chore(deps): bump deepmerge-ts and agent-browser

[dependabot]

Removes deepmerge-ts. It's no longer used after updating ancestor dependency agent-browser. These dependencies need to be updated together.

Removes deepmerge-ts

Updates agent-browser from 0.13.0 to 0.34.0

Changelog

Sourced from agent-browser's changelog.

0.34.0

New Features

• Added persistent session-to-tab binding for shared Chrome sessions. Named sessions connected through --cdp or --auto-connect now remember their CDP target across commands and daemon restarts, and CDP target ids can be used directly as tab references. Start each session with --pin-tab to make the binding strict, so a tab closed externally returns a stable tab_gone error instead of silently adopting a neighboring tab. JSON output includes data.targetId and an optional sanitized data.lastUrl; batch exposes the same recovery data under result (#1589)

Improvements

• Added a Remote Agent Browser provider guide covering Vercel authentication, disposable and stable sessions, custom VCR images, snapshots, and live-view URLs (#1648)

Bug Fixes

• Fixed parallel sessions sharing one Chrome hijacking each other's tabs. Event-discovered targets no longer steal a pinned session's active tab, re-attach restores the persisted target instead of selecting index 0, and preliminary plus existing-daemon --cdp and --auto-connect paths preserve explicit pin enable and disable. Agent skill guidance now requires a named --session before the first command (#1589)
• Fixed agent-browser doctor hanging on Chrome version detection. Windows reads the version from the executable resource table without spawning Chrome; other platforms bound the version subprocess with a deadline, kill, and reap so inherited output handles cannot block forever or leave an orphan browser (#1641)

Contributors

• @​Railly
• @​huozhi
• @​soichisumi
• @​dandaka
• @​mvanhorn

0.33.2

New Features

• Added input priority and per-client delivery settings to the stream server: each WebSocket connection now splits into a reader task and a writer loop, so clicks and keystrokes dispatch to the browser without queueing behind a frame write. Adds a per-client {"type":"config","maxFps":N} cap (1 to 120, 0 uncapped) and opt-in ack pacing via {"type":"config","pacing":"ack"} with {"type":"ack","seq":N}, which keeps one frame in flight so a stalled client never drains a backlog. Both settings can also be declared on the connection URL (?pacing=ack&maxFps=10), the only way to cover the opening frame. Every frame now carries a monotonic seq (#1594)
• Added configurable stream encoding: frames were hardcoded to jpeg quality 80 at the session viewport, so frame rate was the only bandwidth lever. AGENT_BROWSER_STREAM_QUALITY, AGENT_BROWSER_STREAM_MAX_WIDTH and AGENT_BROWSER_STREAM_MAX_HEIGHT are read once per daemon and cut bytes without dropping frames: on a busy page at 1280x720, quality 20 takes a frame from 54 KB to 25 KB, and quality 20 at 640x360 takes it to 9 KB, frame rate unchanged in both. Width and height default to the session viewport, so a larger viewport is never downscaled unless both are set (#1626)

Behavior Changes

• Frame delivery is now latest-wins. The stream server holds only the newest frame and reads it at send time, so frames produced while an earlier one is still being written are skipped. A client that assumed it received every frame from the WebSocket now receives fewer. Nothing in this repo consumes the stream that way, since record captures through CDP and the dashboard is a viewer, so this affects external consumers only (#1594)
• metadata.timestamp now carries a real value. It was always 0, because CDP sends the capture time as a float in seconds and the code read it as an integer. It is now epoch milliseconds, so a client can measure how stale the frame it is drawing is. A client that treated 0 as unknown is unaffected (#1594)

Bug Fixes

• Fixed keyboard input over the stream, which worked in none of the three shapes the docs publish: an absent key, code, or text reached CDP as an explicit null, which rejects the whole command, so every key release and every non-printable key was silently dropped, the dashboard's own payloads included (#1594)
• Fixed click latency behind mouse movement: input dispatch awaited Chrome's reply before reading the next message, so a click sat one round trip behind every queued mouse move. After a 300-event sweep a click landed 2471ms late; it now lands in 6ms (#1627)
• Fixed stream disable returning while a slow client's input reader was still running (#1594)

Contributors

• @​Railly
• @​kevingatera
• @​WebCloud

0.33.1

... (truncated)

Commits

• 548b159 Prepare v0.34.0 release (#1678)
• 861e76d feat(session): persistent session tab binding with --pin-tab (#1589)
• acbc22b docs: add Remote Agent Browser provider guide (#1648)
• 01c1147 fix(doctor): stop hanging on the Chrome version query (#1641)
• 93cdda5 test(native): raise parity action timeout to 60s (#1637)
• da1237e Prepare v0.33.2 release (#1628)
• 3aa6c75 feat(stream): configurable screencast quality and frame size (#1626)
• 723b452 fix(stream): dispatch input without waiting for the browser's reply (#1627)
• 2158803 feat(stream): input priority and latest-frame-wins delivery with per-client m...
• 6dcea79 Prepare v0.33.1 release (#1620)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for agent-browser since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.