chore(deps): bump the playwright group across 1 directory with 14 updates

[dependabot]

Bumps the playwright group with 7 updates in the /e2e directory:

Package	From	To
@playwright/test	1.59.1	1.62.1
@types/node	26.1.1	26.1.2
mysql2	3.20.0	3.23.2
pg	8.20.0	8.22.0
@types/pg	8.20.0	8.20.4
tar	7.5.19	7.5.22
iconv-lite	0.7.2	0.7.3

Updates @playwright/test from 1.59.1 to 1.62.1

Release notes

Sourced from @​playwright/test's releases.

v1.62.1

Bug Fixes

• #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });
</tr></table>

... (truncated)

Commits

• 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
• 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
• 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
• 66c5cc9 chore: mark v1.62.1 (#42020)
• 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
• 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
• 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• Additional commits viewable in compare view

Updates @types/node from 26.1.1 to 26.1.2

Commits

• See full diff in compare view

Updates mysql2 from 3.20.0 to 3.23.2

Release notes

Sourced from mysql2's releases.

v3.23.2

3.23.2 (2026-07-27)

Bug Fixes

• correct connectAttributes typo in ChangeUser packet (#4423) (f64ce07), closes #2140
• don't leave a failed execute as the active command (#4425) (fbd64b6)

v3.23.1

3.23.1 (2026-07-19)

Bug Fixes

• security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
• parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

v3.23.0

3.23.0 (2026-07-13)

Features

• return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
• sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
• support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

v3.22.6

3.22.6 (2026-07-07)

Bug Fixes

• sql-escaper: resolve multi statement and expand object regressions (#4380) (1b927a9)

v3.22.5

3.22.5 (2026-06-06)

Bug Fixes

• keep 00:00:00 time for TIMESTAMP in binary protocol with dateStrings (#4327) (2af33a1)

v3.22.4

3.22.4 (2026-05-24)

Bug Fixes

... (truncated)

Changelog

Sourced from mysql2's changelog.

3.23.2 (2026-07-27)

Bug Fixes

• correct connectAttributes typo in ChangeUser packet (#4423) (f64ce07), closes #2140
• don't leave a failed execute as the active command (#4425) (fbd64b6)

3.23.1 (2026-07-19)

Bug Fixes

• security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
• parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

3.23.0 (2026-07-13)

Features

• return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
• sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
• support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

3.22.6 (2026-07-07)

Bug Fixes

• sql-escaper: resolve multi statement and expand object regressions (#4380) (1b927a9)

3.22.5 (2026-06-06)

Bug Fixes

• keep 00:00:00 time for TIMESTAMP in binary protocol with dateStrings (#4327) (2af33a1)

3.22.4 (2026-05-26)

Bug Fixes

• pool: reject queued requests on end (#4291) (fbff09c)

3.22.3 (2026-04-24)

Bug Fixes

... (truncated)

Commits

• a987302 chore(master): release 3.23.2 (#4424)
• 6c0cbc6 build(deps): bump postcss from 8.5.15 to 8.5.23 in /website (#4437)
• 2aec892 build(deps): bump lucide-react from 1.26.0 to 1.27.0 in /website (#4436)
• 4f7a589 build(deps): bump sass from 1.101.7 to 1.102.0 in /website (#4435)
• 992adc5 build(deps): bump lucide-react from 1.25.0 to 1.26.0 in /website (#4431)
• 26c956b build(deps): bump sass from 1.101.6 to 1.101.7 in /website (#4432)
• e6a1cf7 build(deps): bump sass from 1.101.3 to 1.101.6 in /website (#4427)
• 3f240ce build(deps): bump fast-uri from 3.1.2 to 3.1.4 in /website (#4422)
• 28ad315 build(deps): bump immutable from 5.1.5 to 5.1.9 in /website (#4421)
• 67821f8 build(deps): bump svgo from 3.3.3 to 3.3.4 in /website (#4420)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mysql2 since your current version.

Updates pg from 8.20.0 to 8.22.0

Changelog

Sourced from pg's changelog.

pg@8.22.0

• Add support for sslnegotiation=direct for PostgreSQL 17+.

pg@8.21.0

• Handle SASL SCRAM server error responses properly.
• Add support for node@26.
• Add scramMaxIterations config option.
• Add client.getTransactionStatus() method.

Commits

• b617619 Publish
• d80b261 Update docs & changelog
• 835fb83 Fix error handling for exceptions on values parsing. (#3574)
• f49ab4a fix: correct spelling mistakes across codebase (#3692)
• d7175a4 Expand CI matrix of PG versions and add direct SSL test (#3693)
• 882fc30 Add support for sslnegotiation=direct (PostgreSQL 17) (#3688)
• 544b1ce Publish
• cc03fa5 Add scramMaxIterations option to limit SCRAM iteration count (#3677)
• f776327 Remove compatibility code for unsupported versions of Node (<16) (#3678)
• f252870 cleanup: pg utils (#3675)
• Additional commits viewable in compare view

Updates @types/pg from 8.20.0 to 8.20.4

Commits

• See full diff in compare view

Updates tar from 7.5.19 to 7.5.22

Commits

• 2a22bfc 7.5.22
• df1cd8d Allow transform to be falsey
• 0cd9cc3 7.5.21
• 631ae59 list: prevent unbounded recursion
• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• See full diff in compare view

Updates iconv-lite from 0.7.2 to 0.7.3

Release notes

Sourced from iconv-lite's releases.

0.7.3

🚀 Improvements

• Add iso-8859-8-i and iso-8859-8-e charset aliases - by @​baptistejamin in #394

🐞 Bug fixes

• Fix UTF-32 streaming across chunk boundaries - by @​spokodev and @​bjohansebas in #393

  When decoding a UTF-32 stream, a 4-byte code unit split across a chunk boundary was decoded incorrectly, and a truncated trailing unit is now replaced with U+FFFD instead of being dropped. When encoding, a surrogate held over between chunks no longer throws. Whole-buffer decode/encode were unaffected.

New Contributors

• @​baptistejamin made their first contribution in pillarjs/iconv-lite#394
• @​spokodev made their first contribution in pillarjs/iconv-lite#393

Full Changelog: pillarjs/iconv-lite@v0.7.2...v0.7.3

Changelog

Sourced from iconv-lite's changelog.

0.7.3

🚀 Improvements

• Add iso-8859-8-i and iso-8859-8-e charset aliases - by @​baptistejamin in #394

🐞 Bug fixes

• Fix UTF-32 streaming across chunk boundaries - by @​spokodev and @​bjohansebas in #393

  When decoding a UTF-32 stream, a 4-byte code unit split across a chunk boundary was decoded incorrectly, and a truncated trailing unit is now replaced with U+FFFD instead of being dropped. When encoding, a surrogate held over between chunks no longer throws. Whole-buffer decode/encode were unaffected.

Commits

• 43694e2 release: 0.7.3 (#411)
• 11e96b5 fix(utf32): reassemble split codepoint from overflow buffer, not source index...
• b52b9d3 feat: support iso-8859-8-i and iso-8859-8-e charset labels (#394)
• 2bfa5ab ci: fix workflow configuration for v0.x branch (#404)
• See full diff in compare view

Updates pg-cloudflare from 1.3.0 to 1.4.0

Changelog

Sourced from pg-cloudflare's changelog.

All major and minor releases are briefly explained below.

For richer information consult the commit log on github with referenced pull requests.

We do not include break-fix version release in this file.

pg@8.23.0

• Add support for query pipelineing.

pg@8.22.0

• Add support for sslnegotiation=direct for PostgreSQL 17+.

pg@8.21.0

• Handle SASL SCRAM server error responses properly.
• Add support for node@26.
• Add scramMaxIterations config option.
• Add client.getTransactionStatus() method.

pg@8.20.0

• Add onConnect callback to pg.Pool constructor options allowing for async initialization of newly created & connected pooled clients.

pg@8.19.0

• Deprecate interal query queue.
• Pass connection parameters to password callback.

pg@8.18.0

• Return the client instance as the result of calling connect (previously it was void).

pg@8.17.0

• Throw correct error if database URL parsing fails.

pg@8.16.0

• Add support for min connection pool size.

pg@8.15.0

• Add support for esm importing. CommonJS importing is still also supported.

pg@8.14.0

• Add support for SCRAM-SHA-256-PLUS, i.e. channel binding.

... (truncated)

Commits

• 544b1ce Publish
• 02367b8 Upgrade eslint and typescript (#3662)
• c78b302 Cleanup tests (#3640)
• See full diff in compare view

Updates pg-connection-string from 2.12.0 to 2.14.0

Commits

• b617619 Publish
• f49ab4a fix: correct spelling mistakes across codebase (#3692)
• 882fc30 Add support for sslnegotiation=direct (PostgreSQL 17) (#3688)
• 544b1ce Publish
• 7674d8c Fix pg prototype pollution via server supplied column names (#3656)
• 02367b8 Upgrade eslint and typescript (#3662)
• See full diff in compare view

Updates pg-pool from 3.13.0 to 3.14.0

Commits

• 544b1ce Publish
• 3bb9fba Add error handling for non-function callback (#3561)
• See full diff in compare view

Updates pg-protocol from 1.13.0 to 1.16.0

Commits

• df274d1 Publish
• 1be86af fix(pg-protocol): read ParameterDescription type OIDs as unsigned (#3728)
• 1a38e1d Remove unused “chunky” dev dependency and associated leftovers (#3697)
• b617619 Publish
• 835fb83 Fix error handling for exceptions on values parsing. (#3574)
• 695fe61 Stop cstring reading on any falsy value (#3691)
• f49ab4a fix: correct spelling mistakes across codebase (#3692)
• c4dfbba perf(pg-protocol): encode length-prefixed strings in a single pass (#3681)
• 544b1ce Publish
• 02367b8 Upgrade eslint and typescript (#3662)
• See full diff in compare view

Updates playwright from 1.59.1 to 1.62.1

Release notes

Sourced from playwright's releases.

v1.62.1

Bug Fixes

• #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });
</tr></table>

... (truncated)

Commits

• 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
• 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
• 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
• 66c5cc9 chore: mark v1.62.1 (#42020)
• 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
• 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
• 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• Additional commits viewable in compare view

Updates playwright-core from 1.59.1 to 1.62.1

Release notes

Sourced from playwright-core's releases.

v1.62.1

Bug Fixes

• #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });
</tr></table>

... (truncated)

Commits

• 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
• 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
• 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
• 66c5cc9 chore: mark v1.62.1 (#42020)
• 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
• 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
• 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• Additional commits viewable in compare view

Updates sql-escaper from 1.3.3 to 1.5.1

Release notes

Sourced from sql-escaper's releases.

v1.5.1

1.5.1 (2026-07-12)

Bug Fixes

• make TemporalValue self-contained (#49) (f655fe1)

v1.5.0

1.5.0 (2026-07-12)

Features

• add Temporal support to escape (#42) (5ea3a69)

v1.4.0

1.4.0 (2026-07-07)

Features

• add Set and Map support to ? placeholder expansion (#27) (a1dc888)

Bug Fixes

• expand SET ? in multi-statement queries (#34) (4638497)
• extend SQL parsing to expand objects across SET assignment lists (#37) (adaf338)
• substitute placeholders near non-comment -- and executable comments (#31) (bcc11a2)

Performance Improvements

• scan SET clauses per-token instead of per-char (#38) (f953b9c)

Changelog

Sourced from sql-escaper's changelog.

1.5.1 (2026-07-12)

Bug Fixes

• make TemporalValue self-contained (#49) (f655fe1)

1.5.0 (2026-07-12)

Features

• add Temporal support to escape (#42) (5ea3a69)

1.4.0 (2026-07-07)

Features

• add Set and Map support to ? placeholder expansion (#27) (a1dc888)

Bug Fixes

• expand SET ? in multi-statement queries (#34) (4638497)
• extend SQL parsing to expand objects across SET assignment lists (#37) (adaf338)
• substitute placeholders near non-comment -- and executable comments (#31) (bcc11a2)

Performance Improvements

• scan SET clauses per-token instead of per-char (#38) (f953b9c)

Commits

• 72fbc98 chore(main): release 1.5.1 (#50)
• f655fe1 fix: make TemporalValue self-contained (#49)
• 479d3a5 chore: update dependencies (#48)
• 4012714 chore(main): release 1.5.0 (#45)
• a1a5d55 chore: upgrade Lagune.ai (#47)
• 15a8696 chore: upgrade TypeScript (#46)
• 5ea3a69 feat: add Temporal support to escape (#42)
• 58a69f1 chore: update TypeScript to 6.0.3 (#44)
• bda3792 chore(main): release 1.4.0 (#32)
• f2830c0 docs: encourage secure approaches (#41)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions