[dependabot]

Bumps the minor-and-patch group in /mcp/flight_tool with 2 updates: playwright and authlib.

Updates playwright from 1.63.0 to 1.64.0

Release notes

Sourced from playwright's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

browser = chromium.launch(args=["--enable-features=WebMCP"])
page = browser.new_page()
page.goto("https://example.com")
for tool in page.webmcp.tools():
print(tool["name"], tool["description"])
result = page.webmcp.call_tool("add", {"a": 2, "b": 40})
print(result["content"][0]["text"])  # "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

page.screencast.start(path="video.webm", size={"width": 1920, "height": 1080}, fps=60)
page.screencast.show_actions(
    style={
        "point": "width: 20px; height: 20px; border-radius: 50%; background: red",
        "highlight": "outline: 2px solid [#333](https://github.com/microsoft/playwright-python/issues/333); background: rgba(0, 128, 255, .15)",
        "title": "font-size: 16px",
    }
)

• New record_video_fps option and new fps option in screencast.start(). Firefox and WebKit currently capture up to 25 frames per second.
• New style option takes CSS declarations for the point marker, the target highlight and the action title. It replaces the font_size option, which is now deprecated.
• The cursor stays visible at the last action point, survives navigations and travels along a natural, eased path.
• Videos are encoded with VP9 instead of VP8, which takes less CPU and produces smaller files of the same or better quality.

... (truncated)

Commits

• 387a8a9 cherry-pick(#3252): devops: publish to PyPI from GitHub Actions with trusted ...
• 71d2a17 chore: roll Playwright to v1.64.0 (#3251)
• d566fc5 fix(fetch): JSON-stringify NaN and Infinity string data (#3249)
• 2959d19 docs(skills): add a skill to prepare a release (#3250)
• 5313ac2 fix(network): keep blank values in Request.post_data_json for form bodies (#3...
• 9d8c50f chore(codegen): use alphabetical order in the generated API (#3242)
• 478282f chore(codegen): generate the public TypedDicts from the docs (#3247)
• b8b7155 fix: raise Error instead of assert for user input validation (#3245)
• 1de5d37 fix(network): do not add missing headers when looking them up (#3246)
• 222a2e0 chore(codegen): type _impl_obj in the generated API (#3241)
• Additional commits viewable in compare view

Updates authlib from 1.8.0 to 1.9.1

Release notes

Sourced from authlib's releases.

v1.9.1

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1

What's Changed

• Use scriv to handle the changelog by @​azmeuk in authlib/authlib#954

Full Changelog: authlib/authlib@v1.9.0...v1.9.1

v1.9.0

What's Changed

• feat: add Identity Assertion JWT Authorization Grant (ID-JAG) by @​BinoyOza-okta in authlib/authlib#898
• Fix empty signatures validation in JWS JSON deserialization by @​loporto in authlib/authlib#938
• fix(jose): reject boolean values for NumericDate claims by @​cpruijsen in authlib/authlib#942
• fix(client): avoid duplicated OAuth 1.0 parameters in signed requests by @​cpruijsen in authlib/authlib#943
• OAuth2 token fetch crashes with JSONDecodeError instead of a catchable error on rate-limit responses by @​juneja-varun in authlib/authlib#929
• docs: add i18n wrappers in conf.py and templates by @​hwhsu1231 in authlib/authlib#901
• fix(oauth): enforce JOSE key, scope, and audience validation by @​lepture in authlib/authlib#945
• AsyncOpenIDMixin.parse_id_token: return None when id_token is absent, matching the sync client by @​ckarnell in authlib/authlib#924
• fix(oauth): enforce nonce and JAR request validation by @​lepture in authlib/authlib#949
• fix(oauth): require client authentication for ID-JAG grants by @​lepture in authlib/authlib#955

New Contributors

• @​BinoyOza-okta made their first contribution in authlib/authlib#898
• @​loporto made their first contribution in authlib/authlib#938
• @​cpruijsen made their first contribution in authlib/authlib#942
• @​juneja-varun made their first contribution in authlib/authlib#929
• @​hwhsu1231 made their first contribution in authlib/authlib#901
• @​ckarnell made their first contribution in authlib/authlib#924

Full Changelog: authlib/authlib@v1.8.0...v1.9.0

Commits

• 46b9487 chore: release 1.9.1
• abb3f49 docs: use the issuer identifier as ID-JAG audience and fix broken links
• 1bd2a31 Merge commit from fork
• 311da11 docs: more detailed PKCE instructions
• 873f72c docs: rpinitiated instructions
• 4ff30db Merge commit from fork
• 9a86ff3 docs: rpinitiated sequence chart
• 1c35757 docs: RFC 9101 sequence chart
• a755e28 docs: add a sequence diagram to the token introspection page
• 1996c56 docs: PKCE flow chart illustration
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions