Repository navigation
[CLNP-9036][fix]: bump @playwright/test to 1.64.1 - #1482
Conversation
Update @playwright/test from 1.57.0 to 1.64.1 in yarn.lock, within the declared range. playwright and playwright-core move with it, because each pins the next exactly. playwright 1.64.1 no longer depends on fsevents 2.3.2, so that entry and its patch entry are removed; other packages keep fsevents 2.3.3. Raise the declared range in package.json devDependencies from ^1.55.1 to ^1.64.1, so a yarn.lock that falls back to 1.57.0 fails yarn install --immutable. The Chromium build that Playwright 1.57.0 downloads bundles a Brotli revision without the fix for CVE-2026-111497, an out-of-bounds write in the Brotli decoder. The Chromium build of 1.64.1 includes the fix.
✅ Deploy Preview for sendbird-uikit-react ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
| CVE | Package | Version | Fix |
|---|---|---|---|
| CVE-2024-21539 | @eslint/plugin-kit |
0.2.0 |
0.2.3 |
✅ Resolved · 2 findings
| CVE | Package | Version |
|---|---|---|
| CVE-2026-118664 | decode-uri-component |
0.2.2 |
| CVE-2026-45822 | decode-uri-component |
0.2.2 |
View full analysis in Upwind Console
Scan completed in 16s
Scan history (2 scans)
| Commit | Scanned at | New | Resolved | Net |
|---|---|---|---|---|
24f147d |
2026-11-05 04:06 UTC | +1 | 0 | +1 |
f29589c < |
2026-11-05 04:51 UTC | +1 | -2 | -1 |
Last scanned: f29589c · 2026-11-05 04:51 UTC
|
| Commit | Scanned at | New | Resolved | Net |
|---|---|---|---|---|
24f147d |
2026-11-05 04:06 UTC | 0 | 0 | 0 |
f29589c < |
2026-11-05 04:51 UTC | 0 | 0 | 0 |
Last scanned: f29589c · 2026-11-05 04:51 UTC
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![semgrep-code-sendbird[bot]](https://avatars.githubusercontent.com/u/5143408?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 24f147db6c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Playwright 1.62 and later require Node.js 20 and exit on older versions with "Playwright requires Node.js 20 or higher", so yarn test:visual no longer runs on Node.js 18 after the bump to 1.64.1. Say so in the Node.js prerequisite in README.md. yarn install, yarn build, yarn package:check and vitest still run on Node.js 18.20.8, so the general prerequisite and engines stay at 18.
|
@codex review |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Summary
This repository locked Playwright 1.57.0. The Chromium build that Playwright 1.57.0 downloads bundles a Brotli revision without the fix for CVE-2026-111497, an out-of-bounds write in the Brotli decoder. This change moves
@playwright/test,playwrightandplaywright-coreto 1.64.1, whose Chromium build includes the fix, and raises the range declared inpackage.jsonto 1.64.1. Because Playwright 1.64.1 needs Node.js 20,README.mdnow says thatyarn test:visualneeds Node.js 20 or later.Playwright is a development tool here. It runs
yarn test:visualin Chromium and WebKit. The library build uses Rollup and does not load Playwright, so the published package's code is unaffected.Changes
Playwright 1.57.0 → 1.64.1 —
package.json,yarn.lockplaywright-coreis JavaScript and carries no Brotli code. The Chromium build thatplaywright installdownloads carries its own copy of the Brotli decoder, and each Playwright version pins the build it downloads.third_party/brotli/README.chromiumrecords google/brotli@9801a2c, from May 2022, which does not contain the fix (google/brotli@0ed4268).third_party/brotli/README.chromiumrecords google/brotli@cfa184a, which contains the fix.@playwright/testis re-resolved inyarn.lockwithin its declared range.playwrightandplaywright-coremove with it, because each pins the next to an exact version.playwright1.64.1 no longer depends onfsevents2.3.2, so that entry and its patch entry are removed. Other packages keepfsevents2.3.3.devDependenciesmoves from^1.55.1to^1.64.1. The old floor let a lockfile go back to 1.57.0 without CI noticing. The new floor makesyarn install --immutablereject such a lockfile (see Testing).Node.js prerequisite —
README.mdyarn test:visualno longer runs on Node.js 18. The Node.js line under Prerequisites now says thatyarn test:visualneeds 20 or later.Backward compatibility
No public API changes.
package.jsonchanges onlydevDependencies. Applications that install@sendbird/uikit-reactdo not install Playwright.dependenciesandpeerDependenciesare unchanged. It does not declareengines.README.md, a build ofmainand a build of this branch produce the samedist/contents, including itspackage.json. Only Rollup's hashed chunk file names differ.package.jsonkeepsenginesat>=18. That field is not published, and CI runs Node.js 24.Testing
On Node.js 24:
yarn install --immutablepassesyarn lint,yarn typecheck,yarn build,yarn testandyarn build:apps:testingpassyarn api:snapshot— no public API surface changeyarn package:check— publint and attw passOn Node.js 18.20.8, on this branch:
yarn install --immutable,yarn build,yarn package:checkand a vitest run pass.yarn test:visualexits with "Playwright requires Node.js 20 or higher".Also:
yarn install --immutablewith this branch'spackage.jsonandmain'syarn.lockfails, because the lockfile would have to change.yarn test:visuallaunches Chromium and WebKit with 1.64.1 and opens the visual-test app in each, as it does with 1.57.0 onmain.Changelogs
yarn test:visualnow needs Node.js 20 or later (internal)