chore(playwright): update version of playwright and currents

[Vere-Grey]

Description

Bumps Playwright from 1.60.0 to 1.61.1 across every place the version is pinned — including the nix dev shell, which is the part that makes this a lockstep change rather than six independent bumps.

npm

Package	Workspace
@playwright/test	packages/e2e-utils, packages/connect-web, suite/e2e
@playwright/browser-{chromium,firefox,webkit}	suite/e2e
@currents/playwright ^2.1.4 → ^2.5.0	packages/e2e-utils, suite/e2e

nix

flake.nix pins playwright-web-flake by version tag, so it has to move with npm:

-playwright-web-flake.url = "github:pietdevries94/playwright-web-flake/1.60.0";
+playwright-web-flake.url = "github:pietdevries94/playwright-web-flake/1.61.1";

flake.lock regenerated with nix flake update playwright-web-flake — a 4-line diff (ref, rev, narHash, lastModified); the input's nested nixpkgs is untouched.

This matters because flake.nix exports PLAYWRIGHT_BROWSERS_PATH="${pkgs.playwright-driver.browsers}". Leaving the flake at 1.60.0 while npm moves to 1.61.1 would break every nix-based dev shell with Executable doesn't exist … browser has been downloaded for a different version of Playwright, while CI (which uses the npm @playwright/browser-* packages) stayed green.

Two required couplings

• @currents/playwright must be ≥ 2.3.1. Its changelog has an explicit entry — "@currents/playwright compatibility with Playwright 1.61.0 [ENG-680]" — so 2.1.4 does not support Playwright 1.61. Going to 2.5.0; everything between 2.2.0 and 2.5.0 is features and fixes, no breaking changes.
• npm and nix versions must be identical, not merely compatible, since the driver and browser binaries are version-keyed.

Why 1.61.1 and not 1.62

1.62.1 is npm latest, but three independent constraints all top out at 1.61.1:

🌐 Preview deployments

🌐 Suite Web preview: https://dev.suite.sldev.cz/suite-web/qa-bump-dep-playwright/web/

🔍 Currents Test Results

🔍 Suite web test results: View in Currents

🔍 Suite desktop test results: View in Currents

🔒 Quarantined E2E Tests

Trezor Suite (desktop) — 2 test(s)

Test	Type
Quarantine test: "Recovery - dry run,Recovery after partial recovery"	🙋 manual
Quarantine test: "Recovery - dry run,Recovery with device reconnection"	🙋 manual

Updated: 2026-08-05T12:19:04.121Z • 2 test(s) total

Trezor Suite (web) — 3 test(s)

Test	Type
Quarantine test: "Recovery - dry run,Recovery with device reconnection"	🙋 manual
Quarantine test: "TrezorConnect webextension -> Suite Web,second call after popup was closed by user should work"	🙋 manual
Quarantine test: "Recovery T2T1 - dry run,Recovery after partial recovery"	🙋 manual

Updated: 2026-08-05T12:18:52.473Z • 3 test(s) total

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm @currents/playwright is 61.0% likely to have a medium risk anomaly Notes: No overt malware indicators (e.g., hardcoded credentials, reverse shells, or direct data exfiltration) are visible in this fragment. However, it presents a significant supply-chain/security risk pattern: it dynamically loads and can execute a locally resolved configuration module via jiti, and it drives Playwright subprocess execution based on unvalidated WebSocket event payloads. Additionally, it propagates the full host environment to subprocesses. Treat the configuration source and orchestration channel as highly sensitive and ensure integrity/authentication and strict trust boundaries are enforced outside this snippet. Confidence: 0.61 Severity: 0.56 From: packages/e2e-utils/package.json → npm/@currents/playwright@2.5.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@currents/playwright@2.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm jiti is 68.0% likely to have a medium risk anomaly Notes: The fragment implements a sophisticated on-the-fly loader using JITI for transpilation and execution, with careful handling of JSON interop based on nearby package.json type. There is no explicit malicious behavior identified (no external network activity, no hardcoded secrets). However, the dynamic code execution path introduced by _wrapSource and the synthetic module environment represents a potential risk vector if untrusted inputs are loaded, or if jiti/mjs execution context could be manipulated. This warrants strict review of the loader environment, the version and security of JITI, and checks on the sources being loaded to mitigate potential code execution or supply chain concerns. Confidence: 0.68 Severity: 0.60 From: ? → npm/eslint@9.39.4 → npm/@walletconnect/core@2.23.9 → npm/@walletconnect/utils@2.23.9 → npm/@walletconnect/types@2.23.9 → npm/vite@8.0.8 → npm/electron-builder@26.15.3 → npm/orval@8.19.0 → npm/@currents/playwright@2.5.0 → npm/postcss-loader@8.2.0 → npm/jiti@2.7.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jiti@2.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm playwright is 62.0% likely to have a medium risk anomaly Notes: Overall, this fragment is best characterized as high-privilege runtime instrumentation for TypeScript/ESM transformation and source-map-based stack trace remapping with on-disk compilation caching. There is no direct evidence of malware behavior such as network exfiltration or credential theft in the shown code. However, it contains security-sensitive primitives—eval-based dynamic ESM import, broad Node module loader/internal patching, and flexible source-map retrieval with filesystem I/O—that materially increase supply-chain abuse potential. Treat as moderate security risk and ensure untrusted input/option influence is tightly controlled. Confidence: 0.62 Severity: 0.64 From: ? → npm/@playwright/test@1.61.1 → npm/@vitest/browser-playwright@4.1.10 → npm/playwright@1.61.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/playwright@1.61.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

• npm/playwright-core@1.61.1

View full report

[Ondra-Zik]

Good, thanks for updating the flake as well. lets wait for CI

[Vere-Grey]

@SocketSecurity ignore npm/playwright-core@1.61.1