PyPI / playwright / 1.64.0

playwright 1.64.0

Source

https://github.com/microsoft/playwright-python

Tag scanned

v1.64.0

Compared with

v1.63.0 (3 signals introduced since)

Files

345 scanned, 70 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

5.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 07:21

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import scripts/codegen/generate_api.js:120:22 new in this release

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

     fail('Set PW_SRC_DIR to a microsoft/playwright checkout at the release branch in DRIVER_VERSION.');
   const { parseApi } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'api_parser'));
   const { Type, parseCodeLang } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'documentation'));

   likely benign LLM, confidence 0.85 Codegen script requiring Playwright doclint modules via a path built from a configured source directory.

   Reasoning

   This is a build-time codegen script in Playwright's repo. The require path is built from PW_SRC_DIR, an environment-configured checkout directory, joined with fixed relative module names. Dynamic require here is a developer tooling choice, not obfuscation or a dropper.

2. info warn → info by review dynamic-import scripts/codegen/generate_api.js:121:33 new in this release

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

   const { parseApi } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'api_parser'));
   const { Type, parseCodeLang } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'documentation'));
   const md = require(path.join(PW_SRC_DIR, 'utils', 'markdown'));

   likely benign LLM, confidence 0.85 Codegen script loading Playwright markdown and documentation helpers from a configured checkout.

   Reasoning

   Same build-time script pattern: require resolved from PW_SRC_DIR joined with fixed module path segments. Non-literal specifier is explained by the configurable checkout location; no sign of malicious intent.

3. info warn → info by review dynamic-import scripts/codegen/generate_api.js:122:12 new in this release

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

   const { Type, parseCodeLang } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'documentation'));
   const md = require(path.join(PW_SRC_DIR, 'utils', 'markdown'));
   
   const BASE_CLASS = isAsync ? 'AsyncBase' : 'SyncBase';

   likely benign LLM, confidence 0.85 Codegen script requiring the markdown utility module from a configured Playwright checkout.

   Reasoning

   Consistent with the other requires in the same file: a developer tool loading modules from a checkout path set via environment. The flag is a generic dynamic-import heuristic firing on a legitimate pattern.

4. info warn → info by review frame-introspection playwright/_impl/_connection.py:682:13

   `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

   def _capture_stack_trace() -> ParsedStackTrace:
       frame = inspect.currentframe()
       # Skip this helper and the caller that only captures the stack.
       frame = frame.f_back.f_back if frame and frame.f_back else None

   likely benign LLM, confidence 0.90 Playwright helper that uses inspect.currentframe to trim its own frames from a captured stack trace.

   Reasoning

   Stack-frame introspection to skip helper frames when capturing a stack trace for error reporting is a standard, legitimate pattern in Playwright's connection code. No execution of retrieved data or exfiltration is visible.

5. info warn → info by review frame-introspection playwright/_impl/_path_utils.py:23:29

   `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

       """Returns the callee (`__file__`) directory name"""
       frame = cast(FrameType, inspect.currentframe()).f_back
       module = inspect.getmodule(frame)
       assert module

   likely benign LLM, confidence 0.90 Path utility that resolves the directory of the calling module via frame introspection.

   Reasoning

   Using inspect.currentframe().f_back with getmodule to find the calling module's directory is a common way to resolve __file__ of a caller. Benign utility code.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/microsoft/playwright-python playwright-python && cd playwright-python
git checkout v1.64.0
disclude scan --severity info --diff v1.63.0 .