From 35bd2011ba2e5eea2beaec231d5e90c641e139ac Mon Sep 17 00:00:00 2001 From: lskramarov Date: Wed, 5 Aug 2026 18:07:57 +0300 Subject: [PATCH] chore(deps-dev): bump @playwright/test from 1.55.0 to 1.62.1 (#DS-5215) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Resolves GHSA-7mvr-c777-76hp / CVE-2025-59288 (high): browsers were downloaded without verifying the SSL certificate, fixed in 1.55.1. The advisory had been parked in `npmAuditIgnoreAdvisories` precisely because the upgrade could not ride along inside an unrelated change; that entry goes away with it. 1.62.1 rather than the minimal 1.55.1: the screenshot cost is identical either way, since any release past 1.55.0 bumps the bundled Chromium and the baselines are compared with `threshold: 0`. Taking the latest buys seven minor releases for the same single regeneration. Bundled Chromium moves from 140.0.7339.16 to 151.0.7922.34, so all 215 committed screenshots are regenerated in this pull request via /approve-snapshots. None of the APIs removed between 1.56 and 1.62 are used here: the suite only touches `test`, `expect`, `Page`, `Locator`, `page.evaluate` and `toHaveScreenshot`. Verified locally against Chromium 151 and WebKit 26.5 — every failure is a screenshot mismatch (expected: the baselines are Linux), with no behavioural regression. In particular the clipboard round-trip in textarea still works under the headless clipboard isolation introduced in 1.62. --- .yarnrc.yml | 15 --------------- package.json | 2 +- playwright.config.ts | 6 +++--- yarn.lock | 30 +++++++++++++++--------------- 4 files changed, 19 insertions(+), 34 deletions(-) diff --git a/.yarnrc.yml b/.yarnrc.yml index af1839058..c469d2200 100644 --- a/.yarnrc.yml +++ b/.yarnrc.yml @@ -7,21 +7,6 @@ nodeLinker: node-modules # and CI audit — the matching alert must also be dismissed on GitHub (Security -> # Dependabot alerts) with the same reasoning, otherwise the two views disagree. npmAuditIgnoreAdvisories: - # playwright, GHSA-7mvr-c777-76hp. Browsers are downloaded without verifying the SSL - # certificate; fixed in 1.55.1. - # - # @playwright/test is deliberately pinned to 1.55.0, because 1.55.1 also bumps the bundled - # Chromium from build 1187 to 1193, and the 211 committed screenshots are compared with - # threshold: 0 — a different browser build invalidates all of them. Upgrading therefore - # belongs in its own pull request, where regenerating the baselines via /approve-snapshots - # is the expected, reviewable outcome rather than noise inside an unrelated change. - # - # Scope of the risk: development only, at install time, over HTTPS to Microsoft's CDN. It - # does not reach the published packages. - # - # Remove this entry together with that upgrade. - - '1109208' - # brace-expansion, GHSA-mh99-v99m-4gvg. # Upstream patched only the 5.x line, but the advisory range (<=5.0.7) is flat across # majors, so the already-patched 1.1.18 and 2.1.4 releases are still reported. diff --git a/package.json b/package.json index efd70ea79..6e8b9d6af 100644 --- a/package.json +++ b/package.json @@ -73,7 +73,7 @@ "@messageformat/core": "^3.4.0", "@microsoft/api-extractor": "7.58.9", "@octokit/rest": "^22.0.1", - "@playwright/test": "1.55.0", + "@playwright/test": "1.62.1", "@prettier/plugin-xml": "^3.4.2", "@rollup/plugin-commonjs": "^24.0.0", "@rollup/plugin-json": "^6.0.0", diff --git a/playwright.config.ts b/playwright.config.ts index 376270c25..67a27f94c 100644 --- a/playwright.config.ts +++ b/playwright.config.ts @@ -34,9 +34,9 @@ export default defineConfig({ expect: { // These baselines are compared with threshold: 0, so they are tied to one exact browser // build. @playwright/test is pinned to an exact version in package.json for that reason: - // even a patch release can bump the bundled Chromium (1.55.0 ships build 1187, 1.55.1 - // ships 1193) and invalidate every screenshot. Upgrade it on its own branch and refresh - // the baselines with /approve-snapshots in the same pull request. + // even a patch release can bump the bundled Chromium — 1.55.0 shipped build 1187 and + // 1.55.1 shipped 1193 — and that invalidates every screenshot. Upgrade it on its own + // branch and refresh the baselines with /approve-snapshots in the same pull request. toHaveScreenshot: { pathTemplate: '{testFileDir}/__screenshots__/{arg}{ext}', threshold: 0, diff --git a/yarn.lock b/yarn.lock index 3d379e47d..00945056b 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5958,14 +5958,14 @@ __metadata: languageName: node linkType: hard -"@playwright/test@npm:1.55.0": - version: 1.55.0 - resolution: "@playwright/test@npm:1.55.0" +"@playwright/test@npm:1.62.1": + version: 1.62.1 + resolution: "@playwright/test@npm:1.62.1" dependencies: - playwright: "npm:1.55.0" + playwright: "npm:1.62.1" bin: playwright: cli.js - checksum: 10c0/e68b59cd8271f1b57c0649fc0562ab2d5f6bba8c3653dd7bd52ca1338dc380fde34588d0254e3cd3f0f2b20af04a80dfb080419ceb7475990bb2fc4d8c474984 + checksum: 10c0/4b76f2f717723f84a73601f74fde97f5d92e4b5c869cf87c0f5628bf247fa1d18c9dc6c8e136463303233239e8ce58f902513d4281a9fabc3c426e911ded2c83 languageName: node linkType: hard @@ -13598,7 +13598,7 @@ __metadata: "@messageformat/core": "npm:^3.4.0" "@microsoft/api-extractor": "npm:7.58.9" "@octokit/rest": "npm:^22.0.1" - "@playwright/test": "npm:1.55.0" + "@playwright/test": "npm:1.62.1" "@prettier/plugin-xml": "npm:^3.4.2" "@rollup/plugin-commonjs": "npm:^24.0.0" "@rollup/plugin-json": "npm:^6.0.0" @@ -15658,27 +15658,27 @@ __metadata: languageName: node linkType: hard -"playwright-core@npm:1.55.0": - version: 1.55.0 - resolution: "playwright-core@npm:1.55.0" +"playwright-core@npm:1.62.1": + version: 1.62.1 + resolution: "playwright-core@npm:1.62.1" bin: playwright-core: cli.js - checksum: 10c0/c39d6aa30e7a4e73965942ca5e13405ae05c9cb49f755a35f04248c864c0b24cf662d9767f1797b3ec48d1cf4e54774dce4a19c16534bd5cfd2aa3da81c9dc3a + checksum: 10c0/a37d0f03bb73364cfd0eba704c4b3359b609c4779ae2649a88d8e2b3a29c7357dfcc58bdcf0cb68ddffdef7687abf78902c8356e89f189682c7e19be38e108f0 languageName: node linkType: hard -"playwright@npm:1.55.0": - version: 1.55.0 - resolution: "playwright@npm:1.55.0" +"playwright@npm:1.62.1": + version: 1.62.1 + resolution: "playwright@npm:1.62.1" dependencies: fsevents: "npm:2.3.2" - playwright-core: "npm:1.55.0" + playwright-core: "npm:1.62.1" dependenciesMeta: fsevents: optional: true bin: playwright: cli.js - checksum: 10c0/51605b7e57a5650e57972c5fdfc09d7a9934cca1cbee5beacca716fa801e25cb5bb7c1663de90c22b300fde884e5545a2b13a0505a93270b660687791c478304 + checksum: 10c0/4d3522cd46325f50c46f8874d31f70d036f6983228a9f8b9d68fc249e4c17464edcd97cc4adfbb24e712d1829c1386d3bc24e17f58a1ced94e7c423300c21845 languageName: node linkType: hard