[dependabot]

Bumps the npm-routine group with 2 updates in the / directory: @typescript-eslint/parser and eslint.
Bumps the npm-routine group with 6 updates in the /apps/api directory:

Package	From	To
@fastify/cookie	11.0.0	11.1.5
@fastify/cors	11.3.0	11.3.1
csv-stringify	6.8.3	6.9.0
nodemailer	10.2.1	10.3.1
playwright-core	1.63.0	1.64.1
tsx	4.23.9	4.23.15

Bumps the npm-routine group with 5 updates in the /apps/web directory:

Package	From	To
@tanstack/react-query	5.101.4	5.105.0
react	19.2.8	19.3.1
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.1
@types/react-dom	19.2.4	19.3.0
@types/react	19.2.18	19.3.0
@types/react-dom	19.2.4	19.3.0

Updates @typescript-eslint/parser from 8.72.0 to 8.72.1

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.72.1 (2026-10-26)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 4ad6b75 chore(release): publish 8.72.1
• 7757694 chore: cleanup typecheck & build and fix race condition (#13071)
• See full diff in compare view

Updates eslint from 10.13.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

• d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)
• 6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)
• 9155e14 fix: Update @​humanfs/node dependency version (#21434) (Nicholas C. Zakas)
• cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)
• 5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

• 0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)
• dab466e docs: Update README (GitHub Actions Bot)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)
• 7697550 docs: Update README (GitHub Actions Bot)
• 0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)
• 0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)
• e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])
• a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)
• 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)
• 276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])
• 449724e chore: update ecosystem plugins (#21420) (ESLint Bot)
• 8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])

Commits

• 12cbff4 10.14.0
• 6b696e7 Build: changelog update for 10.14.0
• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462)
• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460)
• 0f94f47 docs: remove zh-hans from docs language switcher (#21437)
• dab466e docs: Update README
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419)
• Additional commits viewable in compare view

Updates @fastify/cookie from 11.0.0 to 11.1.5

Release notes

Sourced from @​fastify/cookie's releases.

v11.1.5

What's Changed

• refactor: pass only encode option to cookie serializer, add tests by @​ezefernandezyf in fastify/fastify-cookie#377

New Contributors

• @​ezefernandezyf made their first contribution in fastify/fastify-cookie#377

Full Changelog: fastify/fastify-cookie@v11.1.4...v11.1.5

v11.1.4

What's Changed

• perf(signer): early exit on missing delimiter in unsign to avoid redundant HMAC calculations by @​TalhaHunter101 in fastify/fastify-cookie#379
• fix: forward encode option to cookie serializer by @​lprnmns in fastify/fastify-cookie#374

New Contributors

• @​TalhaHunter101 made their first contribution in fastify/fastify-cookie#379
• @​lprnmns made their first contribution in fastify/fastify-cookie#374

Full Changelog: fastify/fastify-cookie@v11.1.3...v11.1.4

v11.1.3

What's Changed

• ci: pin actions to commit-hash by @​Fdawgs in fastify/fastify-cookie#364
• chore: bump c8 from 11.0.0 to 12.0.0 by @​dependabot[bot] in fastify/fastify-cookie#365
• docs: fix signed cookie request examples by @​mdiniz97 in fastify/fastify-cookie#366
• chore(.npmrc): add min-release-age by @​Fdawgs in fastify/fastify-cookie#367
• chore: bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-cookie#369
• chore: bump fastify/workflows/.github/workflows/plugins-ci.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-cookie#368
• ci: enable trusted publishing releases by @​Puppo in fastify/fastify-cookie#378

New Contributors

• @​mdiniz97 made their first contribution in fastify/fastify-cookie#366
• @​Puppo made their first contribution in fastify/fastify-cookie#378

Full Changelog: fastify/fastify-cookie@v11.1.2...v11.1.3

v11.1.2

What's Changed

• fix: use dynamic import for cookie by @​climba03003 in fastify/fastify-cookie#363

Full Changelog: fastify/fastify-cookie@v11.1.1...v11.1.2

v11.1.1

What's Changed

• fix: support cookie v2.x by @​Tony133 in fastify/fastify-cookie#361
• fix: register onSend writer even when hook is false by @​0XFF-96 in fastify/fastify-cookie#360

New Contributors

• @​0XFF-96 made their first contribution in fastify/fastify-cookie#360

... (truncated)

Commits

• a96460b Bumped v11.1.5
• 7f9551e fix: forward custom encode option to cookie serializer (#377)
• 4f47cf1 Bumped v11.1.4
• c07e472 fix: forward encode option to cookie serializer (#374)
• d27beb4 perf(signer): add early delimiter check in unsign to avoid redundant HMAC com...
• 576e0dd Bumped v11.1.3
• 19a1307 ci: enable trusted publishing releases
• 104aca7 chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#368)
• c838334 chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#369)
• 916538c chore(.npmrc): add min-release-age
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/cookie since your current version.

Updates @fastify/cors from 11.3.0 to 11.3.1

Release notes

Sourced from @​fastify/cors's releases.

v11.3.1

What's Changed

• ci: pin actions to commit-hash by @​Fdawgs in fastify/fastify-cors#413
• chore: bump c8 from 11.0.0 to 12.0.0 by @​dependabot[bot] in fastify/fastify-cors#414
• chore: bump typescript from 6.0.3 to 7.0.2 in the dev-dependencies-typescript group across 1 directory by @​dependabot[bot] in fastify/fastify-cors#412
• chore: return to typescript v6.x by @​Tony133 in fastify/fastify-cors#415
• chore(.npmrc): add min-release-age by @​Fdawgs in fastify/fastify-cors#416
• chore: bump fastify/workflows/.github/workflows/plugins-ci.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-cors#417
• chore: bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @​dependabot[bot] in fastify/fastify-cors#418
• ci: enable trusted publishing releases by @​Puppo in fastify/fastify-cors#421

New Contributors

• @​Puppo made their first contribution in fastify/fastify-cors#421

Full Changelog: fastify/fastify-cors@v11.3.0...v11.3.1

Commits

• a4fb482 Bumped v11.3.1
• 4627a17 ci: enable trusted publishing releases
• 7670483 chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#418)
• d03ec98 chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#417)
• 5a2e0d0 chore(.npmrc): add min-release-age
• 2a47537 chore: return to typescript v6.x
• 10c73be chore: bump typescript (#412)
• b9f74b7 chore: bump c8 from 11.0.0 to 12.0.0 (#414)
• 61789f1 ci: pin actions to commit-hash
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fastify/cors since your current version.

Updates csv-stringify from 6.8.3 to 6.9.0

Changelog

Sourced from csv-stringify's changelog.

6.9.0 (2026-09-25)

Features

• csv-stringify: expose csv error and normalize_options (963388d)

Bug Fixes

• csv-stringify: do not alter the source record when columns is set (#504) (041deff)
• csv-stringify: preserve header cast context when eof is false (#505) (a38ef06)
• csv-stringify: preserve negative numeric values (#510) (0002d56)
• csv-stringify: preserve objects returned by cast functions (#509) (1742c9f)
• csv-stringify: quote fields containing a carriage return (#485) (d64d410)

Commits

• 594c646 chore(release): publish
• 9f04145 build: latest dependencies
• d64d410 fix(csv-stringify): quote fields containing a carriage return (#485)
• 963388d feat(csv-stringify): expose csv error and normalize_options
• 041deff fix(csv-stringify): do not alter the source record when columns is set (#504)
• a38ef06 fix(csv-stringify): preserve header cast context when eof is false (#505)
• 8d4173d build: latest dev dependencies
• c8caa1c build: generate latest dist
• 3433750 test: eslint format
• 6c45c9b build: remove npx usage in package scripts
• Additional commits viewable in compare view

Updates nodemailer from 10.2.1 to 10.3.1

Release notes

Sourced from nodemailer's releases.

v10.3.1

10.3.1 (2026-10-29)

Bug Fixes

• apply the otp option in MailComposer too (1d4087f)

v10.3.0

10.3.0 (2026-10-29)

Summary

This release adds support for the OTP-Token header from the IETF draft draft-goto-otp-token, which lets mail clients and browsers offer a one-time passcode for autofill on the site it belongs to. It also fixes how a Content-ID header is encoded.

Who should upgrade

• Anyone sending one-time passcodes by email who wants them to be machine-readable.
• Anyone already setting an OTP-Token header through headers: before this release it went out MIME encoded and could not be parsed.
• Anyone embedding images with a cid that holds a non-ASCII character or a quote.

Highlights

• New otp message option: otp: { code: '123456', origin: 'https://example.com' } adds OTP-Token: "123456"; origin="https://example.com". The origin is reduced to its canonical form, only https (or http on a loopback host) is accepted, and invalid values fail the send with the new EOTP error code. See Message configuration.
• A custom OTP-Token header is no longer MIME word encoded. Line breaks and control characters are still removed.
• OTP-Token is included in the DKIM signature by default.
• A Content-ID header, from an attachment cid or set through headers, is now encoded as a message id rather than as text, so a cid with a non-ASCII character or a quote keeps matching the cid: URL in the HTML.
• Groundmail added to the well-known services.

Features

• add the otp option for the OTP-Token header (7789e15)

Bug Fixes

• encode a Content-ID header as a message id (#1904) (47f2b25)

Changelog

Sourced from nodemailer's changelog.

10.3.1 (2026-10-29)

Bug Fixes

• apply the otp option in MailComposer too (1d4087f)

10.3.0 (2026-10-29)

Features

• add the otp option for the OTP-Token header (7789e15)

Bug Fixes

• encode a Content-ID header as a message id (#1904) (47f2b25)

Commits

• 26555d0 Merge pull request #1906 from nodemailer/release-please--branches--master--co...
• 3e5bb55 chore(master): release 10.3.1
• 1d4087f fix: apply the otp option in MailComposer too
• 488ce9c chore(deps): update development dependencies
• 41eda65 chore(deps): update development dependencies
• 5de343d chore(master): release 10.3.0 (#1905)
• 7789e15 feat: add the otp option for the OTP-Token header
• 47f2b25 fix: encode a Content-ID header as a message id (#1904)
• a6e7a70 chore(services): add Groundmail (#1903)
• a0cea19 chore(deps): update development dependencies [skip ci]
• Additional commits viewable in compare view

Updates playwright-core from 1.63.0 to 1.64.1

Release notes

Sourced from playwright-core's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• Additional commits viewable in compare view

Updates tsx from 4.23.9 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

... (truncated)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• Additional commits viewable in compare view

Updates @tanstack/react-query from 5.101.4 to 5.105.0

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.105.0
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-next-experimental@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-persist-client@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.105.0
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.105.0

Changelog

Sourced from @​tanstack/react-query's changelog.

5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.105.0

5.104.5

Patch Changes

• #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.
• Updated dependencies [f608f93]:
  • @​tanstack/query-core@​5.104.5

5.104.4

Patch Changes

• #11328 c208861 - Allow queries with falsy errors to retry on mount when throwOnError returns false.

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [1fee044, fce89dd]:

  • @​tanstack/query-core@​5.104.4

5.104.3

Patch Changes

• Updated dependencies [0f15bc9]:
  • @​tanstack/query-core@​5.104.3

5.104.2

Patch Changes

• Updated dependencies [03e8c39]:
  • @​tanstack/query-core@​5.104.2

5.104.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.104.1

5.104.0

Minor Changes

... (truncated)

Commits

• 5cc606e ci: Version Packages (#12301)
• 14cc330 style(packages): write durations in 'count * unit * 1000' order (#12382)
• d7c0418 chore(react-query/{useQuery,useInfiniteQuery}): remove the unused '@​eslint-re...
• aa3e26b chore(react-query/{HydrationBoundary,utils}): explain why 'react-hooks-js/ref...
• b2801aa test(react-query/useMutation): assert that the mutation settles in the cache ...
• 43636c4 test(react-query/useMutation): wait for the mutation to settle after unmount ...
• 1eed9d9 chore(*): explain why 'vitest-js/valid-expect' is disabled for the 'expectTyp...
• 6bdeb13 test(*/useQuery): rename the 'throwOnError' callback parameter to 'err' to av...
• 86b9f20 test(*/useMutationState): rename the built 'mutation' to 'existingMutation' t...
• d09972b test(*): rename the 'queryKey' test helper to 'createKey' since it creates ke...
• Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

• Improve transport protocol (#37845 by @​unstubbable and @​eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #371...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.