[dependabot]

Bumps the playbook-node group with 9 updates in the /playbook/node directory:

Package	From	To
@ai-sdk/anthropic	4.0.79	4.0.91
@browserbasehq/sdk	2.21.0	2.23.0
@browserbasehq/stagehand	4.2.1	4.3.0
boxen	8.0.1	9.0.0
chalk	5.6.2	6.0.1
dotenv	16.6.1	18.0.9
zod	4.4.3	4.6.7
ai	7.0.139	7.0.156
playwright-core	1.64.0	1.64.1

Updates @ai-sdk/anthropic from 4.0.79 to 4.0.91

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

4.0.91

Patch Changes

• 50da4c5: Fix workflow serialization of Anthropic models using API keys or synchronous auth tokens while preserving support for asynchronous token providers.

4.0.90

Patch Changes

• 63bf860: Support synchronous and asynchronous authToken providers so applications can use refreshable credentials, including Anthropic workload identity federation helpers for inference. Resolve tokens before each request while preserving existing authentication headers and beta-header behavior.
• Updated dependencies [57086ff]
• Updated dependencies [95348b3]
  • @​ai-sdk/provider-utils@​5.0.70

4.0.89

Patch Changes

• Updated dependencies [e64ed82]
  • @​ai-sdk/provider-utils@​5.0.69

4.0.88

Patch Changes

• e729d58: chore(docs): update README.md for consistent format and to avoid duplication
• Updated dependencies [5475347]
• Updated dependencies [e729d58]
  • @​ai-sdk/provider@​4.0.34
  • @​ai-sdk/provider-utils@​5.0.68

4.0.87

Patch Changes

• Updated dependencies [8202f5b]
• Updated dependencies [85d84a1]
  • @​ai-sdk/provider-utils@​5.0.67
  • @​ai-sdk/provider@​4.0.33

4.0.86

Patch Changes

• 43ad966: Report interrupted when a stream ends cleanly without its provider completion signal, preserving partial output without emitting an error solely for the interruption.

  This applies to OpenAI (Chat, Responses, and Completions), Anthropic, Google (Generate Content and Interactions), Alibaba, Amazon Bedrock Converse, Cohere, DeepSeek, Groq, Hugging Face Responses, Mistral Chat, Moonshot AI, Open Responses, Perplexity, and xAI Responses. It also covers cutoffs in later Anthropic messages and Google automatic continuations.

  Compatibility notice: These streams previously fell back to other or omitted the finish part. Applications must now handle interrupted in finish-reason switches, mappings, and custom validation. Check finishReason === 'interrupted' to detect incomplete responses; interruption alone does not trigger error handling.

... (truncated)

Commits

• a5db0af Version Packages (#24143)
• 50da4c5 fix(anthropic): preserve workflow serialization for synchronous credentials (...
• 1f3cdbb Version Packages (#24084)
• 95348b3 feat(provider-utils): change Experimental_SandboxSession's spawn() method...
• 63bf860 feat(anthropic): support refreshable auth tokens (#24096)
• e197b50 Version Packages (#23955)
• 612be23 Version Packages (#23938)
• e729d58 chore(docs): update README.md for consistent format and to avoid duplicatio...
• 594495a Version Packages (#23857)
• 401cadc Version Packages (#23785)
• Additional commits viewable in compare view

Updates @browserbasehq/sdk from 2.21.0 to 2.23.0

Release notes

Sourced from @​browserbasehq/sdk's releases.

v2.23.0

2.23.0 (2026-10-26)

Features

• add contextId to fetch and Exa deep search modes (257c819)

v2.22.0

2.22.0 (2026-10-14)

Features

• add search provider and mode options (99e788c)

Bug Fixes

• preserve required search parameters in SDKs (56022b3)

Changelog

Sourced from @​browserbasehq/sdk's changelog.

2.23.0 (2026-10-26)

Features

• add contextId to fetch and Exa deep search modes (257c819)

2.22.0 (2026-10-14)

Features

• add search provider and mode options (99e788c)

Bug Fixes

• preserve required search parameters in SDKs (56022b3)

Commits

• 847f582 release: 2.23.0 (#223)
• 257c819 feat: add contextId to fetch and Exa deep search modes
• 1c0fe8d release: 2.22.0 (#222)
• 56022b3 fix: preserve required search parameters in SDKs
• 99e788c feat: add search provider and mode options
• f8cf0dd Build SDK
• dcd71d0 Build SDK
• See full diff in compare view

Updates @browserbasehq/stagehand from 4.2.1 to 4.3.0

Changelog

Sourced from @​browserbasehq/stagehand's changelog.

TypeScript SDK 4.3.0

Minor Changes

• #3267 cb9a1d1 Thanks @​seanmcguire12! - add extension archive getter

• #3253 6bf4146 Thanks @​seanmcguire12! - add optional extensionCdpUrl to localBrowser.connect to allow configuring the in-browser CDP url

• #3263 ecb2a6b Thanks @​seanmcguire12! - add headers to localBrowser.connect so CDP gateways can be authenticated without credentials in the URL

• #3183 901eb27 Thanks @​supremeboxlogos! - Add page.waitForFunction() to wait until a predicate in the page returns a truthy value.

Patch Changes

• #3229 c6b6f27 Thanks @​seanmcguire12! - skip caching for request bodies larger than 25 MB.

• #3198 10418f9 Thanks @​seanmcguire12! - enable WebMCP by default for local chromium versions newer than 157

• #3210 1c40ba7 Thanks @​seanmcguire12! - Require client transport for Browserbase Model Gateway and cache requests.

• #3209 17de6ea Thanks @​seanmcguire12! - Route Browserbase Model Gateway and cache requests through the connected SDK.

Python SDK 4.3.0

Minor Changes

• #3260 2859fd5 Thanks @​seanmcguire12! - add headers to local_browser.connect so CDP gateways can be authenticated without credentials in the URL

• #3267 cb9a1d1 Thanks @​seanmcguire12! - add extension archive getter

• #3252 21e0363 Thanks @​seanmcguire12! - add extension_cdp_url to local_browser.connect for clients that reach Chrome through a proxy the extension cannot use

• #3183 901eb27 Thanks @​supremeboxlogos! - Add page.wait_for_function() to wait until a predicate in the page returns a truthy value.

Patch Changes

• #3229 c6b6f27 Thanks @​seanmcguire12! - skip caching for request bodies larger than 25 MB.

• #3198 10418f9 Thanks @​seanmcguire12! - enable WebMCP by default for local chromium versions newer than 157

• #3210 1c40ba7 Thanks @​seanmcguire12! - Require client transport for Browserbase Model Gateway and cache requests.

• #3209 17de6ea Thanks @​seanmcguire12! - Route Browserbase Model Gateway and cache requests through the connected SDK.

Extension Runtime 1.2.0

Minor Changes

• #3208 4a7c637 Thanks @​seanmcguire12! - Support routing Browserbase Model Gateway and cache requests through the connected SDK.

... (truncated)

Commits

• 621c120 Release Stagehand packages (#3200)
• cb9a1d1 [feat]: add extension archive getter (#3267)
• 901eb27 feat: expose browser-side function waits across Stagehand SDKs (#3183)
• ecb2a6b [feat]: expose headers param on localBrowser.connect() (#3263)
• 6bf4146 [feat]: expose optional extensionCdpUrl param on localBrowser.connect() i...
• c6b6f27 [fix]: align bb transport behaviour across SDKs (#3229)
• 1c40ba7 [refactor]: remove worker-side HTTP request path (#3210)
• 17de6ea [feat]: route gateway & cache requests through the SDKs (#3209)
• 0735164 [feat]: add HTTP transport to TS SDK (#3205)
• 2b050db [feat]: define RPC contract for client side requests (#3204)
• Additional commits viewable in compare view

Updates boxen from 8.0.1 to 9.0.0

Release notes

Sourced from boxen's releases.

v9.0.0

Breaking

• Require Node.js 22 0aead27

Improvements

• Add maxWidth option 5932ef4
• Add footer option e719cec
• Add titleColor option c0f18e7
• Add borderBackgroundColor option (#100) 1373d4f
• Lots of bug fixes

---

sindresorhus/boxen@v8.0.1...v9.0.0

Commits

• a809729 9.0.0
• 2e901c1 Measure a label with the corners it is drawn between
• 6d377fb More tests
• 427ac21 Give the box the height it is given when the text does not fit
• 94db7a5 Write a border character the way a label is written
• 804e1e7 Keep a styling escape whole when a backspace is applied
• 9f8fabd Draw a padding and a margin as a whole number of columns
• 986a49b Do not take columns for a margin that is not drawn
• 2bc26cd Measure the border in columns
• 7ed8da2 Read the height of the terminal from LINES
• Additional commits viewable in compare view

Updates chalk from 5.6.2 to 6.0.1

Release notes

Sourced from chalk's releases.

v6.0.1

• Fix inconsistent coercion of two arguments 9c93a04

---

chalk/chalk@v6.0.0...v6.0.1

v6.0.0

Breaking

• Require Node.js 22 8a94e0e

Improvements

• Add underline styles and underline colors (#689) 4c304dd
• Improve performance 5729845 fa5cff2

Fixes

• Treat a numeric FORCE_COLOR as an exact level (#688) e912931
• Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687) ff549c5

---

chalk/chalk@v5.6.2...v6.0.0

Commits

• 47fc05a 6.0.1
• 9c93a04 Fix inconsistent coercion of two arguments
• 8960ada Meta tweaks
• 661317e 6.0.0
• 5729845 Improve performance
• 4c304dd Add extended underline styles and underline colors (#689)
• e912931 Fix: Treat a numeric FORCE_COLOR as an exact level (#688)
• 8a94e0e Require Node.js 22
• fa5cff2 Optimize 2-argument calls (#670)
• ff549c5 Fix: Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687)
• Additional commits viewable in compare view

Updates dotenv from 16.6.1 to 18.0.9

Changelog

Sourced from dotenv's changelog.

18.0.9 (2026-10-14)

Changed

• Permit DOTENV_PATH being empty string with the CLI (#1076)

18.0.8 (2026-10-14)

Changed

• Fast parser should strip appended extra quotes (#1073)
• Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

• Treat undefined settings like quiet: true as null rather than falsey (#1070)
• CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

• Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

• Fix missing typescript module declaration (#1068)
• Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

• import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

• Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

• Patch additional edge cases for the fast parser (#1056)

... (truncated)

Commits

• 8d1ab85 18.0.9
• 59a40ce changelog
• 88228bd Merge pull request #1076 from Enesuygurs/fix/cli-empty-dotenv-path
• bc6ef94 fix(cli): load the default .env when DOTENV_PATH is empty
• 6d6e6c5 Merge pull request #1075 from kory-kaai/test/fast-parser-branch-coverage
• 10218f1 test(parse-fast): cover the size-dependent and export-prefix branches
• e2fe95e 18.0.8
• 7aa712a type detail improvement
• 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
• 0b4843a changelog
• Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

• b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

• 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
• 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
• 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
• 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
• b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
• 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
• bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
• c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
• 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

... (truncated)

Commits

• b500a2e 4.6.7
• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (#6622)
• Additional commits viewable in compare view

Updates ai from 7.0.139 to 7.0.156

Changelog

Sourced from ai's changelog.

7.0.156

Patch Changes

• Updated dependencies [9f19c79]
  • @​ai-sdk/gateway@​4.0.129

7.0.155

Patch Changes

• b6b9dca: chore(ai): remove runtime validation of inputs that TypeScript types already guarantee

  streamText, generateText, generateObject and streamObject no longer validate messages against the ModelMessage schema. This removes a cost that grew linearly with message history and was paid on every streamText step. Type checks on call settings, steering messages, tool caller configuration, smoothStream chunking, experimental_streamSpeech text input, the shape of decide state and questions, and the batch reference version have also been removed. Value constraints that types cannot express, such as integer ranges, non-empty collections, unknown keys, and non-finite numbers or cycles in decide JSON input, are still validated.

• Updated dependencies [57086ff]

• Updated dependencies [01d7a03]

• Updated dependencies [95348b3]

  • @​ai-sdk/provider-utils@​5.0.70
  • @​ai-sdk/gateway@​4.0.128

7.0.154

Patch Changes

• 47236dd: add onStepError callback to generateText, streamText, ToolLoopAgent and telemetry integrations, and onError and onAbort to ToolLoopAgent
• c8e8866: Add aiVersion to telemetry events so tracing-channel subscribers and telemetry integrations can identify the emitting ai package version, including in bundled applications and applications with multiple SDK versions.
• 1cf95c6: add experimental steering to generateText, streamText and ToolLoopAgent
• Updated dependencies [e64ed82]
  • @​ai-sdk/provider-utils@​5.0.69
  • @​ai-sdk/gateway@​4.0.127

7.0.153

Patch Changes

• 5475347: Fix non-streaming Responses API structured output failing when multiple assistant messages contain JSON. Providers can supply separate structured-output text for parsing, allowing OpenAI and Azure Responses models to select the last final_answer while preserving all generated content, annotations, conversation history, and token usage.
• Updated dependencies [5475347]
• Updated dependencies [e729d58]
  • @​ai-sdk/provider@​4.0.34
  • @​ai-sdk/provider-utils@​5.0.68
  • @​ai-sdk/gateway@​4.0.126

7.0.152

Patch Changes

• Updated dependencies [a706678]
  • @​ai-sdk/gateway@​4.0.125

... (truncated)

Commits

• a5db0af Version Packages (#24143)
• 1f3cdbb Version Packages (#24084)
• 95348b3 feat(provider-utils): change Experimental_SandboxSession's spawn() method...
• b6b9dca chore(ai): remove redundant runtime type validation (#24095)
• e197b50 Version Packages (#23955)
• 1cf95c6 feat(ai): add experimental steering to generateText, streamText and ToolLoopA...
• 47236dd feat(ai): add onStepError callback to generateText, streamText and ToolLoopAg...
• c8e8866 feat(ai): add aiVersion to telemetry tracing channel events (#23958)
• 612be23 Version Packages (#23938)
• 5475347 fix(openai): parse the last final answer for non-streaming structured output ...
• Additional commits viewable in compare view

Updates playwright-core from 1.64.0 to 1.64.1

Release notes

Sourced from playwright-core's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​playwright-core@​1.64.1
	npm/​boxen@​9.0.0
	npm/​@​ai-sdk/​anthropic@​4.0.91
	npm/​@​browserbasehq/​sdk@​2.23.0
	npm/​ai@​7.0.156

View full report