[dependabot]

Bumps the compatible-updates group with 5 updates in the / directory:

Package	From	To
jszip	3.10.1	3.10.2
mammoth	1.12.0	1.13.0
pg	8.13.1	8.23.1
@playwright/test	1.60.0	1.64.0
esbuild	0.25.12	0.28.2

Updates jszip from 3.10.1 to 3.10.2

Changelog

Sourced from jszip's changelog.

v3.10.2 2026-09-09

• Fix cross-realm binary type detection in getTypeOf. Fixes #759 (see #578)
• Add missing types for JSZip.defaults. Fixes #690 (see #927)
• Fix Blob support in Node.js 18 and up. Fixes #941 (see #955)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by jkoops, a new releaser for jszip since your current version.

Updates mammoth from 1.12.0 to 1.13.0

Changelog

Sourced from mammoth's changelog.

1.13.0

• Replace the use of bluebird with native promises.

  This is arguably a breaking change: however, the return value of functions such as convertToHtml() was only documented as a promise, rather than as a bluebird promise.

  The only exception is that the docs previously used .done(): therefore, when returning promises from the API to external users, a done method is added.

  Any callers that rely on bluebird promises can convert the returned promise into a bluebird promise using bluebird.Promise.resolve().

• Read the children of w:customXml elements.

• Handle paragraphs and runs that have been moved and tracked as a revision.

• Improve escaping in Markdown writer. This avoids some cases where source documents could inject arbitrary HTML into the converted document.

1.12.3

• Avoid excessive backtracking when parsing an unterminated string with many escape sequences. The previous behaviour would allow maliciously crafted documents to cause a denial of service.

  Note that it is still strongly recommended to process untrusted documents in a separate thread with a timeout to avoid potential similar issues.

• Handle complex field separator and end characters without corresponding start characters.

1.12.2

• Avoid prototype pollution when reading the styles defined in a document. This avoids an issue where a maliciously crafted document could be used to set externalFileAccess to true.

1.12.1

• Fix: on Windows, when an image's content type includes a backslash in the subpart, files may be written outside of the directory set by --output-dir.

• Detect and ignore numbering levels that use numStyleLink to refer to themselves.

Commits

• See full diff in compare view

Updates pg from 8.13.1 to 8.23.1

Changelog

Sourced from pg's changelog.

All major and minor releases are briefly explained below.

For richer information consult the commit log on github with referenced pull requests.

We do not include break-fix version release in this file.

pg@8.23.0

• Add support for query pipelineing.

pg@8.22.0

• Add support for sslnegotiation=direct for PostgreSQL 17+.

pg@8.21.0

• Handle SASL SCRAM server error responses properly.
• Add support for node@26.
• Add scramMaxIterations config option.
• Add client.getTransactionStatus() method.

pg@8.20.0

• Add onConnect callback to pg.Pool constructor options allowing for async initialization of newly created & connected pooled clients.

pg@8.19.0

• Deprecate interal query queue.
• Pass connection parameters to password callback.

pg@8.18.0

• Return the client instance as the result of calling connect (previously it was void).

pg@8.17.0

• Throw correct error if database URL parsing fails.

pg@8.16.0

• Add support for min connection pool size.

pg@8.15.0

• Add support for esm importing. CommonJS importing is still also supported.

pg@8.14.0

• Add support for SCRAM-SHA-256-PLUS, i.e. channel binding.

... (truncated)

Commits

• 0980cef Publish
• 2759b2c fix(pg): run a named statement with an empty text more than once (#3781)
• 7feb7df fix(pg): expose detail and hint on errors from the native client (#3780)
• 9683053 fix(pg): do not treat Sync as connection ending (#3772)
• 4589038 fix: validate server certificate against host when connecting to an IP addres...
• 9808955 cleanup: Fix typo in comment
• 2b02f64 fix: avoid mutating query config (#3720)
• 0cef6af Reject portal based queries in pipeline mode instead of misrouting rows (#3737)
• 2991480 Deprecate serializing invalid Dates (#3731)
• c940d7c Fail pipelined queries when the connection dies instead of hanging (#3736)
• Additional commits viewable in compare view

Updates @playwright/test from 1.60.0 to 1.64.0

Release notes

Sourced from @​playwright/test's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits

• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
• 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
• 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
• 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
• dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
• Additional commits viewable in compare view

Updates esbuild from 0.25.12 to 0.28.2