ci: bump @playwright/test from 1.61.1 to 1.62.1 - #423
Conversation
Bumps [@playwright/test](https://github.com/microsoft/playwright) from 1.61.1 to 1.62.1. - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.61.1...v1.62.1) --- updated-dependencies: - dependency-name: "@playwright/test" dependency-version: 1.62.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
Warning Review limit reached
Next review available in: 35 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthrough
ChangesPlaywright 테스트 의존성 업데이트
Estimated code review effort: 1 (매우 간단) | ~2분 Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head review: package.json and package-lock.json consistently update @playwright/test, playwright, and playwright-core from 1.61.1 to 1.62.1, with the expected Node >=20 engine floor that remains compatible with ScopeWeave's Node 22.13+ runtime. Approved subject to a clean base update and all required checks after the Hono security fix lands.
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Reviewed exact head c734fc296ae173c73523b17669b6f8d6657a448e. The change is limited to the lock/manifest update from Playwright 1.61.1 to 1.62.1, preserves immutable npm integrity metadata, and raises no production runtime dependency. Approved subject to rebasing onto the Hono 4.13.0 protected base and passing the exact-head browser, security, and central review gates.
|
@coderabbitai review |
✅ Action performedReview finished.
|
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head dependency review reconfirmed. Playwright 1.62.1 and the lockfile remain internally consistent, fit the repository's supported Node runtime, and are confined to the test toolchain. No actionable finding remains.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
c734fc296ae173c73523b17669b6f8d6657a448e. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Security Scan/trivy-fs: FAILURE (https://github.com/ContextualWisdomLab/scopeweave/actions/runs/30885374026/job/91915305868)
- trivy-fs check run: failure (https://github.com/ContextualWisdomLab/scopeweave/actions/runs/30885374026/job/91915305868)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
OpenCode Review Overview
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
|
|
@coderabbitai review Protected commercial-readiness pass reconfirmed exact head |
|
✅ Action performedReview finished.
|
|
@coderabbitai review @OpenCode review Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="24c86489800ef4405e737a8e3d5bc3d54d7628dd"
head="767f4223e284f4254c40653fe3dbc56591d27d89"
git rev-parse --verify "${base}^{commit}"
git rev-parse --verify "${head}^{commit}"
git merge-base --is-ancestor "$base" "$head"
git diff --stat "${base}..${head}"
git diff --name-status "${base}..${head}"
git log --oneline "${base}..${head}"Length of output: 866 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="24c86489800ef4405e737a8e3d5bc3d54d7628dd"
head="767f4223e284f4254c40653fe3dbc56591d27d89"
git diff --find-renames --find-copies --unified=80 "${base}..${head}" -- package.json package-lock.json
printf '\n--- package manifests ---\n'
fd -HI '^(package(-lock)?\.json|npm-shrinkwrap\.json)$' . \
-E node_modules -E .git \
-x sh -c 'printf "\n### %s\n" "$1"; grep -nE "\"(`@playwright/test`|playwright|playwright-core|hono)\"" "$1" || true' sh {}
printf '\n--- changed lockfile package entries ---\n'
git diff --unified=8 "${base}..${head}" -- package-lock.json \
| grep -nE '(^[+-].*"node_modules/(`@playwright/test`|playwright|playwright-core|hono)|^[+-].*"version"|^[+-].*"resolved"|^[+-].*"integrity"|^[+-].*"`@playwright/test`"|^[+-].*"playwright-core"|^[+-].*"hono")' \
|| trueLength of output: 19266
I found no actionable issues.
|
|
@opencode-agent review Please submit a current-head independent review for exact |
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: APPROVE for the devDependency-only bump in package.json:29 (@playwright/test 1.62.1) with matching package-lock.json updates at line 15 (root devDependencies) and lines for @playwright/test/playwright/playwright-core (all 1.62.1, new integrity hashes, Apache-2.0 kept, dev:true retained); changed-file evidence inspected: package.json and package-lock.json focused hunks. Verification posture: no OPENCODE_EXECUTION_RECEIPT in bounded evidence; precomputed Coverage execution evidence reports Result: PASS with supported repository test suites passed; Failed GitHub Check evidence reports no completed failed checks at head 767f422. Linter/static: no lint findings; only hadolint Dockerfile is configured and no Dockerfile changed. TDD/regression: dependency-only change; the repo E2E/unit suites (npm run test:e2e, npm run test:unit) serve as the regression net and fall under the PASS coverage decision. Coverage: Coverage execution evidence — Result: PASS, supported repository test suites passed. Docstring coverage: configured repository docstring gates passed or advisory per Coverage execution evidence. DAG: dependency-flow flowchart (package.json devDependencies -> package-lock.json root entry -> @playwright/test -> playwright -> playwright-core -> npm test:e2e/test:unit on CI Node 22.13.0) reflecting the head state of the changed surface. PoC/execution: no execution receipts available; verdict rests on trusted diff/lockfile/check/coverage evidence, no runtime claim made. DDD/domain: no domain code changed; test-toolchain-only surface. CDD/context: no context/bounded-context change; CodeGraph blast radius (pathOf tests/api/smoke.mjs:324, currentOrgId cloud-sync.js:15) is unrelated to and untouched by this PR. Similar issues: prior dependabot bump PR #195 (1.59.1->1.61.1) follows the same manifest+lockfile pattern; no unresolved review threads exist. Claim/concept check: PR title/body claim matches the diff exactly; upstream 1.62.1 bug-fix release notes not independently verifiable offline (source limitation). Standards search: no new standards material; Node engine floor >=20 is compatible with the repo engines contract and CI Node 22.13.0 per workflow_versions evidence. Compatibility/convention: naming/reserved-word review N/A because no schema/API/config identifiers were added or renamed; lockfileVersion 3 and manifest conventions preserved. Breaking-change/backcompat: no production runtime dependency touched; devDependency bump engine floor satisfied by the repo runtime. Performance: no production code path affected. Developer experience: DX surface is the E2E test toolchain (npm run test:e2e / test:fuzz); Playwright 1.62.1 runs on repo Node 22.13.0 with no config changes required. User experience: UX surface unaffected; no user-visible behavior changed. Visual/DOM: no web UI changed; the non-web surface reviewed is the npm manifest/lockfile. Accessibility/i18n: no UI/a11y surface changed. Supply-chain/license: all three bumped packages keep Apache-2.0 and dev:true; production deps @hono/node-server ^2.0.12 and hono ^4.13.1 unchanged; security command npm audit --audit-level=high shows no failed-check report. Packaging: npm manifest and lockfile are internally consistent (lockfileVersion 3, integrity hashes present for every updated entry). Security/privacy: no runtime or security boundary touched; no identifier-exposure or naming surface changed.
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including package-lock.json, package.json.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects package-lock.json to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source claims require trusted bounded source evidence prepared outside the isolated model process; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
Adversarial validation
{"status":"passed","probes":[{"path":"package.json","line":29,"hypothesis":"Playwright 1.62.1's raised Node >=20 engine floor breaks the repository runtime and CI installs","attack_or_counterexample":"Dependency/runtime mismatch: check the repo engines contract and CI Node pins against the new floor","evidence":"Trusted source/diff evidence at package.json:29 shows the devDependency pinned to 1.62.1 while the package engines contract stays ^22.13.0 || >=23.4.0 (focused hunk, unchanged), and Review execution contracts workflow_versions evidence pins CI Node at 22.13.0 (.github/workflows/fuzz.yml, server-tests.yml); 22.13.0 satisfies the >=20 floor shown in the package-lock.json:612 hunk, so the runtime mismatch hypothesis was rejected; source-line-sha256=2d215a9f90bf5e892c5337ea3d9e0af3694ce7a460be91457600320e6d00e417","outcome":"falsified"},{"path":"package-lock.json","line":15,"hypothesis":"package.json and package-lock.json disagree on the pinned version, breaking npm ci / E2E test resolution","attack_or_counterexample":"Lockfile drift: compare root lockfile entry vs manifest and trace the dependency chain and integrity hashes","evidence":"Trusted diff evidence at package-lock.json:15 shows the root packages[''].devDependencies entry updated to @playwright/test 1.62.1, matching package.json:29, with the full chain @playwright/test 1.62.1 -> playwright 1.62.1 -> playwright-core 1.62.1 all carrying fresh integrity hashes, so version/integrity resolution is internally consistent; Coverage execution evidence reports Result: PASS with supported repository test suites passed, rejecting the drift hypothesis; source-line-sha256=6547d94668f8515442770f8b5111a749ec48037a287ad471c7dbd26e845b9264","outcome":"falsified"},{"path":"package-lock.json","line":612,"hypothesis":"The bump alters production dependencies or introduces a license/supply-chain regression","attack_or_counterexample":"Supply-chain check: verify dev-only markers, licenses, and production dependency graph after the bump","evidence":"Trusted diff evidence at package-lock.json:612 (playwright-core engines entry) and the focused hunks show the three updated entries retain \"dev\": true and Apache-2.0 while production dependencies @hono/node-server ^2.0.12 and hono ^4.13.1 are unchanged; Failed GitHub Check evidence reports no completed failed checks at head 767f4223, so no security-audit failure was recorded, rejecting the supply-chain regression hypothesis; source-line-sha256=97174887051335dc6b6dd35897d211dbfae828aaeb79c6cce379ebd0741007b4","outcome":"falsified"}],"residual_risk":"Playwright 1.62.1 runtime behavior differences in E2E tests were not exercised by an execution receipt in this isolated review; mitigated by the precomputed coverage PASS, internally consistent lockfile, and absence of failed checks or unresolved threads at the current head."}- Result: APPROVE
- Reason: DevDependency-only @playwright/test 1.61.1 to 1.62.1 bump with an internally consistent lockfile (root entry, @playwright/test, playwright, playwright-core all 1.62.1 with fresh integrity hashes); the raised Node >=20 engine floor is satisfied by the repo engines contract (^22.13.0 || >=23.4.0) and CI Node 22.13.0; production deps unchanged; no failed checks, no unresolved threads, coverage PASS at head 767f422.
- Head SHA:
767f4223e284f4254c40653fe3dbc56591d27d89 - Workflow run: 31565281507
- Workflow attempt: 1
4c96777
into
fix/hono-cves-2026-69207-71848-71850
1 participant
Bumps @playwright/test from 1.61.1 to 1.62.1.
Release notes
Sourced from @playwright/test's releases.
... (truncated)
Commits
26a9e47cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...0a81d5dcherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...8376826cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...66c5cc9chore: mark v1.62.1 (#42020)9672bc3cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...4325804cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors9632f8echerry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...e3950d9chore: mark v1.62.0 (#41981)f07e0f7cherry-pick(#41940): docs: release notes for v1.62 (#41967)05a306ccherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit
CWL stacked exact-head evidence
767f4223e284f4254c40653fe3dbc56591d27d89.fix/hono-cves-2026-69207-71848-71850@24c86489800ef4405e737a8e3d5bc3d54d7628dd.767f422records fix(security): upgrade Hono past 2026 CVEs #469 as an explicit second parent so repository-wide scanners evaluate the remediated Hono tree.package.jsonandpackage-lock.json; Hono changes belong to fix(security): upgrade Hono past 2026 CVEs #469 and are absent from this PR's effective diff.