Skip to content

Bump the dependencies group with 10 updates - #73

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-517a378e93
Open

Bump the dependencies group with 10 updates#73
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-517a378e93

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 10 updates:

Package From To
playwright-core 1.63.0 1.64.1
@vercel/sandbox 3.5.1 3.9.1
zod 4.6.5 4.6.7
@modelcontextprotocol/sdk 1.32.0 1.32.2
postgres 3.4.9 4.0.0
botid 1.5.11 1.5.12
next 16.3.8 16.4.3
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
workflow 5.0.1 5.2.3

Updates playwright-core from 1.63.0 to 1.64.1

Release notes

Sourced from playwright-core's releases.

v1.64.1

Bug Fixes

  • #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
  • #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits
  • cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
  • 866cbb8 chore: mark v1.64.1 (#43354)
  • 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
  • 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
  • 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
  • 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
  • e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
  • f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
  • e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
  • d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
  • Additional commits viewable in compare view

Updates @vercel/sandbox from 3.5.1 to 3.9.1

Release notes

Sourced from @​vercel/sandbox's releases.

@​vercel/sandbox-mock@​3.9.1

Patch Changes

@​vercel/sandbox@​3.9.1

Patch Changes

  • Update README intro to reflect persistent-by-default sandboxes. (#408)

@​vercel/sandbox-mock@​3.9.0

Minor Changes

  • Support command stdin: writeStdin(), closeStdin() and stdin: Readable. Writes are buffered, and the command runs once stdin is closed. (#397)

Patch Changes

@​vercel/sandbox@​3.9.0

Patch Changes

  • Apply network policy changes to active sessions before saving configuration and tags, and surface live policy failures so tags cannot incorrectly indicate that a failed policy update succeeded. (#400)

    Skip live network policy updates for sessions that are already stopping so configuration can still be saved for the next session.

  • Stdin writes now always send an offset, and a timed-out write that reports no progress is treated as stalled. (#381)

@​vercel/sandbox-mock@​3.8.0

Patch Changes

@​vercel/sandbox@​3.8.0

Minor Changes

  • Add a new onStart hook on sandbox.runCommand({ ... }) to be notified when a command is started when not using detached: true (#384)

@​vercel/sandbox-mock@​3.7.0

Patch Changes

@​vercel/sandbox@​3.7.0

Minor Changes

... (truncated)

Changelog

Sourced from @​vercel/sandbox's changelog.

3.9.1

Patch Changes

  • Update README intro to reflect persistent-by-default sandboxes. (#408)

3.9.0

Patch Changes

  • Apply network policy changes to active sessions before saving configuration and tags, and surface live policy failures so tags cannot incorrectly indicate that a failed policy update succeeded. (#400)

    Skip live network policy updates for sessions that are already stopping so configuration can still be saved for the next session.

  • Stdin writes now always send an offset, and a timed-out write that reports no progress is treated as stalled. (#381)

3.8.0

Minor Changes

  • Add a new onStart hook on sandbox.runCommand({ ... }) to be notified when a command is started when not using detached: true (#384)

3.7.0

Minor Changes

  • Add opt-in stdin for commands. Pass stdin: true to a detached runCommand, then use command.writeStdin(data) and command.closeStdin() while it runs, or pass a Readable such as process.stdin to have it piped to the command. (#365)

Patch Changes

  • Update @vercel/oidc to v4. (#375)

3.6.1

Patch Changes

  • Preserve UTF-8 characters split across command and log stream chunks so recovery does not skip new output. (#374)

  • Recover from interrupted command wait and log connections, including streams ending with incomplete JSON records, without rerunning commands or duplicating output. (#374)

3.6.0

Minor Changes

  • Add a new Drive.get method to retrieve an existing drive by name. (#367)

  • Add a new drive.fork({ name }) API that forks and returns a new Drive, inheriting the parent drive's data, max size and region. (#369)

Commits

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

  • b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

  • 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
  • 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
  • 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
  • 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
  • b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
  • 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
  • bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
  • c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
  • a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
  • a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
  • 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why
Commits
  • b500a2e 4.6.7
  • 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
  • 529f78d 4.6.6
  • a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
  • c42596b release: hold the run on the release-approval environment until the staged ve...
  • bacad51 docs: square the Code for Japan logo to match the other bronze tiles
  • 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
  • b2ef983 docs: add Code for Japan to bronze sponsors
  • 74304ce release: stage npm versions instead of publishing them (#6622)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.32.0 to 1.32.2

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.2

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

1.32.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

Commits
  • 3b73021 chore: bump version to 1.32.2 (#3089)
  • fa56d81 [v1.x] fix: allow registering after connect() when the capability was declare...
  • 6919e95 fix: add explicit | undefined to Transport optional properties (v1.x backport...
  • ff07b00 chore: bump version to 1.32.1 (#2954)
  • 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
  • a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
  • See full diff in compare view

Updates postgres from 3.4.9 to 4.0.0

Release notes

Sourced from postgres's releases.

v4.0.0

v4 rewrites everything below the public API: the pool, the connection, the protocol, startup and the socket layer. Queries, helpers, transactions, cursors, COPY, listen, subscribe, large objects and the options work as in 3.4.9, apart from the changes below.

Security

  • A NUL character in a connection parameter can no longer add parameters (also in v3). A database, user or connection value such as 'db\0user\0postgres' was sent as further startup parameters, so an app that put untrusted input there, as with a database per tenant, could be made to log in as another user where that user needs no password, or with replication or options set. A NUL in any protocol string, also in query text and identifiers, now rejects with NUL_CHARACTER.
  • A column named __proto__ is an own property (also in v3). It became the prototype of the row, so a JSON value in it, for instance from a column alias built from user input, made the row inherit its properties (row.isAdmin), in query results and in sql.subscribe rows alike.

Upgrading from v3

The README has an upgrade guide, with a query that shows whether the change in parameter types concerns you.

  • The server decides the type of every parameter (infer: false by default) (#392). v3 typed a Date as timestamptz, a boolean, a Buffer, a bigint and arrays of these from JavaScript; v4 sends them without a type and writes each value for the type the server asks for, as libpq does. timestamptz columns, values written to a column of their own type, strings, numbers and anything cast work as before. Outside UTC, a Date written to or compared with a timestamp or date column is taken as UTC instead of the session's local time, and a timestamp is read as UTC, so it comes back as the instant that was written whatever the time zone. A Date where the query doesn't decide its type, such as in date_trunc('day', ${ date }), needs a cast (${ date }::timestamptz). infer: true keeps v3's behaviour.
  • Runtimes. Node.js 20 or later, Bun, and Cloudflare Workers; Deno through its Node.js compatibility. The CommonJS and Deno builds are gone: Postgres.js is an ES module, which require can load on Node.js 20.19 and 22.12 and later (require('postgres').default).
  • sql.array() is removed. Pass the array as it is, with a cast where the query doesn't decide its type: ${ ids }::int[]. Calling sql.array() throws ARRAY_REMOVED.
  • A transaction the server rolled back rejects. When the server answers COMMIT with ROLLBACK, sql.begin rejects with TRANSACTION_ROLLED_BACK; v3 took it as a commit.
  • A released connection stays released. A query on a reserved sql after release(), or on a transaction's sql after it has committed or rolled back, rejects; v3 ran it on whatever connection it then had. Releasing a reserved connection while its own BEGIN is still open closes it instead of returning an open transaction to the pool.
  • An unsafe begin outside sql.begin, a reserved connection or max: 1 rejects with UNSAFE_TRANSACTION and is rolled back. A query that looks like it may open a transaction runs alone on its connection, so nothing else lands in it, and any query that leaves its connection in a transaction is rolled back and rejected. v3 rejected BEGIN but left the transaction open. A script that opens and closes its own transaction in one query, such as a migration file with BEGIN and COMMIT, runs; v3 ran it and still rejected it.
  • A query that cannot be built or serialized inside a transaction aborts the transaction, in sql.begin (#1236, #1238) or one opened by hand on a reserved connection, just as a server error would: the queries after it fail with 25P02 and a later COMMIT answers ROLLBACK. v3 skipped the query and let the rest commit.
  • Domains that exist when the pool starts are read and written as their base type, so a domain over int[] comes back as an array of numbers; v3 returned the text.
  • A connection refused for too many connections (53300) is retried with backoff until connect_timeout has passed, and the waiting queries reject with that error only then. Such a refusal is often momentary: connections opened at the same time against a connection limit can all be refused while the server counts them. v3 rejected the queries of the refused connection at once.
  • No host matching target_session_attrs rejects with CONNECTION_DESTROYED instead of retrying forever.
  • An unknown authentication type rejects with AUTH_TYPE_NOT_IMPLEMENTED instead of waiting for the connect timeout.
  • A replication error with no onerror is logged. When the sql.subscribe stream fails and none of its subscriptions has an onerror, the error goes to console.error before the stream reconnects; v3 dropped it. Pass onerror to handle or silence it.
  • infinity timestamps are Infinity and -Infinity, both ways, instead of an invalid Date.
  • TypeScript: the types are an ES module with a default export and named types (import postgres, { type Sql } from 'postgres'). A reserved connection is no longer typed as having begin and end, which it never had.

New

  • Scheduling across connections: when every connection is busy, a query is pipelined on the connection where it should be done soonest, from how long each statement took before and how long what is in flight has run, and slow queries are kept together once the rest of the pool is needed for quick ones. In simulations of mixed workloads, the p99 of quick queries fell 2 to 100 times; on PostgreSQL, a 1 ms lookup no longer waits behind a report on a busy pool (p99.9 from 792 ms to 5 ms). scheduler: false pipelines on the busy connection with the fewest queries in flight instead; v3 went round-robin over the busy connections. With max: 1 it is off, as there is only one connection.
  • queue_timeout: seconds a query, transaction or reserve may wait for a connection before it rejects with QUEUE_TIMEOUT, unsent (#1036, #824).
  • .signal(abortSignal) on a query: aborting rejects it if it is still waiting, or cancels it if it is running.
  • Canceling a cursor between batches stops it. .cancel() or an aborted .signal() while the cursor's callback runs, or while an async iterator over it is between batches, fetches no more rows, closes the portal and rejects with 57014. v3 sent a cancel request that the idle server ignored, so the cursor ran on to the end (or, arriving late, could cancel the next query).
  • sql` and `.join(items) joins fragments and values with a fragment as separator, leaving out falsy items and adding spaces where missing (#807, #813).
  • Nested sql.begin inside a transaction runs in a savepoint (#985).
  • sql.rollback() rolls back a transaction, or the savepoint it is called in, without throwing; sql.begin resolves with the callback's result (#500).
  • Pipelining anywhere in a transaction is documented and tested: queries in a Promise.all between awaited ones are sent together and run in the order they were made (#951).
  • Custom types by name: to and from can be type names, looked up when the pool starts, with array types, for extension types such as pgvector (#1115, #719).
  • using and await using: sql ends the pool and a reserved connection is released when it goes out of scope (#886, #1094).
  • unref_sockets: true lets the process exit while connections are idle, like allowExitOnIdle in node-postgres (#869, #918).
  • min: connections kept open once the pool is used; idle_timeout closes only those above it (#672).
  • user as a function, called each time a connection opens, like password, for credentials that rotate (#881).
  • Password file: with no password given, PGPASSFILE or ~/.pgpass is read as libpq reads it (#964).
  • Named arguments: an object in the parentheses of a function call becomes name => value arguments, make_interval(${ sql({ days: 1 }) }) (#1040).
  • Errors are documented with their fields and how to tell them apart (#1140).
  • COPY row count: a copy ... from stdin writable has count and command once it has finished, with the number of rows the server copied (#465).
  • Persistent replication slots: slot: 'name' keeps the slot of sql.subscribe across restarts and streams from where it was last confirmed. A transaction is confirmed only once its handlers have finished, a handler that fails gets its transaction delivered again, and handlers may be async: they run one after the other in commit order while the stream waits.
  • More from sql.subscribe: truncate events, and the lsn, time and xid of the transaction on every change. Reconnecting retries with backoff.
  • Channel binding: over TLS, SCRAM authenticates with SCRAM-SHA-256-PLUS (tls-server-end-point) when the server offers it, binding the login to the server certificate. channel_binding is 'prefer' by default, 'require' or 'disable' as in libpq, also from the url or PGCHANNELBINDING; 'require' rejects an unbound connection with CHANNEL_BINDING_REQUIRED (#1008).
  • Direct TLS on Node.js with sslnegotiation: 'direct' (PostgreSQL 17+) is opened as TLS from the first byte and is the fastest encrypted connection.

... (truncated)

Changelog

Sourced from postgres's changelog.

v4.0.0

v4 rewrites everything below the public API: the pool, the connection, the protocol, startup and the socket layer. Queries, helpers, transactions, cursors, COPY, listen, subscribe, large objects and the options work as in 3.4.9, apart from the changes below.

Security

  • A NUL character in a connection parameter can no longer add parameters (also in v3). A database, user or connection value such as 'db\0user\0postgres' was sent as further startup parameters, so an app that put untrusted input there, as with a database per tenant, could be made to log in as another user where that user needs no password, or with replication or options set. A NUL in any protocol string, also in query text and identifiers, now rejects with NUL_CHARACTER.
  • A column named __proto__ is an own property (also in v3). It became the prototype of the row, so a JSON value in it, for instance from a column alias built from user input, made the row inherit its properties (row.isAdmin), in query results and in sql.subscribe rows alike.

Upgrading from v3

The README has an upgrade guide, with a query that shows whether the change in parameter types concerns you.

  • The server decides the type of every parameter (infer: false by default) (#392). v3 typed a Date as timestamptz, a boolean, a Buffer, a bigint and arrays of these from JavaScript; v4 sends them without a type and writes each value for the type the server asks for, as libpq does. timestamptz columns, values written to a column of their own type, strings, numbers and anything cast work as before. Outside UTC, a Date written to or compared with a timestamp or date column is taken as UTC instead of the session's local time, and a timestamp is read as UTC, so it comes back as the instant that was written whatever the time zone. A Date where the query doesn't decide its type, such as in date_trunc('day', ${ date }), needs a cast (${ date }::timestamptz). infer: true keeps v3's behaviour.
  • Runtimes. Node.js 20 or later, Bun, and Cloudflare Workers; Deno through its Node.js compatibility. The CommonJS and Deno builds are gone: Postgres.js is an ES module, which require can load on Node.js 20.19 and 22.12 and later (require('postgres').default).
  • sql.array() is removed. Pass the array as it is, with a cast where the query doesn't decide its type: ${ ids }::int[]. Calling sql.array() throws ARRAY_REMOVED.
  • A transaction the server rolled back rejects. When the server answers COMMIT with ROLLBACK, sql.begin rejects with TRANSACTION_ROLLED_BACK; v3 took it as a commit.
  • A released connection stays released. A query on a reserved sql after release(), or on a transaction's sql after it has committed or rolled back, rejects; v3 ran it on whatever connection it then had. Releasing a reserved connection while its own BEGIN is still open closes it instead of returning an open transaction to the pool.
  • An unsafe begin outside sql.begin, a reserved connection or max: 1 rejects with UNSAFE_TRANSACTION and is rolled back. A query that looks like it may open a transaction runs alone on its connection, so nothing else lands in it, and any query that leaves its connection in a transaction is rolled back and rejected. v3 rejected BEGIN but left the transaction open. A script that opens and closes its own transaction in one query, such as a migration file with BEGIN and COMMIT, runs; v3 ran it and still rejected it.
  • A query that cannot be built or serialized inside a transaction aborts the transaction, in sql.begin (#1236, #1238) or one opened by hand on a reserved connection, just as a server error would: the queries after it fail with 25P02 and a later COMMIT answers ROLLBACK. v3 skipped the query and let the rest commit.
  • Domains that exist when the pool starts are read and written as their base type, so a domain over int[] comes back as an array of numbers; v3 returned the text.
  • A connection refused for too many connections (53300) is retried with backoff until connect_timeout has passed, and the waiting queries reject with that error only then. Such a refusal is often momentary: connections opened at the same time against a connection limit can all be refused while the server counts them. v3 rejected the queries of the refused connection at once.
  • No host matching target_session_attrs rejects with CONNECTION_DESTROYED instead of retrying forever.
  • An unknown authentication type rejects with AUTH_TYPE_NOT_IMPLEMENTED instead of waiting for the connect timeout.
  • A replication error with no onerror is logged. When the sql.subscribe stream fails and none of its subscriptions has an onerror, the error goes to console.error before the stream reconnects; v3 dropped it. Pass onerror to handle or silence it.
  • infinity timestamps are Infinity and -Infinity, both ways, instead of an invalid Date.
  • TypeScript: the types are an ES module with a default export and named types (import postgres, { type Sql } from 'postgres'). A reserved connection is no longer typed as having begin and end, which it never had.

New

  • Scheduling across connections: when every connection is busy, a query is pipelined on the connection where it should be done soonest, from how long each statement took before and how long what is in flight has run, and slow queries are kept together once the rest of the pool is needed for quick ones. In simulations of mixed workloads, the p99 of quick queries fell 2 to 100 times; on PostgreSQL, a 1 ms lookup no longer waits behind a report on a busy pool (p99.9 from 792 ms to 5 ms). scheduler: false pipelines on the busy connection with the fewest queries in flight instead; v3 went round-robin over the busy connections. With max: 1 it is off, as there is only one connection.
  • queue_timeout: seconds a query, transaction or reserve may wait for a connection before it rejects with QUEUE_TIMEOUT, unsent (#1036, #824).
  • .signal(abortSignal) on a query: aborting rejects it if it is still waiting, or cancels it if it is running.
  • Canceling a cursor between batches stops it. .cancel() or an aborted .signal() while the cursor's callback runs, or while an async iterator over it is between batches, fetches no more rows, closes the portal and rejects with 57014. v3 sent a cancel request that the idle server ignored, so the cursor ran on to the end (or, arriving late, could cancel the next query).
  • sql` and `.join(items) joins fragments and values with a fragment as separator, leaving out falsy items and adding spaces where missing (#807, #813).
  • Nested sql.begin inside a transaction runs in a savepoint (#985).
  • sql.rollback() rolls back a transaction, or the savepoint it is called in, without throwing; sql.begin resolves with the callback's result (#500).
  • Pipelining anywhere in a transaction is documented and tested: queries in a Promise.all between awaited ones are sent together and run in the order they were made (#951).
  • Custom types by name: to and from can be type names, looked up when the pool starts, with array types, for extension types such as pgvector (#1115, #719).
  • using and await using: sql ends the pool and a reserved connection is released when it goes out of scope (#886, #1094).
  • unref_sockets: true lets the process exit while connections are idle, like allowExitOnIdle in node-postgres (#869, #918).
  • min: connections kept open once the pool is used; idle_timeout closes only those above it (#672).
  • user as a function, called each time a connection opens, like password, for credentials that rotate (#881).
  • Password file: with no password given, PGPASSFILE or ~/.pgpass is read as libpq reads it (#964).
  • Named arguments: an object in the parentheses of a function call becomes name => value arguments, make_interval(${ sql({ days: 1 }) }) (#1040).
  • Errors are documented with their fields and how to tell them apart (#1140).
  • COPY row count: a copy ... from stdin writable has count and command once it has finished, with the number of rows the server copied (#465).
  • Persistent replication slots: slot: 'name' keeps the slot of sql.subscribe across restarts and streams from where it was last confirmed. A transaction is confirmed only once its handlers have finished, a handler that fails gets its transaction delivered again, and handlers may be async: they run one after the other in commit order while the stream waits.
  • More from sql.subscribe: truncate events, and the lsn, time and xid of the transaction on every change. Reconnecting retries with backoff.
  • Channel binding: over TLS, SCRAM authenticates with SCRAM-SHA-256-PLUS (tls-server-end-point) when the server offers it, binding the login to the server certificate. channel_binding is 'prefer' by default, 'require' or 'disable' as in libpq, also from the url or PGCHANNELBINDING; 'require' rejects an unbound connection with CHANNEL_BINDING_REQUIRED (#1008).

... (truncated)

Commits

Updates botid from 1.5.11 to 1.5.12

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for botid since your current version.


Updates next from 16.3.8 to 16.4.3

Release notes

Sourced from next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
  • [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
  • [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
  • [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
  • [lts-active] test: Pin react-virtualized (#100545)
  • [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
  • [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
  • [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

v16.4.2

What's Changed

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

High:

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

  • Show compiler plugin warning in more situations: #75682
  • fix(scripts): correct typo in rm.mjs error message: #87015

... (truncated)

Commits
  • 29bbeab v16.4.3
  • 5117201 [lts-active] Avoid loading standalone React in server bootstrap (#100610)
  • 37d603b [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #1...
  • cf9d27d [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (...
  • 3f6a632 [lts-active] test: Pin react-virtualized (#100545)
  • f715bba [lts-active][cd] Gate release bot credentials behind GitHub environments (#10...
  • c864c78 [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
  • f3ff943 [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
  • f697cf5 [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
  • 2864b17 v16.4.2
  • Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates workflow from 5.0.1 to 5.2.3

Release notes

Sourced from workflow's releases.

workflow@5.2.3

@​workflow/core@​5.2.3

@dependabot
Bump the dependencies group with 10 updates
fcec092 
Bumps the dependencies group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [playwright-core](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` |
| [@vercel/sandbox](https://github.com/vercel/sandbox/tree/HEAD/packages/vercel-sandbox) | `3.5.1` | `3.9.1` |
| [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.32.0` | `1.32.2` |
| [postgres](https://github.com/porsager/postgres) | `3.4.9` | `4.0.0` |
| [botid](https://github.com/vercel/botid-package) | `1.5.11` | `1.5.12` |
| [next](https://github.com/vercel/next.js) | `16.3.8` | `16.4.3` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [workflow](https://github.com/vercel/workflow/tree/HEAD/packages/workflow) | `5.0.1` | `5.2.3` |


Updates `playwright-core` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

Updates `@vercel/sandbox` from 3.5.1 to 3.9.1
- [Release notes](https://github.com/vercel/sandbox/releases)
- [Changelog](https://github.com/vercel/sandbox/blob/main/packages/vercel-sandbox/CHANGELOG.md)
- [Commits](https://github.com/vercel/sandbox/commits/@vercel/sandbox@3.9.1/packages/vercel-sandbox)

Updates `zod` from 4.6.5 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.5...v4.6.7)

Updates `@modelcontextprotocol/sdk` from 1.32.0 to 1.32.2
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.32.0...1.32.2)

Updates `postgres` from 3.4.9 to 4.0.0
- [Release notes](https://github.com/porsager/postgres/releases)
- [Changelog](https://github.com/porsager/postgres/blob/master/CHANGELOG.md)
- [Commits](porsager/postgres@v3.4.9...v4.0.0)

Updates `botid` from 1.5.11 to 1.5.12
- [Commits](https://github.com/vercel/botid-package/commits)

Updates `next` from 16.3.8 to 16.4.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.8...v16.4.3)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `workflow` from 5.0.1 to 5.2.3
- [Release notes](https://github.com/vercel/workflow/releases)
- [Changelog](https://github.com/vercel/workflow/blob/main/packages/workflow/CHANGELOG.md)
- [Commits](https://github.com/vercel/workflow/commits/workflow@5.2.3/packages/workflow)

---
updated-dependencies:
- dependency-name: playwright-core
  dependency-version: 1.64.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@vercel/sandbox"
  dependency-version: 3.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: postgres
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: botid
  dependency-version: 1.5.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: next
  dependency-version: 16.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: workflow
  dependency-version: 5.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026
@vercel

vercel Bot commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
stackprobe Ready Ready Preview Nov 1, 2026 9:14pm UTC

Request Review

@drippa-ai

drippa-ai Bot commented Nov 1, 2026

Copy link
Copy Markdown

Drippa Sign-Off

No linked ticket to check this against.

Mention the ticket in the title, description or branch name (like ENG-123), then comment @drippa-ai review.

This branch was successfully deployed

1 active deployment
Preview — fcec092e Deployed Nov 1, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants