Bump the app-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the app-dependencies group with 6 updates in the / directory:

Package	From	To
@auth0/nextjs-auth0	4.30.0	4.31.1
@vercel/blob	2.8.0	2.8.1
@vercel/sandbox	3.5.0	3.6.1
@types/node	24.19.0	24.19.1
eslint-config-next	15.5.26	15.5.27
playwright	1.63.0	1.64.0

Updates @auth0/nextjs-auth0 from 4.30.0 to 4.31.1

Release notes

Sourced from @​auth0/nextjs-auth0's releases.

v4.31.1

Added

• feat: ship agent skills inside the package #2866 (subhankarmaiti)

Fixed

• fix(anonymous-sessions): surface session expiry error instead of silently rotating #2879 (yogeshchoudhary147)
• fix: pass request cookies in startEnterpriseLogin to evict stale txn cookies #2868 (kwy404)

Summary by CodeRabbit

• New Features
  • Added anonymous-session support, including session creation and retrieval, a client hook, and login linking.
  • The package now ships agent skills.
• Bug Fixes
  • Anonymous-session expiry errors are now surfaced.
  • Enterprise login now passes request cookies to clear stale transaction cookies.
• Documentation
  • Updated API documentation for version 4.31.1 and added anonymous-session references.

v4.31.0

Added

• feat(anonymous-sessions): anonymous sessions with Session Transfer Ticket linking (EA) #2865 (tusharpandey13)

Changelog

Sourced from @​auth0/nextjs-auth0's changelog.

v4.31.1 (2026-10-07)

Full Changelog

Added

• feat: ship agent skills inside the package #2866 (subhankarmaiti)

Fixed

• fix(anonymous-sessions): surface session expiry error instead of silently rotating #2879 (yogeshchoudhary147)
• fix: pass request cookies in startEnterpriseLogin to evict stale txn cookies #2868 (kwy404)

v4.31.0 (2026-10-01)

Full Changelog

Added

• feat(anonymous-sessions): anonymous sessions with Session Transfer Ticket linking (EA) #2865 (tusharpandey13)

Commits

• 9692824 Release v4.31.1 (#2887)
• db54d18 fix(anonymous-sessions): surface session expiry error instead of silently rot...
• 169cdf5 chore(deps-dev): bump typescript-eslint from 8.70.1 to 8.71.0 (#2882)
• 35f69ff chore(deps-dev): bump @​types/node from 22.20.4 to 22.20.5 (#2881)
• f0e90f9 chore(deps-dev): bump next from 15.5.25 to 15.5.27 (#2880)
• 05aa4a9 chore(deps): bump postcss-selector-parser from 6.1.2 to 6.1.4 in /examples/wi...
• bda8c21 chore(deps): bump postcss-selector-parser from 6.1.2 to 6.1.4 in /examples/wi...
• 1366901 chore(deps): bump markdown-it from 14.3.0 to 14.3.2 (#2876)
• d1f28de chore(deps): bump source-map-js from 1.2.1 to 1.2.2 in /examples/with-passwor...
• 87e0b25 chore(deps): bump next from 16.3.3 to 16.3.6 in /examples/with-shadcn (#2878)
• Additional commits viewable in compare view

Updates @vercel/blob from 2.8.0 to 2.8.1

Release notes

Sourced from @​vercel/blob's releases.

@​vercel/blob@​2.8.1

Patch Changes

• 59be092: Allow get() to fetch blob URLs from a VERCEL_BLOB_API_URL origin. get() only accepted URLs on *.blob.vercel-storage.com, which blocked local emulators like emulate, since they serve blob content from their own host. When VERCEL_BLOB_API_URL (or NEXT_PUBLIC_VERCEL_BLOB_API_URL) is set, URLs on that same origin are now accepted as well. With no override set the behavior is unchanged, so arbitrary hosts are still rejected in production.

Changelog

Sourced from @​vercel/blob's changelog.

2.8.1

Patch Changes

• 59be092: Allow get() to fetch blob URLs from a VERCEL_BLOB_API_URL origin. get() only accepted URLs on *.blob.vercel-storage.com, which blocked local emulators like emulate, since they serve blob content from their own host. When VERCEL_BLOB_API_URL (or NEXT_PUBLIC_VERCEL_BLOB_API_URL) is set, URLs on that same origin are now accepted as well. With no override set the behavior is unchanged, so arbitrary hosts are still rejected in production.

Commits

• d15b9b3 Version Packages (#1111)
• 59be092 [@​vercel/blob] Allow get() to fetch from a VERCEL_BLOB_API_URL origin (#1110)
• See full diff in compare view

Updates @vercel/sandbox from 3.5.0 to 3.6.1

Release notes

Sourced from @​vercel/sandbox's releases.

@​vercel/sandbox-mock@​3.6.1

Patch Changes

• Updated dependencies [dd2ba29a2c54c8c12573fcb291ed874a6583a7cb, dd2ba29a2c54c8c12573fcb291ed874a6583a7cb]:
  • @​vercel/sandbox@​3.6.1

@​vercel/sandbox@​3.6.1

Patch Changes

• Preserve UTF-8 characters split across command and log stream chunks so recovery does not skip new output. (#374)

• Recover from interrupted command wait and log connections, including streams ending with incomplete JSON records, without rerunning commands or duplicating output. (#374)

@​vercel/sandbox-mock@​3.6.0

Minor Changes

• Add a new Drive.get method to retrieve an existing drive by name. (#367)

Patch Changes

• Updated dependencies [26a1162ec144138382d173416c635a270b692983, bc2f85f6803a7562c4c4902e35833a8bb45dd071]:
  • @​vercel/sandbox@​3.6.0

@​vercel/sandbox@​3.6.0

Minor Changes

• Add a new Drive.get method to retrieve an existing drive by name. (#367)

• Add a new drive.fork({ name }) API that forks and returns a new Drive, inheriting the parent drive's data, max size and region. (#369)

@​vercel/sandbox-mock@​3.5.1

Patch Changes

• Updated dependencies [d5b845bbe1b21fffa79f77bf0cdccb183605703c]:
  • @​vercel/sandbox@​3.5.1

@​vercel/sandbox@​3.5.1

Patch Changes

• Forward Drive mounts when forking a sandbox. (#348)

Changelog

Sourced from @​vercel/sandbox's changelog.

3.6.1

Patch Changes

• Preserve UTF-8 characters split across command and log stream chunks so recovery does not skip new output. (#374)

• Recover from interrupted command wait and log connections, including streams ending with incomplete JSON records, without rerunning commands or duplicating output. (#374)

3.6.0

Minor Changes

• Add a new Drive.get method to retrieve an existing drive by name. (#367)

• Add a new drive.fork({ name }) API that forks and returns a new Drive, inheriting the parent drive's data, max size and region. (#369)

3.5.1

Patch Changes

• Forward Drive mounts when forking a sandbox. (#348)

Commits

• a1481a5 Version Packages (#376)
• dd2ba29 fix(sdk): recover from interrupted command streams (#374)
• b159c81 Version Packages (#368)
• bc2f85f feat(sdk,cli): add drive forks (#369)
• 26a1162 feat(sdk): add Drive.get API (#367)
• 85d53ff Version Packages (#349)
• d5b845b fix(sdk): allow passing Drives in mounts when forking (#348)
• See full diff in compare view

Updates @types/node from 24.19.0 to 24.19.1

Commits

• See full diff in compare view

Updates eslint-config-next from 15.5.26 to 15.5.27

Release notes

Sourced from eslint-config-next's releases.

v15.5.27

This release contains security fixes for the following advisories:

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Commits

• def7eff v15.5.27
• See full diff in compare view

Updates playwright from 1.63.0 to 1.64.0

Release notes

Sourced from playwright's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits

• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
• 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
• 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
• 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
• dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
opensrced	Ready	Preview	Oct 16, 2026 6:44pm UTC
opensrced-staging	Ready	Preview	Oct 16, 2026 6:44pm UTC