diff --git a/.yarnrc.yml b/.yarnrc.yml index af1839058..c469d2200 100644 --- a/.yarnrc.yml +++ b/.yarnrc.yml @@ -7,21 +7,6 @@ nodeLinker: node-modules # and CI audit — the matching alert must also be dismissed on GitHub (Security -> # Dependabot alerts) with the same reasoning, otherwise the two views disagree. npmAuditIgnoreAdvisories: - # playwright, GHSA-7mvr-c777-76hp. Browsers are downloaded without verifying the SSL - # certificate; fixed in 1.55.1. - # - # @playwright/test is deliberately pinned to 1.55.0, because 1.55.1 also bumps the bundled - # Chromium from build 1187 to 1193, and the 211 committed screenshots are compared with - # threshold: 0 — a different browser build invalidates all of them. Upgrading therefore - # belongs in its own pull request, where regenerating the baselines via /approve-snapshots - # is the expected, reviewable outcome rather than noise inside an unrelated change. - # - # Scope of the risk: development only, at install time, over HTTPS to Microsoft's CDN. It - # does not reach the published packages. - # - # Remove this entry together with that upgrade. - - '1109208' - # brace-expansion, GHSA-mh99-v99m-4gvg. # Upstream patched only the 5.x line, but the advisory range (<=5.0.7) is flat across # majors, so the already-patched 1.1.18 and 2.1.4 releases are still reported. diff --git a/package.json b/package.json index efd70ea79..6e8b9d6af 100644 --- a/package.json +++ b/package.json @@ -73,7 +73,7 @@ "@messageformat/core": "^3.4.0", "@microsoft/api-extractor": "7.58.9", "@octokit/rest": "^22.0.1", - "@playwright/test": "1.55.0", + "@playwright/test": "1.62.1", "@prettier/plugin-xml": "^3.4.2", "@rollup/plugin-commonjs": "^24.0.0", "@rollup/plugin-json": "^6.0.0", diff --git a/playwright.config.ts b/playwright.config.ts index 376270c25..67a27f94c 100644 --- a/playwright.config.ts +++ b/playwright.config.ts @@ -34,9 +34,9 @@ export default defineConfig({ expect: { // These baselines are compared with threshold: 0, so they are tied to one exact browser // build. @playwright/test is pinned to an exact version in package.json for that reason: - // even a patch release can bump the bundled Chromium (1.55.0 ships build 1187, 1.55.1 - // ships 1193) and invalidate every screenshot. Upgrade it on its own branch and refresh - // the baselines with /approve-snapshots in the same pull request. + // even a patch release can bump the bundled Chromium — 1.55.0 shipped build 1187 and + // 1.55.1 shipped 1193 — and that invalidates every screenshot. Upgrade it on its own + // branch and refresh the baselines with /approve-snapshots in the same pull request. toHaveScreenshot: { pathTemplate: '{testFileDir}/__screenshots__/{arg}{ext}', threshold: 0, diff --git a/yarn.lock b/yarn.lock index 3d379e47d..00945056b 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5958,14 +5958,14 @@ __metadata: languageName: node linkType: hard -"@playwright/test@npm:1.55.0": - version: 1.55.0 - resolution: "@playwright/test@npm:1.55.0" +"@playwright/test@npm:1.62.1": + version: 1.62.1 + resolution: "@playwright/test@npm:1.62.1" dependencies: - playwright: "npm:1.55.0" + playwright: "npm:1.62.1" bin: playwright: cli.js - checksum: 10c0/e68b59cd8271f1b57c0649fc0562ab2d5f6bba8c3653dd7bd52ca1338dc380fde34588d0254e3cd3f0f2b20af04a80dfb080419ceb7475990bb2fc4d8c474984 + checksum: 10c0/4b76f2f717723f84a73601f74fde97f5d92e4b5c869cf87c0f5628bf247fa1d18c9dc6c8e136463303233239e8ce58f902513d4281a9fabc3c426e911ded2c83 languageName: node linkType: hard @@ -13598,7 +13598,7 @@ __metadata: "@messageformat/core": "npm:^3.4.0" "@microsoft/api-extractor": "npm:7.58.9" "@octokit/rest": "npm:^22.0.1" - "@playwright/test": "npm:1.55.0" + "@playwright/test": "npm:1.62.1" "@prettier/plugin-xml": "npm:^3.4.2" "@rollup/plugin-commonjs": "npm:^24.0.0" "@rollup/plugin-json": "npm:^6.0.0" @@ -15658,27 +15658,27 @@ __metadata: languageName: node linkType: hard -"playwright-core@npm:1.55.0": - version: 1.55.0 - resolution: "playwright-core@npm:1.55.0" +"playwright-core@npm:1.62.1": + version: 1.62.1 + resolution: "playwright-core@npm:1.62.1" bin: playwright-core: cli.js - checksum: 10c0/c39d6aa30e7a4e73965942ca5e13405ae05c9cb49f755a35f04248c864c0b24cf662d9767f1797b3ec48d1cf4e54774dce4a19c16534bd5cfd2aa3da81c9dc3a + checksum: 10c0/a37d0f03bb73364cfd0eba704c4b3359b609c4779ae2649a88d8e2b3a29c7357dfcc58bdcf0cb68ddffdef7687abf78902c8356e89f189682c7e19be38e108f0 languageName: node linkType: hard -"playwright@npm:1.55.0": - version: 1.55.0 - resolution: "playwright@npm:1.55.0" +"playwright@npm:1.62.1": + version: 1.62.1 + resolution: "playwright@npm:1.62.1" dependencies: fsevents: "npm:2.3.2" - playwright-core: "npm:1.55.0" + playwright-core: "npm:1.62.1" dependenciesMeta: fsevents: optional: true bin: playwright: cli.js - checksum: 10c0/51605b7e57a5650e57972c5fdfc09d7a9934cca1cbee5beacca716fa801e25cb5bb7c1663de90c22b300fde884e5545a2b13a0505a93270b660687791c478304 + checksum: 10c0/4d3522cd46325f50c46f8874d31f70d036f6983228a9f8b9d68fc249e4c17464edcd97cc4adfbb24e712d1829c1386d3bc24e17f58a1ced94e7c423300c21845 languageName: node linkType: hard