You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
### v0.28.1* Disallow ``\`` in local development server HTTP requests ([GHSA-g7r4-m6w7-qqqr](https://redirect.github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr))
This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a ``\`` backslash character. It happened due to the use of Go's `path.Clean()` function, which only handles Unix-style `/` characters. HTTP requests with paths containing ``\`` are no longer allowed.
Thanks to [@​dellalibera](https://redirect.github.com/dellalibera) for reporting this issue.
The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.
Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.
Avoid inlining using and await using declarations (#4482)
Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
// Original code{usingx=newResource()x.activate()}// Old output (with --minify)newResource().activate();// New output (with --minify){usinge=newResource;e.activate()}
Fix module evaluation when an error is thrown (#4461, #4467)
If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)
Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
// Original codenew(foo()`bar`)()new(foo()?.bar)()// Old outputnewfoo()`bar`();new(foo())?.bar();// New outputnew(foo())`bar`();new(foo()?.bar)();
This release fixes a bug where var declarations in nested scopes that are hoisted up to module scope were not correctly being renamed during bundling. That could previously lead to name collisions when minification was disabled, which could potentially cause a behavior change. The bug has been fixed so that these hoisted declarations are now considered to be module-level symbols during the name collision avoidance pass.
Emit var instead of const for certain TypeScript-only constructs for ES5 (#4448)
While esbuild doesn't generally support converting const to var for ES5 due to nested scoping rules (which is currently a build-time error), esbuild previously incorrectly converted TypeScript-only import assignment constructs into a const declaration even when targeting ES5. With this release, esbuild will now use var for this case instead:
// Original codeimportx=require('y')// Old output (with --target=es5)constx=require("y");// New output (with --target=es5)varx=require("y");
### v0.28.0* Add support for `with { type: 'text' }` imports ([#4435](https://redirect.github.com/evanw/esbuild/issues/4435))
The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:
Add integrity checks to fallback download path (#4343)
Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the npm command, and then with a HTTP request to registry.npmjs.org as a last resort).
This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level esbuild package. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.
Update the Go compiler from 1.25.7 to 1.26.1
This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:
### v0.27.7* Fix lowering of define semantics for TypeScript parameter properties ([#4421](https://redirect.github.com/evanw/esbuild/issues/4421))
The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:
// Original codeclassFoo{constructor(publicx=1){}y=2}// Old output (with --loader=ts --target=es2021)classFoo{constructor(x=1){this.x=x;__publicField(this,"y",2);}x;}// New output (with --loader=ts --target=es2021)classFoo{constructor(x=1){__publicField(this,"x",x);__publicField(this,"y",2);}}
### v0.27.5* Fix for an async generator edge case ([#4401](https://redirect.github.com/evanw/esbuild/issues/4401), [#4417](https://redirect.github.com/evanw/esbuild/pull/4417))
Support for transforming async generators into the equivalent state machine was added in version 0.19.0. However, the generated state machine didn't work correctly when polling async generators concurrently, such as in the following code:
Previously esbuild's output of the above code behaved incorrectly when async generators were transformed (such as with --supported:async-generator=false). The transformation should be fixed starting with this release.
Fix a regression when metafile is enabled (#4420, #4418)
This release fixes a regression introduced by the previous release. When metafile: true was enabled in esbuild's JavaScript API, builds with build errors were incorrectly throwing an error about an empty JSON string instead of an object containing the build errors.
Use define semantics for TypeScript parameter properties (#4421)
Parameter properties are a TypeScript-specific code generation feature that converts constructor parameters into class fields when they are prefixed by certain keywords. When "useDefineForClassFields": true is present in tsconfig.json, the TypeScript compiler automatically generates class field declarations for parameter properties. Previously esbuild didn't do this, but esbuild will now do this starting with this release:
// Original codeclassFoo{constructor(publicx: number){}}// Old output (with --loader=ts)classFoo{constructor(x){this.x=x;}}// New output (with --loader=ts)classFoo{constructor(x){this.x=x;}x;}
TypeScript recently added es2025 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
"compilerOptions": {
"target": "ES2025"
}
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.
### v0.27.4* Fix a regression with CSS media queries ([#4395](https://redirect.github.com/evanw/esbuild/issues/4395), [#4405](https://redirect.github.com/evanw/esbuild/issues/4405), [#4406](https://redirect.github.com/evanw/esbuild/issues/4406))
Version 0.25.11 of esbuild introduced support for parsing media queries. This unintentionally introduced a regression with printing media queries that use the <media-type> and <media-condition-without-or> grammar. Specifically, esbuild was failing to wrap an or clause with parentheses when inside <media-condition-without-or>. This release fixes the regression.
Here is an example:
/* Original code */
@​media only screen and ((min-width: 10px) or (min-height: 10px)) {
a { color: red }
}
/* Old output (incorrect) */
@​media only screen and (min-width: 10px) or (min-height: 10px) {
a {
color: red;
}
}
/* New output (correct) */
@​media only screen and ((min-width: 10px) or (min-height: 10px)) {
a {
color: red;
}
}
This release fixes an edge case where esbuild's inject feature could not be used with arbitrary module namespace names exported using an export {} from statement with bundling disabled and a target environment where arbitrary module namespace names is unsupported.
Can now always be rewritten as this without esbuild sometimes incorrectly generating an error:
export{defaultas'window.jQuery'}from'jquery';
Attempt to improve API handling of huge metafiles (#4329, #4415)
This release contains a few changes that attempt to improve the behavior of esbuild's JavaScript API with huge metafiles (esbuild's name for the build metadata, formatted as a JSON object). The JavaScript API is designed to return the metafile JSON as a JavaScript object in memory, which makes it easy to access from within a JavaScript-based plugin. Multiple people have encountered issues where this API breaks down with a pathologically-large metafile.
The primary issue is that V8 has an implementation-specific maximum string length, so using the JSON.parse API with large enough strings is impossible. This release will now attempt to use a fallback JavaScript-based JSON parser that operates directly on the UTF8-encoded JSON bytes instead of using JSON.parse when the JSON metafile is too big to fit in a JavaScript string. The new fallback path has not yet been heavily-tested. The metafile will also now be generated with whitespace removed if the bundle is significantly large, which will reduce the size of the metafile JSON slightly.
However, hitting this case is potentially a sign that something else is wrong. Ideally you wouldn't be building something so enormous that the build metadata can't even fit inside a JavaScript string. You may want to consider optimizing your project, or breaking up your project into multiple parts that are built independently. Another option could potentially be to use esbuild's command-line API instead of its JavaScript API, which is more efficient (although of course then you can't use JavaScript plugins, so it may not be an option).
#41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
#41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
#41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
#41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
#41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks
### v1.61.0## 🔑 WebAuthn passkeys
New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:
constcontext=awaitbrowser.newContext();// Seed a passkey your backend provisioned for a test user.awaitcontext.credentials.create('example.com',{id: credentialId,
userHandle,
privateKey,
publicKey,});awaitcontext.credentials.install();constpage=awaitcontext.newPage();awaitpage.goto('https://example.com/login');// The page's navigator.credentials.get() is answered with the seeded passkey.
You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.
New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.
Test runner
The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
Supported expect.soft.poll(...).
New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
testInfo.errors now lists each sub-error of an AggregateError as a separate entry.
New -G command line shorthand for --grep-invert.
🛠️ Other improvements
Playwright now supports Ubuntu 26.04.
HAR and trace recordings now include WebSocket requests.
Browser Versions
Chromium 149.0.7827.55
Mozilla Firefox 151.0
WebKit 26.5
This version was also tested against the following stable channels:
Google Chrome 149
Microsoft Edge 149
### v1.60.0## 🌐 HAR recording on Tracing
tracing.startHar() / tracing.stopHar() expose HAR recording as a first-class tracing API, with the same content, mode and urlFilter options as recordHar. The returned Disposable makes it easy to scope a recording with await using:
awaitusinghar=awaitcontext.tracing.startHar('trace.har');constpage=awaitcontext.newPage();awaitpage.goto('https://playwright.dev');// HAR is finalized when `har` goes out of scope.
🪝 Drop API
New locator.drop() simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches dragenter, dragover, and drop with a synthetic [DataTransfer] in the page context — works cross-browser and is great for testing upload zones:
New test.abort() aborts the currently running test from a fixture, hook, or route handler with an optional message. Use it when you have detected an unrecoverable misuse and want to fail the test right away:
test('does not publish to the shared page',async({ page })=>{awaitpage.route('**/publish',route=>{test.abort('Tests must not publish to the shared page. Use the `clone` option.');returnroute.abort();});// ...});
New option noDefaults in browserType.connectOverCDP() disables Playwright's default overrides on the default context (download behavior, focus emulation, media emulation), so attaching to a user's daily-driver browser doesn't disturb its state.
consoleMessage.location() now exposes line / column properties (lineNumber / columnNumber are deprecated).
New testInfoError.errorContext surfaces additional diagnostic context, such as the aria snapshot of the receiver at the time of an expect(...) matcher failure.
reporter.onError() now receives a workerInfo argument with details about the worker for fixture teardown errors.
handle option on BrowserContext.exposeBinding and Page.exposeBinding.
logger option on BrowserType.connect and BrowserType.connectOverCDP — use tracing instead.
Context options videosPath / videoSize — use recordVideo instead.
Browser Versions
Chromium 148.0.7778.96
Mozilla Firefox 150.0.2
WebKit 26.4
This version was also tested against the following stable channels:
Google Chrome 147
Microsoft Edge 147
### v1.59.1### Bug Fixes
[Windows] Reverted hiding console window when spawning browser processes, which caused regressions including broken codegen, --ui and show commands (#39990)
### v1.59.0## 🎬 Screencast
New page.screencast API provides a unified interface for capturing page content with:
Screencast recordings
Action annotations
Visual overlays
Real-time frame capture
Agentic video receipts
Screencast recording — record video with precise start/stop control, as an alternative to the recordVideo option:
screencast.showActions() accepts position ('top-left', 'top', 'top-right', 'bottom-left', 'bottom', 'bottom-right'), duration (ms per annotation), and fontSize (px). Returns a disposable to stop showing actions.
Action annotations can also be enabled in test fixtures via the video option:
Visual overlays — add chapter titles and custom HTML overlays on top of the page for richer narration:
awaitpage.screencast.showChapter('Adding TODOs',{description: 'Type and press enter for each TODO',duration: 1000,});awaitpage.screencast.showOverlay('<div style="color: red">Recording</div>');
Real-time frame capture — stream JPEG-encoded frames for custom processing like thumbnails, live previews, AI vision, and more:
awaitpage.screencast.start({onFrame: ({ data })=>sendToVisionModel(data),size: {width: 800,height: 600},});
Agentic video receipts — coding agents can produce video evidence of their work. After completing a task, an agent can record a walkthrough video with rich annotations for human review:
awaitpage.screencast.start({path: 'receipt.webm'});awaitpage.screencast.showActions({position: 'top-right'});awaitpage.screencast.showChapter('Verifying checkout flow',{description: 'Added coupon code support per ticket #1234',});// Agent performs the verification steps...awaitpage.locator('#coupon').fill('SAVE20');awaitpage.locator('#apply-coupon').click();awaitexpect(page.locator('.discount')).toContainText('20%');awaitpage.screencast.showChapter('Done',{description: 'Coupon applied, discount reflected in total',});awaitpage.screencast.stop();
The resulting video serves as a receipt: chapter titles provide context, action annotations highlight each interaction, and the visual walkthrough is faster to review than text logs.
🔗 Interoperability
New browser.bind() API makes a launched browser available for playwright-cli, @​playwright/mcp, and other clients to connect to.
Bind a browser — start a browser and bind it so others can connect:
Run playwright-cli show to open the Dashboard that lists all the bound browsers, their statuses, and allows interacting with them:
See what your agent is doing on the background browsers
Click into the sessions for manual interventions
Open DevTools to inspect pages from the background browsers.
- `playwright-cli` binds all of its browsers automatically, so you can see what your agents are doing.
- Pass `PLAYWRIGHT_DASHBOARD=1` env variable to see all `@playwright/test` browsers in the dashboard.
🐛 CLI debugger for agents
Coding agents can now run npx playwright test --debug=cli to attach and debug tests over playwright-cli — perfect for automatically fixing tests in agentic workflows:
$ npx playwright test --debug=cli
### Debugging Instructions
- Run "playwright-cli attach tw-87b59e" to attach to this test
$ playwright-cli attach tw-87b59e
### Session `tw-87b59e` created, attached to `tw-87b59e`.
Run commands with: playwright-cli --session=tw-87b59e <command>### Paused
- Navigate to "/" at output/tests/example.spec.ts:4
$ playwright-cli --session tw-87b59e step-over
### Page
- Page URL: https://playwright.dev/
- Page Title: Fast and reliable end-to-end testing for modern web apps | Playwright
### Paused
- Expect "toHaveTitle" at output/tests/example.spec.ts:7
📋 CLI trace analysis for agents
Coding agents can run npx playwright trace to explore Playwright Trace and understand failing or flaky tests from the command line:
$ npx playwright trace open test-results/example-has-title-chromium/trace.zip
Title: example.spec.ts:3 › has title
$ npx playwright trace actions --grep="expect"# Time Action Duration
──── ───────── ─────────────────────────────────────────────────────── ────────
9. 0:00.859 Expect "toHaveTitle" 5.1s ✗
$ npx playwright trace action 9
Expect "toHaveTitle"
Error: expect(page).toHaveTitle(expected) failed
Expected pattern: /Wrong Title/
Received string: "Fast and reliable end-to-end testing for modern web apps | Playwright"
Timeout: 5000ms
Snapshots
available: before, after
usage: npx playwright trace snapshot 9 --name <before|after>
$ npx playwright trace snapshot 9 --name after
### Page
- Page Title: Fast and reliable end-to-end testing for modern web apps | Playwright
$ npx playwright trace close
♻️ await using
Many APIs now return async disposables, enabling the await using syntax for automatic cleanup:
awaitusingpage=awaitcontext.newPage();{awaitusingroute=awaitpage.route('**/*',route=>route.continue());awaitusingscript=awaitpage.addInitScript('console.log("init script here")');awaitpage.goto('https://playwright.dev');// do something}// route and init script have been removed at this point
🔍 Snapshots and Locators
Method page.ariaSnapshot() to capture the aria snapshot of the page — equivalent to page.locator('body').ariaSnapshot().
Method locator.normalize() converts a locator to follow best practices like test ids and aria roles.
Method page.pickLocator() enters an interactive mode where hovering over elements highlights them and shows the corresponding locator. Click an element to get its Locator back. Use page.cancelPickLocator() to cancel.
New APIs
Screencast
page.screencast provides video recording, real-time frame streaming, and overlay management.
Method browserContext.setStorageState() clears existing cookies, local storage, and IndexedDB for all origins and sets a new storage state — no need to create a new context.
Option artifactsDir in browserType.launch() to configure the artifacts directory.
🛠️ Other improvements
UI Mode has an option to only show tests affected by source changes.
UI Mode and Trace Viewer have improved action filtering.
HTML Reporter shows the list of runs from the same worker.
HTML Reporter allows filtering test steps for quick search.
New trace mode 'retain-on-failure-and-retries' records a trace for each test run and retains all traces when an attempt fails — great for comparing a passing trace with a failing one from a flaky test.
Known Issues ⚠️⚠️
navigator.platform emulation can cause Ctrl or Meta dispatching errors (https://redirect.github.com/microsoft/playwright/issues/40009). Pass PLAYWRIGHT_NO_UA_PLATFORM = '1' environment variable while we are issuing a patch release. Let us know in the issue how it affected you.
Breaking Changes ⚠️
Removed macOS 14 support for WebKit. We recommend upgrading your macOS version, or keeping an older Playwright version.
48b8c6 🤖 Merge PR #75132 [@types/luxon] Fix DateTime#isValid typing to support type guards and narrowing by @CBx0-dev
71e2e1 🤖 Merge PR #75139 [ramda] bump types-ramda to 0.32.0 by @Harris-Miller
8803a4 🤖 Merge PR #75108 feat(kakao.postcode): Add type definitions by @doinki
b341ee 🤖 Merge PR #75025 node: v26 by @Renegade334
Co-authored-by: Adam Ahmed <adam@released.so>
cd21ba 🤖 Merge PR #75143 [ex-abstract] fix ToPrimitive expected type by @jakebailey
3707ad 🤖 Merge PR #75142 frida-gum: Add typings for Process.findThreadById by @oleavr
1948da [Office-Runtime] Mark OfficeRuntime.ApiInformation as deprecated (#75107)
79b25d 🤖 Merge PR #75141 [webvis] Update type definitions for the non-npm package webvis 3.13.x by @TimLamThreedy
Co-authored-by: Timo Sturm <sturm.timo@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated Packages