Bump the "all-dependencies" group with 2 updates across multiple ecosystems

[dependabot]

Bumps the all-dependencies group with 19 updates in the /cli directory:

Package	From	To
@faker-js/faker	8.3.1	10.5.0
@playwright/test	1.58.2	1.62.0
adm-zip	0.5.16	0.6.0
luxon	3.4.4	3.7.2
@types/luxon	3.3.5	3.7.2
prettier	3.1.0	3.9.6
shelljs	0.8.5	0.10.0
@types/shelljs	0.8.15	0.10.0
typescript	5.3.2	7.0.2
yaml	2.3.4	2.9.0
@types/adm-zip	0.5.7	0.5.8
@types/node	20.9.4	26.1.2
@typescript-eslint/eslint-plugin	6.12.0	8.65.0
@typescript-eslint/parser	6.12.0	8.65.0
dotenv	16.3.1	17.4.2
eslint-config-airbnb-typescript	17.1.0	18.0.0
eslint-config-prettier	9.0.0	10.1.8
eslint-plugin-import	2.29.0	2.32.0
eslint-plugin-playwright	0.18.0	2.11.0

Bumps the all-dependencies group with 31 updates in the /codeceptjs-e2e directory:

Package	From	To
@faker-js/faker	7.6.0	10.5.0
adm-zip	0.5.14	0.6.0
luxon	3.4.4	3.7.2
@types/luxon	3.4.2	3.7.2
playwright	1.45.0	1.62.0
prettier	3.3.1	3.9.6
shelljs	0.8.5	0.10.0
@types/shelljs	0.8.15	0.10.0
typescript	5.4.5	7.0.2
@types/node	18.8.3	26.1.2
@typescript-eslint/eslint-plugin	7.12.0	8.65.0
@typescript-eslint/parser	7.12.0	8.65.0
dotenv	16.4.5	17.4.2
eslint	8.57.0	10.8.0
eslint-config-prettier	9.1.0	10.1.8
eslint-plugin-import	2.29.1	2.32.0
eslint-plugin-playwright	1.6.2	2.11.0
axios	1.7.2	1.18.1
chai	5.1.1	6.2.2
codeceptjs	3.7.9	4.0.9
faker	5.5.3	6.6.6
@types/faker	6.6.9	6.6.11
form-data	4.0.5	4.0.6
glob	11.1.0	13.0.6
lodash	4.17.21	4.18.1
@types/lodash	4.17.5	4.17.24
mocha	10.4.0	11.7.6
mongodb	3.7.4	7.5.0
mysql2	3.10.0	3.23.2
pg	8.12.0	8.22.0
tar	7.5.20	7.5.22

Bumps the all-dependencies group with 21 updates in the /e2e_tests directory:

Package	From	To
@playwright/test	1.58.1	1.62.0
adm-zip	0.5.17	0.6.0
prettier	3.8.1	3.9.6
typescript	5.9.3	7.0.2
@types/node	24.10.11	26.1.2
@types/shelljs	0.8.17	0.10.0
dotenv	17.2.3	17.4.2
eslint	9.39.2	10.8.0
eslint-plugin-playwright	2.5.1	2.11.0
mongodb	7.1.0	7.5.0
@eslint-community/eslint-plugin-eslint-comments	4.6.0	4.7.2
@eslint/js	9.39.2	10.0.1
@stylistic/eslint-plugin	2.13.0	5.10.0
build-url-ts	6.2.0	6.3.0
eslint-plugin-perfectionist	5.5.0	5.10.0
eslint-plugin-prettier	5.5.5	5.5.6
eslint-plugin-unicorn	55.0.0	72.0.0
globals	16.5.0	17.8.0
jiti	2.6.1	2.7.0
lint-staged	16.2.7	17.2.0
typescript-eslint	8.54.0	8.65.0

Updates @faker-js/faker from 8.3.1 to 10.5.0

Release notes

Sourced from @​faker-js/faker's releases.

v10.5.0

What's Changed

• docs: fix contribution git commands by @​hiSandog in faker-js/faker#3770
• infra: trusted publishing via OIDC token by @​Shinigami92 in faker-js/faker#3743
• docs: add favicon by @​ST-DDT in faker-js/faker#2853
• chore(deps): update eslint (major) by @​renovate[bot] in faker-js/faker#3753
• infra: migrate to tsdown by @​Shinigami92 in faker-js/faker#3558
• chore(deps): update all non-major dependencies by @​renovate[bot] in faker-js/faker#3776
• chore(deps): update codecov/codecov-action action to v6 by @​renovate[bot] in faker-js/faker#3777
• chore(deps): update dependency typescript-eslint to v8.57.2 by @​renovate[bot] in faker-js/faker#3778
• chore(deps): update vitest by @​renovate[bot] in faker-js/faker#3779
• chore(deps): update dependency typescript-eslint to v8.58.0 by @​renovate[bot] in faker-js/faker#3780
• chore(deps): update devdependencies by @​renovate[bot] in faker-js/faker#3781
• docs: instructions to solve v10 compatibility issues with jest by @​pkuczynski in faker-js/faker#3616
• infra: update cypress config by @​Shinigami92 in faker-js/faker#3782
• fix(locale): changed farsi phone locales to correct ones by @​Javid-Izadfar in faker-js/faker#3775
• feat(location): add postal address generation by @​matthewmayer in faker-js/faker#3760
• feat(locale): add sl_SI locale, location module by @​ZigaVukcevicDev in faker-js/faker#3652
• fix(locale): phone numbers for en_AU by @​hiSandog in faker-js/faker#3788
• feat(phone): mobile style for phone.number by @​matthewmayer in faker-js/faker#3583
• fix(locale): typo in de_CH last name by @​rbuetzer in faker-js/faker#3799
• chore(deps): lock file maintenance by @​renovate[bot] in faker-js/faker#3774
• feat(locale): add Farsi airline module locale by @​Javid-Izadfar in faker-js/faker#3789
• feat(date): add ability to provide year range for past and future by @​xDivisionByZerox in faker-js/faker#3783
• feat(locale): add mn_MN_cyrl (Mongolian) locale by @​btseee in faker-js/faker#3796
• feat: introduce FakerCore by @​ST-DDT in faker-js/faker#2838
• docs: fix typo in internet.mac parameter by @​ST-DDT in faker-js/faker#3801
• chore: reformat person.bio by @​ST-DDT in faker-js/faker#3803
• fix(food): correct fruit and vegetable locale data by @​hiSandog in faker-js/faker#3800
• feat(locale): improved en_IE postal_address by @​matthewmayer in faker-js/faker#3797
• feat(locale): Add postal_address and improved secondary_address for es by @​matthewmayer in faker-js/faker#3798
• docs(image): remove deprecated urlLoremFlickr from module overview by @​hiSandog in faker-js/faker#3807
• fix: link release checklist in release PR workflow by @​hiSandog in faker-js/faker#3802
• chore(deps): lock file maintenance by @​renovate[bot] in faker-js/faker#3806
• chore(deps): update dependency sanitize-html to v2.17.3 [security] by @​renovate[bot] in faker-js/faker#3814
• feat(number): add distributor functions by @​ST-DDT in faker-js/faker#3375
• refactor(location): simplify locale access by @​ST-DDT in faker-js/faker#3809
• test(person): cleanup tests by @​ST-DDT in faker-js/faker#3804
• chore: import types from the source file directly by @​ST-DDT in faker-js/faker#3805
• docs(image): link to tracking issue by @​ST-DDT in faker-js/faker#3815
• docs: render multiple @​example blocks as tabbed code groups by @​Shinigami92 in faker-js/faker#3817
• feat(locale): Add more realistic Greek address data by @​matthewmayer in faker-js/faker#3792
• fix(finance): routingNumber now uses real FederalReserveRoutingSymbol from lookup table. by @​woldaker in faker-js/faker#3429
• feat(locale): add color to cy by @​IestynGage in faker-js/faker#3816
• fix(locale): remove citation brackets from snake names by @​AustralianRaven in faker-js/faker#3822
• fix(helpers): ignore wrapper characters in fromRegExp by @​ST-DDT in faker-js/faker#3795
• refactor(core): expose core.locale as LocaleProxy by @​ST-DDT in faker-js/faker#3820
• docs: fix typos in jsdocs by @​ST-DDT in faker-js/faker#3823
• feat(locale): add Welsh (cy) sex definitions by @​IestynGage in faker-js/faker#3824
• docs: change link in GitHub PR template by @​IestynGage in faker-js/faker#3826

... (truncated)

Changelog

Sourced from @​faker-js/faker's changelog.

10.5.0 (2026-06-17)

New Locales

• locale: add color to cy (#3816) (5a6379f)
• locale: add Farsi airline module locale (#3789) (f4a1c3e)
• locale: add mn_MN_cyrl (Mongolian) locale (#3796) (d17c0f1)
• locale: Add more realistic Greek address data (#3792) (6153eb7)
• locale: Add postal_address and improved secondary_address for es (#3798) (6c2a0ab)
• locale: add sl_SI locale, location module (#3652) (28d4f7c)
• locale: add Welsh (cy) animal type definitions (#3842) (50a5ec9)
• locale: add Welsh (cy) book format definitions (#3846) (#3846) (2b32d6e)
• locale: add Welsh (cy) building numbers definition (#3892) (4996a2b)
• locale: add Welsh (cy) city name definitions (#3884) (ac36c22)
• locale: add Welsh (cy) continents definitions (#3880) (03a1682)
• locale: add Welsh (cy) county definitions (#3849) (f51d28a)
• locale: add Welsh (cy) direction definitions (#3840) (d862071)
• locale: add Welsh (cy) internet domain suffix definitions (#3865) (#3865) (fb2e2cb)
• locale: add Welsh (cy) phone number definitions (#3878) (70994db)
• locale: add Welsh (cy) postal address definitions (#3850) (e72fd7c)
• locale: add Welsh (cy) postcode definitions (#3851) (1afbd59)
• locale: add Welsh (cy) sex definitions (#3824) (6f29eb7)
• locale: add Welsh (cy) state definitions (#3891) (#3891) (606d47c)
• locale: add Welsh (cy) street name definitions (#3889) (143789e)
• locale: add Welsh (cy) vehicle fuel definitions (#3845) (29c918a)
• locale: extend tr person last names (#3839) (f433771)
• locale: improved en_GB postcodes (#3864) (a4e5039)
• locale: improved en_IE postal_address (#3797) (fb3ffd3)

Features

• add first standalone module functions (#3818) (5d4f5de)
• date: add ability to provide date range for recent and soon (#3844) (0bc038d)
• date: add ability to provide year range for past and future (#3783) (237e7dc)
• food: expand plant-based dish and pattern variety (#3887) (5eaf729)
• introduce FakerCore (#2838) (68e15d7)
• location: add postal address generation (#3760) (753bec6)
• number: add distributor functions (#3375) (325e402)
• phone: mobile style for phone.number (#3583) (cd5953b)

Bug Fixes

• date: incorrect date boundary in past and future (#3827) (0446411)
• finance: routingNumber now uses real FederalReserveRoutingSymbol from lookup table. (#3429) (c53c1fe)
• food: correct fruit and vegetable locale data (#3800) (30a812a)
• handle single-character fromRegExp patterns (#3877) (ec6cc3b)
• helpers: ignore wrapper characters in fromRegExp (#3795) (9e2c0e3)

... (truncated)

Commits

• 5fb3b2d chore(release): 10.5.0 (#3898)
• f89348f chore(deps): lock file maintenance (#3861)
• e157511 chore(deps): pin dependencies (#3896)
• 77dbfae chore(deps): update prettier to v3.8.4 (#3893)
• 123193a chore(deps): update pnpm/action-setup action to v6 (#3894)
• 8244a24 chore(deps): update devdependencies (#3871)
• 68bc79a chore(deps): update eslint (major) (#3875)
• e43b21b chore(deps): update all non-major dependencies (#3870)
• b6aca31 chore(deps): update vitest (#3872)
• a7e8c4f chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24 docker...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​faker-js/faker since your current version.

Updates @playwright/test from 1.58.2 to 1.62.0

Release notes

Sourced from @​playwright/test's releases.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

</tr></table> 

... (truncated)

Commits

• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• 2934858 fix: correct pending navigation log spacing (#41949)
• 4b0cc99 fix(test): unflake screencast backpressure test on slow macOS runner (#41951)
• bbbae6d test: fixme WebSocket locale test in Chromium 150 (#41944)
• 15c4f55 fix(mcp): identify downloads explicitly (#41933)
• f5fa967 fix(network): request.postData() returns null for empty string body override ...
• 0edafe4 fix(mcp): launch the Chrome profile that has the extension installed (#41939)
• 244a1ff feat(firefox): roll to r1538 (#41938)
• Additional commits viewable in compare view

Updates adm-zip from 0.5.16 to 0.6.0

Release notes

Sourced from adm-zip's releases.

v0.6.0

Full Changelog: cthackers/adm-zip@v0.5.18...v0.6.0

This release fixes a security vulnerability (CVE-2026-39244), resolves several long-standing bugs, ships built-in TypeScript types, and includes two behavior changes worth reading before you upgrade.

• extractEntryTo(dirEntry, target, maintainEntryPath = false) now preserves subdirectories instead of flattening files into the target folder by basename (which also silently overwrote same-named files). (#306)
• Extraction no longer fails when the modification time can't be set — utimes is now best-effort. (#379)
• Minimum Node.js is now 14 (the code already required it; engines was incorrectly >=12).
• CVE-2026-39244 — a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc and OOM the process; allocation is now bounded by the data actually present. Reported by Daniel Púa (devploit), Anh Hong, and José Antonio Zamudio Amaya. (#568)
• Hardened entry-name lookup against object injection (proto names). Prototype-less table.
• Data-descriptor regression rejecting valid archives (#548, #533, #554)
• Directory permissions not restored on extract (#530)
• Infinite recursion on symlink loops in addLocalFolder (#541)
• Uncaught process crash in writeFileToAsync on write failure (#470, #459, #402)
• Empty name on directory entries (#466)
• test() always returned false for archives with files
• ~6× faster entry sorting for large archives
• Built-in TypeScript definitions (types.d.ts) — you can drop @​types/adm-zip

v0.5.18

What's Changed

• Bump js-yaml from 4.1.1 to 4.3.0 by @​dependabot[bot] in cthackers/adm-zip#566
• Fix corrupted zip when round-tripping entries with a data descriptor (#555) by @​JohnJunior in cthackers/adm-zip#564
• prevent crashes when process.versions is an empty object by @​matt-fidd in cthackers/adm-zip#551
• support for writing zip64 by @​mielverkerken in cthackers/adm-zip#562
• Fix Archive Utility failure on zips with empty directories (#558) by @​JohnJunior in cthackers/adm-zip#563

New Contributors

• @​JohnJunior made their first contribution in cthackers/adm-zip#564
• @​matt-fidd made their first contribution in cthackers/adm-zip#551
• @​mielverkerken made their first contribution in cthackers/adm-zip#562

Full Changelog: cthackers/adm-zip@v0.5.17...v0.5.18

v0.5.17

What's Changed

• entryHeader time setter more tolerant by @​thomasheritage in cthackers/adm-zip#540
• Add check for local desc flag in crc check by @​issacgerges in cthackers/adm-zip#543
• Create only if the directory does not exist by @​DennisHill in cthackers/adm-zip#557
• Fix issue with absolute paths by @​kwolfy in cthackers/adm-zip#559

New Contributors

• @​thomasheritage made their first contribution in cthackers/adm-zip#540
• @​issacgerges made their first contribution in cthackers/adm-zip#543
• @​DennisHill made their first contribution in cthackers/adm-zip#557
• @​kwolfy made their first contribution in cthackers/adm-zip#559

Full Changelog: cthackers/adm-zip@v0.5.16...v0.5.17

Changelog

Sourced from adm-zip's changelog.

0.6.0 / 2026-07-10

Security

• Fixed CVE-2026-39244: a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc (memory exhaustion / DoS) before any validation. Allocation is now bounded by the data actually present — STORED output is sized from the real bytes, DEFLATED output is grown by the inflater and capped at the declared size (#568)
• Hardened the internal entry-name lookup table against object injection: entry names come from untrusted archives, and a name such as __proto__ previously resolved to Object.prototype, crashing addFile and hiding the entry from getEntry/readFile. The table is now prototype-less

Bug fixes

• Fixed a regression (0.5.15) that rejected valid archives using a data descriptor (general-purpose bit 3). The payload is now validated against the authoritative central-directory CRC instead of requiring/parsing the trailing descriptor (#548, #533, #554)
• Fixed extractAllTo/extractAllToAsync not restoring directory permissions with keepOriginalPermission; directory modes are applied after their contents are written, deepest path first, and no longer lock the extractor out of a restrictive directory (#530)
• Fixed infinite recursion in addLocalFolder when a folder contains a symlink pointing back to an ancestor (e.g. workspace node_modules); the walk now tracks resolved real paths and skips already-visited directories (#541)
• Fixed an uncaught exception (ERR_INVALID_ARG_TYPE) that crashed the process when writeFileToAsync could not open the target file (bad permissions, invalid filename, exhausted file descriptors); write failures are now reported through the callback and write errors are no longer silently swallowed (#470, #459, #402)
• Fixed directory entries reporting an empty name (e.g. a/b/c/ now returns c) (#466)
• Fixed extractEntryTo flattening subdirectories when maintainEntryPath is false; the structure below the extracted directory is now preserved instead of collapsing (and overwriting) files by basename (#306)
• Fixed a failed utimes aborting extraction; setting the modification time is now best-effort and never fails extraction of already-written content (#379)
• Fixed test() always returning false for any archive containing a file (it indexed the entries array with an entry object instead of reading the entry); it now correctly verifies each entry's CRC

Performance

• Faster entry sorting when writing archives with many entries: names are decoded once instead of on every comparison (about 6× faster sort for large archives)

Added

• Bundled TypeScript type definitions (types.d.ts), so @types/adm-zip is no longer required

Notes

• Behavior change: extractEntryTo(dir, target, /* maintainEntryPath */ false) now preserves subdirectories beneath the extracted directory rather than flattening them
• Behavior change: extraction no longer fails when the modification time cannot be set

0.5.4 / 2021-03-08

• Fixed relative paths
• Added zipcrypto encryption
• Lower verMade for macOS when generating zip file

0.5.3 / 2021-02-07

• Fixed filemode when unzipping

0.5.2 / 2021-01-27

• Fixed path traversal issue (GHSL-2020-198)

0.5.1 / 2020-11-27

• Incremented version (cthackers)
• Fixed outFileName (cthackers)

0.5.0 / 2020-11-19

• Added extra parameter to extractEntryTo so target filename can be renamed (cthackers)

... (truncated)

Commits

• 2b4d840 updated minimum node engine version to >= 14
• dc57f0f Hardened entry-name lookup, fixed test(), and sped up entry sorting
• f81806a Made utimes best-effort so it can't abort extraction (#379)
• ab04324 Fixed extractEntryTo flattening subdirectories (#306)
• 8a5d9ba Fixed empty name for directory entries (#466)
• 3e72790 Fixed uncaught crash in writeFileToAsync on write failure (#470, #459, #402)
• 651ae4c Added typescript types
• e72021d Fixed infinite recursion on symlink loops in addLocalFolder (#541)
• 8f3176b Fixed directory permissions on linux
• 4d2c8f9 Fixed error introduced with zip descriptor checks
• Additional commits viewable in compare view

Updates luxon from 3.4.4 to 3.7.2

Changelog

Sourced from luxon's changelog.

3.7.2 (2025-07-09)

• Fix ES6 packaging

3.7.1 (2025-07-09)

• Revert change in ES6 packaging

3.7.0 (2025-07-09)

• Added showZeros option to Duration#toHuman
• Added Duration#removeZeros method.
• Added rounding option to DateTime#toRelative
• Added precision option to ISO formatting methods
• Added signMode option to Duration#toFormat
• Allow escaping single quotes in format strings
• Improve output of Info.months and Info.monthsFormat for ja locale
• Accept lowercase t as a separator in ISO strings
• Accept lowercase z as an offset in ISO strings
• Reject non-finite numbers where previously only NaN was rejected
• Improve the documentation for Interval
• Added a dark theme for the documentation site

3.6.1 (2025-03-31)

• Add Fallback for minimalDays being removed from Intl.WeekInfo
• Fix various caches when JS keywords like "constructor" are used for names

3.6.0 (2025-03-25)

• Add Interval.lastDateTime
• Fix a bug that could cause wrong timezone calculations when multiple timezones are in use

3.5.0 (2024-08-03)

• Various performance improvements
• throwOnInvalid causes the constructor to throw if the year is invalid

Commits

• 4262a38 Version 3.7.2
• 738144d Fix the build ES6 code having the wrong file extension and use it in package....
• 3b2f374 Release version 3.7.1
• c67ee7d Revert "build: use the es6 build for ESM exports (#1707)"
• cfa58a2 Release version 3.7.0
• 7d379cc Fix unsupported signDisplay value
• 4e81ef9 Implement "signMode" on Duration#toFormat
• 5aa55da Improve documentation regarding Interval's half-openness
• b188e10 add dark theme to docs (#1713)
• cf67025 build: use the es6 build for ESM exports (#1707)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by diesieben07, a new releaser for luxon since your current version.

Updates @types/luxon from 3.3.5 to 3.7.2

Commits

• See full diff in compare view

Updates playwright from 1.58.2 to 1.62.0

Release notes

Sourced from playwright's releases.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

</tr></table> 

... (truncated)

Commits

• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• 2934858 fix: correct pending navigation log spacing (#41949)
• 4b0cc99 fix(test): unflake screencast backpressure test on slow macOS runner (#41951)
• bbbae6d test: fixme WebSocket locale test in Chromium 150 (#41944)
• 15c4f55 fix(mcp): identify downloads explicitly (#41933)
• f5fa967 fix(network): request.postData() returns null for empty string body override ...
• 0edafe4 fix(mcp): launch the Chrome profile that has the extension installed (#41939)
• 244a1ff feat(firefox): roll to r1538 (#41938)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for playwright since your current version.

Updates playwright-core from 1.58.2 to 1.62.0

Release notes

Sourced from playwright-core's releases.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and setuptools, ansible-runner and requests to permit the latest version.
Updates setuptools to 83.0.0

Changelog

Sourced from setuptools's changelog.

v83.0.0

Features

• Require Python 3.10 or later.

Bugfixes

• MANIFEST.in matching (via FileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude, global-exclude, recursive-exclude, or prune rule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

• pypa/distutils#334

v82.0.1

Bugfixes

• Fix the loading of launcher manifest.xml file. (#5047)
• Replaced deprecated json.__version__ with fixture in tests. (#5186)

Improved Documentation

• Add advice about how to improve predictability when installing sdists. (#5168)

Misc

• #4941, #5157, #5169, #5175

v82.0.0

... (truncated)

Commits

• 6519f72 Bump version: 82.0.1 → 83.0.0
• d1151b1 Merge pull request #5250 from pypa/feature/distutils-d7633fbed
• a2df31e Capture removal of dry_run parameter in changelog.
• 00144dc Moved newsfragment to the release where it occurred.
• a4a5a2b Add news fragment.
• 77470c2 Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed
• 3c43897 Merge pull request #5247 from pypa/copilot/fix-pypy-version-issue
• bb6ea66 Bump PyPy from 3.10 to 3.11 in CI workflow
• a2bc3ac Fix broken intersphinx reference to build's installation docs
• 2d6a739 Use stacked parametrize decorators instead of itertools.product
• Additional commits viewable in compare view

Updates ansible-runner from 2.3.2 to 2.4.3

Release notes

Sourced from ansible-runner's releases.

2.4.3

What's Changed

• Use get_option api from callback plugins (ansible/ansible-runner#1488). This fixes some problems around using custom callback plugins.
• Fix container --tty detection in subprocess mode (ansible/ansible-runner#1489)

Full Changelog: ansible/ansible-runner@2.4.2...2.4.3

2.4.2

What's Changed

• Short circuit display wrapper of the callback plugin within forks (ansible/ansible-runner#1414)
• Improve EOF log messages when streaming (ansible/ansible-runner#1458)

Full Changelog: ansible/ansible-runner@2.4.1...2.4.2

2.4.1

What's Changed

• Modify volume mount behavior when source does not exist (#1408). Volumes specified using the container-volume-mount option will now be passed through to the underlying container engine unverified and unmodified. This now allows you to mount individual files (vs. the parent directory) and non-existing source volumes. The behavior encountered with a non-existing source volume depends on which container engine is in use (docker creates the volume, podman will error).

Bug Fixes

• Various documentation updates.

Full Changelog: ansible/ansible-runner@2.4.0...2.4.1

2.4.0

What's Changed

• Bump minimum supported Python to 3.9

Bug Fixes

• Honor inventory filepath by @​Akasurde in ansible/ansible-runner#1065
• Ensure that UTC ISO8601 datetimes include timezone info by @​sivel in ansible/ansible-runner#1238
• Fix for non-str ident by @​Shrews in ansible/ansible-runner#1268
• Pass inventory directory path instead of file path when using containerization by @​christophert in ansible/ansible-runner#1304
• Validate inventory from CLI early by @​Shrews in ansible/ansible-runner#1307
• Allow shutil to copy into existing isolation directory by @​christophert in ansible/ansible-runner#1311
• Fix invalid inventory with relative pvt data dir by @​Shrews in ansible/ansible-runner#1316
• Add lib symlink to bwrap call by @​christophert in ansible/ansible-runner#1312

2.3.8

What's Changed

• Short circuit display wrapper in forks (#1414)

Full Changelog: ansible/ansible-runner@2.3.7...2.3.8

2.3.7

What's Changed

... (truncated)

Commits

• dafa5b5 📦 Fix setuptools-scm warnings on git archival (#1492) (#1493)
• 27d5fa6 Fix container --tty detection in subprocess mode (#1306) (#1489)
• 92d751d Use get_option api from callback plugins (#1142) (#1488)
• f9b33f3 Fix GH issue templates (#1430) (#1487)
• 5e9f56b Fix test_invalid_registry_host() integration test (#1485) (#1486)
• a098dcc Clarify automount of SSH dir in docs (#1462) (#1463)
• aa1d850 Improve EOF log messages when streaming (#1454) (#1458)
• 23d1720 Fix container build cache issue (#1449) (#1450)
• 342cfc5 Remove wheel building from CI (#1443) (#1445)
• 3dde1ff Change keepalive test boundary to 15
• Additional commits viewable in compare view

Updates requests from 2.26.0 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

• @​k223kim made their first contribution in psf/requests#7433

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
• Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

• 6e83187 v2.34.2
• 84d10f0 Move Request.headers back to Mapping (#7441)
• b7b549b v2.34.1
• e511bc7 Fix mutability issues with headers input types (#7431)
• 5691f59 Update JsonType containers to read-based collections (#7436)
• 2144213 Constrain Response.reason to str (#7437)
• 6404f34 Fix prepare_body stream detection for __getattr__-based file wrappers (#7...
• 0b401c7 v2.34.0
• 86b378d Align Session.get parameters with requests.get (#7429)
• a4f9a59 Port bpo-39057 to Requests (#7427)
• Additional commits viewable in compare view