[dependabot]

Bumps the python-dependencies group with 7 updates:

Package	From	To
playwright	1.63.0	1.64.0
qc-core	0.0.4	0.0.5
ruff	0.17.0	0.17.1
pre-commit	4.6.2	4.7.0
poethepoet	0.48.0	0.49.0
hypothesis	6.169.0	6.170.1
zizmor	1.30.1	1.31.1

Updates playwright from 1.63.0 to 1.64.0

Release notes

Sourced from playwright's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

browser = chromium.launch(args=["--enable-features=WebMCP"])
page = browser.new_page()
page.goto("https://example.com")
for tool in page.webmcp.tools():
print(tool["name"], tool["description"])
result = page.webmcp.call_tool("add", {"a": 2, "b": 40})
print(result["content"][0]["text"])  # "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

page.screencast.start(path="video.webm", size={"width": 1920, "height": 1080}, fps=60)
page.screencast.show_actions(
    style={
        "point": "width: 20px; height: 20px; border-radius: 50%; background: red",
        "highlight": "outline: 2px solid [#333](https://github.com/microsoft/playwright-python/issues/333); background: rgba(0, 128, 255, .15)",
        "title": "font-size: 16px",
    }
)

• New record_video_fps option and new fps option in screencast.start(). Firefox and WebKit currently capture up to 25 frames per second.
• New style option takes CSS declarations for the point marker, the target highlight and the action title. It replaces the font_size option, which is now deprecated.
• The cursor stays visible at the last action point, survives navigations and travels along a natural, eased path.
• Videos are encoded with VP9 instead of VP8, which takes less CPU and produces smaller files of the same or better quality.

... (truncated)

Commits

• 387a8a9 cherry-pick(#3252): devops: publish to PyPI from GitHub Actions with trusted ...
• 71d2a17 chore: roll Playwright to v1.64.0 (#3251)
• d566fc5 fix(fetch): JSON-stringify NaN and Infinity string data (#3249)
• 2959d19 docs(skills): add a skill to prepare a release (#3250)
• 5313ac2 fix(network): keep blank values in Request.post_data_json for form bodies (#3...
• 9d8c50f chore(codegen): use alphabetical order in the generated API (#3242)
• 478282f chore(codegen): generate the public TypedDicts from the docs (#3247)
• b8b7155 fix: raise Error instead of assert for user input validation (#3245)
• 1de5d37 fix(network): do not add missing headers when looking them up (#3246)
• 222a2e0 chore(codegen): type _impl_obj in the generated API (#3241)
• Additional commits viewable in compare view

Updates qc-core from 0.0.4 to 0.0.5

Updates ruff from 0.17.0 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Commits

• 4683270 Bump version to 0.17.1 (#29420)
• 3514027 [ty] Update typing conformance suite pin (#29417)
• 8294556 Update referenced PR security-review workflow (#29237)
• d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
• 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
• 83a3afc Fix dedent with multiple leading comments (#29382)
• b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
• d01678e [ty] Clarify object attribute write-contract rationale (#29384)
• 355b42a [ty] Avoid writable override contracts from object (#29373)
• e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
• Additional commits viewable in compare view

Updates pre-commit from 4.6.2 to 4.7.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.7.0

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Changelog

Sourced from pre-commit's changelog.

4.7.0 - 2026-10-12

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Commits

• 65bb884 v4.7.0
• 73926c1 Merge pull request #3774 from cbirkhold/node-no-git-env-npm-install
• 860d07d don't leak GIT_* env into npm install for language: node
• 9ad8a0a Merge pull request #3775 from pre-commit/contextlib-chdir
• 9905e88 use contextlib.chdir
• 59cb792 Merge pull request #3771 from pre-commit/all-repos_autofix_py311-plus
• 2be1701 remove triple-nested withs for 3.14 coverage
• 4c8d22a py311+
• c429238 Merge pull request #3770 from pre-commit/pre-commit-ci-update-config
• f49e251 [pre-commit.ci] pre-commit autoupdate
• Additional commits viewable in compare view

Updates poethepoet from 0.48.0 to 0.49.0

Release notes

Sourced from poethepoet's releases.

0.49.0

Enhancements

• Add true_string and false_string options to customize the string values that boolean args are exposed as by @​nat-n in nat-n/poethepoet#419
• Support the .yml file extension for poe_tasks.yml and included config files by @​Ab2nour in nat-n/poethepoet#426
• Remove the pastel dependency, leaving pyyaml (and tomli on older pythons) as the only runtime dependencies by @​nat-n in nat-n/poethepoet#411

Fixes

• Resolve glob patterns in cmd tasks after parameter expansion, so expansions and quotes inside square bracket patterns are respected and unmatched globs are passed on unescaped by @​nat-n in nat-n/poethepoet#425
• Handle absolute glob patterns (e.g. /etc/host*) and ** within a path component in cmd tasks instead of crashing by @​nat-n in nat-n/poethepoet#431
• Propagate errors and exit codes from failed subtasks: errors in a switch case or a ref'd task are no longer swallowed, and poe now exits with the exit code of the first failed subtask instead of 1 by @​nat-n in nat-n/poethepoet#430
• Resolve subtask arg defaults against the env inherited from the parent task by @​nat-n in nat-n/poethepoet#421
• Detect and report cyclic deps/uses instead of silently running nothing or crashing by @​nat-n in nat-n/poethepoet#421
• Report malformed, empty, and non-table config files with clear errors instead of tracebacks by @​nat-n in nat-n/poethepoet#428
• Fix boolean flags forwarded to python tasks being inverted when their default is templated by @​nat-n in nat-n/poethepoet#420

Breaking changes

These changes may affect a small number of existing configurations:

• Consistent sys.argv for Python tasks with declared args. Script tasks that call a function, and expr tasks, now get the same sys.argv as script tasks that run a module: declared args as parsed (with defaults applied), followed by any args given after --. Templates like ${VAR} in args given on the command line are also no longer expanded for these tasks, matching other task types. See the migration guide for an example. (nat-n/poethepoet#420)

• Square bracket glob patterns in cmd tasks are parsed like in bash. Whitespace, backslashes, quotes, and parameter expansions inside [...] are no longer taken literally, so e.g. [ -f foo ] is now four words rather than one pattern. To match a space or backslash, escape or quote it, e.g. [a\ b]. See the migration guide for details. (nat-n/poethepoet#425)

AI Agent Skill 🤖

• Teach the task graph (deps, uses, uses_env) and steer agents towards declarative poe features rather than bash logic by @​nat-n in nat-n/poethepoet#429

Upgrade an installed skill with:

poe _install_skill --upgrade

New Contributors

• @​Ab2nour made their first contribution in nat-n/poethepoet#426

Full Changelog: nat-n/poethepoet@v0.48.0...v0.49.0

Commits

• b8e96a9 Bump version to 0.49.0
• 98da6fe fix(cmd): handle absolute glob patterns and misplaced ** without crashing (...
• 5e67f11 fix: propagate errors and exit codes from failed subtasks (#430)
• 65f2390 fix!: resolve glob patterns in cmd tasks after parameter expansion (#425)
• 0f56a81 docs(skill): teach the task graph and steer bash logic to poe features (#429)
• eec9c33 fix!: consistent sys.argv for Python tasks with declared args (#420)
• ac60c37 fix(config): report malformed and non-table config files cleanly (#428)
• af160fe feat: support both .yaml and .yml file extensions (#426)
• 31b931e fix: resolve subtask arg defaults against the inherited env, and detect cycli...
• ee5b9bc feat: customize boolean argument string values (#419)
• Additional commits viewable in compare view

Updates hypothesis from 6.169.0 to 6.170.1

Commits

• 718686d Bump hypothesis version to 6.170.1 and update changelog
• ba6c3e3 Merge pull request #4834 from Zac-HD/claude/hypothesis-4458-prototypes-nqza1f
• 7572cd0 Bump hypothesis version to 6.170.0 and update changelog
• 1ad039f Merge pull request #4871 from Zac-HD/claude/hypothesis-conformance-tests-c6877l
• a03eb1b Merge pull request #4895 from TaiSakuma/add-hypothesis-awkward
• 7219a20 Strengthen provider conformance tests and fix BytestringProvider
• e7c0eb9 Bump hypothesis version to 6.169.4 and update changelog
• c3705d2 Merge pull request #4898 from Arjun-Aravind/fix/unresolved-lazy-annotations
• 6ec54d5 Bump hypothesis version to 6.169.3 and update changelog
• 37c6420 Merge pull request #4903 from MarcoGorelli/random-seed-signature
• Additional commits viewable in compare view

Updates zizmor from 1.30.1 to 1.31.1

Release notes

Sourced from zizmor's releases.

v1.31.1

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit (#2450)

v1.31.0

Sponsorship is appreciated!

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

• Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)

  Many thanks to @​marcalexiei for implementing this improvement!

• Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#2390)

• Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#2394)

• Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#2413)

• Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#2444)

Changelog

Sourced from zizmor's changelog.

1.31.1

Bug Fixes 🐛

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the [dangerous-triggers] audit (#2450)

1.31.0

Enhancements 🌱

• The [typosquat-uses] audit now supports pre-commit config inputs (#2437)

• The [self-hosted-runner] audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The [dangerous-triggers] audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The [dangerous-triggers] audit now produces more precise finding/diagnostic spans (#2402)

• The [cache-poisoning] audit is now aware of @​pnpm/setup (#2409)

• The [unpinned-images] audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The [cache-poisoning] audit is now aware of GitHub's new #!yaml cache-mode: setting, and will skip any findings that would occur when a job has an effective #!yaml cache-mode: none (#2418)

• The [cache-poisoning] audit now flags usages of #!yaml cache-mode: write and #!yaml cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛

• Fixed a class of false positives/imprecisions in [adhoc-packages] that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)

  Many thanks to @​marcalexiei for implementing this improvement!

• Fixed a bug where zizmor would fail to honor Git submodules and worktrees

... (truncated)

Commits

• effdb35 Prepare zizmor 1.31.1 (#2451)
• 684ab59 Fix #2448 (#2450)
• 5eb3769 docs: bump action pins (#2447)
• 1c9cb3d Prepare release (#2446)
• a5acb37 chore(deps-dev): bump zensical from 0.0.66 to 0.0.68 in the uv group (#2441)
• 0f8b44b Record changes from #2444 (#2445)
• e2b4dfb Switch to woodruffw-trough-tree-sitter-powershell (#2444)
• f8dda18 chore(deps): bump the cargo group with 2 updates (#2440)
• b2c6076 chore(deps): bump the github-actions group across 1 directory with 2 updates ...
• 1779f43 typosquat-uses: support pre-commit inputs (#2437)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

📖 Docs preview: https://pr-824--endearing-crepe-c2d5fe.netlify.app

Smoke render — the expensive notebooks run with reduced budgets, so
figures are not publication fidelity. /render-mode.txt says smoke.