[dependabot]

Bumps the minor-and-patch group with 6 updates in the /services/j3w1ctl-auth directory:

Package	From	To
@fastify/cors	11.3.0	11.3.1
@fastify/helmet	13.1.1	13.2.0
@upstash/redis	1.38.4	1.39.0
@vercel/blob	2.8.0	2.8.2
fastify	5.12.5	5.12.7
@playwright/test	1.63.0	1.64.1

Updates @fastify/cors from 11.3.0 to 11.3.1

Release notes

Sourced from @​fastify/cors's releases.

v11.3.1

What's Changed

• ci: pin actions to commit-hash by @​Fdawgs in fastify/fastify-cors#413
• chore: bump c8 from 11.0.0 to 12.0.0 by @​dependabot[bot] in fastify/fastify-cors#414
• chore: bump typescript from 6.0.3 to 7.0.2 in the dev-dependencies-typescript group across 1 directory by @​dependabot[bot] in fastify/fastify-cors#412
• chore: return to typescript v6.x by @​Tony133 in fastify/fastify-cors#415
• chore(.npmrc): add min-release-age by @​Fdawgs in fastify/fastify-cors#416
• chore: bump fastify/workflows/.github/workflows/plugins-ci.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-cors#417
• chore: bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-cors#418
• ci: enable trusted publishing releases by @​Puppo in fastify/fastify-cors#421

New Contributors

• @​Puppo made their first contribution in fastify/fastify-cors#421

Full Changelog: fastify/fastify-cors@v11.3.0...v11.3.1

Commits

• a4fb482 Bumped v11.3.1
• 4627a17 ci: enable trusted publishing releases
• 7670483 chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#418)
• d03ec98 chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#417)
• 5a2e0d0 chore(.npmrc): add min-release-age
• 2a47537 chore: return to typescript v6.x
• 10c73be chore: bump typescript (#412)
• b9f74b7 chore: bump c8 from 11.0.0 to 12.0.0 (#414)
• 61789f1 ci: pin actions to commit-hash
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/cors since your current version.

Updates @fastify/helmet from 13.1.1 to 13.2.0

Release notes

Sourced from @​fastify/helmet's releases.

v13.2.0

What's Changed

• fix: inherit global enableCSPNonces on routes with custom helmet options by @​TalhaHunter101 in fastify/fastify-helmet#324
  • Note: routes with custom helmet options now inherit the global enableCSPNonces setting. If you relied on nonces being disabled on those routes, set { helmet: { enableCSPNonces: false } } on the route.

New Contributors

• @​TalhaHunter101 made their first contribution in fastify/fastify-helmet#324

Full Changelog: fastify/fastify-helmet@v13.1.2...v13.2.0

v13.1.2

What's Changed

• ci: enable trusted publishing releases by @​Puppo in fastify/fastify-helmet#322

New Contributors

• @​Puppo made their first contribution in fastify/fastify-helmet#322

Full Changelog: fastify/fastify-helmet@v13.1.1...v13.1.2

Commits

• f715808 Bumped v13.2.0
• 6ab142a fix: inherit global enableCSPNonces on routes with custom helmet options (#324)
• 6e3234f Bumped v13.1.2
• 4b0aac4 ci: enable trusted publishing releases
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/helmet since your current version.

Updates @upstash/redis from 1.38.4 to 1.39.0

Release notes

Sourced from @​upstash/redis's releases.

@​upstash/redis@​1.39.0

Minor Changes

• 6801501: Add array commands: arset, armset, arget, armget, argetrange, arscan, argrep, ardel, ardelrange, arcount, arlen, arinsert, arring, arlastitems, arnext, arseek, arop and arinfo, available on the client, in pipelines and in transactions.
• 3f6e286: Support search indexes over Redis streams: redis.search.createIndex({ dataType: "stream", stream: "events", schema }) indexes every entry of the stream as a document keyed by its entry ID. describe() reports dataType: "stream" with the stream key in prefixes.
• 33658bc: Add vector index support: redis.vector.createIndex() / redis.vector.index() return a VectorIndex with add, get, query, delete, count, info and drop, backed by the new VECTOR.CREATE, VECTOR.ADD, VECTOR.GET, VECTOR.QUERY, VECTOR.DEL, VECTOR.COUNT, VECTOR.INFO and VECTOR.DROP commands.

@​upstash/redis@​1.39.0-canary-20260826110341-795a33599494ef4034259bd4f7d36db70c44f368

Full Changelog: https://github.com/upstash/redis-js/compare/@​upstash/redis@1.38.3...@​upstash/redis@1.39.0-canary-20260826110341-795a33599494ef4034259bd4f7d36db70c44f368

Commits

• 6b27727 chore: version packages (#1456)
• 33658bc DX-2963: add vector index commands and redis.vector namespace (#1446)
• 6801501 DX-3009: add array commands (#1451)
• 3f6e286 DX-3010: support search indexes over redis streams (#1452)
• See full diff in compare view

Updates @vercel/blob from 2.8.0 to 2.8.2

Release notes

Sourced from @​vercel/blob's releases.

@​vercel/blob@​2.8.2

Patch Changes

• f11f653: Send blob API version 13, where the server reads keys containing . or .. path segments exactly as they were written instead of resolving them away. Fixes head, copy, rename, del and list on blobs whose pathname has a dot segment.

@​vercel/blob@​2.8.1

Patch Changes

• 59be092: Allow get() to fetch blob URLs from a VERCEL_BLOB_API_URL origin. get() only accepted URLs on *.blob.vercel-storage.com, which blocked local emulators like emulate, since they serve blob content from their own host. When VERCEL_BLOB_API_URL (or NEXT_PUBLIC_VERCEL_BLOB_API_URL) is set, URLs on that same origin are now accepted as well. With no override set the behavior is unchanged, so arbitrary hosts are still rejected in production.

Changelog

Sourced from @​vercel/blob's changelog.

2.8.2

Patch Changes

• f11f653: Send blob API version 13, where the server reads keys containing . or .. path segments exactly as they were written instead of resolving them away. Fixes head, copy, rename, del and list on blobs whose pathname has a dot segment.

2.8.1

Patch Changes

• 59be092: Allow get() to fetch blob URLs from a VERCEL_BLOB_API_URL origin. get() only accepted URLs on *.blob.vercel-storage.com, which blocked local emulators like emulate, since they serve blob content from their own host. When VERCEL_BLOB_API_URL (or NEXT_PUBLIC_VERCEL_BLOB_API_URL) is set, URLs on that same origin are now accepted as well. With no override set the behavior is unchanged, so arbitrary hosts are still rejected in production.

Commits

• 5425e16 Version Packages (#1112)
• f11f653 [blob] Send blob API version 13 (#1109)
• d15b9b3 Version Packages (#1111)
• 59be092 [@​vercel/blob] Allow get() to fetch from a VERCEL_BLOB_API_URL origin (#1110)
• See full diff in compare view

Updates fastify from 5.12.5 to 5.12.7

Release notes

Sourced from fastify's releases.

v5.12.7

Full Changelog: fastify/fastify@v5.12.6...v5.12.7

v5.12.6

⚠️ Security Release

• Fix for GHSA-389g-gv7q-r4x8

What's Changed

• [Backport 5.x] types: restrict route lookup methods by @​github-actions[bot] in fastify/fastify#7048
• [Backport 5.x] perf: decode string bodies once instead of per chunk by @​github-actions[bot] in fastify/fastify#7053
• [Backport 5.x] perf: avoid resetting the level of request child loggers by @​github-actions[bot] in fastify/fastify#7058
• [Backport 5.x] fix: resolve reply.mediaType from raw response headers by @​github-actions[bot] in fastify/fastify#7067
• [Backport 5.x] perf: use a FIFO cache for parsed content-types by @​github-actions[bot] in fastify/fastify#7072
• [Backport 5.x] fix(validation): lowercase header names in propertyNames enum/const by @​mcollina in fastify/fastify#7104
• [Backport 5.x] fix: copy a set-cookie array passed to reply.header instead of storing it by @​github-actions[bot] in fastify/fastify#7087
• [Backport 5.x] fix: remove error when HTTP QUERY request has empty body by @​github-actions[bot] in fastify/fastify#7060
• [Backport 5.x] docs: document fastify.query() shorthand for RFC 10008 by @​github-actions[bot] in fastify/fastify#7094

Full Changelog: fastify/fastify@v5.12.5...v5.12.6

Commits

• 9f40003 Bumped v5.12.7
• 16469b9 Bumped v5.12.6
• 63496de [Backport 5.x] docs: document fastify.query() shorthand for RFC 10008 (#7094)
• 20b55d4 [Backport 5.x] fix: remove error when HTTP QUERY request has empty body (#7060)
• 38d2b63 [Backport 5.x] fix: copy a set-cookie array passed to reply.header instead of...
• 3241fbd [Backport 5.x] fix(validation): lowercase header names in propertyNames enum/...
• 1a46b1b [Backport 5.x] perf: use a FIFO cache for parsed content-types (#7072)
• 7e06676 [Backport 5.x] fix: resolve reply.mediaType from raw response headers (#7067)
• 1b0eb32 [Backport 5.x] perf: avoid resetting the level of request child loggers (#7058)
• a636a10 [Backport 5.x] perf: decode string bodies once instead of per chunk (#7053)
• Additional commits viewable in compare view

Updates @playwright/test from 1.63.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.