chore(deps)(deps): bump the npm-production group with 5 updates

[dependabot]

Bumps the npm-production group with 5 updates:

Package	From	To
@fastify/multipart	10.1.1	10.1.2
@fastify/static	10.1.3	10.1.5
fastify	5.12.1	5.12.5
jszip	3.10.1	3.10.2
playwright	1.62.1	1.63.0

Updates @fastify/multipart from 10.1.1 to 10.1.2

Release notes

Sourced from @​fastify/multipart's releases.

v10.1.2

What's Changed

• test: fix Node 26 flake in 'group parts with same name to an array' by @​mcollina in fastify/fastify-multipart#646
• docs: clarify multipart bodyLimit is not an aggregate limit by @​mcollina in fastify/fastify-multipart#645
• fix: do not tear down the part in flight when a parser limit is raised by @​cmiic in fastify/fastify-multipart#643

New Contributors

• @​cmiic made their first contribution in fastify/fastify-multipart#643

Full Changelog: fastify/fastify-multipart@v10.1.1...v10.1.2

Commits

• e85cc1f Bumped v10.1.2
• 6044f7e Added .pi to .gitignore
• 9133a1c fix: do not tear down the part in flight when a parser limit is raised (#643)
• 57bbbc5 docs: clarify multipart bodyLimit is not an aggregate limit (#645)
• ee36838 test: fix Node 26 flake in 'group parts with same name to an array'
• See full diff in compare view

Updates @fastify/static from 10.1.3 to 10.1.5

Release notes

Sourced from @​fastify/static's releases.

v10.1.5

What's Changed

• fix: use registered root for relative downloads by @​lprnmns in fastify/fastify-static#610

New Contributors

• @​lprnmns made their first contribution in fastify/fastify-static#610

Full Changelog: fastify/fastify-static@v10.1.4...v10.1.5

v10.1.4

This is a security release for GHSA-r799-r9gc-m956 (CVE-2026-90982).

It fixes a route guard and allowedPath bypass on case-insensitive filesystems. Users should upgrade to @fastify/static 10.1.4.

Full Changelog: fastify/fastify-static@v10.1.3...v10.1.4

Commits

• 2f0953a Bumped v10.1.5
• 275d87e fix: use registered root for relative downloads (#610)
• a39a464 Bumped v10.1.4
• ac46015 Ignore .pi
• 6288466 test: consume compressed response bodies
• 04134a4 test: cover rootless path validation on Windows
• d9a8c0a test: make case-folding fallback portable
• dbe65e8 Merge commit from fork
• 48b821f chore: bump content-disposition in the dependencies group (#607)
• ee3f89d chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#604)
• See full diff in compare view

Updates fastify from 5.12.1 to 5.12.5

Release notes

Sourced from fastify's releases.

v5.12.5

⚠️ Security release

• Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

• [Backport 5.x] perf: reduce content-type parser overhead by @​github-actions[bot] in fastify/fastify#7019
• [Backport 5.x] perf: avoid redundant request-part reads during validation by @​github-actions[bot] in fastify/fastify#7020

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.2

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @​github-actions[bot] in fastify/fastify#6973
• [Backport 5.x] chore: npm ignore remaining agent files by @​github-actions[bot] in fastify/fastify#7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

Commits

• ba235fd Bumped v5.12.5
• ad06a4c Merge commit from fork
• 7af0d77 [Backport 5.x] perf: avoid redundant request-part reads during validation (#7...
• 990ebef [Backport 5.x] perf: reduce content-type parser overhead (#7019)
• 1690e35 Bumped v5.12.4
• 1c991c4 Bumped v5.12.3
• 942a2be Bumped v5.12.2
• 853f6e2 test(validation): cover normalization and async branches
• f02d8d4 fix(validation): do not unwrap async validator results
• 93c239a fix: reject malformed URLs before custom 404 handlers
• Additional commits viewable in compare view

Updates jszip from 3.10.1 to 3.10.2

Changelog

Sourced from jszip's changelog.

v3.10.2 2026-09-09

• Fix cross-realm binary type detection in getTypeOf. Fixes #759 (see #578)
• Add missing types for JSZip.defaults. Fixes #690 (see #927)
• Fix Blob support in Node.js 18 and up. Fixes #941 (see #955)

Commits

• 020fa33 Release preparation for 3.10.2 (#974)
• d38fda5 Fix cross-realm binary type detection in getTypeOf (#578)
• e682f9a Fix grunt build rebundling existing dist via browser field (#971)
• 5adef36 Add missing types for JSZip.defaults (#927)
• 41a1342 Fix blob support in Node.js 18 and up (#955)
• 643714a Move all continuous integration to GitHub Actions (#942)
• 418c11f Upgrade Playwright to the latest version (#940)
• 2ceb998 Create FUNDING.yml
• See full diff in compare view

Maintainer changes

This version was pushed to npm by jkoops, a new releaser for jszip since your current version.

Updates playwright from 1.62.1 to 1.63.0

Release notes

Sourced from playwright's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions