qunitx-cli 0.9.0 → 0.9.2

package/cli.js

@@ -27,5 +27,13 @@ process.title = 'qunitx';
     import('./lib/commands/run.js'),
   ]);
 
-  return await run(config);
+  try {
+    return await run(config);
+  } catch (error) {
+    console.error(error);
+    // Flush stdout before exit so any queued console.log writes (e.g. from WS testEnd
+    // handlers that fired before the exception) are not lost when process.exit() runs.
+    process.exitCode = 1;
+    process.stdout.write('\n', () => process.exit(1));
+  }
 })();

package/deno.lock

@@ -10,13 +10,13 @@
     "npm:esbuild@~0.27.3": "0.27.4",
     "npm:express@^5.2.1": "5.2.1",
     "npm:js-yaml@^4.1.1": "4.1.1",
-    "npm:picomatch@*": "4.0.3",
-    "npm:picomatch@^4.0.3": "4.0.3",
+    "npm:picomatch@*": "4.0.4",
+    "npm:picomatch@^4.0.4": "4.0.4",
     "npm:playwright-core@^1.58.2": "1.58.2",
     "npm:prettier@^3.8.1": "3.8.1",
-    "npm:qunitx@^1.0.3": "1.0.3",
-    "npm:ws@*": "8.19.0",
-    "npm:ws@^8.19.0": "8.19.0"
+    "npm:qunitx@^1.0.4": "1.0.4",
+    "npm:ws@*": "8.20.0",
+    "npm:ws@^8.20.0": "8.20.0"
   },
   "jsr": {
     "@std/fmt@1.0.9": {
@@ -473,8 +473,8 @@
     "path-to-regexp@8.3.0": {
       "integrity": "sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA=="
     },
-    "picomatch@4.0.3": {
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q=="
+    "picomatch@4.0.4": {
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="
     },
     "playwright-core@1.58.2": {
       "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
@@ -497,8 +497,8 @@
         "side-channel"
       ]
     },
-    "qunitx@1.0.3": {
-      "integrity": "sha512-LdCQ0Sh85IvLqcAIIbIlNNC3NGEMlkuDUQl1gk3AH2d3Dv7HbEYEG+RW786c8w5gMfPh8gx1+PJKbuN2jqQf+g=="
+    "qunitx@1.0.4": {
+      "integrity": "sha512-iu3enOfQo5Ul5As+KFiN1Zm1kd8MWeeNcHFUbZpKYQn+y6f6V4yiDeehVc5LFSUFBOkutjnqHzZiqInCf0MutA=="
     },
     "range-parser@1.2.1": {
       "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg=="
@@ -615,8 +615,8 @@
     "wrappy@1.0.2": {
       "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
     },
-    "ws@8.19.0": {
-      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg=="
+    "ws@8.20.0": {
+      "integrity": "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA=="
     }
   },
   "workspace": {
@@ -631,11 +631,11 @@
         "npm:esbuild@~0.27.3",
         "npm:express@^5.2.1",
         "npm:js-yaml@^4.1.1",
-        "npm:picomatch@^4.0.3",
+        "npm:picomatch@^4.0.4",
         "npm:playwright-core@^1.58.2",
         "npm:prettier@^3.8.1",
-        "npm:qunitx@^1.0.3",
-        "npm:ws@^8.19.0"
+        "npm:qunitx@^1.0.4",
+        "npm:ws@^8.20.0"
       ]
     }
   }

package/lib/commands/generate.js

@@ -10,7 +10,7 @@ import readBoilerplate from '../utils/read-boilerplate.js';
  */
 export default async function generateTestFiles() {
   const projectRoot = await findProjectRoot();
-  const moduleName = process.argv[3]; // TODO: classify this maybe in future
+  const moduleName = process.argv[3];
   const path =
     process.argv[3].endsWith('.js') || process.argv[3].endsWith('.ts')
       ? `${projectRoot}/${process.argv[3]}`

package/lib/commands/init.js

@@ -9,34 +9,25 @@ import readBoilerplate from '../utils/read-boilerplate.js';
 export default async function initializeProject() {
   const projectRoot = await findProjectRoot();
   const oldPackageJSON = JSON.parse(await fs.readFile(`${projectRoot}/package.json`));
-  const htmlPaths = process.argv.slice(2).reduce(
-    (result, arg) => {
-      if (arg.endsWith('.html')) {
-        result.push(arg);
-      }
-
-      return result;
-    },
-    oldPackageJSON.qunitx && oldPackageJSON.qunitx.htmlPaths ? oldPackageJSON.qunitx.htmlPaths : [],
-  );
-  const newQunitxConfig = Object.assign(
-    defaultProjectConfigValues,
-    htmlPaths.length > 0 ? { htmlPaths } : { htmlPaths: ['test/tests.html'] },
-    oldPackageJSON.qunitx,
-  );
+  const existingQunitx = oldPackageJSON.qunitx || {};
+  const cliHtmlPaths = process.argv.slice(2).filter((arg) => arg.endsWith('.html'));
+  const config = Object.assign({}, defaultProjectConfigValues, existingQunitx, {
+    htmlPaths:
+      cliHtmlPaths.length > 0 ? cliHtmlPaths : existingQunitx.htmlPaths || ['test/tests.html'],
+  });
 
   await Promise.all([
-    writeTestsHTML(projectRoot, newQunitxConfig, oldPackageJSON),
-    rewritePackageJSON(projectRoot, newQunitxConfig, oldPackageJSON),
+    writeTestsHTML(projectRoot, config, oldPackageJSON),
+    rewritePackageJSON(projectRoot, config, oldPackageJSON),
     writeTSConfigIfNeeded(projectRoot),
   ]);
 }
 
-async function writeTestsHTML(projectRoot, newQunitxConfig, oldPackageJSON) {
+async function writeTestsHTML(projectRoot, config, oldPackageJSON) {
   const testHTMLTemplateBuffer = await readBoilerplate('setup/tests.hbs');
 
   return await Promise.all(
-    newQunitxConfig.htmlPaths.map(async (htmlPath) => {
+    config.htmlPaths.map(async (htmlPath) => {
       const targetPath = `${projectRoot}/${htmlPath}`;
       if (await pathExists(targetPath)) {
         return console.log(`${htmlPath} already exists`);
@@ -44,7 +35,7 @@ async function writeTestsHTML(projectRoot, newQunitxConfig, oldPackageJSON) {
         const targetDirectory = path.dirname(targetPath);
         const _targetOutputPath = path.relative(
           targetDirectory,
-          `${projectRoot}/${newQunitxConfig.output}/tests.js`,
+          `${projectRoot}/${config.output}/tests.js`,
         );
         const testHTMLTemplate = testHTMLTemplateBuffer.replace(
           '{{applicationName}}',
@@ -60,8 +51,8 @@ async function writeTestsHTML(projectRoot, newQunitxConfig, oldPackageJSON) {
   );
 }
 
-async function rewritePackageJSON(projectRoot, newQunitxConfig, oldPackageJSON) {
-  const newPackageJSON = Object.assign(oldPackageJSON, { qunitx: newQunitxConfig });
+async function rewritePackageJSON(projectRoot, config, oldPackageJSON) {
+  const newPackageJSON = Object.assign(oldPackageJSON, { qunitx: config });
 
   await fs.writeFile(`${projectRoot}/package.json`, JSON.stringify(newPackageJSON, null, 2));
 }

package/lib/commands/run/tests-in-browser.js

@@ -140,28 +140,39 @@ function buildFilteredTests(filteredTests, outputPath, config) {
 async function runTestInsideHTMLFile(filePath, { page, server, browser }, config) {
   let QUNIT_RESULT;
   let targetError;
+  let timeoutHandle;
   try {
     console.log('#', blue(`QUnitX running: http://localhost:${config.port}${filePath}`));
 
-    const testsDone = new Promise((resolve) => {
-      config._testRunDone = resolve;
+    // Single promise driven by the WS handler:
+    //   config._testRunDone()      → tests finished normally
+    //   config._resetTestTimeout() → reset idle timer; fires as timeout if silent for config.timeout ms
+    // This replaces waitForFunction (CDP polling), which raced against WS testEnd messages
+    // under load: CDP could win and trigger cleanup before Node.js processed the pending messages.
+    const testRaceResult = new Promise((resolve) => {
+      config._testRunDone = () => resolve(false);
+      config._resetTestTimeout = () => {
+        clearTimeout(timeoutHandle);
+        timeoutHandle = setTimeout(() => resolve(true), config.timeout);
+      };
     });
 
     await page.goto(`http://localhost:${config.port}${filePath}`, {
       timeout: config.timeout + 10000,
     });
-    await Promise.race([
-      testsDone,
-      page.waitForFunction(`window.testTimeout >= ${config.timeout}`, null, {
-        timeout: config.timeout + 10000,
-      }),
-    ]);
+
+    config._resetTestTimeout(); // start idle countdown once the page is loaded
+
+    await testRaceResult;
 
     QUNIT_RESULT = await page.evaluate(() => window.QUNIT_RESULT);
   } catch (error) {
     targetError = error;
     console.log(error);
     console.error(error);
+  } finally {
+    clearTimeout(timeoutHandle);
+    config._resetTestTimeout = null;
   }
 
   if (!QUNIT_RESULT || QUNIT_RESULT.totalTests === 0) {
@@ -174,6 +185,10 @@ async function runTestInsideHTMLFile(filePath, { page, server, browser }, config
     console.log(`BROWSER: TEST TIMED OUT: ${QUNIT_RESULT.currentTest}`);
     console.error(`BROWSER: TEST TIMED OUT: ${QUNIT_RESULT.currentTest}`);
     await failOnNonWatchMode(config.watch, { server, browser }, config._groupMode);
+  } else if (QUNIT_RESULT.failedTests > config.COUNTER.failCount) {
+    // Safety net: browser tracked failures that WebSocket events never delivered to Node.js
+    // (e.g. WS connection dropped mid-run). Reconcile so the exit code is always correct.
+    config.COUNTER.failCount = QUNIT_RESULT.failedTests;
   }
 }
 

package/lib/commands/run.js

@@ -81,6 +81,8 @@ export default async function run(config) {
     }));
     const groupCachedContents = groups.map(() => ({ ...cachedContent }));
 
+    console.log('TAP version 13');
+
     // Build all group bundles and write static files while the browser is starting up.
     const [browser] = await Promise.all([
       launchBrowser(config),
@@ -93,34 +95,74 @@ export default async function run(config) {
         ),
       ),
     ]);
-
-    console.log('TAP version 13');
     const TIME_COUNTER = timeCounter();
-    let hasFatalError = false;
 
-    await Promise.allSettled(
-      groupConfigs.map(async (groupConfig, i) => {
-        const connections = await setupBrowser(groupConfig, groupCachedContents[i], browser);
-        groupConfig.expressApp = connections.server;
+    // 3-minute per-group deadline. Firefox/WebKit can hang indefinitely in any Playwright
+    // operation (browser.newPage, page.evaluate, page.close) when overwhelmed by concurrent
+    // pages. Without this outer timeout, one stuck group freezes Promise.allSettled forever.
+    // After all groups settle, browser.close() (below) terminates the browser and unblocks
+    // any still-pending Playwright calls in background async fns.
+    const GROUP_TIMEOUT_MS = 3 * 60 * 1000;
 
-        if (config.before) {
-          await runUserModule(`${process.cwd()}/${config.before}`, groupConfig, 'before');
-        }
+    // Keep the event loop alive during Promise.allSettled. The Chrome child process and its
+    // stderr pipe are unref'd (pre-launch-chrome.js). If Chrome crashes during group cleanup,
+    // all active handles close and the event loop would drain — exiting silently before
+    // allSettled resolves or results are printed. This interval holds the loop open so that
+    // unref'd group/page-close timers can still fire normally.
+    const keepAlive = setInterval(() => {}, 1000);
 
-        try {
-          await runTestsInBrowser(groupConfig, groupCachedContents[i], connections);
-        } catch {
-          hasFatalError = true;
-        } finally {
-          await Promise.all([
-            connections.server && connections.server.close(),
-            connections.page && connections.page.close(),
-          ]);
-        }
+    const groupResults = await Promise.allSettled(
+      groupConfigs.map((groupConfig, i) => {
+        const groupTimeout = new Promise((_, reject) => {
+          const t = setTimeout(
+            () => reject(new Error(`Group ${i} timed out after ${GROUP_TIMEOUT_MS}ms`)),
+            GROUP_TIMEOUT_MS,
+          );
+          t.unref();
+        });
+
+        return Promise.race([
+          (async () => {
+            const connections = await setupBrowser(groupConfig, groupCachedContents[i], browser);
+            groupConfig.expressApp = connections.server;
+
+            if (config.before) {
+              await runUserModule(`${process.cwd()}/${config.before}`, groupConfig, 'before');
+            }
+
+            try {
+              await runTestsInBrowser(groupConfig, groupCachedContents[i], connections);
+            } finally {
+              await Promise.all([
+                connections.server && connections.server.close(),
+                connections.page &&
+                  // Unref'd: the keepAlive interval above holds the event loop open, so this
+                  // timer still fires if page.close() hangs, without preventing process exit later.
+                  Promise.race([
+                    connections.page.close(),
+                    new Promise((resolve) => {
+                      const t = setTimeout(resolve, 10000);
+                      t.unref();
+                    }),
+                  ]).catch(() => {}),
+              ]);
+            }
+          })(),
+          groupTimeout,
+        ]);
       }),
     );
 
-    await browser.close();
+    const exitCode = groupResults.reduce(
+      (code, { status, reason }) => {
+        if (status !== 'rejected') return code;
+        console.error(reason);
+        return 1;
+      },
+      config.COUNTER.failCount > 0 ? 1 : 0,
+    );
+
+    process.exitCode = exitCode;
 
     TAPDisplayFinalResult(config.COUNTER, TIME_COUNTER.stop());
 
@@ -128,7 +170,18 @@ export default async function run(config) {
       await runUserModule(`${process.cwd()}/${config.after}`, config.COUNTER, 'after');
     }
 
-    process.exit(config.COUNTER.failCount > 0 || hasFatalError ? 1 : 0);
+    // Flush stdout then exit. keepAlive holds the event loop open until this callback fires,
+    // at which point process.exit() takes over — so clearInterval happens here, not earlier.
+    // If the write callback never fires (theoretical), the unref'd exitTimer is the fallback.
+    const exitTimer = setTimeout(() => process.exit(exitCode), 5000);
+    exitTimer.unref();
+    process.stdout.write('\n', () => {
+      clearTimeout(exitTimer);
+      clearInterval(keepAlive);
+      // Close browser after stdout is flushed; fire-and-forget since process.exit follows.
+      browser.close().catch(() => {});
+      process.exit(exitCode);
+    });
   }
 }
 

package/lib/servers/http.js

@@ -77,11 +77,13 @@ export default class HTTPServer {
   }
 
   /**
-   * Closes the underlying HTTP server.
-   * @returns {object}
+   * Closes the underlying HTTP server and all active connections, returning a
+   * Promise that resolves once the server is fully closed.
+   * @returns {Promise<void>}
    */
   close() {
-    return this._server.close();
+    this._server.closeAllConnections?.();
+    return new Promise((resolve) => this._server.close(resolve));
   }
 
   /** Registers a GET route handler. */

package/lib/setup/file-watcher.js

@@ -86,9 +86,8 @@ export function handleWatchEvent(config, extensions, event, filePath, onEventFun
       .then(() => {
         onFinishFunc ? onFinishFunc(event, filePath) : null;
       })
-      .catch(() => {
-        // TODO: make an index.html to display the error
-        // error type has to be derived from the error!
+      .catch((error) => {
+        console.error('#', red('Build error:'), error.message || error);
       })
       .finally(() => (config._building = false));
   }

package/lib/setup/fs-tree.js

@@ -22,8 +22,6 @@ export default async function buildFSTree(fileAbsolutePaths, config = {}) {
     fileAbsolutePaths.map(async (fileAbsolutePath) => {
       const glob = picomatch.scan(fileAbsolutePath);
 
-      // TODO: maybe allow absolute path references
-
       try {
         if (glob.isGlob) {
           const fileNames = await readDirRecursive(glob.base, (name) => {

package/lib/setup/web-server.js

@@ -29,11 +29,13 @@ export default function setupWebServer(
 
       if (event === 'connection') {
         if (!config._groupMode) console.log('TAP version 13');
+        config._resetTestTimeout?.();
       } else if (event === 'testEnd' && !abort) {
         if (details.status === 'failed') {
           config.lastFailedTestFiles = config.lastRanTestFiles;
         }
 
+        config._resetTestTimeout?.();
         TAPDisplayTestResult(config.COUNTER, details);
       } else if (event === 'done') {
         // Signal test completion. TCP ordering guarantees all testEnd messages
@@ -214,7 +216,7 @@ function testRuntimeToInject(port, config) {
     }
 
     function setupQUnit() {
-      window.QUNIT_RESULT = { totalTests: 0, finishedTests: 0, currentTest: '' };
+      window.QUNIT_RESULT = { totalTests: 0, finishedTests: 0, failedTests: 0, currentTest: '' };
 
       if (!window.QUnit) {
         console.log('QUnit not found after WebSocket connected');
@@ -239,6 +241,7 @@ function testRuntimeToInject(port, config) {
       window.QUnit.on('testEnd', (details) => { // NOTE: https://github.com/qunitjs/qunit/blob/master/src/html-reporter/diff.js
         window.testTimeout = 0;
         window.QUNIT_RESULT.finishedTests++;
+        if (details.status === 'failed') window.QUNIT_RESULT.failedTests++;
         window.QUNIT_RESULT.currentTest = null;
         if (window.IS_PLAYWRIGHT) {
           window.socket.send(JSON.stringify({ event: 'testEnd', details: details, abort: window.abortQUnit }, getCircularReplacer()));
@@ -251,10 +254,11 @@ function testRuntimeToInject(port, config) {
       window.QUnit.done((details) => {
         if (window.IS_PLAYWRIGHT) {
           window.socket.send(JSON.stringify({ event: 'done', details: details, abort: window.abortQUnit }, getCircularReplacer()));
-          // Delay the testTimeout fallback so the WS done event can arrive at Node.js first.
-          // Without this delay, waitForFunction resolves before Node.js processes the done WS
-          // message, causing the shared COUNTER to miss testEnd results under concurrent load.
-          window.setTimeout(() => { window.testTimeout = ${config.timeout}; }, 500);
+          // Do NOT set testTimeout here. The WS 'done' event (testsDone promise) is the
+          // canonical completion signal for Playwright runs. waitForFunction is reserved
+          // for true timeouts (test hangs) where testTimeout increments naturally via setInterval.
+          // Setting testTimeout after done caused a race: under CI load, waitForFunction could
+          // win before Node.js processed the WS done message, dropping all testEnd events.
         } else {
           window.testTimeout = ${config.timeout};
         }

package/lib/tap/display-test-result.js

@@ -23,7 +23,7 @@ export default function TAPDisplayTestResult(COUNTER, details) {
       details.fullName.join(' | '),
       `# (${details.runtime.toFixed(0)} ms)`,
     );
-    details.assertions.reduce((errorCount, assertion, index) => {
+    details.assertions.forEach((assertion, index) => {
       if (!assertion.passed && assertion.todo === false) {
         COUNTER.errorCount = (COUNTER.errorCount ?? 0) + 1;
         const stack = assertion.stack?.match(/\(.+\)/g);
@@ -32,7 +32,7 @@ export default function TAPDisplayTestResult(COUNTER, details) {
         console.log(
           indentString(
             dumpYaml({
-              name: `Assertion #${index + 1}`, // TODO: check what happens on runtime errors
+              name: `Assertion #${index + 1}`,
               actual: assertion.actual
                 ? JSON.parse(JSON.stringify(assertion.actual, getCircularReplacer()))
                 : assertion.actual,
@@ -48,9 +48,7 @@ export default function TAPDisplayTestResult(COUNTER, details) {
         );
         console.log('  ...');
       }
-
-      return errorCount;
-    }, 0);
+    });
   } else if (details.status === 'passed') {
     COUNTER.passCount++;
     console.log(

package/lib/utils/listen-to-keyboard-key.js

@@ -14,6 +14,7 @@ export default function listenToKeyboardKey(
   closure,
   options = { caseSensitive: false },
 ) {
+  if (!stdin.isTTY) return;
   stdin.setRawMode(true);
   stdin.resume();
   stdin.setEncoding('utf8');

package/lib/utils/pre-launch-chrome.js

@@ -20,13 +20,22 @@ export default function preLaunchChrome(chromePath, args) {
     proc.stderr.on('data', (chunk) => {
       buffer += chunk.toString();
       const match = buffer.match(CDP_URL_REGEX);
-      if (match) resolve({ proc, cdpEndpoint: match[1] });
+      if (match) {
+        // Unref so Chrome's process + stderr pipe don't keep the Node.js event loop alive
+        // after all test work is done. Chrome is still killed via process.on('exit').
+        proc.unref();
+        proc.stderr.unref();
+        resolve({ proc, cdpEndpoint: match[1] });
+      }
     });
 
-    // Resolve null on any startup failure so launchBrowser falls back to chromium.launch()
+    // Resolve null on any startup failure so launchBrowser falls back to chromium.launch().
+    // The close handler resolves unconditionally: if Chrome exits before printing its CDP URL
+    // (code=0 for a clean exit, code=null for a signal-killed process such as OOM on CI),
+    // the original condition `code !== null && code !== 0` would leave the promise pending
+    // forever, causing launchBrowser to hang and the event loop to drain silently (exit 0).
+    // If Chrome already printed its URL and the promise is resolved, this is a no-op.
     proc.on('error', () => resolve(null));
-    proc.on('close', (code) => {
-      if (code !== null && code !== 0) resolve(null);
-    });
+    proc.on('close', () => resolve(null));
   });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "qunitx-cli",
   "type": "module",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Browser runner for QUnitx: run your qunitx tests in google-chrome",
   "main": "cli.js",
   "author": "Izel Nakri",
@@ -25,8 +25,8 @@
     "changelog:preview": "git-cliff",
     "changelog:update": "git-cliff --output CHANGELOG.md",
     "postinstall": "deno install --allow-scripts=npm:playwright-core || true",
-    "test": "node test/setup.js && FORCE_COLOR=0 node --test test/**/*-test.js",
-    "test:browser": "node test/setup.js && FORCE_COLOR=0 node --test test/flags/*-test.js test/inputs/*-test.js",
+    "test": "node test/setup.js && FORCE_COLOR=0 node --test --test-concurrency=$(node -p 'require(\"os\").availableParallelism()') test/**/*-test.js",
+    "test:browser": "node test/setup.js && FORCE_COLOR=0 node --test --test-concurrency=$(node -p 'require(\"os\").availableParallelism()') test/flags/*-test.js test/inputs/*-test.js",
     "test:sanity-first": "./cli.js test/helpers/failing-tests.js test/helpers/failing-tests.ts",
     "test:sanity-second": "./cli.js test/helpers/passing-tests.js test/helpers/passing-tests.ts"
   },
@@ -43,16 +43,16 @@
   },
   "dependencies": {
     "esbuild": "^0.27.3",
-    "picomatch": "^4.0.3",
+    "picomatch": "^4.0.4",
     "playwright-core": "^1.58.2",
-    "ws": "^8.19.0"
+    "ws": "^8.20.0"
   },
   "devDependencies": {
     "cors": "^2.8.6",
     "express": "^5.2.1",
     "js-yaml": "^4.1.1",
     "prettier": "^3.8.1",
-    "qunitx": "^1.0.3"
+    "qunitx": "^1.0.4"
   },
   "volta": {
     "node": "24.14.0"