[dependabot]

Bumps the development-dependencies group with 6 updates in the / directory:

Package	From	To
@playwright/test	1.63.0	1.64.0
agents	0.26.0	0.28.0
knip	6.39.0	6.41.0
mixpanel-browser	2.83.0	2.84.0
satori	0.35.0	0.47.1
wrangler	4.147.0	4.149.0

Updates @playwright/test from 1.63.0 to 1.64.0

Release notes

Sourced from @​playwright/test's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits

• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
• 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
• 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
• 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
• dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
• Additional commits viewable in compare view

Updates agents from 0.26.0 to 0.28.0

Release notes

Sourced from agents's releases.

agents@0.28.0

This release adds two new tools, browser via agents/browser/{pi,ai-sdk,tanstack-ai} allowing an agent to create and manipulate a persistent browser session and web_fetch via agents/webfetch/{pi,ai-sdk,tanstack-ai} that can retrieve most document formats converted into markdown.

Minor Changes

• #2484 dedbee4 Thanks @​ben-reitz! - Add browserTool() to agents/browser/pi. See Persistent browser.

• #2473 6614955 Thanks @​mattzcarey! - Make agents/lifecycle stable along with the Scheduler (agents/schedules), State (agents/state), WebSockets (agents/websockets) and MCPClientManager (agents/mcp/client) capabilities. See Lifecycle.

Patch Changes

• #2540 b65956e Thanks @​mattzcarey! - ThinkHarness now keeps its sessions and operations in the shared agents/harness/store. Migrations are performed on first run. See ThinkHarness: Recovery.

• #2522 bcf5d20 Thanks @​ben-reitz! - Add agents/webfetch, a web_fetch tool that reads a URL as Markdown, JSON, or text (HTML, PDF, and Office documents via Worker AI). See Fetch the Web.

agents@0.27.0

This release adds four new experimental harnesses and a web_search tool, and reorganizes the experimental Channels API.

• New experimental harnesses: AiSdkHarness, ThinkHarness, ContainerHarness (which runs Claude Code or Codex in a Container) and OpenCodeHarness, all with the same shape as PiHarness.
• New agents/websearch: a web_search tool over Cloudflare's Web Search API for pi, the AI SDK and TanStack AI.
• Channels moved to agents/experimental/channels: Channels is being rebuilt around conversations and turns, and the old agents/channels entry point has been removed. The new API includes ChannelGateway, the Web Channel and its client, an AI SDK chat transport, and a new npx agents tui terminal client.
• Fixes: Streams, Tasks, useAgentChat reconnects, WebChannelClient, MCP credential cleanup on removeServer(), and x402 with MCP SDK v2.

Minor Changes

• #2434 0ebeae5 Thanks @​cjol! - Add AiSdkHarness from the new agents/harness/ai-sdk entry point, which runs each message with streamText and keeps sessions and transcripts in the Durable Object, so Channels.forHarness can serve an AI SDK model. The same entry point exports the AI SDK message conversions it is built on and createSendMessageTool, an AI SDK tool that sends a message to a surface through the gateway.

• #2431 6393265 Thanks @​cjol! - Add Channels to agents/experimental/channels: a Lifecycle capability that serves an agent harness's sessions as conversations to every surface that joins them, with durable, resumable responses on Streams. Connect a harness with Channels.forHarness(harness, { channels }). The entry point also exports the turn protocol types and a draft harness interface (AgentHarness), which may change.

• #2429 df4cbd6 Thanks @​cjol! - Breaking: remove the first pass of agents/channels and move Channels to agents/experimental/channels.

  The agents/channels entry points are gone, along with ChannelHost, the fallback and fanout composites, and the AI SDK, TanStack AI and Voice helpers from the first pass. Slack, Telegram and Email move to agents/experimental/channels/slack, agents/experimental/channels/telegram and agents/experimental/channels/email, and keep verified ingress and normalization. Channels is being rebuilt around conversations and turns; the new API is experimental and may change between releases.

• #2432 752cdc3 Thanks @​cjol! - Add ChannelGateway to agents/experimental/channels: the Worker entry point that verifies channel webhooks, takes Web Channel upgrades through web() from agents/experimental/channels/web, routes each to the agent object that holds its conversation, and delivers outbound messages. Every Channel that takes ingress needs a participant callback, where the application says who the sender is; Channels never picks an identity. The agent object is the authorization boundary: by default each participant gets one of their own, and a route callback can share one between participants or refuse them.

• #2436 062d091 Thanks @​cjol! - Add WebChannelChatTransport (agents/experimental/channels/web/ai-sdk), an AI SDK ChatTransport over the Web Channel, so AI SDK UIs can join a Channels conversation.

• #2433 6e6c58a Thanks @​cjol! - Add the Web Channel (agents/experimental/channels/web) and its client (agents/experimental/channels/web/client), which connect browsers and terminals to a conversation over the agent's WebSockets: live transcript and turns, approvals, client tool results, and creating, forking, resetting, listing and following conversations. WebSockets gains use for protocol handlers that run before the configured ones.

• #2502 66ae955 Thanks @​ben-reitz! - Add agents/websearch, a web_search tool over Cloudflare's Web Search API for the pi harness, the AI SDK, and TanStack AI. See Search the Web.

Patch Changes

• #2480 1923625 Thanks @​cjol! - AiSdkHarness: session.wait(operationId, signal) now rejects straight away when signal is already aborted, instead of staying pending until the operation settles.

• #2463 1e97e11 Thanks @​cjol! - AiSdkHarness no longer fails to start when it has stored sessions. onStart listed sessions while listing each one's pending work, and Durable Object storage allows one open kv.list() at a time, so a restarted agent stopped acknowledging messages.

• #2502 66ae955 Thanks @​ben-reitz! - AiSdkHarness passes its tools to convertToModelMessages, so a tool's toModelOutput also shapes its results on later turns instead of the model getting the raw output as JSON.

• #2488 98ec934 Thanks @​ben-reitz! - browserTool now has its own tool description instead of codemode's generic one. It covers the cdp API, common CDP mistakes, and the run time limit, so the model no longer runs codemode.search first. It also explains how to take a smaller screenshot when one is over the 1 MB result limit. See Persistent browser.

... (truncated)

Changelog

Sourced from agents's changelog.

0.28.0

Minor Changes

• #2484 dedbee4 Thanks @​ben-reitz! - Add browserTool() to agents/browser/pi. See Persistent browser.

• #2473 6614955 Thanks @​mattzcarey! - Make agents/lifecycle stable along with the Scheduler (agents/schedules), State (agents/state), WebSockets (agents/websockets) and MCPClientManager (agents/mcp/client) capabilities. See Lifecycle.

Patch Changes

• #2540 b65956e Thanks @​mattzcarey! - ThinkHarness now keeps its sessions and operations in the shared agents/harness/store. Migrations are performed on first run. See ThinkHarness: Recovery.

• #2522 bcf5d20 Thanks @​ben-reitz! - Add agents/webfetch, a web_fetch tool that reads a URL as Markdown, JSON, or text (HTML, PDF, and Office documents via Worker AI). See Fetch the Web.

0.27.0

This release adds four new experimental harnesses and a web_search tool, and reorganizes the experimental Channels API.

• New experimental harnesses: AiSdkHarness, ThinkHarness, ContainerHarness (which runs Claude Code or Codex in a Container) and OpenCodeHarness, all with the same shape as PiHarness.
• New agents/websearch: a web_search tool over Cloudflare's Web Search API for pi, the AI SDK and TanStack AI.
• Channels moved to agents/experimental/channels: Channels is being rebuilt around conversations and turns, and the old agents/channels entry point has been removed. The new API includes ChannelGateway, the Web Channel and its client, an AI SDK chat transport, and a new npx agents tui terminal client.
• Fixes: Streams, Tasks, useAgentChat reconnects, WebChannelClient, MCP credential cleanup on removeServer(), and x402 with MCP SDK v2.

Minor Changes

• #2434 0ebeae5 Thanks @​cjol! - Add AiSdkHarness from the new agents/harness/ai-sdk entry point, which runs each message with streamText and keeps sessions and transcripts in the Durable Object, so Channels.forHarness can serve an AI SDK model. The same entry point exports the AI SDK message conversions it is built on and createSendMessageTool, an AI SDK tool that sends a message to a surface through the gateway.

• #2431 6393265 Thanks @​cjol! - Add Channels to agents/experimental/channels: a Lifecycle capability that serves an agent harness's sessions as conversations to every surface that joins them, with durable, resumable responses on Streams. Connect a harness with Channels.forHarness(harness, { channels }). The entry point also exports the turn protocol types and a draft harness interface (AgentHarness), which may change.

• #2429 df4cbd6 Thanks @​cjol! - Breaking: remove the first pass of agents/channels and move Channels to agents/experimental/channels.

  The agents/channels entry points are gone, along with ChannelHost, the fallback and fanout composites, and the AI SDK, TanStack AI and Voice helpers from the first pass. Slack, Telegram and Email move to agents/experimental/channels/slack, agents/experimental/channels/telegram and agents/experimental/channels/email, and keep verified ingress and normalization. Channels is being rebuilt around conversations and turns; the new API is experimental and may change between releases.

• #2432 752cdc3 Thanks @​cjol! - Add ChannelGateway to agents/experimental/channels: the Worker entry point that verifies channel webhooks, takes Web Channel upgrades through web() from agents/experimental/channels/web, routes each to the agent object that holds its conversation, and delivers outbound messages. Every Channel that takes ingress needs a participant callback, where the application says who the sender is; Channels never picks an identity. The agent object is the authorization boundary: by default each participant gets one of their own, and a route callback can share one between participants or refuse them.

• #2436 062d091 Thanks @​cjol! - Add WebChannelChatTransport (agents/experimental/channels/web/ai-sdk), an AI SDK ChatTransport over the Web Channel, so AI SDK UIs can join a Channels conversation.

• #2433 6e6c58a Thanks @​cjol! - Add the Web Channel (agents/experimental/channels/web) and its client (agents/experimental/channels/web/client), which connect browsers and terminals to a conversation over the agent's WebSockets: live transcript and turns, approvals, client tool results, and creating, forking, resetting, listing and following conversations. WebSockets gains use for protocol handlers that run before the configured ones.

• #2502 66ae955 Thanks @​ben-reitz! - Add agents/websearch, a web_search tool over Cloudflare's Web Search API for the pi harness, the AI SDK, and TanStack AI. See Search the Web.

Patch Changes

• #2480 1923625 Thanks @​cjol! - AiSdkHarness: session.wait(operationId, signal) now rejects straight away when signal is already aborted, instead of staying pending until the operation settles.

• #2463 1e97e11 Thanks @​cjol! - AiSdkHarness no longer fails to start when it has stored sessions. onStart listed sessions while listing each one's pending work, and Durable Object storage allows one open kv.list() at a time, so a restarted agent stopped acknowledging messages.

• #2502 66ae955 Thanks @​ben-reitz! - AiSdkHarness passes its tools to convertToModelMessages, so a tool's toModelOutput also shapes its results on later turns instead of the model getting the raw output as JSON.

• #2488 98ec934 Thanks @​ben-reitz! - browserTool now has its own tool description instead of codemode's generic one. It covers the cdp API, common CDP mistakes, and the run time limit, so the model no longer runs codemode.search first. It also explains how to take a smaller screenshot when one is over the 1 MB result limit. See Persistent browser.

... (truncated)

Commits

• 48d9c36 Release agents@0.28.0 & @​cloudflare/think@​0.20.2 (#2537)
• b65956e refactor(agents): keep ThinkHarness records in the shared harness store (#2540)
• 6614955 chore(agents): mark Lifecycle, Scheduler, State, WebSockets and MCPClientMana...
• c1e71b3 feat(agents): add web_fetch tool (#2520)
• 0d5ccfd feat(agents): add web fetch source and content conversion (#2527)
• b898e62 feat(agents): add shared URL policy for web tools (#2526)
• 2a8687d refactor(agents): move websearch to src/web/search (#2525)
• dedbee4 feat(agents): add a pi-durable browserTool for a persistent browser (#2484)
• 63ea7d3 fix(agents): keep browserTool's active tab per scope (#2532)
• b263404 refactor(agents): move the browserTool adapters into src/browser/tools/ (#2531)
• Additional commits viewable in compare view

Updates knip from 6.39.0 to 6.41.0

Release notes

Sourced from knip's releases.

Release 6.41.0

• Add Flue plugin (#2124) (c52737d45ff008d6d96d4c2d4182048a2aa64602) - thanks @​LuisFigueroaG!
• Match all React Native config file extensions (#2125) (898fdffb37ae0bdb3d2653038eb10c2e01edf983) - thanks @​LuisFigueroaG!
• Consolidate fixture guidance and extend plugin guidelines (37a4ca04645f71f599e9b530676543f9893bd641)
• Add AI contribution policy (b15f0fbb090ea0427240880da2bec602c11cea50)
• Use files from tsconfig references with --use-tsconfig-files (#2126) (9618185eafb0c5cb365035f89e9d66718642338a) - thanks @​kaanisthatyou!
• Compile gitignore walk patterns once (resolve #2127) (09c80299779fa5abe133ee8f82051c25870007b8)
• Drop readdir order dependent case from gitignore walk test (ab3da8ff95a05a0fbfba6873b64559017d038aa7)
• fix: recognize binaries from absent optional dependencies (#2120) (d908556eaa98bf9637a2744d2de089bab31b8dbc) - thanks @​DreamLongYT!
• Apply a directory's .gitignore before walking its subdirectories (9560c07862d4c72dc956371b9a77e049d83ed4a9)
• Apply nested .gitignore files to workspace globs (23d35421dd67c405254f2f8bcbc09b18d224e338)
• Update gitignore matcher and walk notes (499f85f4544457dc7c51c4a7612fea69773ef3dd)
• Keep the cwd out of glob patterns and matchers (#2107) (1e82fb807c88cc46951f2028214569f9a2eb0061) - thanks @​kaanisthatyou!
• Support function configs in Rsbuild plugin (#2122) (38071db87e9023e5dd61173ce32f9020a1a5d7ff) - thanks @​bytedoe!
• Separate Expo Router plugin; remove expo-router entry points from Expo plugin (#2128) (ad541764ca7d3c062236661677d1d66d5275122f) - thanks @​jjjjonathan!
• Link Expo config discovery source and fold expo6 fixture into expo-router (2ddeca50956790b10580e835df50bc980cce961d)
• Update dependencies (c9f79148f7165314a7b3c801eff926d1d0d6b060)
• Migrate shell script parsing to unbash v5 (4942cca05303410120a007a5bb23b0c2da725da1)
• Handle updated Formatly result types (ca9e8315e003dae69646f7500fa98ab9ed403b92)
• Preserve TypeScript 5.0 compatibility in shell AST filters (957ac7bbd654f6d3d0c4dc4eab2f4aa133ff0b4b)
• Point timerify crashes to the Node.js version that fixes them (0c235de096fd3361eb918d1290241fa32a62f089)
• Copy importer identifier sets into the reverse index (2860d678a87dddb5ad56299119fb6e108ceffa12)
• Clear the resolver cache at the start of a run (10b5bb82ecd03c88b68ace58a7aea23d188cc5f1)

Release 6.40.0

• Resolve local and scope-only extends in commitlint plugin (#2079) (e667552d4e7122094565d3ad9ae407acfc0ac684) - thanks @​giaBaoJS!
• Clarify worktree guides and plugin review preparation (dd02baf020d23af1d47c44c1a726a61014b270bd)
• Document stale cache results and workarounds (#2078) (3573749a5d5bbee6305f207cc7d1b72c200c8c9b)
• Exclude test files from package entries in production mode (resolve #2082) (b86f45f9d38d4b83baad98e43983e08910e00c78) - thanks @​jonathanong!
• Resolve Serverless file variables in plugins and functions (resolve #2074) (99cac789694ea8d76cd38184d2d7c95f34315224) - thanks @​SwastikTripathi!
• Preserve locally referenced namespace members (resolve #2070) (f0f36df766cd74ad7ae03fbf8940bdeb792439be) - thanks @​MFA-G!
• fix: add the commitlint-plugin prefix to Commitlint plugin names (#2096) (3decd35ff0a4220c7cd2c9142dc69c89794b3927) - thanks @​devYRPauli!
• fix: match .mjs config files in the simple-git-hooks plugin (#2097) (79a87d92396c2444ae4ef3c780c0d2e18cd73e4c) - thanks @​devYRPauli!
• fix: match capacitor.config.js in the Capacitor plugin (#2098) (4a5ec96d818117a7f2eafa027e3b707bc97573a8) - thanks @​devYRPauli!
• fix(typescript): ArrayExpression (#2099) (#2100) (87fea9f201c2fd864eafa31bdad68910a8a177ba) - thanks @​DreamLongYT!
• Preserve development entry pattern groups (7c229f4e1918075d801ed3b046fa022b1d3bcc41)
• Resolve null package exports to the files they hide (resolve #2084, close #2085) (5bd46260feb60b957c2631bc72375ef192e441e0)
• Pin InvokeAI ecosystem test (4e0a3432eb35e3f628f6d3b7fcd14b942de343d0)
• fix(utils): add jsx extension to source mapping (#2087) (eaa353b5fc30c2f12cdf2c29e6dd68e0d0950062) - thanks @​DreamLongYT!
• fix(serverless-framework): handle explicit extensions in handler paths (#2091) (e9393965be7563640921e3f20c946fcb9132e1cb) - thanks @​DreamLongYT!
• Annotate published manifest return type (d95a8310a0d0dca8f23d8dd3f83e7b0a1909d038)
• Add Jasmine plugin (#2105) (9ed14911d5c5752aef36878ab3d515c35d1ac6bc) - thanks @​SulimanAbdulrazzaq!
• fix: resolve workspace exports with fallback arrays (#2088) (49c2aaeaba4544f25cc02c19d5da5152a8ef68c3) - thanks @​DreamLongYT!
• fix(postcss): ignore disabled plugins in object configs (#2092) (b84fdf8a8ee676ee45f4313009ebfe969d034a88) - thanks @​DreamLongYT!
• Resolve webServer commands in Playwright plugin (#2110) (1af96bce36b0d0d07791de100c7f2ea5672a478c) - thanks @​everton-dgn!
• Cache config file inputs per plugin (#2109) (01cb43267ca5dc03a2cbcba0a19fd891d4ed1f37) - thanks @​everton-dgn!
• fix: include custom compiler extensions in source path mapping (#2090) (dc3a47e2d810808314454b8f5c23070f136d15d3) - thanks @​DreamLongYT!
• Don't let a self-closing swallow the next (#2113) (989fdadde0a068d1d1c52e26a8327b99c5de0668) - thanks @​maniflopi!
• fix(oxlint): resolve lint from loaded Vite config (#2108) (6d44e532ed6320cdf4f4c3253b26e155c4d26ba7) - thanks @​everton-dgn!
• fix: resolve Jest module names without the jest-* prefix (#2095) (a5f4cfbff7f263a0ea8d5461a3f9216cbef38602) - thanks @​devYRPauli!

... (truncated)

Commits

• 13d7f21 Release knip@6.41.0
• 10b5bb8 Clear the resolver cache at the start of a run
• 2860d67 Copy importer identifier sets into the reverse index
• 0c235de Point timerify crashes to the Node.js version that fixes them
• 957ac7b Preserve TypeScript 5.0 compatibility in shell AST filters
• ca9e831 Handle updated Formatly result types
• 4942cca Migrate shell script parsing to unbash v5
• c9f7914 Update dependencies
• 2ddeca5 Link Expo config discovery source and fold expo6 fixture into expo-router
• ad54176 Separate Expo Router plugin; remove expo-router entry points from Expo plugin...
• Additional commits viewable in compare view

Updates mixpanel-browser from 2.83.0 to 2.84.0

Release notes

Sourced from mixpanel-browser's releases.

New on_track hook and various fixes

• Adds an on_track hook that is called for every tracked event with its merged properties. It can modify the event or return null to drop it.
• Fixes people.set mutating the object passed to it when the object contains Date values (thanks @​sarmah-rup!).
• Fixes $browser_version being null on Android Mobile browsers (thanks @​sarmah-rup!).
• Fixes opt-out tracking not being honored when localStorage is unavailable and the opt-out flag was stored in a cookie.
• Fixes session recording dropping a batch when gzip compression fails. It now sends the batch uncompressed (thanks @​pkuczynski!).
• Reports an error when clearing the persisted request queue fails, instead of leaving the promise rejected (thanks @​pkuczynski!).
• Moves the API reference docs to TypeDoc.

Changelog

Sourced from mixpanel-browser's changelog.

2.84.0 (5 Oct 2026)

• Adds an on_track hook (under hooks config) that is called for every tracked event with the event name and its merged properties. It can return a modified event name/properties or null to drop the event, and is not bypassed by skip_hooks.
• Fixes people.set (and other people calls) mutating the object passed in: Date values were being converted to strings in place. Dates are now encoded on a copy, so the caller's object is left untouched.
• Fixes $browser_version being null for Android Mobile browsers, caused by a lower-case android in the version regex.
• Fixes opt-out checks when localStorage is unusable: opt_out_tracking() falls back to saving the flag in a cookie, but the opt-out check only read localStorage, so the opt-out was not honored. The check now reads whichever store the flag was written to.
• Fixes session recording to send a batch uncompressed (and report the error) when gzip compression fails, instead of silently dropping it.
• Fixes request queue clear() so a failure to clear persisted storage is reported rather than leaving the returned promise rejected.
• Replaces the dox/rdme API docs tooling with TypeDoc and regenerates the API reference; the TypeScript definitions and JSDoc were updated to match.

2.83.0 (8 Sep 2026)

• Adds semver and date custom operators for Feature Flags runtime targeting (first-time-event) rules, alongside the existing operators.
• Fixes session recording network telemetry: passing a Request object directly to fetch() no longer marks its body as consumed, which previously made the application's own fetch() call fail with "Cannot construct a Request with a Request object that has already been used".
• Fixes autocapture link tracking to skip the delayed navigation when a tracked <a> element has no href, instead of navigating to undefined.
• Fixes a CodeQL-flagged incomplete sanitization in _.getQueryParam: the URL param name is now fully escaped (including backslashes) before being interpolated into the lookup regex.
• Removes the internal _.trim polyfill in favor of native String.prototype.trim, addressing a CodeQL alert.
• Updates @mixpanel/rrweb to 2.0.0-alpha.18.6.
• Publishes the CycloneDX SBOM as part of the dist build rather than as a separate CI job.
• Trims the published npm package down to CHANGELOG.md, dist, doc, LICENSE, logo.svg, package.json, README.md, and src, so dev/build/test tooling is no longer shipped.

2.82.1 (19 Aug 2026)

• Publishes a CycloneDX Software Bill of Materials (SBOM) as a release asset.
• Bumps the transitive postcss and nanoid dependencies to patched versions. The published bundle is unchanged — a fresh install already resolved to the patched versions.

2.82.0 (10 Aug 2026)

• Fixes empty response bodies in session recording network telemetry. Fetch events were emitted before the response body finished being read; they now wait for it. The application's own fetch() is not delayed.
• Adds fallback_reason (FLAG_NOT_FOUND, NOT_READY, or BACKEND_ERROR) to feature flag variants when variant_source is 'fallback'. @mixpanel/openfeature-web-provider uses it to report the specific cause instead of always reporting FLAG_NOT_FOUND.

2.81.0 (9 Jul 2026)

• @mixpanel/openfeature-web-provider: fixes fallback detection so FLAG_NOT_FOUND is reported correctly. The provider previously compared the returned variant against the fallback by reference, but mixpanel-browser wraps fallbacks in a new object, so the check never matched. It now detects fallbacks via the variant_source marker.
• Removes the engines field from package.json so npm no longer prints an engine warning on newer Node.js versions. CI now runs on current Node.js LTS versions.

2.80.0 (28 May 2026)

• Fixes a session recording bug where record_min_ms could be bypassed after a page navigation or an idle period, causing short recordings to be uploaded. Elapsed time is now measured from the first rrweb event timestamp rather than wall-clock time, so the minimum-duration check stays accurate across navigations.
• Fixes a malformed first-time-events request URL that contained a double slash (//) before the flag ID. The URL is now built cleanly regardless of whether the base ends in /.
• Registers autocapture click/change/submit listeners in the capture phase, so events are reliably observed even when downstream handlers call stopPropagation().

2.79.0 (14 May 2026)

• Adds support for feature flag variant persistence: variants can now be cached in IndexedDB with a configurable TTL so flag values stay stable across page loads and remain available before the next fetch completes.
• Enables pageview events for free during session recording when record_heatmap_data is enabled, so heatmaps get accompanying pageview context without separately enabling pageview autocapture.
• Event-triggered session recordings now wait for remote settings to finish loading (or fail) before deciding whether to start, preventing missed recordings when a triggering event fires during init.
• Hardens all window.localStorage and window.sessionStorage access with exhaustive try/catch guards, so SDK initialization no longer throws in environments where storage access raises (e.g., strict privacy modes, sandboxed iframes).

2.78.0 (8 Apr 2026)

... (truncated)

Commits

• d6bdc7f add contributors
• c19a672 changelog
• b5f3df0 build 2.84.0 release
• ca95e7d rebuild rc1
• 2447ec5 Fix: encodeDates mutates the object passed to people.set (#479) (#608)
• 0bb6b78 gdpr: honor cookie opt-out when localStorage is unusable (#498)
• 8f73aab fix: correct Android Mobile browserVersion regex casing (null $browser_versio...
• f86efb6 build rc1
• 628ee01 2.84.0
• 444c09b build rc1
• Additional commits viewable in compare view

Updates satori from 0.35.0 to 0.47.1

Release notes

Sourced from satori's releases.

0.47.1

0.47.1 (2026-10-09)

Bug Fixes

• Align text by its baseline (#873) (2bace17)
• Clamp the lines of vertical -webkit-box elements like browsers (#875) (680bbe4)
• Move tabs to the tab stops of their line (#876) (e441832)
• Only keep a character before an ellipsis at the start of a line (#874) (ca93f94)
• Show the background through transparent stops of radial gradients (#872) (b480215)

0.47.0

0.47.0 (2026-10-09)

Features

• Support backgroundBlendMode (#870) (75d20f5)
• Support textTransform: full-width and full-size-kana (#869) (d717b5a)

0.46.0

0.46.0 (2026-10-09)

Features

• Support fontKerning and fontVariant (#868) (23b8d1c)

0.45.0

0.45.0 (2026-10-09)

Features

• Support overflowWrap and wordWrap (#867) (d29185c)
• Support sizing keywords in sizes and flexBasis: content (#866) (368e18c)

0.44.3

0.44.3 (2026-10-09)

Bug Fixes

• Report the boxes of inline elements to onNodeDetected (#865) (f1fab0e)

0.44.2

0.44.2 (2026-10-09)

... (truncated)

Commits

• e441832 fix: Move tabs to the tab stops of their line (#876)
• 680bbe4 fix: Clamp the lines of vertical -webkit-box elements like browsers (#875)
• ca93f94 fix: Only keep a character before an ellipsis at the start of a line (#874)
• 2bace17 fix: Align text by its baseline (#873)
• b480215 fix: Show the background through transparent stops of radial gradients (#872)
• 75d20f5 feat: Support backgroundBlendMode (#870)
• d717b5a feat: Support textTransform: full-width and full-size-kana (#869)
• 23b8d1c feat: Support fontKerning and fontVariant (#868)
• d29185c feat: Support overflowWrap and wordWrap (#867)
• 368e18c feat: Support sizing keywords in sizes and flexBasis: content (#866)
• Additional commits viewable in compare view

Updates wrangler from 4.147.0 to 4.149.0

Release notes

Sourced from wrangler's releases.

wrangler@4.149.0

Minor Changes

• #16036 9a58244 Thanks @​edevil! - Support temporary event accounts in R2 and Containers commands

  wrangler r2 and wrangler containers commands now accept the hidden --temporary flag, so accounts created for an event can manage buckets, objects and containers directly. Every command that supports --temporary now also accepts a hidden --event-code flag, so the first command a participant runs can create the event account:

  wrangler r2 bucket create my-bucket --temporary --event-code <code>

  R2 and Containers are only available on event accounts. R2 custom domains, Sippy, external container registries and wrangler cloudchamber commands still require a logged-in account.

Patch Changes

• #16139 2d1d563 Thanks @​cpojer! - Update esbuild to 0.28.2

  Align esbuild dependency with tooling using the latest 0.28 patch so package managers can share one installation instead of downloading a second native binary.

• #15632 85b14e7 Thanks @​petebacondarwin! - Honor Retry-After directives during static asset uploads

  Static asset uploads now pause retries and pending uploads until the latest outstanding deadline requested by the API. A per-request limiter also keeps gateway retries at the reduced concurrency after the pause ends, preventing a deployment from immediately overloading a constrained asset service again.

• #16098 fe607f9 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  sharp	0.35.4	0.35.5

• #16093 ad7ff45 Thanks @​DiogoSantoss! - Document that addresses catch-all entries must use the zone apex

  A *@domain entry in addresses must use the zone apex, such as *@example.com. The zone catch-all also receives mail for every subdomain in the zone that has no literal rule.

• #16102 757faa6 Thanks @​tlq5l! - Keep Preview secrets when deploying to an existing Preview

  Secrets added to a Preview with wrangler preview secret put or wrangler preview sec...

  Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pixelated	Ready	Preview	Oct 13, 2026 12:44am UTC

[github-actions]

AutoReview

No rule-based issues detected.

[github-actions]

px Advisor Review

Risk: unknown

No summary available

No findings.

[github-actions]

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

• Report files not found (see artifacts)

Reports are also available as workflow artifacts

[github-actions]

AutoReview

No rule-based issues detected.

[github-actions]

px Advisor Review

Risk: unknown

No summary available

No findings.

[github-actions]

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

• Report files not found (see artifacts)

Reports are also available as workflow artifacts

[github-actions]

px Advisor Review

Risk: unknown

No summary available

No findings.

[github-actions]

AutoReview

No rule-based issues detected.

[github-actions]

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

• lhr-1791850786663
• lhr-1791850797702
• lhr-1791850808446
• lhr-1791850818806
• lhr-1791850829076
• lhr-1791850839322
• lhr-1791850849608
• lhr-1791850859900
• lhr-1791850870202

Reports are also available as workflow artifacts

[github-actions]

AutoReview

No rule-based issues detected.

[github-actions]

px Advisor Review

Risk: unknown

No summary available

No findings.

[github-actions]

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

• lhr-1791852254572
• lhr-1791852265635
• lhr-1791852276473
• lhr-1791852286873
• lhr-1791852297190
• lhr-1791852307497
• lhr-1791852317894
• lhr-1791852328220
• lhr-1791852338492

Reports are also available as workflow artifacts