Bump the "all-dependencies" group with 2 updates across multiple ecosystems

[dependabot]

Bumps the all-dependencies group with 19 updates in the /cli directory:

Package	From	To
@faker-js/faker	8.3.1	10.5.0
@playwright/test	1.58.2	1.61.1
adm-zip	0.5.16	0.6.0
luxon	3.4.4	3.7.2
@types/luxon	3.3.5	3.7.2
prettier	3.1.0	3.9.6
shelljs	0.8.5	0.10.0
@types/shelljs	0.8.15	0.10.0
typescript	5.3.2	7.0.2
yaml	2.3.4	2.9.0
@types/adm-zip	0.5.7	0.5.8
@types/node	20.9.4	26.1.1
@typescript-eslint/eslint-plugin	6.12.0	8.65.0
@typescript-eslint/parser	6.12.0	8.65.0
dotenv	16.3.1	17.4.2
eslint-config-airbnb-typescript	17.1.0	18.0.0
eslint-config-prettier	9.0.0	10.1.8
eslint-plugin-import	2.29.0	2.32.0
eslint-plugin-playwright	0.18.0	2.10.5

Bumps the all-dependencies group with 30 updates in the /codeceptjs-e2e directory:

Package	From	To
@faker-js/faker	7.6.0	10.5.0
adm-zip	0.5.14	0.6.0
luxon	3.4.4	3.7.2
@types/luxon	3.4.2	3.7.2
playwright	1.45.0	1.61.1
prettier	3.3.1	3.9.6
shelljs	0.8.5	0.10.0
@types/shelljs	0.8.15	0.10.0
typescript	5.4.5	7.0.2
@types/node	18.8.3	26.1.1
@typescript-eslint/eslint-plugin	7.12.0	8.65.0
@typescript-eslint/parser	7.12.0	8.65.0
dotenv	16.4.5	17.4.2
eslint	8.57.0	10.7.0
eslint-config-prettier	9.1.0	10.1.8
eslint-plugin-import	2.29.1	2.32.0
eslint-plugin-playwright	1.6.2	2.10.5
axios	1.7.2	1.18.1
chai	5.1.1	6.2.2
codeceptjs	3.7.9	4.0.9
faker	5.5.3	6.6.6
@types/faker	6.6.9	6.6.11
form-data	4.0.5	4.0.6
glob	11.1.0	13.0.6
lodash	4.17.21	4.18.1
@types/lodash	4.17.5	4.17.24
mocha	10.4.0	11.7.6
mongodb	3.7.4	7.5.0
mysql2	3.10.0	3.23.1
pg	8.12.0	8.22.0

Bumps the all-dependencies group with 21 updates in the /e2e_tests directory:

Package	From	To
@playwright/test	1.58.1	1.61.1
adm-zip	0.5.17	0.6.0
prettier	3.8.1	3.9.6
typescript	5.9.3	7.0.2
@types/node	24.10.11	26.1.1
@types/shelljs	0.8.17	0.10.0
dotenv	17.2.3	17.4.2
eslint	9.39.2	10.7.0
eslint-plugin-playwright	2.5.1	2.10.5
mongodb	7.1.0	7.5.0
@eslint-community/eslint-plugin-eslint-comments	4.6.0	4.7.2
@eslint/js	9.39.2	10.0.1
@stylistic/eslint-plugin	2.13.0	5.10.0
build-url-ts	6.2.0	6.3.0
eslint-plugin-perfectionist	5.5.0	5.10.0
eslint-plugin-prettier	5.5.5	5.5.6
eslint-plugin-unicorn	55.0.0	72.0.0
globals	16.5.0	17.7.0
jiti	2.6.1	2.7.0
lint-staged	16.2.7	17.1.0
typescript-eslint	8.54.0	8.65.0

Updates @faker-js/faker from 8.3.1 to 10.5.0

Release notes

Sourced from @​faker-js/faker's releases.

v10.5.0

What's Changed

• docs: fix contribution git commands by @​hiSandog in faker-js/faker#3770
• infra: trusted publishing via OIDC token by @​Shinigami92 in faker-js/faker#3743
• docs: add favicon by @​ST-DDT in faker-js/faker#2853
• chore(deps): update eslint (major) by @​renovate[bot] in faker-js/faker#3753
• infra: migrate to tsdown by @​Shinigami92 in faker-js/faker#3558
• chore(deps): update all non-major dependencies by @​renovate[bot] in faker-js/faker#3776
• chore(deps): update codecov/codecov-action action to v6 by @​renovate[bot] in faker-js/faker#3777
• chore(deps): update dependency typescript-eslint to v8.57.2 by @​renovate[bot] in faker-js/faker#3778
• chore(deps): update vitest by @​renovate[bot] in faker-js/faker#3779
• chore(deps): update dependency typescript-eslint to v8.58.0 by @​renovate[bot] in faker-js/faker#3780
• chore(deps): update devdependencies by @​renovate[bot] in faker-js/faker#3781
• docs: instructions to solve v10 compatibility issues with jest by @​pkuczynski in faker-js/faker#3616
• infra: update cypress config by @​Shinigami92 in faker-js/faker#3782
• fix(locale): changed farsi phone locales to correct ones by @​Javid-Izadfar in faker-js/faker#3775
• feat(location): add postal address generation by @​matthewmayer in faker-js/faker#3760
• feat(locale): add sl_SI locale, location module by @​ZigaVukcevicDev in faker-js/faker#3652
• fix(locale): phone numbers for en_AU by @​hiSandog in faker-js/faker#3788
• feat(phone): mobile style for phone.number by @​matthewmayer in faker-js/faker#3583
• fix(locale): typo in de_CH last name by @​rbuetzer in faker-js/faker#3799
• chore(deps): lock file maintenance by @​renovate[bot] in faker-js/faker#3774
• feat(locale): add Farsi airline module locale by @​Javid-Izadfar in faker-js/faker#3789
• feat(date): add ability to provide year range for past and future by @​xDivisionByZerox in faker-js/faker#3783
• feat(locale): add mn_MN_cyrl (Mongolian) locale by @​btseee in faker-js/faker#3796
• feat: introduce FakerCore by @​ST-DDT in faker-js/faker#2838
• docs: fix typo in internet.mac parameter by @​ST-DDT in faker-js/faker#3801
• chore: reformat person.bio by @​ST-DDT in faker-js/faker#3803
• fix(food): correct fruit and vegetable locale data by @​hiSandog in faker-js/faker#3800
• feat(locale): improved en_IE postal_address by @​matthewmayer in faker-js/faker#3797
• feat(locale): Add postal_address and improved secondary_address for es by @​matthewmayer in faker-js/faker#3798
• docs(image): remove deprecated urlLoremFlickr from module overview by @​hiSandog in faker-js/faker#3807
• fix: link release checklist in release PR workflow by @​hiSandog in faker-js/faker#3802
• chore(deps): lock file maintenance by @​renovate[bot] in faker-js/faker#3806
• chore(deps): update dependency sanitize-html to v2.17.3 [security] by @​renovate[bot] in faker-js/faker#3814
• feat(number): add distributor functions by @​ST-DDT in faker-js/faker#3375
• refactor(location): simplify locale access by @​ST-DDT in faker-js/faker#3809
• test(person): cleanup tests by @​ST-DDT in faker-js/faker#3804
• chore: import types from the source file directly by @​ST-DDT in faker-js/faker#3805
• docs(image): link to tracking issue by @​ST-DDT in faker-js/faker#3815
• docs: render multiple @​example blocks as tabbed code groups by @​Shinigami92 in faker-js/faker#3817
• feat(locale): Add more realistic Greek address data by @​matthewmayer in faker-js/faker#3792
• fix(finance): routingNumber now uses real FederalReserveRoutingSymbol from lookup table. by @​woldaker in faker-js/faker#3429
• feat(locale): add color to cy by @​IestynGage in faker-js/faker#3816
• fix(locale): remove citation brackets from snake names by @​AustralianRaven in faker-js/faker#3822
• fix(helpers): ignore wrapper characters in fromRegExp by @​ST-DDT in faker-js/faker#3795
• refactor(core): expose core.locale as LocaleProxy by @​ST-DDT in faker-js/faker#3820
• docs: fix typos in jsdocs by @​ST-DDT in faker-js/faker#3823
• feat(locale): add Welsh (cy) sex definitions by @​IestynGage in faker-js/faker#3824
• docs: change link in GitHub PR template by @​IestynGage in faker-js/faker#3826

... (truncated)

Changelog

Sourced from @​faker-js/faker's changelog.

10.5.0 (2026-06-17)

New Locales

• locale: add color to cy (#3816) (5a6379f)
• locale: add Farsi airline module locale (#3789) (f4a1c3e)
• locale: add mn_MN_cyrl (Mongolian) locale (#3796) (d17c0f1)
• locale: Add more realistic Greek address data (#3792) (6153eb7)
• locale: Add postal_address and improved secondary_address for es (#3798) (6c2a0ab)
• locale: add sl_SI locale, location module (#3652) (28d4f7c)
• locale: add Welsh (cy) animal type definitions (#3842) (50a5ec9)
• locale: add Welsh (cy) book format definitions (#3846) (#3846) (2b32d6e)
• locale: add Welsh (cy) building numbers definition (#3892) (4996a2b)
• locale: add Welsh (cy) city name definitions (#3884) (ac36c22)
• locale: add Welsh (cy) continents definitions (#3880) (03a1682)
• locale: add Welsh (cy) county definitions (#3849) (f51d28a)
• locale: add Welsh (cy) direction definitions (#3840) (d862071)
• locale: add Welsh (cy) internet domain suffix definitions (#3865) (#3865) (fb2e2cb)
• locale: add Welsh (cy) phone number definitions (#3878) (70994db)
• locale: add Welsh (cy) postal address definitions (#3850) (e72fd7c)
• locale: add Welsh (cy) postcode definitions (#3851) (1afbd59)
• locale: add Welsh (cy) sex definitions (#3824) (6f29eb7)
• locale: add Welsh (cy) state definitions (#3891) (#3891) (606d47c)
• locale: add Welsh (cy) street name definitions (#3889) (143789e)
• locale: add Welsh (cy) vehicle fuel definitions (#3845) (29c918a)
• locale: extend tr person last names (#3839) (f433771)
• locale: improved en_GB postcodes (#3864) (a4e5039)
• locale: improved en_IE postal_address (#3797) (fb3ffd3)

Features

• add first standalone module functions (#3818) (5d4f5de)
• date: add ability to provide date range for recent and soon (#3844) (0bc038d)
• date: add ability to provide year range for past and future (#3783) (237e7dc)
• food: expand plant-based dish and pattern variety (#3887) (5eaf729)
• introduce FakerCore (#2838) (68e15d7)
• location: add postal address generation (#3760) (753bec6)
• number: add distributor functions (#3375) (325e402)
• phone: mobile style for phone.number (#3583) (cd5953b)

Bug Fixes

• date: incorrect date boundary in past and future (#3827) (0446411)
• finance: routingNumber now uses real FederalReserveRoutingSymbol from lookup table. (#3429) (c53c1fe)
• food: correct fruit and vegetable locale data (#3800) (30a812a)
• handle single-character fromRegExp patterns (#3877) (ec6cc3b)
• helpers: ignore wrapper characters in fromRegExp (#3795) (9e2c0e3)

... (truncated)

Commits

• 5fb3b2d chore(release): 10.5.0 (#3898)
• f89348f chore(deps): lock file maintenance (#3861)
• e157511 chore(deps): pin dependencies (#3896)
• 77dbfae chore(deps): update prettier to v3.8.4 (#3893)
• 123193a chore(deps): update pnpm/action-setup action to v6 (#3894)
• 8244a24 chore(deps): update devdependencies (#3871)
• 68bc79a chore(deps): update eslint (major) (#3875)
• e43b21b chore(deps): update all non-major dependencies (#3870)
• b6aca31 chore(deps): update vitest (#3872)
• a7e8c4f chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24 docker...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​faker-js/faker since your current version.

Updates @playwright/test from 1.58.2 to 1.61.1

Release notes

Sourced from @​playwright/test's releases.

v1.61.1

Bug Fixes

• #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

... (truncated)

Commits

• 39e3553 cherry-pick(#41399): fix(test): load require-reached files as commonjs in syn...
• 4328122 chore: mark v1.61.1 (#41404)
• 2c29a94 fix(tracing): stop recording websocket frames outside of chunks (#41398)
• 4324b19 cherry-pick(#41367): fix(test): keep builtin expect matchers on base extend
• 041e7e3 cherry-pick(#41364): fix(har): WebSocket message timestamps should be in mi...
• b8a0fc3 cherry-pick(#41309, #43149): Revert "fix(firefox): treat `navigationCommitted...
• b5a3175 cherry-pick(#41319): fix(loader): support other node versions
• d4724a9 cherry-pick(#41290): feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image
• 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
• a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
• Additional commits viewable in compare view

Updates adm-zip from 0.5.16 to 0.6.0

Release notes

Sourced from adm-zip's releases.

v0.6.0

Full Changelog: cthackers/adm-zip@v0.5.18...v0.6.0

This release fixes a security vulnerability (CVE-2026-39244), resolves several long-standing bugs, ships built-in TypeScript types, and includes two behavior changes worth reading before you upgrade.

• extractEntryTo(dirEntry, target, maintainEntryPath = false) now preserves subdirectories instead of flattening files into the target folder by basename (which also silently overwrote same-named files). (#306)
• Extraction no longer fails when the modification time can't be set — utimes is now best-effort. (#379)
• Minimum Node.js is now 14 (the code already required it; engines was incorrectly >=12).
• CVE-2026-39244 — a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc and OOM the process; allocation is now bounded by the data actually present. Reported by Daniel Púa (devploit), Anh Hong, and José Antonio Zamudio Amaya. (#568)
• Hardened entry-name lookup against object injection (proto names). Prototype-less table.
• Data-descriptor regression rejecting valid archives (#548, #533, #554)
• Directory permissions not restored on extract (#530)
• Infinite recursion on symlink loops in addLocalFolder (#541)
• Uncaught process crash in writeFileToAsync on write failure (#470, #459, #402)
• Empty name on directory entries (#466)
• test() always returned false for archives with files
• ~6× faster entry sorting for large archives
• Built-in TypeScript definitions (types.d.ts) — you can drop @​types/adm-zip

v0.5.18

What's Changed

• Bump js-yaml from 4.1.1 to 4.3.0 by @​dependabot[bot] in cthackers/adm-zip#566
• Fix corrupted zip when round-tripping entries with a data descriptor (#555) by @​JohnJunior in cthackers/adm-zip#564
• prevent crashes when process.versions is an empty object by @​matt-fidd in cthackers/adm-zip#551
• support for writing zip64 by @​mielverkerken in cthackers/adm-zip#562
• Fix Archive Utility failure on zips with empty directories (#558) by @​JohnJunior in cthackers/adm-zip#563

New Contributors

• @​JohnJunior made their first contribution in cthackers/adm-zip#564
• @​matt-fidd made their first contribution in cthackers/adm-zip#551
• @​mielverkerken made their first contribution in cthackers/adm-zip#562

Full Changelog: cthackers/adm-zip@v0.5.17...v0.5.18

v0.5.17

What's Changed

• entryHeader time setter more tolerant by @​thomasheritage in cthackers/adm-zip#540
• Add check for local desc flag in crc check by @​issacgerges in cthackers/adm-zip#543
• Create only if the directory does not exist by @​DennisHill in cthackers/adm-zip#557
• Fix issue with absolute paths by @​kwolfy in cthackers/adm-zip#559

New Contributors

• @​thomasheritage made their first contribution in cthackers/adm-zip#540
• @​issacgerges made their first contribution in cthackers/adm-zip#543
• @​DennisHill made their first contribution in cthackers/adm-zip#557
• @​kwolfy made their first contribution in cthackers/adm-zip#559

Full Changelog: cthackers/adm-zip@v0.5.16...v0.5.17

Changelog

Sourced from adm-zip's changelog.

0.6.0 / 2026-07-10

Security

• Fixed CVE-2026-39244: a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc (memory exhaustion / DoS) before any validation. Allocation is now bounded by the data actually present — STORED output is sized from the real bytes, DEFLATED output is grown by the inflater and capped at the declared size (#568)
• Hardened the internal entry-name lookup table against object injection: entry names come from untrusted archives, and a name such as __proto__ previously resolved to Object.prototype, crashing addFile and hiding the entry from getEntry/readFile. The table is now prototype-less

Bug fixes

• Fixed a regression (0.5.15) that rejected valid archives using a data descriptor (general-purpose bit 3). The payload is now validated against the authoritative central-directory CRC instead of requiring/parsing the trailing descriptor (#548, #533, #554)
• Fixed extractAllTo/extractAllToAsync not restoring directory permissions with keepOriginalPermission; directory modes are applied after their contents are written, deepest path first, and no longer lock the extractor out of a restrictive directory (#530)
• Fixed infinite recursion in addLocalFolder when a folder contains a symlink pointing back to an ancestor (e.g. workspace node_modules); the walk now tracks resolved real paths and skips already-visited directories (#541)
• Fixed an uncaught exception (ERR_INVALID_ARG_TYPE) that crashed the process when writeFileToAsync could not open the target file (bad permissions, invalid filename, exhausted file descriptors); write failures are now reported through the callback and write errors are no longer silently swallowed (#470, #459, #402)
• Fixed directory entries reporting an empty name (e.g. a/b/c/ now returns c) (#466)
• Fixed extractEntryTo flattening subdirectories when maintainEntryPath is false; the structure below the extracted directory is now preserved instead of collapsing (and overwriting) files by basename (#306)
• Fixed a failed utimes aborting extraction; setting the modification time is now best-effort and never fails extraction of already-written content (#379)
• Fixed test() always returning false for any archive containing a file (it indexed the entries array with an entry object instead of reading the entry); it now correctly verifies each entry's CRC

Performance

• Faster entry sorting when writing archives with many entries: names are decoded once instead of on every comparison (about 6× faster sort for large archives)

Added

• Bundled TypeScript type definitions (types.d.ts), so @types/adm-zip is no longer required

Notes

• Behavior change: extractEntryTo(dir, target, /* maintainEntryPath */ false) now preserves subdirectories beneath the extracted directory rather than flattening them
• Behavior change: extraction no longer fails when the modification time cannot be set

0.5.4 / 2021-03-08

• Fixed relative paths
• Added zipcrypto encryption
• Lower verMade for macOS when generating zip file

0.5.3 / 2021-02-07

• Fixed filemode when unzipping

0.5.2 / 2021-01-27

• Fixed path traversal issue (GHSL-2020-198)

0.5.1 / 2020-11-27

• Incremented version (cthackers)
• Fixed outFileName (cthackers)

0.5.0 / 2020-11-19

• Added extra parameter to extractEntryTo so target filename can be renamed (cthackers)

... (truncated)

Commits

• 2b4d840 updated minimum node engine version to >= 14
• dc57f0f Hardened entry-name lookup, fixed test(), and sped up entry sorting
• f81806a Made utimes best-effort so it can't abort extraction (#379)
• ab04324 Fixed extractEntryTo flattening subdirectories (#306)
• 8a5d9ba Fixed empty name for directory entries (#466)
• 3e72790 Fixed uncaught crash in writeFileToAsync on write failure (#470, #459, #402)
• 651ae4c Added typescript types
• e72021d Fixed infinite recursion on symlink loops in addLocalFolder (#541)
• 8f3176b Fixed directory permissions on linux
• 4d2c8f9 Fixed error introduced with zip descriptor checks
• Additional commits viewable in compare view

Updates luxon from 3.4.4 to 3.7.2

Changelog

Sourced from luxon's changelog.

3.7.2 (2025-07-09)

• Fix ES6 packaging

3.7.1 (2025-07-09)

• Revert change in ES6 packaging

3.7.0 (2025-07-09)

• Added showZeros option to Duration#toHuman
• Added Duration#removeZeros method.
• Added rounding option to DateTime#toRelative
• Added precision option to ISO formatting methods
• Added signMode option to Duration#toFormat
• Allow escaping single quotes in format strings
• Improve output of Info.months and Info.monthsFormat for ja locale
• Accept lowercase t as a separator in ISO strings
• Accept lowercase z as an offset in ISO strings
• Reject non-finite numbers where previously only NaN was rejected
• Improve the documentation for Interval
• Added a dark theme for the documentation site

3.6.1 (2025-03-31)

• Add Fallback for minimalDays being removed from Intl.WeekInfo
• Fix various caches when JS keywords like "constructor" are used for names

3.6.0 (2025-03-25)

• Add Interval.lastDateTime
• Fix a bug that could cause wrong timezone calculations when multiple timezones are in use

3.5.0 (2024-08-03)

• Various performance improvements
• throwOnInvalid causes the constructor to throw if the year is invalid

Commits

• 4262a38 Version 3.7.2
• 738144d Fix the build ES6 code having the wrong file extension and use it in package....
• 3b2f374 Release version 3.7.1
• c67ee7d Revert "build: use the es6 build for ESM exports (#1707)"
• cfa58a2 Release version 3.7.0
• 7d379cc Fix unsupported signDisplay value
• 4e81ef9 Implement "signMode" on Duration#toFormat
• 5aa55da Improve documentation regarding Interval's half-openness
• b188e10 add dark theme to docs (#1713)
• cf67025 build: use the es6 build for ESM exports (#1707)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by diesieben07, a new releaser for luxon since your current version.

Updates @types/luxon from 3.3.5 to 3.7.2

Commits

• See full diff in compare view

Updates playwright from 1.58.2 to 1.61.1

Release notes

Sourced from playwright's releases.

v1.61.1

Bug Fixes

• #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

... (truncated)

Commits

• 39e3553 cherry-pick(#41399): fix(test): load require-reached files as commonjs in syn...
• 4328122 chore: mark v1.61.1 (#41404)
• 2c29a94 fix(tracing): stop recording websocket frames outside of chunks (#41398)
• 4324b19 cherry-pick(#41367): fix(test): keep builtin expect matchers on base extend
• 041e7e3 cherry-pick(#41364): fix(har): WebSocket message timestamps should be in mi...
• b8a0fc3 cherry-pick(#41309, #43149): Revert "fix(firefox): treat `navigationCommitted...
• b5a3175 cherry-pick(#41319): fix(loader): support other node versions
• d4724a9 cherry-pick(#41290): feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image
• 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
• a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for playwright since your current version.

Updates playwright-core from 1.58.2 to 1.61.1

Release notes

Sourced from playwright-core's releases.

v1.61.1

Bug Fixes

• #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext()...
Description has been truncated
Updates the requirements on setuptools, ansible-runner and requests to permit the latest version.
Updates setuptools to 83.0.0

Changelog
Sourced from setuptools's changelog.

v83.0.0
Features

Require Python 3.10 or later.

Bugfixes

MANIFEST.in matching (via FileList) is now insensitive to Unicode
normalization form. A pattern authored in one form (e.g. NFC, as typically
saved by editors) now matches a file whose name is stored on disk in another
(e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude,
global-exclude, recursive-exclude, or prune rule could silently
fail to drop a non-ASCII-named file from the source distribution, publishing
it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

pypa/distutils#334

v82.0.1
Bugfixes

Fix the loading of launcher manifest.xml file. (#5047)
Replaced deprecated json.__version__ with fixture in tests. (#5186)

Improved Documentation

Add advice about how to improve predictability when installing sdists. (#5168)

Misc

#4941, #5157, #5169, #5175

v82.0.0


... (truncated)


Commits

6519f72 Bump version: 82.0.1 → 83.0.0
d1151b1 Merge pull request #5250 from pypa/feature/distutils-d7633fbed
a2df31e Capture removal of dry_run parameter in changelog.
00144dc Moved newsfragment to the release where it occurred.
a4a5a2b Add news fragment.
77470c2 Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed
3c43897 Merge pull request #5247 from pypa/copilot/fix-pypy-version-issue
bb6ea66 Bump PyPy from 3.10 to 3.11 in CI workflow
a2bc3ac Fix broken intersphinx reference to build's installation docs
2d6a739 Use stacked parametrize decorators instead of itertools.product
Additional commits viewable in compare view



Updates ansible-runner from 2.3.2 to 2.4.3

Release notes
Sourced from ansible-runner's releases.

2.4.3
What's Changed

Use get_option api from callback plugins (ansible/ansible-runner#1488). This fixes some problems around using custom callback plugins.
Fix container --tty detection in subprocess mode (ansible/ansible-runner#1489)

Full Changelog: https://github.com/ansible/ansible-runner/compare/2.4.2...2.4.3
2.4.2
What's Changed

Short circuit display wrapper of the callback plugin within forks (ansible/ansible-runner#1414)
Improve EOF log messages when streaming (ansible/ansible-runner#1458)

Full Changelog: https://github.com/ansible/ansible-runner/compare/2.4.1...2.4.2
2.4.1
What's Changed

Modify volume mount behavior when source does not exist (#1408). Volumes specified using the container-volume-mount option will now be passed through to the underlying container engine unverified and unmodified. This now allows you to mount individual files (vs. the parent directory) and non-existing source volumes. The behavior encountered with a non-existing source volume depends on which container engine is in use (docker creates the volume, podman will error).

Bug Fixes

Various documentation updates.

Full Changelog: https://github.com/ansible/ansible-runner/compare/2.4.0...2.4.1
2.4.0
What's Changed

Bump minimum supported Python to 3.9

Bug Fixes

Honor inventory filepath by @​Akasurde in ansible/ansible-runner#1065
Ensure that UTC ISO8601 datetimes include timezone info by @​sivel in ansible/ansible-runner#1238
Fix for non-str ident by @​Shrews in ansible/ansible-runner#1268
Pass inventory directory path instead of file path when using containerization by @​christophert in ansible/ansible-runner#1304
Validate inventory from CLI early by @​Shrews in ansible/ansible-runner#1307
Allow shutil to copy into existing isolation directory by @​christophert in ansible/ansible-runner#1311
Fix invalid inventory with relative pvt data dir by @​Shrews in ansible/ansible-runner#1316
Add lib symlink to bwrap call by @​christophert in ansible/ansible-runner#1312

2.3.8
What's Changed

Short circuit display wrapper in forks (#1414)

Full Changelog: https://github.com/ansible/ansible-runner/compare/2.3.7...2.3.8
2.3.7
What's Changed


... (truncated)


Commits

dafa5b5 📦 Fix setuptools-scm warnings on git archival (#1492) (#1493)
27d5fa6 Fix container --tty detection in subprocess mode (#1306) (#1489)
92d751d Use get_option api from callback plugins (#1142) (#1488)
f9b33f3 Fix GH issue templates (#1430) (#1487)
5e9f56b Fix test_invalid_registry_host() integration test (#1485) (#1486)
a098dcc Clarify automount of SSH dir in docs (#1462) (#1463)
aa1d850 Improve EOF log messages when streaming (#1454) (#1458)
23d1720 Fix container build cache issue (#1449) (#1450)
342cfc5 Remove wheel building from CI (#1443) (#1445)
3dde1ff Change keepalive test boundary to 15
Additional commits viewable in compare view



Updates requests from 2.26.0 to 2.34.2

Release notes
Sourced from requests's releases.

v2.34.2
2.34.2 (2026-05-14)

Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14
v2.34.1
2.34.1 (2026-05-13)
Bugfixes

Widened json input type from dict and list to Mapping
and Sequence. (#7436)
Changed headers input type to MutableMapping and removed None from
Request.headers typing to improve handling for users. (#7431)
Response.reason moved from str | None to str to improve handling
for users. (#7437)
Fixed a bug where some bodies with custom __getattr__ implementations
weren't being properly detected as Iterables. (#7433)

New Contributors

@​k223kim made their first contribution in psf/requests#7433

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13
v2.34.0
2.34.0 (2026-05-11)
Announcements


Requests 2.34.0 introduces inline types, replacing those provided by
typeshed. Public API types should be fully compatible with mypy, pyright,
and ty. We believe types are comprehensive but if you find issues, please
report them to the pinned tracking issue.
Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for
helping review and test the types ahead of the release. (#7272)


Improvements

Digest Auth hashing algorithms have added usedforsecurity=False to clarify
security considerations. (#7310)
Requests added support for Python 3.15 based on beta1. Downstream projects
should be able to start testing prior to its release in October. (#7422)
Requests added support for Python 3.14t. (#7419)

Bugfixes

Response.history no longer contains a reference to itself, preventing
accidental looping when traversing the history list. (#7328)
Requests no longer performs greedy matching on no_proxy domains. The



... (truncated)


Changelog
Sourced from requests's changelog.

2.34.2 (2026-05-14)

Moved headers input type back to Mapping to avoid invariance issues
with MutableMapping and inferred dict types. Users calling
Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)
Bugfixes

Widened json input type from dict and list to Mapping
and Sequence. (#7436)
Changed headers input type to MutableMapping and removed None from
Request.headers typing to improve handling for users. (#7431)
Response.reason moved from str | None to str to improve handling
for users. (#7437)
Fixed a bug where some bodies with custom __getattr__ implementations
weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)
Announcements


Requests 2.34.0 introduces inline types, replacing those provided by
typeshed. Public API types should be fully compatible with mypy, pyright,
and ty. We believe types are comprehensive but if you find issues, please
report them to the pinned tracking issue.
Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for
helping review and test the types ahead of the release. (#7272)


Improvements

Digest Auth hashing algorithms have added usedforsecurity=False to clarify
security considerations. (#7310)
Requests added support for Python 3.15 based on beta1. Downstream projects
should be able to start testing prior to its release in October. (#7422)
Requests added support for Python 3.14t. (#7419)

Bugfixes

Response.history no longer contains a reference to itself, preventing
accidental looping when traversing the history list. (#7328)
Requests no longer performs greedy matching on no_proxy domains. The
proxy_bypass implementation has been updated with CPython's fix from
bpo-39057. (#7427)
Requests no longer incorrectly strips duplicate leading slashes in
URI paths. This should address user issues with specific presigned
URLs. Note the full fix requires urllib3 2.7.0+. (#7315)



... (truncated)


Commits

6e83187 v2.34.2
84d10f0 Move Request.headers back to Mapping (#7441)
b7b549b v2.34.1
e511bc7 Fix mutability issues with headers input types (#7431)
5691f59 Update JsonType containers to read-based collections (#7436)
2144213 Constrain Response.reason to str (#7437)
6404f34 Fix prepare_body stream detection for __getattr__-based file wrappers (#7...
0b401c7 v2.34.0
86b378d Align Session.get parameters with requests.get (#7429)
a4f9a59 Port bpo-39057 to Requests (#7427)
Additional commits viewable in compare view