Skip to content

build(deps): bump the app-dependencies group across 1 directory with 9 updates - #26

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/app-dependencies-e3c8f71c48
Open

build(deps): bump the app-dependencies group across 1 directory with 9 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/app-dependencies-e3c8f71c48

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the app-dependencies group with 9 updates in the / directory:

Package From To
@auth0/nextjs-auth0 4.30.0 4.33.0
@vercel/blob 2.8.0 2.8.2
@vercel/sandbox 3.5.0 3.9.0
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
@axe-core/playwright 4.13.0 4.14.0
@types/node 24.19.0 24.19.2
eslint-config-next 15.5.26 15.5.28
playwright 1.63.0 1.64.1

Updates @auth0/nextjs-auth0 from 4.30.0 to 4.33.0

Release notes

Sourced from @​auth0/nextjs-auth0's releases.

v4.33.0

Added

  • feat(passkey): add identifier verification for passkey signup #2905 (Piyush-85)

Summary by CodeRabbit

  • New Features
    • Passkey signup now supports verification of email and phone identifiers using one-time codes, with retry support for incorrect codes.
    • Phone verification can be delivered by text or voice.
  • Documentation
    • Updated the API documentation and changelog for version 4.33.0 and the passkey verification flow.

v4.32.1

Fixed

  • fix(mfa): map channel factor names to oob in mfaChallenge #2911 (Piyush-85)

v4.32.0

Fixed

  • fix: preserve cookie attributes when refreshing from a Server Action #2893 (Piyush-85)
  • fix: return 401 instead of 500 when /me and /my-org token refresh fails #2907 (Piyush-85)

Security

  • fix: prevent open redirect in createRouteUrl via cross-origin origin check GHSA-5vvp-h2v6-59j6

v4.31.1

Added

Fixed

  • fix(anonymous-sessions): surface session expiry error instead of silently rotating #2879 (yogeshchoudhary147)
  • fix: pass request cookies in startEnterpriseLogin to evict stale txn cookies #2868 (kwy404)

Summary by CodeRabbit

  • New Features
    • Added anonymous-session support, including session creation and retrieval, a client hook, and login linking.
    • The package now ships agent skills.

... (truncated)

Changelog

Sourced from @​auth0/nextjs-auth0's changelog.

v4.33.0 (2026-10-22)

Full Changelog

Added

  • feat(passkey): add identifier verification for passkey signup #2905 (Piyush-85)

v4.32.1 (2026-10-16)

Full Changelog

Fixed

  • fix(mfa): map channel factor names to oob in mfaChallenge #2911 (Piyush-85)

v4.32.0 (2026-10-13)

Full Changelog

Fixed

  • fix: preserve cookie attributes when refreshing from a Server Action #2893 (Piyush-85)
  • fix: return 401 instead of 500 when /me and /my-org token refresh fails #2907 (Piyush-85)

Security

  • fix: prevent open redirect in createRouteUrl via cross-origin origin check

v4.31.1 (2026-10-07)

Full Changelog

Added

Fixed

  • fix(anonymous-sessions): surface session expiry error instead of silently rotating #2879 (yogeshchoudhary147)
  • fix: pass request cookies in startEnterpriseLogin to evict stale txn cookies #2868 (kwy404)

v4.31.0 (2026-10-01)

Full Changelog

Added

  • feat(anonymous-sessions): anonymous sessions with Session Transfer Ticket linking (EA) #2865 (tusharpandey13)
Commits
  • 9d14a92 Release v4.33.0 (#2920)
  • 01d183d feat(passkey): add identifier verification for passkey signup (#2905)
  • d246e33 chore(deps): bump markdown-it from 14.3.2 to 14.3.3 (#2919)
  • 2fdc4bc chore(deps): bump the codeql-action group with 3 updates (#2917)
  • d6823b2 chore(deps-dev): bump @​playwright/test from 1.64.0 to 1.64.1 (#2916)
  • ec6a8a9 chore(deps-dev): bump eslint-plugin-prettier from 5.5.6 to 5.5.7 (#2915)
  • caf97a8 chore(deps-dev): bump next from 15.5.27 to 15.5.28 (#2914)
  • 33981e6 chore(deps-dev): bump typescript-eslint from 8.71.1 to 8.71.2 (#2913)
  • 8555996 chore(deps): bump vite from 7.1.9 to 7.3.7 in /examples/with-dpop (#2918)
  • 2290679 chore(deps-dev): bump prettier from 3.9.9 to 3.9.10 (#2910)
  • Additional commits viewable in compare view

Updates @vercel/blob from 2.8.0 to 2.8.2

Release notes

Sourced from @​vercel/blob's releases.

@​vercel/blob@​2.8.2

Patch Changes

  • f11f653: Send blob API version 13, where the server reads keys containing . or .. path segments exactly as they were written instead of resolving them away. Fixes head, copy, rename, del and list on blobs whose pathname has a dot segment.

@​vercel/blob@​2.8.1

Patch Changes

  • 59be092: Allow get() to fetch blob URLs from a VERCEL_BLOB_API_URL origin. get() only accepted URLs on *.blob.vercel-storage.com, which blocked local emulators like emulate, since they serve blob content from their own host. When VERCEL_BLOB_API_URL (or NEXT_PUBLIC_VERCEL_BLOB_API_URL) is set, URLs on that same origin are now accepted as well. With no override set the behavior is unchanged, so arbitrary hosts are still rejected in production.
Changelog

Sourced from @​vercel/blob's changelog.

2.8.2

Patch Changes

  • f11f653: Send blob API version 13, where the server reads keys containing . or .. path segments exactly as they were written instead of resolving them away. Fixes head, copy, rename, del and list on blobs whose pathname has a dot segment.

2.8.1

Patch Changes

  • 59be092: Allow get() to fetch blob URLs from a VERCEL_BLOB_API_URL origin. get() only accepted URLs on *.blob.vercel-storage.com, which blocked local emulators like emulate, since they serve blob content from their own host. When VERCEL_BLOB_API_URL (or NEXT_PUBLIC_VERCEL_BLOB_API_URL) is set, URLs on that same origin are now accepted as well. With no override set the behavior is unchanged, so arbitrary hosts are still rejected in production.
Commits

Updates @vercel/sandbox from 3.5.0 to 3.9.0

Release notes

Sourced from @​vercel/sandbox's releases.

@​vercel/sandbox-mock@​3.9.0

Minor Changes

  • Support command stdin: writeStdin(), closeStdin() and stdin: Readable. Writes are buffered, and the command runs once stdin is closed. (#397)

Patch Changes

@​vercel/sandbox@​3.9.0

Patch Changes

  • Apply network policy changes to active sessions before saving configuration and tags, and surface live policy failures so tags cannot incorrectly indicate that a failed policy update succeeded. (#400)

    Skip live network policy updates for sessions that are already stopping so configuration can still be saved for the next session.

  • Stdin writes now always send an offset, and a timed-out write that reports no progress is treated as stalled. (#381)

@​vercel/sandbox-mock@​3.8.0

Patch Changes

@​vercel/sandbox@​3.8.0

Minor Changes

  • Add a new onStart hook on sandbox.runCommand({ ... }) to be notified when a command is started when not using detached: true (#384)

@​vercel/sandbox-mock@​3.7.0

Patch Changes

@​vercel/sandbox@​3.7.0

Minor Changes

  • Add opt-in stdin for commands. Pass stdin: true to a detached runCommand, then use command.writeStdin(data) and command.closeStdin() while it runs, or pass a Readable such as process.stdin to have it piped to the command. (#365)

Patch Changes

  • Update @vercel/oidc to v4. (#375)

@​vercel/sandbox-mock@​3.6.1

Patch Changes

... (truncated)

Changelog

Sourced from @​vercel/sandbox's changelog.

3.9.0

Patch Changes

  • Apply network policy changes to active sessions before saving configuration and tags, and surface live policy failures so tags cannot incorrectly indicate that a failed policy update succeeded. (#400)

    Skip live network policy updates for sessions that are already stopping so configuration can still be saved for the next session.

  • Stdin writes now always send an offset, and a timed-out write that reports no progress is treated as stalled. (#381)

3.8.0

Minor Changes

  • Add a new onStart hook on sandbox.runCommand({ ... }) to be notified when a command is started when not using detached: true (#384)

3.7.0

Minor Changes

  • Add opt-in stdin for commands. Pass stdin: true to a detached runCommand, then use command.writeStdin(data) and command.closeStdin() while it runs, or pass a Readable such as process.stdin to have it piped to the command. (#365)

Patch Changes

  • Update @vercel/oidc to v4. (#375)

3.6.1

Patch Changes

  • Preserve UTF-8 characters split across command and log stream chunks so recovery does not skip new output. (#374)

  • Recover from interrupted command wait and log connections, including streams ending with incomplete JSON records, without rerunning commands or duplicating output. (#374)

3.6.0

Minor Changes

  • Add a new Drive.get method to retrieve an existing drive by name. (#367)

  • Add a new drive.fork({ name }) API that forks and returns a new Drive, inheriting the parent drive's data, max size and region. (#369)

3.5.1

Patch Changes

  • Forward Drive mounts when forking a sandbox. (#348)
Commits

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates @axe-core/playwright from 4.13.0 to 4.14.0

Release notes

Sourced from @​axe-core/playwright's releases.

Release 4.14.0

What's Changed

New Contributors

Full Changelog: dequelabs/axe-core-npm@v4.13.0...v4.14.0

Changelog

Sourced from @​axe-core/playwright's changelog.

4.14.0 (2026-10-06)

Bug Fixes

Features

Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates @types/node from 24.19.0 to 24.19.2

Commits

Updates eslint-config-next from 15.5.26 to 15.5.28

Release notes

Sourced from eslint-config-next's releases.

v15.5.28

This release contains security fixes for the following advisories:

Critical:

High:

v15.5.27

This release contains security fixes for the following advisories:

Medium:

Commits

Updates playwright from 1.63.0 to 1.64.1

Release notes

Sourced from playwright's releases.

v1.64.1

Bug Fixes

  • #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
  • #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits
  • cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
  • 866cbb8 chore: mark v1.64.1 (#43354)
  • 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
  • 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
  • 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
  • 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
  • e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
  • f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
  • e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
  • d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
  • Additional commits viewable in compare view

@vercel

vercel Bot commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
opensrced Ready Ready Preview Oct 30, 2026 6:45pm UTC
opensrced-staging Ready Ready Preview Oct 30, 2026 6:45pm UTC

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 22, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/app-dependencies-e3c8f71c48 branch from d2f4817 to 38c894d Compare October 23, 2026 18:40
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/app-dependencies-e3c8f71c48 branch from 38c894d to e44ee2a Compare October 24, 2026 05:33
@dependabot
build(deps): bump the app-dependencies group across 1 directory with …
c1f669a 
…9 updates

Bumps the app-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@auth0/nextjs-auth0](https://github.com/auth0/nextjs-auth0) | `4.30.0` | `4.33.0` |
| [@vercel/blob](https://github.com/vercel/storage/tree/HEAD/packages/blob) | `2.8.0` | `2.8.2` |
| [@vercel/sandbox](https://github.com/vercel/sandbox/tree/HEAD/packages/vercel-sandbox) | `3.5.0` | `3.9.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.13.0` | `4.14.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.19.0` | `24.19.2` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `15.5.26` | `15.5.28` |
| [playwright](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` |



Updates `@auth0/nextjs-auth0` from 4.30.0 to 4.33.0
- [Release notes](https://github.com/auth0/nextjs-auth0/releases)
- [Changelog](https://github.com/auth0/nextjs-auth0/blob/main/CHANGELOG.md)
- [Commits](auth0/nextjs-auth0@v4.30.0...v4.33.0)

Updates `@vercel/blob` from 2.8.0 to 2.8.2
- [Release notes](https://github.com/vercel/storage/releases)
- [Changelog](https://github.com/vercel/storage/blob/main/packages/blob/CHANGELOG.md)
- [Commits](https://github.com/vercel/storage/commits/@vercel/blob@2.8.2/packages/blob)

Updates `@vercel/sandbox` from 3.5.0 to 3.9.0
- [Release notes](https://github.com/vercel/sandbox/releases)
- [Changelog](https://github.com/vercel/sandbox/blob/main/packages/vercel-sandbox/CHANGELOG.md)
- [Commits](https://github.com/vercel/sandbox/commits/@vercel/sandbox@3.9.0/packages/vercel-sandbox)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@axe-core/playwright` from 4.13.0 to 4.14.0
- [Release notes](https://github.com/dequelabs/axe-core-npm/releases)
- [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core-npm@v4.13.0...v4.14.0)

Updates `@types/node` from 24.19.0 to 24.19.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `eslint-config-next` from 15.5.26 to 15.5.28
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v15.5.28/packages/eslint-config-next)

Updates `playwright` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

---
updated-dependencies:
- dependency-name: "@auth0/nextjs-auth0"
  dependency-version: 4.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: app-dependencies
- dependency-name: "@axe-core/playwright"
  dependency-version: 4.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: app-dependencies
- dependency-name: "@types/node"
  dependency-version: 24.19.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: app-dependencies
- dependency-name: "@vercel/blob"
  dependency-version: 2.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: app-dependencies
- dependency-name: "@vercel/sandbox"
  dependency-version: 3.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: app-dependencies
- dependency-name: eslint-config-next
  dependency-version: 15.5.28
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: app-dependencies
- dependency-name: playwright
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: app-dependencies
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: app-dependencies
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: app-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the app-dependencies group across 1 directory with 9 updates build(deps): bump the app-dependencies group across 1 directory with 9 updates Oct 30, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/app-dependencies-e3c8f71c48 branch from e44ee2a to c1f669a Compare October 30, 2026 18:36

This branch was successfully deployed

2 active deployments
Preview – opensrced — c1f669ad Deployed Oct 30, 2026 by vercel[bot]
View deployment
Preview – opensrced-staging — c1f669ad Deployed Oct 30, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants