mirror of
https://github.com/ChromeDevTools/chrome-devtools-mcp.git
synced 2026-11-04 15:00:11 +00:00
refactor/json-object-transform
1549
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Nikolay Vitkov
|
32af393ab6 |
fix(tools): validate JSON object tool parameters in Zod schemas
## Summary Moves JSON object parameter parsing and validation out of tool handlers into the Zod schemas using a shared `jsonObjectTransform` helper in `src/tools/ToolDefinition.ts`. - Adds `jsonObjectTransform` in `src/tools/ToolDefinition.ts` backed by `zod.record(zod.string(), zod.unknown())`. - Uses `.transform(zodTransform(jsonObjectTransform))` on `params` in `execute_3p_developer_tool` (`src/tools/thirdPartyDeveloper.ts`) and `input` in `execute_webmcp_tool` (`src/tools/webmcp.ts`), removing manual `JSON.parse` and plain-object checks from both handlers. ## User-visible behavior changes - Passing malformed JSON or non-object JSON (e.g. `[]`, `null`, primitives) to `execute_3p_developer_tool`'s `params` or `execute_webmcp_tool`'s `input` now fails at schema validation time (`Invalid arguments for tool ...`) before acquiring the page or running the handler. |
||
 Nikolay Vitkov
|
3c609da38a |
refactor: reuse Zod schemas and validate integer viewport dimensions (#3367)
## Summary Replaces custom regex checks and manual parsing in `viewportTransform` and `geolocationTransform` with internal Zod object schemas, and enforces integer viewport width and height. - Reuses Zod schemas for numeric validation and bounds checking (`latitude`, `longitude`, `width`, `height`, `deviceScaleFactor`) with user-friendly validation messages (`Expected an integer` / `Expected a number`) instead of raw regex patterns. - Rejects non-integer viewport width and height (e.g. `1280.5x720`, `1280.0x720`, `1280x720.`) with clear validation issues (`Expected an integer`), preventing CDP `Emulation.setDeviceMetricsOverride` protocol errors while continuing to accept fractional `deviceScaleFactor`. - Provides a descriptive validation message on `viewportTagSchema` when an invalid or empty viewport option is passed (e.g. `Invalid viewport option "bogus". Expected "mobile", "touch", or "landscape" in '<width>x<height>x<devicePixelRatio>[,mobile][,touch][,landscape]'.`). - Inlines intermediate variables (`isMobile`, `hasTouch`, `isLandscape`) in `viewportTransform`. - Forwards `issue.path` in `zodTransform` when a `ZodError` is caught so validation messages identify the specific failing property (for example `viewport.width: Too small: expected number to be >0` or `viewport.width: Expected an integer`). - Simplifies `timeoutSchema` to use `.transform()` directly instead of wrapping with `zodTransform`. ## Verification - `npm run build` passed. - `npm run format` passed on all changed files with 0 errors. - `npm run test` passed. |
||
|
Nikolay Vitkov
|
ae7281aef9 |
chore(deps): finish updating Lighthouse to v13.6.0 (#3373)
- Bump the `lighthouse` npm dependency in `package.json` and `package-lock.json` to `13.6.0` (used for TypeScript types, `bundled-packages.json`, and `THIRD_PARTY_NOTICES`) and exclude `lighthouse` and `devtools-protocol` from `min-release-age` in `.npmrc`. - Run `yarn build-report` before `yarn build-devtools-mcp` in `scripts/update-lighthouse.ts` and regenerate `src/third_party/lighthouse-devtools-mcp-bundle.js` so the inlined standalone HTML report includes the v13.6.0 report changes (such as `DOM.safelySetImageSrc`). |
||
 dependabot[bot]
|
4697482530 |
chore(deps): bump third_party/devtools-frontend from ce6d180 to 1212f1b (#3371)
Bumps [third_party/devtools-frontend](https://github.com/ChromeDevTools/devtools-frontend) from `ce6d180` to `1212f1b`. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/1212f1bf37d47640deaef2911db0be022637c89d"><code>1212f1b</code></a> [Elements] Fix CSSPropertyDocsView widget mounting in tooltip</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/2bd93995d53f795e9305bd99be7703bd151b67cb"><code>2bd9399</code></a> [Size Tokens] Review margin-top value in Security view</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/d4d2ff0c930ce4a90dcc60b8efb1f68dd302ffbf"><code>d4d2ff0</code></a> [settings] Keep invalid backend linking rules in view state</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/7eef4139ad48bd8b03377f8a71ff698520c5d7e8"><code>7eef413</code></a> [sources] Use Lit to render NavigatorSourceTreeElement content</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/44041f782250207a5dba883e29ca5530d9fffb38"><code>44041f7</code></a> [Size Tokens] Review left value in Console view</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/5e6a54e7ba701774cedcf0915e5af3d986d3b342"><code>5e6a54e</code></a> trace: scope InitiatorsHandler IDs by process and execution context</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/41ca4a8212f939374edbe1f1733b3c08990cee21"><code>41ca4a8</code></a> [comments] Show "Working" in comment thread UI once the agent takes it</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/08bc9366285d6c1340f3a97dd6f741fc929967b3"><code>08bc936</code></a> [comments] Only show "Working" in the drawer once the agent takes it</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/18b4319719ba844ad1e4c38ae8b7062a58121f53"><code>18b4319</code></a> [Size Tokens] Review height value in Emulation view</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/1ca8e95bbae470ddee106a1000a00430b0ec6d37"><code>1ca8e95</code></a> [console] Migrate ConsolePrompt to a declarative view</li> <li>Additional commits viewable in <a href="https://github.com/ChromeDevTools/devtools-frontend/compare/ce6d1800e1b75c04e989b1c9a54ffe7cacfcbf23...1212f1bf37d47640deaef2911db0be022637c89d">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
 Jae Bird
|
63170b11a2 |
fix(config): accept config files with a UTF-8 BOM (#3365)
`--config` file w/ a UTF-8 BOM aborts startup:
```
Invalid JSON config file: Unexpected token '<U+FEFF>', "<U+FEFF>{"headles"... is not valid JSON
```
Windows PowerShell 5.1 writes a BOM by default (`'{"headless": true}' |
Out-File -Encoding utf8 cfg.json`). Same for a discovered
`%LOCALAPPDATA%\Google\cd4a\config.json`, which then fails every launch,
and for `--watchConfig` reloads ("Keeping the previous configuration").
`parseConfigFile` now strips a leading `\uFEFF` before `JSON.parse`; all
three paths go through it. Invalid JSON, unknown keys & non-objects
after the BOM are still rejected.
Validation, Linux (Node 22/24/26) & Windows 11 (Node 24.18):
```
npm run check-format
npm run typecheck
npm run test tests/config/mcp-options.test.ts # new test fails on main
npm run test:no-build # same 5 failures as main (CLI e2e, no Chrome stable in container)
```
|
||
 Hannes
|
bc0d93ee2d |
docs: add Pi client configuration (#3364)
Adds a configuration section for the [Pi](https://pi.dev) coding agent to [docs/client-configurations.md](https://github.com/ChromeDevTools/chrome-devtools-mcp/blob/main/docs/client-configurations.md). The section is in alphabetical order. The section shows how to: - Add the MCP server with `pi mcp add` and check the connection with `pi mcp list`. - Load the server in a running session with `/reload`. - Copy the skill folders to `~/.pi/agent/skills/`. I tested the commands with Pi 1.4.0. `pi mcp list` shows the server as connected with 32 tools. Cheers Hannes |
||
|
dependabot[bot]
|
b770c91cb1 |
chore(deps): bump third_party/devtools-frontend from 34926d0 to ce6d180 (#3362)
Bumps [third_party/devtools-frontend](https://github.com/ChromeDevTools/devtools-frontend) from `34926d0` to `ce6d180`. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/ce6d1800e1b75c04e989b1c9a54ffe7cacfcbf23"><code>ce6d180</code></a> Update DevTools DEPS (trusted)</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/85811b6fb65c133b1ba35f6ca75ce0a3338ef267"><code>85811b6</code></a> [Lighthouse] Roll Lighthouse 13.6.0</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/d38f40d6c00ffc38cc4e6d05404baa2b78ad5100"><code>d38f40d</code></a> Provide a clean 'paused' UI when animations are paused for profiling</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/a19ceb8912fdf5f0ad0d9177615c3c37c184e9b7"><code>a19ceb8</code></a> Add Private Verification Tokens tree element and empty view</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/51fea24e3ef393aa56cb6e3b5e747097d13f2d47"><code>51fea24</code></a> [Evals]: Fix build (stop running failing test server-error-5xx)</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/10eca6c4ac4e45eadc8674e45a1a5b533e94c256"><code>10eca6c</code></a> [RPP] Fix es-shims regex matching in legacy-javascript</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/79fea4ed0e47f270985fd98f5d1c441b20e3d021"><code>79fea4e</code></a> [agents] Add migration false-positive guards to UI and test review rules</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/ccca172f54874d77b5d993dfdb932a4c2385097f"><code>ccca172</code></a> Update DevTools DEPS (trusted)</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/e362119a4e33389580ab9532ad18de49ceb14049"><code>e362119</code></a> [test] Support --isolated-script-test-repeat</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/5bca92f45dbeecd97d73aa76f69decd749ba636a"><code>5bca92f</code></a> trace: round CPU profile sample bounds to integer microseconds</li> <li>Additional commits viewable in <a href="https://github.com/ChromeDevTools/devtools-frontend/compare/34926d0802182647cad7a1b5fe0590f3e3d66346...ce6d1800e1b75c04e989b1c9a54ffe7cacfcbf23">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Nikolay Vitkov
|
3a24fa3b86 |
chore(deps): update Lighthouse to v13.6.0 (#3366)
Update via the `scripts/update-lighthouse.ts` and ran `npm audit fix` |
||
 Victor Hugo Macedo Paes Leme
|
b7017767a4 |
fix(network): start an empty request list for navigations without a request (#3357)
Fixes #3356 When the main frame navigates, `NetworkCollector.splitAfterNavigation()` starts the new bucket at the last navigation request it finds. If the navigation didn't send a request (back/forward cache restore, `about:blank`), the last one it finds is the request that started the previous navigation, so the previous page's requests get moved into the current bucket and `list_network_requests` shows them as if they belonged to the current page. The collector now remembers the navigation request that started the latest navigation and skips it when looking for the next one. If there's no new navigation request, the new bucket starts empty. It only keeps a reference to that one request and drops it on a navigation without a request. What changes for users: after a navigation that doesn't send a request, `list_network_requests` shows only the requests made since then (usually none) instead of the previous page's. The previous page's requests are still listed with `includePreservedRequests`. Navigations that do send a request work the same as before, including back/forward without the cache, reloads and redirects. Testing: - Added a test for a navigation without a request. It fails on main (the previous navigation's requests come back) and passes with the fix. - `npm run test` passes locally (Linux, Node 24, Chrome 156). - Ran the repro from the issue against a real Chrome: after `back` (restored from the cache) and after `about:blank`, the list is empty. With `--disable-features=BackForwardCache`, `back` and `forward` list the requests of the page they load, same as before. |
||
 Łukasz Dubiel
|
a24334d3a1 |
fix(plugin): launch the Claude Code MCP server with npx --prefix (#3353)
Fixes #3352. `npx` resolves against the `package.json` in the session's cwd. A project whose `overrides` conflict with a direct dependency makes it exit with `EOVERRIDE`, so the plugin fails to start there. ### Change - `.claude-plugin/plugin.json`: `args` becomes `["--prefix", "${CLAUDE_PLUGIN_DATA}", "chrome-devtools-mcp@<ver>"]`. - `release-please-config.json`: the version pin for that file moves from `args[0]` to `args[2]`. With the old path, release-please skips the update with "No version found" and leaves a stale pin. - `mcp.json` is untouched. ### Verification - Claude Code 2.1.287, `claude mcp list`, fresh npm cache per run: original manifest fails in a project with a conflicting override (stderr: `EOVERRIDE`) and connects in a clean project. The patched manifest connects in both. - `${CLAUDE_PLUGIN_DATA}` and `${HOME}` are expanded by Claude Code. `${PLUGIN_DATA}` is not, which is why `mcp.json`'s value can't be reused here. - release-please's `GenericJson` updater, simulating 1.13.0: `["--prefix","${CLAUDE_PLUGIN_DATA}","chrome-devtools-mcp@1.13.0"]`. - Agent Plugins CLI 0.1.91 (throwaway HOME): `validate`, dry-run `add`, and real `add --target claude` give identical output and identical generated `.mcp.json` / `.claude-plugin/plugin.json` with and without this change. - Prettier passes. Not covered: the OpenCode target of the Agent Plugins CLI, and the other client manifests (`.cursor-plugin/`, `.github/plugin/`, `gemini-extension.json`), which are unchanged. |
||
 a5768549
|
78c9c0c17a |
test(input): cover rejected fill and fill_form actions (#3351)
## Summary Related to #2942. The read-only/unaccepted-value fix is already in Puppeteer (puppeteer/puppeteer#15603) and this repository has updated that dependency. This is test-only coverage, not a new implementation of that fix. The two handler tests verify that a rejected locator fill does not append success output, wait results or a snapshot, and that `fill_form` stops before attempting the next field. They use the existing mocks and exercise the actual handler action callback. Only `tests/tools/input.test.ts` changes. The tests cover propagation of a locator rejection; they do not independently test browser read-only/input-sanitization behavior. ## Verification Tested commit: `5e68bd1d6f72760bc7fc1a5f99dc0ed313bfbc05`, based on `ada7963246c0c91eae185125a57aecd13cbe0376`. [Isolated fork validation job](https://github.com/a5768549/chrome-devtools-mcp/actions/runs/40338560835/job/121626630879) on Ubuntu, Node **22.23.3**: - `npm ci` and `npm run bundle`: passed. - `npm run test -- --test-concurrency=1`: **1764 passed, 0 failed, 0 cancelled, 2 skipped**. The two skips are existing Windows-only cases. - `npm run test:notices:no-build`: **1 passed**. - `npm run typecheck`, `npm run check-format`: passed. - `npm run gen` followed by `git diff --exit-code`: passed. The unchanged baseline was run with the same setup (1762 passed, 2 skipped). Final test names were compared with the baseline: no existing tests were missing. Additional Windows focused validation: `npm run test -- tests/tools/input.test.ts --test-concurrency=1`: 48 passed (Windows browser cleanup warnings were also emitted). Windows full-suite success is not claimed: the unchanged baseline and candidates fail the same ConfigWatcher symlink test with `EPERM` on this workstation. Earlier parallel Node 24 runs returned success but inconsistent completed-test counts, so those were not used as the full-suite acceptance evidence. The upstream CI matrix remains separate from this fork validation. Prepared and verified with AI assistance (Hermes Agent). |
||
 Thomas Bachem
|
ca6f834980 |
perf(memory): drop async parents of request initiators in NetworkCollector (#3345)
This drops `initiator.stack.parent` from every request `NetworkCollector` keeps. The async parents get there through the debugger `createTargetUniverse()` starts (see #3344), and no tool reads them. With the repro from #3344, the heap now levels off at 52 MB instead of 290 MB on `main`. On a Google Calendar tab, an initiator averaged 416 KB, of which 11 KB remain without the async parents. No tool output changes, and console messages and errors still show their async fragments. I edit the object `initiator()` returns rather than a copy, since a copy wouldn't free anything. That relies on Puppeteer handing out its own object, which the mocked test can't check. Fixes #3344 |
||
|
dependabot[bot]
|
b8697c3e51 |
chore(deps): bump third_party/devtools-frontend from 7be69df to 34926d0 (#3358)
Bumps [third_party/devtools-frontend](https://github.com/ChromeDevTools/devtools-frontend) from `7be69df` to `34926d0`. Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Victor Hugo Macedo Paes Leme
|
172656ab38 |
fix(console): stop resolving a cyclic Error.cause chain after 10 causes (#3338)
Fixes #3337 `SymbolizedError` follows `Error.cause` recursively with no limit. With a cyclic chain like `e.cause = e` it never stops, because CDP returns a new object id for the same object on every lookup. `get_console_message` hangs and keeps the page queue busy, so other tools (even `list_pages`) are stuck until the server restarts. This stops the lookup after 10 causes. The recursion now goes through private `#fromDetails()` / `#fromError()` that carry the depth, and the public `fromDetails()` / `fromError()` signatures stay the same. Detecting the cycle by object id doesn't work here since the ids are different every time. What changes for users: `get_console_message` for `Error` arguments, and `get_console_message` / `list_console_messages` with `includeStackTraces` for uncaught errors, show at most 10 `Caused by:` entries. Chains with up to 10 causes look the same as before. Testing: - Added a test where a mocked session keeps returning the same error with a new object id. It fails on main (`actual: 50, expected: 10`, the mock cuts the chain at 50 so the test fails instead of hanging) and passes with the fix. - `npm run test` passes locally (Linux, Node 24, Chrome 156). - Ran the repro from the issue: `get_console_message` comes back right away and `take_snapshot` / `list_pages` keep working. Side note: `DebuggerWorkspaceBinding.createSymbolizedError()` in devtools-frontend recurses on `RemoteError.cause()` the same way, but chrome-devtools-mcp doesn't use it, so this fix doesn't depend on an upstream change. |
||
|
dependabot[bot]
|
2a54e28eeb |
chore(deps-dev): bump fast-uri from 3.1.8 to 3.1.9 (#3346)
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.8 to 3.1.9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastify/fast-uri/releases">fast-uri's releases</a>.</em></p> <blockquote> <h2>v3.1.9</h2> <h2>Security</h2> <p>This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.</p> <ul> <li><strong>Medium — URI scheme spoofing through percent-encoded schemes</strong> (<a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg">GHSA-w74x-v6f9-j3xg</a>, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.</li> <li><strong>Medium — Host confusion during domain-host canonicalization</strong> (<a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr">GHSA-wjr9-j795-jxcr</a>, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.</li> <li><strong>Low — Incorrect relative-reference normalization</strong> (<a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h">GHSA-xhq7-xmqj-769h</a>, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.</li> <li><strong>Low — Scheme injection in suffix references</strong> (<a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp">GHSA-333x-w4r6-6crp</a>, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.</li> </ul> <p>Upgrade with:</p> <pre lang="sh"><code>npm install fast-uri@3.1.9 </code></pre> <p>Thanks to <a href="https://github.com/zekth"><code>@zekth</code></a> for reporting the scheme, host, and relative-reference issues, and to <a href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a> for finding the suffix-reference issue and reviewing the remediations.</p> <h2>What's Changed</h2> <ul> <li>ci: enable trusted publishing releases (v3.x) by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/229">fastify/fast-uri#229</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.8...v3.1.9">https://github.com/fastify/fast-uri/compare/v3.1.8...v3.1.9</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fastify/fast-uri/commit/0def70338a0fa2f12a10c83ae8eafc2139ae9a07"><code>0def703</code></a> Bumped v3.1.9</li> <li><a href="https://github.com/fastify/fast-uri/commit/a1d0da2f5c703244027c1b204c1aebd0516da338"><code>a1d0da2</code></a> test: generate only relative path references</li> <li><a href="https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd"><code>9eb8759</code></a> fix: preserve relative paths in suffix and relative resolution</li> <li><a href="https://github.com/fastify/fast-uri/commit/54c30f75891b74e5a4393b44be9ea7ba43dd1e4b"><code>54c30f7</code></a> docs: note suffix-reference authority ambiguity</li> <li><a href="https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e"><code>39e6493</code></a> fix: escape a first-segment colon in suffix references</li> <li><a href="https://github.com/fastify/fast-uri/commit/745183c1d9d98d113bed8a57bb1c9ceaf0147b7a"><code>745183c</code></a> test: cover first-segment colon in suffix references</li> <li><a href="https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c"><code>ddfc6a5</code></a> fix(SEC-03): reject non reg-name characters in domain hosts</li> <li><a href="https://github.com/fastify/fast-uri/commit/d86a8d29f45187819dac2d4fe171c35e3e488264"><code>d86a8d2</code></a> fix: keep a colon-first segment behind "./" in relative normalization</li> <li><a href="https://github.com/fastify/fast-uri/commit/eb483b5da2580bdecb8af644bbfee878d5424850"><code>eb483b5</code></a> test: cover colon-first relative references in normalization</li> <li><a href="https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424"><code>b110a35</code></a> fix(SEC-02): preserve meaning of relative references during normalization</li> <li>Additional commits viewable in <a href="https://github.com/fastify/fast-uri/compare/v3.1.8...v3.1.9">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for fast-uri since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ChromeDevTools/chrome-devtools-mcp/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
cdc493b170 |
chore(deps-dev): bump the dev-dependencies group with 2 updates (#3336)
Bumps the dev-dependencies group with 2 updates: [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) and [rollup](https://github.com/rollup/rollup). Updates `eslint-plugin-jsdoc` from 65.3.6 to 65.3.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gajus/eslint-plugin-jsdoc/releases">eslint-plugin-jsdoc's releases</a>.</em></p> <blockquote> <h2>v65.3.11</h2> <h2><a href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.10...v65.3.11">65.3.11</a> (2026-10-17)</h2> <h3>Bug Fixes</h3> <ul> <li><strong><code>no-unnecessary-type-assertion</code>:</strong> no exit early when typescript is found; fixes <a href="https://redirect.github.com/gajus/eslint-plugin-jsdoc/issues/1816">#1816</a> (<a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/6a4c8fe2b91f244e4583902f5885dd0e4a11b664">6a4c8fe</a>)</li> </ul> <h2>v65.3.10</h2> <h2><a href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.9...v65.3.10">65.3.10</a> (2026-10-17)</h2> <h3>Bug Fixes</h3> <ul> <li><strong><code>no-missing-syntax</code>, <code>no-restricted-syntax</code>:</strong> support string <code>any</code> contexts and contexts without <code>comment</code> (<a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/2ba7ffdfd15033ce973c372fa5ba55e859381e43">2ba7ffd</a>)</li> </ul> <h2>v65.3.9</h2> <h2><a href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.8...v65.3.9">65.3.9</a> (2026-10-17)</h2> <h3>Bug Fixes</h3> <ul> <li><strong><code>check-template-names</code>:</strong> count template names used as indexed-access indexes (<a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/57444cb9791f28e1f4bf93badab2ff6452b45569">57444cb</a>)</li> <li><strong><code>check-template-names</code>:</strong> count template names used in other templates' constraints and defaults (<a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/e12efb64f7127bc05ccf9ecebf390d3a0152da0d">e12efb6</a>)</li> </ul> <h2>v65.3.8</h2> <h2><a href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.7...v65.3.8">65.3.8</a> (2026-10-16)</h2> <h3>Bug Fixes</h3> <ul> <li><strong><code>prefer-import-tag</code>:</strong> do not re-escape existing import names; use a valid identifier for default imports (<a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/10b6cef1c81fd4044d6900ebe7878ef70d26ff55">10b6cef</a>)</li> </ul> <h2>v65.3.7</h2> <h2><a href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.6...v65.3.7">65.3.7</a> (2026-10-16)</h2> <h3>Bug Fixes</h3> <ul> <li><strong><code>check-template-names</code>, <code>no-undefined-types</code>, <code>require-template</code>:</strong> allow spaces around the <code>=</code> of a <code>@template</code> default (<a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/a7fa83e73cf1bc9353f6271c67e9a8edb6acee3c">a7fa83e</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/6a4c8fe2b91f244e4583902f5885dd0e4a11b664"><code>6a4c8fe</code></a> fix(<code>no-unnecessary-type-assertion</code>): no exit early when typescript is found;...</li> <li><a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/2ba7ffdfd15033ce973c372fa5ba55e859381e43"><code>2ba7ffd</code></a> fix(<code>no-missing-syntax</code>, <code>no-restricted-syntax</code>): support string <code>any</code> contex...</li> <li><a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/57444cb9791f28e1f4bf93badab2ff6452b45569"><code>57444cb</code></a> fix(<code>check-template-names</code>): count template names used as indexed-access indexes</li> <li><a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/e12efb64f7127bc05ccf9ecebf390d3a0152da0d"><code>e12efb6</code></a> fix(<code>check-template-names</code>): count template names used in other templates' co...</li> <li><a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/10b6cef1c81fd4044d6900ebe7878ef70d26ff55"><code>10b6cef</code></a> fix(<code>prefer-import-tag</code>): do not re-escape existing import names; use a valid...</li> <li><a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/a7fa83e73cf1bc9353f6271c67e9a8edb6acee3c"><code>a7fa83e</code></a> fix(<code>check-template-names</code>, <code>no-undefined-types</code>, <code>require-template</code>): allow ...</li> <li>See full diff in <a href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.6...v65.3.11">compare view</a></li> </ul> </details> <br /> Updates `rollup` from 4.64.7 to 4.64.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/releases">rollup's releases</a>.</em></p> <blockquote> <h2>v4.64.9</h2> <h2>4.64.9</h2> <p><em>2026-10-17</em></p> <h3>Bug Fixes</h3> <ul> <li>Ensure export live-bindings are properly maintained for aliased exports (<a href="https://redirect.github.com/rollup/rollup/issues/6576">#6576</a>)</li> <li>Retain typed array constructor calls if the argument has iteration side effects (<a href="https://redirect.github.com/rollup/rollup/issues/6582">#6582</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6576">#6576</a>: Fix live bindings for aliased reassigned exports (<a href="https://github.com/oxura"><code>@oxura</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6582">#6582</a>: Retain typed array constructors that iterate their argument (<a href="https://github.com/joshuablac"><code>@joshuablac</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>v4.64.8</h2> <h2>4.64.8</h2> <p><em>2026-10-17</em></p> <h3>Bug Fixes</h3> <ul> <li>Ensure chunk hashes change when sourcemap comments change (<a href="https://redirect.github.com/rollup/rollup/issues/6509">#6509</a>)</li> <li>Resolve some relative import resolution edge cases (<a href="https://redirect.github.com/rollup/rollup/issues/6522">#6522</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6509">#6509</a>: fix: include sourcemap comments in chunk hashes (<a href="https://github.com/snoopuppy582"><code>@snoopuppy582</code></a>, <a href="https://github.com/wangxpych"><code>@wangxpych</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6522">#6522</a>: fix(browser): match node's join and relative for "." and ".." segments (<a href="https://github.com/luantaraschi"><code>@luantaraschi</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6577">#6577</a>: Update dtolnay/rust-toolchain digest to 686976e (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6578">#6578</a>: Update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6579">#6579</a>: Update swc monorepo (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6580">#6580</a>: Lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6581">#6581</a>: Update dependency eslint-plugin-unicorn to v78 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/blob/master/CHANGELOG.md">rollup's changelog</a>.</em></p> <blockquote> <h2>4.64.9</h2> <p><em>2026-10-17</em></p> <h3>Bug Fixes</h3> <ul> <li>Ensure export live-bindings are properly maintained for aliased exports (<a href="https://redirect.github.com/rollup/rollup/issues/6576">#6576</a>)</li> <li>Retain typed array constructor calls if the argument has iteration side effects (<a href="https://redirect.github.com/rollup/rollup/issues/6582">#6582</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6576">#6576</a>: Fix live bindings for aliased reassigned exports (<a href="https://github.com/oxura"><code>@oxura</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6582">#6582</a>: Retain typed array constructors that iterate their argument (<a href="https://github.com/joshuablac"><code>@joshuablac</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>4.64.8</h2> <p><em>2026-10-17</em></p> <h3>Bug Fixes</h3> <ul> <li>Ensure chunk hashes change when sourcemap comments change (<a href="https://redirect.github.com/rollup/rollup/issues/6509">#6509</a>)</li> <li>Resolve some relative import resolution edge cases (<a href="https://redirect.github.com/rollup/rollup/issues/6522">#6522</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6509">#6509</a>: fix: include sourcemap comments in chunk hashes (<a href="https://github.com/snoopuppy582"><code>@snoopuppy582</code></a>, <a href="https://github.com/wangxpych"><code>@wangxpych</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6522">#6522</a>: fix(browser): match node's join and relative for "." and ".." segments (<a href="https://github.com/luantaraschi"><code>@luantaraschi</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6577">#6577</a>: Update dtolnay/rust-toolchain digest to 686976e (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6578">#6578</a>: Update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6579">#6579</a>: Update swc monorepo (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6580">#6580</a>: Lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6581">#6581</a>: Update dependency eslint-plugin-unicorn to v78 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rollup/rollup/commit/6278729a94e091b2b5f4cb8250852caaf21a2b62"><code>6278729</code></a> 4.64.9</li> <li><a href="https://github.com/rollup/rollup/commit/3b41241e74937712098079056a47cb6c71e41373"><code>3b41241</code></a> Retain typed array constructors that iterate their argument (<a href="https://redirect.github.com/rollup/rollup/issues/6582">#6582</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/092d13954b2a1509a1356bbeb5292a2dca36c04b"><code>092d139</code></a> Fix live bindings for aliased reassigned exports (<a href="https://redirect.github.com/rollup/rollup/issues/6576">#6576</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/b7dd776462bfc5c36df44c837d6bfbc404a68c23"><code>b7dd776</code></a> 4.64.8</li> <li><a href="https://github.com/rollup/rollup/commit/77a6b2bc8b5ed0d4dc909524bd4359d10067fdf1"><code>77a6b2b</code></a> fix: include sourcemap comments in chunk hashes (<a href="https://redirect.github.com/rollup/rollup/issues/6509">#6509</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/55f46a5818e4982fcc8c190dee012d2f0df22055"><code>55f46a5</code></a> fix(browser): match node's join and relative for "." and ".." segments (<a href="https://redirect.github.com/rollup/rollup/issues/6522">#6522</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/fabcaff54e076f93d329fb141e7fea110abcdbaa"><code>fabcaff</code></a> Update swc monorepo (major) (<a href="https://redirect.github.com/rollup/rollup/issues/6579">#6579</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/e410d422c1857f7191f6df26164810f9a0e7b693"><code>e410d42</code></a> Lock file maintenance (<a href="https://redirect.github.com/rollup/rollup/issues/6580">#6580</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/5104039159e04f1a0c4df5761dde4ff199c93428"><code>5104039</code></a> Update dtolnay/rust-toolchain digest to 686976e (<a href="https://redirect.github.com/rollup/rollup/issues/6577">#6577</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/175b8dc4d79070b72a91e341c578d3d9d551b75b"><code>175b8dc</code></a> Update dependency eslint-plugin-unicorn to v78 (<a href="https://redirect.github.com/rollup/rollup/issues/6581">#6581</a>)</li> <li>Additional commits viewable in <a href="https://github.com/rollup/rollup/compare/v4.64.7...v4.64.9">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
c12774ad4f |
chore(deps): bump third_party/devtools-frontend from daedf81 to 7be69df (#3343)
Bumps [third_party/devtools-frontend](https://github.com/ChromeDevTools/devtools-frontend) from `daedf81` to `7be69df`. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/7be69dfa5dd9cdd753ef832a4cf55b8f253fb6aa"><code>7be69df</code></a> Show comment thread near drawer row when not anchored</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/c24bdda04bd6abdb4472b30aabae79b47c7f6b6b"><code>c24bdda</code></a> [network] Only open web-safe URLs on request double-click</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/978a9ce4a4fbe64bac8ddc02731bfde069ecffc2"><code>978a9ce</code></a> Trim the node_modules archive from 30.5 MB to 25.5 MB</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/4de3650e3f1fd33fc7fb770f43edde6614e963e0"><code>4de3650</code></a> EventListenersView: Render script links using a widget</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/ea5f9de48717519802ecd1aac6f5a6f2280bd35e"><code>ea5f9de</code></a> Migrate SnippetsNavigatorView to MVP</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/8cb73aefb301421cf4798560ac9079de46157442"><code>8cb73ae</code></a> Migrate ContentScriptsNavigatorView to MVP</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/1eead86fe70613ae4416603fccab65fe783c6da6"><code>1eead86</code></a> [spte] Migrate VariableNameRenderer to lit</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/36d8063002e4ac6a647d81eb2b395fb2302070b1"><code>36d8063</code></a> Remove strip_private_fields() from manage_node_deps.py</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/65266a1b39bba1c23ae6cdc10c9b4f4ac4be3a62"><code>65266a1</code></a> [spte] Migrate VariableRenderer to lit</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/e7997cafa383858920a932cfa23ac642ff0855f8"><code>e7997ca</code></a> [spte] Migrate CSSWideKeywordRenderer to lit</li> <li>Additional commits viewable in <a href="https://github.com/ChromeDevTools/devtools-frontend/compare/daedf816a02fb9def836e35037ea6a99ba5aad3f...7be69dfa5dd9cdd753ef832a4cf55b8f253fb6aa">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
 Mankhong Garden
|
ada7963246 |
feat: add configure_webauthn tool for virtual authenticators (#3276)
Closes #1004. Adds one opt-in tool, `configure_webauthn`, behind a new `--categoryWebauthn` flag (off by default), so agents can test passkey and security key flows with a virtual authenticator. It goes through the `WebAuthnModel` exported from devtools-frontend in https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/8606246, which is included in the current `third_party/devtools-frontend` roll. **Depends on** https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/8629668 (landed 2026-10-22, not rolled yet), which makes `WebAuthnModel` throw when a CDP command fails. Until that CL lands and is rolled into `third_party/devtools-frontend`, the model still ignores CDP errors, so the error and reset paths below only run in the unit tests. This PR should land after that roll. ### Shape One authenticator per page, all params top-level primitives so the tool also works from the CLI (reworked from an `authenticators: [...]` list during review): ``` configure_webauthn({ enabled, // false disables the virtual authenticator environment for the page; other params are ignored protocol?, // 'ctap2' | 'u2f', default ctap2 transport?, // 'internal' | 'usb' | 'nfc' | 'ble' | 'hybrid', default internal hasResidentKey?, // default true; false for u2f hasUserVerification?, // default true; false for u2f isUserVerified?, // default true; false tests a failed verification }) ``` - On a later call, omitted params keep the current values. - Changing only `isUserVerified` updates the authenticator in place, so passkeys the page registered survive (e.g. register, then make verification fail and check that sign-in is rejected). - Changing `protocol`, `transport`, `hasResidentKey` or `hasUserVerification` replaces the authenticator, since CDP can't change those on an existing one. - `enabled: false` always disables the environment for the whole page, which also removes authenticators other clients (such as the DevTools WebAuthn panel) added. - u2f supports neither resident keys nor user verification, so both are `false` for u2f, also when a later call switches from ctap2 with them omitted. An explicit `true` with u2f is rejected before any CDP call. - The tool description asks the agent to call it before the page calls `navigator.credentials`: a request made without a virtual authenticator stays pending, and later requests fail with `OperationError: A request is already pending` until the page navigates. - When a CDP command fails, the tool throws `Failed to configure WebAuthn for page <id>: <CDP message>`, drops its stored authenticator, removes it from the browser on a best-effort basis, and marks the environment as disabled, so the next call starts from scratch instead of reusing a stale authenticator id. - The response shows the authenticator and its stored credentials (`credentialId` as base64url without padding, matching `PublicKeyCredential.id`, `rpId`, `discoverable`, `signCount`, `userName`), formatted by `WebAuthnFormatter` and included in structured content. Private keys are never printed. - Page listings (`list_pages` and the other tools that print the page list) show `webauthn=<protocol>/<transport>` for pages that have one (`webauthn` in structured content). - The authenticator is scoped to the page and goes away when it closes. The tool uses `concurrency: 'page'`. - Importing credentials with a known private key is left out for now; it could come back as a follow-up. ### Testing - `tests/McpPage.test.ts`: `configureWebAuthn()` against a mocked `WebAuthnModel`: create with defaults, update `isUserVerified` in place and keep omitted options, replace on a creation option change, disable (also when another client enabled the environment), list stored credentials, u2f with both options false after a ctap2 authenticator, an explicit `true` with u2f rejected without a CDP call, no model, and a failing call for each CDP command (enable, add, remove, disable, `setUserVerified`, `getCredentials`), including that the next call creates a new authenticator. - `tests/tools/webauthn.test.ts`: the handler passes params through and attaches the result, plus the only real-browser run: register and sign in through (the response lists the ID the page got) `navigator.credentials.create()` / `get()`, the `list_pages` label, a rejected sign-in after `isUserVerified: false`, the passkey gone after a `transport` change, and disabling. - `tests/formatters/WebAuthnFormatter.test.ts`: snapshot tests for `toString` / `toJSON`, and a test that credential IDs print as base64url. - `McpPage`, `webauthn` and `WebAuthnFormatter` test files pass locally; `npm run gen`, eslint and prettier produce no further changes. |
||
|
dependabot[bot]
|
0ca821f3ac |
chore(deps): bump third_party/devtools-frontend from f22c645 to daedf81 (#3324)
Bumps [third_party/devtools-frontend](https://github.com/ChromeDevTools/devtools-frontend) from `f22c645` to `daedf81`. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/daedf816a02fb9def836e35037ea6a99ba5aad3f"><code>daedf81</code></a> [security] Remove elementsByOrigin from SecurityPanelSidebar</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/38d2de628c738c98f17ccdf25a1caf35b1946fff"><code>38d2de6</code></a> [trace] Defer to X-ProtocolIsH2 for request protocol in Lightrider</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/5de307634fdbc4192a3cd8503d33016321ba7c65"><code>5de3076</code></a> [build] Use node:util parseArgs in scripts/build</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/09a1ff2e5b27c804c405d79e31111f69dd09e87b"><code>09a1ff2</code></a> [application] Migrate StorageView clear site data section to a declarative view</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/0e5a14216146b375ae84eff95aa19fed49bb059e"><code>0e5a142</code></a> [security] Remove dumpSecurityPanelSidebarOrigins from SecurityTestRunner</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/2e063f3b0daa159b509924d65a70471fbdc7afc6"><code>2e063f3</code></a> Roll browser-protocol and CfT</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/efc798d713840db1807354ac6b877c36d9173fca"><code>efc798d</code></a> [UI] Fix tab flicker when a tab with a slotted icon overflows the header</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/e79562d3712496f6c11d8c9875e315dceab9ea99"><code>e79562d</code></a> Update DevTools DEPS (trusted)</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/f6f9a9fe4b160a00aa884ba111aebccb315d2f4a"><code>f6f9a9f</code></a> Roll puppeteer-core</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/8ead0898bb8343ccc25fc578ba7028bac4afc0c1"><code>8ead089</code></a> Ship node_modules as a GCS archive instead of checking it into git</li> <li>Additional commits viewable in <a href="https://github.com/ChromeDevTools/devtools-frontend/compare/f22c645573adc85e4553747c577eebb874c3fb43...daedf816a02fb9def836e35037ea6a99ba5aad3f">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
106d672858 |
chore(deps-dev): bump eslint-plugin-jsdoc from 65.3.4 to 65.3.6 in the dev-dependencies group (#3323)
Bumps the dev-dependencies group with 1 update: [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc). Updates `eslint-plugin-jsdoc` from 65.3.4 to 65.3.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gajus/eslint-plugin-jsdoc/releases">eslint-plugin-jsdoc's releases</a>.</em></p> <blockquote> <h2>v65.3.6</h2> <h2><a href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.5...v65.3.6">65.3.6</a> (2026-10-15)</h2> <h3>Bug Fixes</h3> <ul> <li><strong><code>prefer-import-tag</code>:</strong> keep a hashbang on the first line when adding <code>@import</code> (<a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/2ffe7b6e12735b4d364b2bbd6e24d3727e952c84">2ffe7b6</a>)</li> </ul> <h2>v65.3.5</h2> <h2><a href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.4...v65.3.5">65.3.5</a> (2026-10-15)</h2> <h3>Bug Fixes</h3> <ul> <li><strong><code>require-jsdoc</code>:</strong> with <code>publicOnly</code>, check members of anonymous default exports and of exported object literals (<a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/ff41e5012a4e207ad5dd41e9819b82af0fdefd4e">ff41e50</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/2ffe7b6e12735b4d364b2bbd6e24d3727e952c84"><code>2ffe7b6</code></a> fix(<code>prefer-import-tag</code>): keep a hashbang on the first line when adding `@imp...</li> <li><a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/ff41e5012a4e207ad5dd41e9819b82af0fdefd4e"><code>ff41e50</code></a> fix(<code>require-jsdoc</code>): with <code>publicOnly</code>, check members of anonymous default e...</li> <li>See full diff in <a href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.4...v65.3.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
 browser-automation-bot
|
af2834411a |
chore(main): release chrome-devtools-mcp 1.12.0 (#3168)
🤖 I have created a release *beep* *boop* --- ## [1.12.0](https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.11.0...chrome-devtools-mcp-v1.12.0) (2026-10-22) ### 🎉 Features * add --maxNavigationSaved flag to configure retained navigation history ([#3018](https://github.com/ChromeDevTools/chrome-devtools-mcp/issues/3018)) ([chrome-devtools-mcp-v1.12.0 |
||
 Alex Rudenko
|
7d5f7dec09 |
fix: treat 0.0.0.0 and [::] browser endpoints as local (#3321)
`isLocalBrowser()` in `ToolHandler` uses `isLocalhost()` to decide if a connected browser runs on the local machine. `isLocalhost()` does not accept the unspecified addresses `0.0.0.0` and `[::]`. A connection to these addresses reaches the local machine. Thus, `--browserUrl http://0.0.0.0:9222` caused the tool handler to classify a local browser as remote. ## Changes - `src/utils/url.ts`: add `isLocalBrowserEndpoint()`. It accepts all `isLocalhost()` hosts and the unspecified addresses `0.0.0.0`, `[::]` and `[::ffff:0:0]`. `URL` normalizes `0`, `0x0`, `0.0`, `0.0.0.0.` and `[::0]` to these forms. - `src/ToolHandler.ts`: `isLocalBrowser()` uses `isLocalBrowserEndpoint()`. - `isLocalhost()` does not change. The telemetry `is_localhost` value for page URLs does not change. ## Behavior changes For a browser that is connected through a `0.0.0.0` or `[::]` endpoint, these tools now run the local file path checks for local browsers: - `upload_file` (`filePaths`) - `install_pwa` (`installUrlOrBundleUrl`) - `install_extension` (`path`) Before this change, these tools skipped the checks for such endpoints. ## Tests - `tests/utils/url.test.ts`: unit tests for `isLocalBrowserEndpoint()`. - `tests/ToolHandler.test.ts`: a local-only `verifyFilesSchema` runs `validatePath` for a `ws://0.0.0.0` endpoint. This test fails on `main`. |
||
|
dependabot[bot]
|
db442f9636 |
chore(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates (#3316)
Bumps the dev-dependencies group with 3 updates in the / directory: [@google/genai](https://github.com/googleapis/js-genai), [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) and [rollup](https://github.com/rollup/rollup). Updates `@google/genai` from 2.29.0 to 2.30.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/js-genai/releases">@google/genai's releases</a>.</em></p> <blockquote> <h2>v2.30.0</h2> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.29.1...v2.30.0">2.30.0</a> (2026-10-14)</h2> <h3>Features</h3> <ul> <li><strong>interactions:</strong> add gemini-4-argon to Model enum (<a href="https://github.com/googleapis/js-genai/commit/8a3c3074a6688cc12c9f30c2366089cd94622fd6">8a3c307</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>clear continuation state and preserve prompt feedback when continuation hop returns no candidates (<a href="https://github.com/googleapis/js-genai/commit/e63d1f184811ac2ddec2a17e206e5a6c1c79ed6e">e63d1f1</a>)</li> <li>fix the grounding metadata merging for automatic continuation in generate content and generate content stream (<a href="https://github.com/googleapis/js-genai/commit/6bfba8790e9a3a663884db10290b2909b7ca4b0b">6bfba87</a>)</li> <li>make continuation streams retry dropped hops, stop on prompt_feedback, and keep real errors in generate_content (<a href="https://github.com/googleapis/js-genai/commit/6bdc0d98709df070c935e812bb126dcffaedff97">6bdc0d9</a>)</li> <li>type GeminiNextGen signatures with public, importable names (<a href="https://github.com/googleapis/js-genai/commit/ad3fb891c91b8b57fee846f3319442150d77d622">ad3fb89</a>)</li> </ul> <h2>v2.29.1</h2> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.29.0...v2.29.1">2.29.1</a> (2026-10-13)</h2> <h3>Bug Fixes</h3> <ul> <li>concatenate output_text across multi-step model responses in a turn (<a href="https://github.com/googleapis/js-genai/commit/567cc8a1731850d3d3f22c0f9cf3b0b3664cf79f">567cc8a</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md">@google/genai's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.29.1...v2.30.0">2.30.0</a> (2026-10-14)</h2> <h3>Features</h3> <ul> <li><strong>interactions:</strong> add gemini-4-argon to Model enum (<a href="https://github.com/googleapis/js-genai/commit/8a3c3074a6688cc12c9f30c2366089cd94622fd6">8a3c307</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>clear continuation state and preserve prompt feedback when continuation hop returns no candidates (<a href="https://github.com/googleapis/js-genai/commit/e63d1f184811ac2ddec2a17e206e5a6c1c79ed6e">e63d1f1</a>)</li> <li>fix the grounding metadata merging for automatic continuation in generate content and generate content stream (<a href="https://github.com/googleapis/js-genai/commit/6bfba8790e9a3a663884db10290b2909b7ca4b0b">6bfba87</a>)</li> <li>make continuation streams retry dropped hops, stop on prompt_feedback, and keep real errors in generate_content (<a href="https://github.com/googleapis/js-genai/commit/6bdc0d98709df070c935e812bb126dcffaedff97">6bdc0d9</a>)</li> <li>type GeminiNextGen signatures with public, importable names (<a href="https://github.com/googleapis/js-genai/commit/ad3fb891c91b8b57fee846f3319442150d77d622">ad3fb89</a>)</li> </ul> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.29.0...v2.29.1">2.29.1</a> (2026-10-13)</h2> <h3>Bug Fixes</h3> <ul> <li>concatenate output_text across multi-step model responses in a turn (<a href="https://github.com/googleapis/js-genai/commit/567cc8a1731850d3d3f22c0f9cf3b0b3664cf79f">567cc8a</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/js-genai/commit/1de87f896cfdb6a091d65ab81c7d68c3f2d54382"><code>1de87f8</code></a> chore(main): release 2.30.0 (<a href="https://redirect.github.com/googleapis/js-genai/issues/2058">#2058</a>)</li> <li><a href="https://github.com/googleapis/js-genai/commit/14086e639acb309b87857ef118e0fac25b68386c"><code>14086e6</code></a> chore(cli): update Speakeasy OpenAPI generator to v2.948.9</li> <li><a href="https://github.com/googleapis/js-genai/commit/433a33ad16992efeae215901ac345c67a0735ab4"><code>433a33a</code></a> chore: internal change</li> <li><a href="https://github.com/googleapis/js-genai/commit/6bdc0d98709df070c935e812bb126dcffaedff97"><code>6bdc0d9</code></a> fix: make continuation streams retry dropped hops, stop on prompt_feedback, a...</li> <li><a href="https://github.com/googleapis/js-genai/commit/6bfba8790e9a3a663884db10290b2909b7ca4b0b"><code>6bfba87</code></a> fix: fix the grounding metadata merging for automatic continuation in generat...</li> <li><a href="https://github.com/googleapis/js-genai/commit/ad3fb891c91b8b57fee846f3319442150d77d622"><code>ad3fb89</code></a> fix: type GeminiNextGen signatures with public, importable names</li> <li><a href="https://github.com/googleapis/js-genai/commit/8a3c3074a6688cc12c9f30c2366089cd94622fd6"><code>8a3c307</code></a> feat(interactions): add gemini-4-argon to Model enum</li> <li><a href="https://github.com/googleapis/js-genai/commit/f2ad2c1107d9ed0b09aa0a8116f2c093a7628a45"><code>f2ad2c1</code></a> chore: Skip the code coverage workflow on push/PR (manual trigger only).</li> <li><a href="https://github.com/googleapis/js-genai/commit/e63d1f184811ac2ddec2a17e206e5a6c1c79ed6e"><code>e63d1f1</code></a> fix: clear continuation state and preserve prompt feedback when continuation ...</li> <li><a href="https://github.com/googleapis/js-genai/commit/2e083a76600f37755dab8c4947dd45881f05f33a"><code>2e083a7</code></a> chore(main): release 2.29.1 (<a href="https://redirect.github.com/googleapis/js-genai/issues/2052">#2052</a>)</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/js-genai/compare/v2.29.0...v2.30.0">compare view</a></li> </ul> </details> <br /> Updates `eslint-plugin-jsdoc` from 65.3.2 to 65.3.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gajus/eslint-plugin-jsdoc/releases">eslint-plugin-jsdoc's releases</a>.</em></p> <blockquote> <h2>v65.3.4</h2> <h2><a href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.3...v65.3.4">65.3.4</a> (2026-10-14)</h2> <h3>Performance Improvements</h3> <ul> <li><strong><code>no-undefined-types</code>, <code>require-returns-check</code>:</strong> parse the JSDoc blocks of a file only once (<a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/73a92a1306af4e143e49ce64820f5cfa6293bd58">73a92a1</a>)</li> </ul> <h2>v65.3.3</h2> <h2><a href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.2...v65.3.3">65.3.3</a> (2026-10-14)</h2> <h3>Bug Fixes</h3> <ul> <li><strong><code>check-tag-names</code>:</strong> only treat <code>@public</code>, <code>@private</code> and <code>@protected</code> as redundant on class members with <code>typed</code> (<a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/2d89c3d9e7bec043d546bf4f83e7c9baa57b2ad1">2d89c3d</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/73a92a1306af4e143e49ce64820f5cfa6293bd58"><code>73a92a1</code></a> perf(<code>no-undefined-types</code>, <code>require-returns-check</code>): parse the JSDoc blocks o...</li> <li><a href="https://github.com/gajus/eslint-plugin-jsdoc/commit/2d89c3d9e7bec043d546bf4f83e7c9baa57b2ad1"><code>2d89c3d</code></a> fix(<code>check-tag-names</code>): only treat <code>@public</code>, <code>@private</code> and <code>@protected</code> as ...</li> <li>See full diff in <a href="https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.2...v65.3.4">compare view</a></li> </ul> </details> <br /> Updates `rollup` from 4.64.6 to 4.64.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/releases">rollup's releases</a>.</em></p> <blockquote> <h2>v4.64.7</h2> <h2>4.64.7</h2> <p><em>2026-10-15</em></p> <h3>Bug Fixes</h3> <ul> <li>Fix an issue where watching not-yet-created files from plugins did not work if several shared a directory (<a href="https://redirect.github.com/rollup/rollup/issues/6575">#6575</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6575">#6575</a>: Report creation of missing watch files sharing a directory on Linux (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/blob/master/CHANGELOG.md">rollup's changelog</a>.</em></p> <blockquote> <h2>4.64.7</h2> <p><em>2026-10-15</em></p> <h3>Bug Fixes</h3> <ul> <li>Fix an issue where watching not-yet-created files from plugins did not work if several shared a directory (<a href="https://redirect.github.com/rollup/rollup/issues/6575">#6575</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6575">#6575</a>: Report creation of missing watch files sharing a directory on Linux (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rollup/rollup/commit/5f658604845ca7fb4d8e8a27a9e68e166c6f9973"><code>5f65860</code></a> 4.64.7</li> <li><a href="https://github.com/rollup/rollup/commit/97611099c648ad66d2ea4a4d3601c0a0a82c9c48"><code>9761109</code></a> Report creation of missing watch files sharing a directory on Linux (<a href="https://redirect.github.com/rollup/rollup/issues/6575">#6575</a>)</li> <li>See full diff in <a href="https://github.com/rollup/rollup/compare/v4.64.6...v4.64.7">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
 kevin
|
296ccef3dd |
fix: allow paths below a filesystem-root workspace root (#3277)
Fixes #2808 `validatePath()` builds the allowed prefix as `canonicalRoot + path.sep`. A filesystem root (`/`, or `C:\` on Windows) already ends with the separator, so the prefix becomes `//` (or `C:\\`) and no path below it matches. This makes `--workspace=/`, which the `--allowUnrestrictedPaths` deprecation notice recommends, reject every file write with `Access denied`. The fix appends the separator only when the root doesn't already end with one. Narrower roots behave as before. The new test in `tests/roots.test.ts` sets the workspace root to the filesystem root of the path under test, so it is on the same drive on Windows (that drive mismatch is why the CI failed on the earlier, stale attempt in #2809). It fails on `main` with `Access denied` and passes with the fix. `tests/roots.test.ts` passes locally. --- AI-assistance note: I prepared this change with help from an AI coding assistant, then reviewed it and ran the tests myself. |
||
|
Alex Rudenko
|
3eb76a6547 | chore(dep): bump pptr (#3318) | ||
|
Nikolay Vitkov
|
f25f3df2ab |
fix(network): reset page network emulation before applying URL restrictions (#3312)
Call emulateNetworkConditions(null) in McpPage.clearNetworkConditions() and await it before browser.restrictNetwork() in McpContext.syncNetworkRestrictions() so emulated offline/throttled state (such as navigator.onLine) is cleared when URL restrictions are hot-reloaded. --- <sub>Stack created with <a href="https://github.com/github/gh-stack">GitHub Stacks CLI</a> • <a href="https://gh.io/stacks-feedback">Give Feedback 💬</a></sub> |
||
|
Nikolay Vitkov
|
47db2b836f |
docs(config): note that hot-reloaded URL restrictions keep open targets attached (#3314)
Document on --blockedUrlPattern, --allowedUrlPattern, and docs/configuration.md that targets already open on a newly disallowed URL remain attached when patterns are updated via --watchConfig. --- <sub>Stack created with <a href="https://github.com/github/gh-stack">GitHub Stacks CLI</a> • <a href="https://gh.io/stacks-feedback">Give Feedback 💬</a></sub> |
||
|
Alex Rudenko
|
a560c32675 |
ci: use pull_request trigger for PR title check (#3310)
GitHub enforces a default event policy that blocks `pull_request_target` in public repositories from 2026-11-02. See [Default policy for pull_request_target](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target#default-policy-for-pull_request_target). This PR changes the trigger of the `Conventional Commit` workflow from `pull_request_target` to `pull_request`. - The workflow reads only the PR title. A read-only `GITHUB_TOKEN` is sufficient. - The event types, permissions, action version, and job name do not change. The required check name stays the same. - For first-time contributors from forks, a maintainer must approve the workflow run before the check starts. |
||
|
Alex Rudenko
|
841793ff68 |
chore(deps): reimport lighthouse 13.5.0 bundle (#3309)
the version downgrade is due to using the lighthouse's lock file without updating deps of the latest trace engine. |
||
|
Alex Rudenko
|
186ea66f1b |
fix(pages): revert reporting the page size after resize_page (#3308)
This reverts commit
|
||
|
dependabot[bot]
|
ecab31def0 |
chore(deps): bump third_party/devtools-frontend from d9de6d3 to f22c645 (#3305)
Bumps [third_party/devtools-frontend](https://github.com/ChromeDevTools/devtools-frontend) from `d9de6d3` to `f22c645`. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/f22c645573adc85e4553747c577eebb874c3fb43"><code>f22c645</code></a> Update translations</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/b0369b2a5156388898961d56c156948e6a24ad5d"><code>b0369b2</code></a> [DevTools a11y][Quality life] Fix collapsed announcements pane and add resizer</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/994fb97ec7922af46a40ab012a18d1133d8487a8"><code>994fb97</code></a> Update DevTools DEPS (trusted)</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/800e5b63764d7d567b1f9829bf95c5fd39f9f761"><code>800e5b6</code></a> [screencast] Manage navigation bar listeners in wasShown/willHide</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/b98876d0d46bdf54fb959f3ab12d72ae3e5b067d"><code>b98876d</code></a> [Sources] Fix duplicate script leaks when closing tabs</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/86fa7798fcff68d377830b3a8a322474f9613658"><code>86fa779</code></a> [layer_viewer] Only listen to settings while Layers3DView is shown</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/678e2679bf22a039b9e1bff9974e8be6fed05ce2"><code>678e267</code></a> Add a regression test for a rendering issue in the position-area editor</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/698308ee94c5ab55b18bb7e65ad53e5febf1fd05"><code>698308e</code></a> Add node_modules archive tooling to manage_node_deps.py</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/5728cd2f873b444134996b2eda76ea959f61d9d5"><code>5728cd2</code></a> Roll browser-protocol and CfT</li> <li><a href="https://github.com/ChromeDevTools/devtools-frontend/commit/304e6bad67e15bc7d2798c80ce2770e263fa37a6"><code>304e6ba</code></a> Update DevTools DEPS (trusted)</li> <li>Additional commits viewable in <a href="https://github.com/ChromeDevTools/devtools-frontend/compare/d9de6d3140b80466b714dc10e4b690bfc456a34a...f22c645573adc85e4553747c577eebb874c3fb43">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Nikolay Vitkov
|
f4eaf1face |
refactor: import types and values from a module in one statement (#3303)
Stacked on #3302. When a file imports both types and values from the same module, merges the `import type {...}` statement into the value import as `type X` specifiers (33 files). A value import where every specifier has an inline `type` modifier becomes `import type` (`McpContext.ts`). The changes are the autofix of the DevTools [`inline-type-imports`](https://source.chromium.org/chromium/chromium/src/+/main:third_party/devtools-frontend/src/scripts/eslint_rules/lib/inline-type-imports.ts) ESLint rule, followed by `npm run format`. TypeScript erases type imports either way. ## User-visible changes None. ## Testing - `npm run format` - `npm run test` |
||
|
Nikolay Vitkov
|
dc929c04b4 |
refactor: list optional properties last in inline object types (#3302)
Stacked on #3301. Reorders 15 inline object types in 7 source files so that optional properties come after required ones. The change only affects types. This matches the DevTools [`enforce-optional-properties-last`](https://source.chromium.org/chromium/chromium/src/+/main:third_party/devtools-frontend/src/scripts/eslint_rules/lib/enforce-optional-properties-last.ts) ESLint rule. Its autofix is not used because it moves properties without their JSDoc comments (for example, the `readOnlyHint` comment in `ToolDefinition.ts` would end up on `title`). ## User-visible changes None. ## Testing - `npm run format` - `npm run test` |
||
|
Nikolay Vitkov
|
2e13311bb3 |
refactor: use #private names instead of the private modifier (#3301)
Stacked on #3300. Converts the two remaining `private` members to ECMAScript private names: `TextSnapshot.insertExtraNodes()` and `Result.nextCallIndex` in `scripts/eval_result.ts`. The rest of the code already uses `#`. This matches the DevTools [`prefer-private-class-members`](https://source.chromium.org/chromium/chromium/src/+/main:third_party/devtools-frontend/src/scripts/eslint_rules/lib/prefer-private-class-members.ts) ESLint rule. ## User-visible changes None. ## Testing - `npm run format` - `npm run test` |
||
|
Nikolay Vitkov
|
3da5985b34 |
test: use assert.strictEqual for equality checks (#3300)
Stacked on #3299. Replaces `assert.ok(a === b)` and `assert.ok(a !== b)` with `assert.strictEqual(a, b)` and `assert.notStrictEqual(a, b)` in 5 test files, so that a failure shows both values. `WaitForHelper.test.ts` uses `assert.fail()` behind an `if` instead, because the code after the check relies on the narrowed type and `assert.notStrictEqual` does not narrow. This matches the DevTools [`prefer-assert-strict-equal`](https://source.chromium.org/chromium/chromium/src/+/main:third_party/devtools-frontend/src/scripts/eslint_rules/lib/prefer-assert-strict-equal.ts) ESLint rule. ## User-visible changes None. Tests only. ## Testing - `npm run format` - `npm run test` |
||
|
Nikolay Vitkov
|
d0a2306ea9 |
test: replace assert.equal with assert.strictEqual (#3299)
Stacked on #3298. `assert.equal` from `node:assert` compares with `==`, so for example `assert.equal(1, '1')` passes. Replaces its 153 uses in 13 test files with `assert.strictEqual`. Three of the files import `node:assert/strict`, where the two are the same; the rename keeps the files consistent. No test relied on the loose comparison. This matches the DevTools [`no-assert-equal`](https://source.chromium.org/chromium/chromium/src/+/main:third_party/devtools-frontend/src/scripts/eslint_rules/lib/no-assert-equal.ts) ESLint rule. Its autofix is not used because it rewrites comparisons against object and array literals to `assert.deepEqual`, which is also loose in `node:assert`. ## User-visible changes None. Tests only. ## Testing - `npm run format` - `npm run test` |
||
|
Nikolay Vitkov
|
0174df59a8 |
test: remove manual Sinon restores (#3298)
Stacked on #3297. `tests/setup.ts` runs `sinon.restore()` after every test, so: - Removes the `afterEach` hooks in `ClearcutSender.test.ts` and `DevToolsCommentBridge.test.ts` that restored stubs and fake timers created on the default sandbox. - In `ToolHandler.test.ts` and `input.test.ts`, restores only the stub that has to be reset in the middle of the test instead of calling `sinon.restore()`. - Renames `TestServer.restore()` to `reset()`, including the caller in `scripts/eval_gemini.ts`. It clears the registered routes, and a `restore()` call in `afterEach` reads like a Sinon restore. This matches the DevTools [`no-manual-sinon-restore`](https://source.chromium.org/chromium/chromium/src/+/main:third_party/devtools-frontend/src/scripts/eslint_rules/lib/no-manual-sinon-restore.ts) ESLint rule. When the rule is added, it needs to exempt `tests/setup.ts`, as DevTools does for its own test harness setup files. ## User-visible changes None. Tests and the eval script only. ## Testing - `npm run format` - `npm run test` |
||
|
Nikolay Vitkov
|
920c9133b1 |
test: use sinon.assert for stub call checks (#3297)
Replaces `assert.ok(stub.notCalled)`, `assert.ok(stub.calledOnce)`, `assert.ok(stub.calledWith(...))` and `assert.strictEqual(stub.callCount, n)` with the matching `sinon.assert` methods, as AGENTS.md asks. A failing `sinon.assert` call names the stub and lists the calls it received. The changes are the autofix of the DevTools [`prefer-sinon-assert`](https://source.chromium.org/chromium/chromium/src/+/main:third_party/devtools-frontend/src/scripts/eslint_rules/lib/prefer-sinon-assert.ts) ESLint rule. This is part 1 of a stack that makes the code pass the DevTools custom ESLint rules that apply to this repository. The rules themselves are not added yet. ## User-visible changes None. Tests only. ## Testing - `npm run format` - `npm run test` |
||
 Yuri (IURII) Trukhin
|
10455b7820 |
fix: warn when screenshot dimensions exceed 16384px limit (#2952) (#3291)
When taking a `fullPage` screenshot on a tall page without `--screenshotMaxHeight` or `--screenshotMaxWidth`, Chromium's GPU texture limit (`MAX_CHROMIUM_SCREENSHOT_DIMENSION`) causes content beyond the limit to repeat or corrupt silently. Inspect the source bounding box for `fullPage` and element screenshots in `src/tools/screenshot.ts`, append a warning to the tool response when the effective pixel dimensions exceed `MAX_CHROMIUM_SCREENSHOT_DIMENSION`, and add unit tests in `tests/tools/screenshot.test.ts`. Closes https://github.com/ChromeDevTools/chrome-devtools-mcp/issues/2952 |
||
|
Alex Rudenko
|
d399c4a41e |
feat(slim): support filepath in slim mode screenshot (#3296)
Closes https://github.com/ChromeDevTools/chrome-devtools-mcp/issues/3281 |
||
 mjdch
|
11e7d47495 |
fix: truncate data: URLs in accessibility snapshots (#3292)
## Problem `take_snapshot` printed each node's `url` attribute in full. Images embedded as `data:` URLs (base64 PNG/JPEG/SVG) add up to 10,000 characters per node (Chrome's own cap on this attribute). That data costs tokens and does not help the agent. ## Change - `take_snapshot` truncates `data:` URLs in `url` attributes longer than 255 characters and appends `... <truncated>`, in both the text output and the structured content. - Other URLs (`https:`, etc.) stay whole, since the snapshot is the only place where the agent can read a link's full URL. - The 255-character limit and marker match the network request list. Both formatters now share a new `truncateUrl()` helper in `src/utils/text.ts`. The network request list output does not change. Accessible names are unaffected: Chrome does not derive an image's name from `src`. Images without `alt` keep an empty name; the URL appears only in `url`. ## Benchmark `take_snapshot` output on `main` vs. this branch, in characters. Savings are computed on the same `main` snapshot, since the change only touches `data:` URLs over 255 characters. | Page | Mode | Before | After | Saved | Cause | |---|---|---|---|---|---| | Telerik KendoReact docs | default | 71,479 | 39,085 | 45.3% | 7 base64 SVG icons (up to 10,000 chars) | | Figma.com home | default | 33,246 | 21,121 | 36.5% | 8 base64 PNG/JPEG illustrations (~2,200 chars) | | Amazon.com home | default | 70,652 | 51,192 | 27.5% | 2 base64 JPEG banners (10,000 chars each) | | vite.dev | default | 15,809 | 12,883 | 18.5% | 2 inline SVG data URLs | | W&B Weave docs | verbose | 45,722 | 44,206 | 3.3% | base64 SVG logo | 127 pages tested; 102 loaded (the rest showed bot-check pages to headless Chrome or timed out). The pages above changed; the others are identical. UI libraries that render icons as inline `<svg>` (MUI, Ant Design, Chakra, Mantine, shadcn, Fluent) are not affected, because inline SVG markup is not part of the accessibility tree. ## Testing - New test: `truncates long data url attributes in text and JSON output` (fails on `main`). - New test: `keeps long non-data url attributes in full`. - New tests for `truncateUrl()`. - `npm run test` passes locally (macOS, Chrome for Testing 155). 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
Nikolay Vitkov
|
d575da4e63 |
fix: exclude source maps from the npm package (#3295)
Stacked on #3293. #1948 enabled source maps for local debugging and added `!*.js.map` to `files` in `package.json` to keep them out of the npm package. npm matches a negated `files` entry only at the package root, so the entry never matched the source maps in `build/src`, and the package has included them since then. This PR changes the entry to `!**/*.js.map`, the same form that #3293 uses for `.d.ts` files. The published maps were of little use: they do not embed `sourcesContent`, and the TypeScript sources that they reference are not in the package. ## User-visible changes - The npm package no longer includes `.js.map` files (100 files in a local `npm pack --dry-run`). - The published `.js` files still end with `//# sourceMappingURL=` comments, which now point to files that are not in the package. Tools that load source maps, such as debuggers, can warn that the map is missing. ## Testing - `npm pack --dry-run` lists no `.js.map` files and still lists the `.js` files. - `npm run format` - `npm run test` |
||
|
Nikolay Vitkov
|
2c0931b51a |
chore: enable isolatedDeclarations (#3293)
Stacked on #3290. Enables `isolatedDeclarations` in `tsconfig.json`. The option requires `declaration`, so that is enabled too. `isolatedDeclarations` requires explicit types on exports, so the CLI option types are now declared instead of inferred from the Yargs option objects: - `BrowserArguments`, `PuppeteerArguments`, `ToolArguments`, `CategoryArguments` and `McpArguments` declare the parsed value of each option. `ParsedArguments` is now defined in `mcp-options.ts` from `McpArguments` instead of `InferredOptionTypes<typeof mcpOptions>`. - `McpOptionsFor<TArgs, TBase>` derives the type of an option map from its arguments interface. It checks each option's `type`, `default`, `choices` and `coerce` against the declared value type. A required argument must have a `default`. An optional (`?`) argument has no `default`. - `ParsedArguments` is imported from `mcp-options.ts` everywhere. The re-exports from `ServerConfig.ts` and `ConfigParser.ts` are removed, and so is an unused `McpOption` re-export. - `package.json` excludes the emitted `.d.ts` files from the npm package. npm matches a negated `files` entry such as `!*.d.ts` only at the package root, so the entry is `!**/*.d.ts`. ## User-visible changes None. The option definitions, defaults and generated docs do not change (`npm run gen` produces no diff). `npm pack --dry-run` lists no `.d.ts` files. ## Testing - `npm run format` - `npm run test` - `npm run gen` (no changes) |
||
|
Nikolay Vitkov
|
92c4a55436 |
chore: remove allowJs from tsconfig.json and annotate URLPattern (#3290)
Removes `allowJs` and the `acorn.mjs` entry from `tsconfig.json` (transpiling pre-built DevTools third-party JS/MJS files in `scripts/post-build.ts` instead), updates `rollup.config.js` to discover bundled DevTools `third_party` packages from Rollup chunks and read their metadata/licenses from `README.chromium`, and adds an explicit type annotation to `URLPattern` in `src/third_party/cli.ts` in preparation for enabling `isolatedDeclarations`. |
||
|
Yuri (IURII) Trukhin
|
d7f1e78037 |
fix: surface nested error causes and autoConnect hint on connection failure (#3111)
### Summary 1. Set `autoConnect = true` when connecting via `channel` in `BrowserManager#connect()` so connection failures include the `chrome://inspect/#remote-debugging` hint even when `userDataDir` is not explicitly set. 2. Walk the nested `error.cause` chain in `ToolHandler` so the underlying filesystem error (`Cause: EPERM: operation not permitted, open '.../DevToolsActivePort'`) is surfaced alongside the Puppeteer `DevToolsActivePort` error. 3. Document the macOS `Files & Folders > Google Chrome` TCC permission requirement for `--autoConnect` in `docs/troubleshooting.md`. ### Verification - `npm run build && npm run check-format` - `node --import ./build/tests/setup.js --test build/tests/ToolHandler.test.js` - `node --import ./build/tests/setup.js --test build/tests/browser.test.js` |
||
|
Nikolay Vitkov
|
ece9bca577 |
chore: enforce explicit-module-boundary-types across codebase (#3285)
Enables `@typescript-eslint/explicit-module-boundary-types` in `eslint.config.js`, updates `tsconfig.json`, and adds explicit module-boundary type annotations to the remaining modules and test helpers. The end goal of this stack is to enable TypeScript's `isolatedDeclarations` compiler option across the codebase. No user-visible behavior change. |
||
|
Nikolay Vitkov
|
4d1d7b21c8 |
refactor(tools): add explicit factory types to tool definitions (#3284)
Introduces `ToolSchema`, `ToolFactory`, `PageToolFactory`, and `BrowserlessToolFactory` in `src/tools/ToolDefinition.ts`, streamlines the schema type constraints to use `ToolSchema` consistently, and annotates all exported tool definitions with their factory types. The end goal of this stack is to enable TypeScript's `isolatedDeclarations` compiler option across the codebase. No user-visible behavior change. |
||
 tlq5l
|
4723335294 |
docs: clarify URL pattern port and hostname matching (#3287)
Fixes #2837 Adds one sentence to the `--blockedUrlPattern` and `--allowedUrlPattern` descriptions (src/config/puppeteer-options.ts, and the matching entries in docs/configuration.md) stating the standard URL Pattern semantics: - An omitted port matches only the scheme's default port, so `https://internal.corp/*` does not match `https://internal.corp:8443/`. Use `https://internal.corp:*/*` to match any port. - The hostname must match exactly, so `internal.corp.` (trailing dot) is a different hostname. No behaviour change. Patterns are not normalized: they go unchanged to Chrome via Puppeteer's `blockedUrlPattern`/`allowedUrlPattern` launch options (src/BrowserManager.ts) and to `new URLPattern()` in src/McpContext.ts, so standard URL Pattern matching applies. Verified the examples against `URLPattern` in Node 24. Note: docs/configuration.md was edited by hand to mirror the generated output because `npm run docs:generate` needs the devtools-frontend submodule build. Prettier check passes on both files. Ran live: Node 24.21.0, `new URLPattern("https://internal.corp/*")` matches `https://internal.corp/x` but not `https://internal.corp:8443/x` or `https://internal.corp./x`; `https://internal.corp:*/*` matches `https://internal.corp:8443/x`. |
||
|
Alex Rudenko
|
46eb546ebb |
docs: explain how to install skills, including the CLI skill (#3274)
Stacked on #3273. ## Changes - Add a **Skills** section to the README. It lists all bundled skills. - Explain how to install skills as a plugin in Claude Code, Copilot / VS Code, and Gemini CLI. - Explain how to copy skills manually from the global npm package. - State that the `chrome-devtools-cli` skill requires the globally installed CLI. - Add an **Agent skill** section to `docs/cli.md`. It links to the README. This PR changes documentation only. It does not change tool behavior. |
||
|
Alex Rudenko
|
0ced16b960 |
docs: remove experimental status from CLI and promote it in README (#3273)
## Changes - Remove the "experimental" label from `docs/cli.md`. - Add a **CLI** section to the README with a short usage example. - Add a **CLI** link to the README link bar. - Remove the `--slim` config example from "Getting started". - Add one sentence about `--slim` to the "Configuration" section. This PR changes documentation only. It does not change tool behavior. |