chore(deps): update playwright to v1.61.1

[gierschv]

Why

The embed-client:tests job in the flat repo is failing job;

Error: browserType.launch: Executable doesn't exist at
/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell
current:  mcr.microsoft.com/playwright:v1.61.1-noble
required: mcr.microsoft.com/playwright:v1.58.2-noble

flat's develop landed chore(deps): update playwright to v1.61.1, so its runner image now ships the 1.61.1 browser builds. That job installs this repo's deps, which still pinned 1.58.2 — so the library went looking for a chromium build the image doesn't ship.

Playwright phrases this as "required: v1.58.2" because it reports what the installed library wants; the fix is to move the library up to the image, not the image down.

Changes

• package.json — playwright 1.58.2 → 1.61.1
• .gitlab-ci.yml — image v1.58.2-noble → v1.61.1-noble
• .gitlab-ci.yml — corepack prepare pnpm@10.17.1 → 11.0.9
• pnpm-lock.yaml — regenerated

Notes for reviewers

The pnpm bump is load-bearing, not drive-by. GitLab CI was still on 10.17.1 while #724 moved the GitHub workflows to 11.0.9. Left alone, GitLab would install a pnpm-11 lockfile with pnpm 10 under --frozen-lockfile.

The lockfile diff is large (~481 deletions) — mostly msw and @types/node disappearing. This is not caused by the playwright bump: a fresh resolve with the original 1.58.2 drops them too. It's pnpm 10→11 drift (pnpm 11 no longer auto-installs optional peers), latent since #724 bumped the workflows without regenerating the lockfile. The bump here just forced the re-resolve that surfaced it. Nothing imports msw.

Leftover, deliberately out of scope: msw: false in pnpm-workspace.yaml's allowBuilds is now dead config since msw is no longer in the graph. Harmless; happy to strip it if preferred.

Verification

• pnpm test — 81 passed, 1 skipped, 2 files
• pnpm install --frozen-lockfile — clean

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	playwright@​1.61.1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Potential security risk (AI signal): npm playwright-core is 72.0% likely risky Notes: This fragment is not overtly obfuscated and shows no explicit credential theft or exfiltration, but it is security-critical because it downloads an MSI from an unvalidated, caller-supplied URL and immediately executes it silently via msiexec. Post-install verification only checks for file presence/VersionInfo and does not attest authenticity. Treat as a potentially dangerous installer bootstrapper unless the URL is strictly allowlisted to trusted Microsoft endpoints and the MSI is verified (signature/hash) before installation. Confidence: 0.72 Severity: 0.78 From: pnpm-lock.yaml → npm/playwright@1.61.1 → npm/playwright-core@1.61.1 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/playwright-core@1.61.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential security risk (AI signal): npm playwright-core is 70.0% likely risky Notes: The primary risk is supply-chain/installer substitution: the script downloads an MSI from an unvalidated, caller-supplied URL and immediately performs a silent msiexec install without any integrity or publisher verification. While the snippet itself shows no overt backdoor/exfiltration logic, its execution model makes it potentially dangerous if $args[0] can be influenced or if the MSI source is not strictly trusted and authenticated upstream. Confidence: 0.70 Severity: 0.72 From: pnpm-lock.yaml → npm/playwright@1.61.1 → npm/playwright-core@1.61.1 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/playwright-core@1.61.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential security risk (AI signal): npm playwright-core is 70.0% likely risky Notes: No direct indicators of stealthy malware (exfiltration, backdoor logic, or obfuscation) are present in this fragment. The primary security concern is supply-chain execution risk: the script downloads an MSI from a caller-provided URL and silently installs it via msiexec without any signature/hash/publisher verification or URL/domain allowlisting. If $args[0] is attacker-controlled or tampered, the MSI could contain malicious installer actions executed on the host. Verification is limited to checking msedge.exe presence/version info and does not protect against installing the wrong or compromised package. Confidence: 0.70 Severity: 0.70 From: pnpm-lock.yaml → npm/playwright@1.61.1 → npm/playwright-core@1.61.1 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/playwright-core@1.61.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report