 14.0.12 → 14.0.15 (patch)
• vite 8.0.10 → 8.0.11 (patch)

Scope: devDependencies only
Workspace: root (vite also pinned in packages/react-web-cli)

What changed upstream

• @eslint/compat: Added includeIgnoreFile() helper, no breaking changes
• @types/node: TypeScript type definition patch, no runtime impact
• @vitest/eslint-plugin: Two bug fixes (prefer-expect-type-of, no-standalone-expect), no breaking changes
• fs-extra: Windows-only bug fixes (ensureLink/ensureSymlink, fd leak), no Linux impact
• nock v14.0.13: Definition type changed — headers removed, rawHeaders added. v14.0.14 + v14.0.15 are a bug fix + revert pair. Net: one type-only change
• vite v8.0.11: Bumped rolldown to rc.18, minor bug fixes (glob matcher, environment object instance). No breaking API changes

Migration concerns checked

• Peer dependencies: OK — no conflicts
• Type changes (nock): Checked all test files for Definition type or .headers usage — none found. Our tests only use the default nock import for interceptors
• Config files: OK — no vite/vitest config changes needed
• Module format: OK — all packages still ESM-compatible
• React compatibility: OK — no React version conflicts
• Monorepo impact: OK — vite is pinned to 8.0.11 in packages/react-web-cli, consistent with root bump

What broke in CI

Failed check: Web CLI E2E Tests (Parallel) — session-tests / Run Session & Reconnection Tests
Failing test: should handle disconnection and reconnection gracefully (reconnection.test.ts:121)

Root cause: Server-side rate limiting (code 4003), not a code change

The browser logs show:

[GlobalReconnect] reconnectTimer FIRED. Attempting connection... attempt #2
Session ended: Too many connection attempts. Please try again in 32 seconds.
WebSocket closed. Code: 4003, Reason: Rate limited. Try again in 32s

The test disconnects the WebSocket to simulate a network outage, then waits for auto-reconnect. The reconnection logic (in packages/react-web-cli/src/global-reconnect.ts) uses a fixed backoff: 2s (attempt 1), 4s (attempt 2), 8s (attempt 3+). The second reconnect attempt hit the server's 32-second rate limit window.

None of the 6 bumped packages affect WebSocket reconnection timing. The source code in global-reconnect.ts is unchanged. This is a pre-existing test flakiness caused by the parallel E2E test suite exhausting the real server's rate limit quota before the auto-reconnect backoff expires.

Evidence this is flakiness, not a regression:

• 8 other tests in the same run passed, including other reconnection tests
• The failure is a server response (4003), not a code/type error
• No bumped package touches WebSocket, timer, or reconnection logic
• vite 8.0.11 uses rolldown rc.18 but produces functionally equivalent bundle output for reconnection code

What was fixed

No code changes were needed. This is test infrastructure flakiness.

Verification (run locally against this branch)

• Build (pnpm prepare): ✅
• Lint (pnpm exec eslint .): ✅ (0 errors, 10 pre-existing warnings)
• Unit tests (pnpm test:unit): ✅ 2479 passed, 0 failed
• Web CLI package tests (pnpm --filter @ably/react-web-cli test): ✅ 57 passed, 6 skipped

Notes for reviewer

The failing E2E test (should handle disconnection and reconnection gracefully) is known to be sensitive to server-side rate limits in parallel CI runs — there is already a skipped test in the same file with annotation "COMPLEX test with timing issues" (line 635). The test has rate-limit avoidance code (waitForRateLimitLock, waitForRateLimitIfNeeded) but those guards only protect the test setup, not the reconnection attempts that happen mid-test.

This PR is safe to merge. The dependency updates are all devDependencies with no runtime behavior changes relevant to this codebase.