[dependabot]

Bumps the prod-minor-patch group in /javascript with 3 updates: ky, playwright and puppeteer.

Updates ky from 2.1.0 to 2.2.0

Release notes

Sourced from ky's releases.

v2.2.0

[!NOTE] In init hooks, options.headers now has lowercase names. Read and delete headers with lowercase names, for example delete options.headers.authorization.

Improvements

• Add maxResponseSize option 0d59458
  • Limits the response body size in bytes, counted after decompression. Exceeding it throws the new ResponseSizeError.
• Let beforeRetry hooks change options for the next attempts (#885) 242c327
  • Return {options: {...}} to change onUploadProgress, onDownloadProgress, timeout, fetch, or throwHttpErrors. For example, retry a failed upload without upload progress.
• Respect Retry-After and rate-limit headers when retry.shouldRetry returns true d1c921f
• Run beforeError hooks for errors thrown while reading the response body 323b98f 50c3810
  • A connection that drops while .json(), .text(), etc. reads the body is now a NetworkError.
• Support onUploadProgress and streamed Request bodies in Bun and Deno 83c711c
• Validate options and report clear errors 3ded2aa
  • Invalid options now throw a TypeError that names the option, instead of being silently ignored or failing later with an internal error. This includes null, non-array hooks, and invalid timeout and retry values.
  • Invalid options and errors thrown by init hooks now reject the returned promise instead of throwing synchronously.
• Improve TypeScript types 51b3177 52b8f93 f4886ca 481f6f7
  • Accept readonly arrays and explicit undefined for all options, allow custom error names, and fix the .clone() and .bytes() return types.

Fixes

• Fix aborts and timeouts in many edge cases e1b088e 2f0a3fb 7c1272b 82fa84c 3f0e330
  • User aborts and timeouts now also cancel requests returned from hooks, interrupt pending hooks and body reads, and are no longer reported as NetworkError and retried in Chromium. totalTimeout is now enforced when the response or body arrives after the deadline.
• Fix searchParams with a Request input dropping its body and options such as credentials b4bdecc 4e0bf0b
• Fix option merging in .extend() and init hooks e06d351 0655b9d c5dc4e6 88e2432
  • Class instances, such as an undici Agent as dispatcher or a Date in json, are no longer turned into plain objects. Header names are now matched case-insensitively. Changes made in .extend() callbacks and init hooks no longer leak into other requests.
• Fix many replaceOption() edge cases cc9b5a3 d6e049a deb5a33
• Fix parseJson being ignored by response.clone().json() and when using onDownloadProgress c6c5dbf 015ef95
• Fix progress events, including wrong totalBytes for compressed responses and missing response properties with onDownloadProgress d89c8c8 e893f16 de278ae
• Fix onUploadProgress breaking uploads without request stream support, and keepalive and no-cors requests 6520f64 06ebf18
• Fix fetch: window.fetch throwing "Illegal invocation" in browsers 92ef60e
• Fix isTimeoutError() and the other type guards matching unrelated errors with the same name d636438
• Fix request on Ky errors being an internal clone instead of the request that was sent 619c427 ec3d17f

---

sindresorhus/ky@v2.1.0...v2.2.0

Commits

• 3541888 2.2.0
• 242c327 Let a beforeRetry hook change per-attempt options
• d9ddb03 Fix CI
• d93adf8 Run the browser tests and static checks once in CI
• a5ed57b Refactor
• 7f0137d Report the sent request for a hook's response, and finish the cross-realm and...
• 13c8da5 Stop surfacing progress callback errors
• 55599c8 Run beforeError for a beforeRetry abort and share the body-wrapping check
• 3ded2aa Tweaks
• 692c435 Restore the retry-only marker condition and cover the remaining cases
• Additional commits viewable in compare view

Updates playwright from 1.63.0 to 1.64.0

Release notes

Sourced from playwright's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits

• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
• 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
• 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
• 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
• dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
• Additional commits viewable in compare view

Updates puppeteer from 25.12.0 to 25.13.0

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v25.13.0

25.13.0 (2026-10-08)

🎉 Features

• add page, frame and worker methods on ConsoleMessage (#15515) (82e1fee)
• allow configuring the WebSocket max payload (#15532) (c91da4f)
• network: add asFetchRequest method to HTTPRequest (#15518) (f891aaa)
• network: add asFetchResponse method to HTTPResponse (#15446) (6ab0419)
• roll to Chrome 155.0.8059.39 (#15517) (43dc2a1)
• roll to Firefox 157.0.1 (#15516) (ba92fc7)

🛠️ Fixes

• await browser process termination and run exit hooks after kill (#15522) (a281197)
• cdp: disconnect the browser when the close callback fails (#15496) (e015f22)
• cdp: extend emulateMediaFeatures to media features Chrome honors (#15495) (4758830)
• cdp: settle worker evaluate and close when the script fails to load (#15501) (02c2a3d)
• connect: preserve browserURL path prefixes (#15435) (8d816de)
• launcher: remove the temporary profile when Firefox rejects pipes (#15499) (889a6b7)
• remove injected scripts when clearing custom query handlers (#15507) (909853c)
• use the shadow host when checking visibility of a text node in a shadow root (#15466) (d08c868)
• webdriver: close the browser process when the BiDi close command fails (#15469) (9e5fefa)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 3.2.3 to 3.2.4

puppeteer: v25.13.0

25.13.0 (2026-10-08)

🎉 Features

• roll to Chrome 155.0.8059.39 (#15517) (43dc2a1)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 3.2.3 to 3.2.4
    • puppeteer-core bumped from 25.12.0 to 25.13.0

Commits

• 6e95cc5 chore: release main (#15490)
• e4f90de test(webmcp): update tests to match Chrome 155 implementation (#15558)
• 43dc2a1 feat: roll to Chrome 155.0.8059.39 (#15517)
• e015f22 fix(cdp): disconnect the browser when the close callback fails (#15496)
• ba92fc7 feat: roll to Firefox 157.0.1 (#15516)
• 1964533 build: temp fix (#15555)
• f5a9b39 chore(deps): bump deps to latest versions (#15553)
• ab1882b chore(deps): bump qs and express in /website (#15550)
• 1e03db3 chore: fix build (#15549)
• e7a9ce0 chore(deps): bump compression from 1.8.1 to 1.8.2 in /website (#15545)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions