[dependabot]

Bumps the npm-minor-patch group with 4 updates in the / directory: @playwright/test, @types/node, electron and obsidian.

Updates @playwright/test from 1.63.0 to 1.64.0

Release notes

Sourced from @​playwright/test's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits

• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
• 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
• 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
• 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
• dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
• Additional commits viewable in compare view

Updates @types/node from 24.19.1 to 24.19.2

Commits

• See full diff in compare view

Updates electron from 43.7.7 to 43.7.9

Release notes

Sourced from electron's releases.

electron v43.7.9

Release Notes for v43.7.9

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. #54667
• Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. #54658

electron v43.7.8

Release Notes for v43.7.8

Fixes

• Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. #54597
• Fixed webview.findInPage() hanging when the host page also has an iframe. #54584 (Also in 44, 45)
• Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. #54622

Commits

• c41115b chore: cherry-pick 47 changes from angle, chromium, dawn, fontconfig, skia, v...
• e546dde test: add mouse-input addon for setIgnoreMouseEvents specs (#54606)
• b2a89a1 chore: cherry-pick 9 changes from angle, chromium, skia, v8 and webrtc (#54658)
• e23db61 fix: update ICU time zone data to tzdata 2026d (#54622)
• 83a7520 build: update PGO profiles (#54640)
• 0b605a8 chore: cherry-pick 69403d85b78b from chromium (#54597)
• f5e30a9 fix: webview findInPage() hang when the embedder page has an iframe (#54584)
• See full diff in compare view

Updates obsidian from 1.13.1 to 1.14.4

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[qawatake]

Update review: npm-minor-patch group — @playwright/test 1.63.0 → 1.64.0, @types/node 24.19.1 → 24.19.2, electron 43.7.7 → 43.7.9, obsidian 1.13.1 → 1.14.4

This PR supersedes #52. Dependabot closed #52 after @dependabot rebase, once #51 and #50 had been merged. Compared with #52, this PR adds @types/node 24.19.2. The other versions and their lockfile integrities are identical to #52, so I reused the upstream evidence for them (release notes, tarball diffs, provenance, license). Everything repo-specific was redone on this head.

Final decision: Proceed
Risk assessment: Medium. Axis hit: change type. @playwright/test and obsidian are minor bumps, and Playwright 1.64.0 lists breaking changes, though none of them applies to this repo. All other axes are Low.
Review type: Approve
Release/deploy: Not required (no-release). I built the artifact at base d186448 (current main, after #51 and #50) and at head 7496642 with pnpm install --frozen-lockfile && pnpm build, then built base a second time to check determinism. main.js sha256 a1c0cbd9… and manifest.json sha256 07a565f7… are identical in all three builds. All four packages are devDependencies, and @types/node is type-only. obsidian and electron are external in esbuild.config.mjs, and check-bundled-deps reports 0 package.

Changes reviewed (2.1)

• Primary sources consulted:
  • @types/node: a diff of the npm tarballs 24.19.1 → 24.19.2, and the upstream commit 8cbe925 (DefinitelyTyped#75656).
  • @playwright/test: v1.64.0 release notes.
  • electron: release notes for v43.7.8 and v43.7.9, plus a diff of the npm tarballs.
  • obsidian: the package has no CHANGELOG entries for 1.13/1.14 and no tags or releases, so I diffed the npm tarballs 1.13.1 → 1.14.4 directly. I compared them against the obsidianmd/obsidian-api commits "Update to Obsidian 1.14.4" (40301c1), 06b4f1b, and 9abd960.
  • Transitive: moment 2.31.0 release; tag messages for @codemirror/state 6.7.6 and @codemirror/view 6.43.13 on code.haverbeke.berlin.
• Version range reviewed:
  • @types/node: 24.19.1 → 24.19.2.
  • playwright: 1.63.0 → 1.64.0.
  • electron: 43.7.7 → 43.7.8 → 43.7.9.
  • obsidian: 1.13.1 → 1.14.4. npm has no versions in between, but 1.13.2 exists as a git commit. I reviewed the whole tarball diff.
• Breaking / behavior changes:
  • @types/node 24.19.2: the format parameter of util.styleText now also accepts hex colors inside the array form. This is a type-level widening plus a doc comment, and nothing else in the .d.ts files changed.
  • Playwright 1.64.0 breaking changes:
    • The screen property is forwarded from device descriptors.
    • JSX in test files follows tsconfig.json.
    • --update-snapshots=missing now passes.
    • Elements inside hidden iframes are considered hidden.
    • Deprecated: screencast fontSize → style.
    • Bundled browsers are now Chromium 156, Firefox 157 and WebKit 27.2.
  • Electron 43.7.8: macOS sleep/wake crash fix, webview.findInPage() fix, tzdata 2026d. Electron 43.7.9: upstream Chromium/V8/etc. backports. In the npm package, only checksums.json and the version strings changed (index.js, cli.js, install.js are identical).
  • obsidian 1.14.4 (obsidian.d.ts +3498/−728):
    • Large doc-comment additions.
    • New settings, secret and frontmatter types; Side is widened.
    • Global augmentations String.prototype.endsWith and ObjectConstructor.hasOwn were removed.
    • The return type of DocumentFragment.find is now HTMLElement | null.
    • SecretComponent.onChange signature changed.
    • Peer deps @codemirror/state 6.5.0 → 6.7.6 and @codemirror/view 6.38.6 → 6.43.13, and dep moment 2.29.4 → 2.31.0.
  • Transitive packages I looked at:
    • moment 2.31.0 fixes CVE-2026-17495 / GHSA-4p3w-j4w9-5jqw and adds bug fixes.
    • @codemirror/* are bug-fix releases, deprecating visualLineSide.
  • The other transitive packages (playwright, playwright-core) move in lockstep with @playwright/test. The lockfile's package-name set is identical before and after (72 names): no package was added or removed.

Impact and adequacy of the PR (2.2, 2.3)

Change	Affected location / no impact	Evidence	Is the PR adequate
@types/node: styleText signature widened	No impact	grep styleText over main.ts, scripts/, tests/ and the configs finds no use. check-toolchain confirms the @types/node major still matches Node 24	Yes
PW: device screen forwarding	No impact	playwright.config.ts imports devices but spreads no device descriptor; tests use _electron.launch only	Yes
PW: JSX follows tsconfig	No impact	No .tsx/JSX under tests/	Yes
PW: --update-snapshots=missing, toHaveScreenshot	No impact	No snapshot / screenshot assertions (grep updateSnapshots|toHaveScreenshot)	Yes
PW: hidden-iframe visibility	No impact	Only toBeVisible() is tests/e2e/sample.spec.ts:74 (getByText("Woah!") in the Obsidian window, not an iframe)	Yes
PW: new bundled browsers / browser regressions reported for 1.64	No impact	Tests drive Electron via _electron, not bundled browsers	Yes
Electron patch fixes	e2e runtime only	scripts/setup-obsidian.sh checks the Electron major against Obsidian's bundled one; CI log: Electron 43.7.9 matches Obsidian's bundled major (43.7.7)	Yes
obsidian: removed endsWith/hasOwn augmentations, find return type, SecretComponent.onChange	No impact	main.ts imports App, Editor, MarkdownView, Modal, Notice, Plugin, PluginSettingTab, Setting. Its only onChange is on a TextComponent (main.ts:140). There is no endsWith/hasOwn/.find( use in main.ts; the .find( calls in tests/e2e-setup/cleanup.ts are on arrays. tsc --noEmit passes on head.	Yes
obsidian peers @codemirror/*, moment	No impact on the artifact	Listed as external in esbuild.config.mjs; main.ts does not import them; type-only via obsidian.d.ts	Yes

Verification (2.4)

• CI results, and what CI does not cover: run 38998321529 on head 7496642. Its base is d186448, so jdx/mise-action v5.1.1 and actions/upload-artifact v7.0.2 were already on main. build, e2e and test-e2e-tools all succeeded. I read the log bodies:

  • pnpm install resolved the expected versions, including @types/node 24.19.2.
  • toolchain: ok, actions-pinned: ok, config-schema: ok (biome.jsonc -> @biomejs/biome@2.5.15).
  • pnpm audit --audit-level=high: "No known vulnerabilities found".
  • biome check: "Checked 7 files … No fixes applied".
  • tsc --noEmit: clean.
  • bundled-deps: ok.
  • The e2e jobs ran against Obsidian v1.14.4, the same version as the new types, with 1 passed each.

  CI does not cover cold Playwright features (video, WebMCP), which this repo does not use.

• Additional checks I did:

  • Ran the local artifact diff described above (no change) and a local pnpm typecheck on head (passes).
  • Diffed the tarballs for obsidian and electron.
  • Verified that the electron checksums.json (75 entries) matches SHASUMS256.txt of the v43.7.9 GitHub release.

Rollback, supply chain, license (2.5, 2.6, 2.7)

• Rollback: revert package.json and pnpm-lock.yaml. No persistent data, schema or artifact format is involved.
• Supply chain:
  • Lockfile integrity: every changed integrity in pnpm-lock.yaml matches dist.integrity from the npm registry. No entry changes its hash without changing its version.
  • Install scripts: none of the changed packages declares preinstall/install/postinstall. electron has had none in either version: it uses the install-electron bin. The @codemirror/* packages have only prepare, which does not run for registry installs.
  • @types/node 24.19.2:
    • Published 2026-10-09 (8 days ago) by the types account, the same publisher as 24.19.1, through the DefinitelyTyped publisher.
    • No npm provenance, before or after, so the publish path is unchanged.
    • The content matches upstream commit 8cbe925 (merged PR #75656). The tarball diff touches only util.d.ts (+7/−4), package.json (version and content hash) and README.md.
    • No install scripts. Dependencies are unchanged (undici-types >=7.24.0 <7.24.7).
  • @playwright/test, playwright, playwright-core 1.64.0: published via npm trusted publishing with provenance from microsoft/playwright, .github/workflows/publish_release.yml, refs/tags/v1.64.0, commit 606ecd8b. That commit matches tag v1.64.0. The publish path (repo, workflow, publisher) is the same as 1.63.0. Published 2026-10-07 (10 days ago).
  • electron 43.7.9: published by electron-nightly, the same publisher as 43.7.7. It has no provenance, and neither did 43.7.7. Tag v43.7.9 is annotated: after dereferencing it points to commit c41115bb, released by sudowoodo-release-bot[bot]. The binary download is pinned by checksums.json, which matches the GitHub release. Published 2026-10-07.
  • obsidian 1.14.4: published by lishid, the same publisher as 1.13.1. It has no provenance, and neither did 1.13.1. The upstream repo has never had tags or releases, so the "tag exists" check cannot be met for any version of this package. I compensated with a content check:
    • The 1.13.1 tarball's obsidian.d.ts is byte-identical to upstream commit 28a6b86 ("Release v1.13.1").
    • The 1.14.4 tarball's obsidian.d.ts differs from upstream master (9abd960) only in 5 doc-comment lines ("sidedock" vs "sidebar").
    • The tarball contains only .d.ts, .md, LICENSE.md and package.json: no executable code. It also drops an undo.patch file that 1.13.1 shipped.
    • Published 2026-10-08 (9 days ago).
  • moment 2.31.0 (transitive): the publish path improved from a manual publish (2.29.4) to trusted publishing with provenance from moment/moment release.yml at refs/tags/2.31.0 (commit 15b45d4 = tag).
  • @codemirror/state 6.7.6 / @codemirror/view 6.43.13 (transitive):
    • The repository field changed from github.com/codemirror/* to code.haverbeke.berlin/codemirror/*. The move took effect in npm metadata from view 6.42.0 (2026-05) and is announced publicly: the GitHub repos are archived with "This repository has moved to https://code.haverbeke.berlin/…" in the README.
    • The publisher (marijn) is unchanged, and tags 6.7.6 / 6.43.13 exist on the new forge.
    • Both packages are used for types only here.
• License:
  • Unchanged for all four direct dependencies: @types/node MIT → MIT, @playwright/test Apache-2.0 → Apache-2.0, electron MIT → MIT, obsidian MIT → MIT.
  • Transitive packages: moment MIT and @codemirror/* MIT, both unchanged.
  • No packages were added and no majors were bumped.

Blocking conditions

• Hit: none.

Requests

• None.

Unverified items / notes for other reviewers (2.9)

• 2.8 (minimal change): this group bundles four unrelated dev-only packages. I accepted it because of the repo's deliberate npm-minor-patch grouping for development dependencies. The artifact is unchanged, so a revert of the whole PR is cheap. Any regression would show up in typecheck or e2e, and both are green.
• obsidian is declared as "latest" in package.json, so this group will keep picking up Obsidian type updates without a version cap. This was already the case before this PR and is not a blocker for it. I raise it only so someone can decide whether to pin it.
• Known constraint: obsidian has neither provenance nor tags upstream (see above). I relied on the content comparison against upstream master, not on a tag.
• The pnpm-workspace.yaml comment says electron "Downloads the Electron binary in its postinstall", but neither 43.7.7 nor 43.7.9 declares a postinstall script. The comment is stale. This is pre-existing and not caused by this PR.