chore(deps): bump the testing-and-build group across 1 directory with 2 updates

[dependabot]

Bumps the testing-and-build group with 2 updates in the /packages/dd-trace/test/plugins/versions directory: next and selenium-webdriver.

Updates next from 16.3.2 to 16.3.3

Release notes

Sourced from next's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Commits

• a9a1cb7 v16.3.3
• 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
• 3a15b4a [16.3.x] [next/image]: disable avif image optimization
• 7378b51 Backport/docs fixes 16.3 (#97649)
• 528c1cd [16.3.x] Stop generating error codes (#97780)
• See full diff in compare view

Updates selenium-webdriver from 4.47.0 to 4.48.0

Release notes

Sourced from selenium-webdriver's releases.

Selenium 4.48.0

Detailed Changelogs by Component

Java     |     Python     |     DotNet     |     Ruby     |     JavaScript

What's Changed

• [js] Normalize empty custom locator results by @​munawiki in SeleniumHQ/selenium#17851
• [py]: fix W3C capabilities built from a list of options (create_matches) by @​navin772 in SeleniumHQ/selenium#17897
• [rb] add low-level BiDi protocol integration specs by @​titusfortner in SeleniumHQ/selenium#17878
• Fix badge for CI build on the default branch by @​nvborisenko in SeleniumHQ/selenium#17901
• [py] Fix broken reStructuredText link in docs by @​cgoldberg in SeleniumHQ/selenium#17902
• [grid] stop forwarding se:remoteUrl past the Node that consumes it by @​titusfortner in SeleniumHQ/selenium#17908
• [grid] Forward file upload/download for Kubernetes, Docker and relay sessions by @​VietND96 in SeleniumHQ/selenium#17914
• [build] reduce github cache churn and aggressively prune CodeQL caches by @​titusfortner in SeleniumHQ/selenium#17909
• [java] fix two flaky BiDi tests that left timing-dependent state behind by @​titusfortner in SeleniumHQ/selenium#17918
• [java] Add warn annotation for undeclared field while JSON coercion by @​pujagani in SeleniumHQ/selenium#17917
• [py] temporarily disable nightly TestPyPI publishing by @​titusfortner in SeleniumHQ/selenium#17920
• [rb] fix Safari test failures by @​titusfortner in SeleniumHQ/selenium#17922
• [build] fix the issues that caused the release workflow to fail during last release by @​titusfortner in SeleniumHQ/selenium#17921
• Revert "[py] temporarily disable nightly TestPyPI publishing (#17920)" by @​diemol in SeleniumHQ/selenium#17924
• [rb] fix silent hang on oversized WebSocket frames by @​aguspe in SeleniumHQ/selenium#17655
• [js] Ensure BiDi is not exposed on Driver by @​pujagani in SeleniumHQ/selenium#17926
• [docs] charter: link the accepted BiDi support boundary record by @​AutomatedTester in SeleniumHQ/selenium#17928
• Honour the DO_NOT_TRACK env var by @​shs96c in SeleniumHQ/selenium#17931
• [build] record flaky tests on trunk and report weekly offenders to Slack by @​titusfortner in SeleniumHQ/selenium#17930
• [build] ignore .bazelbsp/ IDE-generated directory by @​diemol in SeleniumHQ/selenium#17932
• [adr] Install browser extensions from the driver directly by @​titusfortner in SeleniumHQ/selenium#17817
• [py] generate the internal BiDi protocol layer from the shared binding-neutral schema by @​titusfortner in SeleniumHQ/selenium#17761
• [rb] always reject a missing required inbound BiDi field by @​titusfortner in SeleniumHQ/selenium#17936
• [build] make Java and .NET release reruns pass when already published by @​titusfortner in SeleniumHQ/selenium#17935
• [build] Move dependency updates into a weekly workflow by @​titusfortner in SeleniumHQ/selenium#17934
• [rb] accept a whole-valued float for an integer BiDi field by @​titusfortner in SeleniumHQ/selenium#17939
• [build] unlock trunk once the release finishes writing to it by @​titusfortner in SeleniumHQ/selenium#17938
• [js] Add serialization and domain layer by @​pujagani in SeleniumHQ/selenium#17927
• [build] stop updating browsers and CDP during release preparation by @​titusfortner in SeleniumHQ/selenium#17940
• [py] update new BiDi layer generation to conform to latest proposed ADR by @​titusfortner in SeleniumHQ/selenium#17942
• [dotnet] [bidi] Throw in case of unknown discriminator by @​nvborisenko in SeleniumHQ/selenium#17948
• [rb] reject an inbound BiDi scalar outside its union's declared arms by @​titusfortner in SeleniumHQ/selenium#17947
• [build] alert Slack when a CDP update lands on trunk by @​titusfortner in SeleniumHQ/selenium#17950
• [js][bidi] Add BiDi connection-level event subscription by @​pujagani in SeleniumHQ/selenium#17946
• [dotnet] [bidi] SetMediaFeaturesOverride command in Emulation module by @​nvborisenko in SeleniumHQ/selenium#17953

New Contributors

• @​munawiki made their first contribution in SeleniumHQ/selenium#17851

Full Changelog: SeleniumHQ/selenium@selenium-4.47.0...selenium-4.48.0

Commits

• 27f5213 [build] Prepare for release of selenium-4.48.0 (#17956)
• 857ff4f [build] remove cddl updates from release preparation
• 2183264 [dotnet] [bidi] SetMediaFeaturesOverride command in Emulation module (#17953)
• 5fd1f41 [build] unlock trunk when release preparation PR is closed without merging
• 5b053b5 [js][bidi] Add BiDi connection-level event subscription (#17946)
• 498c0e7 [build] alert Slack when a CDP update lands on trunk (#17950)
• 7bfaedb [rb] reject an inbound BiDi scalar outside its union's declared arms (#17947)
• 083869c [dotnet] [bidi] Throw in case of unknown discriminator (#17948)
• 5b3666d [py] update new BiDi layer generation to conform to latest proposed ADR (#17942)
• a4b3c3d [build] stop updating browsers and CDP during release preparation (#17940)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dd-octo-sts]

Overall package size

Self size: 8.56 MB
Deduped: 9.23 MB
No deduping: 9.23 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.3.3 | 125.43 kB | 445.14 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

[pr-commenter]

Benchmarks

Benchmark execution time: 2026-08-31 01:13:38

Comparing candidate commit dff86f3 in PR branch dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/testing-and-build-1673aba856 with baseline commit 4d9ea3d in branch master.

📊 Benchmarking dashboard

Found 1 performance improvements and 0 performance regressions! Performance is the same for 2297 metrics, 12 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

• 🟩 = significantly better candidate vs. baseline
• 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:encoders-0.4-events-native-20

• 🟩 max_rss_usage [-11.408MB; -3.634MB] or [-8.049%; -2.564%]

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-20

• unstable max_rss_usage [-16.450MB; +6.134MB] or [-9.422%; +3.514%]

scenario:debugger-line-probe-with-snapshot-minimal-24

• unstable max_rss_usage [-18.094MB; +12.369MB] or [-7.298%; +4.989%]

scenario:dogstatsd-with-tags-20

• unstable cpu_user_time [-154.986ms; +451.063ms] or [-3.179%; +9.252%]
• unstable execution_time [-154.030ms; +451.175ms] or [-3.110%; +9.108%]
• unstable throughput [-154900.604op/s; +50792.389op/s] or [-9.151%; +3.000%]

scenario:plugin-claude-agent-sdk-compact-stream-scan-24

• unstable cpu_usage_percentage [-5.633%; +5.304%]

scenario:plugin-graphql-long-with-depth-off-20

• unstable max_rss_usage [-6.681MB; +9.092MB] or [-5.300%; +7.213%]

scenario:plugin-graphql-long-with-depth-on-max-20

• unstable max_rss_usage [-6.834MB; +11.804MB] or [-3.761%; +6.496%]

scenario:plugin-memcached-hashring-26

• unstable cpu_user_time [-231.474ms; +359.115ms] or [-9.513%; +14.758%]
• unstable execution_time [-231.731ms; +358.055ms] or [-9.261%; +14.310%]
• unstable throughput [-1311715.083op/s; +861325.025op/s] or [-8.511%; +5.589%]

scenario:test-optimization-large-suite-20

• unstable max_rss_usage [-5273.266KB; +3630.599KB] or [-6.602%; +4.545%]