chore(deps): bump the mcp-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the mcp-dependencies group with 4 updates in the /mcp directory: playwright, zod, @types/node and vitest.

Updates playwright from 1.62.1 to 1.63.0

Release notes

Sourced from playwright's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates zod from 4.5.1 to 4.6.2

Release notes

Sourced from zod's releases.

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

• .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
• z.instanceof().properties() — validates properties of an instance
• fromJSONSchema() — enforces six validation keywords it used to ignore
• z.iban() — electronic-format IBAN plus mod-97 checksum
• z.withParser() — installs a parser generated elsewhere, for environments without new Function
• Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
• Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
• @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42);   // false

It is a method on Zod Classic schemas too. (#6547)

const Player = z.object({
  username: z.string(),
  xp: z.number(),
});
</tr></table>

... (truncated)

Commits

• e359f73 4.6.2
• 9446b5c fix: preserve undefined prefault outputs and object keys (#6587)
• 0c483c5 docs: Zod 4.6 announcement post (#6546)
• a00c3f3 docs: use Trigger.dev's brand-kit lockups for the platinum card
• 62311eb 4.6.1
• 2efa8b8 ci: give the npm wait a real budget and drop the back-publish path (#6583)
• b12aa52 fix: preserve unique tags with defaulted discriminators (#6582)
• dd9c36f fix(v4): defer recursive object index inference (#6580)
• 574d480 fix(locales): clarify Tajik discriminator value message
• c532d76 test(locales): cover Tajik error branches
• Additional commits viewable in compare view

Updates @types/node from 26.4.0 to 26.5.1

Commits

• See full diff in compare view

Updates vitest from 4.1.11 to 5.0.0

Release notes

Sourced from vitest's releases.

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

• Replace loupe.inspect with pretty-format  -  by @​hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in vitest-dev/vitest#9609 (3f802)
• Remove quotes from string values in test.for/each title $ variable (take 2)  -  by @​hi-ogawa in vitest-dev/vitest#10170 (04d37)
• Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/  -  by @​MdSadiqMd in vitest-dev/vitest#10186 (1ba73)
• Remove sequential test/suite options in favor of concurrent  -  by @​hi-ogawa and OpenAI Codex in vitest-dev/vitest#10198 (9229f)
• Represent locator as an object instead of a string  -  by @​sheremet-va in vitest-dev/vitest#10212 (80f07)
• Inline expect package  -  by @​sheremet-va in vitest-dev/vitest#10221 (ad162)
• Remove deprecated entry points  -  by @​sheremet-va in vitest-dev/vitest#10222 (994c6)
• Require Node.js 22 and Vite 6.4  -  by @​sheremet-va in vitest-dev/vitest#10178 (38762)
• Fail expect.poll when function didn't resolve in time  -  by @​hi-ogawa and OpenAI Codex in vitest-dev/vitest#10233 (4df04)
• Throw an error if hoistable methods are outside the top level scope  -  by @​sheremet-va in vitest-dev/vitest#10460 (d0b4f)
• toHaveTextContent is strict, add toMatchTextContent as alternative  -  by @​sheremet-va in vitest-dev/vitest#10473 (18f30)
• Don't lookup config file from ancestor directories  -  by @​hi-ogawa, OpenAI Codex and Hiroshi Ogawa in vitest-dev/vitest#10428 (945d9)
• Inline @vitest/runner package, do not publish it anymore  -  by @​sheremet-va in vitest-dev/vitest#10511 (6d6e4)
• Allow mutating happy-dom/jsdom window object  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10373 (206e8)
• Expose concurrencyId/workerId on TestModule's diagnostics, make id 1-based  -  by @​sheremet-va in vitest-dev/vitest#10516 (bdd98)
• Add screenshotDirectory config to browser.expect.toMatchScreenshot  -  by @​macarie in vitest-dev/vitest#10592 (a60de)
• Update @sinonjs/fake-timers and support mocking Temporal  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10654 (f8b15)
• Remove webdriverio package  -  by @​sheremet-va in vitest-dev/vitest#10675 (5fed6)
• Clear mocks by default before each test  -  by @​sheremet-va in vitest-dev/vitest#10613 (0f646)
• Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start  -  by @​sheremet-va in vitest-dev/vitest#10293 (334ed)
• Separate config resolution from the server creation  -  by @​sheremet-va in vitest-dev/vitest#10554 (1c0ec)
• Inline projects extend the root config by default  -  by @​sheremet-va in vitest-dev/vitest#10750 (fec00)
• Enable mocking Temporal without fake timers  -  by @​fabon-f, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10757 (ac2d4)
• Support nested projects  -  by @​sheremet-va in vitest-dev/vitest#10846 (ec367)
• Use > as separator in -t, calculate only once  -  by @​sheremet-va in vitest-dev/vitest#10686 (a0b20)
• Fail the test when an asynchronous assertion is not awaited  -  by @​sheremet-va in vitest-dev/vitest#10868 (86d4a)
• Share the Vite server between inline projects  -  by @​sheremet-va in vitest-dev/vitest#10848 (d87c9)
• Parse files statically in vitest list by default  -  by @​sheremet-va in vitest-dev/vitest#11088 (51e94)
• benchmark:
  • Rewrite the public API  -  by @​sheremet-va in vitest-dev/vitest#10113 (19f6e)
• browser:
  • Iframe scale  -  by @​macarie in vitest-dev/vitest#9745 (b6398)
  • Enable locators.exact by default  -  by @​sheremet-va in vitest-dev/vitest#10430 (e2032)
  • Require sessionId for orchestrator html request  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10522 (79b7d)
  • Save failure screenshots in attachmentsDir  -  by @​macarie in vitest-dev/vitest#10917 (3b5bb)
• coverage:
  • include/exclude globs too eager  -  by @​AriPerkkio in vitest-dev/vitest#9818 (edacb)
  • Allow thresholds.perFile to accept an object  -  by @​vladlenskiy and @​AriPerkkio in vitest-dev/vitest#10190 (13b78)
• expect:
  • Fix toThrow("") behavior by reverting #6710  -  by @​hi-ogawa in vitest-dev/vitest#9643 and vitest-dev/vitest#6710 (6c3e4)
• mocker:
  • Deserialize automock as automock  -  by @​nami8824 in vitest-dev/vitest#10192 (2f892)
• reporters:
  • blob reporter and --merge-reports default to .vitest/blob/  -  by @​AriPerkkio in vitest-dev/vitest#10232 (d22b0)
  • Write json and junit reporter output files to .vitest by default  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @​AriPerkkio in vitest-dev/vitest#10621 (58577)

... (truncated)

Commits

• f441c6f chore: release v5.0.0 (#11130)
• d46a747 fix: treat test.describe as a suite during static collection (#11128)
• 584cf30 fix: add a warning if inline project has duplicate plugins due to unexpected ...
• f08ce4b fix: apply queued mocks from doMock() in queue order (fixes #10706) (#11127)
• 897f51f chore: release v5.0.0-rc.4 (#11107)
• 1339b06 chore(deps): update all non-major dependencies (#11104)
• 51e9494 feat!: parse files statically in vitest list by default (#11088)
• 2122ffd fix: propagate --maxWorkers to projects (#11102)
• dc10f5f fix(browser): report the action error when a task times out (#11101)
• d4fe198 feat: promote clearCache out of experimental (#11086)
• Additional commits viewable in compare view

[sebavan]

@dependabot rebase

[sebavan]

@dependabot rebase

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.