build(deps-dev): bump @playwright/cli from 0.1.14 to 0.1.15

[dependabot]

Bumps @playwright/cli from 0.1.14 to 0.1.15.

Release notes

Sourced from @​playwright/cli's releases.

v0.1.15

Highlights

• High resolution screenshots (#376) — playwright-cli screenshot --hires captures at the device's full pixel ratio instead of downscaling to CSS pixels. (microsoft/playwright#41465)
• Secrets filtered from console logs (#41509) — configured secret values are now redacted in captured console log artifacts. (microsoft/playwright#41515)

Heads up

• The CLI now checks for updates — on startup it notifies you when a newer @playwright/cli is available on npm. (#426)
• The CLI now warns when your installed skill is out of date — if the bundled Playwright skill is newer than the one installed in your workspace, you'll be prompted to reinstall it. Re-run playwright-cli install --skills to update. (#427)

Fixes

• fix(mcp): pass action timeout to browser_wait_for waitFor calls — wait_for now honors the configured action timeout instead of waiting indefinitely. (microsoft/playwright#41270)
• fix(mcp): wait for next pause or context closure in browser_resume — resuming a paused session settles reliably. (microsoft/playwright#41293)
• fix(mcp): assign caps as array for legacy --vision flag — the legacy --vision flag works again. (microsoft/playwright#41253)
• fix(mcp): never include data: URL payloads in snapshot or network output — large data: URLs no longer flood snapshot and network output. (microsoft/playwright#41450)
• fix(mcp): list a failed network request only once — failed requests are no longer duplicated in network output. (microsoft/playwright#41481)
• fix(mcp): check tracing state before stopping in browser_stop_tracing — stopping tracing when it is not running no longer errors. (microsoft/playwright#41040)
• fix(mcp): add missing .catch() on sessionLog write queue — a failed session-log write no longer crashes the session. (microsoft/playwright#41234) (microsoft/playwright#41382)

Commits

• 74d9bf1 chore: mark v0.1.15 (#432)
• 34bf2ad chore: roll Playwright to 1.62.0-alpha-2026-06-29 (#431)
• 13639df test(skills): regress on skill-update notice (#429)
• 9805da3 feat(cli): warn when installed skill is out of date (#427)
• 0857d71 feat(cli): notify when a newer version is available on npm (#426)
• See full diff in compare view

---

Note

Low Risk
Lockfile-only dev dependency bump with no production or test-runner package changes beyond the CLI bundle.

Overview
Bumps the @playwright/cli dev dependency from 0.1.14 to 0.1.15 in the root package.json, with the lockfile pulling in the CLI’s bundled Playwright 1.62.0-alpha (playwright / playwright-core). @playwright/test is unchanged at ^1.61.1.

This is a tooling-only update (CLI/MCP fixes, hires screenshots, secret redaction in logs, etc. per upstream release notes)—no application source changes.

^{Reviewed by Cursor Bugbot for commit d036745. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Injected PR Evaluation: Web Compatibility & Security

PR: build(deps-dev): bump @playwright/cli from 0.1.14 to 0.1.15
Scope: package.json, package-lock.json only (2 files, 14 insertions / 14 deletions)

---

Web Compatibility Assessment

No findings.

This PR changes only the root devDependencies entry for @playwright/cli. There are no modifications to injected/, messaging/, special-pages/ runtime source, platform entry points, wrapper utilities, or browser API overrides. @playwright/cli is not bundled into Content Scope Scripts and does not ship to end-user browsers.

The lockfile also updates nested playwright / playwright-core versions under @playwright/cli (1.61.0-alpha → 1.62.0-alpha). These are isolated to the CLI package's own node_modules tree. Integration tests continue to use the top-level @playwright/test (^1.61.1), which is unchanged.

---

Security Assessment

No findings.

@playwright/cli is a development/agent tooling dependency used for interactive browser automation (e.g. playwright-cli via the repo's agent skill). It runs outside the C-S-S browser injection trust boundary and has no interaction with:

• captured-globals.js or page-world globals
• Message bridge / native messaging transports
• Remote configuration or feature gating
• Third-party page execution context

No new network surfaces, postMessage usage, or dynamic code execution paths are introduced in shipped artifacts.

---

Risk Level

Low Risk — devDependency-only version bump with no runtime bundle, API override, or security-critical path changes.

---

Recommendations

1. None required for web compatibility or security. Safe to merge from an injected-runtime perspective.
2. Optional (CI hygiene): If CI or local agent workflows exercise playwright-cli, a quick smoke run (npx playwright-cli --help) after merge confirms the CLI binary resolves correctly with the new nested alpha.
3. Note: @playwright/test remains at ^1.61.1 while @playwright/cli now bundles 1.62.0-alpha internally. This version skew is expected (CLI ships its own Playwright) and does not affect integration test execution, which resolves @playwright/test independently.

  

_{Sent by Cursor Automation: Web compat and sec}

[github-actions]

Build Branch

Branch	pr-releases/dependabot/npm_and_yarn/main/playwright/cli-0.1.15
Commit	6f54b58eef
Updated	July 17, 2026 at 5:18:51 PM UTC

Static preview entry points

• Docs: docs/index.html
• Static pages: build/integration/pages/index.html
• Integration pages: injected/integration-test/test-pages/index.html

QR codes (mobile preview)

Entry point	QR code
Docs
Static pages
Integration pages

Integration commands

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#pr-releases/dependabot/npm_and_yarn/main/playwright/cli-0.1.15

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/dependabot/npm_and_yarn/main/playwright/cli-0.1.15")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/playwright/cli-0.1.15
git -C submodules/content-scope-scripts checkout origin/pr-releases/dependabot/npm_and_yarn/main/playwright/cli-0.1.15

Pin to exact commit

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#6f54b58eef496d2d20855a08e03a720e6afe08b0

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "6f54b58eef496d2d20855a08e03a720e6afe08b0")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/playwright/cli-0.1.15
git -C submodules/content-scope-scripts checkout 6f54b58eef496d2d20855a08e03a720e6afe08b0

[cursor]

Stale comment

Dependency update review: @playwright/cli 0.1.14 → 0.1.15

Verdict: Low risk — safe to merge with a follow-up skill sync.

This is a patch bump to a dev-only agent tooling dependency. It does not affect CI integration tests (those use @playwright/[email protected] via npx playwright test). No application/runtime code imports @playwright/cli.

---

Changelog impact (confirmed)

Per v0.1.15 release notes:

Change	Risk
--hires screenshots, secrets redaction in console logs	Low — additive
MCP timeout/tracing/network-output fixes	Low — bug fixes
Startup update check (notifies when newer npm version exists)	Low — may emit network traffic in agent environments
Out-of-date skill warnings when bundled skill ≠ workspace skill	Medium (DX) — confirmed locally after npm ci

Nested dependency in lockfile also moves from [email protected]* to [email protected] under node_modules/@playwright/cli/. This is isolated from @playwright/[email protected] and does not change the Playwright Docker image CI uses.

---

Test coverage (confirmed gap)

• No automated tests exercise @playwright/cli. CI (tests.yml) runs npx playwright test from workspace packages only.
• The bump cannot break existing CI gates based on current wiring.
• Validation performed: npm ci, npx playwright-cli --version (reports 0.1.15), npm audit (no playwright-related vulnerabilities).

---

Is this dependency still needed?

Yes, for agent workflows — it powers the playwright-cli skill used by Cursor/Claude agents (.agents/skills/playwright-cli, symlinked from .claude/skills/). It is not used by build/test scripts.

Uncertain / discussion point: A prior branch (a3817e936) attempted to remove @playwright/cli as unused. That was not merged; the dependency was re-added for agent skills in #2386. Removal would require an alternative skill delivery mechanism.

---

Supply chain (confirmed low risk)

• Publisher: Microsoft (microsoft/playwright-cli on GitHub, @playwright/cli on npm)
• License: Apache-2.0
• Release signing: GitHub verified signatures on releases
• Lockfile integrity hashes updated in this PR
• npm audit: no playwright-related vulnerabilities

---

Action required after merge

Confirmed issue: Workspace skills are stale relative to 0.1.15. After merge, every playwright-cli invocation prints mismatch warnings for both .claude/skills/playwright-cli (symlink) and .agents/skills/playwright-cli.

Opened companion PR to fix: skill sync via playwright-cli install --skills=agents (supersedes draft #2799 manual doc edits).

Note: playwright-cli install --skills (default Claude path) fails here because .claude/skills/playwright-cli is a symlink — use --skills=agents instead.

---

Uncertain concerns

• Version lag: 0.1.17 is already latest on npm; the new startup update check will prompt for another bump soon. Not blocking.
• Draft PR #2611 proposes a playwright-cli smoke-test CI gate — would close the test-coverage gap but is unrelated to this patch.

  

_{Sent by Cursor Automation: Review dependabot}

[cursor]

Confirmed — nested Playwright version skew (low runtime risk).

This bump pulls in [email protected] as a nested dependency of @playwright/cli, while @playwright/test remains on 1.61.1 (used by CI integration tests and the mcr.microsoft.com/playwright:v1.61.1-noble container).

Because npm nests these under separate node_modules paths, this should not affect npx playwright test. Agents invoking playwright-cli will use the newer alpha browser driver — worth knowing if debugging agent-only browser behavior diverges from CI.

[cursor]

Dependency update review: @playwright/cli 0.1.14 → 0.1.15

Verdict: Approve with companion follow-up. This is a low-risk devDependency bump. The version bump itself is safe to merge; merge #2870 alongside or immediately after to silence new skill-mismatch warnings.

---

Scope of change

Only package.json and package-lock.json change. The lockfile also updates nested playwright / playwright-core from 1.61.0-alpha-1781023400000 → 1.62.0-alpha-2026-06-29 (bundled inside @playwright/cli).

How this dependency is used here

@playwright/cli is dev-only agent tooling for the playwright-cli skill (.agents/skills/playwright-cli, symlinked from .claude/skills/playwright-cli). It is not referenced by CI workflows, npm scripts, or application code.

Integration tests use @playwright/test@^1.61.1 and the mcr.microsoft.com/playwright:v1.61.1-noble container — a separate dependency tree. npm nests the two Playwright versions under different node_modules paths, so CI browser behavior should be unaffected.

Changelog impact (v0.1.15)

Change	Impact on this repo
Skill version warnings (new in 0.1.15)	Confirmed issue. npx playwright-cli --version now prints mismatch warnings for both .claude/skills/playwright-cli and .agents/skills/playwright-cli. Committed skills document removed commands (network, open --extension) and omit new ones (requests, attach --extension).
Update notifications (new in 0.1.15)	Informational noise — CLI now warns that 0.1.17 is available on every invocation. Not a blocker.
Secrets redaction in console logs	Security improvement; only relevant if agents use --secrets. No current usage in this repo.
screenshot --hires	Additive/opt-in; no impact unless adopted.
MCP timeout/tracing/network fixes	Bug fixes in MCP layer; no impact on standard playwright-cli agent workflows here.

Test coverage

• No automated tests exercise @playwright/cli directly (confirmed: no references in .github/workflows/, npm scripts, or test files).
• CI integration tests (@playwright/test) are the relevant safety net — multiple jobs already passing on this PR.
• Local validation: after npm ci + npm run build, npx playwright test pages.spec.js --grep "Test infra" passed (3/3) on chrome-mv3.

Is this dependency still needed?

Yes. Added in #2386 for agent browser automation via the playwright-cli skill. @playwright/test serves a different purpose (headless integration testing) and cannot replace the CLI's interactive snapshot/codegen workflow.

Supply chain

• Publisher: Microsoft (microsoft/playwright-cli), maintainers include [email protected]
• License: Apache-2.0
• Integrity: lockfile SHA updated (sha512-2eLqaKBoNCR0TWv3+…)
• npm audit: no Playwright-related vulnerabilities flagged
• Risk: low — official Microsoft package, no new install scripts or postinstall hooks

Companion fix PR (already exists — no duplicate needed)

#2870 (chore: sync playwright-cli agent skills for @playwright/cli 0.1.15) runs playwright-cli install --skills=agents to align .agents/skills/playwright-cli with 0.1.15. Because .claude/skills/playwright-cli symlinks to .agents/skills/playwright-cli, this covers both warning targets. Supersedes draft #2799.

Recommended merge order: merge this bump first, then rebase and merge #2870.

Uncertain / optional follow-ups

• Skip to 0.1.17? npm shows 0.1.17 as latest (published Jul 9). Staying on 0.1.15 is fine for a targeted patch bump; a separate update would be needed for 0.1.16/0.1.17 changes.
• CI smoke test for playwright-cli? Draft #2611 proposed a gate but was never merged. Would catch future skill drift but is not required for this bump.

  

_{Sent by Cursor Automation: Review dependabot}

[cursor]

Confirmed — no CI/scripts reference this package.

@playwright/cli is dev-only agent tooling. Merging without the companion skill sync (#2870) will cause noisy out-of-date-skill warnings on every playwright-cli invocation — new behavior introduced in 0.1.15.