playwright 1.64.0

Source: https://github.com/microsoft/playwright-python
Tag scanned: v1.64.0
Compared with: v1.63.0 (3 signals introduced since)
Files: 295 scanned, 120 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 5 info
Scan time: 6.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 22:44

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import scripts/codegen/generate_api.js:120:22 new in this release

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
  fail('Set PW_SRC_DIR to a microsoft/playwright checkout at the release branch in DRIVER_VERSION.');
const { parseApi } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'api_parser'));
const { Type, parseCodeLang } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'documentation'));
```
likely benign LLM, confidence 0.86 Codegen script loading Playwright's doclint parser from a local source checkout configured by an environment variable.
Reasoning
The require specifier is built with path.join from PW_SRC_DIR, which the script validates and requires to point to a local Playwright checkout. This is a developer codegen script loading local modules, not fetching or executing remote or hidden code. The non-literal specifier is the only reason it was flagged.
info ~~warn~~ → info by review dynamic-import scripts/codegen/generate_api.js:121:33 new in this release

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
const { parseApi } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'api_parser'));
const { Type, parseCodeLang } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'documentation'));
const md = require(path.join(PW_SRC_DIR, 'utils', 'markdown'));
```
likely benign LLM, confidence 0.86 Codegen script requiring the doclint documentation module from the local Playwright source tree.
Reasoning
Same pattern as the adjacent require: path.join under the validated PW_SRC_DIR root loads a local documentation module from the Playwright checkout. No obfuscation or remote loading is present in the snippet.
info ~~warn~~ → info by review dynamic-import scripts/codegen/generate_api.js:122:12 new in this release

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
const { Type, parseCodeLang } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'documentation'));
const md = require(path.join(PW_SRC_DIR, 'utils', 'markdown'));

const BASE_CLASS = isAsync ? 'AsyncBase' : 'SyncBase';
```
likely benign LLM, confidence 0.86 Codegen script requiring a markdown utility from the local Playwright source tree.
Reasoning
The require path.join(PW_SRC_DIR, 'utils', 'markdown') loads a local markdown utility from the configured checkout. It matches the surrounding codegen requires and shows no sign of malicious loading.
info ~~warn~~ → info by review frame-introspection playwright/_impl/_connection.py:682:13

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
def _capture_stack_trace() -> ParsedStackTrace:
    frame = inspect.currentframe()
    # Skip this helper and the caller that only captures the stack.
    frame = frame.f_back.f_back if frame and frame.f_back else None
```
likely benign LLM, confidence 0.92 Stack-trace capture helper in Playwright's connection layer that walks frames to attribute errors to the caller.
Reasoning
The snippet uses inspect.currentframe() and f_back to skip the helper and caller frames so the captured stack trace points at user code. This is a standard way for a library to build error stack traces, with no execution, network, or encoding behavior in the snippet.
info ~~warn~~ → info by review frame-introspection playwright/_impl/_path_utils.py:23:29

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    """Returns the callee (`__file__`) directory name"""
    frame = cast(FrameType, inspect.currentframe()).f_back
    module = inspect.getmodule(frame)
    assert module
```
likely benign LLM, confidence 0.92 Helper that resolves the calling module's directory using frame introspection.
Reasoning
The function returns the directory of its callee by taking the caller frame and resolving its module, then asserting it is non-null. This is a common Python idiom for locating a module's own directory and does not hide or run anything.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/microsoft/playwright-python playwright-python && cd playwright-python
git checkout v1.64.0
disclude scan --severity info --diff v1.63.0 .