PyPI / playwright / 1.64.1

playwright 1.64.1

Source

https://github.com/microsoft/playwright-python

Tag scanned

v1.64.1

Compared with

v1.64.0 (0 signals introduced since)

Files

345 scanned, 70 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 5 info

Scan time

5.4 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 5 of 5 warn and critical signals; 5 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 21:43

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review frame-introspection playwright/_impl/_connection.py:682:13

   `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

   def _capture_stack_trace() -> ParsedStackTrace:
       frame = inspect.currentframe()
       # Skip this helper and the caller that only captures the stack.
       frame = frame.f_back.f_back if frame and frame.f_back else None

   likely benign LLM, confidence 0.93 Uses inspect.currentframe to trim the call stack for Playwright's error stack trace capture.

   Reasoning

   Stack-frame introspection to skip helper frames when capturing a stack trace for error reporting is a standard, legitimate pattern in Playwright's connection code. No dynamic execution or exfiltration is present.

2. info warn → info by review frame-introspection playwright/_impl/_path_utils.py:23:29

   `inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)

       """Returns the callee (`__file__`) directory name"""
       frame = cast(FrameType, inspect.currentframe()).f_back
       module = inspect.getmodule(frame)
       assert module

   likely benign LLM, confidence 0.93 Resolves the calling module's directory via inspect.currentframe and getmodule.

   Reasoning

   Getting the caller's frame to resolve its module directory (__file__-equivalent) is a common, benign way to locate the calling module's directory. Nothing is executed or hidden.

3. info warn → info by review dynamic-import scripts/codegen/generate_api.js:120:22

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

     fail('Set PW_SRC_DIR to a microsoft/playwright checkout at the release branch in DRIVER_VERSION.');
   const { parseApi } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'api_parser'));
   const { Type, parseCodeLang } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'documentation'));

   likely benign LLM, confidence 0.90 Codegen script requiring Playwright doclint modules from a configured source directory.

   Reasoning

   This is a build-time codegen script that requires modules from a Playwright source checkout whose path is supplied through the PW_SRC_DIR environment variable. The non-literal specifier is a developer-tooling pattern, not obfuscation or a supply-chain payload, though the path is taken from the environment.

4. info warn → info by review dynamic-import scripts/codegen/generate_api.js:121:33

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

   const { parseApi } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'api_parser'));
   const { Type, parseCodeLang } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'documentation'));
   const md = require(path.join(PW_SRC_DIR, 'utils', 'markdown'));

   likely benign LLM, confidence 0.90 Requires a doclint module from the Playwright source checkout during API generation.

   Reasoning

   Same codegen pattern: path.join over a configured PW_SRC_DIR with fixed sub-path segments. Benign developer tooling, the specifier is not attacker-controlled in a shipped package.

5. info warn → info by review dynamic-import scripts/codegen/generate_api.js:122:12

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

   const { Type, parseCodeLang } = require(path.join(PW_SRC_DIR, 'utils', 'doclint', 'documentation'));
   const md = require(path.join(PW_SRC_DIR, 'utils', 'markdown'));
   
   const BASE_CLASS = isAsync ? 'AsyncBase' : 'SyncBase';

   likely benign LLM, confidence 0.90 Requires the markdown utility from the Playwright source checkout during codegen.

   Reasoning

   Same codegen script loading utility modules relative to PW_SRC_DIR with literal path segments. Consistent with ordinary build tooling and not evasive.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/microsoft/playwright-python playwright-python && cd playwright-python
git checkout v1.64.1
disclude scan --severity info --diff v1.64.0 .