[dependabot]

Bumps the pnpm-minor group with 3 updates in the / directory: @aws-sdk/client-s3, @aws-sdk/lib-storage and playwright.

Updates @aws-sdk/client-s3 from 3.1142.0 to 3.1149.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1149.0

3.1149.0(2026-10-09)

Chores

• codegen: sync for endpoint cache fix and pre-schema error fallback (#8341) (5773a751)

New Features

• client-quicksight: Adds granular custom permissions for the Gong action connector (GongAction, CreateAndUpdateGongAction, ShareGongAction, UseGongAction) and for create, update, and share operations on 45 data source connectors, such as Amazon S3 and Snowflake, through the Custom Permissions APIs. (c5d26e39)
• client-deadline: The new ListMemberships API enables users to discover their memberships across Deadline Cloud resources, enabling scoped users of Deadline resources to discover and interact with the resources they have been provided scoped access to. (0d7406c7)
• client-marketplace-metering: AWS Marketplace Metering Service adds AgreementId to ResolveCustomer API response. (9653f5cc)
• client-mediatailor: Add caching settings to http functions (7ac7530b)
• client-securityagent: Adds a test scope field to specify whether a pentest targets a web application or a generative AI application. (1cc5ba6a)

Bug Fixes

• lib-transfer-manager:
  • retry UploadPart on worker-thread upload path (#8345) (0e357d90)
  • avoid full-body copy for SharedArrayBuffer uploads (#8338) (5473caf9)

---

For list of updated packages, view updated-packages.md in assets-3.1149.0.zip

v3.1148.0

3.1148.0(2026-10-08)

Documentation Changes

• client-sesv2: SESV2 DEED - Documentation Update (3d227df4)

New Features

• client-pi: This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.1. The SDK will prioritize its most performant protocol. (1d99c7c8)
• client-marketplace-agreement: This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.0. The SDK will prioritize its most performant protocol. (404943ce)
• client-emr-serverless: This release adds support for system profile logs for lakeformation enabled Spark connect sessions . (f9ed2f83)
• client-cost-explorer: Adds a product attribute dimension to GetCostAndUsage, GetCostAndUsageWithResources, and GetDimensionValues, letting customers group, filter, and discover Cost Explorer costs by structured attributes such as Amazon Bedrock model, provider, inference type, and feature. (7e0afd11)
• client-guardduty: Added support for GuardDuty RDS Data Activity Monitoring (aa200020)
• client-gamelift: Amazon GameLift Servers container fleets now support CPU bursting for game server container groups. The TotalVcpuLimit property of a game server container group definition is now optional. When you omit it, the group has no CPU cap and its containers can burst into unused CPU on the instance. (18121840)
• client-datazone: Adds support for multi-file notebook import. StartNotebookImport now accepts an s3Files source location with an ordered list of Amazon S3 objects, creating one notebook cell per file, plus a type field to create either a DATA or SQL notebook. (37214f3f)
• client-devops-agent: Adds release management associations with private network access to AWS DevOps Agent, and a releaseManagementAssociationId field on GitHub and GitLab associations. This helps release management agents (Release-readiness review and Release Testing) access customer resources that are behind a VPC. (55b389d1)
• client-security-ir: Adds support for retrieving finding-lifecycle metrics for an AWS Security Incident Response membership. (f4f6dfe5)
• client-cloudformation: CloudFormation introduces force rollback, a new opt-in capability that lets your stacks complete a rollback even when an individual resource cannot be reverted. Set ForceRollback on ContinueUpdateRollback and CloudFormation records each resource that fails as skipped, completing the rollback. (07e146a5)
• client-opensearch: This release adds a new EncryptionMode option (DISK or NATIVE) to EncryptionAtRestOptions for the CreateDomain and UpdateDomainConfig operations, enabling selection of engine-native index-level encryption on supported Amazon OpenSearch Service domains. (393fb011)
• client-lambda: AWS Lambda now supports OAuth 2.0 (OAUTHBEARER), IAM, and IAM with OAUTHBEARER authentication for self-managed Apache Kafka event source mappings, including optional OAuth scope, audience, logical cluster, and identity pool parameters. OAuth 2.0 is also available for Confluent Schema Registry. (c7696bfa)
• client-securityhub: Release findings export APIs - StartExportJobV2, GetExportJobV2, ListExportJobsV2, and CancelExportJobV2. This supports exporting findings from AWS Security Hub to Amazon S3 bucket. (f53e8a2a)
• client-medialive: AWS Elemental MediaLive Workflow Monitor now supports AWS Elemental Inference feeds as a target resource type for CloudWatch alarm templates. (e335e5dc)
• client-eks: Configurations support for EKS ACK Capabilities, including EnableCrossNamespace and DisableServices configuration. (82f87e7c)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1149.0 (2026-10-09)

Note: Version bump only for package @​aws-sdk/client-s3

3.1148.0 (2026-10-08)

Note: Version bump only for package @​aws-sdk/client-s3

3.1147.0 (2026-10-06)

Note: Version bump only for package @​aws-sdk/client-s3

3.1146.0 (2026-10-02)

Note: Version bump only for package @​aws-sdk/client-s3

3.1145.0 (2026-10-01)

Note: Version bump only for package @​aws-sdk/client-s3

3.1144.0 (2026-09-30)

Features

• client-s3: Amazon S3 adds a new optional S3 Inventory field, IntelligentTieringReferenceDate, reporting the reference date S3 Intelligent-Tiering uses to evaluate an object's tier-transition eligibility. The value is populated for objects in the Intelligent-Tiering storage class and left blank for others. (82bbbdc)

... (truncated)

Commits

• a960c14 Publish v3.1149.0
• 5773a75 chore(codegen): sync for endpoint cache fix and pre-schema error fallback (#8...
• 1bc0425 Publish v3.1148.0
• 663046d Publish v3.1147.0
• 054298b Publish v3.1146.0
• 0199117 Publish v3.1145.0
• ce26281 Publish v3.1144.0
• 82bbbdc feat(client-s3): Amazon S3 adds a new optional S3 Inventory field, Intelligen...
• 81afad0 Publish v3.1143.0
• See full diff in compare view

Updates @aws-sdk/lib-storage from 3.1142.0 to 3.1149.0

Release notes

Sourced from @​aws-sdk/lib-storage's releases.

v3.1149.0

3.1149.0(2026-10-09)

Chores

• codegen: sync for endpoint cache fix and pre-schema error fallback (#8341) (5773a751)

New Features

• client-quicksight: Adds granular custom permissions for the Gong action connector (GongAction, CreateAndUpdateGongAction, ShareGongAction, UseGongAction) and for create, update, and share operations on 45 data source connectors, such as Amazon S3 and Snowflake, through the Custom Permissions APIs. (c5d26e39)
• client-deadline: The new ListMemberships API enables users to discover their memberships across Deadline Cloud resources, enabling scoped users of Deadline resources to discover and interact with the resources they have been provided scoped access to. (0d7406c7)
• client-marketplace-metering: AWS Marketplace Metering Service adds AgreementId to ResolveCustomer API response. (9653f5cc)
• client-mediatailor: Add caching settings to http functions (7ac7530b)
• client-securityagent: Adds a test scope field to specify whether a pentest targets a web application or a generative AI application. (1cc5ba6a)

Bug Fixes

• lib-transfer-manager:
  • retry UploadPart on worker-thread upload path (#8345) (0e357d90)
  • avoid full-body copy for SharedArrayBuffer uploads (#8338) (5473caf9)

---

For list of updated packages, view updated-packages.md in assets-3.1149.0.zip

v3.1148.0

3.1148.0(2026-10-08)

Documentation Changes

• client-sesv2: SESV2 DEED - Documentation Update (3d227df4)

New Features

• client-pi: This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.1. The SDK will prioritize its most performant protocol. (1d99c7c8)
• client-marketplace-agreement: This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.0. The SDK will prioritize its most performant protocol. (404943ce)
• client-emr-serverless: This release adds support for system profile logs for lakeformation enabled Spark connect sessions . (f9ed2f83)
• client-cost-explorer: Adds a product attribute dimension to GetCostAndUsage, GetCostAndUsageWithResources, and GetDimensionValues, letting customers group, filter, and discover Cost Explorer costs by structured attributes such as Amazon Bedrock model, provider, inference type, and feature. (7e0afd11)
• client-guardduty: Added support for GuardDuty RDS Data Activity Monitoring (aa200020)
• client-gamelift: Amazon GameLift Servers container fleets now support CPU bursting for game server container groups. The TotalVcpuLimit property of a game server container group definition is now optional. When you omit it, the group has no CPU cap and its containers can burst into unused CPU on the instance. (18121840)
• client-datazone: Adds support for multi-file notebook import. StartNotebookImport now accepts an s3Files source location with an ordered list of Amazon S3 objects, creating one notebook cell per file, plus a type field to create either a DATA or SQL notebook. (37214f3f)
• client-devops-agent: Adds release management associations with private network access to AWS DevOps Agent, and a releaseManagementAssociationId field on GitHub and GitLab associations. This helps release management agents (Release-readiness review and Release Testing) access customer resources that are behind a VPC. (55b389d1)
• client-security-ir: Adds support for retrieving finding-lifecycle metrics for an AWS Security Incident Response membership. (f4f6dfe5)
• client-cloudformation: CloudFormation introduces force rollback, a new opt-in capability that lets your stacks complete a rollback even when an individual resource cannot be reverted. Set ForceRollback on ContinueUpdateRollback and CloudFormation records each resource that fails as skipped, completing the rollback. (07e146a5)
• client-opensearch: This release adds a new EncryptionMode option (DISK or NATIVE) to EncryptionAtRestOptions for the CreateDomain and UpdateDomainConfig operations, enabling selection of engine-native index-level encryption on supported Amazon OpenSearch Service domains. (393fb011)
• client-lambda: AWS Lambda now supports OAuth 2.0 (OAUTHBEARER), IAM, and IAM with OAUTHBEARER authentication for self-managed Apache Kafka event source mappings, including optional OAuth scope, audience, logical cluster, and identity pool parameters. OAuth 2.0 is also available for Confluent Schema Registry. (c7696bfa)
• client-securityhub: Release findings export APIs - StartExportJobV2, GetExportJobV2, ListExportJobsV2, and CancelExportJobV2. This supports exporting findings from AWS Security Hub to Amazon S3 bucket. (f53e8a2a)
• client-medialive: AWS Elemental MediaLive Workflow Monitor now supports AWS Elemental Inference feeds as a target resource type for CloudWatch alarm templates. (e335e5dc)
• client-eks: Configurations support for EKS ACK Capabilities, including EnableCrossNamespace and DisableServices configuration. (82f87e7c)

... (truncated)

Changelog

Sourced from @​aws-sdk/lib-storage's changelog.

3.1149.0 (2026-10-09)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1148.0 (2026-10-08)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1147.0 (2026-10-06)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1146.0 (2026-10-02)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1145.0 (2026-10-01)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1144.0 (2026-09-30)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1143.0 (2026-09-29)

... (truncated)

Commits

• a960c14 Publish v3.1149.0
• 5773a75 chore(codegen): sync for endpoint cache fix and pre-schema error fallback (#8...
• 1bc0425 Publish v3.1148.0
• 663046d Publish v3.1147.0
• 054298b Publish v3.1146.0
• 0199117 Publish v3.1145.0
• ce26281 Publish v3.1144.0
• 81afad0 Publish v3.1143.0
• See full diff in compare view

Updates playwright from 1.63.0 to 1.64.0

Release notes

Sourced from playwright's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits

• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
• 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
• 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
• 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
• dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cloudflare-workers-and-pages]

Deploying frameworks with    Cloudflare Pages

Latest commit:	b17e9f4
Status:	✅  Deploy successful!
Preview URL:	https://5ee5fd42.frameworks-573.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-deve-jupg.frameworks-573.pages.dev

View logs

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	playwright@​1.63.0 ⏵ 1.64.0	+1		+1
	@​aws-sdk/​lib-storage@​3.1142.0 ⏵ 3.1149.0
	@​aws-sdk/​client-s3@​3.1142.0 ⏵ 3.1149.0	+1

View full report