[dependabot]

Bumps the development group with 6 updates in the / directory:

Package	From	To
@iconify-json/fluent	1.2.59	1.2.61
@playwright/test	1.63.0	1.64.1
@types/node	26.6.3	26.6.6
cspell	10.3.6	10.4.0
postcss-custom-media	12.0.2	12.0.3
postcss-nested	8.0.1	9.0.1

Updates @iconify-json/fluent from 1.2.59 to 1.2.61

Commits

• See full diff in compare view

Updates @playwright/test from 1.63.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• Additional commits viewable in compare view

Updates @types/node from 26.6.3 to 26.6.6

Commits

• See full diff in compare view

Updates cspell from 10.3.6 to 10.4.0

Release notes

Sourced from cspell's releases.

v10.4.0

Features

feat: Add --glob-symlinks to follow symbolic links when matching globs (#9342)

Summary

cspell lint can now follow symbolic links in glob searches, with --glob-symlinks. Glob searches skip linked files and linked directories by default, so a tree made of links, such as Bazel runfiles, found nothing to check.

Closes #7700.

Feature

cspell lint --glob-symlinks "**"

• --glob-symlinks follows symbolic links, and searches linked directories, when matching globs. Links are followed wherever they point.
• CSPELL_GLOB_SYMLINKS=true does the same for a whole job. --no-glob-symlinks overrides it.
• API: globSymlinks in the lint options.
• It can't be set in a configuration file.
• Files are reported by the path through the link. A file reached by two paths is checked under both.
• It applies only to glob searches. For --file, --files, and --file-list documents, use --follow-symlinks.

• The design decisions are recorded in docs/ADRs/glob-symlinks/.
• Link loops, such as a link to a parent directory, are stopped by the glob search after one level.

---

feat: Respect COLUMNS for help and table width (#9358)

Summary

Help, and the tables from cspell trace and cspell dictionaries, now follow the COLUMNS environment variable. That lets you choose a narrower width, which helps with large fonts and screen magnifiers. The help in the cspell README now fits on npmjs.com without scrolling sideways.

Feature

Set COLUMNS to pick the output width:

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.4.0 (2026-10-14)

Features

feat: Add --glob-symlinks to follow symbolic links when matching globs (#9342)

Summary

cspell lint can now follow symbolic links in glob searches, with --glob-symlinks. Glob searches skip linked files and linked directories by default, so a tree made of links, such as Bazel runfiles, found nothing to check.

Closes #7700.

Feature

cspell lint --glob-symlinks "**"

• --glob-symlinks follows symbolic links, and searches linked directories, when matching globs. Links are followed wherever they point.
• CSPELL_GLOB_SYMLINKS=true does the same for a whole job. --no-glob-symlinks overrides it.
• API: globSymlinks in the lint options.
• It can't be set in a configuration file.
• Files are reported by the path through the link. A file reached by two paths is checked under both.
• It applies only to glob searches. For --file, --files, and --file-list documents, use --follow-symlinks.

• The design decisions are recorded in docs/ADRs/glob-symlinks/.
• Link loops, such as a link to a parent directory, are stopped by the glob search after one level.

---

feat: Respect COLUMNS for help and table width (#9358)

Summary

Help, and the tables from cspell trace and cspell dictionaries, now follow the COLUMNS environment variable. That lets you choose a narrower width, which helps with large fonts and screen magnifiers. The help in the cspell README now fits on npmjs.com without scrolling sideways.

Feature

... (truncated)

Commits

• 7e2bbb5 v10.4.0
• d2dce3f chore: Prepare Release v10.4.0 (auto-deploy) (#9380)
• a1509fe chore: Fix the README build after the inject-markdown 6 upgrade (#9429)
• ab3ae04 fix: Workflow Bot -- Update Dictionaries (main) (#9405)
• 55c0fbd fix: Show hidden lint options and issue template help in cspell --help (#9387)
• 628768a v10.4.0-alpha.1
• 998957b chore: Prepare Release v10.4.0-alpha.1 (auto-deploy) (#9378)
• 4c287f5 fix: Deprecate cspell-lib/rpc; import from @cspell/rpc (#9376)
• 7be53ce chore: Prepare Release v10.4.0-alpha.0 (auto-deploy) (#9332)
• e3b5887 chore: Update README.md (#9368)
• Additional commits viewable in compare view

Updates postcss-custom-media from 12.0.2 to 12.0.3

Changelog

Sourced from postcss-custom-media's changelog.

12.0.3

October 1, 2026

• Updated @csstools/css-parser-algorithms to 4.0.2 (patch)
• Updated @csstools/cascade-layer-name-parser to 3.0.2 (patch)
• Updated @csstools/media-query-list-parser to 5.0.2 (patch)

Commits

• See full diff in compare view

Updates postcss-nested from 8.0.1 to 9.0.1

Release notes

Sourced from postcss-nested's releases.

9.0.1

• Fixed declarations after nested rules inside at-rules (by @​wahidrizka).

9.0.0

• Fixed compatibility with Sass nested and CSS nesting (by @​wahidrizka). See #176 and #179.

Changelog

Sourced from postcss-nested's changelog.

9.0.1

• Fixed declarations after nested rules inside at-rules (by @​wahidrizka).

9.0.0

• Fixed compatibility with Sass nested and CSS nesting (by @​wahidrizka). See #176 and #179.

Commits

• d7b4e8d Release 9.0.1 version
• 8aebe42 Update dependencies
• 9465773 Keep declarations after nested rules inside at-rules (#180)
• 90af828 Release 9.0.0 version
• 98eb47a Update dependencies
• 7370297 Keep all parent selectors inside :not() (#179)
• 4690ff0 Call formatter
• 0faabcd Update dependencies
• a930945 Simplify types
• 6d7b96b Move to pnpm 12
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​iconify-json/​fluent@​1.2.59 ⏵ 1.2.61	+1
	@​types/​node@​26.6.3 ⏵ 26.6.6	+1		+1
	postcss-nested@​8.0.1 ⏵ 9.0.1			+2
	postcss-custom-media@​12.0.2 ⏵ 12.0.3				+3
	cspell@​10.3.6 ⏵ 10.4.0	+1			+1
	@​playwright/​test@​1.63.0 ⏵ 1.64.1

View full report

[netlify]

✅ Deploy Preview for expressjscom-preview ready!

Name	Link
🔨 Latest commit	a0658ae
🔍 Latest deploy log	https://app.netlify.com/projects/expressjscom-preview/deploys/6aebe2e5d3ab81ae009e98f3
😎 Deploy Preview	https://deploy-preview-2559--expressjscom-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 98 (🟢 up 1 from production) Accessibility: 100 (no change from production) Best Practices: 100 (no change from production) SEO: 100 (no change from production) PWA: 80 (no change from production) View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.