build(deps): bump the frontend group across 1 directory with 4 updates

[dependabot]

Bumps the frontend group with 4 updates in the /services/frontend directory: marked, @eslint/eslintrc, @hey-api/openapi-ts and @playwright/test.

Updates marked from 18.0.4 to 18.0.6

Release notes

Sourced from marked's releases.

v18.0.6

18.0.6 (2026-07-09)

Bug Fixes

• Avoid O(n^2) backtracking in inline link href regex (#4013) (a009808)
• Fix ordered lists after blockquotes (#4003) (33928d0)
• keep trailing text on HTML block close line for PI, declarations, and CDATA (#3991) (bbb84c8)

v18.0.5

18.0.5 (2026-06-04)

Bug Fixes

• parse empty list item with trailing space (#3984) (b55410f)

Commits

• 39bd884 chore(release): 18.0.6 [skip ci]
• 6bce57d chore(deps-dev): bump @​semantic-release/github from 12.0.8 to 12.0.9 (#4009)
• 63a4bba chore(deps-dev): bump markdown-it from 14.2.0 to 14.3.0 (#4010)
• a009808 fix: Avoid O(n^2) backtracking in inline link href regex (#4013)
• 33928d0 fix: Fix ordered lists after blockquotes (#4003)
• bbb84c8 fix: keep trailing text on HTML block close line for PI, declarations, and CD...
• d2af54e chore(deps-dev): bump eslint from 10.5.0 to 10.6.0 (#4005)
• f403898 chore(deps-dev): bump @​arethetypeswrong/cli from 0.18.3 to 0.18.4 (#4006)
• f8f4112 chore(deps): bump actions/checkout from 6 to 7 (#4000)
• 5ddfd8a chore: Update repository metadata URLs (#3998)
• Additional commits viewable in compare view

Updates @eslint/eslintrc from 3.3.5 to 3.3.6

Release notes

Sourced from @​eslint/eslintrc's releases.

eslintrc: v3.3.6

3.3.6 (2026-07-10)

Bug Fixes

• update js-yaml to 4.3.0 to address security vulnerability (#235) (0c5de74)

Changelog

Sourced from @​eslint/eslintrc's changelog.

3.3.6 (2026-07-10)

Bug Fixes

• update js-yaml to 4.3.0 to address security vulnerability (#235) (0c5de74)

Commits

• b433a22 chore: release 3.3.6 🚀 (#236)
• 0c5de74 fix: update js-yaml to 4.3.0 to address security vulnerability (#235)
• 94837a4 docs: Update README sponsors
• dbae1a1 docs: Update README sponsors
• 19fe72a docs: Update README sponsors
• 92ebd17 docs: Update README sponsors
• 3ba4c8c ci: add Node.js 26 to CI (#231)
• f8d268a docs: Update README sponsors
• 6e20867 docs: Update README sponsors
• 6d722b6 docs: Update README sponsors
• Additional commits viewable in compare view

Updates @hey-api/openapi-ts from 0.97.3 to 0.99.0

Changelog

Sourced from @​hey-api/openapi-ts's changelog.

0.99.0

Minor Changes

• BREAKING plugin: rename .symbols to .imports (#4052) (57fac5e) by @​mrlubos

To better represent its functionality, the plugin.symbols property has been renamed to plugin.imports.

• BREAKING config: merge duplicate plugin configurations (089ed2e) by @​mrlubos

Plugin duplicates behavior

If you specified the same plugin multiple times, only the last instance would be used. We eventually added a warning for this behavior, but that didn't treat the root issue. This release changes that by merging duplicate plugin configurations.

• BREAKING plugin(@​hey-api/schemas): widen schema type in nameBuilder to unknown (#4076) (98ce35e) by @​mrlubos

• BREAKING plugin: remove .external() method (#4052) (57fac5e) by @​mrlubos

Removed plugin.external() function

This function was used to reference external symbols. All plugins now use the Imports API, which allows you to reference external symbols in a type-safe way through plugin.imports.

Patch Changes

• api: replace ~ fields with $ (#4086) (d5ca286) by @​mrlubos

• config: add Presets API (3b4ee7a) by @​mrlubos

• plugin(@​hey-api/client-angular): fix: send an empty object request body when explicitly provided in flat parameters mode (#4070) (ab522ef) by @​matthewjamesadam

• client: use getBaseUrl() function to determine default value (#3772) (4026955) by @​mrlubos

• plugin(zod): improve discriminator handling (680b947) by @​mrlubos

• plugin(@​tanstack/preact-query): fix: strip initialData from the inferred result types for infinite query options (7a4b0cf) by @​mrlubos

• plugin(@​tanstack/solid-query): fix: strip initialData from the inferred result types for infinite query options (7a4b0cf) by @​mrlubos

• plugin(valibot): support custom regular expression error messages with x-pattern-message (#4117) (3ed3afb) by @​pullfrog

• plugin(@​hey-api/client-next): fix: send an empty object request body when explicitly provided in flat parameters mode (#4070) (f6d4512) by @​matthewjamesadam

• plugin(@​hey-api/client-axios): fix: send an empty object request body when explicitly provided in flat parameters mode (#4070) (f6d4512) by @​matthewjamesadam

• plugin(zod): support creating optional request schemas (11315c7) by @​mrlubos

• plugin(@​tanstack/react-query): fix: strip initialData from the inferred result types for infinite query options (7a4b0cf) by @​mrlubos

• plugin(@​hey-api/client-ky): fix: send an empty object request body when explicitly provided in flat parameters mode (#4070) (f6d4512) by @​matthewjamesadam

... (truncated)

Commits

• 8f3eb72 ci: release
• 3ed3afb docs: add changesets
• 66bc2b7 feat: support x-pattern-message extension in Zod and Valibot validator plugins
• 7b83c97 test: update snapshots
• 020df93 feat(faker): first implementation
• a3338ac test: update snapshots
• 307e020 test: update snapshots
• 835c230 chore: more cleanup
• 1490b05 test: update snapshots
• 9e6bdde chore: clean up
• Additional commits viewable in compare view

Updates @playwright/test from 1.60.0 to 1.61.1

Release notes

Sourced from @​playwright/test's releases.

v1.61.1

Bug Fixes

• #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

... (truncated)

Commits

• 39e3553 cherry-pick(#41399): fix(test): load require-reached files as commonjs in syn...
• 4328122 chore: mark v1.61.1 (#41404)
• 2c29a94 fix(tracing): stop recording websocket frames outside of chunks (#41398)
• 4324b19 cherry-pick(#41367): fix(test): keep builtin expect matchers on base extend
• 041e7e3 cherry-pick(#41364): fix(har): WebSocket message timestamps should be in mi...
• b8a0fc3 cherry-pick(#41309, #43149): Revert "fix(firefox): treat `navigationCommitted...
• b5a3175 cherry-pick(#41319): fix(loader): support other node versions
• d4724a9 cherry-pick(#41290): feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image
• 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
• a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
• Additional commits viewable in compare view