build(deps-dev): bump @playwright/cli from 0.1.14 to 0.1.17 - #2899
build(deps-dev): bump @playwright/cli from 0.1.14 to 0.1.17#2899dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@playwright/cli](https://github.com/microsoft/playwright-cli) from 0.1.14 to 0.1.17. - [Release notes](https://github.com/microsoft/playwright-cli/releases) - [Commits](microsoft/playwright-cli@v0.1.14...v0.1.17) --- updated-dependencies: - dependency-name: "@playwright/cli" dependency-version: 0.1.17 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Build Branch
Static preview entry points
QR codes (mobile preview)
Integration commandsnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/dependabot/npm_and_yarn/main/playwright/cli-0.1.17")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/playwright/cli-0.1.17
git -C submodules/content-scope-scripts checkout origin/pr-releases/dependabot/npm_and_yarn/main/playwright/cli-0.1.17Pin to exact commitnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "ac1047c6fcd501aef59553144253e70b7acad858")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/playwright/cli-0.1.17
git -C submodules/content-scope-scripts checkout ac1047c6fcd501aef59553144253e70b7acad858 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Injected PR Evaluation: Web Compatibility & Security
PR: build(deps-dev): bump @playwright/cli from 0.1.14 to 0.1.17 (5a2f9bb)
Web Compatibility Assessment
No findings.
This PR only updates package.json and package-lock.json. There are no changes under injected/src/, messaging/, special-pages/, or any other application/runtime source. @playwright/cli is a devDependency used for local/agent browser-automation tooling (the playwright-cli skill); it is not bundled into content-scope injection scripts shipped to DuckDuckGo browsers.
Security Assessment
No findings.
No changes to captured-globals.js, messaging transports, message bridge, API overrides, or any runtime trust boundaries. The lockfile update pulls in nested playwright / playwright-core 1.62.0-alpha packages scoped to @playwright/cli's own dependency tree only — these do not affect the shipped injection bundle.
Risk Level
Low Risk — devDependency-only version bump with no runtime code changes and no impact on injected web compatibility or browser security posture.
Recommendations
- Info: Safe to merge from a web-compat/security perspective. No injected-runtime review items.
- Info (CI/tooling): Nested
@playwright/clidependencies now declareengines.node: ">=20"(was>=18). This is scoped to the CLI's nestedplaywrightpackages only; root@playwright/test(^1.61.1) is unchanged. Repo already targets Node 22 per.nvmrc/ cloud setup — no action needed. - Optional: If maintainers use
playwright-cliinteractively, a quick smoke test (npx playwright-cli open https://example.com && npx playwright-cli close) after merge is sufficient validation; integration tests (npm run test-int) exercise@playwright/testseparately and are unaffected by this bump.
Sent by Cursor Automation: Web compat and sec
There was a problem hiding this comment.
Dependency update review: @playwright/cli 0.1.14 → 0.1.17
Verdict: Approve with companion fix recommended. The version bump itself is low-risk for CI/production, but it exposes a confirmed agent-skill mismatch that should be addressed before or alongside merge.
Summary
@playwright/cli is a dev-only dependency used for Cursor/Claude agent browser automation (playwright-cli binary + bundled skills). It is not referenced in CI workflows — integration tests run via @playwright/test directly. This bump only changes package.json / package-lock.json.
Changelog impact (0.1.15 → 0.1.17)
| Version | Notable changes |
|---|---|
| 0.1.15 | Startup update/skill-out-of-date warnings; secret redaction in logs; --hires screenshots; rolls Playwright to 1.62.0-alpha |
| 0.1.16 | New find command; open --mobile / --device; leaner AI snapshots; Chromium sandbox enabled by default; npx playwright cli alias |
| 0.1.17 | Bug fixes: goto no longer crashes on privileged pages; screenshot race fix; video path preservation |
All changes are additive or bug-fix oriented — no breaking CLI removals in this range.
Confirmed issues
1. Stale agent skills (action required)
Since 0.1.15, the CLI warns when committed skills don't match the installed version. With 0.1.17 installed, npx playwright-cli --version emits warnings for both .claude/skills/playwright-cli and .agents/skills/playwright-cli.
Committed skills still document removed commands (network, open --extension) while missing new ones (find, open --mobile, drop, etc.). This can mislead agents using the playwright-cli skill.
Fix: Companion PR opened to sync skills — see follow-up PR from this review (supersedes draft #2870 which targeted 0.1.15).
2. No CI coverage for @playwright/cli
CI runs @playwright/test integration tests only. A green CI run does not validate playwright-cli behavior. I smoke-tested locally (open / snapshot / close) successfully on 0.1.17.
Uncertain concerns (low severity)
- Playwright version skew:
@playwright/clinow bundlesplaywright@1.62.0-alpha-*while@playwright/testremains^1.61.1. These are isolated dependency trees (nestednode_modules), so CI test behavior should be unaffected. Worth aligning@playwright/testin a future bump for consistency. - Alpha transitive dependency: The CLI pins pre-release Playwright alpha builds. Expected for this package, but means behavior can shift between patch releases.
- Chromium sandbox (0.1.16): Default browser now runs sandboxed. Could affect headed/local agent usage in restricted environments — unlikely to impact this repo's headless CI.
Supply chain
- Publisher: Microsoft (
microsoft/playwright-cli), Apache-2.0 - Maintainers: Known Playwright team members +
playwright-bot - Integrity: Lockfile updated with new SRI hashes
- npm audit: No vulnerabilities attributed to
@playwright/clior its nestedplaywrightpackages - Risk level: Low — official first-party package from the Playwright maintainers
Is this dependency still needed?
Yes. It powers the playwright-cli agent skill (skills-lock.json, .agents/skills/playwright-cli/) for AI-assisted browser testing/debugging. It is not used in shipped browser code. No better alternative exists in-repo — @playwright/test serves a different purpose (automated test suites).
Recommendation
- Merge #2899 (this bump) — safe for CI/production
- Merge companion skill-sync PR to resolve agent doc drift and silence CLI warnings
- Consider closing superseded draft #2870
Sent by Cursor Automation: Review dependabot
| "devDependencies": { | ||
| "@duckduckgo/eslint-config": "github:duckduckgo/eslint-config#v0.2.1", | ||
| "@playwright/cli": "^0.1.14", | ||
| "@playwright/cli": "^0.1.17", |
There was a problem hiding this comment.
Confirmed: Bumping to ^0.1.17 triggers skill-mismatch warnings on every playwright-cli invocation because committed skills (.agents/skills/playwright-cli/) still document removed commands like network and open --extension. A companion PR syncing skills from the bundled 0.1.17 package has been opened to address this.
Bumps @playwright/cli from 0.1.14 to 0.1.17.
Release notes
Sourced from @playwright/cli's releases.
Commits
793cfb3chore: mark v0.1.17 (#437)372ad83chore: roll Playwright to 1.62.0-alpha-1783623505000 (#436)22d98afchore: mark v0.1.16 (#435)72735e5chore: roll Playwright to 1.62.0-alpha-2026-07-08 (#434)74d9bf1chore: mark v0.1.15 (#432)34bf2adchore: roll Playwright to 1.62.0-alpha-2026-06-29 (#431)13639dftest(skills): regress on skill-update notice (#429)9805da3feat(cli): warn when installed skill is out of date (#427)0857d71feat(cli): notify when a newer version is available on npm (#426)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Dev-only dependency bump with no production code changes; CI or local workflows that invoke
@playwright/climay see different CLI behavior and need Node 20+ for the nested Playwright binaries.Overview
Bumps the
@playwright/clidev dependency from 0.1.14 to 0.1.17 inpackage.jsonand refreshespackage-lock.json. The lockfile also pulls in newer nestedplaywright/playwright-core(1.62.0-alpha) for that CLI package, whose engine requirement moves from Node ≥18 to ≥20.@playwright/testis unchanged at^1.61.1; this is tooling-only, not application runtime code.Reviewed by Cursor Bugbot for commit 5a2f9bb. Bugbot is set up for automated code reviews on this repo. Configure here.