chore(deps): bump the javascript-minor-and-patch group across 1 directory with 6 updates

[dependabot]

Bumps the javascript-minor-and-patch group with 6 updates in the / directory:

Package	From	To
@anthropic-ai/claude-code	2.1.283	2.1.296
@node-rs/argon2	2.2.1	2.2.2
drizzle-orm	0.45.3	0.45.4
@playwright/test	1.63.0	1.64.0
playwright	1.63.0	1.64.0
postcss	8.5.28	8.5.29

Updates @anthropic-ai/claude-code from 2.1.283 to 2.1.296

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.296

What's changed

• Added a code key to the Claude apps gateway's managed.policies[]: the same settings as cli, also applied in Claude Desktop's Code tab; beside desktop, it turns on Claude Desktop's gateway mode
• Added autoCompactWindow to subagent frontmatter and --agents definitions, so a subagent can auto-compact earlier than the main conversation's window
• Added CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL to run every workflow agent on one model while other subagents keep theirs
• Added CLAUDE_CODE_OVERLOADED_RETRY_MAX_DELAY_MS environment variable to set a longer maximum delay for the backoff when retrying an overloaded (529) request
• Added a note in /plugin on a plugin whose hooks are left out because another enabled plugin has the same name
• Added an allow_large option to the Read tool so Claude can read a text file past the usual size limits in one call when it needs the whole file and the context has room
• Fixed managed-settings PreToolUse hooks that deny a tool call with "continue": false, and managed prompt hooks that block one, refusing the call but not ending the turn
• Fixed PostToolUse hooks in managed settings not applying updatedMCPToolOutput in some sessions
• Fixed headless sessions starting a folder's .mcp.json or plugin MCP server that was switched off for that folder, after changing directory or reloading plugins
• Fixed a Claude apps gateway that serves allowedProviders with "gateway" locking out laptops that name that gateway in user settings
• Fixed a saved Claude apps gateway sign-in being ignored on machines whose managed settings set forceLoginMethod to gateway with no forceLoginGatewayUrl (regression in 2.1.295)
• Fixed --teleport opening an empty conversation when the session's history could not be read
• Fixed token counts for Haiku 5.5 and other models that take only adaptive thinking, which failed behind some gateways and were counted with budget thinking elsewhere
• Fixed resumed subagents being told that the user rejected a tool call that a session shutdown had interrupted
• Fixed hook output being altered when it contained text resembling a plugin hint tag
• Fixed secret redaction in shared transcripts and debug logs missing some values that follow a key with no value, including in JSON written inside a shell string
• Fixed a stray 52;c;… escape sequence printed on screen after copying in older VTE-based terminals such as MATE Terminal
• Fixed toasts and notifications waiting unseen for as long as the /diff panel or dialog was open
• Fixed Esc or an interrupt during a UserPromptSubmit hook or a mod's prompt.submit hook ending headless sessions, clearing the typed prompt, or letting the unchecked prompt through
• Fixed SessionStart hooks of a plugin loaded after a headless session starts being skipped when a different plugin with the same name, or another spelling of it, had already run
• Fixed claude self-hosted-runner printing misleading errors when registration is refused: it now names the org admin setting, or says a restarted on-demand runner needs a fresh work order
• Fixed a self-hosted runner session's git fetch, pull and push failing while another session of the same repository starts on a runner with --capacity above 1
• Fixed workflow scripts silently truncating results, agent options and other values nested deeper than about 20,000 levels, and deeply nested results writing huge task output files
• Fixed a plugin's served $ methods running in the main session's working directory instead of the calling agent's, and ignoring the turn their calling hook holds
• Fixed $.agent.register succeeding from a mod's hook that was still running after the mod was reloaded or removed; the call is now refused
• Fixed $.http.fetch in mods refusing a HEAD request when the response declares a Content-Length over the 4 MiB body limit
• Fixed claude plugin marketplace add, marketplace update and plugin install failing with an internal error for a marketplace named like constructor; add now refuses such names clearly
• Fixed a plugin secret named constructor or prototype being deleted by the next save of that plugin's options
• Fixed cloud sessions skipping auto mode's checks on Claude in Chrome actions that a saved permission allows when their feature flags had not loaded
• Fixed CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-running a finished turn after a restart when an MCP tool result had ended that turn
• Fixed Bash permission checks auto-approving some commands that assign the BASH_ARGV0 shell variable and then use it; these now prompt for approval
• Fixed Edit and NotebookEdit replacing every non-ASCII character in files that are not valid UTF-8 (Windows-1252, Shift-JIS, GBK); such edits are now refused
• Fixed a prompt sent just after ← being run twice, once unseen in the foreground, when the background service was slow to answer
• Fixed a prompt sent while SessionStart hooks were still running vanishing when ← moved the session to the background; it is still not sent, but ↑ now brings it back
• Fixed a late-loading plugin's SessionStart hook output reaching the new conversation after /clear in headless sessions
• Fixed PowerShell commands not seeing variables that hooks write to CLAUDE_ENV_FILE (when the file holds only plain assignments)
• Fixed Claude calling cloud sessions non-interactive and suggesting /mcp or claude mcp when an MCP server needs authentication
• Fixed /code-review ending on a raw JSON array in cloud sessions, the Agent SDK and IDE integrations; the findings now print as a numbered list
• Fixed auto mode occasionally refusing one update to your own artifact, saying its sharing had changed when it had not
• Fixed skills synced from claude.ai never finishing their install, and being downloaded again at every sync, when several sessions share a config directory
• Fixed a plugin synced from claude.ai being disabled when the marketplace dependency it declares was also synced from claude.ai
• Fixed a startup hang on macOS when plugin paths copied from a Linux machine pointed under /home
• Fixed the Workflow tool refusing script files with CRLF line endings, such as files checked out on Windows
• Fixed OpenTelemetry tool_result events missing git_commit_id after git commit -q or git -C <dir> commit
• Fixed CLAUDE_CODE_TRANSCRIPT_LOCAL_GC dropping a message from the saved transcript when its text held a Unicode line or paragraph separator (U+2028, U+2029)
• Fixed claude purge leaving a prompt in the history file when its text held a Unicode line or paragraph separator (U+2028, U+2029)
• Windows: Fixed PowerShell commands longer than about 1 KB always asking for permission, so allow rules and read-only detection now apply up to 32 KB

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

2.1.296

• Added a code key to the Claude apps gateway's managed.policies[]: the same settings as cli, also applied in Claude Desktop's Code tab; beside desktop, it turns on Claude Desktop's gateway mode
• Added autoCompactWindow to subagent frontmatter and --agents definitions, so a subagent can auto-compact earlier than the main conversation's window
• Added CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL to run every workflow agent on one model while other subagents keep theirs
• Added CLAUDE_CODE_OVERLOADED_RETRY_MAX_DELAY_MS environment variable to set a longer maximum delay for the backoff when retrying an overloaded (529) request
• Added a note in /plugin on a plugin whose hooks are left out because another enabled plugin has the same name
• Added an allow_large option to the Read tool so Claude can read a text file past the usual size limits in one call when it needs the whole file and the context has room
• Fixed managed-settings PreToolUse hooks that deny a tool call with "continue": false, and managed prompt hooks that block one, refusing the call but not ending the turn
• Fixed PostToolUse hooks in managed settings not applying updatedMCPToolOutput in some sessions
• Fixed headless sessions starting a folder's .mcp.json or plugin MCP server that was switched off for that folder, after changing directory or reloading plugins
• Fixed a Claude apps gateway that serves allowedProviders with "gateway" locking out laptops that name that gateway in user settings
• Fixed a saved Claude apps gateway sign-in being ignored on machines whose managed settings set forceLoginMethod to gateway with no forceLoginGatewayUrl (regression in 2.1.295)
• Fixed --teleport opening an empty conversation when the session's history could not be read
• Fixed token counts for Haiku 5.5 and other models that take only adaptive thinking, which failed behind some gateways and were counted with budget thinking elsewhere
• Fixed resumed subagents being told that the user rejected a tool call that a session shutdown had interrupted
• Fixed hook output being altered when it contained text resembling a plugin hint tag
• Fixed secret redaction in shared transcripts and debug logs missing some values that follow a key with no value, including in JSON written inside a shell string
• Fixed a stray 52;c;… escape sequence printed on screen after copying in older VTE-based terminals such as MATE Terminal
• Fixed toasts and notifications waiting unseen for as long as the /diff panel or dialog was open
• Fixed Esc or an interrupt during a UserPromptSubmit hook or a mod's prompt.submit hook ending headless sessions, clearing the typed prompt, or letting the unchecked prompt through
• Fixed SessionStart hooks of a plugin loaded after a headless session starts being skipped when a different plugin with the same name, or another spelling of it, had already run
• Fixed claude self-hosted-runner printing misleading errors when registration is refused: it now names the org admin setting, or says a restarted on-demand runner needs a fresh work order
• Fixed a self-hosted runner session's git fetch, pull and push failing while another session of the same repository starts on a runner with --capacity above 1
• Fixed workflow scripts silently truncating results, agent options and other values nested deeper than about 20,000 levels, and deeply nested results writing huge task output files
• Fixed a plugin's served $ methods running in the main session's working directory instead of the calling agent's, and ignoring the turn their calling hook holds
• Fixed $.agent.register succeeding from a mod's hook that was still running after the mod was reloaded or removed; the call is now refused
• Fixed $.http.fetch in mods refusing a HEAD request when the response declares a Content-Length over the 4 MiB body limit
• Fixed claude plugin marketplace add, marketplace update and plugin install failing with an internal error for a marketplace named like constructor; add now refuses such names clearly
• Fixed a plugin secret named constructor or prototype being deleted by the next save of that plugin's options
• Fixed cloud sessions skipping auto mode's checks on Claude in Chrome actions that a saved permission allows when their feature flags had not loaded
• Fixed CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-running a finished turn after a restart when an MCP tool result had ended that turn
• Fixed Bash permission checks auto-approving some commands that assign the BASH_ARGV0 shell variable and then use it; these now prompt for approval
• Fixed Edit and NotebookEdit replacing every non-ASCII character in files that are not valid UTF-8 (Windows-1252, Shift-JIS, GBK); such edits are now refused
• Fixed a prompt sent just after ← being run twice, once unseen in the foreground, when the background service was slow to answer
• Fixed a prompt sent while SessionStart hooks were still running vanishing when ← moved the session to the background; it is still not sent, but ↑ now brings it back
• Fixed a late-loading plugin's SessionStart hook output reaching the new conversation after /clear in headless sessions
• Fixed PowerShell commands not seeing variables that hooks write to CLAUDE_ENV_FILE (when the file holds only plain assignments)
• Fixed Claude calling cloud sessions non-interactive and suggesting /mcp or claude mcp when an MCP server needs authentication
• Fixed /code-review ending on a raw JSON array in cloud sessions, the Agent SDK and IDE integrations; the findings now print as a numbered list
• Fixed auto mode occasionally refusing one update to your own artifact, saying its sharing had changed when it had not
• Fixed skills synced from claude.ai never finishing their install, and being downloaded again at every sync, when several sessions share a config directory
• Fixed a plugin synced from claude.ai being disabled when the marketplace dependency it declares was also synced from claude.ai
• Fixed a startup hang on macOS when plugin paths copied from a Linux machine pointed under /home
• Fixed the Workflow tool refusing script files with CRLF line endings, such as files checked out on Windows
• Fixed OpenTelemetry tool_result events missing git_commit_id after git commit -q or git -C <dir> commit
• Fixed CLAUDE_CODE_TRANSCRIPT_LOCAL_GC dropping a message from the saved transcript when its text held a Unicode line or paragraph separator (U+2028, U+2029)
• Fixed claude purge leaving a prompt in the history file when its text held a Unicode line or paragraph separator (U+2028, U+2029)
• Windows: Fixed PowerShell commands longer than about 1 KB always asking for permission, so allow rules and read-only detection now apply up to 32 KB
• Windows: Fixed stdio MCP servers being force-killed at shutdown; stdin now closes first and the process tree is killed only if the server is still running after 300 ms

... (truncated)

Commits

• 2301018 chore: Update CHANGELOG.md and feed.xml
• 3f349d4 Merge pull request #100293 from anthropics/sarahdeaton/managed-settings-hipaa...
• e47cc82 chore: Update mods/
• 602df92 chore: Update CHANGELOG.md and feed.xml
• 9196319 Move the HIPAA example into examples/settings
• 71cddde chore: Update CHANGELOG.md and feed.xml
• e32908d Add HIPAA managed-settings example (hipaa-baseline.json, managed-mcp lockdown...
• 79babc3 chore: Update CHANGELOG.md and feed.xml
• 09651d3 chore: Update mods/
• 765f236 diff: the docked pane starts at its header, under the engine's own head row (...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/claude-code since your current version.

Updates @node-rs/argon2 from 2.2.1 to 2.2.2

Commits

• b706e30 chore(release): publish
• d907346 chore(deps): update dependency @​napi-rs/cli to ^3.10.8
• 22926d9 chore(deps): update dependency oxfmt to ^0.72.0 (#1221)
• fe73c75 feat!: redesign bcrypt API while preserving stored hash verification (#1207)
• 9814527 chore(deps): lock file maintenance (#1220)
• c6632df chore(deps): update rust to v1.99.0 (#1219)
• c1d8de4 chore(deps): lock file maintenance (#1215)
• c118471 chore(deps): update dependency oxfmt to ^0.71.0 (#1218)
• c14dee2 chore(deps): update yarn to v4.18.1 (#1217)
• 84d621a chore(deps): update dependency oxfmt to ^0.70.0 (#1216)
• Additional commits viewable in compare view

Updates drizzle-orm from 0.45.3 to 0.45.4

Release notes

Sourced from drizzle-orm's releases.

0.45.4

• Fixed postgres-js not using prepared queries on explicit .prepare(name)

Commits

• eab8bed Fixed postgres-js not using prepared queries on explicit .prepare(name) (...
• See full diff in compare view

Updates @playwright/test from 1.63.0 to 1.64.0

Release notes

Sourced from @​playwright/test's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits

• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
• 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
• 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
• 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
• dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
• Additional commits viewable in compare view

Updates playwright from 1.63.0 to 1.64.0

Release notes

Sourced from playwright's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits

• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
• 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
• 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
• 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
• dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
• Additional commits viewable in compare view

Updates postcss from 8.5.28 to 8.5.29

Release notes

Sourced from postcss's releases.

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Changelog

Sourced from postcss's changelog.

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Commits

• a7a1f34 Release 8.5.29 version
• b55a36d Update dependencies
• 7647a81 Escape </style> in output of non-Root nodes (#2163)
• 7ac9026 Do not split list.comma() and list.space() on separators inside comments (#2162)
• ebffa97 Add postcss-smooth-corners plugin
• 57d6401 Speed up source map cleaning
• 7e46a03 Speed up parser
• 7f5c417 Improve </style> protection for the case when beffore nodes have different parts
• 7ba9051 Fix useless ESLint warning
• 12b4161 Update dependencies
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: rheos/coderabbit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6fca356c-0a25-46d5-ae32-2c9c60c004be

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.