feat(mcp): allow creating tabs in isolated browser contexts by pavelfeldman · Pull Request #43087 · microsoft/playwright

Pavel Feldman (pavelfeldman) · 2026-10-02T23:32:58Z

Summary

browser_tabs action: 'new' takes an optional isolatedContext name; tabs with the same name share cookies and storage, different names (or the default context) are fully isolated
CLI: tab-new <url> --isolated-context=<name>; tab list and page header show the context name
Init scripts, origin filters and routes apply to every context; tracing and video span all contexts; cookie, storage and network tools act on the current tab's context

`browser_tabs` with `action: 'new'` accepts an optional `isolatedContext` name. Tabs with the same name share cookies and storage, tabs in different contexts (or the default one) are fully isolated. The CLI exposes it as `tab-new --isolated-context=<name>`. Context keeps all browser contexts in one map, applies init scripts, origin filters and routes to each of them, and tracing and video span all contexts. Cookie, storage and network tools act on the current tab's context.

Yury Semikhatsky (yury-s) · 2026-10-02T23:47:26Z

-  private _browserContextPromise: Promise<playwrightTypes.BrowserContext> | undefined;
+  private _defaultBrowserContext: playwrightTypes.BrowserContext;
+  // Keyed by isolated context name, undefined for the default context.
+  // Resolves once the context exists and has routes, init scripts and page listeners installed.


drop the comment?

Yury Semikhatsky (yury-s) · 2026-10-02T23:52:29Z

    this._tabs.length = 0;
    this._setCurrentTab(undefined);
-    await this.stopVideoRecording();
+    await Promise.all([...this._browserContexts].filter(([isolatedContext]) => isolatedContext).map(([, browserContext]) => browserContext.then(c => c.close()).catch(() => {})));


can context name be '' ?

Yury Semikhatsky (yury-s) · 2026-10-02T23:57:10Z

  async startVideoRecording(fileName: string, params: VideoParams) {
    if (this._video)
      throw new Error('Video recording has already been started.');
+    await this.ensureBrowserContext();


will it also start video for a context created later?

Video is wired per page.

Yury Semikhatsky (yury-s) · 2026-10-03T00:05:36Z

  }

-  private async _setupRequestInterception(context: playwrightTypes.BrowserContext) {
+  private async _setupRequestInterception(context: playwrightTypes.BrowserContext, disposables: Disposable[]) {


should it also add entries from this._routes ?

yes, in _initializeBrowserContext

github-actions · 2026-10-03T00:14:30Z

Test results for "tests 1"

6 flaky

⚠️ [chromium-library] › library/webmcp.spec.ts:238 › should call same-name tools in their own frame `@frozen-time-library-chromium-linux`
⚠️ [chromium-library] › library/webmcp.spec.ts:256 › should list and call tools in cross-origin and nested frames `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/popup.spec.ts:260 › should not throw when click closes popup `@chromium-ubuntu-22.04-node22`
⚠️ [chromium-library] › library/video.spec.ts:762 › screencast › should work with video+trace `@chromium-ubuntu-22.04-node22`
⚠️ [firefox-library] › library/browsercontext-cookies-third-party.spec.ts:257 › third party 'Partitioned;' cookies `@firefox-ubuntu-22.04-node20`
⚠️ [firefox-library] › library/browsercontext-cookies-third-party.spec.ts:470 › top level 'Partitioned;' cookie and same origin iframe `@firefox-ubuntu-22.04-node20`

52485 passed, 1268 skipped

Merge workflow run.

github-actions · 2026-10-03T00:19:43Z

Test results for "MCP"

1 failed
❌ [firefox] › mcp/annotate.spec.ts:446 › should switch screencast to -s session on show --annotate @mcp-windows-latest-firefox

9014 passed, 1489 skipped

Merge workflow run.

github-actions · 2026-10-03T00:22:18Z

🟢 The failure is a pre-existing flake

Hi, I'm the Playwright bot and I triaged the MCP failure. The same test has failed with the same session-selection assertion on unrelated PRs, so this does not look caused by this change.

Details

This PR changes shared MCP browser-context lifecycle and therefore reaches adjacent screencast code, but the failure is an established Windows/Firefox flake rather than a new correlation with this branch.

Pre-existing flake / infra

[firefox] › mcp/annotate.spec.ts:446 › should switch screencast to -s session on show --annotate (@mcp-windows-latest-firefox) — timed out waiting for the active session to switch from Session first to Session second. The exact test on the same bot also failed on unrelated fix(cli): expose benign globals in run-code vm context #42975 and chore(proxy): drop legacy 'per-context' launch proxy handling #42892; the fix(cli): expose benign globals in run-code vm context #42975 DB-backed triage recorded 40 final failures in 723 runs, plus 37 runs rescued by a retry, with the same toHaveAccessibleName assertion. This PR's other Windows MCP jobs passed.

_{Triaged by the Playwright bot - agent run}

## ✨ Highlights - **👥 Separate sessions in one browser** — work with multiple accounts without sharing their cookies or storage. `browser_tabs` with `action: "new"` now accepts `isolatedContext: "<name>"`: tabs with the same name share a context, while different names stay isolated. Omit it or use `"default"` for the default context. Cookie and storage tools operate on the current tab's context. ([microsoft/playwright#43087](microsoft/playwright#43087)) - **🙈 Redact runtime values in URLs** ([#1791](#1791)) — session and grant values minted at runtime cannot be listed in a secrets file ahead of time. `--redact-url-params=access_token,code` (config `redactUrlParams`, env `PLAYWRIGHT_MCP_REDACT_URL_PARAMS`) replaces the named query and fragment parameter values with `<redacted>` in tool responses. Like `secrets`, this is a convenience, not a security feature. The extension also removes its connection token from the connect page URL after reading it. ([microsoft/playwright#43258](microsoft/playwright#43258)) - **🔎 Bound find results** ([microsoft/playwright#42077](microsoft/playwright#42077)) — common search terms no longer have to fill the response with every match. `browser_find` accepts a positive integer `maxResults`, returns the first matching items with their context, and reports the total match count. Omit it to keep returning all matches; ancestor paths are unchanged. ([microsoft/playwright#42947](microsoft/playwright#42947)) - **🌐 Inspect requests across navigations** ([microsoft/playwright-cli#479](microsoft/playwright-cli#479)) — requests from the previous page are no longer lost as soon as a flow navigates. `browser_network_requests` accepts `all: true` to include retained history, keeping up to 200 requests from earlier navigations. Request indexes stay stable across navigations for `browser_network_request`. `browser_console_messages` also reports counts consistent with its existing `all` option. ([microsoft/playwright#43526](microsoft/playwright#43526)) - **🎯 Use locators in your language** ([#1797](#1797)) — element tools such as `browser_click` now accept JavaScript, Python, Java and C# locators in `target`, alongside snapshot refs and CSS selectors. Invalid targets get an actionable error, including a reminder to pass the bare ref rather than `button [ref=e5]`. ([microsoft/playwright#43539](microsoft/playwright#43539)) - **📂 Skip unsupported workspace-root requests** ([#1798](#1798)) — clients that advertise roots but cannot answer `roots/list` can stall the first tool call. Pass `--ignore-roots` (config `ignoreRoots: true`, env `PLAYWRIGHT_MCP_IGNORE_ROOTS=true`) to skip that request and use the server's current working directory as the workspace root. ([microsoft/playwright#43532](microsoft/playwright#43532)) - **🍪 Delete cookies by domain and path** — deleting a cookie by name no longer has to remove every cookie with that name. `browser_cookie_delete` (opt-in via `--caps=storage`) accepts optional `domain` and `path` filters to leave other domains and paths untouched. ([microsoft/playwright#43319](microsoft/playwright#43319)) ## 🐛 Fixes - `fix(mcp): allow combining time, text and textGone in browser_wait_for` — when combined with a text condition, `time` is its timeout (capped at 30 seconds), not a delay before checking it. Supplying both `text` and `textGone` now waits for the first condition to happen, rather than both in sequence. ([microsoft/playwright#43011](microsoft/playwright#43011)) - `fix(mcp): allow loopback hosts by default for all bind addresses` — HTTP clients can connect through `localhost`, `127.0.0.1` or `[::1]` regardless of the bind address. Other hosts still require `--allowed-hosts`; binding to `0.0.0.0` prints a usable localhost URL. ([microsoft/playwright#42993](microsoft/playwright#42993)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — credentials embedded in the proxy URL are now passed to the browser as proxy authentication settings. ([microsoft/playwright#43071](microsoft/playwright#43071)) - `fix(mcp): race browser_navigate_back against modal states` — `browser_navigate_back` reports a dialog opened during history navigation instead of timing out. ([microsoft/playwright#43252](microsoft/playwright#43252)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `browser_navigate` handles scheme-less hosts with ports and uses HTTP for loopback addresses such as `127.0.0.1:3000` and `[::1]:3000`. ([microsoft/playwright#43264](microsoft/playwright#43264)) - `fix(mcp): do not close the browser twice when the client disconnects` — stdio disconnects let the browser close gracefully instead of force-killing it through a second close request. Dashboard annotation processes also exit when their parent goes away. ([microsoft/playwright#43174](microsoft/playwright#43174)) - `fix(mcp): give each isolated client its own idle timer` — with HTTP transport and `--isolated`, an idle client's context now expires even while another client keeps the shared browser busy. ([microsoft/playwright#43527](microsoft/playwright#43527)) - `fix(mcp): apply route headers without bypassing origin filters` — `browser_route` (opt-in via `--caps=network`) matches added request header names case-insensitively, includes custom headers in mocked responses, and preserves origin filters and other routes when modifying request headers. ([microsoft/playwright#43227](microsoft/playwright#43227), [microsoft/playwright#43244](microsoft/playwright#43244), [microsoft/playwright#43637](microsoft/playwright#43637)) - `fix(mcp): correct cookie filtering and missing-domain errors` — `browser_cookie_list` (opt-in via `--caps=storage`) matches domain and path boundaries instead of unrelated names such as `notexample.com` or `/apiary`. `browser_cookie_set` asks for an explicit `domain` when the current page has no hostname, such as `about:blank`. ([microsoft/playwright#43316](microsoft/playwright#43316), [microsoft/playwright#43368](microsoft/playwright#43368), [microsoft/playwright#43318](microsoft/playwright#43318)) - `fix(mcp): accept Windows paths in browser_resume location` — `browser_resume` (opt-in via `--caps=devtools`) no longer mistakes a Windows drive-letter colon for the line-number separator. ([microsoft/playwright#43349](microsoft/playwright#43349)) - `fix(mcp): report run-code route handler exceptions once and verbatim` — `browser_run_code_unsafe` reports a route handler's thrown value without duplicating it or wrapping non-Error values in another error. ([microsoft/playwright#43203](microsoft/playwright#43203)) - `fix(extension): release debugger when attach completes after connection close` — disconnecting while `browser_tabs` attaches to a new tab no longer leaves that tab attached to the extension's debugger. ([microsoft/playwright#43025](microsoft/playwright#43025)) - `fix(chromium): close pages that crashed before connecting over CDP` — connecting through `--cdp-endpoint` no longer stalls on an already crashed or discarded page; those pages are omitted from the tab list. ([microsoft/playwright#43075](microsoft/playwright#43075)) - `fix(aria): skip text nodes that are not rendered` — `browser_snapshot` and accessible names omit unrendered text, including unslotted shadow-host text and text directly inside closed `<details>`. ([microsoft/playwright#43150](microsoft/playwright#43150)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude inert content and content outside the topmost modal `<dialog>`. Click and fill actions wait for targets to stop being inert instead of silently misfiring. ([microsoft/playwright#43211](microsoft/playwright#43211)) - `fix(aria): do not count whitespace-only contributors as name sources` — snapshots retain button names when whitespace around a hidden icon previously caused the name to disappear. ([microsoft/playwright#43317](microsoft/playwright#43317)) - `fix(aria): resolve label references consistently` — snapshots and role locators recognize tab- or newline-separated label IDs and labels assigned through `ariaLabelledByElements`, while retaining attribute-based labels in older browsers. ([microsoft/playwright#43361](microsoft/playwright#43361), [microsoft/playwright#43577](microsoft/playwright#43577), [microsoft/playwright#43722](microsoft/playwright#43722)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-like names remain strings rather than being parsed as null or special floating-point values. ([microsoft/playwright#43469](microsoft/playwright#43469)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots retain an iframe's contents when the iframe element also contains fallback text. ([microsoft/playwright#43635](microsoft/playwright#43635)) - `fix(aria): match mixed-case roles and states` — snapshots and role locators recognize mixed-case `role` and ARIA state values, including checked, pressed and expanded states. ([microsoft/playwright#43727](microsoft/playwright#43727)) ## 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.84 ``` Co-authored-by: microsoft-playwright-automation[bot] <203992400+microsoft-playwright-automation[bot]@users.noreply.github.com>

## ✨ Highlights - **👥 Use different signed-in users in one session** — `playwright-cli tab-new https://example.com --isolated-context=user-b` opens a tab with separate cookies and storage. Tabs with the same context name share their login state; different names stay isolated. ([microsoft/playwright#43087](microsoft/playwright#43087)) - **🎬 Smaller video recordings with less encoding CPU** — `playwright-cli video-start demo.webm` now records with VP9, keeping the same WebM output format. Stop and save the recording with `playwright-cli video-stop`. ([microsoft/playwright#43021](microsoft/playwright#43021)) - **📋 Keep console messages and requests across navigations** ([#479](#479)) — `playwright-cli console --all` and `playwright-cli requests --all` include retained entries from earlier navigations, so warnings and failed requests are not lost when checking a multi-page flow. Request numbers stay stable for `playwright-cli request 5`. ([microsoft/playwright#43526](microsoft/playwright#43526)) - **🔎 Keep common searches from flooding the agent's context** ([microsoft/playwright#42077](microsoft/playwright#42077)) — `playwright-cli find button --max-results=5` returns at most five matching items and reports the total match count. ([microsoft/playwright#42947](microsoft/playwright#42947)) - **🍪 Delete one site's cookie without signing out of others** ([microsoft/playwright#43310](microsoft/playwright#43310)) — `playwright-cli cookie-delete session_id --domain=example.com --path=/` removes only the cookie matching that name, domain and path, leaving same-named cookies elsewhere intact. ([microsoft/playwright#43319](microsoft/playwright#43319)) - **🔒 Redact session tokens in URLs printed in responses** ([microsoft/playwright-mcp#1791](microsoft/playwright-mcp#1791)) — add `"redactUrlParams": ["access_token", "code"]` to `.playwright/cli.config.json` to replace those query and fragment parameter values with `<redacted>` in command responses. ([microsoft/playwright#43258](microsoft/playwright#43258)) ## 🐛 Fixes - `fix(cli): do not force-kill the browser on close` — `playwright-cli close` lets Chrome shut down normally, preventing temporary app-clone folders from accumulating on macOS. ([#475](#475), [microsoft/playwright#43229](microsoft/playwright#43229)) - `fix(cli): respect npm registry config in update check` — update checks honor npm's registry, scoped registry, proxy and authentication settings instead of contacting the public registry directly when a custom registry is configured. ([#478](#478), [#484](#484)) - `fix(cli): report run-code route handler exception once and verbatim` — asynchronous route callback errors return their original message without duplicated errors or an extra `Error:` prefix. ([#476](#476), [microsoft/playwright#43203](microsoft/playwright#43203)) - `fix(chromium): do not hang on pages without a renderer when connecting over CDP` — `attach --cdp` handles discarded or crashed tabs without wedging every command; a follow-up closes those tabs while preserving live ones. ([microsoft/playwright#41714](microsoft/playwright#41714), [microsoft/playwright#42936](microsoft/playwright#42936), [microsoft/playwright#43075](microsoft/playwright#43075)) - `fix(chromium): report local frames of existing oopifs when connecting over CDP` — attaching to an already-loaded page discovers nested frames correctly instead of replacing the main document with a sandboxed iframe. ([microsoft/playwright#42955](microsoft/playwright#42955), [microsoft/playwright#43000](microsoft/playwright#43000)) - `fix(mcp): report invalid element targets and accept locators in any language` — action targets accept JavaScript, Python, Java and C# locators. Invalid targets explain the accepted forms, including how to pass a bare snapshot ref. ([microsoft/playwright-mcp#1797](microsoft/playwright-mcp#1797), [microsoft/playwright#43539](microsoft/playwright#43539)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `playwright-cli open 127.0.0.1:3000` uses HTTP, and bare external hosts with ports are normalized to HTTPS rather than mistaken for custom schemes. ([microsoft/playwright#43263](microsoft/playwright#43263), [microsoft/playwright#43264](microsoft/playwright#43264)) - `fix(mcp): race browser_navigate_back and forward against modal states` — `go-back` and `go-forward` surface navigation dialogs immediately so they can be handled, rather than hanging until timeout. ([microsoft/playwright#43251](microsoft/playwright#43251), [microsoft/playwright#43252](microsoft/playwright#43252)) - `fix(mcp): preserve origin filters when modifying request headers` — header-only `route` handlers no longer skip configured allowed/blocked-origin filters. ([microsoft/playwright#43630](microsoft/playwright#43630), [microsoft/playwright#43637](microsoft/playwright#43637)) - `fix(mcp): pass custom headers to route.fulfill when mocking response` — mocked `route` responses retain supplied headers, including CORS and cache headers. ([microsoft/playwright#43245](microsoft/playwright#43245), [microsoft/playwright#43244](microsoft/playwright#43244)) - `fix(mcp): match browser_route header names case-insensitively` — request-header replacement and removal work consistently regardless of header-name casing. ([microsoft/playwright#43215](microsoft/playwright#43215), [microsoft/playwright#43227](microsoft/playwright#43227)) - `fix(mcp): match cookie list domain filter on domain boundaries` — `cookie-list --domain=example.com` includes that domain and its subdomains, not unrelated names such as `my-example.com`; matching ignores case and a leading dot. ([microsoft/playwright#43308](microsoft/playwright#43308), [microsoft/playwright#43316](microsoft/playwright#43316)) - `fix(mcp): do not match sibling paths in cookie-list path filter` — `cookie-list --path=/api` includes `/api` and paths under `/api/`, not `/apikeys`. ([microsoft/playwright#43366](microsoft/playwright#43366), [microsoft/playwright#43368](microsoft/playwright#43368)) - `fix(mcp): ask for a cookie domain when the page has no host` — `cookie-set` on `about:blank` or a data URL asks for `--domain` instead of returning an internal assertion error. ([microsoft/playwright#43309](microsoft/playwright#43309), [microsoft/playwright#43318](microsoft/playwright#43318)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — authenticated proxy URLs supplied through `PLAYWRIGHT_MCP_PROXY_SERVER` retain their credentials instead of failing proxy authentication. ([microsoft/playwright#43048](microsoft/playwright#43048), [microsoft/playwright#43071](microsoft/playwright#43071)) - `fix(mcp): accept Windows paths in browser_resume location` — `pause-at` accepts Windows source locations such as `C:\tests\example.spec.ts:42`. ([microsoft/playwright#43340](microsoft/playwright#43340), [microsoft/playwright#43349](microsoft/playwright#43349)) - `fix(video): hide ffmpeg console windows on Windows` — `video-start` no longer opens a terminal window that steals focus during background recording. ([microsoft/playwright#43515](microsoft/playwright#43515), [microsoft/playwright#43575](microsoft/playwright#43575)) - `feat(cli): keep sockets in XDG_RUNTIME_DIR` — Unix CLI sessions and the dashboard prefer `$XDG_RUNTIME_DIR/playwright` over the shared temporary directory when it is usable. ([microsoft/playwright#43698](microsoft/playwright#43698), [microsoft/playwright#43732](microsoft/playwright#43732)) - `fix(tracing): do not store secrets in trace context options` — trace metadata no longer copies credential-bearing context options such as HTTP credentials, proxy credentials, extra headers and storage-state cookies. ([microsoft/playwright#38673](microsoft/playwright#38673), [microsoft/playwright#43220](microsoft/playwright#43220)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots show a loaded iframe's content and element refs even when its HTML contains fallback text. ([microsoft/playwright#43628](microsoft/playwright#43628), [microsoft/playwright#43635](microsoft/playwright#43635)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-special text remains a string when snapshot output is parsed or reused. ([microsoft/playwright#43451](microsoft/playwright#43451), [microsoft/playwright#43469](microsoft/playwright#43469)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude controls that cannot currently be used, and click/fill actions wait for targets to stop being inert rather than silently misfiring. ([microsoft/playwright#36938](microsoft/playwright#36938), [microsoft/playwright#42967](microsoft/playwright#42967), [microsoft/playwright#43211](microsoft/playwright#43211)) - `fix(webmcp): handle Chromium tool API changes` — WebMCP tool discovery tolerates Chromium's null input schemas while preserving the existing tool shape. ([microsoft/playwright#43578](microsoft/playwright#43578)) ## 📦 Upgrading ```bash npm install -g @playwright/cli@0.1.23 ``` This release uses Playwright `1.65.0-alpha-2026-10-30`. Co-authored-by: microsoft-playwright-automation[bot] <203992400+microsoft-playwright-automation[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [@playwright/mcp](https://playwright.dev) ([source](https://redirect.github.com/microsoft/playwright-mcp)) | `0.0.83` → `0.0.84` | ![age](https://developer.mend.io/api/mc/badges/age/npm/@playwright%2fmcp/0.0.84?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/@playwright%2fmcp/0.0.84?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/@playwright%2fmcp/0.0.83/0.0.84?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@playwright%2fmcp/0.0.83/0.0.84?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>microsoft/playwright-mcp (@playwright/mcp)</summary> ### [`v0.0.84`](https://redirect.github.com/microsoft/playwright-mcp/releases/tag/v0.0.84) [Compare Source](https://redirect.github.com/microsoft/playwright-mcp/compare/v0.0.83...v0.0.84) #### ✨ Highlights - **👥 Separate sessions in one browser** — work with multiple accounts without sharing their cookies or storage. `browser_tabs` with `action: "new"` now accepts `isolatedContext: "<name>"`: tabs with the same name share a context, while different names stay isolated. Omit it or use `"default"` for the default context. Cookie and storage tools operate on the current tab's context. ([microsoft/playwright#43087](https://redirect.github.com/microsoft/playwright/pull/43087)) - **🙈 Redact runtime values in URLs** ([#1791](https://redirect.github.com/microsoft/playwright-mcp/issues/1791)) — session and grant values minted at runtime cannot be listed in a secrets file ahead of time. `--redact-url-params=access_token,code` (config `redactUrlParams`, env `PLAYWRIGHT_MCP_REDACT_URL_PARAMS`) replaces the named query and fragment parameter values with `<redacted>` in tool responses. Like `secrets`, this is a convenience, not a security feature. The extension also removes its connection token from the connect page URL after reading it. ([microsoft/playwright#43258](https://redirect.github.com/microsoft/playwright/pull/43258)) - **🔎 Bound find results** ([microsoft/playwright#42077](https://redirect.github.com/microsoft/playwright/issues/42077)) — common search terms no longer have to fill the response with every match. `browser_find` accepts a positive integer `maxResults`, returns the first matching items with their context, and reports the total match count. Omit it to keep returning all matches; ancestor paths are unchanged. ([microsoft/playwright#42947](https://redirect.github.com/microsoft/playwright/pull/42947)) - **🌐 Inspect requests across navigations** ([microsoft/playwright-cli#479](https://redirect.github.com/microsoft/playwright-cli/issues/479)) — requests from the previous page are no longer lost as soon as a flow navigates. `browser_network_requests` accepts `all: true` to include retained history, keeping up to 200 requests from earlier navigations. Request indexes stay stable across navigations for `browser_network_request`. `browser_console_messages` also reports counts consistent with its existing `all` option. ([microsoft/playwright#43526](https://redirect.github.com/microsoft/playwright/pull/43526)) - **🎯 Use locators in your language** ([#1797](https://redirect.github.com/microsoft/playwright-mcp/issues/1797)) — element tools such as `browser_click` now accept JavaScript, Python, Java and C# locators in `target`, alongside snapshot refs and CSS selectors. Invalid targets get an actionable error, including a reminder to pass the bare ref rather than `button [ref=e5]`. ([microsoft/playwright#43539](https://redirect.github.com/microsoft/playwright/pull/43539)) - **📂 Skip unsupported workspace-root requests** ([#1798](https://redirect.github.com/microsoft/playwright-mcp/issues/1798)) — clients that advertise roots but cannot answer `roots/list` can stall the first tool call. Pass `--ignore-roots` (config `ignoreRoots: true`, env `PLAYWRIGHT_MCP_IGNORE_ROOTS=true`) to skip that request and use the server's current working directory as the workspace root. ([microsoft/playwright#43532](https://redirect.github.com/microsoft/playwright/pull/43532)) - **🍪 Delete cookies by domain and path** — deleting a cookie by name no longer has to remove every cookie with that name. `browser_cookie_delete` (opt-in via `--caps=storage`) accepts optional `domain` and `path` filters to leave other domains and paths untouched. ([microsoft/playwright#43319](https://redirect.github.com/microsoft/playwright/pull/43319)) #### 🐛 Fixes - `fix(mcp): allow combining time, text and textGone in browser_wait_for` — when combined with a text condition, `time` is its timeout (capped at 30 seconds), not a delay before checking it. Supplying both `text` and `textGone` now waits for the first condition to happen, rather than both in sequence. ([microsoft/playwright#43011](https://redirect.github.com/microsoft/playwright/pull/43011)) - `fix(mcp): allow loopback hosts by default for all bind addresses` — HTTP clients can connect through `localhost`, `127.0.0.1` or `[::1]` regardless of the bind address. Other hosts still require `--allowed-hosts`; binding to `0.0.0.0` prints a usable localhost URL. ([microsoft/playwright#42993](https://redirect.github.com/microsoft/playwright/pull/42993)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — credentials embedded in the proxy URL are now passed to the browser as proxy authentication settings. ([microsoft/playwright#43071](https://redirect.github.com/microsoft/playwright/pull/43071)) - `fix(mcp): race browser_navigate_back against modal states` — `browser_navigate_back` reports a dialog opened during history navigation instead of timing out. ([microsoft/playwright#43252](https://redirect.github.com/microsoft/playwright/pull/43252)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `browser_navigate` handles scheme-less hosts with ports and uses HTTP for loopback addresses such as `127.0.0.1:3000` and `[::1]:3000`. ([microsoft/playwright#43264](https://redirect.github.com/microsoft/playwright/pull/43264)) - `fix(mcp): do not close the browser twice when the client disconnects` — stdio disconnects let the browser close gracefully instead of force-killing it through a second close request. Dashboard annotation processes also exit when their parent goes away. ([microsoft/playwright#43174](https://redirect.github.com/microsoft/playwright/pull/43174)) - `fix(mcp): give each isolated client its own idle timer` — with HTTP transport and `--isolated`, an idle client's context now expires even while another client keeps the shared browser busy. ([microsoft/playwright#43527](https://redirect.github.com/microsoft/playwright/pull/43527)) - `fix(mcp): apply route headers without bypassing origin filters` — `browser_route` (opt-in via `--caps=network`) matches added request header names case-insensitively, includes custom headers in mocked responses, and preserves origin filters and other routes when modifying request headers. ([microsoft/playwright#43227](https://redirect.github.com/microsoft/playwright/pull/43227), [microsoft/playwright#43244](https://redirect.github.com/microsoft/playwright/pull/43244), [microsoft/playwright#43637](https://redirect.github.com/microsoft/playwright/pull/43637)) - `fix(mcp): correct cookie filtering and missing-domain errors` — `browser_cookie_list` (opt-in via `--caps=storage`) matches domain and path boundaries instead of unrelated names such as `notexample.com` or `/apiary`. `browser_cookie_set` asks for an explicit `domain` when the current page has no hostname, such as `about:blank`. ([microsoft/playwright#43316](https://redirect.github.com/microsoft/playwright/pull/43316), [microsoft/playwright#43368](https://redirect.github.com/microsoft/playwright/pull/43368), [microsoft/playwright#43318](https://redirect.github.com/microsoft/playwright/pull/43318)) - `fix(mcp): accept Windows paths in browser_resume location` — `browser_resume` (opt-in via `--caps=devtools`) no longer mistakes a Windows drive-letter colon for the line-number separator. ([microsoft/playwright#43349](https://redirect.github.com/microsoft/playwright/pull/43349)) - `fix(mcp): report run-code route handler exceptions once and verbatim` — `browser_run_code_unsafe` reports a route handler's thrown value without duplicating it or wrapping non-Error values in another error. ([microsoft/playwright#43203](https://redirect.github.com/microsoft/playwright/pull/43203)) - `fix(extension): release debugger when attach completes after connection close` — disconnecting while `browser_tabs` attaches to a new tab no longer leaves that tab attached to the extension's debugger. ([microsoft/playwright#43025](https://redirect.github.com/microsoft/playwright/pull/43025)) - `fix(chromium): close pages that crashed before connecting over CDP` — connecting through `--cdp-endpoint` no longer stalls on an already crashed or discarded page; those pages are omitted from the tab list. ([microsoft/playwright#43075](https://redirect.github.com/microsoft/playwright/pull/43075)) - `fix(aria): skip text nodes that are not rendered` — `browser_snapshot` and accessible names omit unrendered text, including unslotted shadow-host text and text directly inside closed `<details>`. ([microsoft/playwright#43150](https://redirect.github.com/microsoft/playwright/pull/43150)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude inert content and content outside the topmost modal `<dialog>`. Click and fill actions wait for targets to stop being inert instead of silently misfiring. ([microsoft/playwright#43211](https://redirect.github.com/microsoft/playwright/pull/43211)) - `fix(aria): do not count whitespace-only contributors as name sources` — snapshots retain button names when whitespace around a hidden icon previously caused the name to disappear. ([microsoft/playwright#43317](https://redirect.github.com/microsoft/playwright/pull/43317)) - `fix(aria): resolve label references consistently` — snapshots and role locators recognize tab- or newline-separated label IDs and labels assigned through `ariaLabelledByElements`, while retaining attribute-based labels in older browsers. ([microsoft/playwright#43361](https://redirect.github.com/microsoft/playwright/pull/43361), [microsoft/playwright#43577](https://redirect.github.com/microsoft/playwright/pull/43577), [microsoft/playwright#43722](https://redirect.github.com/microsoft/playwright/pull/43722)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-like names remain strings rather than being parsed as null or special floating-point values. ([microsoft/playwright#43469](https://redirect.github.com/microsoft/playwright/pull/43469)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots retain an iframe's contents when the iframe element also contains fallback text. ([microsoft/playwright#43635](https://redirect.github.com/microsoft/playwright/pull/43635)) - `fix(aria): match mixed-case roles and states` — snapshots and role locators recognize mixed-case `role` and ARIA state values, including checked, pressed and expanded states. ([microsoft/playwright#43727](https://redirect.github.com/microsoft/playwright/pull/43727)) #### 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.84 ``` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/paulnsorensen/dotfiles).  --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Paul Sorensen <paulnsorensen@gmail.com>

## ✨ Highlights - **👥 Separate sessions in one browser** — work with multiple accounts without sharing their cookies or storage. `browser_tabs` with `action: "new"` now accepts `isolatedContext: "<name>"`: tabs with the same name share a context, while different names stay isolated. Omit it or use `"default"` for the default context. Cookie and storage tools operate on the current tab's context. ([microsoft/playwright#43087](microsoft/playwright#43087)) - **🙈 Redact runtime values in URLs** ([microsoft#1791](microsoft#1791)) — session and grant values minted at runtime cannot be listed in a secrets file ahead of time. `--redact-url-params=access_token,code` (config `redactUrlParams`, env `PLAYWRIGHT_MCP_REDACT_URL_PARAMS`) replaces the named query and fragment parameter values with `<redacted>` in tool responses. Like `secrets`, this is a convenience, not a security feature. The extension also removes its connection token from the connect page URL after reading it. ([microsoft/playwright#43258](microsoft/playwright#43258)) - **🔎 Bound find results** ([microsoft/playwright#42077](microsoft/playwright#42077)) — common search terms no longer have to fill the response with every match. `browser_find` accepts a positive integer `maxResults`, returns the first matching items with their context, and reports the total match count. Omit it to keep returning all matches; ancestor paths are unchanged. ([microsoft/playwright#42947](microsoft/playwright#42947)) - **🌐 Inspect requests across navigations** ([microsoft/playwright-cli#479](microsoft/playwright-cli#479)) — requests from the previous page are no longer lost as soon as a flow navigates. `browser_network_requests` accepts `all: true` to include retained history, keeping up to 200 requests from earlier navigations. Request indexes stay stable across navigations for `browser_network_request`. `browser_console_messages` also reports counts consistent with its existing `all` option. ([microsoft/playwright#43526](microsoft/playwright#43526)) - **🎯 Use locators in your language** ([microsoft#1797](microsoft#1797)) — element tools such as `browser_click` now accept JavaScript, Python, Java and C# locators in `target`, alongside snapshot refs and CSS selectors. Invalid targets get an actionable error, including a reminder to pass the bare ref rather than `button [ref=e5]`. ([microsoft/playwright#43539](microsoft/playwright#43539)) - **📂 Skip unsupported workspace-root requests** ([microsoft#1798](microsoft#1798)) — clients that advertise roots but cannot answer `roots/list` can stall the first tool call. Pass `--ignore-roots` (config `ignoreRoots: true`, env `PLAYWRIGHT_MCP_IGNORE_ROOTS=true`) to skip that request and use the server's current working directory as the workspace root. ([microsoft/playwright#43532](microsoft/playwright#43532)) - **🍪 Delete cookies by domain and path** — deleting a cookie by name no longer has to remove every cookie with that name. `browser_cookie_delete` (opt-in via `--caps=storage`) accepts optional `domain` and `path` filters to leave other domains and paths untouched. ([microsoft/playwright#43319](microsoft/playwright#43319)) ## 🐛 Fixes - `fix(mcp): allow combining time, text and textGone in browser_wait_for` — when combined with a text condition, `time` is its timeout (capped at 30 seconds), not a delay before checking it. Supplying both `text` and `textGone` now waits for the first condition to happen, rather than both in sequence. ([microsoft/playwright#43011](microsoft/playwright#43011)) - `fix(mcp): allow loopback hosts by default for all bind addresses` — HTTP clients can connect through `localhost`, `127.0.0.1` or `[::1]` regardless of the bind address. Other hosts still require `--allowed-hosts`; binding to `0.0.0.0` prints a usable localhost URL. ([microsoft/playwright#42993](microsoft/playwright#42993)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — credentials embedded in the proxy URL are now passed to the browser as proxy authentication settings. ([microsoft/playwright#43071](microsoft/playwright#43071)) - `fix(mcp): race browser_navigate_back against modal states` — `browser_navigate_back` reports a dialog opened during history navigation instead of timing out. ([microsoft/playwright#43252](microsoft/playwright#43252)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `browser_navigate` handles scheme-less hosts with ports and uses HTTP for loopback addresses such as `127.0.0.1:3000` and `[::1]:3000`. ([microsoft/playwright#43264](microsoft/playwright#43264)) - `fix(mcp): do not close the browser twice when the client disconnects` — stdio disconnects let the browser close gracefully instead of force-killing it through a second close request. Dashboard annotation processes also exit when their parent goes away. ([microsoft/playwright#43174](microsoft/playwright#43174)) - `fix(mcp): give each isolated client its own idle timer` — with HTTP transport and `--isolated`, an idle client's context now expires even while another client keeps the shared browser busy. ([microsoft/playwright#43527](microsoft/playwright#43527)) - `fix(mcp): apply route headers without bypassing origin filters` — `browser_route` (opt-in via `--caps=network`) matches added request header names case-insensitively, includes custom headers in mocked responses, and preserves origin filters and other routes when modifying request headers. ([microsoft/playwright#43227](microsoft/playwright#43227), [microsoft/playwright#43244](microsoft/playwright#43244), [microsoft/playwright#43637](microsoft/playwright#43637)) - `fix(mcp): correct cookie filtering and missing-domain errors` — `browser_cookie_list` (opt-in via `--caps=storage`) matches domain and path boundaries instead of unrelated names such as `notexample.com` or `/apiary`. `browser_cookie_set` asks for an explicit `domain` when the current page has no hostname, such as `about:blank`. ([microsoft/playwright#43316](microsoft/playwright#43316), [microsoft/playwright#43368](microsoft/playwright#43368), [microsoft/playwright#43318](microsoft/playwright#43318)) - `fix(mcp): accept Windows paths in browser_resume location` — `browser_resume` (opt-in via `--caps=devtools`) no longer mistakes a Windows drive-letter colon for the line-number separator. ([microsoft/playwright#43349](microsoft/playwright#43349)) - `fix(mcp): report run-code route handler exceptions once and verbatim` — `browser_run_code_unsafe` reports a route handler's thrown value without duplicating it or wrapping non-Error values in another error. ([microsoft/playwright#43203](microsoft/playwright#43203)) - `fix(extension): release debugger when attach completes after connection close` — disconnecting while `browser_tabs` attaches to a new tab no longer leaves that tab attached to the extension's debugger. ([microsoft/playwright#43025](microsoft/playwright#43025)) - `fix(chromium): close pages that crashed before connecting over CDP` — connecting through `--cdp-endpoint` no longer stalls on an already crashed or discarded page; those pages are omitted from the tab list. ([microsoft/playwright#43075](microsoft/playwright#43075)) - `fix(aria): skip text nodes that are not rendered` — `browser_snapshot` and accessible names omit unrendered text, including unslotted shadow-host text and text directly inside closed `<details>`. ([microsoft/playwright#43150](microsoft/playwright#43150)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude inert content and content outside the topmost modal `<dialog>`. Click and fill actions wait for targets to stop being inert instead of silently misfiring. ([microsoft/playwright#43211](microsoft/playwright#43211)) - `fix(aria): do not count whitespace-only contributors as name sources` — snapshots retain button names when whitespace around a hidden icon previously caused the name to disappear. ([microsoft/playwright#43317](microsoft/playwright#43317)) - `fix(aria): resolve label references consistently` — snapshots and role locators recognize tab- or newline-separated label IDs and labels assigned through `ariaLabelledByElements`, while retaining attribute-based labels in older browsers. ([microsoft/playwright#43361](microsoft/playwright#43361), [microsoft/playwright#43577](microsoft/playwright#43577), [microsoft/playwright#43722](microsoft/playwright#43722)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-like names remain strings rather than being parsed as null or special floating-point values. ([microsoft/playwright#43469](microsoft/playwright#43469)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots retain an iframe's contents when the iframe element also contains fallback text. ([microsoft/playwright#43635](microsoft/playwright#43635)) - `fix(aria): match mixed-case roles and states` — snapshots and role locators recognize mixed-case `role` and ARIA state values, including checked, pressed and expanded states. ([microsoft/playwright#43727](microsoft/playwright#43727)) ## 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.84 ``` Co-authored-by: microsoft-playwright-automation[bot] <203992400+microsoft-playwright-automation[bot]@users.noreply.github.com>

> [!NOTE] > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | Pending | |---|---|---|---|---|---|---| | [@playwright/mcp](https://playwright.dev) ([source](https://redirect.github.com/microsoft/playwright-mcp)) | `0.0.82` → `0.0.84` | ![age](https://developer.mend.io/api/mc/badges/age/npm/@playwright%2fmcp/0.0.84?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@playwright%2fmcp/0.0.82/0.0.84?slim=true) | | patch | | | [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) | `v5.5.0` → `v5.6.1` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/CodSpeedHQ%2faction/v5.6.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/CodSpeedHQ%2faction/v5.5.0/v5.6.1?slim=true) | action | minor | `v5.6.3` | | [actions/upload-artifact](https://redirect.github.com/actions/upload-artifact) | `v7.0.1` → `v7.0.2` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/actions%2fupload-artifact/v7.0.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/actions%2fupload-artifact/v7.0.1/v7.0.2?slim=true) | action | patch | | | [alembic](https://redirect.github.com/sqlalchemy/alembic) ([changelog](https://alembic.sqlalchemy.org/en/latest/changelog.html)) | `==1.20.0` → `==1.20.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/alembic/1.20.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/alembic/1.20.0/1.20.1?slim=true) | project.dependencies | patch | | | [anchore/syft](https://redirect.github.com/anchore/syft) | `v1.52.0` → `v1.55.0` | ![age](https://developer.mend.io/api/mc/badges/age/docker/anchore%2fsyft/v1.55.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/anchore%2fsyft/v1.52.0/v1.55.0?slim=true) | | minor | `v1.56.0` | | [aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://redirect.github.com/aquasecurity/trivy)) | `0.76.0` → `0.76.1` | ![age](https://developer.mend.io/api/mc/badges/age/docker/aquasec%2ftrivy/0.76.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/aquasec%2ftrivy/0.76.0/0.76.1?slim=true) | | patch | | | [astral-sh/ruff-pre-commit](https://redirect.github.com/astral-sh/ruff-pre-commit) | `v0.16.8` → `v0.17.3` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/astral-sh%2fruff-pre-commit/v0.17.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/astral-sh%2fruff-pre-commit/v0.16.8/v0.17.3?slim=true) | repository | minor | | | [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) | `v10.1.0` → `v10.3.3` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/astral-sh%2fsetup-uv/v10.3.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/astral-sh%2fsetup-uv/v10.1.0/v10.3.3?slim=true) | action | minor | | | [astral-sh/uv](https://redirect.github.com/astral-sh/uv) | `0.12.17` → `0.13.6` | ![age](https://developer.mend.io/api/mc/badges/age/github-releases/astral-sh%2fuv/0.13.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-releases/astral-sh%2fuv/0.12.17/0.13.6?slim=true) | | minor | `0.13.7` | | [asyncpg](https://redirect.github.com/MagicStack/asyncpg) | `==0.31.0` → `==0.32.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/asyncpg/0.32.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/asyncpg/0.31.0/0.32.0?slim=true) | project.dependencies | minor | | | [boto3](https://redirect.github.com/boto/boto3) | `==1.43.98` → `==1.43.123` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/boto3/1.43.123?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/boto3/1.43.98/1.43.123?slim=true) | project.dependencies | patch | | | [boto3-stubs](https://redirect.github.com/youtype/mypy_boto3_builder) | `==1.43.98` → `==1.43.123` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/boto3-stubs/1.43.123?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/boto3-stubs/1.43.98/1.43.123?slim=true) | project.optional-dependencies | patch | | | craftainer-crud | `>=0.7.0,<0.8` → `>=0.8.1,<0.9` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/craftainer-crud/0.8.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/craftainer-crud/0.7.0/0.8.1?slim=true) | project.dependencies | minor | | | craftainer-crud-sdk | `>=0.2.0,<0.3` → `>=0.3.1,<0.4` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/craftainer-crud-sdk/0.3.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/craftainer-crud-sdk/0.2.0/0.3.1?slim=true) | project.optional-dependencies | minor | | | [fastapi](https://redirect.github.com/fastapi/fastapi) ([changelog](https://fastapi.tiangolo.com/release-notes/)) | `==0.141.1` → `==0.162.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/fastapi/0.162.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/fastapi/0.141.1/0.162.0?slim=true) | project.dependencies | minor | | | [granian](https://redirect.github.com/emmett-framework/granian) | `==2.8.4` → `==2.8.7` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/granian/2.8.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/granian/2.8.4/2.8.7?slim=true) | project.dependencies | patch | | | [httpx2](https://redirect.github.com/pydantic/httpx2) ([changelog](https://redirect.github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)) | `==2.13.0` → `==2.16.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/httpx2/2.16.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/httpx2/2.13.0/2.16.0?slim=true) | project.optional-dependencies | minor | | | [locust](https://redirect.github.com/locustio/locust) | `==2.46.6` → `==2.47.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/locust/2.47.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/locust/2.46.6/2.47.0?slim=true) | project.optional-dependencies | minor | | | [mypy](https://redirect.github.com/python/mypy) ([changelog](https://mypy.readthedocs.io/en/latest/changelog.html)) | `==2.3.1` → `==2.4.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/mypy/2.4.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/mypy/2.3.1/2.4.1?slim=true) | project.optional-dependencies | minor | | | [opentelemetry-exporter-otlp-proto-http](https://redirect.github.com/open-telemetry/opentelemetry-python) | `==1.45.1` → `==1.45.2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/opentelemetry-exporter-otlp-proto-http/1.45.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/opentelemetry-exporter-otlp-proto-http/1.45.1/1.45.2?slim=true) | project.dependencies | patch | | | [opentelemetry-instrumentation-fastapi](https://redirect.github.com/open-telemetry/opentelemetry-python-contrib) | `==0.66b1` → `==0.66b2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/opentelemetry-instrumentation-fastapi/0.66b2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/opentelemetry-instrumentation-fastapi/0.66b1/0.66b2?slim=true) | project.dependencies | patch | | | [opentelemetry-instrumentation-logging](https://redirect.github.com/open-telemetry/opentelemetry-python-contrib) | `==0.66b1` → `==0.66b2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/opentelemetry-instrumentation-logging/0.66b2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/opentelemetry-instrumentation-logging/0.66b1/0.66b2?slim=true) | project.dependencies | patch | | | [opentelemetry-instrumentation-sqlalchemy](https://redirect.github.com/open-telemetry/opentelemetry-python-contrib) | `==0.66b1` → `==0.66b2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/opentelemetry-instrumentation-sqlalchemy/0.66b2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/opentelemetry-instrumentation-sqlalchemy/0.66b1/0.66b2?slim=true) | project.dependencies | patch | | | [opentelemetry-sdk](https://redirect.github.com/open-telemetry/opentelemetry-python) | `==1.45.1` → `==1.45.2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/opentelemetry-sdk/1.45.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/opentelemetry-sdk/1.45.1/1.45.2?slim=true) | project.dependencies | patch | | | [playwright](https://redirect.github.com/Microsoft/playwright-python) ([changelog](https://redirect.github.com/microsoft/playwright-python/releases)) | `==1.63.0` → `==1.64.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/playwright/1.64.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/playwright/1.63.0/1.64.1?slim=true) | project.optional-dependencies | minor | | | [prek](https://prek.j178.dev/) ([source](https://redirect.github.com/j178/prek), [changelog](https://redirect.github.com/j178/prek/blob/main/CHANGELOG.md)) | `==0.5.3` → `==0.5.9` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/prek/0.5.9?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/prek/0.5.3/0.5.9?slim=true) | project.optional-dependencies | patch | `0.5.10` | | [pydantic-settings](https://redirect.github.com/pydantic/pydantic-settings) ([changelog](https://redirect.github.com/pydantic/pydantic-settings/releases)) | `==2.15.0` → `==2.16.2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pydantic-settings/2.16.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pydantic-settings/2.15.0/2.16.2?slim=true) | project.dependencies | minor | | | [pyjwt](https://redirect.github.com/jpadilla/pyjwt) | `==2.15.0` → `==2.15.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pyjwt/2.15.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pyjwt/2.15.0/2.15.1?slim=true) | project.dependencies | patch | | | [pytest](https://redirect.github.com/pytest-dev/pytest) ([changelog](https://docs.pytest.org/en/stable/changelog.html)) | `==9.1.1` → `==9.2.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pytest/9.2.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pytest/9.1.1/9.2.0?slim=true) | project.optional-dependencies | minor | | | [pytest-asyncio](https://redirect.github.com/pytest-dev/pytest-asyncio) ([changelog](https://pytest-asyncio.readthedocs.io/en/stable/reference/changelog.html)) | `==1.4.0` → `==1.4.1.post1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pytest-asyncio/1.4.1.post1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pytest-asyncio/1.4.0/1.4.1.post1?slim=true) | project.optional-dependencies | patch | | | [pytest-benchmark](https://redirect.github.com/ionelmc/pytest-benchmark) ([changelog](https://pytest-benchmark.readthedocs.io/en/latest/changelog.html)) | `==5.3.0` → `==5.3.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pytest-benchmark/5.3.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pytest-benchmark/5.3.0/5.3.1?slim=true) | project.optional-dependencies | patch | | | [pytest-codspeed](https://redirect.github.com/CodSpeedHQ/pytest-codspeed) | `==5.0.3` → `==5.0.4` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pytest-codspeed/5.0.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pytest-codspeed/5.0.3/5.0.4?slim=true) | project.optional-dependencies | patch | | | [pytest-playwright](https://redirect.github.com/microsoft/playwright-pytest) | `==0.9.0` → `==0.10.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pytest-playwright/0.10.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pytest-playwright/0.9.0/0.10.0?slim=true) | project.optional-dependencies | minor | | | [python](https://hub.docker.com/_/python) ([source](https://redirect.github.com/docker-library/python)) | `3.14.8-slim-trixie` → `3.15.1-slim-trixie` | ![age](https://developer.mend.io/api/mc/badges/age/docker/python/3.15.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/python/3.14.8/3.15.1?slim=true) | final | minor | `3.15.2-slim-trixie` | | [python](https://hub.docker.com/_/python) ([source](https://redirect.github.com/docker-library/python)) | `3.14.8-slim-trixie` → `3.15.1-slim-trixie` | ![age](https://developer.mend.io/api/mc/badges/age/docker/python/3.15.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/python/3.14.8/3.15.1?slim=true) | stage | minor | `3.15.2-slim-trixie` | | [python-multipart](https://redirect.github.com/Kludex/python-multipart) ([changelog](https://redirect.github.com/Kludex/python-multipart/blob/master/CHANGELOG.md)) | `==0.0.32` → `==0.0.33` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/python-multipart/0.0.33?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/python-multipart/0.0.32/0.0.33?slim=true) | project.dependencies | patch | | | [ruff](https://docs.astral.sh/ruff) ([source](https://redirect.github.com/astral-sh/ruff), [changelog](https://redirect.github.com/astral-sh/ruff/blob/main/CHANGELOG.md)) | `==0.16.8` → `==0.17.3` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/ruff/0.17.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/ruff/0.16.8/0.17.3?slim=true) | project.optional-dependencies | minor | | | [selenium](https://www.selenium.dev) | `==4.49.0` → `==4.52.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/selenium/4.52.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/selenium/4.49.0/4.52.0?slim=true) | project.optional-dependencies | minor | | | [sqlalchemy](https://redirect.github.com/sqlalchemy/sqlalchemy) ([changelog](https://docs.sqlalchemy.org/en/latest/changelog/)) | `==2.0.54` → `==2.1.6` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/sqlalchemy/2.1.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/sqlalchemy/2.0.54/2.1.6?slim=true) | project.dependencies | minor | `2.1.8` (+1) | | [squawk-cli](https://squawkhq.com) ([source](https://redirect.github.com/sbdchd/squawk)) | `==2.70.0` → `==2.71.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/squawk-cli/2.71.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/squawk-cli/2.70.0/2.71.0?slim=true) | project.optional-dependencies | minor | | | [uvicorn](https://redirect.github.com/Kludex/uvicorn) ([changelog](https://uvicorn.dev/release-notes)) | `==0.53.0` → `==0.54.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/uvicorn/0.54.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/uvicorn/0.53.0/0.54.0?slim=true) | project.dependencies | minor | | | [valkey/valkey](https://redirect.github.com/valkey-io/valkey) | `9.1.2-alpine` → `9.1.3-alpine` | ![age](https://developer.mend.io/api/mc/badges/age/docker/valkey%2fvalkey/9.1.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/valkey%2fvalkey/9.1.2/9.1.3?slim=true) | | patch | | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://redirect.github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>microsoft/playwright-mcp (@playwright/mcp)</summary> ### [`v0.0.84`](https://redirect.github.com/microsoft/playwright-mcp/releases/tag/v0.0.84) [Compare Source](https://redirect.github.com/microsoft/playwright-mcp/compare/v0.0.83...v0.0.84) #### ✨ Highlights - **👥 Separate sessions in one browser** — work with multiple accounts without sharing their cookies or storage. `browser_tabs` with `action: "new"` now accepts `isolatedContext: "<name>"`: tabs with the same name share a context, while different names stay isolated. Omit it or use `"default"` for the default context. Cookie and storage tools operate on the current tab's context. ([microsoft/playwright#43087](https://redirect.github.com/microsoft/playwright/pull/43087)) - **🙈 Redact runtime values in URLs** ([#1791](https://redirect.github.com/microsoft/playwright-mcp/issues/1791)) — session and grant values minted at runtime cannot be listed in a secrets file ahead of time. `--redact-url-params=access_token,code` (config `redactUrlParams`, env `PLAYWRIGHT_MCP_REDACT_URL_PARAMS`) replaces the named query and fragment parameter values with `<redacted>` in tool responses. Like `secrets`, this is a convenience, not a security feature. The extension also removes its connection token from the connect page URL after reading it. ([microsoft/playwright#43258](https://redirect.github.com/microsoft/playwright/pull/43258)) - **🔎 Bound find results** ([microsoft/playwright#42077](https://redirect.github.com/microsoft/playwright/issues/42077)) — common search terms no longer have to fill the response with every match. `browser_find` accepts a positive integer `maxResults`, returns the first matching items with their context, and reports the total match count. Omit it to keep returning all matches; ancestor paths are unchanged. ([microsoft/playwright#42947](https://redirect.github.com/microsoft/playwright/pull/42947)) - **🌐 Inspect requests across navigations** ([microsoft/playwright-cli#479](https://redirect.github.com/microsoft/playwright-cli/issues/479)) — requests from the previous page are no longer lost as soon as a flow navigates. `browser_network_requests` accepts `all: true` to include retained history, keeping up to 200 requests from earlier navigations. Request indexes stay stable across navigations for `browser_network_request`. `browser_console_messages` also reports counts consistent with its existing `all` option. ([microsoft/playwright#43526](https://redirect.github.com/microsoft/playwright/pull/43526)) - **🎯 Use locators in your language** ([#1797](https://redirect.github.com/microsoft/playwright-mcp/issues/1797)) — element tools such as `browser_click` now accept JavaScript, Python, Java and C# locators in `target`, alongside snapshot refs and CSS selectors. Invalid targets get an actionable error, including a reminder to pass the bare ref rather than `button [ref=e5]`. ([microsoft/playwright#43539](https://redirect.github.com/microsoft/playwright/pull/43539)) - **📂 Skip unsupported workspace-root requests** ([#1798](https://redirect.github.com/microsoft/playwright-mcp/issues/1798)) — clients that advertise roots but cannot answer `roots/list` can stall the first tool call. Pass `--ignore-roots` (config `ignoreRoots: true`, env `PLAYWRIGHT_MCP_IGNORE_ROOTS=true`) to skip that request and use the server's current working directory as the workspace root. ([microsoft/playwright#43532](https://redirect.github.com/microsoft/playwright/pull/43532)) - **🍪 Delete cookies by domain and path** — deleting a cookie by name no longer has to remove every cookie with that name. `browser_cookie_delete` (opt-in via `--caps=storage`) accepts optional `domain` and `path` filters to leave other domains and paths untouched. ([microsoft/playwright#43319](https://redirect.github.com/microsoft/playwright/pull/43319)) #### 🐛 Fixes - `fix(mcp): allow combining time, text and textGone in browser_wait_for` — when combined with a text condition, `time` is its timeout (capped at 30 seconds), not a delay before checking it. Supplying both `text` and `textGone` now waits for the first condition to happen, rather than both in sequence. ([microsoft/playwright#43011](https://redirect.github.com/microsoft/playwright/pull/43011)) - `fix(mcp): allow loopback hosts by default for all bind addresses` — HTTP clients can connect through `localhost`, `127.0.0.1` or `[::1]` regardless of the bind address. Other hosts still require `--allowed-hosts`; binding to `0.0.0.0` prints a usable localhost URL. ([microsoft/playwright#42993](https://redirect.github.com/microsoft/playwright/pull/42993)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — credentials embedded in the proxy URL are now passed to the browser as proxy authentication settings. ([microsoft/playwright#43071](https://redirect.github.com/microsoft/playwright/pull/43071)) - `fix(mcp): race browser_navigate_back against modal states` — `browser_navigate_back` reports a dialog opened during history navigation instead of timing out. ([microsoft/playwright#43252](https://redirect.github.com/microsoft/playwright/pull/43252)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `browser_navigate` handles scheme-less hosts with ports and uses HTTP for loopback addresses such as `127.0.0.1:3000` and `[::1]:3000`. ([microsoft/playwright#43264](https://redirect.github.com/microsoft/playwright/pull/43264)) - `fix(mcp): do not close the browser twice when the client disconnects` — stdio disconnects let the browser close gracefully instead of force-killing it through a second close request. Dashboard annotation processes also exit when their parent goes away. ([microsoft/playwright#43174](https://redirect.github.com/microsoft/playwright/pull/43174)) - `fix(mcp): give each isolated client its own idle timer` — with HTTP transport and `--isolated`, an idle client's context now expires even while another client keeps the shared browser busy. ([microsoft/playwright#43527](https://redirect.github.com/microsoft/playwright/pull/43527)) - `fix(mcp): apply route headers without bypassing origin filters` — `browser_route` (opt-in via `--caps=network`) matches added request header names case-insensitively, includes custom headers in mocked responses, and preserves origin filters and other routes when modifying request headers. ([microsoft/playwright#43227](https://redirect.github.com/microsoft/playwright/pull/43227), [microsoft/playwright#43244](https://redirect.github.com/microsoft/playwright/pull/43244), [microsoft/playwright#43637](https://redirect.github.com/microsoft/playwright/pull/43637)) - `fix(mcp): correct cookie filtering and missing-domain errors` — `browser_cookie_list` (opt-in via `--caps=storage`) matches domain and path boundaries instead of unrelated names such as `notexample.com` or `/apiary`. `browser_cookie_set` asks for an explicit `domain` when the current page has no hostname, such as `about:blank`. ([microsoft/playwright#43316](https://redirect.github.com/microsoft/playwright/pull/43316), [microsoft/playwright#43368](https://redirect.github.com/microsoft/playwright/pull/43368), [microsoft/playwright#43318](https://redirect.github.com/microsoft/playwright/pull/43318)) - `fix(mcp): accept Windows paths in browser_resume location` — `browser_resume` (opt-in via `--caps=devtools`) no longer mistakes a Windows drive-letter colon for the line-number separator. ([microsoft/playwright#43349](https://redirect.github.com/microsoft/playwright/pull/43349)) - `fix(mcp): report run-code route handler exceptions once and verbatim` — `browser_run_code_unsafe` reports a route handler's thrown value without duplicating it or wrapping non-Error values in another error. ([microsoft/playwright#43203](https://redirect.github.com/microsoft/playwright/pull/43203)) - `fix(extension): release debugger when attach completes after connection close` — disconnecting while `browser_tabs` attaches to a new tab no longer leaves that tab attached to the extension's debugger. ([microsoft/playwright#43025](https://redirect.github.com/microsoft/playwright/pull/43025)) - `fix(chromium): close pages that crashed before connecting over CDP` — connecting through `--cdp-endpoint` no longer stalls on an already crashed or discarded page; those pages are omitted from the tab list. ([microsoft/playwright#43075](https://redirect.github.com/microsoft/playwright/pull/43075)) - `fix(aria): skip text nodes that are not rendered` — `browser_snapshot` and accessible names omit unrendered text, including unslotted shadow-host text and text directly inside closed `<details>`. ([microsoft/playwright#43150](https://redirect.github.com/microsoft/playwright/pull/43150)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude inert content and content outside the topmost modal `<dialog>`. Click and fill actions wait for targets to stop being inert instead of silently misfiring. ([microsoft/playwright#43211](https://redirect.github.com/microsoft/playwright/pull/43211)) - `fix(aria): do not count whitespace-only contributors as name sources` — snapshots retain button names when whitespace around a hidden icon previously caused the name to disappear. ([microsoft/playwright#43317](https://redirect.github.com/microsoft/playwright/pull/43317)) - `fix(aria): resolve label references consistently` — snapshots and role locators recognize tab- or newline-separated label IDs and labels assigned through `ariaLabelledByElements`, while retaining attribute-based labels in older browsers. ([microsoft/playwright#43361](https://redirect.github.com/microsoft/playwright/pull/43361), [microsoft/playwright#43577](https://redirect.github.com/microsoft/playwright/pull/43577), [microsoft/playwright#43722](https://redirect.github.com/microsoft/playwright/pull/43722)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-like names remain strings rather than being parsed as null or special floating-point values. ([microsoft/playwright#43469](https://redirect.github.com/microsoft/playwright/pull/43469)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots retain an iframe's contents when the iframe element also contains fallback text. ([microsoft/playwright#43635](https://redirect.github.com/microsoft/playwright/pull/43635)) - `fix(aria): match mixed-case roles and states` — snapshots and role locators recognize mixed-case `role` and ARIA state values, including checked, pressed and expanded states. ([microsoft/playwright#43727](https://redirect.github.com/microsoft/playwright/pull/43727)) #### 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.84 ``` ### [`v0.0.83`](https://redirect.github.com/microsoft/playwright-mcp/releases/tag/v0.0.83) [Compare Source](https://redirect.github.com/microsoft/playwright-mcp/compare/v0.0.82...v0.0.83) #### Bug Fixes - `browser_find` takes `filename` to save matches to a file instead of the response ([microsoft/playwright#42077](https://redirect.github.com/microsoft/playwright/issues/42077)). ([microsoft/playwright#42968](https://redirect.github.com/microsoft/playwright/pull/42968)) - `browser_navigate` and `browser_reload` report a dialog opened during page load instead of timing out ([microsoft/playwright#42817](https://redirect.github.com/microsoft/playwright/issues/42817)). ([microsoft/playwright#42908](https://redirect.github.com/microsoft/playwright/pull/42908)) - The server no longer crashes when the browser is closed during a download ([microsoft/playwright#42831](https://redirect.github.com/microsoft/playwright/issues/42831)). ([microsoft/playwright#42922](https://redirect.github.com/microsoft/playwright/pull/42922)) - `browser_wait_for` reports when `time` is capped at 30 seconds ([#1767](https://redirect.github.com/microsoft/playwright-mcp/issues/1767)). ([microsoft/playwright#42932](https://redirect.github.com/microsoft/playwright/pull/42932)) - WebMCP tools no longer stay bound to a stale tab or frame ([microsoft/playwright#42816](https://redirect.github.com/microsoft/playwright/issues/42816)). ([microsoft/playwright#42821](https://redirect.github.com/microsoft/playwright/pull/42821)) - WebMCP tool calls work with Chromium 155+. ([microsoft/playwright#42915](https://redirect.github.com/microsoft/playwright/pull/42915)) - Snapshots quote accessible names that look like regexes, e.g. `"/home/"` ([microsoft/playwright#42807](https://redirect.github.com/microsoft/playwright/issues/42807)). ([microsoft/playwright#42811](https://redirect.github.com/microsoft/playwright/pull/42811)) - The Docker image reaps orphaned browser processes ([#1769](https://redirect.github.com/microsoft/playwright-mcp/issues/1769)). ([#1771](https://redirect.github.com/microsoft/playwright-mcp/pull/1771)) </details> <details> <summary>CodSpeedHQ/action</summary> ### [`v5.6.1`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.6.1) [Compare Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.6.0...v5.6.1) Bumps the CodSpeed runner to [v5.6.1](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.6.1). ##### Fixes - Walltime: the runner no longer hangs after the benchmark exits when a Python process forks and leaves a corrupted perf jitdump ([#599](https://redirect.github.com/CodSpeedHQ/codspeed/pull/599)) - Simulation: stop the libpython symlink warning from firing falsely ([#594](https://redirect.github.com/CodSpeedHQ/codspeed/pull/594)) ##### 🐛 Bug Fixes - Stop the libpython symlink warning from firing falsely by [@not-matthias](https://redirect.github.com/not-matthias) in [#594](https://redirect.github.com/CodSpeedHQ/runner/pull/594) ##### 💼 Other - Bump submodule to not loop on corrupted jit dump by [@GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange) in [#599](https://redirect.github.com/CodSpeedHQ/runner/pull/599) **Full Runner Changelog**: <https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md> #### What's Changed - docs(examples): update the example workflows by [@SuperMuel](https://redirect.github.com/SuperMuel) in [#252](https://redirect.github.com/CodSpeedHQ/action/pull/252) - chore: bump runner version to 5.6.1 by [@github-actions](https://redirect.github.com/github-actions)\[bot] in [#254](https://redirect.github.com/CodSpeedHQ/action/pull/254) #### New Contributors - [@SuperMuel](https://redirect.github.com/SuperMuel) made their first contribution in [#252](https://redirect.github.com/CodSpeedHQ/action/pull/252) **Full Changelog**: <https://github.com/CodSpeedHQ/action/compare/v5.6.0...v5.6.1> ### [`v5.6.0`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.6.0) [Compare Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.5.0...v5.6.0) Bumps the CodSpeed runner to [v5.6.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.6.0). ##### Highlights ##### More consistent CPU Simulation results Changes to your CI environment, like a different path or an extra environment variable, no longer change the performance. Each benchmark now starts with the same memory layout, reducing the chance of false regressions. ##### 🐛 Bug Fixes - Keep the user's `HOME` when wrapping commands with sudo by [@lvaroqui](https://redirect.github.com/lvaroqui) in [#588](https://redirect.github.com/CodSpeedHQ/codspeed/pull/588) ##### ⚙️ Internals - Bump pinned valgrind-codspeed to [3.26.0-0codspeed10](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/releases/tag/3.26.0-0codspeed10) by [@adriencaccia](https://redirect.github.com/adriencaccia) in [#593](https://redirect.github.com/CodSpeedHQ/codspeed/pull/593) - fix(callgrind): suppress L3 warning for explicit LL settings by [@not-matthias](https://redirect.github.com/not-matthias) in [CodSpeedHQ/valgrind-codspeed#52](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/52) - fix(initimg): stabilize Linux startup stack layout by [@not-matthias](https://redirect.github.com/not-matthias) in [CodSpeedHQ/valgrind-codspeed#53](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/53) **Full Runner Changelog**: <https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md> #### What's Changed - chore: bump runner version to 5.6.0 by [@github-actions](https://redirect.github.com/github-actions)\[bot] in [#253](https://redirect.github.com/CodSpeedHQ/action/pull/253) **Full Changelog**: <https://github.com/CodSpeedHQ/action/compare/v5.5.0...v5.6.0> </details> <details> <summary>actions/upload-artifact</summary> ### [`v7.0.2`](https://redirect.github.com/actions/upload-artifact/releases/tag/v7.0.2) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2) #### What's Changed - Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers. - Updates [@actions/artifact](https://redirect.github.com/actions/artifact) to v6.3.1. #### New Contributors - [@tunc-d](https://redirect.github.com/tunc-d) made their first contribution in [#821](https://redirect.github.com/actions/upload-artifact/pull/821) **Full Changelog**: <https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2> </details> <details> <summary>anchore/syft</summary> ### [`v1.55.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.55.0) [Compare Source](https://redirect.github.com/anchore/syft/compare/v1.54.1...v1.55.0) ##### Added Features - Add support for scanning IPK packages using the deb-archive-cataloger \[PR [#5111](https://redirect.github.com/anchore/syft/pull/5111) [@skyhisi](https://redirect.github.com/skyhisi)] ##### Bug Fixes - Pin Gguff lib to prevent dropping packages \[PR [#5447](https://redirect.github.com/anchore/syft/pull/5447) [@spiffcs](https://redirect.github.com/spiffcs)] - Licensing: copyright holder missing, needed for Debian packaging \[Issue [#5394](https://redirect.github.com/anchore/syft/issues/5394)] \[PR [#5414](https://redirect.github.com/anchore/syft/pull/5414) [@wagoodman](https://redirect.github.com/wagoodman)] - Syft cli.Command() panics when invoked multiple times \[Issue [#2285](https://redirect.github.com/anchore/syft/issues/2285)] \[PR [#5386](https://redirect.github.com/anchore/syft/pull/5386) [@JasonMetal](https://redirect.github.com/JasonMetal)] ##### Additional Changes - bump go-make module and action together \[PR [#5415](https://redirect.github.com/anchore/syft/pull/5415) [@wagoodman](https://redirect.github.com/wagoodman)] ##### Dependencies 49 dependency changes (46 updated, 1 added, 2 removed). 5 vulnerabilities remediated. **🟢 Remediated (5)** - [GO-2026-6603](https://go.dev/cl/847185) (High) — golang.org/x/net - [GO-2026-6610](https://go.dev/cl/835145) (High) — golang.org/x/net - [GO-2026-6611](https://go.dev/cl/847186) (High) — golang.org/x/net - [GO-2026-6612](https://go.dev/cl/847187) (Critical) — golang.org/x/net - [GO-2026-6617](https://go.dev/cl/847188) (High) — golang.org/x/net <details> <summary>Updated (46 packages)</summary> - cloud.google.com/go/auth `v0.23.2` → `v0.23.3` - cloud.google.com/go/compute/metadata `v0.9.0` → `v0.9.1` - cloud.google.com/go/storage `v1.65.1` → `v1.68.0` - github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp `v1.33.0` → `v1.34.0` - github.com/aws/aws-sdk-go-v2 `v1.44.0` → `v1.47.1` - github.com/aws/aws-sdk-go-v2/config `v1.32.40` → `v1.33.6` - github.com/aws/aws-sdk-go-v2/credentials `v1.19.39` → `v1.20.6` - github.com/aws/aws-sdk-go-v2/feature/ec2/imds `v1.18.40` → `v1.20.1` - github.com/aws/aws-sdk-go-v2/internal/configsources `v1.4.40` → `v1.5.4` - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 `v2.7.40` → `v2.8.4` - github.com/aws/aws-sdk-go-v2/internal/v4a `v1.4.41` → `v1.5.4` - github.com/aws/aws-sdk-go-v2/service/internal/checksum `v1.10.0` → `v1.11.5` - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url `v1.13.40` → `v1.14.4` - github.com/aws/aws-sdk-go-v2/service/internal/s3shared `v1.19.41` → `v1.20.4` - github.com/aws/aws-sdk-go-v2/service/s3 `v1.108.0` → `v1.114.0` - github.com/aws/aws-sdk-go-v2/service/signin `v1.6.0` → `v1.10.1` - github.com/aws/aws-sdk-go-v2/service/sso `v1.34.0` → `v1.38.1` - github.com/aws/aws-sdk-go-v2/service/ssooidc `v1.39.0` → `v1.43.1` - github.com/aws/aws-sdk-go-v2/service/sts `v1.46.0` → `v1.51.1` - github.com/github/go-spdx/v2 `v2.7.0` → `v2.7.1` - github.com/go-git/go-billy/v5 `v5.9.1` → `v5.9.2` - github.com/go-git/go-git/v5 `v5.19.2` → `v5.19.3` - github.com/google/s2a-go `v0.1.9` → `v0.1.10` - github.com/googleapis/enterprise-certificate-proxy `v0.3.20` → `v0.3.22` - github.com/googleapis/gax-go/v2 `v2.24.0` → `v2.24.1` - github.com/gookit/color `v1.6.1` → `v1.6.2` - github.com/gpustack/gguf-parser-go `v0.26.3` → `v0.26.4` - github.com/hashicorp/go-getter `v1.8.9` → `v1.8.10` - github.com/pb33f/ordered-map/v2 `v2.3.1` → `v2.3.2` - github.com/pjbgf/sha1cd `v0.6.0` → `v0.7.0` - github.com/spiffe/go-spiffe/v2 `v2.7.0` → `v2.8.1` - golang.org/x/crypto `v0.57.0` → `v0.58.0` - golang.org/x/net `v0.59.0` → `v0.61.0` **(🟢 remediated [GO-2026-6603](https://go.dev/cl/847185), [GO-2026-6610](https://go.dev/cl/835145), [GO-2026-6611](https://go.dev/cl/847186), [GO-2026-6612](https://go.dev/cl/847187), [GO-2026-6617](https://go.dev/cl/847188))** - golang.org/x/oauth2 `v0.36.0` → `v0.37.0` - golang.org/x/sync `v0.23.0` → `v0.24.0` - golang.org/x/sys `v0.48.0` → `v0.49.0` - golang.org/x/term `v0.46.0` → `v0.47.0` - golang.org/x/text `v0.42.0` → `v0.43.0` - golang.org/x/tools `v0.50.0` → `v0.51.0` - google.golang.org/api `v0.294.0` → `v0.299.0` - google.golang.org/genproto/googleapis/rpc `v0.0.0-da73d73` → `v0.0.0-b142276` - google.golang.org/grpc `v1.83.2` → `v1.84.0` - modernc.org/cc/v4 `v4.29.2` → `v4.29.7` - modernc.org/ccgo/v4 `v4.35.0` → `v4.36.1` - modernc.org/libc `v1.75.7` → `v1.77.1` - modernc.org/sqlite `v1.59.0` → `v1.60.1` </details> <details> <summary>Added (1 package)</summary> - github.com/pb33f/go-yaml `v0.1.0` </details> <details> <summary>Removed (2 packages)</summary> - github.com/klauspost/cpuid/v2 `v2.3.0` - go.yaml.in/yaml/v4 `v4.0.0-rc.2` </details> **[(Full Changelog)](https://redirect.github.com/anchore/syft/compare/v1.54.1...v1.55.0)** ### [`v1.54.1`](https://redirect.github.com/anchore/syft/releases/tag/v1.54.1) [Compare Source](https://redirect.github.com/anchore/syft/compare/v1.54.0...v1.54.1) ##### Bug Fixes - resolve packages.lock dependencies deterministically \[PR [#5210](https://redirect.github.com/anchore/syft/pull/5210) [@spiffcs](https://redirect.github.com/spiffcs)] - Cannot produce attestation file from local podman image \[Issue [#1664](https://redirect.github.com/anchore/syft/issues/1664)] \[PR [#5368](https://redirect.github.com/anchore/syft/pull/5368) [@Bru456](https://redirect.github.com/Bru456)] ##### Dependencies 9 dependency changes (9 updated). <details> <summary>Updated (9 packages)</summary> - github.com/anchore/go-rpmdb `v0.2.0` → `v0.2.2` - github.com/anchore/stereoscope `v0.3.3` → `v0.3.4` - github.com/docker/cli `v29.8.1+incompatible` → `v29.8.2+incompatible` - github.com/glebarez/go-sqlite `v1.20.3` → `v1.23.0` - github.com/klauspost/compress `v1.20.0` → `v1.20.1` - github.com/secure-systems-lab/go-securesystemslib `v0.11.0` → `v0.11.1` - github.com/sigstore/protobuf-specs `v0.5.1` → `v0.5.2` - github.com/sigstore/sigstore `v1.10.8` → `v1.10.11` - github.com/sylabs/sif/v2 `v2.24.1` → `v2.24.2` </details> **[(Full Changelog)](https://redirect.github.com/anchore/syft/compare/v1.54.0...v1.54.1)** ### [`v1.54.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.54.0) [Compare Source](https://redirect.github.com/anchore/syft/compare/v1.52.0...v1.54.0) ##### Added Features - report the perl interpreter as a cpan package \[PR [#5132](https://redirect.github.com/anchore/syft/pull/5132) [@wagoodman](https://redirect.github.com/wagoodman)] - Add package cataloger for perl ecosystem \[Issue [#1906](https://redirect.github.com/anchore/syft/issues/1906)] \[PR [#5131](https://redirect.github.com/anchore/syft/pull/5131) [@wagoodman](https://redirect.github.com/wagoodman)] - Analyze with Non-Daemon podman \[Issue [#1173](https://redirect.github.com/anchore/syft/issues/1173)] ##### Bug Fixes - write a name for the root package when the source has none \[PR [#5349](https://redirect.github.com/anchore/syft/pull/5349) [@DrVelvetFog](https://redirect.github.com/DrVelvetFog)] - match opensource.org license URLs across SPDX URL forms \[PR [#5361](https://redirect.github.com/anchore/syft/pull/5361) [@willmurphyscode](https://redirect.github.com/willmurphyscode)] - Account for malformed GGUF and safetensors parameter counts \[PR [#5343](https://redirect.github.com/anchore/syft/pull/5343) [@wagoodman](https://redirect.github.com/wagoodman)] - don't panic on a root file without a supplier or null entries \[PR [#5326](https://redirect.github.com/anchore/syft/pull/5326) [@DrVelvetFog](https://redirect.github.com/DrVelvetFog)] - do not panic on a stack.yaml rev pin \[PR [#5310](https://redirect.github.com/anchore/syft/pull/5310) [@arpitjain099](https://redirect.github.com/arpitjain099)] - report scanner errors and raise the line cap in metadata parsers \[PR [#5353](https://redirect.github.com/anchore/syft/pull/5353) [@wagoodman](https://redirect.github.com/wagoodman)] - Harden cataloger parsers against truncated input (do not panic) \[PR [#5355](https://redirect.github.com/anchore/syft/pull/5355) [@wagoodman](https://redirect.github.com/wagoodman)] - bound CPE candidate generation for pathological package metadata \[PR [#5356](https://redirect.github.com/anchore/syft/pull/5356) [@wagoodman](https://redirect.github.com/wagoodman)] - account for UPX's loader padding when unpacking Go binaries \[PR [#5347](https://redirect.github.com/anchore/syft/pull/5347) [@huuyafwww](https://redirect.github.com/huuyafwww)] - handle malformed GGUF headers without panicking \[PR [#5345](https://redirect.github.com/anchore/syft/pull/5345) [@wagoodman](https://redirect.github.com/wagoodman)] - bound model companion file reads and validate their contents \[PR [#5344](https://redirect.github.com/anchore/syft/pull/5344) [@wagoodman](https://redirect.github.com/wagoodman)] - don't fail the whole SBOM when a cataloger panics on one file \[PR [#5342](https://redirect.github.com/anchore/syft/pull/5342) [@wagoodman](https://redirect.github.com/wagoodman)] - release package collection lock in Ubuntu ESM detection \[PR [#5336](https://redirect.github.com/anchore/syft/pull/5336) [@sverrirsig](https://redirect.github.com/sverrirsig)] - render TUI log lines on their own rows, with colors and a small header \[PR [#5324](https://redirect.github.com/anchore/syft/pull/5324) [@wagoodman](https://redirect.github.com/wagoodman)] - uv.lock: dependents are linked to every locked version of a dependency \[Issue [#5340](https://redirect.github.com/anchore/syft/issues/5340)] \[PR [#5351](https://redirect.github.com/anchore/syft/pull/5351) [@devtechedge](https://redirect.github.com/devtechedge)] - java-archive-cataloger maps Apache Groovy 4+ (org.apache.groovy) to obsolete org.codehaus.groovy \[Issue [#5311](https://redirect.github.com/anchore/syft/issues/5311)] \[PR [#5313](https://redirect.github.com/anchore/syft/pull/5313) [@texasich](https://redirect.github.com/texasich)] - Support traefik binary various versions \[Issue [#4980](https://redirect.github.com/anchore/syft/issues/4980)] \[PR [#5281](https://redirect.github.com/anchore/syft/pull/5281) [@mayanksekhar](https://redirect.github.com/mayanksekhar)] - File Digests Remain at Zero, No Hashes Available Despite .syft.yaml Settings Should Support \[Issue [#5325](https://redirect.github.com/anchore/syft/issues/5325)] \[PR [#5341](https://redirect.github.com/anchore/syft/pull/5341) [@wagoodman](https://redirect.github.com/wagoodman)] - not showing expat CVEs from syft generated sbom \[Issue [#4771](https://redirect.github.com/anchore/syft/issues/4771)] \[PR [#5259](https://redirect.github.com/anchore/syft/pull/5259) [@KR-Ravindra](https://redirect.github.com/KR-Ravindra)] - PHP extensions are cataloged as upstream products using the PHP version \[Issue [#5014](https://redirect.github.com/anchore/syft/issues/5014)] \[PR [#5102](https://redirect.github.com/anchore/syft/pull/5102) [@pujitha24](https://redirect.github.com/pujitha24)] - Panic during scanning with gguf-cataloger/safetensors-cataloger \[Issue [#5327](https://redirect.github.com/anchore/syft/issues/5327)] \[PR [#5328](https://redirect.github.com/anchore/syft/pull/5328) [@tk1475](https://redirect.github.com/tk1475)] - github-actions cataloger emits an invalid PURL for docker:// use statements \[Issue [#5299](https://redirect.github.com/anchore/syft/issues/5299)] \[PR [#5302](https://redirect.github.com/anchore/syft/pull/5302) [@yunaremaia](https://redirect.github.com/yunaremaia)] - Crash when running syft on a directory that is the root file system of a Yocto build \[Issue [#5320](https://redirect.github.com/anchore/syft/issues/5320)] \[PR [#5321](https://redirect.github.com/anchore/syft/pull/5321) [@somaz94](https://redirect.github.com/somaz94)] - Invalid PURLs when cataloging instrumentation classes/jars \[Issue [#2596](https://redirect.github.com/anchore/syft/issues/2596)] ##### Dependencies 79 dependency changes (48 updated, 28 added, 3 removed). 2 vulnerabilities remediated. **🟢 Remediated (2)** - [GHSA-8wmf-6v46-5gfg](https://redirect.github.com/advisories/GHSA-8wmf-6v46-5gfg) (Low) — go.opentelemetry.io/otel/sdk - [GHSA-pg57-6jwg-q645](https://redirect.github.com/advisories/GHSA-pg57-6jwg-q645) (Medium) — github.com/containerd/containerd/v2 **Toolchains (1)** - Go minimum version: `1.26.3` → `1.26.8` <details> <summary>Updated (48 packages)</summary> - github.com/Microsoft/hcsshim `v0.15.0-rc.1` → `v0.15.0-rc.4` - github.com/anchore/bubbly `v0.2.1` → `v0.2.2` - github.com/anchore/go-logger `v0.1.1` → `v0.2.0` - github.com/anchore/stereoscope `v0.3.2` → `v0.3.3` - github.com/bmatcuk/doublestar/v4 `v4.10.0` → `v4.10.2` - github.com/containerd/containerd/api `v1.11.1` → `v1.12.0` - github.com/containerd/containerd/v2 `v2.3.5` → `v2.4.1` **(🟢 remediated [GHSA-pg57-6jwg-q645](https://redirect.github.com/advisories/GHSA-pg57-6jwg-q645))** - github.com/containerd/log `v0.1.0` → `v0.2.0` - github.com/containerd/ttrpc `v1.2.8` → `v1.2.9` - github.com/containerd/typeurl/v2 `v2.2.3` → `v2.3.0` - github.com/cyphar/filepath-securejoin `v0.6.1` → `v0.7.0` - github.com/docker/cli `v29.8.0+incompatible` → `v29.8.1+incompatible` - github.com/docker/docker-credential-helpers `v0.9.5` → `v0.9.8` - github.com/dustin/go-humanize `v1.0.1` → `v1.1.0` - github.com/erofs/go-erofs `v0.3.0` → `v0.3.1` - github.com/felixge/httpsnoop `v1.0.4` → `v1.1.0` - github.com/fsnotify/fsnotify `v1.9.0` → `v1.10.1` - github.com/go-jose/go-jose/v4 `v4.1.4` → `v4.1.5` - github.com/go-logr/logr `v1.4.3` → `v1.4.4` - github.com/hashicorp/hcl/v2 `v2.24.0` → `v2.25.0` - github.com/magiconair/properties `v1.18.11` → `v1.18.12` - github.com/mattn/go-runewidth `v0.0.21` → `v0.0.27` - github.com/moby/sys/user `v0.4.0` → `v0.4.1` - github.com/moby/sys/userns `v0.1.0` → `v0.2.1` - github.com/nwaples/rardecode/v2 `v2.2.0` → `v2.4.1` - github.com/olekukonko/tablewriter `v1.1.4` → `v1.1.5` - github.com/sirupsen/logrus `v1.9.4` → `v1.10.2` - github.com/ulikunitz/xz `v0.5.16` → `v0.5.17` - github.com/zclconf/go-cty `v1.16.3` → `v1.19.0` - go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc `v0.68.0` → `v0.71.0` - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp `v0.68.0` → `v0.71.0` - go.opentelemetry.io/otel `v1.44.0` → `v1.46.0` - go.opentelemetry.io/otel/metric `v1.44.0` → `v1.46.0` - go.opentelemetry.io/otel/metric/x `v0.66.0` → `v0.68.0` - go.opentelemetry.io/otel/sdk `v1.44.0` → `v1.46.0` **(🟢 remediated [GHSA-8wmf-6v46-5gfg](https://redirect.github.com/advisories/GHSA-8wmf-6v46-5gfg))** - go.opentelemetry.io/otel/sdk/metric `v1.44.0` → `v1.46.0` - go.opentelemetry.io/otel/trace `v1.44.0` → `v1.46.0` - golang.org/x/crypto `v0.56.0` → `v0.57.0` - golang.org/x/net `v0.58.0` → `v0.59.0` - golang.org/x/sync `v0.22.0` → `v0.23.0` - golang.org/x/sys `v0.47.0` → `v0.48.0` - golang.org/x/term `v0.45.0` → `v0.46.0` - golang.org/x/text `v0.41.0` → `v0.42.0` - golang.org/x/tools `v0.49.0` → `v0.50.0` - google.golang.org/genproto/googleapis/api `v0.0.0-e75dac1` → `v0.0.0-da73d73` - google.golang.org/genproto/googleapis/rpc `v0.0.0-08b0e42` → `v0.0.0-da73d73` - modernc.org/libc `v1.75.6` → `v1.75.7` - modernc.org/sqlite `v1.58.0` → `v1.59.0` </details> <details> <summary>Added (28 packages)</summary> - cyphar.com/go-pathrs `v0.2.5` - github.com/VividCortex/ewma `v1.2.0` - github.com/apparentlymart/go-textseg/v17 `v17.0.1` - github.com/containerd/log/otel `v0.1.0` - github.com/containerd/stargz-snapshotter/estargz `v0.18.2` - github.com/containers/libtrust `v0.0.0-c1716e8` - github.com/containers/ocicrypt `v1.3.2` - github.com/cyberphone/json-canonicalization `v0.0.0-19d51d7` - github.com/google/go-intervals `v0.0.2` - github.com/mattn/go-sqlite3 `v1.14.48` - github.com/miekg/pkcs11 `v1.1.2` - github.com/mistifyio/go-zfs/v4 `v4.0.0` - github.com/moby/sys/capability `v0.4.0` - github.com/opencontainers/selinux `v1.15.1` - github.com/proglottis/gpgme `v0.1.6` - github.com/secure-systems-lab/go-securesystemslib `v0.11.0` - github.com/sigstore/fulcio `v1.8.7` - github.com/sigstore/protobuf-specs `v0.5.1` - github.com/sigstore/sigstore `v1.10.8` - github.com/smallstep/pkcs7 `v0.2.1` - github.com/stefanberger/go-pkcs11uri `v0.0.0-7828495` - github.com/tchap/go-patricia/v2 `v2.3.3` - github.com/vbatts/tar-split `v0.12.3` - github.com/vbauerster/cupwriter `v0.0.4` - github.com/vbauerster/mpb/v8 `v8.14.0` - github.com/youmark/pkcs8 `v0.0.0-a2c0da2` - go.podman.io/image/v5 `v5.41.2` - go.podman.io/storage `v1.64.1` </details> <details> <summary>Removed (3 packages)</summary> - github.com/gogo/protobuf `v1.3.2` - github.com/moby/sys/sequential `v0.6.0` - go.opencensus.io `v0.24.0` </details> **[(Full Changelog)](https://redirect.github.com/anchore/syft/compare/v1.52.0...v1.54.0)** </details> <details> <summary>aquasecurity/trivy (aquasec/trivy)</summary> ### [`v0.76.1`](https://redirect.github.com/aquasecurity/trivy/releases/tag/v0.76.1) [Compare Source](https://redirect.github.com/aquasecurity/trivy/compare/v0.76.0...v0.76.1) #### 🔐 Security update: eMudhra CA incident 🛡️ Trivy v0.76.1 includes mitigations for the [eMudhra intermediate CA key compromise](https://blog.cloudflare.com/emudhra-certificate-compromise/). - Official binaries are built with Go 1.27.3, which includes the certificate distrust mitigation tracked as [CVE-2026-111943](https://go.dev/issue/82345). - Official container images include an updated Alpine CA trust store that rejects the affected certificate chains. We recommend upgrading to v0.76.1 and redeploying container images to apply these updates. If you build Trivy from source, use Go 1.27.3 or later and keep your runtime CA trust store up to date. #### Changelog - [`e713f67`](https://redirect.github.com/aquasecurity/trivy/commit/e713f67f7d54decdcd9b3132c9751833dcced698) release: v0.76.1 \[release/v0.76] ([#11445](https://redirect.github.com/aquasecurity/trivy/issues/11445)) - [`6647bd6`](https://redirect.github.com/aquasecurity/trivy/commit/6647bd6ec5924087956285b773b8cae10508736e) fix(deps): bump the aws group across 1 directory with 6 updates \[backport: release/v0.76] ([#11446](https://redirect.github.com/aquasecurity/trivy/issues/11446)) - [`e0964c9`](https://redirect.github.com/aquasecurity/trivy/commit/e0964c97819b1d6a45b7e0426803745f173fc550) fix(deps): bump the docker group with 3 updates \[backport: release/v0.76] ([#11443](https://redirect.github.com/aquasecurity/trivy/issues/11443)) - [`992c360`](https://redirect.github.com/aquasecurity/trivy/commit/992c360c33d9f9627bb24c1fe3f20815110c88e5) fix(deps): bump the common group with 3 updates \[backport: release/v0.76] ([#11442](https://redirect.github.com/aquasecurity/trivy/issues/11442)) </details> <details> <summary>astral-sh/ruff-pre-commit</summary> ### [`v0.17.3`](https://redirect.github.com/astral-sh/ruff-pre-commit/releases/tag/v0.17.3) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.17.2...v0.17.3) See: <https://github.com/astral-sh/ruff/releases/tag/0.17.3> ### [`v0.17.2`](https://redirect.github.com/astral-sh/ruff-pre-commit/releases/tag/v0.17.2) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.17.1...v0.17.2) See: <https://github.com/astral-sh/ruff/releases/tag/0.17.2> ### [`v0.17.1`](https://redirect.github.com/astral-sh/ruff-pre-commit/releases/tag/v0.17.1) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.17.0...v0.17.1) See: <https://github.com/astral-sh/ruff/releases/tag/0.17.1> ### [`v0.17.0`](https://redirect.github.com/astral-sh/ruff-pre-commit/releases/tag/v0.17.0) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.10...v0.17.0) See: <https://github.com/astral-sh/ruff/releases/tag/0.17.0> ### [`v0.16.10`](https://redirect.github.com/astral-sh/ruff-pre-commit/releases/tag/v0.16.10) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.9...v0.16.10) See: <https://github.com/astral-sh/ruff/releases/tag/0.16.10> ### [`v0.16.9`](https://redirect.github.com/astral-sh/ruff-pre-commit/releases/tag/v0.16.9) [Compare Source](https://redirect.github.com/astral-sh/ruff-pre-commit/compare/v0.16.8...v0.16.9) See: <https://github.com/astral-sh/ruff/releases/tag/0.16.9> </details> <details> <summary>astral-sh/setup-uv</summary> ### [`v10.3.3`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.3.3): 🌈 Use Astral mirror for version manifests with GitHub fallback [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.3.2...v10.3.3) ##### Changes This release contains something that should have been included a very long time ago. Sorry for sleeping on that. This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change) Also a big thank you to [@soujasK](https://redirect.github.com/soujasK) for a set of bugfixes 👏 ##### 🐛 Bug fixes - Use Astral mirror for version manifests with GitHub fallback [@eifinger](https://redirect.github.com/eifinger) ([#1119](https://redirect.github.com/astral-sh/setup-uv/issues/1119)) - fix: allow whitespace in uv requirement specifiers [@soujasK](https://redirect.github.com/soujasK) ([#1112](https://redirect.github.com/astral-sh/setup-uv/issues/1112)) - fix: resolve \~= specifiers with PEP 440 semantics [@soujasK](https://redirect.github.com/soujasK) ([#1111](https://redirect.github.com/astral-sh/setup-uv/issues/1111)) - fix: only report a saved cache when saving succeeded [@soujasK](https://redirect.github.com/soujasK) ([#1110](https://redirect.github.com/astral-sh/setup-uv/issues/1110)) ##### 🧰 Maintenance - chore: update known checksums for 0.13.6 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1117](https://redirect.github.com/astral-sh/setup-uv/issues/1117)) ##### 📚 Documentation - docs: use JSDoc for compatible release specifier comment [@eifinger](https://redirect.github.com/eifinger) ([#1113](https://redirect.github.com/astral-sh/setup-uv/issues/1113)) - docs: update version references to v10.3.2 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1104](https://redirect.github.com/astral-sh/setup-uv/issues/1104)) ### [`v10.3.2`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.3.2): 🌈 update known checksums for 0.13.5 [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.3.1...v10.3.2) ##### Changes ##### 🧰 Maintenance - chore: update known checksums for 0.13.5 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1103](https://redirect.github.com/astral-sh/setup-uv/issues/1103)) ##### 📚 Documentation - docs: update version references to v10.3.1 @[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#1102](https://redirect.github.com/astral-sh/setup-uv/issues/1102)) ### [`v10.3.1`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.3.0...v10.3.1) > [!IMPORTANT] > ✂ PR body was truncated to here. --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: crazyracer98 <8631139+crazyracer98@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@playwright/mcp](https://playwright.dev) ([source](https://redirect.github.com/microsoft/playwright-mcp)) | [`0.0.83` → `0.0.85`](https://renovatebot.com/diffs/npm/@playwright%2fmcp/0.0.83/0.0.85) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@playwright%2fmcp/0.0.85?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@playwright%2fmcp/0.0.83/0.0.85?slim=true) | --- ### Release Notes <details> <summary>microsoft/playwright-mcp (@playwright/mcp)</summary> ### [`v0.0.85`](https://redirect.github.com/microsoft/playwright-mcp/releases/tag/v0.0.85) [Compare Source](https://redirect.github.com/microsoft/playwright-mcp/compare/v0.0.84...v0.0.85) #### ✨ Highlights - **🌙 Keep the browser in the background** ([microsoft/playwright#42973](https://redirect.github.com/microsoft/playwright/issues/42973)) — connecting through the extension activated the tab and focused the browser window, taking the screen from the app you were working in. Pass `--background` alongside `--extension` (config `background: true`, env `PLAYWRIGHT_MCP_BACKGROUND=1`) to leave the connected tab inactive and its window unfocused, and to open the client's new tabs in the background. With `PLAYWRIGHT_MCP_EXTENSION_TOKEN` set, the connect page opens in the background too (Chrome 158.0.8127.2 or later, with the browser already running). Requires extension 0.5.0 or later. Chrome throttles timers and animation frames in background tabs. ([microsoft/playwright#43864](https://redirect.github.com/microsoft/playwright/pull/43864)) - **🗂️ Leave tabs out of the Playwright tab group** ([microsoft/playwright#43038](https://redirect.github.com/microsoft/playwright/issues/43038)) — the extension always moved the tabs a client controls into its own tab group. Pass `--no-tab-group` alongside `--extension` (config `tabGroup: false`, env `PLAYWRIGHT_MCP_NO_TAB_GROUP=1`) to keep the selected tab and the tabs the client opens in their existing groups, if any. Connection approval is unchanged, each controlled tab still belongs to one client, and the extension's status page lists the controlled tabs. Requires extension 0.5.0 or later. ([microsoft/playwright#43814](https://redirect.github.com/microsoft/playwright/pull/43814)) - **👁️ Match only visible elements** ([microsoft/playwright#43855](https://redirect.github.com/microsoft/playwright/issues/43855)) — a locator could resolve to a hidden element, or fail because a hidden duplicate matched as well. Set `browser.contextOptions.locateOnlyVisible: true` in the config file to restrict locators to visible elements, both in the `target` of element tools such as `browser_click` and in `browser_run_code_unsafe`, as if `.filter({ visible: true })` ended each of them. A locator that ends with its own visibility filter keeps it. Off by default. ([microsoft/playwright#43903](https://redirect.github.com/microsoft/playwright/pull/43903)) - **🏷️ Keep container names in snapshots** ([microsoft/playwright#43809](https://redirect.github.com/microsoft/playwright/issues/43809)) — dialogs, landmarks and tables could appear unnamed even when their heading or caption was visible. `browser_snapshot` now retains identifying names on containers and table headers when the text supplying the name also appears among their children. ([microsoft/playwright#43810](https://redirect.github.com/microsoft/playwright/pull/43810)) - **🎯 Find custom form controls by label** ([microsoft/playwright#43898](https://redirect.github.com/microsoft/playwright/issues/43898)) — native `<label>` associations were ignored for form-associated custom elements. Element tools now recognize these controls through targets such as `getByLabel('City')`, and accessible names use the associated labels too. Both `for` attributes and nested labels are supported. ([microsoft/playwright#43900](https://redirect.github.com/microsoft/playwright/pull/43900)) #### 🐛 Fixes - `fix(aria): restore snapshot visibility rules for inert and modal content` — the filtering announced in v0.0.84 is reverted: `browser_snapshot` no longer hides content solely because it is inert or outside a modal dialog. Click, fill and select actions still wait for explicitly inert targets to become non-inert ([microsoft/playwright#43792](https://redirect.github.com/microsoft/playwright/issues/43792)). ([microsoft/playwright#43850](https://redirect.github.com/microsoft/playwright/pull/43850), [microsoft/playwright#43851](https://redirect.github.com/microsoft/playwright/pull/43851)) - `fix(mcp): preserve non-JSON evaluation results` — `browser_evaluate` returns readable representations of values such as BigInt, `NaN`, `Infinity`, `undefined` and circular objects instead of losing values or failing JSON serialization. JSON-compatible results keep their existing format ([#1838](https://redirect.github.com/microsoft/playwright-mcp/issues/1838)). ([microsoft/playwright#43973](https://redirect.github.com/microsoft/playwright/pull/43973)) - `fix(mcp): resolve config file paths relative to their source` — profile, executable, storage-state, output and other file paths in a config resolve against that file's directory, or its target's directory for a symlink. CLI and environment paths remain relative to the working directory. Extension connections also honor the merged executable-path configuration ([#1836](https://redirect.github.com/microsoft/playwright-mcp/issues/1836)). ([microsoft/playwright#43970](https://redirect.github.com/microsoft/playwright/pull/43970)) - `fix(extension): report lost tab instead of crashing` — tool responses report when a page closes before its snapshot can be captured. Extension connections also explain that Chrome may have detached the debugger because of an unsupported frame, rather than crashing response rendering ([microsoft/playwright#43230](https://redirect.github.com/microsoft/playwright/issues/43230)). ([microsoft/playwright#43863](https://redirect.github.com/microsoft/playwright/pull/43863)) - `fix(mcp): bound settle waits when page timers cannot run` — tool calls no longer hang during their settling delay when page timers are throttled, paused or otherwise unable to run ([microsoft/playwright#43752](https://redirect.github.com/microsoft/playwright/issues/43752)). ([microsoft/playwright#43767](https://redirect.github.com/microsoft/playwright/pull/43767)) - `fix(mcp): report event listener exceptions as console errors` — exceptions from page and context listeners installed through `browser_run_code_unsafe` appear in tool responses and `browser_console_messages` instead of escaping as unhandled errors ([microsoft/playwright#43770](https://redirect.github.com/microsoft/playwright/issues/43770)). ([microsoft/playwright#43686](https://redirect.github.com/microsoft/playwright/pull/43686)) - `fix(mcp): validate device names and preserve device descriptors` — unknown `--device` values produce an explicit error, and per-client overrides no longer mutate shared device presets ([#1834](https://redirect.github.com/microsoft/playwright-mcp/issues/1834)). ([microsoft/playwright#43971](https://redirect.github.com/microsoft/playwright/pull/43971)) - `fix(mcp): report one-based console source lines` — source locations in `browser_console_messages` and console entries in tool responses now use editor-style line numbers starting at 1 ([#1839](https://redirect.github.com/microsoft/playwright-mcp/issues/1839)). ([microsoft/playwright#43975](https://redirect.github.com/microsoft/playwright/pull/43975)) - `fix(mcp): clarify screenshot actions with vision tools` — the `browser_take_screenshot` description no longer rules out acting on a screenshot. `browser_snapshot` stays the default for actions; with `--caps=vision`, the description points to the coordinate-based mouse tools for elements that the snapshot does not expose, such as canvas content ([#1816](https://redirect.github.com/microsoft/playwright-mcp/issues/1816)). ([microsoft/playwright#43857](https://redirect.github.com/microsoft/playwright/pull/43857)) - `fix(aria): match mixed-case selected options in accessible names` — snapshots and role locators include the selected option's text when a custom listbox uses a mixed-case value such as `aria-selected="TRUE"` ([microsoft/playwright#43785](https://redirect.github.com/microsoft/playwright/issues/43785)). ([microsoft/playwright#43787](https://redirect.github.com/microsoft/playwright/pull/43787)) - `fix(chromium): preserve fonts when connecting with noDefaults` — extension connections no longer overwrite the existing browser's font settings, avoiding unexpected changes to page rendering ([microsoft/playwright#43715](https://redirect.github.com/microsoft/playwright/issues/43715)). ([microsoft/playwright#43773](https://redirect.github.com/microsoft/playwright/pull/43773)) - `fix(chromium): honor Linux config directories for channel connections` — extension profile lookup respects `CHROME_USER_DATA_DIR`, `CHROME_CONFIG_HOME` and `XDG_CONFIG_HOME`. Channel-based `--cdp-endpoint` connections also use the WebSocket path advertised in `DevToolsActivePort` ([microsoft/playwright#43880](https://redirect.github.com/microsoft/playwright/issues/43880)). ([microsoft/playwright#43884](https://redirect.github.com/microsoft/playwright/pull/43884)) - `fix(chromium): preserve HTTP navigations across HTTPS upgrade modes` — in browsers launched by the server, `browser_navigate` keeps HTTP URLs on HTTP instead of Chrome automatically upgrading them to HTTPS ([microsoft/playwright#43871](https://redirect.github.com/microsoft/playwright/issues/43871)). ([microsoft/playwright#43877](https://redirect.github.com/microsoft/playwright/pull/43877)) - `fix(chromium): account for tabs and toolbar in the new headless mode` — with `--headless`, Chrome and Edge now size their window to fit the viewport below the tab strip and toolbar, so videos from `browser_start_video` (opt-in via `--caps=devtools`) no longer lose the bottom of the page. ([microsoft/playwright#43904](https://redirect.github.com/microsoft/playwright/pull/43904)) - `fix(screenshot): support full-page SVG documents` — `browser_take_screenshot` with `fullPage: true` works on standalone SVG documents instead of waiting for a nonexistent HTML body ([microsoft/playwright#43962](https://redirect.github.com/microsoft/playwright/issues/43962)). ([microsoft/playwright#43972](https://redirect.github.com/microsoft/playwright/pull/43972)) ### [`v0.0.84`](https://redirect.github.com/microsoft/playwright-mcp/releases/tag/v0.0.84) [Compare Source](https://redirect.github.com/microsoft/playwright-mcp/compare/v0.0.83...v0.0.84) #### ✨ Highlights - **👥 Separate sessions in one browser** — work with multiple accounts without sharing their cookies or storage. `browser_tabs` with `action: "new"` now accepts `isolatedContext: "<name>"`: tabs with the same name share a context, while different names stay isolated. Omit it or use `"default"` for the default context. Cookie and storage tools operate on the current tab's context. ([microsoft/playwright#43087](https://redirect.github.com/microsoft/playwright/pull/43087)) - **🙈 Redact runtime values in URLs** ([#1791](https://redirect.github.com/microsoft/playwright-mcp/issues/1791)) — session and grant values minted at runtime cannot be listed in a secrets file ahead of time. `--redact-url-params=access_token,code` (config `redactUrlParams`, env `PLAYWRIGHT_MCP_REDACT_URL_PARAMS`) replaces the named query and fragment parameter values with `<redacted>` in tool responses. Like `secrets`, this is a convenience, not a security feature. The extension also removes its connection token from the connect page URL after reading it. ([microsoft/playwright#43258](https://redirect.github.com/microsoft/playwright/pull/43258)) - **🔎 Bound find results** ([microsoft/playwright#42077](https://redirect.github.com/microsoft/playwright/issues/42077)) — common search terms no longer have to fill the response with every match. `browser_find` accepts a positive integer `maxResults`, returns the first matching items with their context, and reports the total match count. Omit it to keep returning all matches; ancestor paths are unchanged. ([microsoft/playwright#42947](https://redirect.github.com/microsoft/playwright/pull/42947)) - **🌐 Inspect requests across navigations** ([microsoft/playwright-cli#479](https://redirect.github.com/microsoft/playwright-cli/issues/479)) — requests from the previous page are no longer lost as soon as a flow navigates. `browser_network_requests` accepts `all: true` to include retained history, keeping up to 200 requests from earlier navigations. Request indexes stay stable across navigations for `browser_network_request`. `browser_console_messages` also reports counts consistent with its existing `all` option. ([microsoft/playwright#43526](https://redirect.github.com/microsoft/playwright/pull/43526)) - **🎯 Use locators in your language** ([#1797](https://redirect.github.com/microsoft/playwright-mcp/issues/1797)) — element tools such as `browser_click` now accept JavaScript, Python, Java and C# locators in `target`, alongside snapshot refs and CSS selectors. Invalid targets get an actionable error, including a reminder to pass the bare ref rather than `button [ref=e5]`. ([microsoft/playwright#43539](https://redirect.github.com/microsoft/playwright/pull/43539)) - **📂 Skip unsupported workspace-root requests** ([#1798](https://redirect.github.com/microsoft/playwright-mcp/issues/1798)) — clients that advertise roots but cannot answer `roots/list` can stall the first tool call. Pass `--ignore-roots` (config `ignoreRoots: true`, env `PLAYWRIGHT_MCP_IGNORE_ROOTS=true`) to skip that request and use the server's current working directory as the workspace root. ([microsoft/playwright#43532](https://redirect.github.com/microsoft/playwright/pull/43532)) - **🍪 Delete cookies by domain and path** — deleting a cookie by name no longer has to remove every cookie with that name. `browser_cookie_delete` (opt-in via `--caps=storage`) accepts optional `domain` and `path` filters to leave other domains and paths untouched. ([microsoft/playwright#43319](https://redirect.github.com/microsoft/playwright/pull/43319)) #### 🐛 Fixes - `fix(mcp): allow combining time, text and textGone in browser_wait_for` — when combined with a text condition, `time` is its timeout (capped at 30 seconds), not a delay before checking it. Supplying both `text` and `textGone` now waits for the first condition to happen, rather than both in sequence. ([microsoft/playwright#43011](https://redirect.github.com/microsoft/playwright/pull/43011)) - `fix(mcp): allow loopback hosts by default for all bind addresses` — HTTP clients can connect through `localhost`, `127.0.0.1` or `[::1]` regardless of the bind address. Other hosts still require `--allowed-hosts`; binding to `0.0.0.0` prints a usable localhost URL. ([microsoft/playwright#42993](https://redirect.github.com/microsoft/playwright/pull/42993)) - `fix(mcp): pass credentials from --proxy-server as proxy username/password` — credentials embedded in the proxy URL are now passed to the browser as proxy authentication settings. ([microsoft/playwright#43071](https://redirect.github.com/microsoft/playwright/pull/43071)) - `fix(mcp): race browser_navigate_back against modal states` — `browser_navigate_back` reports a dialog opened during history navigation instead of timing out. ([microsoft/playwright#43252](https://redirect.github.com/microsoft/playwright/pull/43252)) - `fix(mcp): normalize bare host URLs and loopback IP addresses` — `browser_navigate` handles scheme-less hosts with ports and uses HTTP for loopback addresses such as `127.0.0.1:3000` and `[::1]:3000`. ([microsoft/playwright#43264](https://redirect.github.com/microsoft/playwright/pull/43264)) - `fix(mcp): do not close the browser twice when the client disconnects` — stdio disconnects let the browser close gracefully instead of force-killing it through a second close request. Dashboard annotation processes also exit when their parent goes away. ([microsoft/playwright#43174](https://redirect.github.com/microsoft/playwright/pull/43174)) - `fix(mcp): give each isolated client its own idle timer` — with HTTP transport and `--isolated`, an idle client's context now expires even while another client keeps the shared browser busy. ([microsoft/playwright#43527](https://redirect.github.com/microsoft/playwright/pull/43527)) - `fix(mcp): apply route headers without bypassing origin filters` — `browser_route` (opt-in via `--caps=network`) matches added request header names case-insensitively, includes custom headers in mocked responses, and preserves origin filters and other routes when modifying request headers. ([microsoft/playwright#43227](https://redirect.github.com/microsoft/playwright/pull/43227), [microsoft/playwright#43244](https://redirect.github.com/microsoft/playwright/pull/43244), [microsoft/playwright#43637](https://redirect.github.com/microsoft/playwright/pull/43637)) - `fix(mcp): correct cookie filtering and missing-domain errors` — `browser_cookie_list` (opt-in via `--caps=storage`) matches domain and path boundaries instead of unrelated names such as `notexample.com` or `/apiary`. `browser_cookie_set` asks for an explicit `domain` when the current page has no hostname, such as `about:blank`. ([microsoft/playwright#43316](https://redirect.github.com/microsoft/playwright/pull/43316), [microsoft/playwright#43368](https://redirect.github.com/microsoft/playwright/pull/43368), [microsoft/playwright#43318](https://redirect.github.com/microsoft/playwright/pull/43318)) - `fix(mcp): accept Windows paths in browser_resume location` — `browser_resume` (opt-in via `--caps=devtools`) no longer mistakes a Windows drive-letter colon for the line-number separator. ([microsoft/playwright#43349](https://redirect.github.com/microsoft/playwright/pull/43349)) - `fix(mcp): report run-code route handler exceptions once and verbatim` — `browser_run_code_unsafe` reports a route handler's thrown value without duplicating it or wrapping non-Error values in another error. ([microsoft/playwright#43203](https://redirect.github.com/microsoft/playwright/pull/43203)) - `fix(extension): release debugger when attach completes after connection close` — disconnecting while `browser_tabs` attaches to a new tab no longer leaves that tab attached to the extension's debugger. ([microsoft/playwright#43025](https://redirect.github.com/microsoft/playwright/pull/43025)) - `fix(chromium): close pages that crashed before connecting over CDP` — connecting through `--cdp-endpoint` no longer stalls on an already crashed or discarded page; those pages are omitted from the tab list. ([microsoft/playwright#43075](https://redirect.github.com/microsoft/playwright/pull/43075)) - `fix(aria): skip text nodes that are not rendered` — `browser_snapshot` and accessible names omit unrendered text, including unslotted shadow-host text and text directly inside closed `<details>`. ([microsoft/playwright#43150](https://redirect.github.com/microsoft/playwright/pull/43150)) - `fix(a11y): treat inert elements and content outside of modal dialogs as hidden` — snapshots exclude inert content and content outside the topmost modal `<dialog>`. Click and fill actions wait for targets to stop being inert instead of silently misfiring. ([microsoft/playwright#43211](https://redirect.github.com/microsoft/playwright/pull/43211)) - `fix(aria): do not count whitespace-only contributors as name sources` — snapshots retain button names when whitespace around a hidden icon previously caused the name to disappear. ([microsoft/playwright#43317](https://redirect.github.com/microsoft/playwright/pull/43317)) - `fix(aria): resolve label references consistently` — snapshots and role locators recognize tab- or newline-separated label IDs and labels assigned through `ariaLabelledByElements`, while retaining attribute-based labels in older browsers. ([microsoft/playwright#43361](https://redirect.github.com/microsoft/playwright/pull/43361), [microsoft/playwright#43577](https://redirect.github.com/microsoft/playwright/pull/43577), [microsoft/playwright#43722](https://redirect.github.com/microsoft/playwright/pull/43722)) - `fix(aria): quote ~, .inf and .nan in aria snapshots` — YAML-like names remain strings rather than being parsed as null or special floating-point values. ([microsoft/playwright#43469](https://redirect.github.com/microsoft/playwright/pull/43469)) - `fix(aria): preserve iframe snapshots with fallback text` — snapshots retain an iframe's contents when the iframe element also contains fallback text. ([microsoft/playwright#43635](https://redirect.github.com/microsoft/playwright/pull/43635)) - `fix(aria): match mixed-case roles and states` — snapshots and role locators recognize mixed-case `role` and ARIA state values, including checked, pressed and expanded states. ([microsoft/playwright#43727](https://redirect.github.com/microsoft/playwright/pull/43727)) #### 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.84 ``` </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Tokyo) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/izumin5210/dotfiles).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Yury Semikhatsky (yury-s) approved these changes Oct 3, 2026

View reviewed changes

Pavel Feldman (pavelfeldman) merged commit c2a031e into microsoft:main Oct 3, 2026

This was referenced Oct 5, 2026

fix: pass credentials from --proxy-server as proxy username/password JustasMonkev/mcp-accessibility-scanner#264

Merged

Decide whether to adopt upstream browser_tabs isolatedContext (named isolated contexts per tab) JustasMonkev/mcp-accessibility-scanner#267

Closed

phusitkumsri1437-arch mentioned this pull request Oct 15, 2026

chore: mark v0.0.84 microsoft/playwright-mcp#1793

Closed

This was referenced Oct 31, 2026

chore: mark v0.0.84 microsoft/playwright-mcp#1814

Merged

chore: mark v0.1.23 microsoft/playwright-cli#494

Merged

github-actions Bot mentioned this pull request Nov 1, 2026

Update Playwright MCP upstream to v0.0.84 swimmwatch/cloakbrowser-mcp#189

Open

github-actions Bot mentioned this pull request Nov 2, 2026

⬆️ Playwright MCP updated: v0.0.83 → v0.0.84 adamforrester/xd-toolkit#108

Open

github-actions Bot mentioned this pull request Nov 10, 2026

Update Playwright MCP upstream to v0.0.85 swimmwatch/cloakbrowser-mcp#195

Open

Navigation Menu

Repository navigation

feat(mcp): allow creating tabs in isolated browser contexts - #43087

feat(mcp): allow creating tabs in isolated browser contexts#43087
Pavel Feldman (pavelfeldman) merged 1 commit into
microsoft:mainfrom
pavelfeldman:mcp-isolated-contexts

Pavel Feldman (pavelfeldman) commented Oct 2, 2026

Uh oh!

Yury Semikhatsky (yury-s) Oct 2, 2026

Uh oh!

Yury Semikhatsky (yury-s) Oct 2, 2026

Uh oh!

Yury Semikhatsky (yury-s) Oct 2, 2026

Uh oh!

Pavel Feldman (pavelfeldman) Oct 3, 2026 •

edited

Loading

Uh oh!

Yury Semikhatsky (yury-s) Oct 3, 2026

Uh oh!

Pavel Feldman (pavelfeldman) Oct 3, 2026

Uh oh!

github-actions Bot commented Oct 3, 2026

Uh oh!

github-actions Bot commented Oct 3, 2026

Uh oh!

github-actions Bot commented Oct 3, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Pavel Feldman (pavelfeldman) commented Oct 2, 2026

Summary

Uh oh!

Yury Semikhatsky (yury-s) Oct 2, 2026

Choose a reason for hiding this comment

Uh oh!

Yury Semikhatsky (yury-s) Oct 2, 2026

Choose a reason for hiding this comment

Uh oh!

Yury Semikhatsky (yury-s) Oct 2, 2026

Choose a reason for hiding this comment

Uh oh!

Pavel Feldman (pavelfeldman) Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Yury Semikhatsky (yury-s) Oct 3, 2026

Choose a reason for hiding this comment

Uh oh!

Pavel Feldman (pavelfeldman) Oct 3, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 3, 2026

Test results for "tests 1"

Uh oh!

github-actions Bot commented Oct 3, 2026

Test results for "MCP"

Uh oh!

github-actions Bot commented Oct 3, 2026

🟢 The failure is a pre-existing flake

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Pavel Feldman (pavelfeldman) Oct 3, 2026 •

edited

Loading