fix(mcp): allow loopback hosts by default for all bind addresses by yury-s · Pull Request #42993 · microsoft/playwright

Yury Semikhatsky (yury-s) · 2026-09-29T18:08:32Z

Summary

Default allowed hosts are now localhost, 127.0.0.1, [::1] and the host passed via --host (with the server port); 0.0.0.0/:: binds allow only the loopback names. Other hosts must be passed via --allowed-hosts.
Requests without a Host header skip the check (browsers always send it).
--host 0.0.0.0 prints a localhost URL.

Fixes #42952

Fixes: microsoft#42952

Pavel Feldman (pavelfeldman)

This re-introduces CVE-2025-9611

…ts by default Fixes: microsoft#42952

Pavel Feldman (pavelfeldman) · 2026-09-29T23:47:16Z

The bound address used to be the default and has been dropped. With --host 192.168.1.10 (or any specific hostname):

the server prints http://192.168.1.10:;
requests to that URL send Host: 192.168.1.10:, which isn't on the list, so they get 403.

Before the PR, the bound address was allowed by default, so the server now rejects the URL it prints. The fix is to add the bound host to the loopback list whenever it isn't 0.0.0.0 or ::.

Yury Semikhatsky (yury-s) · 2026-09-30T00:04:21Z

Pavel Feldman (@pavelfeldman) Good catch, fixed in f2b2c7f: the host passed via --host (i.e. the host in the printed URL) is now in the default allowlist alongside localhost, 127.0.0.1 and [::1]. For 0.0.0.0/:: the printed host is localhost, so only loopback names are allowed there. Added a test that binds to 127.0.0.2 and fetches the printed URL.

github-actions · 2026-09-30T00:48:40Z

Test results for "MCP"

8846 passed, 1489 skipped

Merge workflow run.

## ✨ Highlights - **👥 Separate sessions in one browser** — work with multiple accounts without sharing their cookies or storage. `browser_tabs` with `action: "new"` now accepts `isolatedContext: "<name>"`: tabs with the same name share a context, while different names stay isolated. Omit it or use `"default"` for the default context. Cookie and storage tools operate on the current tab's context. ([microsoft/playwright#43087](microsoft/playwright#43087)) - **🙈 Redact runtime values in URLs** ([#1791](#1791)) — session and grant values minted at runtime cannot be listed in a secrets file ahead of time. `--redact-url-params=access_token,code` (config `redactUrlParams`, env `PLAYWRIGHT_MCP_REDACT_URL_PARAMS`) replaces the named query and fragment parameter values with `<redacted>` in tool responses. Like `secrets`, this is a convenience, not a security feature. The extension also removes its connection token from the connect page URL after reading it. ([microsoft/playwright#43258](microsoft/playwright#43258)) - **🔎 Bound find results** ([microsoft/playwright#42077](microsoft/playwright#42077)) — common search terms no longer have to fill the response with every match. `browser_find` accepts a positive integer `maxResults`, returns the first matching items with their context, and reports the total match count. Omit it to keep returning all matches; ancestor paths are unchanged. ([microsoft/playwright#42947](microsoft/playwright#42947)) - **🌐 Inspect requests across navigations** ([microsoft/playwright-cli#479](microsoft/playwright-cli#479)) — requests from the previous page are no longer lost as soon as a flow navigates. `browser_network_requests` accepts `all: true` to include retained history, keeping up to 200 requests from earlier navigations. Request indexes stay stable across navigations for `browser_network_request`. `browser_console_messages` also reports counts consistent with its existing `all` option. ([microsoft/playwright#43526](microsoft/playwright#43526)) - **🎯 Use locators in your language** ([#1797](#1797)) — element tools such as `browser_click` now accept JavaScript, Python, Java and C# locators in `target`, alongside snapshot refs and CSS selectors. Invalid targets get an actionable error, including a reminder to pass the bare ref rather than `button [ref=e5]`. ([microsoft/playwright#43539](microsoft/playwright#43539)) - **📂 Skip unsupported workspace-root requests** ([#1798](#1798)) — clients that advertise roots but cannot answer `roots/list` can stall the first tool call. Pass `--ignore-roots` (config `ignoreRoots: true`, env `PLAYWRIGHT_MCP_IGNORE_ROOTS=true`) to skip that request and use the server's current working directory as the workspace root. ([microsoft/playwright#43532](microsoft/playwright#43532)) - **🍪 Delete cookies by domain and path** — deleting a cookie by name no longer has to remove every cookie with that name. `browser_cookie_delete` (opt-in via `--caps=storage`) accepts optional `domain` and `path` filters to leave other domains and paths untouched. ([microsoft/playwright#43319](microsoft/playwright#43319)) ## 🐛 Fixes - `fix(mcp): allow combining time, text and textGone in browser_wait_for` — when combined with a text condition, `time` is its timeout (capped at 30 seconds), not a delay before checking it. Supplying both `text` and `textGone` now waits for the first condition to happen, rather than both in sequence. ([microsoft/playwright#43011](microsoft/playwright#43011)) - `fix(mcp): allow loopback hosts by default for all bind addresses` — HTTP clients can connect through `localhost`, `127.0.0.1` or `[::1]` regardless of the bind address. Other hosts still require `--allowed-hosts`; binding to `0.0.0.0` prints a usable localhost URL. ([microsoft/playwright#42993](microsoft/playwright#42993)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — credentials embedded in the proxy URL are now passed to the browser as proxy authentication settings. ([microsoft/playwright#43071](microsoft/playwright#43071)) - `fix(mcp): race browser_navigate_back against modal states` — `browser_navigate_back` reports a dialog opened during history navigation instead of timing out. ([microsoft/playwright#43252](microsoft/playwright#43252)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `browser_navigate` handles scheme-less hosts with ports and uses HTTP for loopback addresses such as `127.0.0.1:3000` and `[::1]:3000`. ([microsoft/playwright#43264](microsoft/playwright#43264)) - `fix(mcp): do not close the browser twice when the client disconnects` — stdio disconnects let the browser close gracefully instead of force-killing it through a second close request. Dashboard annotation processes also exit when their parent goes away. ([microsoft/playwright#43174](microsoft/playwright#43174)) - `fix(mcp): give each isolated client its own idle timer` — with HTTP transport and `--isolated`, an idle client's context now expires even while another client keeps the shared browser busy. ([microsoft/playwright#43527](microsoft/playwright#43527)) - `fix(mcp): apply route headers without bypassing origin filters` — `browser_route` (opt-in via `--caps=network`) matches added request header names case-insensitively, includes custom headers in mocked responses, and preserves origin filters and other routes when modifying request headers. ([microsoft/playwright#43227](microsoft/playwright#43227), [microsoft/playwright#43244](microsoft/playwright#43244), [microsoft/playwright#43637](microsoft/playwright#43637)) - `fix(mcp): correct cookie filtering and missing-domain errors` — `browser_cookie_list` (opt-in via `--caps=storage`) matches domain and path boundaries instead of unrelated names such as `notexample.com` or `/apiary`. `browser_cookie_set` asks for an explicit `domain` when the current page has no hostname, such as `about:blank`. ([microsoft/playwright#43316](microsoft/playwright#43316), [microsoft/playwright#43368](microsoft/playwright#43368), [microsoft/playwright#43318](microsoft/playwright#43318)) - `fix(mcp): accept Windows paths in browser_resume location` — `browser_resume` (opt-in via `--caps=devtools`) no longer mistakes a Windows drive-letter colon for the line-number separator. ([microsoft/playwright#43349](microsoft/playwright#43349)) - `fix(mcp): report run-code route handler exceptions once and verbatim` — `browser_run_code_unsafe` reports a route handler's thrown value without duplicating it or wrapping non-Error values in another error. ([microsoft/playwright#43203](microsoft/playwright#43203)) - `fix(extension): release debugger when attach completes after connection close` — disconnecting while `browser_tabs` attaches to a new tab no longer leaves that tab attached to the extension's debugger. ([microsoft/playwright#43025](microsoft/playwright#43025)) - `fix(chromium): close pages that crashed before connecting over CDP` — connecting through `--cdp-endpoint` no longer stalls on an already crashed or discarded page; those pages are omitted from the tab list. ([microsoft/playwright#43075](microsoft/playwright#43075)) - `fix(aria): skip text nodes that are not rendered` — `browser_snapshot` and accessible names omit unrendered text, including unslotted shadow-host text and text directly inside closed `<details>`. ([microsoft/playwright#43150](microsoft/playwright#43150)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude inert content and content outside the topmost modal `<dialog>`. Click and fill actions wait for targets to stop being inert instead of silently misfiring. ([microsoft/playwright#43211](microsoft/playwright#43211)) - `fix(aria): do not count whitespace-only contributors as name sources` — snapshots retain button names when whitespace around a hidden icon previously caused the name to disappear. ([microsoft/playwright#43317](microsoft/playwright#43317)) - `fix(aria): resolve label references consistently` — snapshots and role locators recognize tab- or newline-separated label IDs and labels assigned through `ariaLabelledByElements`, while retaining attribute-based labels in older browsers. ([microsoft/playwright#43361](microsoft/playwright#43361), [microsoft/playwright#43577](microsoft/playwright#43577), [microsoft/playwright#43722](microsoft/playwright#43722)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-like names remain strings rather than being parsed as null or special floating-point values. ([microsoft/playwright#43469](microsoft/playwright#43469)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots retain an iframe's contents when the iframe element also contains fallback text. ([microsoft/playwright#43635](microsoft/playwright#43635)) - `fix(aria): match mixed-case roles and states` — snapshots and role locators recognize mixed-case `role` and ARIA state values, including checked, pressed and expanded states. ([microsoft/playwright#43727](microsoft/playwright#43727)) ## 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.84 ``` Co-authored-by: microsoft-playwright-automation[bot] <203992400+microsoft-playwright-automation[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [@playwright/mcp](https://playwright.dev) ([source](https://redirect.github.com/microsoft/playwright-mcp)) | `0.0.83` → `0.0.84` | ![age](https://developer.mend.io/api/mc/badges/age/npm/@playwright%2fmcp/0.0.84?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/@playwright%2fmcp/0.0.84?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/@playwright%2fmcp/0.0.83/0.0.84?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@playwright%2fmcp/0.0.83/0.0.84?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>microsoft/playwright-mcp (@playwright/mcp)</summary> ### [`v0.0.84`](https://redirect.github.com/microsoft/playwright-mcp/releases/tag/v0.0.84) [Compare Source](https://redirect.github.com/microsoft/playwright-mcp/compare/v0.0.83...v0.0.84) #### ✨ Highlights - **👥 Separate sessions in one browser** — work with multiple accounts without sharing their cookies or storage. `browser_tabs` with `action: "new"` now accepts `isolatedContext: "<name>"`: tabs with the same name share a context, while different names stay isolated. Omit it or use `"default"` for the default context. Cookie and storage tools operate on the current tab's context. ([microsoft/playwright#43087](https://redirect.github.com/microsoft/playwright/pull/43087)) - **🙈 Redact runtime values in URLs** ([#1791](https://redirect.github.com/microsoft/playwright-mcp/issues/1791)) — session and grant values minted at runtime cannot be listed in a secrets file ahead of time. `--redact-url-params=access_token,code` (config `redactUrlParams`, env `PLAYWRIGHT_MCP_REDACT_URL_PARAMS`) replaces the named query and fragment parameter values with `<redacted>` in tool responses. Like `secrets`, this is a convenience, not a security feature. The extension also removes its connection token from the connect page URL after reading it. ([microsoft/playwright#43258](https://redirect.github.com/microsoft/playwright/pull/43258)) - **🔎 Bound find results** ([microsoft/playwright#42077](https://redirect.github.com/microsoft/playwright/issues/42077)) — common search terms no longer have to fill the response with every match. `browser_find` accepts a positive integer `maxResults`, returns the first matching items with their context, and reports the total match count. Omit it to keep returning all matches; ancestor paths are unchanged. ([microsoft/playwright#42947](https://redirect.github.com/microsoft/playwright/pull/42947)) - **🌐 Inspect requests across navigations** ([microsoft/playwright-cli#479](https://redirect.github.com/microsoft/playwright-cli/issues/479)) — requests from the previous page are no longer lost as soon as a flow navigates. `browser_network_requests` accepts `all: true` to include retained history, keeping up to 200 requests from earlier navigations. Request indexes stay stable across navigations for `browser_network_request`. `browser_console_messages` also reports counts consistent with its existing `all` option. ([microsoft/playwright#43526](https://redirect.github.com/microsoft/playwright/pull/43526)) - **🎯 Use locators in your language** ([#1797](https://redirect.github.com/microsoft/playwright-mcp/issues/1797)) — element tools such as `browser_click` now accept JavaScript, Python, Java and C# locators in `target`, alongside snapshot refs and CSS selectors. Invalid targets get an actionable error, including a reminder to pass the bare ref rather than `button [ref=e5]`. ([microsoft/playwright#43539](https://redirect.github.com/microsoft/playwright/pull/43539)) - **📂 Skip unsupported workspace-root requests** ([#1798](https://redirect.github.com/microsoft/playwright-mcp/issues/1798)) — clients that advertise roots but cannot answer `roots/list` can stall the first tool call. Pass `--ignore-roots` (config `ignoreRoots: true`, env `PLAYWRIGHT_MCP_IGNORE_ROOTS=true`) to skip that request and use the server's current working directory as the workspace root. ([microsoft/playwright#43532](https://redirect.github.com/microsoft/playwright/pull/43532)) - **🍪 Delete cookies by domain and path** — deleting a cookie by name no longer has to remove every cookie with that name. `browser_cookie_delete` (opt-in via `--caps=storage`) accepts optional `domain` and `path` filters to leave other domains and paths untouched. ([microsoft/playwright#43319](https://redirect.github.com/microsoft/playwright/pull/43319)) #### 🐛 Fixes - `fix(mcp): allow combining time, text and textGone in browser_wait_for` — when combined with a text condition, `time` is its timeout (capped at 30 seconds), not a delay before checking it. Supplying both `text` and `textGone` now waits for the first condition to happen, rather than both in sequence. ([microsoft/playwright#43011](https://redirect.github.com/microsoft/playwright/pull/43011)) - `fix(mcp): allow loopback hosts by default for all bind addresses` — HTTP clients can connect through `localhost`, `127.0.0.1` or `[::1]` regardless of the bind address. Other hosts still require `--allowed-hosts`; binding to `0.0.0.0` prints a usable localhost URL. ([microsoft/playwright#42993](https://redirect.github.com/microsoft/playwright/pull/42993)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — credentials embedded in the proxy URL are now passed to the browser as proxy authentication settings. ([microsoft/playwright#43071](https://redirect.github.com/microsoft/playwright/pull/43071)) - `fix(mcp): race browser_navigate_back against modal states` — `browser_navigate_back` reports a dialog opened during history navigation instead of timing out. ([microsoft/playwright#43252](https://redirect.github.com/microsoft/playwright/pull/43252)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `browser_navigate` handles scheme-less hosts with ports and uses HTTP for loopback addresses such as `127.0.0.1:3000` and `[::1]:3000`. ([microsoft/playwright#43264](https://redirect.github.com/microsoft/playwright/pull/43264)) - `fix(mcp): do not close the browser twice when the client disconnects` — stdio disconnects let the browser close gracefully instead of force-killing it through a second close request. Dashboard annotation processes also exit when their parent goes away. ([microsoft/playwright#43174](https://redirect.github.com/microsoft/playwright/pull/43174)) - `fix(mcp): give each isolated client its own idle timer` — with HTTP transport and `--isolated`, an idle client's context now expires even while another client keeps the shared browser busy. ([microsoft/playwright#43527](https://redirect.github.com/microsoft/playwright/pull/43527)) - `fix(mcp): apply route headers without bypassing origin filters` — `browser_route` (opt-in via `--caps=network`) matches added request header names case-insensitively, includes custom headers in mocked responses, and preserves origin filters and other routes when modifying request headers. ([microsoft/playwright#43227](https://redirect.github.com/microsoft/playwright/pull/43227), [microsoft/playwright#43244](https://redirect.github.com/microsoft/playwright/pull/43244), [microsoft/playwright#43637](https://redirect.github.com/microsoft/playwright/pull/43637)) - `fix(mcp): correct cookie filtering and missing-domain errors` — `browser_cookie_list` (opt-in via `--caps=storage`) matches domain and path boundaries instead of unrelated names such as `notexample.com` or `/apiary`. `browser_cookie_set` asks for an explicit `domain` when the current page has no hostname, such as `about:blank`. ([microsoft/playwright#43316](https://redirect.github.com/microsoft/playwright/pull/43316), [microsoft/playwright#43368](https://redirect.github.com/microsoft/playwright/pull/43368), [microsoft/playwright#43318](https://redirect.github.com/microsoft/playwright/pull/43318)) - `fix(mcp): accept Windows paths in browser_resume location` — `browser_resume` (opt-in via `--caps=devtools`) no longer mistakes a Windows drive-letter colon for the line-number separator. ([microsoft/playwright#43349](https://redirect.github.com/microsoft/playwright/pull/43349)) - `fix(mcp): report run-code route handler exceptions once and verbatim` — `browser_run_code_unsafe` reports a route handler's thrown value without duplicating it or wrapping non-Error values in another error. ([microsoft/playwright#43203](https://redirect.github.com/microsoft/playwright/pull/43203)) - `fix(extension): release debugger when attach completes after connection close` — disconnecting while `browser_tabs` attaches to a new tab no longer leaves that tab attached to the extension's debugger. ([microsoft/playwright#43025](https://redirect.github.com/microsoft/playwright/pull/43025)) - `fix(chromium): close pages that crashed before connecting over CDP` — connecting through `--cdp-endpoint` no longer stalls on an already crashed or discarded page; those pages are omitted from the tab list. ([microsoft/playwright#43075](https://redirect.github.com/microsoft/playwright/pull/43075)) - `fix(aria): skip text nodes that are not rendered` — `browser_snapshot` and accessible names omit unrendered text, including unslotted shadow-host text and text directly inside closed `<details>`. ([microsoft/playwright#43150](https://redirect.github.com/microsoft/playwright/pull/43150)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude inert content and content outside the topmost modal `<dialog>`. Click and fill actions wait for targets to stop being inert instead of silently misfiring. ([microsoft/playwright#43211](https://redirect.github.com/microsoft/playwright/pull/43211)) - `fix(aria): do not count whitespace-only contributors as name sources` — snapshots retain button names when whitespace around a hidden icon previously caused the name to disappear. ([microsoft/playwright#43317](https://redirect.github.com/microsoft/playwright/pull/43317)) - `fix(aria): resolve label references consistently` — snapshots and role locators recognize tab- or newline-separated label IDs and labels assigned through `ariaLabelledByElements`, while retaining attribute-based labels in older browsers. ([microsoft/playwright#43361](https://redirect.github.com/microsoft/playwright/pull/43361), [microsoft/playwright#43577](https://redirect.github.com/microsoft/playwright/pull/43577), [microsoft/playwright#43722](https://redirect.github.com/microsoft/playwright/pull/43722)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-like names remain strings rather than being parsed as null or special floating-point values. ([microsoft/playwright#43469](https://redirect.github.com/microsoft/playwright/pull/43469)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots retain an iframe's contents when the iframe element also contains fallback text. ([microsoft/playwright#43635](https://redirect.github.com/microsoft/playwright/pull/43635)) - `fix(aria): match mixed-case roles and states` — snapshots and role locators recognize mixed-case `role` and ARIA state values, including checked, pressed and expanded states. ([microsoft/playwright#43727](https://redirect.github.com/microsoft/playwright/pull/43727)) #### 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.84 ``` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/paulnsorensen/dotfiles).  --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Paul Sorensen <paulnsorensen@gmail.com>

## ✨ Highlights - **👥 Separate sessions in one browser** — work with multiple accounts without sharing their cookies or storage. `browser_tabs` with `action: "new"` now accepts `isolatedContext: "<name>"`: tabs with the same name share a context, while different names stay isolated. Omit it or use `"default"` for the default context. Cookie and storage tools operate on the current tab's context. ([microsoft/playwright#43087](microsoft/playwright#43087)) - **🙈 Redact runtime values in URLs** ([microsoft#1791](microsoft#1791)) — session and grant values minted at runtime cannot be listed in a secrets file ahead of time. `--redact-url-params=access_token,code` (config `redactUrlParams`, env `PLAYWRIGHT_MCP_REDACT_URL_PARAMS`) replaces the named query and fragment parameter values with `<redacted>` in tool responses. Like `secrets`, this is a convenience, not a security feature. The extension also removes its connection token from the connect page URL after reading it. ([microsoft/playwright#43258](microsoft/playwright#43258)) - **🔎 Bound find results** ([microsoft/playwright#42077](microsoft/playwright#42077)) — common search terms no longer have to fill the response with every match. `browser_find` accepts a positive integer `maxResults`, returns the first matching items with their context, and reports the total match count. Omit it to keep returning all matches; ancestor paths are unchanged. ([microsoft/playwright#42947](microsoft/playwright#42947)) - **🌐 Inspect requests across navigations** ([microsoft/playwright-cli#479](microsoft/playwright-cli#479)) — requests from the previous page are no longer lost as soon as a flow navigates. `browser_network_requests` accepts `all: true` to include retained history, keeping up to 200 requests from earlier navigations. Request indexes stay stable across navigations for `browser_network_request`. `browser_console_messages` also reports counts consistent with its existing `all` option. ([microsoft/playwright#43526](microsoft/playwright#43526)) - **🎯 Use locators in your language** ([microsoft#1797](microsoft#1797)) — element tools such as `browser_click` now accept JavaScript, Python, Java and C# locators in `target`, alongside snapshot refs and CSS selectors. Invalid targets get an actionable error, including a reminder to pass the bare ref rather than `button [ref=e5]`. ([microsoft/playwright#43539](microsoft/playwright#43539)) - **📂 Skip unsupported workspace-root requests** ([microsoft#1798](microsoft#1798)) — clients that advertise roots but cannot answer `roots/list` can stall the first tool call. Pass `--ignore-roots` (config `ignoreRoots: true`, env `PLAYWRIGHT_MCP_IGNORE_ROOTS=true`) to skip that request and use the server's current working directory as the workspace root. ([microsoft/playwright#43532](microsoft/playwright#43532)) - **🍪 Delete cookies by domain and path** — deleting a cookie by name no longer has to remove every cookie with that name. `browser_cookie_delete` (opt-in via `--caps=storage`) accepts optional `domain` and `path` filters to leave other domains and paths untouched. ([microsoft/playwright#43319](microsoft/playwright#43319)) ## 🐛 Fixes - `fix(mcp): allow combining time, text and textGone in browser_wait_for` — when combined with a text condition, `time` is its timeout (capped at 30 seconds), not a delay before checking it. Supplying both `text` and `textGone` now waits for the first condition to happen, rather than both in sequence. ([microsoft/playwright#43011](microsoft/playwright#43011)) - `fix(mcp): allow loopback hosts by default for all bind addresses` — HTTP clients can connect through `localhost`, `127.0.0.1` or `[::1]` regardless of the bind address. Other hosts still require `--allowed-hosts`; binding to `0.0.0.0` prints a usable localhost URL. ([microsoft/playwright#42993](microsoft/playwright#42993)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — credentials embedded in the proxy URL are now passed to the browser as proxy authentication settings. ([microsoft/playwright#43071](microsoft/playwright#43071)) - `fix(mcp): race browser_navigate_back against modal states` — `browser_navigate_back` reports a dialog opened during history navigation instead of timing out. ([microsoft/playwright#43252](microsoft/playwright#43252)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `browser_navigate` handles scheme-less hosts with ports and uses HTTP for loopback addresses such as `127.0.0.1:3000` and `[::1]:3000`. ([microsoft/playwright#43264](microsoft/playwright#43264)) - `fix(mcp): do not close the browser twice when the client disconnects` — stdio disconnects let the browser close gracefully instead of force-killing it through a second close request. Dashboard annotation processes also exit when their parent goes away. ([microsoft/playwright#43174](microsoft/playwright#43174)) - `fix(mcp): give each isolated client its own idle timer` — with HTTP transport and `--isolated`, an idle client's context now expires even while another client keeps the shared browser busy. ([microsoft/playwright#43527](microsoft/playwright#43527)) - `fix(mcp): apply route headers without bypassing origin filters` — `browser_route` (opt-in via `--caps=network`) matches added request header names case-insensitively, includes custom headers in mocked responses, and preserves origin filters and other routes when modifying request headers. ([microsoft/playwright#43227](microsoft/playwright#43227), [microsoft/playwright#43244](microsoft/playwright#43244), [microsoft/playwright#43637](microsoft/playwright#43637)) - `fix(mcp): correct cookie filtering and missing-domain errors` — `browser_cookie_list` (opt-in via `--caps=storage`) matches domain and path boundaries instead of unrelated names such as `notexample.com` or `/apiary`. `browser_cookie_set` asks for an explicit `domain` when the current page has no hostname, such as `about:blank`. ([microsoft/playwright#43316](microsoft/playwright#43316), [microsoft/playwright#43368](microsoft/playwright#43368), [microsoft/playwright#43318](microsoft/playwright#43318)) - `fix(mcp): accept Windows paths in browser_resume location` — `browser_resume` (opt-in via `--caps=devtools`) no longer mistakes a Windows drive-letter colon for the line-number separator. ([microsoft/playwright#43349](microsoft/playwright#43349)) - `fix(mcp): report run-code route handler exceptions once and verbatim` — `browser_run_code_unsafe` reports a route handler's thrown value without duplicating it or wrapping non-Error values in another error. ([microsoft/playwright#43203](microsoft/playwright#43203)) - `fix(extension): release debugger when attach completes after connection close` — disconnecting while `browser_tabs` attaches to a new tab no longer leaves that tab attached to the extension's debugger. ([microsoft/playwright#43025](microsoft/playwright#43025)) - `fix(chromium): close pages that crashed before connecting over CDP` — connecting through `--cdp-endpoint` no longer stalls on an already crashed or discarded page; those pages are omitted from the tab list. ([microsoft/playwright#43075](microsoft/playwright#43075)) - `fix(aria): skip text nodes that are not rendered` — `browser_snapshot` and accessible names omit unrendered text, including unslotted shadow-host text and text directly inside closed `<details>`. ([microsoft/playwright#43150](microsoft/playwright#43150)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude inert content and content outside the topmost modal `<dialog>`. Click and fill actions wait for targets to stop being inert instead of silently misfiring. ([microsoft/playwright#43211](microsoft/playwright#43211)) - `fix(aria): do not count whitespace-only contributors as name sources` — snapshots retain button names when whitespace around a hidden icon previously caused the name to disappear. ([microsoft/playwright#43317](microsoft/playwright#43317)) - `fix(aria): resolve label references consistently` — snapshots and role locators recognize tab- or newline-separated label IDs and labels assigned through `ariaLabelledByElements`, while retaining attribute-based labels in older browsers. ([microsoft/playwright#43361](microsoft/playwright#43361), [microsoft/playwright#43577](microsoft/playwright#43577), [microsoft/playwright#43722](microsoft/playwright#43722)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-like names remain strings rather than being parsed as null or special floating-point values. ([microsoft/playwright#43469](microsoft/playwright#43469)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots retain an iframe's contents when the iframe element also contains fallback text. ([microsoft/playwright#43635](microsoft/playwright#43635)) - `fix(aria): match mixed-case roles and states` — snapshots and role locators recognize mixed-case `role` and ARIA state values, including checked, pressed and expanded states. ([microsoft/playwright#43727](microsoft/playwright#43727)) ## 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.84 ``` Co-authored-by: microsoft-playwright-automation[bot] <203992400+microsoft-playwright-automation[bot]@users.noreply.github.com>

> [!NOTE] > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | Pending | |---|---|---|---|---|---|---| | [@playwright/mcp](https://playwright.dev) ([source](https://redirect.github.com/microsoft/playwright-mcp)) | `0.0.82` → `0.0.84` | ![age](https://developer.mend.io/api/mc/badges/age/npm/@playwright%2fmcp/0.0.84?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@playwright%2fmcp/0.0.82/0.0.84?slim=true) | | patch | | | [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) | `v5.5.0` → `v5.6.1` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/CodSpeedHQ%2faction/v5.6.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/CodSpeedHQ%2faction/v5.5.0/v5.6.1?slim=true) | action | minor | `v5.6.3` | | [actions/upload-artifact](https://redirect.github.com/actions/upload-artifact) | `v7.0.1` → `v7.0.2` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/actions%2fupload-artifact/v7.0.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/actions%2fupload-artifact/v7.0.1/v7.0.2?slim=true) | action | patch | | | [alembic](https://redirect.github.com/sqlalchemy/alembic) ([changelog](https://alembic.sqlalchemy.org/en/latest/changelog.html)) | `==1.20.0` → `==1.20.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/alembic/1.20.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/alembic/1.20.0/1.20.1?slim=true) | project.dependencies | patch | | | [anchore/syft](https://redirect.github.com/anchore/syft) | `v1.52.0` → `v1.55.0` | ![age](https://developer.mend.io/api/mc/badges/age/docker/anchore%2fsyft/v1.55.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/anchore%2fsyft/v1.52.0/v1.55.0?slim=true) | | minor | `v1.56.0` | | [aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://redirect.github.com/aquasecurity/trivy)) | `0.76.0` → `0.76.1` | ![age](https://developer.mend.io/api/mc/badges/age/docker/aquasec%2ftrivy/0.76.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/aquasec%2ftrivy/0.76.0/0.76.1?slim=true) | | patch | | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | `v0.16.8` → `v0.17.3` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/astral-sh%2fruff-pre-commit/v0.17.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/astral-sh%2fruff-pre-commit/v0.16.8/v0.17.3?slim=true) | repository | minor | | | [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) | `v10.1.0` → `v10.3.3` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/astral-sh%2fsetup-uv/v10.3.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/astral-sh%2fsetup-uv/v10.1.0/v10.3.3?slim=true) | action | minor | | | [astral-sh/uv](https://redirect.github.com/astral-sh/uv) | `0.12.17` → `0.13.6` | ![age](https://developer.mend.io/api/mc/badges/age/github-releases/astral-sh%2fuv/0.13.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/astral-sh%2fuv/0.12.17/0.13.6?slim=true) | | minor | `0.13.7` | | [asyncpg](https://redirect.github.com/MagicStack/asyncpg) | `==0.31.0` → `==0.32.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/asyncpg/0.32.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/asyncpg/0.31.0/0.32.0?slim=true) | project.dependencies | minor | | | [boto3](https://redirect.github.com/boto/boto3) | `==1.43.98` → `==1.43.123` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/boto3/1.43.123?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/boto3/1.43.98/1.43.123?slim=true) | project.dependencies | patch | | | [boto3-stubs](https://redirect.github.com/youtype/mypy_boto3_builder) | `==1.43.98` → `==1.43.123` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/boto3-stubs/1.43.123?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/boto3-stubs/1.43.98/1.43.123?slim=true) | project.optional-dependencies | patch | | | craftainer-crud | `>=0.7.0,<0.8` → `>=0.8.1,<0.9` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/craftainer-crud/0.8.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/craftainer-crud/0.7.0/0.8.1?slim=true) | project.dependencies | minor | | | craftainer-crud-sdk | `>=0.2.0,<0.3` → `>=0.3.1,<0.4` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/craftainer-crud-sdk/0.3.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/craftainer-crud-sdk/0.2.0/0.3.1?slim=true) | project.optional-dependencies | minor | | | [fastapi](https://redirect.github.com/fastapi/fastapi) ([changelog](https://fastapi.tiangolo.com/release-notes/)) | `==0.141.1` → `==0.162.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/fastapi/0.162.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/fastapi/0.141.1/0.162.0?slim=true) | project.dependencies | minor | | | [granian](https://redirect.github.com/emmett-framework/granian) | `==2.8.4` → `==2.8.7` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/granian/2.8.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/granian/2.8.4/2.8.7?slim=true) | project.dependencies | patch | | | [httpx2](https://redirect.github.com/pydantic/httpx2) ([changelog](https://redirect.github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)) | `==2.13.0` → `==2.16.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/httpx2/2.16.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/httpx2/2.13.0/2.16.0?slim=true) | project.optional-dependencies | minor | | | [locust](https://redirect.github.com/locustio/locust) | `==2.46.6` → `==2.47.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/locust/2.47.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/locust/2.46.6/2.47.0?slim=true) | project.optional-dependencies | minor | | | [mypy](https://redirect.github.com/python/mypy) ([changelog](https://mypy.readthedocs.io/en/latest/changelog.html)) | `==2.3.1` → `==2.4.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/mypy/2.4.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/mypy/2.3.1/2.4.1?slim=true) | project.optional-dependencies | minor | | | [opentelemetry-exporter-otlp-proto-http](https://redirect.github.com/open-telemetry/opentelemetry-python) | `==1.45.1` → `==1.45.2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/opentelemetry-exporter-otlp-proto-http/1.45.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/opentelemetry-exporter-otlp-proto-http/1.45.1/1.45.2?slim=true) | project.dependencies | patch | | | [opentelemetry-instrumentation-fastapi](https://redirect.github.com/open-telemetry/opentelemetry-python-contrib) | `==0.66b1` → `==0.66b2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/opentelemetry-instrumentation-fastapi/0.66b2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/opentelemetry-instrumentation-fastapi/0.66b1/0.66b2?slim=true) | project.dependencies | patch | | | [opentelemetry-instrumentation-logging](https://redirect.github.com/open-telemetry/opentelemetry-python-contrib) | `==0.66b1` → `==0.66b2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/opentelemetry-instrumentation-logging/0.66b2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/opentelemetry-instrumentation-logging/0.66b1/0.66b2?slim=true) | project.dependencies | patch | | | [opentelemetry-instrumentation-sqlalchemy](https://redirect.github.com/open-telemetry/opentelemetry-python-contrib) | `==0.66b1` → `==0.66b2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/opentelemetry-instrumentation-sqlalchemy/0.66b2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/opentelemetry-instrumentation-sqlalchemy/0.66b1/0.66b2?slim=true) | project.dependencies | patch | | | [opentelemetry-sdk](https://redirect.github.com/open-telemetry/opentelemetry-python) | `==1.45.1` → `==1.45.2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/opentelemetry-sdk/1.45.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/opentelemetry-sdk/1.45.1/1.45.2?slim=true) | project.dependencies | patch | | | [playwright](https://redirect.github.com/Microsoft/playwright-python) ([changelog](https://redirect.github.com/microsoft/playwright-python/releases)) | `==1.63.0` → `==1.64.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/playwright/1.64.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/playwright/1.63.0/1.64.1?slim=true) | project.optional-dependencies | minor | | | [prek](https://prek.j178.dev/) ([source](https://redirect.github.com/j178/prek), [changelog](https://redirect.github.com/j178/prek/blob/main/CHANGELOG.md)) | `==0.5.3` → `==0.5.9` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/prek/0.5.9?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/prek/0.5.3/0.5.9?slim=true) | project.optional-dependencies | patch | `0.5.10` | | [pydantic-settings](https://redirect.github.com/pydantic/pydantic-settings) ([changelog](https://redirect.github.com/pydantic/pydantic-settings/releases)) | `==2.15.0` → `==2.16.2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pydantic-settings/2.16.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pydantic-settings/2.15.0/2.16.2?slim=true) | project.dependencies | minor | | | [pyjwt](https://redirect.github.com/jpadilla/pyjwt) | `==2.15.0` → `==2.15.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pyjwt/2.15.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pyjwt/2.15.0/2.15.1?slim=true) | project.dependencies | patch | | | [pytest](https://redirect.github.com/pytest-dev/pytest) ([changelog](https://docs.pytest.org/en/stable/changelog.html)) | `==9.1.1` → `==9.2.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pytest/9.2.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pytest/9.1.1/9.2.0?slim=true) | project.optional-dependencies | minor | | | [pytest-asyncio](https://redirect.github.com/pytest-dev/pytest-asyncio) ([changelog](https://pytest-asyncio.readthedocs.io/en/stable/reference/changelog.html)) | `==1.4.0` → `==1.4.1.post1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pytest-asyncio/1.4.1.post1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pytest-asyncio/1.4.0/1.4.1.post1?slim=true) | project.optional-dependencies | patch | | | [pytest-benchmark](https://redirect.github.com/ionelmc/pytest-benchmark) ([changelog](https://pytest-benchmark.readthedocs.io/en/latest/changelog.html)) | `==5.3.0` → `==5.3.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pytest-benchmark/5.3.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pytest-benchmark/5.3.0/5.3.1?slim=true) | project.optional-dependencies | patch | | | [pytest-codspeed](https://redirect.github.com/CodSpeedHQ/pytest-codspeed) | `==5.0.3` → `==5.0.4` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pytest-codspeed/5.0.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pytest-codspeed/5.0.3/5.0.4?slim=true) | project.optional-dependencies | patch | | | [pytest-playwright](https://redirect.github.com/microsoft/playwright-pytest) | `==0.9.0` → `==0.10.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pytest-playwright/0.10.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pytest-playwright/0.9.0/0.10.0?slim=true) | project.optional-dependencies | minor | | | [python](https://hub.docker.com/_/python) ([source](https://redirect.github.com/docker-library/python)) | `3.14.8-slim-trixie` → `3.15.1-slim-trixie` | ![age](https://developer.mend.io/api/mc/badges/age/docker/python/3.15.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/python/3.14.8/3.15.1?slim=true) | final | minor | `3.15.2-slim-trixie` | | [python](https://hub.docker.com/_/python) ([source](https://redirect.github.com/docker-library/python)) | `3.14.8-slim-trixie` → `3.15.1-slim-trixie` | ![age](https://developer.mend.io/api/mc/badges/age/docker/python/3.15.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/python/3.14.8/3.15.1?slim=true) | stage | minor | `3.15.2-slim-trixie` | | [python-multipart](https://redirect.github.com/Kludex/python-multipart) ([changelog](https://redirect.github.com/Kludex/python-multipart/blob/master/CHANGELOG.md)) | `==0.0.32` → `==0.0.33` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/python-multipart/0.0.33?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/python-multipart/0.0.32/0.0.33?slim=true) | project.dependencies | patch | | | [ruff](https://docs.astral.sh/ruff) ([source](https://redirect.github.com/astral-sh/ruff), [changelog](https://redirect.github.com/astral-sh/ruff/blob/main/CHANGELOG.md)) | `==0.16.8` → `==0.17.3` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/ruff/0.17.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/ruff/0.16.8/0.17.3?slim=true) | project.optional-dependencies | minor | | | [selenium](https://www.selenium.dev) | `==4.49.0` → `==4.52.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/selenium/4.52.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/selenium/4.49.0/4.52.0?slim=true) | project.optional-dependencies | minor | | | [sqlalchemy](https://redirect.github.com/sqlalchemy/sqlalchemy) ([changelog](https://docs.sqlalchemy.org/en/latest/changelog/)) | `==2.0.54` → `==2.1.6` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/sqlalchemy/2.1.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/sqlalchemy/2.0.54/2.1.6?slim=true) | project.dependencies | minor | `2.1.8` (+1) | | [squawk-cli](https://squawkhq.com) ([source](https://redirect.github.com/sbdchd/squawk)) | `==2.70.0` → `==2.71.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/squawk-cli/2.71.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/squawk-cli/2.70.0/2.71.0?slim=true) | project.optional-dependencies | minor | | | [uvicorn](https://redirect.github.com/Kludex/uvicorn) ([changelog](https://uvicorn.dev/release-notes)) | `==0.53.0` → `==0.54.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/uvicorn/0.54.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/uvicorn/0.53.0/0.54.0?slim=true) | project.dependencies | minor | | | [valkey/valkey](https://redirect.github.com/valkey-io/valkey) | `9.1.2-alpine` → `9.1.3-alpine` | ![age](https://developer.mend.io/api/mc/badges/age/docker/valkey%2fvalkey/9.1.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/valkey%2fvalkey/9.1.2/9.1.3?slim=true) | | patch | | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>microsoft/playwright-mcp (@playwright/mcp)</summary> ### [`v0.0.84`](https://redirect.github.com/microsoft/playwright-mcp/releases/tag/v0.0.84) [Compare Source](https://redirect.github.com/microsoft/playwright-mcp/compare/v0.0.83...v0.0.84) #### ✨ Highlights - **👥 Separate sessions in one browser** — work with multiple accounts without sharing their cookies or storage. `browser_tabs` with `action: "new"` now accepts `isolatedContext: "<name>"`: tabs with the same name share a context, while different names stay isolated. Omit it or use `"default"` for the default context. Cookie and storage tools operate on the current tab's context. ([microsoft/playwright#43087](https://redirect.github.com/microsoft/playwright/pull/43087)) - **🙈 Redact runtime values in URLs** ([#1791](https://redirect.github.com/microsoft/playwright-mcp/issues/1791)) — session and grant values minted at runtime cannot be listed in a secrets file ahead of time. `--redact-url-params=access_token,code` (config `redactUrlParams`, env `PLAYWRIGHT_MCP_REDACT_URL_PARAMS`) replaces the named query and fragment parameter values with `<redacted>` in tool responses. Like `secrets`, this is a convenience, not a security feature. The extension also removes its connection token from the connect page URL after reading it. ([microsoft/playwright#43258](https://redirect.github.com/microsoft/playwright/pull/43258)) - **🔎 Bound find results** ([microsoft/playwright#42077](https://redirect.github.com/microsoft/playwright/issues/42077)) — common search terms no longer have to fill the response with every match. `browser_find` accepts a positive integer `maxResults`, returns the first matching items with their context, and reports the total match count. Omit it to keep returning all matches; ancestor paths are unchanged. ([microsoft/playwright#42947](https://redirect.github.com/microsoft/playwright/pull/42947)) - **🌐 Inspect requests across navigations** ([microsoft/playwright-cli#479](https://redirect.github.com/microsoft/playwright-cli/issues/479)) — requests from the previous page are no longer lost as soon as a flow navigates. `browser_network_requests` accepts `all: true` to include retained history, keeping up to 200 requests from earlier navigations. Request indexes stay stable across navigations for `browser_network_request`. `browser_console_messages` also reports counts consistent with its existing `all` option. ([microsoft/playwright#43526](https://redirect.github.com/microsoft/playwright/pull/43526)) - **🎯 Use locators in your language** ([#1797](https://redirect.github.com/microsoft/playwright-mcp/issues/1797)) — element tools such as `browser_click` now accept JavaScript, Python, Java and C# locators in `target`, alongside snapshot refs and CSS selectors. Invalid targets get an actionable error, including a reminder to pass the bare ref rather than `button [ref=e5]`. ([microsoft/playwright#43539](https://redirect.github.com/microsoft/playwright/pull/43539)) - **📂 Skip unsupported workspace-root requests** ([#1798](https://redirect.github.com/microsoft/playwright-mcp/issues/1798)) — clients that advertise roots but cannot answer `roots/list` can stall the first tool call. Pass `--ignore-roots` (config `ignoreRoots: true`, env `PLAYWRIGHT_MCP_IGNORE_ROOTS=true`) to skip that request and use the server's current working directory as the workspace root. ([microsoft/playwright#43532](https://redirect.github.com/microsoft/playwright/pull/43532)) - **🍪 Delete cookies by domain and path** — deleting a cookie by name no longer has to remove every cookie with that name. `browser_cookie_delete` (opt-in via `--caps=storage`) accepts optional `domain` and `path` filters to leave other domains and paths untouched. ([microsoft/playwright#43319](https://redirect.github.com/microsoft/playwright/pull/43319)) #### 🐛 Fixes - `fix(mcp): allow combining time, text and textGone in browser_wait_for` — when combined with a text condition, `time` is its timeout (capped at 30 seconds), not a delay before checking it. Supplying both `text` and `textGone` now waits for the first condition to happen, rather than both in sequence. ([microsoft/playwright#43011](https://redirect.github.com/microsoft/playwright/pull/43011)) - `fix(mcp): allow loopback hosts by default for all bind addresses` — HTTP clients can connect through `localhost`, `127.0.0.1` or `[::1]` regardless of the bind address. Other hosts still require `--allowed-hosts`; binding to `0.0.0.0` prints a usable localhost URL. ([microsoft/playwright#42993](https://redirect.github.com/microsoft/playwright/pull/42993)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — credentials embedded in the proxy URL are now passed to the browser as proxy authentication settings. ([microsoft/playwright#43071](https://redirect.github.com/microsoft/playwright/pull/43071)) - `fix(mcp): race browser_navigate_back against modal states` — `browser_navigate_back` reports a dialog opened during history navigation instead of timing out. ([microsoft/playwright#43252](https://redirect.github.com/microsoft/playwright/pull/43252)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `browser_navigate` handles scheme-less hosts with ports and uses HTTP for loopback addresses such as `127.0.0.1:3000` and `[::1]:3000`. ([microsoft/playwright#43264](https://redirect.github.com/microsoft/playwright/pull/43264)) - `fix(mcp): do not close the browser twice when the client disconnects` — stdio disconnects let the browser close gracefully instead of force-killing it through a second close request. Dashboard annotation processes also exit when their parent goes away. ([microsoft/playwright#43174](https://redirect.github.com/microsoft/playwright/pull/43174)) - `fix(mcp): give each isolated client its own idle timer` — with HTTP transport and `--isolated`, an idle client's context now expires even while another client keeps the shared browser busy. ([microsoft/playwright#43527](https://redirect.github.com/microsoft/playwright/pull/43527)) - `fix(mcp): apply route headers without bypassing origin filters` — `browser_route` (opt-in via `--caps=network`) matches added request header names case-insensitively, includes custom headers in mocked responses, and preserves origin filters and other routes when modifying request headers. ([microsoft/playwright#43227](https://redirect.github.com/microsoft/playwright/pull/43227), [microsoft/playwright#43244](https://redirect.github.com/microsoft/playwright/pull/43244), [microsoft/playwright#43637](https://redirect.github.com/microsoft/playwright/pull/43637)) - `fix(mcp): correct cookie filtering and missing-domain errors` — `browser_cookie_list` (opt-in via `--caps=storage`) matches domain and path boundaries instead of unrelated names such as `notexample.com` or `/apiary`. `browser_cookie_set` asks for an explicit `domain` when the current page has no hostname, such as `about:blank`. ([microsoft/playwright#43316](https://redirect.github.com/microsoft/playwright/pull/43316), [microsoft/playwright#43368](https://redirect.github.com/microsoft/playwright/pull/43368), [microsoft/playwright#43318](https://redirect.github.com/microsoft/playwright/pull/43318)) - `fix(mcp): accept Windows paths in browser_resume location` — `browser_resume` (opt-in via `--caps=devtools`) no longer mistakes a Windows drive-letter colon for the line-number separator. ([microsoft/playwright#43349](https://redirect.github.com/microsoft/playwright/pull/43349)) - `fix(mcp): report run-code route handler exceptions once and verbatim` — `browser_run_code_unsafe` reports a route handler's thrown value without duplicating it or wrapping non-Error values in another error. ([microsoft/playwright#43203](https://redirect.github.com/microsoft/playwright/pull/43203)) - `fix(extension): release debugger when attach completes after connection close` — disconnecting while `browser_tabs` attaches to a new tab no longer leaves that tab attached to the extension's debugger. ([microsoft/playwright#43025](https://redirect.github.com/microsoft/playwright/pull/43025)) - `fix(chromium): close pages that crashed before connecting over CDP` — connecting through `--cdp-endpoint` no longer stalls on an already crashed or discarded page; those pages are omitted from the tab list. ([microsoft/playwright#43075](https://redirect.github.com/microsoft/playwright/pull/43075)) - `fix(aria): skip text nodes that are not rendered` — `browser_snapshot` and accessible names omit unrendered text, including unslotted shadow-host text and text directly inside closed `<details>`. ([microsoft/playwright#43150](https://redirect.github.com/microsoft/playwright/pull/43150)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude inert content and content outside the topmost modal `<dialog>`. Click and fill actions wait for targets to stop being inert instead of silently misfiring. ([microsoft/playwright#43211](https://redirect.github.com/microsoft/playwright/pull/43211)) - `fix(aria): do not count whitespace-only contributors as name sources` — snapshots retain button names when whitespace around a hidden icon previously caused the name to disappear. ([microsoft/playwright#43317](https://redirect.github.com/microsoft/playwright/pull/43317)) - `fix(aria): resolve label references consistently` — snapshots and role locators recognize tab- or newline-separated label IDs and labels assigned through `ariaLabelledByElements`, while retaining attribute-based labels in older browsers. ([microsoft/playwright#43361](https://redirect.github.com/microsoft/playwright/pull/43361), [microsoft/playwright#43577](https://redirect.github.com/microsoft/playwright/pull/43577), [microsoft/playwright#43722](https://redirect.github.com/microsoft/playwright/pull/43722)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-like names remain strings rather than being parsed as null or special floating-point values. ([microsoft/playwright#43469](https://redirect.github.com/microsoft/playwright/pull/43469)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots retain an iframe's contents when the iframe element also contains fallback text. ([microsoft/playwright#43635](https://redirect.github.com/microsoft/playwright/pull/43635)) - `fix(aria): match mixed-case roles and states` — snapshots and role locators recognize mixed-case `role` and ARIA state values, including checked, pressed and expanded states. ([microsoft/playwright#43727](https://redirect.github.com/microsoft/playwright/pull/43727)) #### 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.84 ``` ### [`v0.0.83`](https://redirect.github.com/microsoft/playwright-mcp/releases/tag/v0.0.83) [Compare Source](https://redirect.github.com/microsoft/playwright-mcp/compare/v0.0.82...v0.0.83) #### Bug Fixes - `browser_find` takes `filename` to save matches to a file instead of the response ([microsoft/playwright#42077](https://redirect.github.com/microsoft/playwright/issues/42077)). ([microsoft/playwright#42968](https://redirect.github.com/microsoft/playwright/pull/42968)) - `browser_navigate` and `browser_reload` report a dialog opened during page load instead of timing out ([microsoft/playwright#42817](https://redirect.github.com/microsoft/playwright/issues/42817)). ([microsoft/playwright#42908](https://redirect.github.com/microsoft/playwright/pull/42908)) - The server no longer crashes when the browser is closed during a download ([microsoft/playwright#42831](https://redirect.github.com/microsoft/playwright/issues/42831)). ([microsoft/playwright#42922](https://redirect.github.com/microsoft/playwright/pull/42922)) - `browser_wait_for` reports when `time` is capped at 30 seconds ([#1767](https://redirect.github.com/microsoft/playwright-mcp/issues/1767)). ([microsoft/playwright#42932](https://redirect.github.com/microsoft/playwright/pull/42932)) - WebMCP tools no longer stay bound to a stale tab or frame ([microsoft/playwright#42816](https://redirect.github.com/microsoft/playwright/issues/42816)). ([microsoft/playwright#42821](https://redirect.github.com/microsoft/playwright/pull/42821)) - WebMCP tool calls work with Chromium 155+. ([microsoft/playwright#42915](https://redirect.github.com/microsoft/playwright/pull/42915)) - Snapshots quote accessible names that look like regexes, e.g. `"/home/"` ([microsoft/playwright#42807](https://redirect.github.com/microsoft/playwright/issues/42807)). ([microsoft/playwright#42811](https://redirect.github.com/microsoft/playwright/pull/42811)) - The Docker image reaps orphaned browser processes ([#1769](https://redirect.github.com/microsoft/playwright-mcp/issues/1769)). ([#1771](https://redirect.github.com/microsoft/playwright-mcp/pull/1771)) </details> <details> <summary>CodSpeedHQ/action</summary> ### [`v5.6.1`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.6.1) [Compare Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.6.0...v5.6.1) Bumps the CodSpeed runner to [v5.6.1](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.6.1). ##### Fixes - Walltime: the runner no longer hangs after the benchmark exits when a Python process forks and leaves a corrupted perf jitdump ([#599](https://redirect.github.com/CodSpeedHQ/codspeed/pull/599)) - Simulation: stop the libpython symlink warning from firing falsely ([#594](https://redirect.github.com/CodSpeedHQ/codspeed/pull/594)) ##### 🐛 Bug Fixes - Stop the libpython symlink warning from firing falsely by [@not-matthias](https://redirect.github.com/not-matthias) in [#594](https://redirect.github.com/CodSpeedHQ/runner/pull/594) ##### 💼 Other - Bump submodule to not loop on corrupted jit dump by [@GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange) in [#599](https://redirect.github.com/CodSpeedHQ/runner/pull/599) **Full Runner Changelog**: <https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md> #### What's Changed - docs(examples): update the example workflows by [@SuperMuel](https://redirect.github.com/SuperMuel) in [#252](https://redirect.github.com/CodSpeedHQ/action/pull/252) - chore: bump runner version to 5.6.1 by [@github-actions](https://redirect.github.com/github-actions)\[bot] in [#254](https://redirect.github.com/CodSpeedHQ/action/pull/254) #### New Contributors - [@SuperMuel](https://redirect.github.com/SuperMuel) made their first contribution in [#252](https://redirect.github.com/CodSpeedHQ/action/pull/252) **Full Changelog**: <https://github.com/CodSpeedHQ/action/compare/v5.6.0...v5.6.1> ### [`v5.6.0`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.6.0) [Compare Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.5.0...v5.6.0) Bumps the CodSpeed runner to [v5.6.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.6.0). ##### Highlights ##### More consistent CPU Simulation results Changes to your CI environment, like a different path or an extra environment variable, no longer change the performance. Each benchmark now starts with the same memory layout, reducing the chance of false regressions. ##### 🐛 Bug Fixes - Keep the user's `HOME` when wrapping commands with sudo by [@lvaroqui](https://redirect.github.com/lvaroqui) in [#588](https://redirect.github.com/CodSpeedHQ/codspeed/pull/588) ##### ⚙️ Internals - Bump pinned valgrind-codspeed to [3.26.0-0codspeed10](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/releases/tag/3.26.0-0codspeed10) by [@adriencaccia](https://redirect.github.com/adriencaccia) in [#593](https://redirect.github.com/CodSpeedHQ/codspeed/pull/593) - fix(callgrind): suppress L3 warning for explicit LL settings by [@not-matthias](https://redirect.github.com/not-matthias) in [CodSpeedHQ/valgrind-codspeed#52](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/52) - fix(initimg): stabilize Linux startup stack layout by [@not-matthias](https://redirect.github.com/not-matthias) in [CodSpeedHQ/valgrind-codspeed#53](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/53) **Full Runner Changelog**: <https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md> #### What's Changed - chore: bump runner version to 5.6.0 by [@github-actions](https://redirect.github.com/github-actions)\[bot] in [#253](https://redirect.github.com/CodSpeedHQ/action/pull/253) **Full Changelog**: <https://github.com/CodSpeedHQ/action/compare/v5.5.0...v5.6.0> </details> <details> <summary>actions/upload-artifact</summary> ### [`v7.0.2`](https://redirect.github.com/actions/upload-artifact/releases/tag/v7.0.2) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2) #### What's Changed - Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers. - Updates [@actions/artifact](https://redirect.github.com/actions/artifact) to v6.3.1. #### New Contributors - [@tunc-d](https://redirect.github.com/tunc-d) made their first contribution in [#821](https://redirect.github.com/actions/upload-artifact/pull/821) **Full Changelog**: <https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2> </details> <details> <summary>anchore/syft</summary> ### [`v1.55.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.55.0) [Compare Source](https://redirect.github.com/anchore/syft/compare/v1.54.1...v1.55.0) ##### Added Features - Add support for scanning IPK packages using the deb-archive-cataloger \[PR [#5111](https://redirect.github.com/anchore/syft/pull/5111) [@skyhisi](https://redirect.github.com/skyhisi)] ##### Bug Fixes - Pin Gguff lib to prevent dropping packages \[PR [#5447](https://redirect.github.com/anchore/syft/pull/5447) [@spiffcs](https://redirect.github.com/spiffcs)] - Licensing: copyright holder missing, needed for Debian packaging \[Issue [#5394](https://redirect.github.com/anchore/syft/issues/5394)] \[PR [#5414](https://redirect.github.com/anchore/syft/pull/5414) [@wagoodman](https://redirect.github.com/wagoodman)] - Syft cli.Command() panics when invoked multiple times \[Issue [#2285](https://redirect.github.com/anchore/syft/issues/2285)] \[PR [#5386](https://redirect.github.com/anchore/syft/pull/5386) [@JasonMetal](https://redirect.github.com/JasonMetal)] ##### Additional Changes - bump go-make module and action together \[PR [#5415](https://redirect.github.com/anchore/syft/pull/5415) [@wagoodman](https://redirect.github.com/wagoodman)] ##### Dependencies 49 dependency changes (46 updated, 1 added, 2 removed). 5 vulnerabilities remediated. **🟢 Remediated (5)** - [GO-2026-6603](https://go.dev/cl/847185) (High) — golang.org/x/net - [GO-2026-6610](https://go.dev/cl/835145) (High) — golang.org/x/net - [GO-2026-6611](https://go.dev/cl/847186) (High) — golang.org/x/net - [GO-2026-6612](https://go.dev/cl/847187) (Critical) — golang.org/x/net - [GO-2026-6617](https://go.dev/cl/847188) (High) — golang.org/x/net <details> <summary>Updated (46 packages)</summary> - cloud.google.com/go/auth `v0.23.2` → `v0.23.3` - cloud.google.com/go/compute/metadata `v0.9.0` → `v0.9.1` - cloud.google.com/go/storage `v1.65.1` → `v1.68.0` - github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp `v1.33.0` → `v1.34.0` - github.com/aws/aws-sdk-go-v2 `v1.44.0` → `v1.47.1` - github.com/aws/aws-sdk-go-v2/config `v1.32.40` → `v1.33.6` - github.com/aws/aws-sdk-go-v2/credentials `v1.19.39` → `v1.20.6` - github.com/aws/aws-sdk-go-v2/feature/ec2/imds `v1.18.40` → `v1.20.1` - github.com/aws/aws-sdk-go-v2/internal/configsources `v1.4.40` → `v1.5.4` - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 `v2.7.40` → `v2.8.4` - github.com/aws/aws-sdk-go-v2/internal/v4a `v1.4.41` → `v1.5.4` - github.com/aws/aws-sdk-go-v2/service/internal/checksum `v1.10.0` → `v1.11.5` - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url `v1.13.40` → `v1.14.4` - github.com/aws/aws-sdk-go-v2/service/internal/s3shared `v1.19.41` → `v1.20.4` - github.com/aws/aws-sdk-go-v2/service/s3 `v1.108.0` → `v1.114.0` - github.com/aws/aws-sdk-go-v2/service/signin `v1.6.0` → `v1.10.1` - github.com/aws/aws-sdk-go-v2/service/sso `v1.34.0` → `v1.38.1` - github.com/aws/aws-sdk-go-v2/service/ssooidc `v1.39.0` → `v1.43.1` - github.com/aws/aws-sdk-go-v2/service/sts `v1.46.0` → `v1.51.1` - github.com/github/go-spdx/v2 `v2.7.0` → `v2.7.1` - github.com/go-git/go-billy/v5 `v5.9.1` → `v5.9.2` - github.com/go-git/go-git/v5 `v5.19.2` → `v5.19.3` - github.com/google/s2a-go `v0.1.9` → `v0.1.10` - github.com/googleapis/enterprise-certificate-proxy `v0.3.20` → `v0.3.22` - github.com/googleapis/gax-go/v2 `v2.24.0` → `v2.24.1` - github.com/gookit/color `v1.6.1` → `v1.6.2` - github.com/gpustack/gguf-parser-go `v0.26.3` → `v0.26.4` - github.com/hashicorp/go-getter `v1.8.9` → `v1.8.10` - github.com/pb33f/ordered-map/v2 `v2.3.1` → `v2.3.2` - github.com/pjbgf/sha1cd `v0.6.0` → `v0.7.0` - github.com/spiffe/go-spiffe/v2 `v2.7.0` → `v2.8.1` - golang.org/x/crypto `v0.57.0` → `v0.58.0` - golang.org/x/net `v0.59.0` → `v0.61.0` **(🟢 remediated [GO-2026-6603](https://go.dev/cl/847185), [GO-2026-6610](https://go.dev/cl/835145), [GO-2026-6611](https://go.dev/cl/847186), [GO-2026-6612](https://go.dev/cl/847187), [GO-2026-6617](https://go.dev/cl/847188))** - golang.org/x/oauth2 `v0.36.0` → `v0.37.0` - golang.org/x/sync `v0.23.0` → `v0.24.0` - golang.org/x/sys `v0.48.0` → `v0.49.0` - golang.org/x/term `v0.46.0` → `v0.47.0` - golang.org/x/text `v0.42.0` → `v0.43.0` - golang.org/x/tools `v0.50.0` → `v0.51.0` - google.golang.org/api `v0.294.0` → `v0.299.0` - google.golang.org/genproto/googleapis/rpc `v0.0.0-da73d73` → `v0.0.0-b142276` - google.golang.org/grpc `v1.83.2` → `v1.84.0` - modernc.org/cc/v4 `v4.29.2` → `v4.29.7` - modernc.org/ccgo/v4 `v4.35.0` → `v4.36.1` - modernc.org/libc `v1.75.7` → `v1.77.1` - modernc.org/sqlite `v1.59.0` → `v1.60.1` </details> <details> <summary>Added (1 package)</summary> - github.com/pb33f/go-yaml `v0.1.0` </details> <details> <summary>Removed (2 packages)</summary> - github.com/klauspost/cpuid/v2 `v2.3.0` - go.yaml.in/yaml/v4 `v4.0.0-rc.2` </details> **[(Full Changelog)](https://redirect.github.com/anchore/syft/compare/v1.54.1...v1.55.0)** ### [`v1.54.1`](https://redirect.github.com/anchore/syft/releases/tag/v1.54.1) [Compare Source](https://redirect.github.com/anchore/syft/compare/v1.54.0...v1.54.1) ##### Bug Fixes - resolve packages.lock dependencies deterministically \[PR [#5210](https://redirect.github.com/anchore/syft/pull/5210) [@spiffcs](https://redirect.github.com/spiffcs)] - Cannot produce attestation file from local podman image \[Issue [#1664](https://redirect.github.com/anchore/syft/issues/1664)] \[PR [#5368](https://redirect.github.com/anchore/syft/pull/5368) [@Bru456](https://redirect.github.com/Bru456)] ##### Dependencies 9 dependency changes (9 updated). <details> <summary>Updated (9 packages)</summary> - github.com/anchore/go-rpmdb `v0.2.0` → `v0.2.2` - github.com/anchore/stereoscope `v0.3.3` → `v0.3.4` - github.com/docker/cli `v29.8.1+incompatible` → `v29.8.2+incompatible` - github.com/glebarez/go-sqlite `v1.20.3` → `v1.23.0` - github.com/klauspost/compress `v1.20.0` → `v1.20.1` - github.com/secure-systems-lab/go-securesystemslib `v0.11.0` → `v0.11.1` - github.com/sigstore/protobuf-specs `v0.5.1` → `v0.5.2` - github.com/sigstore/sigstore `v1.10.8` → `v1.10.11` - github.com/sylabs/sif/v2 `v2.24.1` → `v2.24.2` </details> **[(Full Changelog)](https://redirect.github.com/anchore/syft/compare/v1.54.0...v1.54.1)** ### [`v1.54.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.54.0) [Compare Source](https://redirect.github.com/anchore/syft/compare/v1.52.0...v1.54.0) ##### Added Features - report the perl interpreter as a cpan package \[PR [#5132](https://redirect.github.com/anchore/syft/pull/5132) [@wagoodman](https://redirect.github.com/wagoodman)] - Add package cataloger for perl ecosystem \[Issue [#1906](https://redirect.github.com/anchore/syft/issues/1906)] \[PR [#5131](https://redirect.github.com/anchore/syft/pull/5131) [@wagoodman](https://redirect.github.com/wagoodman)] - Analyze with Non-Daemon podman \[Issue [#1173](https://redirect.github.com/anchore/syft/issues/1173)] ##### Bug Fixes - write a name for the root package when the source has none \[PR [#5349](https://redirect.github.com/anchore/syft/pull/5349) [@DrVelvetFog](https://redirect.github.com/DrVelvetFog)] - match opensource.org license URLs across SPDX URL forms \[PR [#5361](https://redirect.github.com/anchore/syft/pull/5361) [@willmurphyscode](https://redirect.github.com/willmurphyscode)] - Account for malformed GGUF and safetensors parameter counts \[PR [#5343](https://redirect.github.com/anchore/syft/pull/5343) [@wagoodman](https://redirect.github.com/wagoodman)] - don't panic on a root file without a supplier or null entries \[PR [#5326](https://redirect.github.com/anchore/syft/pull/5326) [@DrVelvetFog](https://redirect.github.com/DrVelvetFog)] - do not panic on a stack.yaml rev pin \[PR [#5310](https://redirect.github.com/anchore/syft/pull/5310) [@arpitjain099](https://redirect.github.com/arpitjain099)] - report scanner errors and raise the line cap in metadata parsers \[PR [#5353](https://redirect.github.com/anchore/syft/pull/5353) [@wagoodman](https://redirect.github.com/wagoodman)] - Harden cataloger parsers against truncated input (do not panic) \[PR [#5355](https://redirect.github.com/anchore/syft/pull/5355) [@wagoodman](https://redirect.github.com/wagoodman)] - bound CPE candidate generation for pathological package metadata \[PR [#5356](https://redirect.github.com/anchore/syft/pull/5356) [@wagoodman](https://redirect.github.com/wagoodman)] - account for UPX's loader padding when unpacking Go binaries \[PR [#5347](https://redirect.github.com/anchore/syft/pull/5347) [@huuyafwww](https://redirect.github.com/huuyafwww)] - handle malformed GGUF headers without panicking \[PR [#5345](https://redirect.github.com/anchore/syft/pull/5345) [@wagoodman](https://redirect.github.com/wagoodman)] - bound model companion file reads and validate their contents \[PR [#5344](https://redirect.github.com/anchore/syft/pull/5344) [@wagoodman](https://redirect.github.com/wagoodman)] - don't fail the whole SBOM when a cataloger panics on one file \[PR [#5342](https://redirect.github.com/anchore/syft/pull/5342) [@wagoodman](https://redirect.github.com/wagoodman)] - release package collection lock in Ubuntu ESM detection \[PR [#5336](https://redirect.github.com/anchore/syft/pull/5336) [@sverrirsig](https://redirect.github.com/sverrirsig)] - render TUI log lines on their own rows, with colors and a small header \[PR [#5324](https://redirect.github.com/anchore/syft/pull/5324) [@wagoodman](https://redirect.github.com/wagoodman)] - uv.lock: dependents are linked to every locked version of a dependency \[Issue [#5340](https://redirect.github.com/anchore/syft/issues/5340)] \[PR [#5351](https://redirect.github.com/anchore/syft/pull/5351) [@devtechedge](https://redirect.github.com/devtechedge)] - java-archive-cataloger maps Apache Groovy 4+ (org.apache.groovy) to obsolete org.codehaus.groovy \[Issue [#5311](https://redirect.github.com/anchore/syft/issues/5311)] \[PR [#5313](https://redirect.github.com/anchore/syft/pull/5313) [@texasich](https://redirect.github.com/texasich)] - Support traefik binary various versions \[Issue [#4980](https://redirect.github.com/anchore/syft/issues/4980)] \[PR [#5281](https://redirect.github.com/anchore/syft/pull/5281) [@mayanksekhar](https://redirect.github.com/mayanksekhar)] - File Digests Remain at Zero, No Hashes Available Despite .syft.yaml Settings Should Support \[Issue [#5325](https://redirect.github.com/anchore/syft/issues/5325)] \[PR [#5341](https://redirect.github.com/anchore/syft/pull/5341) [@wagoodman](https://redirect.github.com/wagoodman)] - not showing expat CVEs from syft generated sbom \[Issue [#4771](https://redirect.github.com/anchore/syft/issues/4771)] \[PR [#5259](https://redirect.github.com/anchore/syft/pull/5259) [@KR-Ravindra](https://redirect.github.com/KR-Ravindra)] - PHP extensions are cataloged as upstream products using the PHP version \[Issue [#5014](https://redirect.github.com/anchore/syft/issues/5014)] \[PR [#5102](https://redirect.github.com/anchore/syft/pull/5102) [@pujitha24](https://redirect.github.com/pujitha24)] - Panic during scanning with gguf-cataloger/safetensors-cataloger \[Issue [#5327](https://redirect.github.com/anchore/syft/issues/5327)] \[PR [#5328](https://redirect.github.com/anchore/syft/pull/5328) [@tk1475](https://redirect.github.com/tk1475)] - github-actions cataloger emits an invalid PURL for docker:// use statements \[Issue [#5299](https://redirect.github.com/anchore/syft/issues/5299)] \[PR [#5302](https://redirect.github.com/anchore/syft/pull/5302) [@yunaremaia](https://redirect.github.com/yunaremaia)] - Crash when running syft on a directory that is the root file system of a Yocto build \[Issue [#5320](https://redirect.github.com/anchore/syft/issues/5320)] \[PR [#5321](https://redirect.github.com/anchore/syft/pull/5321) [@somaz94](https://redirect.github.com/somaz94)] - Invalid PURLs when cataloging instrumentation classes/jars \[Issue [#2596](https://redirect.github.com/anchore/syft/issues/2596)] ##### Dependencies 79 dependency changes (48 updated, 28 added, 3 removed). 2 vulnerabilities remediated. **🟢 Remediated (2)** - [GHSA-8wmf-6v46-5gfg](https://redirect.github.com/advisories/GHSA-8wmf-6v46-5gfg) (Low) — go.opentelemetry.io/otel/sdk - [GHSA-pg57-6jwg-q645](https://redirect.github.com/advisories/GHSA-pg57-6jwg-q645) (Medium) — github.com/containerd/containerd/v2 **Toolchains (1)** - Go minimum version: `1.26.3` → `1.26.8` <details> <summary>Updated (48 packages)</summary> - github.com/Microsoft/hcsshim `v0.15.0-rc.1` → `v0.15.0-rc.4` - github.com/anchore/bubbly `v0.2.1` → `v0.2.2` - github.com/anchore/go-logger `v0.1.1` → `v0.2.0` - github.com/anchore/stereoscope `v0.3.2` → `v0.3.3` - github.com/bmatcuk/doublestar/v4 `v4.10.0` → `v4.10.2` - github.com/containerd/containerd/api `v1.11.1` → `v1.12.0` - github.com/containerd/containerd/v2 `v2.3.5` → `v2.4.1` **(🟢 remediated [GHSA-pg57-6jwg-q645](https://redirect.github.com/advisories/GHSA-pg57-6jwg-q645))** - github.com/containerd/log `v0.1.0` → `v0.2.0` - github.com/containerd/ttrpc `v1.2.8` → `v1.2.9` - github.com/containerd/typeurl/v2 `v2.2.3` → `v2.3.0` - github.com/cyphar/filepath-securejoin `v0.6.1` → `v0.7.0` - github.com/docker/cli `v29.8.0+incompatible` → `v29.8.1+incompatible` - github.com/docker/docker-credential-helpers `v0.9.5` → `v0.9.8` - github.com/dustin/go-humanize `v1.0.1` → `v1.1.0` - github.com/erofs/go-erofs `v0.3.0` → `v0.3.1` - github.com/felixge/httpsnoop `v1.0.4` → `v1.1.0` - github.com/fsnotify/fsnotify `v1.9.0` → `v1.10.1` - github.com/go-jose/go-jose/v4 `v4.1.4` → `v4.1.5` - github.com/go-logr/logr `v1.4.3` → `v1.4.4` - github.com/hashicorp/hcl/v2 `v2.24.0` → `v2.25.0` - github.com/magiconair/properties `v1.18.11` → `v1.18.12` - github.com/mattn/go-runewidth `v0.0.21` → `v0.0.27` - github.com/moby/sys/user `v0.4.0` → `v0.4.1` - github.com/moby/sys/userns `v0.1.0` → `v0.2.1` - github.com/nwaples/rardecode/v2 `v2.2.0` → `v2.4.1` - github.com/olekukonko/tablewriter `v1.1.4` → `v1.1.5` - github.com/sirupsen/logrus `v1.9.4` → `v1.10.2` - github.com/ulikunitz/xz `v0.5.16` → `v0.5.17` - github.com/zclconf/go-cty `v1.16.3` → `v1.19.0` - go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc `v0.68.0` → `v0.71.0` - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp `v0.68.0` → `v0.71.0` - go.opentelemetry.io/otel `v1.44.0` → `v1.46.0` - go.opentelemetry.io/otel/metric `v1.44.0` → `v1.46.0` - go.opentelemetry.io/otel/metric/x `v0.66.0` → `v0.68.0` - go.opentelemetry.io/otel/sdk `v1.44.0` → `v1.46.0` **(🟢 remediated [GHSA-8wmf-6v46-5gfg](https://redirect.github.com/advisories/GHSA-8wmf-6v46-5gfg))** - go.opentelemetry.io/otel/sdk/metric `v1.44.0` → `v1.46.0` - go.opentelemetry.io/otel/trace `v1.44.0` → `v1.46.0` - golang.org/x/crypto `v0.56.0` → `v0.57.0` - golang.org/x/net `v0.58.0` → `v0.59.0` - golang.org/x/sync `v0.22.0` → `v0.23.0` - golang.org/x/sys `v0.47.0` → `v0.48.0` - golang.org/x/term `v0.45.0` → `v0.46.0` - golang.org/x/text `v0.41.0` → `v0.42.0` - golang.org/x/tools `v0.49.0` → `v0.50.0` - google.golang.org/genproto/googleapis/api `v0.0.0-e75dac1` → `v0.0.0-da73d73` - google.golang.org/genproto/googleapis/rpc `v0.0.0-08b0e42` → `v0.0.0-da73d73` - modernc.org/libc `v1.75.6` → `v1.75.7` - modernc.org/sqlite `v1.58.0` → `v1.59.0` </details> <details> <summary>Added (28 packages)</summary> - cyphar.com/go-pathrs `v0.2.5` - github.com/VividCortex/ewma `v1.2.0` - github.com/apparentlymart/go-textseg/v17 `v17.0.1` - github.com/containerd/log/otel `v0.1.0` - github.com/containerd/stargz-snapshotter/estargz `v0.18.2` - github.com/containers/libtrust `v0.0.0-c1716e8` - github.com/containers/ocicrypt `v1.3.2` - github.com/cyberphone/json-canonicalization `v0.0.0-19d51d7` - github.com/google/go-intervals `v0.0.2` - github.com/mattn/go-sqlite3 `v1.14.48` - github.com/miekg/pkcs11 `v1.1.2` - github.com/mistifyio/go-zfs/v4 `v4.0.0` - github.com/moby/sys/capability `v0.4.0` - github.com/opencontainers/selinux `v1.15.1` - github.com/proglottis/gpgme `v0.1.6` - github.com/secure-systems-lab/go-securesystemslib `v0.11.0` - github.com/sigstore/fulcio `v1.8.7` - github.com/sigstore/protobuf-specs `v0.5.1` - github.com/sigstore/sigstore `v1.10.8` - github.com/smallstep/pkcs7 `v0.2.1` - github.com/stefanberger/go-pkcs11uri `v0.0.0-7828495` - github.com/tchap/go-patricia/v2 `v2.3.3` - github.com/vbatts/tar-split `v0.12.3` - github.com/vbauerster/cupwriter `v0.0.4` - github.com/vbauerster/mpb/v8 `v8.14.0` - github.com/youmark/pkcs8 `v0.0.0-a2c0da2` - go.podman.io/image/v5 `v5.41.2` - go.podman.io/storage `v1.64.1` </details> <details> <summary>Removed (3 packages)</summary> - github.com/gogo/protobuf `v1.3.2` - github.com/moby/sys/sequential `v0.6.0` - go.opencensus.io `v0.24.0` </details> **[(Full Changelog)](https://redirect.github.com/anchore/syft/compare/v1.52.0...v1.54.0)** </details> <details> <summary>aquasecurity/trivy (aquasec/trivy)</summary> ### [`v0.76.1`](https://redirect.github.com/aquasecurity/trivy/releases/tag/v0.76.1) [Compare Source](https://redirect.github.com/aquasecurity/trivy/compare/v0.76.0...v0.76.1) #### 🔐 Security update: eMudhra CA incident 🛡️ Trivy v0.76.1 includes mitigations for the [eMudhra intermediate CA key compromise](https://blog.cloudflare.com/emudhra-certificate-compromise/). - Official binaries are built with Go 1.27.3, which includes the certificate distrust mitigation tracked as [CVE-2026-111943](https://go.dev/issue/82345). - Official container images include an updated Alpine CA trust store that rejects the affected certificate chains. We recommend upgrading to v0.76.1 and redeploying container images to apply these updates. If you build Trivy from source, use Go 1.27.3 or later and keep your runtime CA trust store up to date. #### Changelog - [`e713f67`](https://redirect.github.com/aquasecurity/trivy/commit/e713f67f7d54decdcd9b3132c9751833dcced698) release: v0.76.1 \[release/v0.76] ([#11445](https://redirect.github.com/aquasecurity/trivy/issues/11445)) - [`6647bd6`](https://redirect.github.com/aquasecurity/trivy/commit/6647bd6ec5924087956285b773b8cae10508736e) fix(deps): bump the aws group across 1 directory with 6 updates \[backport: release/v0.76] ([#11446](https://redirect.github.com/aquasecurity/trivy/issues/11446)) - [`e0964c9`](https://redirect.github.com/aquasecurity/trivy/commit/e0964c97819b1d6a45b7e0426803745f173fc550) fix(deps): bump the docker group with 3 updates \[backport: release/v0.76] ([#11443](https://redirect.github.com/aquasecurity/trivy/issues/11443)) - [`992c360`](https://redirect.github.com/aquasecurity/trivy/commit/992c360c33d9f9627bb24c1fe3f20815110c88e5) fix(deps): bump the common group with 3 updates \[backport: release/v0.76] ([#11442](https://redirect.github.com/aquasecurity/trivy/issues/11442)) </details> <details> <summary>astral-sh/ruff-pre-commit</summary> ### [`v0.17.3`](https://redirect.github.com/astral-sh/ruff-pre-commit/releases/tag/v0.17.3) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.17.2...v0.17.3) See: <https://github.com/astral-sh/ruff/releases/tag/0.17.3> ### [`v0.17.2`](https://redirect.github.com/astral-sh/ruff-pre-commit/releases/tag/v0.17.2) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.17.1...v0.17.2) See: <https://github.com/astral-sh/ruff/releases/tag/0.17.2> ### [`v0.17.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/releases/tag/v0.17.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.17.0...v0.17.1) See: <https://github.com/astral-sh/ruff/releases/tag/0.17.1> ### [`v0.17.0`](https://redirect.github.com/astral-sh/ruff-pre-commit/releases/tag/v0.17.0) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.10...v0.17.0) See: <https://github.com/astral-sh/ruff/releases/tag/0.17.0> ### [`v0.16.10`](https://redirect.github.com/astral-sh/ruff-pre-commit/releases/tag/v0.16.10) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.9...v0.16.10) See: <https://github.com/astral-sh/ruff/releases/tag/0.16.10> ### [`v0.16.9`](https://redirect.github.com/astral-sh/ruff-pre-commit/releases/tag/v0.16.9) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.8...v0.16.9) See: <https://github.com/astral-sh/ruff/releases/tag/0.16.9> </details> <details> <summary>astral-sh/setup-uv</summary> ### [`v10.3.3`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.3.3): 🌈 Use Astral mirror for version manifests with GitHub fallback [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.3.2...v10.3.3) ##### Changes This release contains something that should have been included a very long time ago. Sorry for sleeping on that. This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change) Also a big thank you to [@soujasK](https://redirect.github.com/soujasK) for a set of bugfixes 👏 ##### 🐛 Bug fixes - Use Astral mirror for version manifests with GitHub fallback [@eifinger](https://redirect.github.com/eifinger) ([#1119](https://redirect.github.com/astral-sh/setup-uv/issues/1119)) - fix: allow whitespace in uv requirement specifiers [@soujasK](https://redirect.github.com/soujasK) ([#1112](https://redirect.github.com/astral-sh/setup-uv/issues/1112)) - fix: resolve \~= specifiers with PEP 440 semantics [@soujasK](https://redirect.github.com/soujasK) ([#1111](https://redirect.github.com/astral-sh/setup-uv/issues/1111)) - fix: only report a saved cache when saving succeeded [@soujasK](https://redirect.github.com/soujasK) ([#1110](https://redirect.github.com/astral-sh/setup-uv/issues/1110)) ##### 🧰 Maintenance - chore: update known checksums for 0.13.6 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1117](https://redirect.github.com/astral-sh/setup-uv/issues/1117)) ##### 📚 Documentation - docs: use JSDoc for compatible release specifier comment [@eifinger](https://redirect.github.com/eifinger) ([#1113](https://redirect.github.com/astral-sh/setup-uv/issues/1113)) - docs: update version references to v10.3.2 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1104](https://redirect.github.com/astral-sh/setup-uv/issues/1104)) ### [`v10.3.2`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.3.2): 🌈 update known checksums for 0.13.5 [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.3.1...v10.3.2) ##### Changes ##### 🧰 Maintenance - chore: update known checksums for 0.13.5 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1103](https://redirect.github.com/astral-sh/setup-uv/issues/1103)) ##### 📚 Documentation - docs: update version references to v10.3.1 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1102](https://redirect.github.com/astral-sh/setup-uv/issues/1102)) ### [`v10.3.1`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.3.0...v10.3.1) > [!IMPORTANT] > ✂ PR body was truncated to here. --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: crazyracer98 <8631139+crazyracer98@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@playwright/mcp](https://playwright.dev) ([source](https://redirect.github.com/microsoft/playwright-mcp)) | [`0.0.83` → `0.0.85`](https://renovatebot.com/diffs/npm/@playwright%2fmcp/0.0.83/0.0.85) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@playwright%2fmcp/0.0.85?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@playwright%2fmcp/0.0.83/0.0.85?slim=true) | --- ### Release Notes <details> <summary>microsoft/playwright-mcp (@playwright/mcp)</summary> ### [`v0.0.85`](https://redirect.github.com/microsoft/playwright-mcp/releases/tag/v0.0.85) [Compare Source](https://redirect.github.com/microsoft/playwright-mcp/compare/v0.0.84...v0.0.85) #### ✨ Highlights - **🌙 Keep the browser in the background** ([microsoft/playwright#42973](https://redirect.github.com/microsoft/playwright/issues/42973)) — connecting through the extension activated the tab and focused the browser window, taking the screen from the app you were working in. Pass `--background` alongside `--extension` (config `background: true`, env `PLAYWRIGHT_MCP_BACKGROUND=1`) to leave the connected tab inactive and its window unfocused, and to open the client's new tabs in the background. With `PLAYWRIGHT_MCP_EXTENSION_TOKEN` set, the connect page opens in the background too (Chrome 158.0.8127.2 or later, with the browser already running). Requires extension 0.5.0 or later. Chrome throttles timers and animation frames in background tabs. ([microsoft/playwright#43864](https://redirect.github.com/microsoft/playwright/pull/43864)) - **🗂️ Leave tabs out of the Playwright tab group** ([microsoft/playwright#43038](https://redirect.github.com/microsoft/playwright/issues/43038)) — the extension always moved the tabs a client controls into its own tab group. Pass `--no-tab-group` alongside `--extension` (config `tabGroup: false`, env `PLAYWRIGHT_MCP_NO_TAB_GROUP=1`) to keep the selected tab and the tabs the client opens in their existing groups, if any. Connection approval is unchanged, each controlled tab still belongs to one client, and the extension's status page lists the controlled tabs. Requires extension 0.5.0 or later. ([microsoft/playwright#43814](https://redirect.github.com/microsoft/playwright/pull/43814)) - **👁️ Match only visible elements** ([microsoft/playwright#43855](https://redirect.github.com/microsoft/playwright/issues/43855)) — a locator could resolve to a hidden element, or fail because a hidden duplicate matched as well. Set `browser.contextOptions.locateOnlyVisible: true` in the config file to restrict locators to visible elements, both in the `target` of element tools such as `browser_click` and in `browser_run_code_unsafe`, as if `.filter({ visible: true })` ended each of them. A locator that ends with its own visibility filter keeps it. Off by default. ([microsoft/playwright#43903](https://redirect.github.com/microsoft/playwright/pull/43903)) - **🏷️ Keep container names in snapshots** ([microsoft/playwright#43809](https://redirect.github.com/microsoft/playwright/issues/43809)) — dialogs, landmarks and tables could appear unnamed even when their heading or caption was visible. `browser_snapshot` now retains identifying names on containers and table headers when the text supplying the name also appears among their children. ([microsoft/playwright#43810](https://redirect.github.com/microsoft/playwright/pull/43810)) - **🎯 Find custom form controls by label** ([microsoft/playwright#43898](https://redirect.github.com/microsoft/playwright/issues/43898)) — native `<label>` associations were ignored for form-associated custom elements. Element tools now recognize these controls through targets such as `getByLabel('City')`, and accessible names use the associated labels too. Both `for` attributes and nested labels are supported. ([microsoft/playwright#43900](https://redirect.github.com/microsoft/playwright/pull/43900)) #### 🐛 Fixes - `fix(aria): restore snapshot visibility rules for inert and modal content` — the filtering announced in v0.0.84 is reverted: `browser_snapshot` no longer hides content solely because it is inert or outside a modal dialog. Click, fill and select actions still wait for explicitly inert targets to become non-inert ([microsoft/playwright#43792](https://redirect.github.com/microsoft/playwright/issues/43792)). ([microsoft/playwright#43850](https://redirect.github.com/microsoft/playwright/pull/43850), [microsoft/playwright#43851](https://redirect.github.com/microsoft/playwright/pull/43851)) - `fix(mcp): preserve non-JSON evaluation results` — `browser_evaluate` returns readable representations of values such as BigInt, `NaN`, `Infinity`, `undefined` and circular objects instead of losing values or failing JSON serialization. JSON-compatible results keep their existing format ([#1838](https://redirect.github.com/microsoft/playwright-mcp/issues/1838)). ([microsoft/playwright#43973](https://redirect.github.com/microsoft/playwright/pull/43973)) - `fix(mcp): resolve config file paths relative to their source` — profile, executable, storage-state, output and other file paths in a config resolve against that file's directory, or its target's directory for a symlink. CLI and environment paths remain relative to the working directory. Extension connections also honor the merged executable-path configuration ([#1836](https://redirect.github.com/microsoft/playwright-mcp/issues/1836)). ([microsoft/playwright#43970](https://redirect.github.com/microsoft/playwright/pull/43970)) - `fix(extension): report lost tab instead of crashing` — tool responses report when a page closes before its snapshot can be captured. Extension connections also explain that Chrome may have detached the debugger because of an unsupported frame, rather than crashing response rendering ([microsoft/playwright#43230](https://redirect.github.com/microsoft/playwright/issues/43230)). ([microsoft/playwright#43863](https://redirect.github.com/microsoft/playwright/pull/43863)) - `fix(mcp): bound settle waits when page timers cannot run` — tool calls no longer hang during their settling delay when page timers are throttled, paused or otherwise unable to run ([microsoft/playwright#43752](https://redirect.github.com/microsoft/playwright/issues/43752)). ([microsoft/playwright#43767](https://redirect.github.com/microsoft/playwright/pull/43767)) - `fix(mcp): report event listener exceptions as console errors` — exceptions from page and context listeners installed through `browser_run_code_unsafe` appear in tool responses and `browser_console_messages` instead of escaping as unhandled errors ([microsoft/playwright#43770](https://redirect.github.com/microsoft/playwright/issues/43770)). ([microsoft/playwright#43686](https://redirect.github.com/microsoft/playwright/pull/43686)) - `fix(mcp): validate device names and preserve device descriptors` — unknown `--device` values produce an explicit error, and per-client overrides no longer mutate shared device presets ([#1834](https://redirect.github.com/microsoft/playwright-mcp/issues/1834)). ([microsoft/playwright#43971](https://redirect.github.com/microsoft/playwright/pull/43971)) - `fix(mcp): report one-based console source lines` — source locations in `browser_console_messages` and console entries in tool responses now use editor-style line numbers starting at 1 ([#1839](https://redirect.github.com/microsoft/playwright-mcp/issues/1839)). ([microsoft/playwright#43975](https://redirect.github.com/microsoft/playwright/pull/43975)) - `fix(mcp): clarify screenshot actions with vision tools` — the `browser_take_screenshot` description no longer rules out acting on a screenshot. `browser_snapshot` stays the default for actions; with `--caps=vision`, the description points to the coordinate-based mouse tools for elements that the snapshot does not expose, such as canvas content ([#1816](https://redirect.github.com/microsoft/playwright-mcp/issues/1816)). ([microsoft/playwright#43857](https://redirect.github.com/microsoft/playwright/pull/43857)) - `fix(aria): match mixed-case selected options in accessible names` — snapshots and role locators include the selected option's text when a custom listbox uses a mixed-case value such as `aria-selected="TRUE"` ([microsoft/playwright#43785](https://redirect.github.com/microsoft/playwright/issues/43785)). ([microsoft/playwright#43787](https://redirect.github.com/microsoft/playwright/pull/43787)) - `fix(chromium): preserve fonts when connecting with noDefaults` — extension connections no longer overwrite the existing browser's font settings, avoiding unexpected changes to page rendering ([microsoft/playwright#43715](https://redirect.github.com/microsoft/playwright/issues/43715)). ([microsoft/playwright#43773](https://redirect.github.com/microsoft/playwright/pull/43773)) - `fix(chromium): honor Linux config directories for channel connections` — extension profile lookup respects `CHROME_USER_DATA_DIR`, `CHROME_CONFIG_HOME` and `XDG_CONFIG_HOME`. Channel-based `--cdp-endpoint` connections also use the WebSocket path advertised in `DevToolsActivePort` ([microsoft/playwright#43880](https://redirect.github.com/microsoft/playwright/issues/43880)). ([microsoft/playwright#43884](https://redirect.github.com/microsoft/playwright/pull/43884)) - `fix(chromium): preserve HTTP navigations across HTTPS upgrade modes` — in browsers launched by the server, `browser_navigate` keeps HTTP URLs on HTTP instead of Chrome automatically upgrading them to HTTPS ([microsoft/playwright#43871](https://redirect.github.com/microsoft/playwright/issues/43871)). ([microsoft/playwright#43877](https://redirect.github.com/microsoft/playwright/pull/43877)) - `fix(chromium): account for tabs and toolbar in the new headless mode` — with `--headless`, Chrome and Edge now size their window to fit the viewport below the tab strip and toolbar, so videos from `browser_start_video` (opt-in via `--caps=devtools`) no longer lose the bottom of the page. ([microsoft/playwright#43904](https://redirect.github.com/microsoft/playwright/pull/43904)) - `fix(screenshot): support full-page SVG documents` — `browser_take_screenshot` with `fullPage: true` works on standalone SVG documents instead of waiting for a nonexistent HTML body ([microsoft/playwright#43962](https://redirect.github.com/microsoft/playwright/issues/43962)). ([microsoft/playwright#43972](https://redirect.github.com/microsoft/playwright/pull/43972)) ### [`v0.0.84`](https://redirect.github.com/microsoft/playwright-mcp/releases/tag/v0.0.84) [Compare Source](https://redirect.github.com/microsoft/playwright-mcp/compare/v0.0.83...v0.0.84) #### ✨ Highlights - **👥 Separate sessions in one browser** — work with multiple accounts without sharing their cookies or storage. `browser_tabs` with `action: "new"` now accepts `isolatedContext: "<name>"`: tabs with the same name share a context, while different names stay isolated. Omit it or use `"default"` for the default context. Cookie and storage tools operate on the current tab's context. ([microsoft/playwright#43087](https://redirect.github.com/microsoft/playwright/pull/43087)) - **🙈 Redact runtime values in URLs** ([#1791](https://redirect.github.com/microsoft/playwright-mcp/issues/1791)) — session and grant values minted at runtime cannot be listed in a secrets file ahead of time. `--redact-url-params=access_token,code` (config `redactUrlParams`, env `PLAYWRIGHT_MCP_REDACT_URL_PARAMS`) replaces the named query and fragment parameter values with `<redacted>` in tool responses. Like `secrets`, this is a convenience, not a security feature. The extension also removes its connection token from the connect page URL after reading it. ([microsoft/playwright#43258](https://redirect.github.com/microsoft/playwright/pull/43258)) - **🔎 Bound find results** ([microsoft/playwright#42077](https://redirect.github.com/microsoft/playwright/issues/42077)) — common search terms no longer have to fill the response with every match. `browser_find` accepts a positive integer `maxResults`, returns the first matching items with their context, and reports the total match count. Omit it to keep returning all matches; ancestor paths are unchanged. ([microsoft/playwright#42947](https://redirect.github.com/microsoft/playwright/pull/42947)) - **🌐 Inspect requests across navigations** ([microsoft/playwright-cli#479](https://redirect.github.com/microsoft/playwright-cli/issues/479)) — requests from the previous page are no longer lost as soon as a flow navigates. `browser_network_requests` accepts `all: true` to include retained history, keeping up to 200 requests from earlier navigations. Request indexes stay stable across navigations for `browser_network_request`. `browser_console_messages` also reports counts consistent with its existing `all` option. ([microsoft/playwright#43526](https://redirect.github.com/microsoft/playwright/pull/43526)) - **🎯 Use locators in your language** ([#1797](https://redirect.github.com/microsoft/playwright-mcp/issues/1797)) — element tools such as `browser_click` now accept JavaScript, Python, Java and C# locators in `target`, alongside snapshot refs and CSS selectors. Invalid targets get an actionable error, including a reminder to pass the bare ref rather than `button [ref=e5]`. ([microsoft/playwright#43539](https://redirect.github.com/microsoft/playwright/pull/43539)) - **📂 Skip unsupported workspace-root requests** ([#1798](https://redirect.github.com/microsoft/playwright-mcp/issues/1798)) — clients that advertise roots but cannot answer `roots/list` can stall the first tool call. Pass `--ignore-roots` (config `ignoreRoots: true`, env `PLAYWRIGHT_MCP_IGNORE_ROOTS=true`) to skip that request and use the server's current working directory as the workspace root. ([microsoft/playwright#43532](https://redirect.github.com/microsoft/playwright/pull/43532)) - **🍪 Delete cookies by domain and path** — deleting a cookie by name no longer has to remove every cookie with that name. `browser_cookie_delete` (opt-in via `--caps=storage`) accepts optional `domain` and `path` filters to leave other domains and paths untouched. ([microsoft/playwright#43319](https://redirect.github.com/microsoft/playwright/pull/43319)) #### 🐛 Fixes - `fix(mcp): allow combining time, text and textGone in browser_wait_for` — when combined with a text condition, `time` is its timeout (capped at 30 seconds), not a delay before checking it. Supplying both `text` and `textGone` now waits for the first condition to happen, rather than both in sequence. ([microsoft/playwright#43011](https://redirect.github.com/microsoft/playwright/pull/43011)) - `fix(mcp): allow loopback hosts by default for all bind addresses` — HTTP clients can connect through `localhost`, `127.0.0.1` or `[::1]` regardless of the bind address. Other hosts still require `--allowed-hosts`; binding to `0.0.0.0` prints a usable localhost URL. ([microsoft/playwright#42993](https://redirect.github.com/microsoft/playwright/pull/42993)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — credentials embedded in the proxy URL are now passed to the browser as proxy authentication settings. ([microsoft/playwright#43071](https://redirect.github.com/microsoft/playwright/pull/43071)) - `fix(mcp): race browser_navigate_back against modal states` — `browser_navigate_back` reports a dialog opened during history navigation instead of timing out. ([microsoft/playwright#43252](https://redirect.github.com/microsoft/playwright/pull/43252)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `browser_navigate` handles scheme-less hosts with ports and uses HTTP for loopback addresses such as `127.0.0.1:3000` and `[::1]:3000`. ([microsoft/playwright#43264](https://redirect.github.com/microsoft/playwright/pull/43264)) - `fix(mcp): do not close the browser twice when the client disconnects` — stdio disconnects let the browser close gracefully instead of force-killing it through a second close request. Dashboard annotation processes also exit when their parent goes away. ([microsoft/playwright#43174](https://redirect.github.com/microsoft/playwright/pull/43174)) - `fix(mcp): give each isolated client its own idle timer` — with HTTP transport and `--isolated`, an idle client's context now expires even while another client keeps the shared browser busy. ([microsoft/playwright#43527](https://redirect.github.com/microsoft/playwright/pull/43527)) - `fix(mcp): apply route headers without bypassing origin filters` — `browser_route` (opt-in via `--caps=network`) matches added request header names case-insensitively, includes custom headers in mocked responses, and preserves origin filters and other routes when modifying request headers. ([microsoft/playwright#43227](https://redirect.github.com/microsoft/playwright/pull/43227), [microsoft/playwright#43244](https://redirect.github.com/microsoft/playwright/pull/43244), [microsoft/playwright#43637](https://redirect.github.com/microsoft/playwright/pull/43637)) - `fix(mcp): correct cookie filtering and missing-domain errors` — `browser_cookie_list` (opt-in via `--caps=storage`) matches domain and path boundaries instead of unrelated names such as `notexample.com` or `/apiary`. `browser_cookie_set` asks for an explicit `domain` when the current page has no hostname, such as `about:blank`. ([microsoft/playwright#43316](https://redirect.github.com/microsoft/playwright/pull/43316), [microsoft/playwright#43368](https://redirect.github.com/microsoft/playwright/pull/43368), [microsoft/playwright#43318](https://redirect.github.com/microsoft/playwright/pull/43318)) - `fix(mcp): accept Windows paths in browser_resume location` — `browser_resume` (opt-in via `--caps=devtools`) no longer mistakes a Windows drive-letter colon for the line-number separator. ([microsoft/playwright#43349](https://redirect.github.com/microsoft/playwright/pull/43349)) - `fix(mcp): report run-code route handler exceptions once and verbatim` — `browser_run_code_unsafe` reports a route handler's thrown value without duplicating it or wrapping non-Error values in another error. ([microsoft/playwright#43203](https://redirect.github.com/microsoft/playwright/pull/43203)) - `fix(extension): release debugger when attach completes after connection close` — disconnecting while `browser_tabs` attaches to a new tab no longer leaves that tab attached to the extension's debugger. ([microsoft/playwright#43025](https://redirect.github.com/microsoft/playwright/pull/43025)) - `fix(chromium): close pages that crashed before connecting over CDP` — connecting through `--cdp-endpoint` no longer stalls on an already crashed or discarded page; those pages are omitted from the tab list. ([microsoft/playwright#43075](https://redirect.github.com/microsoft/playwright/pull/43075)) - `fix(aria): skip text nodes that are not rendered` — `browser_snapshot` and accessible names omit unrendered text, including unslotted shadow-host text and text directly inside closed `<details>`. ([microsoft/playwright#43150](https://redirect.github.com/microsoft/playwright/pull/43150)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude inert content and content outside the topmost modal `<dialog>`. Click and fill actions wait for targets to stop being inert instead of silently misfiring. ([microsoft/playwright#43211](https://redirect.github.com/microsoft/playwright/pull/43211)) - `fix(aria): do not count whitespace-only contributors as name sources` — snapshots retain button names when whitespace around a hidden icon previously caused the name to disappear. ([microsoft/playwright#43317](https://redirect.github.com/microsoft/playwright/pull/43317)) - `fix(aria): resolve label references consistently` — snapshots and role locators recognize tab- or newline-separated label IDs and labels assigned through `ariaLabelledByElements`, while retaining attribute-based labels in older browsers. ([microsoft/playwright#43361](https://redirect.github.com/microsoft/playwright/pull/43361), [microsoft/playwright#43577](https://redirect.github.com/microsoft/playwright/pull/43577), [microsoft/playwright#43722](https://redirect.github.com/microsoft/playwright/pull/43722)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-like names remain strings rather than being parsed as null or special floating-point values. ([microsoft/playwright#43469](https://redirect.github.com/microsoft/playwright/pull/43469)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots retain an iframe's contents when the iframe element also contains fallback text. ([microsoft/playwright#43635](https://redirect.github.com/microsoft/playwright/pull/43635)) - `fix(aria): match mixed-case roles and states` — snapshots and role locators recognize mixed-case `role` and ARIA state values, including checked, pressed and expanded states. ([microsoft/playwright#43727](https://redirect.github.com/microsoft/playwright/pull/43727)) #### 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.84 ``` </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Tokyo) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/izumin5210/dotfiles).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix(mcp): allow any host when http server is bound to all interfaces

89d6373

Fixes: microsoft#42952

Dmitry Gozman (dgozman) approved these changes Sep 29, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

Pavel Feldman (pavelfeldman) requested changes Sep 29, 2026

View reviewed changes

Yury Semikhatsky (yury-s) added 2 commits September 29, 2026 16:30

fix(mcp): keep host check for all-interface binds, allow loopback hos…

adb9f21

…ts by default Fixes: microsoft#42952

fix(mcp): print localhost url when bound to all interfaces

75584fc

Yury Semikhatsky (yury-s) changed the title ~~fix(mcp): allow any host when http server is bound to all interfaces~~ fix(mcp): allow loopback hosts by default for all bind addresses Sep 29, 2026

Yury Semikhatsky (yury-s) requested a review from Pavel Feldman (pavelfeldman) September 29, 2026 23:39

fix(mcp): allow the host passed via --host by default

f2b2c7f

This comment has been minimized.

Sign in to view

test(mcp): consolidate allowed hosts tests

682d49b

Pavel Feldman (pavelfeldman) approved these changes Sep 30, 2026

View reviewed changes

Yury Semikhatsky (yury-s) merged commit 5b8c4a0 into microsoft:main Sep 30, 2026
18 checks passed

Yury Semikhatsky (yury-s) deleted the fix-42952 branch September 30, 2026 00:49

Dmitry Gozman (dgozman) mentioned this pull request Oct 5, 2026

fix(mcp): preserve all-interface HTTP hosts #42953

Closed

phusitkumsri1437-arch mentioned this pull request Oct 15, 2026

chore: mark v0.0.84 microsoft/playwright-mcp#1793

Closed

microsoft-playwright-automation Bot mentioned this pull request Oct 31, 2026

chore: mark v0.0.84 microsoft/playwright-mcp#1814

Merged

Navigation Menu

Repository navigation

fix(mcp): allow loopback hosts by default for all bind addresses - #42993

fix(mcp): allow loopback hosts by default for all bind addresses#42993
Yury Semikhatsky (yury-s) merged 5 commits into
microsoft:mainfrom
yury-s:fix-42952

Yury Semikhatsky (yury-s) commented Sep 29, 2026 •

edited

Loading

Uh oh!

This comment has been minimized.

Pavel Feldman (pavelfeldman) left a comment

Uh oh!

Pavel Feldman (pavelfeldman) commented Sep 29, 2026

Uh oh!

Yury Semikhatsky (yury-s) commented Sep 30, 2026

Uh oh!

This comment has been minimized.

github-actions Bot commented Sep 30, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Yury Semikhatsky (yury-s) commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

This comment has been minimized.

Pavel Feldman (pavelfeldman) left a comment

Choose a reason for hiding this comment

Uh oh!

Pavel Feldman (pavelfeldman) commented Sep 29, 2026

Uh oh!

Yury Semikhatsky (yury-s) commented Sep 30, 2026

Uh oh!

This comment has been minimized.

github-actions Bot commented Sep 30, 2026

Test results for "MCP"

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Yury Semikhatsky (yury-s) commented Sep 29, 2026 •

edited

Loading