deps(deps): bump the npm-minor-patch group across 1 directory with 6 updates

[dependabot]

Bumps the npm-minor-patch group with 6 updates in the / directory:

Package	From	To
@anthropic-ai/sdk	0.122.0	0.128.0
@modelcontextprotocol/sdk	1.30.0	1.30.1
sharp	0.35.4	0.35.5
zod	4.4.3	4.6.5
@playwright/test	1.62.1	1.63.0
js-yaml	5.4.1	5.4.2

Updates @anthropic-ai/sdk from 0.122.0 to 0.128.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.128.0

0.128.0 (2026-09-22)

Full Changelog: sdk-v0.127.0...sdk-v0.128.0

Features

• api: add support for claude-opus-5-5, inline tool definitions and MCP tool-list pinning (beta) (eff2748)

Bug Fixes

• api: share one evaluated_permission enum across Managed Agents events (0c1cc0f)
• tools: addTools() takes effect straight away (#773) (1ccdad0)
• tools: leave reply-only params off the tool runner's compaction request (#769) (8afc336)

Chores

• docs: add descriptions to the Dreams API reference (ea4ddd1)
• docs: add descriptions to the User Profiles API reference (ea4ddd1)
• docs: add memory store descriptions to the Managed Agents API reference (ea4ddd1)
• docs: improve descriptions in the Dreams API reference (971c54a)
• docs: simplify the session thread agent type description (ccf71a2)
• docs: update diagnostics field descriptions on beta messages (c0b8746)
• internal: add property-based tests for partial JSON parsing (#776) (3ffac09)

sdk: v0.127.0

0.127.0 (2026-09-18)

Full Changelog: sdk-v0.126.0...sdk-v0.127.0

Features

• api: add group with display_name to rate limits, deprecate group_type (2575d97)
• tools: add compactBeforeNextTurn() to the tool runner (#682) (9f75ca6)

Bug Fixes

• BetaMessageStream: stop coercing a null compaction_delta content into "null" (#655) (dbd6845)
• client: don't retry requests whose body is a stream or iterator (eebc1b9)
• client: join multiple anthropic-beta values with a comma and no space (#638) (e0cb1ff)
• client: make pagination exports on the client namespace type-only (5adea1f)
• internal: drop jest from tsconfig types (60588af)
• middleware: echo a streamed compaction summary in the fallback continuation (#657) (2e0f004)
• tools: keep $defs when transformJSONSchema root is a $ref (#687) (57a9f30)

Performance Improvements

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.128.0 (2026-09-22)

Full Changelog: sdk-v0.127.0...sdk-v0.128.0

Features

• api: add support for claude-opus-5-5, inline tool definitions and MCP tool-list pinning (beta) (eff2748)

Bug Fixes

• api: share one evaluated_permission enum across Managed Agents events (0c1cc0f)
• tools: addTools() takes effect straight away (#773) (1ccdad0)
• tools: leave reply-only params off the tool runner's compaction request (#769) (8afc336)

Chores

• docs: add descriptions to the Dreams API reference (ea4ddd1)
• docs: add descriptions to the User Profiles API reference (ea4ddd1)
• docs: add memory store descriptions to the Managed Agents API reference (ea4ddd1)
• docs: improve descriptions in the Dreams API reference (971c54a)
• docs: simplify the session thread agent type description (ccf71a2)
• docs: update diagnostics field descriptions on beta messages (c0b8746)
• internal: add property-based tests for partial JSON parsing (#776) (3ffac09)

0.127.0 (2026-09-18)

Full Changelog: sdk-v0.126.0...sdk-v0.127.0

Features

• api: add group with display_name to rate limits, deprecate group_type (2575d97)
• tools: add compactBeforeNextTurn() to the tool runner (#682) (9f75ca6)

Bug Fixes

• BetaMessageStream: stop coercing a null compaction_delta content into "null" (#655) (dbd6845)
• client: don't retry requests whose body is a stream or iterator (eebc1b9)
• client: join multiple anthropic-beta values with a comma and no space (#638) (e0cb1ff)
• client: make pagination exports on the client namespace type-only (5adea1f)
• internal: drop jest from tsconfig types (60588af)
• middleware: echo a streamed compaction summary in the fallback continuation (#657) (2e0f004)
• tools: keep $defs when transformJSONSchema root is a $ref (#687) (57a9f30)

Performance Improvements

• client: skip formatting request details when debug logging is off (2b29ed2)

... (truncated)

Commits

• 1926adb Merge pull request #1208 from anthropics/release-please--branches--main--chan...
• 162c8b1 chore: release main
• 3ffac09 chore(internal): add property-based tests for partial JSON parsing (#776)
• e40ce27 test(ecosystem): check that unused imports tree-shake to nothing
• 1ccdad0 fix(tools): addTools() takes effect straight away (#773)
• 8afc336 fix(tools): leave reply-only params off the tool runner's compaction request ...
• eff2748 feat(api): add support for claude-opus-5-5, inline tool definitions and MCP t...
• 06e5f9b codegen metadata
• 0c1cc0f fix(api): share one evaluated_permission enum across Managed Agents events
• c0b8746 chore(docs): update diagnostics field descriptions on beta messages
• Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.30.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.1

What's Changed

• [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON-RPC batch length by @​maxisbey in modelcontextprotocol/typescript-sdk#2717
• fix(auth): preserve resource URI without trailing slash (#1968) by @​MukundaKatta in modelcontextprotocol/typescript-sdk#1972
• chore: bump version to 1.30.1 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2848

New Contributors

• @​MukundaKatta made their first contribution in modelcontextprotocol/typescript-sdk#1972

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.0...1.30.1

Commits

• 289ac2c chore: bump version to 1.30.1 (#2848)
• 12b4256 fix(auth): preserve resource URI without trailing slash (#1968) (#1972)
• a9f6eb7 [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON...
• See full diff in compare view

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract and rotate operations. #4606

• Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract operation. #4606

... (truncated)

Commits

• 51a990f Release v0.35.5
• 96de105 Upgrade to sharp-libvips v1.3.4
• 3a61390 CI: Configure Dependabot with all package.json locations
• 4940c50 Improve gain map support for rotate/flip/flop ops
• 20654aa Prerelease v0.35.5-rc.1
• ef4f934 CI: Upgrade to Ubuntu 26.04
• 358df95 Upgrade to libvips v8.18.7
• 49f4903 Improve gain map support for rotate-then-extract #4606
• 0e2e55e Silence a couple of compiler/static analysis warnings
• cef3b8c Improve gain map support for extract operation #4606
• Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits

• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
• 0f3f5ee 4.6.5
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
• 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• 743aedb 4.6.4
• Additional commits viewable in compare view

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates js-yaml from 5.4.1 to 5.4.2

Changelog

Sourced from js-yaml's changelog.

[5.4.2] - 2026-09-13

Fixed

• forceQuotes no longer quotes non-string scalars, #798.

Commits

• 494400b 5.4.2 released
• 6d8adb4 Fix forceQuotes quoting non-string scalars, #798
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.