build(deps): bump the one-password-guide group in /playbook/guides/1password/node with 4 updates

[dependabot]

Bumps the one-password-guide group in /playbook/guides/1password/node with 4 updates: @browserbasehq/sdk, @browserbasehq/stagehand, dotenv and @types/node.

Updates @browserbasehq/sdk from 2.19.1 to 2.21.0

Release notes

Sourced from @​browserbasehq/sdk's releases.

v2.21.0

2.21.0 (2026-09-24)

Features

• Add secrets SDK generation (f22482a)

v2.20.0

2.20.0 (2026-09-09)

Features

• api: declare the webhooks resource (d57781b)

Chores

• api: reset webhooks before release re-land (bf7ad1e)

Changelog

Sourced from @​browserbasehq/sdk's changelog.

2.21.0 (2026-09-24)

Features

• Add secrets SDK generation (f22482a)

2.20.0 (2026-09-09)

Features

• api: declare the webhooks resource (d57781b)

Chores

• api: reset webhooks before release re-land (bf7ad1e)

Commits

• adef824 release: 2.21.0 (#221)
• 86b5179 Build SDK
• e8e4409 [AP-2931] docs(agents): pausing and resuming runs (#12265)
• f22482a feat: Add secrets SDK generation
• cdcef9d [AP-3006] Expose secrets operations in SDK spec (#12281)
• 629718d [CB-0000] fix(api): align downloads pagination schema and defaults (#11957)
• fe805b8 release: 2.20.0 (#220)
• 272f02f test(webhooks): use the configured HTTP response shim (#8)
• d57781b feat(api): declare the webhooks resource
• bf7ad1e chore(api): reset webhooks before release re-land
• Additional commits viewable in compare view

Updates @browserbasehq/stagehand from 4.0.2 to 4.1.0

Changelog

Sourced from @​browserbasehq/stagehand's changelog.

TypeScript SDK 4.1.0

Minor Changes

• #2828 e2c8946 Thanks @​miguelg719! - Expose Browserbase Search and Fetch through the Stagehand browserbase facade in TypeScript, Python, and Go.

Patch Changes

• #2827 6555e81 Thanks @​seanmcguire12! - make browser.close() and browser.context.close() always terminate the browser regardless of keepAlive.

• #2878 50146e4 Thanks @​seanmcguire12! - support discovering and invoking WebMCP tools in out-of-process iframes (OOPIFs)

• #2912 67a4668 Thanks @​miguelg719! - Fail fast on protocol compatibility errors

• #2790 1011177 Thanks @​seanmcguire12! - fail fast on browserbase.connect() when extension is not present

• #2818 341433a Thanks @​seanmcguire12! - make stagehand.close() preserve the browser and allow another Stagehand instance to attach later

• #2754 a21633d Thanks @​monadoid! - remove the redundant image type from page screenshot protocol responses.

Python SDK 4.1.0

Minor Changes

• #2828 e2c8946 Thanks @​miguelg719! - Expose Browserbase Search and Fetch through the Stagehand browserbase facade in TypeScript, Python, and Go.

Patch Changes

• #2827 6555e81 Thanks @​seanmcguire12! - make browser.close() and browser.context.close() always terminate the browser regardless of keepAlive.

• #2878 50146e4 Thanks @​seanmcguire12! - support discovering and invoking WebMCP tools in out-of-process iframes (OOPIFs)

• #2912 67a4668 Thanks @​miguelg719! - Fail fast on protocol compatibility errors

• #2790 1011177 Thanks @​seanmcguire12! - fail fast on browserbase.connect() when extension is not present

• #2818 341433a Thanks @​seanmcguire12! - make stagehand.close() preserve the browser and allow another Stagehand instance to attach later

• #2754 a21633d Thanks @​monadoid! - remove the redundant image type from page screenshot protocol responses.

• #2864 d2d9169 Thanks @​seanmcguire12! - Make python and golang SDKs reject occupied local chrome debugging ports, and make local browser launch wait for readiness in python.

Extension Runtime 1.0.2

Patch Changes

• #2827 6555e81 Thanks @​seanmcguire12! - make browser.close() and browser.context.close() always terminate the browser regardless of keepAlive.

• #2878 50146e4 Thanks @​seanmcguire12! - support discovering and invoking WebMCP tools in out-of-process iframes (OOPIFs)

... (truncated)

Commits

• cd7b230 Release Stagehand packages (#2798)
• e825c77 test: cross-version compatibility check against the last published extension ...
• 67a4668 [fix]: fail fast on incompatible Stagehand runtime instead of polling to time...
• 5beaca7 test: make runtime compatibility fixtures resilient to protocol bumps (#2908)
• 50146e4 [feat]: add support for WebMCP tool invokation in iframes (#2878)
• e2c8946 feat(sdk): expose Browserbase search and fetch (#2828)
• d2d9169 [fix]: close parity gaps across SDKs for local browser launching (#2864)
• 8df637a [chore]: fix ts package boundaries (#2865)
• a144e1b [refactor]: replace chrome-launcher with handrolled local browser launcher ...
• 6555e81 [fix]: align browser.close and context.close semantics (#2827)
• Additional commits viewable in compare view

Updates dotenv from 16.6.1 to 18.0.4

Changelog

Sourced from dotenv's changelog.

18.0.4 (2026-09-25)

Changed

• import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

• Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

• Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

• Handle file urls in config logging (#1054)

18.0.0 (2026-09-17)

Added

• NEW: Dotenv now has a CLI. (#1022)

$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv

• NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#1010)

$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv

faster than Node native parseEnv!

Changed

• Injecting message sent to stderr rather than stdout and tips removed (#1037)

... (truncated)

Commits

• 86804c0 18.0.4
• 2403db5 changelog
• 75b775e npm audit
• 7e1750c Merge pull request #1064 from motdotla/dependabot/npm_and_yarn/ip-address-10.7.2
• a6ade63 Merge pull request #1063 from motdotla/import
• 288b0d7 patch test
• 00da912 Bump ip-address from 10.2.0 to 10.7.2
• e6b5816 import 'dotenv/config' should still be defaulting to quiet
• 3646ac5 Merge pull request #1061 from motdotla/fast
• 83fc961 report dotenv vs native vs dotenv.fast
• Additional commits viewable in compare view

Updates @types/node from 24.19.0 to 26.6.3

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​dotenv@​18.0.4
	npm/​@​browserbasehq/​stagehand@​4.1.0

View full report