npm / playwright / 1.65.0-alpha-2026-10-22

playwright 1.65.0-alpha-2026-10-22

Source: https://github.com/microsoft/playwright
Commit scanned: ca7ca36145b8 (recorded by npm)
Directory: packages/playwright (only this part of the repository was scanned)
Compared with: 66070a1eaa0b (0 signals introduced since)
Files: 132 scanned, 13 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 12 info
Scan time: 7.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 07:29

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution packages/playwright/src/isomorphic/teleReceiver.ts:462:90

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
  private _onStdIO(type: JsonStdIOType, testId: string | undefined, resultId: string | undefined, data: string, isBase64: boolean) {
    const chunk = isBase64 ? ((globalThis as any).Buffer ? Buffer.from(data, 'base64') : atob(data)) : data;
    const test = testId ? this._tests.get(testId) : undefined;
```
likely benign LLM, confidence 0.90 Base64-decodes test runner stdout/stderr chunks for reporting.
Reasoning
atob decodes a base64 stdio chunk received from the test runner's own IPC channel. It only produces data for output display and never feeds eval or a fetch of code.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/package.ts:22:28

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
export const packageRoot = path.join(__dirname, '..');
export const packageJSON = require(path.join(packageRoot, 'package.json'));

export function libPath(...parts: string[]): string {
```
likely benign LLM, confidence 0.90 Loads the package's own package.json via a computed path.
Reasoning
The require target is path.join of the package root and the literal 'package.json', which is a fixed, local, expected file.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/reporters/coverage.ts:120:27

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      const resolveFrom = (name: string) => require.resolve(name, { paths: [this._options.configDir] });
      const libCoverage = require(resolveFrom('istanbul-lib-coverage'));
      const libReport = require(resolveFrom('istanbul-lib-report'));
      const reports = require(resolveFrom('istanbul-reports'));
```
likely benign LLM, confidence 0.90 Resolves and loads the istanbul-lib-coverage dependency.
Reasoning
The specifier is resolved with require.resolve from the config directory for well-known istanbul packages. This is standard dependency loading for coverage reporting.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/reporters/coverage.ts:121:25

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      const libCoverage = require(resolveFrom('istanbul-lib-coverage'));
      const libReport = require(resolveFrom('istanbul-lib-report'));
      const reports = require(resolveFrom('istanbul-reports'));
      const context = libReport.createContext({
```
likely benign LLM, confidence 0.90 Resolves and loads the istanbul-lib-report dependency.
Reasoning
Same resolveFrom pattern loading the fixed istanbul-lib-report package. No attacker-controlled input is visible.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/reporters/coverage.ts:122:23

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      const libReport = require(resolveFrom('istanbul-lib-report'));
      const reports = require(resolveFrom('istanbul-reports'));
      const context = libReport.createContext({
        dir: outputDir,
```
likely benign LLM, confidence 0.90 Resolves and loads the istanbul-reports dependency.
Reasoning
Same resolveFrom pattern loading the fixed istanbul-reports package, which is ordinary plugin-style loading.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/transform/babelBundle.ts:169:52

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      ...plugins,
      ...pluginsEpilogue.map(([name, options]) => [require(name), options]),
    ],
    compact: false,
```
likely benign LLM, confidence 0.85 Loads Babel plugins named in the configuration.
Reasoning
Plugin names come from the user's own Babel configuration and are loaded as named Babel plugins. This is expected behaviour for a configurable transform pipeline.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/transform/transform.ts:259:74

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
  const { babelTransform }: { babelTransform: BabelTransformFunction } = require(libPath('transform', 'babelBundle'));
  const babelResult = babelTransform(originalCode, filename, !!moduleUrl, pluginsEpilogue, useDefineForClassFields, jsx);
  if (!babelResult?.code)
```
likely benign LLM, confidence 0.90 Loads the internal babelBundle module via a helper path.
Reasoning
The require target is libPath of the fixed 'transform/babelBundle' module, a bundled internal module, so the specifier is not attacker-controlled.
info ~~critical~~ → info by review dynamic-execution packages/playwright/src/transform/transform.ts:286:29

`eval` called with a non-literal expression (ast pass, confidence 0.90)
```
    const fileName = url.pathToFileURL(file);
    const esmImport = () => eval(`import(${JSON.stringify(fileName)})`);

    // For ESM imports handled by the asynchronous loader, issue a preflight to populate
```
likely benign LLM, confidence 0.85 Uses eval to issue a native dynamic import() of an ESM test file.
Reasoning
The eval wraps a dynamic import() of JSON.stringify of a file URL. This is a known idiom for keeping import() native inside CommonJS output so ESM test files load correctly, and the input is the test file being loaded rather than untrusted data.
info ~~critical~~ → info by review dynamic-execution packages/playwright/src/transform/transform.ts:293:13

`eval` called with a non-literal expression (ast pass, confidence 0.90)
```
    if (loaderChannel) {
      await eval(`import(${JSON.stringify(fileName + '.esm.preflight')})`)
          .catch((error: any) => debugTest('Failed to load preflight for ' + file + ', source maps may be missing for errors thrown during loading.', error))
          .finally(nextTask);
```
likely benign LLM, confidence 0.85 Uses eval to trigger a native dynamic import of an ESM preflight file.
Reasoning
Same native import() idiom via eval, here for a preflight module of the test file, with a JSON-escaped path and a catch handler. This is a loader mechanism, not a dropper.
info ~~warn~~ → info by review dynamic-import packages/playwright/src/transform/transform.ts:305:18

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
  }
  const result = require(file);
  const depsCollector = cc.currentFileDepsCollector();
  if (depsCollector) {
```
likely benign LLM, confidence 0.90 Requires the test file under test for execution.
Reasoning
require(file) loads the test file being executed, which is the core purpose of a test runner. The file comes from the project's own test discovery.
info whitespace-anomaly packages/playwright/src/transform/tsconfig-loader.ts:34:1

file mixes tab and space indentation (9 tab-indented and 112 space-indented lines) (raw pass, confidence 0.40)
```
interface TsConfig {
  extends?: string;
  compilerOptions?: {
    baseUrl?: string;
```

info long-line packages/playwright/types/test.d.ts:7632:1

line length 560 characters (raw pass, confidence 0.50)

  video: VideoMode | /** deprecated */ 'retry-with-video' | { mode: VideoMode, size?: ViewportSize, fps?: number, show?: { actions?: { duration?: number, position?: 'top-left' | 'top' | 'top-right' | 'bottom-left' | 'bottom' | 'bottom-right', /** @deprecated Use `style.title` instead. */ fontSize?: number, cursor?: 'no

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/microsoft/playwright playwright && cd playwright
git checkout ca7ca36145b84183cf423c2a099bd7e9cd8b1cb3
disclude scan --severity info --diff 66070a1eaa0b869379607a9e0e1a652ddf2a77da packages/playwright