[dependabot]

Bumps the routine group with 6 updates:

Package	From	To
next	16.3.8	16.4.3
@playwright/test	1.63.0	1.64.1
@types/node	26.6.3	26.6.6
postcss	8.5.31	8.5.32
prettier	3.9.9	3.9.10
vitest	5.0.1	5.0.5

Updates next from 16.3.8 to 16.4.3

Release notes

Sourced from next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
• [lts-active] test: Pin react-virtualized (#100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
• [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

v16.4.2

What's Changed

• [lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @​lukesandberg in vercel/next.js#100002
• [lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @​sokra in vercel/next.js#100008
• [lts-active] fix(next-code-frame): snap visible window to char boundaries by @​lukesandberg in vercel/next.js#100212
• [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @​lukesandberg in vercel/next.js#100209
• [lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @​lukesandberg in vercel/next.js#100217
• [lts-active] Backport docs fixes since v16.4.0 by @​icyJoseph in vercel/next.js#100246
• [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @​lukesandberg in vercel/next.js#100211
• [lts-active] Backport additional documentation fixes since v16.4.0 by @​aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #75682
• fix(scripts): correct typo in rm.mjs error message: #87015

... (truncated)

Commits

• 29bbeab v16.4.3
• 5117201 [lts-active] Avoid loading standalone React in server bootstrap (#100610)
• 37d603b [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #1...
• cf9d27d [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (...
• 3f6a632 [lts-active] test: Pin react-virtualized (#100545)
• f715bba [lts-active][cd] Gate release bot credentials behind GitHub environments (#10...
• c864c78 [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
• f3ff943 [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
• f697cf5 [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
• 2864b17 v16.4.2
• Additional commits viewable in compare view

Updates @playwright/test from 1.63.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• Additional commits viewable in compare view

Updates @types/node from 26.6.3 to 26.6.6

Commits

• See full diff in compare view

Updates postcss from 8.5.31 to 8.5.32

Release notes

Sourced from postcss's releases.

8.5.32

• Fixed Input#origin() without opts.from (by @​wleeaf).
• Fixed final-word lookup without source offsets (by @​Don-Yin).
• Fixed explicit start in Warning#toString() (by @​Don-Yin).
• Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

Changelog

Sourced from postcss's changelog.

8.5.32

• Fixed Input#origin() without opts.from (by @​wleeaf).
• Fixed final-word lookup without source offsets (by @​Don-Yin).
• Fixed explicit start in Warning#toString() (by @​Don-Yin).
• Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

Commits

• 2455ac8 Release 8.5.32 version
• e367106 Update dependencies
• f70f586 Fix Input#origin() without from or with relative sourceRoot (#2179)
• eb28619 Fix final-word lookup without source offsets (#2178)
• 095654b Preserve explicit start in Warning#toString() (#2177)
• 9b3d8b8 Preserve Promise semantics in result finally() (#2176)
• See full diff in compare view

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits

• 1172b82 Release 3.9.10
• d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
• 953b908 Bump Prettier dependency to 3.9.9
• ad8a6bf Clean changelog_unreleased
• See full diff in compare view

Updates vitest from 5.0.1 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in vitest-dev/vitest#11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in vitest-dev/vitest#11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in vitest-dev/vitest#11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in vitest-dev/vitest#11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in vitest-dev/vitest#11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in vitest-dev/vitest#11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in vitest-dev/vitest#11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in vitest-dev/vitest#11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in vitest-dev/vitest#11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in vitest-dev/vitest#11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in vitest-dev/vitest#11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in vitest-dev/vitest#11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in vitest-dev/vitest#11596 (8dd67)
• reporter:
  • End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39); on worker crash  -  by @​AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

v5.0.4

   🚀 Features

• experimental:
  • Tag cache directories with CACHEDIR.TAG  -  by @​lifeiscontent in vitest-dev/vitest#11461 (a8ea3)
  • Support test.ui.theme option  -  by @​sheremet-va in vitest-dev/vitest#11499 (1da66)
  • Highlight selector multiple matches in trace view  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)
  • Print how many tests were affected and a total when running --changed  -  by @​sheremet-va in vitest-dev/vitest#11424 (a2336)
  • Add an option to cache dependencies instead of statically parsing them  -  by @​sheremet-va in vitest-dev/vitest#11515 (c0601)
  • Add fit and zoom controls to trace viewer  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

   🐞 Bug Fixes

• Fail the run on git and location filter errors  -  by @​sheremet-va in vitest-dev/vitest#11430 (30d03)
• Enable fsModuleCache by default  -  by @​sheremet-va in vitest-dev/vitest#11435 (ad208)
• Track project files and mocks with --changed  -  by @​sheremet-va in vitest-dev/vitest#11432 (b0f2b)
• Refactor caching, fix : in project and change the shape of results cache  -  by @​sheremet-va in vitest-dev/vitest#11453 (9673c)
• Keep full $ string values when taskTitleValueFormatTruncate is 0  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)
• Resolve node builtins in client environments  -  by @​sheremet-va in vitest-dev/vitest#11417 (56b31)
• Fix module graph builtin externals after #11421  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)
• Wrap module mocks during in-source testing  -  by @​sheremet-va in vitest-dev/vitest#11505 (36d19)
• Handle line endings in snapshot  -  by @​sheremet-va in vitest-dev/vitest#11522 (4c468)
• Respect root in projects  -  by @​sheremet-va in vitest-dev/vitest#11521 (26642)
• Resolve mocks in directories with spaces  -  by @​sheremet-va in vitest-dev/vitest#11539 (caaef)
• api:
  • Publish the api token atomically  -  by @​umairnawaz333 in vitest-dev/vitest#11323 (6f990)
• browser:

... (truncated)

Commits

• 7a825db chore: release v5.0.5 (#11609)
• 6621a72 fix: abort all running tests on cancel (#11606)
• e9c3d72 fix: release mocks of finished test files (#11607)
• 8dd67c2 fix(browser): run global setup once with instances (#11596)
• 6c5a447 fix: run hook cleanups when a later hook fails (#11605)
• 9697b38 fix: keep the import frame in native loader errors (#11599)
• 6498b66 fix(browser): wait 30s for the browser to close (#11601)
• f161e6d fix(browser): drop late connections of closed sessions (#11600)
• fe86a64 fix: skip builtin loading in async leak detector (#11598)
• 6ae8e89 fix(reporter): end reason 'failed' on worker crash (#11568)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cloudflare-workers-and-pages]

Deploying palestine-pfp-maker with    Cloudflare Pages

Latest commit:	5b06908
Status:	✅  Deploy successful!
Preview URL:	https://885971af.palestine-pfp-maker.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-rout-fhnc.palestine-pfp-maker.pages.dev

View logs

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.