chore(deps): bump the production group with 3 updates

[dependabot]

Bumps the production group with 3 updates: @anthropic-ai/sdk, undici and playwright.

Updates @anthropic-ai/sdk from 0.113.0 to 0.115.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.115.0

0.115.0 (2026-07-24)

Full Changelog: sdk-v0.114.0...sdk-v0.115.0

Features

• api: add claude-opus-5 model (cdd3606)
• api: add tool addition/removal blocks and tool_change events (cdd3606)
• api: expand client-side fallback credit token types and add server-side fallbacks default option (cdd3606)

Bug Fixes

• client: release abort listeners when requests settle (#1129) (b85e902)

sdk: v0.114.0

0.114.0 (2026-07-23)

Full Changelog: sdk-v0.113.0...sdk-v0.114.0

Features

• api: add new stop reason 'model_context_window_exceeded' (1ec71c1)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.115.0 (2026-07-24)

Full Changelog: sdk-v0.114.0...sdk-v0.115.0

Features

• api: add claude-opus-5 model (cdd3606)
• api: add tool addition/removal blocks and tool_change events (cdd3606)
• api: expand client-side fallback credit token types and add server-side fallbacks default option (cdd3606)

Bug Fixes

• client: release abort listeners when requests settle (#1129) (b85e902)

0.114.0 (2026-07-23)

Full Changelog: sdk-v0.113.0...sdk-v0.114.0

Features

• api: add new stop reason 'model_context_window_exceeded' (1ec71c1)

Commits

• 3b45cd3 chore: release main
• f298e9a feat(api): add claude-opus-5 model
• ce8e54b fix(client): release abort listeners when requests settle (#1129)
• 2d314b4 chore: release main
• 3d051df feat(api): add new stop reason 'model_context_window_exceeded'
• See full diff in compare view

Updates undici from 7.28.0 to 7.29.0

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

Commits

• 9e38fc1 Bumped v7.29.0 (#5590)
• d887e34 fix: validate coerced header values for CRLF (#5579)
• 33928bc fix: validate blob body content type
• 98011a8 fix(cache): harden cache directive parsing
• 4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
• 1b5a531 fix(retry): reject partial content length mismatch
• 466e99d test: cover crash on mixed unqualified and qualified private cache directives
• 9f10f1e fix: handle empty qualified private cache directive
• 3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
• See full diff in compare view

Updates playwright from 1.61.1 to 1.62.0

Release notes

Sourced from playwright's releases.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

</tr></table> 

... (truncated)

Commits

• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• 2934858 fix: correct pending navigation log spacing (#41949)
• 4b0cc99 fix(test): unflake screencast backpressure test on slow macOS runner (#41951)
• bbbae6d test: fixme WebSocket locale test in Chromium 150 (#41944)
• 15c4f55 fix(mcp): identify downloads explicitly (#41933)
• f5fa967 fix(network): request.postData() returns null for empty string body override ...
• 0edafe4 fix(mcp): launch the Chrome profile that has the extension installed (#41939)
• 244a1ff feat(firefox): roll to r1538 (#41938)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions