Skip to content

chore(deps-dev): bump @playwright/test from 1.60.0 to 1.61.0 in the dev-minor-and-patch group across 1 directory#64

Merged
linusdevx merged 1 commit into
devfrom
dependabot/npm_and_yarn/dev-minor-and-patch-98d9b91858
Jun 23, 2026
Merged

chore(deps-dev): bump @playwright/test from 1.60.0 to 1.61.0 in the dev-minor-and-patch group across 1 directory#64
linusdevx merged 1 commit into
devfrom
dependabot/npm_and_yarn/dev-minor-and-patch-98d9b91858

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-minor-and-patch group with 1 update in the / directory: @playwright/test.

Updates @playwright/test from 1.60.0 to 1.61.0

Release notes

Sourced from @​playwright/test's releases.

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

Browser and Screencast

  • New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
  • New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
  • The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.

Test runner

  • The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
  • Supported expect.soft.poll(...).
  • New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
  • New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
  • testInfo.errors now lists each sub-error of an AggregateError as a separate entry.

... (truncated)

Commits
  • 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
  • a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
  • 8133dcf cherry-pick(#41283): docs: add Ubuntu 26.04 and Node.js 26.x to system requir...
  • 812432e chore: mark v1.61.0 (#41277)
  • ac05145 fix(fetch): report serverAddr and securityDetails for reused sockets (#41267)
  • 056efc9 fix(trace-viewer): add keyboard navigation to NetworkFilters component (#41...
  • 41f7b9a chore: fixes uncovered by the .NET 1.61 roll (#41266)
  • ba50778 fix(mcp): assign caps as array for legacy --vision flag (#41253)
  • b8ee5ae docs: release notes for v1.61 (#41261)
  • 49c1f69 fix(trace viewer): load trace from a local file (#41263)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 22, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jun 22, 2026

Copy link
Copy Markdown
Contributor

Deploying xsltdebugx with  Cloudflare Pages  Cloudflare Pages

Latest commit: 3fe2020
Status: ✅  Deploy successful!
Preview URL: https://a908f8a4.xsltdebugx.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-dev.xsltdebugx.pages.dev

View logs

@linusdevx linusdevx enabled auto-merge June 22, 2026 18:38
Bumps the dev-minor-and-patch group with 1 update in the / directory: [@playwright/test](https://github.com/microsoft/playwright).


Updates `@playwright/test` from 1.60.0 to 1.61.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.61.0)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.61.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the base branch from main to dev June 23, 2026 04:57
@dependabot dependabot Bot changed the title chore(deps-dev): bump @playwright/test from 1.60.0 to 1.61.0 in the dev-minor-and-patch group chore(deps-dev): bump @playwright/test from 1.60.0 to 1.61.0 in the dev-minor-and-patch group across 1 directory Jun 23, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-minor-and-patch-98d9b91858 branch from 9288b19 to 3fe2020 Compare June 23, 2026 04:57
@linusdevx linusdevx merged commit 1dbf9b9 into dev Jun 23, 2026
4 checks passed
@linusdevx linusdevx deleted the dependabot/npm_and_yarn/dev-minor-and-patch-98d9b91858 branch June 23, 2026 05:04
linusdevx added a commit that referenced this pull request Jun 23, 2026
* chore(dependabot): target dev, ignore major bumps

After enabling Dependabot, it immediately opened 8 PRs against main —
including several cross-major bumps (vite 6→8, checkout 4→7, etc.) that
need human review and would have skipped the normal dev → main flow.

- target-branch: dev — PRs go through dev like any other change
- ignore semver-major — automated PRs are patch/minor only; majors are
  reviewed by a human when needed
- Security advisories still open PRs regardless of these ignore rules

* fix(editor): handle --!> when stripping XML comment markers

The toggle-comment command stripped --> but not --!>, the rare-but-legal
HTML comment-end-bang form. Browsers (and the HTML spec) treat both as
valid comment terminators; toggling-off a buffer that used the bang form
would leave a stray --!> on the line.

Side benefit: closes CodeQL alert #1 (js/bad-tag-filter) on this line.
The alert was technically a false positive — the regex output is fed
into Monaco's text buffer, never rendered as HTML — but the underlying
incompleteness was real, so it's worth fixing rather than dismissing.

* chore(ci): harden workflows for OpenSSF Scorecard (#67)

- Pin all GitHub Actions to commit SHAs (Pinned-Dependencies check)
- Add top-level 'permissions: contents: read' to codeql.yml and
  e2e-tests.yml (Token-Permissions check); scorecard.yml already had
  'permissions: read-all'
- Bump action versions while pinning:
  - actions/checkout v4 -> v4.2.2
  - actions/setup-node v4 -> v4.4.0
  - actions/upload-artifact v4 -> v4.4.3
  - github/codeql-action v3 -> v3.36.2
  - ossf/scorecard-action v2.4.0 -> v2.4.3

CodeQL's per-job 'permissions:' block is preserved — it widens the
top-level default to grant security-events:write for SARIF upload.

* chore(deps): bump the actions-minor-and-patch group with 2 updates (#69)

Bumps the actions-minor-and-patch group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [actions/upload-artifact](https://github.com/actions/upload-artifact).


Updates `actions/checkout` from 4.2.2 to 4.3.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...34e1148)

Updates `actions/upload-artifact` from 4.4.3 to 4.6.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@b4b15b8...ea165f8)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor-and-patch
- dependency-name: actions/upload-artifact
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-dev): bump @playwright/test (#64)

Bumps the dev-minor-and-patch group with 1 update in the / directory: [@playwright/test](https://github.com/microsoft/playwright).


Updates `@playwright/test` from 1.60.0 to 1.61.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.61.0)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.61.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(security): add SRI integrity to CDN-loaded scripts (#70)

Adds sha384 integrity hashes and crossorigin=anonymous to the three
CDN-hosted dependencies in index.html:

- pako@2.1.0 (compression for share URLs)
- lucide@1.14.0 (icon library)
- monaco-editor@0.44.0 loader

Mitigates the supply-chain risk of a tampered CDN response — the browser
refuses to execute any script whose content doesn't match the hash.

Resolves the only real CodeQL alert
(js/functionality-from-untrusted-source) on index.html:51-53.

Maintenance note: each version bump now requires regenerating the hash:
  curl -sL <url> | openssl dgst -sha384 -binary | openssl base64 -A

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant