[dependabot]

Bumps msw from 2.15.0 to 3.0.3.

Release notes

Sourced from msw's releases.

v3.0.3 (2026-10-10)

Bug Fixes

• HandlersController: dispose of reset handlers (#2810) (3818a81c455a638eda1558558d8ae3cd17a34e55) @​kettanaito
• expose network context on enable in network sources (#2809) (d1fe8e6e6e7eefce43746ee44802bc553731e951) @​kettanaito

v3.0.2 (2026-10-03)

Bug Fixes

• vite: support virtual:msw imports in vitest (#2802) (e73c381e3adc0848fcf9a7ef291b614b06a0d92b) @​kettanaito

v3.0.1 (2026-09-30)

Bug Fixes

• treat CONNECT requests as the transport mechanism (#2796) (7cad86a03b0ddb2efdec96ce8a49b0ed07d9f4dc) @​kettanaito

v3.0.0 (2026-09-28)

• v3.0.0 (#2692) (2bb43428b79ac06f94bb8ea8aeacd6102fe31f56) @​kettanaito @​Andarist

⚠️ BREAKING CHANGES

• MSW is now ESM-only (#2765).
• Deprecate support for Node.js v18 and v20 (#2729). The minimal supported Node.js version is v22.
• msw/native is removed in favor of @msw/react-native.
• Require TypeScript 5.9 as the minimal version.
• Deprecate support for TypeScript 5.1 and 5.2 (#2730)
• worker.stop() returns a Promise (#2724). Awaiting it is relevant only for in-flight critical scenarios.
• graphql is now exported as msw/graphql (#2691). GraphQL is now handled as a proper optional peer dependency.
• Removes the handleRequest() utility. Please use the defineNetwork() API instead.
• GraphQLLinkHandlers type has been renamed to GraphQLLink.
• The file:// requests now throw in Node.js as they normally do (not supported by fetch).
• The Content-Length request header is now removed by bypass().
• HTTP-to-WebSocket upgrade requests performed via fetch() now throw in Node.js as they normally do (not supported by fetch).
• Cookies are no longer managed in Node.js for better compatibility. Instead, whatever is the default behavior of your environment that's the cookie behavior you get. This has no effect on the browser.
• WebSocket connection life cycle event has been renamed to websocket:connection (#2783).
• onUnhandledRequest option has been renamed to onUnhandledFrame.
• The library no longer patches setTimeout to circumvent fake timers in test runners. You should advance the fake timers normally for delayed mocked responses to resolve.
• The library no longer returns a mocked cookie string on request.headers.get('cookie') in the handlers. It returns null in all environments. Please use the cookies resolver argument to have cookie-based logic.

Features

• Supports Node.js v24 and v26.
• Supports TypeScript v6.0 and v7.0.
• You can import individual utilities, like delay or passthrough, from the new msw/utils entrypoint for smaller footprint on your bundle.
• Support GraphQL v17.0.
• Support intercepting page navigations and form submissions (#2721).

... (truncated)

Commits

• 3560a94 chore(release): v3.0.3
• 3818a81 fix(HandlersController): dispose of reset handlers (#2810)
• d1fe8e6 fix: expose network context on enable in network sources (#2809)
• 22a4626 test(node): add jsdom cors/preflight regression tests (#2808)
• a32ee31 docs: add beehiiv to partners (#2805)
• 501a591 chore: update github social image
• a7fa5f0 chore(release): v3.0.2
• 01b1084 docs: feature "msw/http" imports in README examples
• e73c381 fix(vite): support virtual:msw imports in vitest (#2802)
• 6d6aef1 chore(release): v3.0.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Sev7eNup]

Not merging this one. msw 3 needs vitest 5, because every @vitest/mocker 4.x declares msw ^2.4.9 (that is why npm ci fails here). A local try with vitest 5.1 and msw 3.0.3 also showed timing failures in WorkflowEditorPage that do not occur on msw 2. #802 holds msw 3 in dependabot.yml until the vitest family moves.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.