[dependabot]

Bumps the web-dependencies group in /web with 5 updates:

Package	From	To
@playwright/test	1.63.0	1.64.0
@types/node	26.6.3	26.6.4
bits-ui	2.19.4	2.19.5
svelte	5.57.1	5.57.2
vite-plus	1.0.0	1.1.0

Updates @playwright/test from 1.63.0 to 1.64.0

Release notes

Sourced from @​playwright/test's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits

• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
• 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
• 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
• 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
• dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
• Additional commits viewable in compare view

Updates @types/node from 26.6.3 to 26.6.4

Commits

• See full diff in compare view

Updates bits-ui from 2.19.4 to 2.19.5

Release notes

Sourced from bits-ui's releases.

bits-ui@2.19.5

Patch Changes

• fix(Select): ensure Select.Value labels persist after the select is closed (#2066)

• fix(DismissibleLayer): dismiss on a touch tap whose click follows its pointerdown within a few milliseconds. The click listener was armed only after a 10ms debounce, so on WebKit (mobile Safari) a quick tap on a sibling trigger landed before it and left the open layer open beside the new one. (#2182)

• fix(body-scroll-lock): restore only modified body styles to preserve concurrent changes (#2175)

• Fix DateRangePicker and DateRangeField not reformatting their segments when the locale prop changes after mount. (#2150)

• fix(FocusScope): trap and restore focus inside a Shadow Root. Focus reads now follow shadowRoot.activeElement and the focusin target comes from composedPath(), so Tab wraps within the scope and focus returns to a trigger inside the root on close. (#2180)

Commits

• fd10616 Version Packages (#2181)
• 23a03dc fix: include items prop in example Select wrapper (#2081)
• dca21fe fix(Select): ensure Select.Value labels persist after select is closed in `...
• 634d99f fix: DateRangeField and DateRangePicker not reacting to locale changes (#2150)
• 7636aee fix(body-scroll-lock): restore only modified body styles via CSSOM (#2175)
• 6b31f3c Dismiss layers when a touch tap's click beats the debounce (#2182)
• 036260e fix(FocusScope): trap and restore focus inside a Shadow Root (#2180)
• See full diff in compare view

Updates svelte from 5.57.1 to 5.57.2

Release notes

Sourced from svelte's releases.

svelte@5.57.2

Patch Changes

• fix: don't create async deriveds for a component destroyed while waiting for its top-level await (#18931)

• fix: prevent untracked derived reads from retaining disconnected dependencies (#18829)

• fix: error if {:else} is followed by another {:else} or {:else if ...} (#18900)

• fix: avoid tracking SvelteURLSearchParams during URL updates (#18791)

• fix: restore hydration state when custom element attribute updates throw (#18467)

• fix: attach event handlers that are assigned after a top-level await in production (#18933)

• fix: flush anything pending before invoking flushSync callback function (#18878)

• fix: preserve location information for await wrappers (#18859)

• fix: keep a reactive assignment with no dependencies when migrate cannot turn it into a declaration (#18817)

• fix: don't hang migrate on a declaration that shares a line with its script tag (#18816)

• fix: prevent duplicate subscriptions when reconnecting deriveds (#18899)

• fix: recover when an unexpected node replaces a nested boundary comment during hydration (#18925)

• fix: print {#await} blocks that only have a pending branch (#18908)

• fix: don't warn about a redundant link role on <area> elements without an href (#18872)

• fix: don't throw state_unsafe_mutation when the focused element is removed while bind:activeElement is used (#18921)

• fix: don't overwrite an unchanged spread value, preserving incomplete number input (#18864)

• fix: read batch-local array on each-block commit (#18879)

• fix: error at compile time when a declaration in a snippet redeclares one of its parameters (#18842)

• fix: error when using let: directives on a component with a children snippet (#18873)

• fix: ignore stale boundary reset callbacks (#18886)

• fix: handle deferred transitions aborted before initialization (#18776)

• fix: prevent hydration mismatch recovery from being intercepted by error boundaries (#18841)

• fix: preserve dynamic element connections during hydration (#18855)

Changelog

Sourced from svelte's changelog.

5.57.2

Patch Changes

• fix: don't create async deriveds for a component destroyed while waiting for its top-level await (#18931)

• fix: prevent untracked derived reads from retaining disconnected dependencies (#18829)

• fix: error if {:else} is followed by another {:else} or {:else if ...} (#18900)

• fix: avoid tracking SvelteURLSearchParams during URL updates (#18791)

• fix: restore hydration state when custom element attribute updates throw (#18467)

• fix: attach event handlers that are assigned after a top-level await in production (#18933)

• fix: flush anything pending before invoking flushSync callback function (#18878)

• fix: preserve location information for await wrappers (#18859)

• fix: keep a reactive assignment with no dependencies when migrate cannot turn it into a declaration (#18817)

• fix: don't hang migrate on a declaration that shares a line with its script tag (#18816)

• fix: prevent duplicate subscriptions when reconnecting deriveds (#18899)

• fix: recover when an unexpected node replaces a nested boundary comment during hydration (#18925)

• fix: print {#await} blocks that only have a pending branch (#18908)

• fix: don't warn about a redundant link role on <area> elements without an href (#18872)

• fix: don't throw state_unsafe_mutation when the focused element is removed while bind:activeElement is used (#18921)

• fix: don't overwrite an unchanged spread value, preserving incomplete number input (#18864)

• fix: read batch-local array on each-block commit (#18879)

• fix: error at compile time when a declaration in a snippet redeclares one of its parameters (#18842)

• fix: error when using let: directives on a component with a children snippet (#18873)

• fix: ignore stale boundary reset callbacks (#18886)

• fix: handle deferred transitions aborted before initialization (#18776)

• fix: prevent hydration mismatch recovery from being intercepted by error boundaries (#18841)

• fix: preserve dynamic element connections during hydration (#18855)

Commits

• 10fdca7 Version Packages (#18858)
• c580b38 fix: prevent duplicate derived subscriptions on reconnect (#18899)
• 3f885e3 fix: don't throw state_unsafe_mutation when the focused element is removed wi...
• fe4fb46 fix: error if {:else} is followed by another {:else} or {:else if ...} ...
• 179f66b fix: don't create async deriveds for a component destroyed while waiting for ...
• 79a0c0d fix: attach event handlers that are assigned after a top-level await in pro...
• 14136f8 fix: print {#await} blocks that only have a pending branch (#18908)
• 5cbdd34 fix: recover when an unexpected node replaces a nested boundary comment (#18925)
• 7e83327 fix: avoid tracking SvelteURLSearchParams during URL updates (#18791)
• 020242d fix: ensure hydration state restoration for custom element attribute updates ...
• Additional commits viewable in compare view

Updates vite-plus from 1.0.0 to 1.1.0

Release notes

Sourced from vite-plus's releases.

vite-plus v1.1.0: faster vp dev startup and clearer interactive prompts

Vite+ 1.1 starts vp dev faster and makes the interactive prompts clearer, alongside fixes for vp migrate, package-manager commands, and Windows terminals.

Highlights

• vp dev reaches its local URL about 24% sooner and uses about 30% less memory in the parent process, because Vite+ no longer loads Vite and Vitest there before starting the dev server (#2851), by @​camc314.
• Interactive prompts render boxes, logs, and wrapped text consistently, with clearer hints, validation, and navigation instructions (#2870), by @​cpojer.

Features

• vp run sets npm_execpath and npm_config_user_agent for npm, pnpm, and Yarn, so tools such as npm-run-all2 use the project's package manager instead of falling back to npm (#2895), by @​naokihaba and @​tarikermis.
• Upgrade vite@8.3.1 to vite@8.3.3, rolldown@1.2.11 to rolldown@1.2.12, vitest@5.0.1 to vitest@5.0.3, oxlint@1.85.0 to oxlint@1.87.0, and oxfmt@0.70.0 to oxfmt@0.72.0. The new lint and format versions can flag code that passed before, so run vp fmt after upgrading if CI runs vp check. vp migrate now keeps the React Refresh allowCompoundComponents option because the bundled Oxlint supports it (#2871, #2896, #2904), by @​voidzero-guard[bot].

Fixes & Enhancements

• vp migrate keeps Oxlint rules written with plugin aliases (such as @typescript-eslint/*, react-hooks/*, and import-x/*) and removes rules the bundled Oxlint does not support, listing them in a warning (#2820, #2906), by @​TheAlexLichter and @​yusuke99.
• vp migrate leaves projects without a declared package manager unpinned, keeps existing declarations, and points to vp env pin when it infers one (#2817), by @​TheAlexLichter.
• vp migrate reports a short error for a directory without package.json instead of an ENOENT stack trace (#2821), by @​TheAlexLichter.
• vp create in an existing pnpm workspace adds the catalog entries the new application needs, so installation no longer fails with ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_SPEC (#2808), by @​SaKaNa-Y.
• On Windows, one Ctrl+C stops vpr scripts and managed Bun, pnpm, npm, and Yarn commands without leaving cmd.exe stuck at Terminate batch job (Y/N)? (#2890), by @​fengmk2.
• vp pack --watch on Windows rebuilds with the new options after the config file changes (#2826), by @​liangmiQwQ.
• vp test doctor and vp test complete run the Vitest subcommands instead of being treated as test file filters (#2879), by @​liangmiQwQ.
• With isolated dependency layouts such as pnpm's global virtual store, vp pack finds installed Vue language tools and TypeScript Go for declaration generation, and Playwright browser provider options keep their types (#2868, #2865), by @​liangmiQwQ.
• Package-manager commands fail when the project's package manager does not support a named option, instead of silently dropping it and continuing. Bun 1.4.1+ receives --offline and --prefer-offline, and Yarn Classic accepts a single --filter for vp remove (#2775), by @​jong-kyung.
• vp pm config in Bun projects falls back to npm, as its warning says (#2899), by @​jong-kyung.
• vp pm approve-builds states that Yarn Berry disables third-party build scripts by default from 4.14.0, not in every version (#2902), by @​jong-kyung.
• vp implode asks you to type boom instead of uninstall to confirm (#2901), by @​fengmk2.
• Global package installs and updates print a green +, and removals a red -, with bold package names in both (#2828), by @​liangmiQwQ.
• Setup headings and command hints keep their colors when the installer captures stdout (#2829), by @​liangmiQwQ.

Refactor

• Replace semver with verkit in the CLI, reducing the bundled CLI JavaScript by about 26 KB (#2837), by @​liangmiQwQ.
• Share the shim filename logic between setup and vp env doctor, and remove unused config migration metadata (#2876, #2894), by @​jong-kyung.

Docs

• Announce Vite+ 1.0 on the website and update the homepage vp pack demo (#2843, #2844), by @​TheAlexLichter and @​naokihaba.
• Document vp install -g --node and explain when vp env default re-resolves versions (#2885, #2884), by @​hyunbinseo.
• Use runnable package examples in the vpx guide and vpx --help (#2864), by @​SaKaNa-Y.
• Remove the redundant vp install step from setup-vp CI examples (#2888), by @​yusuke99.
• Explain how to return from a preview build, align manual installation examples with the installed toolchain, and update the JetBrains Node.js path and vp env current --json example for the split directory layout (#2886, #2887, #2889, #2891), by @​jong-kyung.

Chore

• Update contributor setup instructions, move the logo files under docs/public, and ignore the root tmp directory (#2832, #2831, #2860), by @​liangmiQwQ.
• Stabilize Node API reporter, catalog update, Bun, Yarn, and preview snapshots (#2869, #2872, #2893), by @​liangmiQwQ and @​fengmk2.
• Build the docs with the latest Vite+ and fix flaky CI tests (#2855), by @​fengmk2.
• Remove the unused set-snapshot-version action (#2877), by @​jong-kyung.
• Refine the release-manager guidance (#2827, #2788), by @​wan9chi and @​fengmk2.

... (truncated)

Commits

• 3aa366e release: v1.1.0: faster vp dev startup and clearer interactive prompts (#2907)
• b639509 fix(shim): preserve Windows terminal after Ctrl+C (#2890)
• 390f215 perf(cli): defer Vite config resolver until needed (#2851)
• 27b4ffd fix(migrate): strip unsupported Oxlint rules with report (#2906)
• 7944376 fix(create): complete catalogs in existing pnpm workspaces (#2808)
• 6961386 fix(migrate): preserve unpinned package manager policy (#2817)
• d0490f6 fix(migrate): preserve Oxlint rule aliases (#2820)
• 1ebe40a fix(migrate): report missing package.json (#2821)
• 64cc3aa fix(cli): reload pack config on Windows in watch mode (#2826)
• c03dd22 fix(cli): set package-manager lifecycle env for vp run (#2895)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, web. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.