[dependabot]

Bumps the minor-and-patch group with 8 updates in the / directory:

Package	From	To
@capacitor/android	8.5.2	8.6.0
@capacitor/core	8.5.2	8.6.0
@capacitor/ios	8.5.2	8.6.0
@capacitor/cli	8.5.2	8.6.0
@playwright/test	1.63.0	1.64.1
acorn	8.18.0	8.19.0
sharp	0.35.4	0.35.5
vite	8.3.0	8.3.5

Updates @capacitor/android from 8.5.2 to 8.6.0

Release notes

Sourced from @​capacitor/android's releases.

8.6.0

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

8.5.3

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Changelog

Sourced from @​capacitor/android's changelog.

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Commits

• ef3ce6e Release 8.6.0
• 4b40f4b chore: add Backstage catalog-info.yaml
• 463225f fix(cli): bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674)
• d19f1ea fix(cli): redact sensitive values from telemetry payloads (#8665)
• 02e43f8 fix(android): keep callbacks on non-public base classes from R8
• 19d2a40 feat(android): recognize @​capacitor-community/ssl-pinning for cert pinning (#...
• 50a3c51 feat(cli): recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666)
• 841017a fix(cli): report npm 12 blocked install scripts in doctor and migrate (#8655)
• acaa9e6 docs: minor correction (#8660)
• 9dc5aeb fix(android): keep plugin annotation types from R8 full mode (#8646)
• Additional commits viewable in compare view

Updates @capacitor/core from 8.5.2 to 8.6.0

Release notes

Sourced from @​capacitor/core's releases.

8.6.0

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

8.5.3

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Changelog

Sourced from @​capacitor/core's changelog.

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Commits

• ef3ce6e Release 8.6.0
• 4b40f4b chore: add Backstage catalog-info.yaml
• 463225f fix(cli): bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674)
• d19f1ea fix(cli): redact sensitive values from telemetry payloads (#8665)
• 02e43f8 fix(android): keep callbacks on non-public base classes from R8
• 19d2a40 feat(android): recognize @​capacitor-community/ssl-pinning for cert pinning (#...
• 50a3c51 feat(cli): recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666)
• 841017a fix(cli): report npm 12 blocked install scripts in doctor and migrate (#8655)
• acaa9e6 docs: minor correction (#8660)
• 9dc5aeb fix(android): keep plugin annotation types from R8 full mode (#8646)
• Additional commits viewable in compare view

Updates @capacitor/ios from 8.5.2 to 8.6.0

Release notes

Sourced from @​capacitor/ios's releases.

8.6.0

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

8.5.3

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Changelog

Sourced from @​capacitor/ios's changelog.

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Commits

• ef3ce6e Release 8.6.0
• 4b40f4b chore: add Backstage catalog-info.yaml
• 463225f fix(cli): bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674)
• d19f1ea fix(cli): redact sensitive values from telemetry payloads (#8665)
• 02e43f8 fix(android): keep callbacks on non-public base classes from R8
• 19d2a40 feat(android): recognize @​capacitor-community/ssl-pinning for cert pinning (#...
• 50a3c51 feat(cli): recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666)
• 841017a fix(cli): report npm 12 blocked install scripts in doctor and migrate (#8655)
• acaa9e6 docs: minor correction (#8660)
• 9dc5aeb fix(android): keep plugin annotation types from R8 full mode (#8646)
• Additional commits viewable in compare view

Updates @capacitor/cli from 8.5.2 to 8.6.0

Release notes

Sourced from @​capacitor/cli's releases.

8.6.0

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

8.5.3

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Changelog

Sourced from @​capacitor/cli's changelog.

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

8.5.3 (2026-10-07)

Bug Fixes

• cli: change Cordova AppDelegate.h imports for SPM (#8618) (145560e)

Commits

• ef3ce6e Release 8.6.0
• 4b40f4b chore: add Backstage catalog-info.yaml
• 463225f fix(cli): bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674)
• d19f1ea fix(cli): redact sensitive values from telemetry payloads (#8665)
• 02e43f8 fix(android): keep callbacks on non-public base classes from R8
• 19d2a40 feat(android): recognize @​capacitor-community/ssl-pinning for cert pinning (#...
• 50a3c51 feat(cli): recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666)
• 841017a fix(cli): report npm 12 blocked install scripts in doctor and migrate (#8655)
• acaa9e6 docs: minor correction (#8660)
• 9dc5aeb fix(android): keep plugin annotation types from R8 full mode (#8646)
• Additional commits viewable in compare view

Updates @playwright/test from 1.63.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• Additional commits viewable in compare view

Updates acorn from 8.18.0 to 8.19.0

Commits

• 0e0ece7 Mark version 8.19.0
• c912cf2 Disallow additional subscripts before arrow in async arrow functions
• f180fd7 Add Unicode v18 support (#1458)
• ab47d42 Update test case for unexpected identifier character (#1456)
• f53ee5f Add a contributing.md file
• 5bd50cd Compare expression end instead of identity in parseSubscripts
• efd7a21 Delete trailing space
• e79ec9e Adjust dubious handling of doubleProto tracking in parseMaybeAssign
• 93e8b90 Upgrade some dependencies with known issues
• f065b20 Upgrade github actions to get rid of warning
• Additional commits viewable in compare view

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract and rotate operations. #4606

• Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract operation. #4606

... (truncated)

Commits

• 51a990f Release v0.35.5
• 96de105 Upgrade to sharp-libvips v1.3.4
• 3a61390 CI: Configure Dependabot with all package.json locations
• 4940c50 Improve gain map support for rotate/flip/flop ops
• 20654aa Prerelease v0.35.5-rc.1
• ef4f934 CI: Upgrade to Ubuntu 26.04
• 358df95 Upgrade to libvips v8.18.7
• 49f4903 Improve gain map support for rotate-then-extract #4606
• 0e2e55e Silence a couple of compiler/static analysis warnings
• cef3b8c Improve gain map support for extract operation #4606
• Additional commits viewable in compare view

Updates vite from 8.3.0 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

v8.3.4

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

8.3.4 (2026-10-08)

Features

• bundled-dev: support import.meta.hot.acceptExports (