npm / playwright / 1.65.0-alpha-2026-10-18

playwright 1.65.0-alpha-2026-10-18

Source: https://github.com/microsoft/playwright
Commit scanned: b335271cdc2b (recorded by npm)
Directory: packages/playwright (only this part of the repository was scanned)
Compared with: 6bbe2475ba79 (0 signals introduced since)
Files: 132 scanned, 13 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 12 info
Scan time: 6.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-19 04:55

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution packages/playwright/src/isomorphic/teleReceiver.ts:462:90

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
  private _onStdIO(type: JsonStdIOType, testId: string | undefined, resultId: string | undefined, data: string, isBase64: boolean) {
    const chunk = isBase64 ? ((globalThis as any).Buffer ? Buffer.from(data, 'base64') : atob(data)) : data;
    const test = testId ? this._tests.get(testId) : undefined;
```
likely benign LLM, confidence 0.85 Base64 decoding of test stdio output in a Playwright-style test receiver.
Reasoning
atob is used as a fallback decoder for stdio chunks in a test reporter receiver when Buffer is unavailable; the decoded data is just output chunk content, not fetched or eval'd here.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/package.ts:22:28

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
export const packageRoot = path.join(__dirname, '..');
export const packageJSON = require(path.join(packageRoot, 'package.json'));

export function libPath(...parts: string[]): string {
```
likely benign LLM, confidence 0.85 Loads the package's own package.json via a computed path.
Reasoning
require of a path.join result rooted at __dirname to load package.json is a standard, fixed-target pattern in a test framework package.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/reporters/coverage.ts:120:27

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      const resolveFrom = (name: string) => require.resolve(name, { paths: [this._options.configDir] });
      const libCoverage = require(resolveFrom('istanbul-lib-coverage'));
      const libReport = require(resolveFrom('istanbul-lib-report'));
      const reports = require(resolveFrom('istanbul-reports'));
```
likely benign LLM, confidence 0.85 Loads istanbul coverage libraries via require.resolve from config dir.
Reasoning
Requires coverage libraries resolved relative to the configured config directory using require.resolve; this is a normal plugin/dependency resolution pattern with fixed package names.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/reporters/coverage.ts:121:25

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      const libCoverage = require(resolveFrom('istanbul-lib-coverage'));
      const libReport = require(resolveFrom('istanbul-lib-report'));
      const reports = require(resolveFrom('istanbul-reports'));
      const context = libReport.createContext({
```
likely benign LLM, confidence 0.85 Loads istanbul-lib-report via resolved path.
Reasoning
Same fixed-name istanbul library loading via resolveFrom; standard dependency loading in a coverage reporter.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/reporters/coverage.ts:122:23

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      const libReport = require(resolveFrom('istanbul-lib-report'));
      const reports = require(resolveFrom('istanbul-reports'));
      const context = libReport.createContext({
        dir: outputDir,
```
likely benign LLM, confidence 0.85 Loads istanbul-reports via resolved path.
Reasoning
Same pattern loading istanbul-reports with fixed names resolved from the config directory; expected for a coverage reporter.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/transform/babelBundle.ts:169:52

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      ...plugins,
      ...pluginsEpilogue.map(([name, options]) => [require(name), options]),
    ],
    compact: false,
```
likely benign LLM, confidence 0.80 Loads configured Babel plugins by name.
Reasoning
Requires Babel plugins named in configuration, a standard plugin-loading mechanism for a bundled transform; the names come from the project's own config rather than untrusted input.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/transform/transform.ts:259:74

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
  const { babelTransform }: { babelTransform: BabelTransformFunction } = require(libPath('transform', 'babelBundle'));
  const babelResult = babelTransform(originalCode, filename, !!moduleUrl, pluginsEpilogue, useDefineForClassFields, jsx);
  if (!babelResult?.code)
```
likely benign LLM, confidence 0.85 Requires the internal babelBundle module through a path helper.
Reasoning
Loads the babelBundle module via libPath with a fixed string argument; the non-literal form is only a bundler-safe path helper, not a payload loader.
info ~~critical~~ → info by review dynamic-execution packages/playwright/src/transform/transform.ts:286:29

`eval` called with a non-literal expression (ast pass, confidence 0.90)
```
    const fileName = url.pathToFileURL(file);
    const esmImport = () => eval(`import(${JSON.stringify(fileName)})`);

    // For ESM imports handled by the asynchronous loader, issue a preflight to populate
```
likely benign LLM, confidence 0.80 eval wrapping import() of a test file URL to bypass transpilation.
Reasoning
eval is used to perform a dynamic import() so that the ESM loader is not transpiled into require by the bundler; the argument is JSON.stringify of a file URL derived from the test file path, a known idiom in test runners, though eval is still a risky construct worth noting.
info ~~critical~~ → info by review dynamic-execution packages/playwright/src/transform/transform.ts:293:13

`eval` called with a non-literal expression (ast pass, confidence 0.90)
```
    if (loaderChannel) {
      await eval(`import(${JSON.stringify(fileName + '.esm.preflight')})`)
          .catch((error: any) => debugTest('Failed to load preflight for ' + file + ', source maps may be missing for errors thrown during loading.', error))
          .finally(nextTask);
```
likely benign LLM, confidence 0.80 eval-wrapped dynamic import of a preflight module for source maps.
Reasoning
Same eval-wrapped import idiom loading a preflight ESM module keyed to the file name for source map handling; input is JSON-stringified local path, consistent with loader internals.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/transform/transform.ts:305:18

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
  }
  const result = require(file);
  const depsCollector = cc.currentFileDepsCollector();
  if (depsCollector) {
```
likely benign LLM, confidence 0.85 Requires the user's test file to load it for execution.
Reasoning
require(file) loads the test file being transformed/executed by the test runner itself; this is the core purpose of the module and expected.
info whitespace-anomaly packages/playwright/src/transform/tsconfig-loader.ts:34:1

file mixes tab and space indentation (9 tab-indented and 112 space-indented lines) (raw pass, confidence 0.40)
```
interface TsConfig {
  extends?: string;
  compilerOptions?: {
    baseUrl?: string;
```

info long-line packages/playwright/types/test.d.ts:7632:1

line length 560 characters (raw pass, confidence 0.50)

  video: VideoMode | /** deprecated */ 'retry-with-video' | { mode: VideoMode, size?: ViewportSize, fps?: number, show?: { actions?: { duration?: number, position?: 'top-left' | 'top' | 'top-right' | 'bottom-left' | 'bottom' | 'bottom-right', /** @deprecated Use `style.title` instead. */ fontSize?: number, cursor?: 'no

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/microsoft/playwright playwright && cd playwright
git checkout b335271cdc2b57cac2be8ad37c5dd283ac6b8938
disclude scan --severity info --diff 6bbe2475ba79174c3df5f28a435958ef0351d515 packages/playwright