[dependabot]

Bumps the npm-minor-patch group with 2 updates: @playwright/test and electron.

Updates @playwright/test from 1.64.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• See full diff in compare view

Updates electron from 43.7.9 to 43.8.0

Release notes

Sourced from electron's releases.

electron v43.8.0

Release Notes for v43.8.0

Fixes

• Fixed a crash on Linux at startup or on theme change with GTK modules loaded. #55016
• Fixed a crash when creating a framed window on Wayland in environments where GTK could not initialize. #54893 (Also in 44, 45)
• Fixed a Linux crash creating a window with a menu bar when GTK failed to load. #54884 (Also in 44, 45)
• Fixed an issue where clicks posted to a background app were dropped on macOS. #54905 (Also in 42, 44, 45)
• Fixed net.fetch and session.fetch failing permanently with net::ERR_FAILED after the Network Service process restarts. #54908 (Also in 42, 44, 45)
• Fixed utilityProcess dropping messages posted with process.parentPort.postMessage() right before the process exits. #54962 (Also in 42, 45)

Other Changes

• Backported fixes from upstream Chromium and V8. #55032
• Updated Node.js to v24.22.0. #55003

electron v43.7.11

Release Notes for v43.7.11

Other Changes

• Backported fixes from upstream ANGLE, Chromium, PDFium and V8. #54899

Documentation

• Documentation changes: #54881

electron v43.7.10

Release Notes for v43.7.10

Fixes

• Fixed a crash when starting without an available display server on Linux. #54795 (Also in 45)
• Fixed a renderer crash when a ResizeObserver loop-limit error handler modified layout. #54611 (Also in 42, 44, 45)

Commits

• 071a136 chore: cherry-pick 10 changes from chromium and v8 (#55032)
• 9ba6738 ci: bump build-tools to pick up the Windows clang-cl siso timeout (#55025)
• 6bb4a9f chore: bump node to v24.22.0 (43-x-y) (#55003)
• 3ca0cad test: wait for service worker activation before stopping it (#55022)
• febc3af fix: drop gtk-modules pin that crashed at startup or on theme change (43-x-y)...
• 273d575 test: keep running deferred cleanup and afterEach hooks when one throws or ha...
• 2ab04b9 fix: deliver pending utilityProcess messages before emitting exit (#54962)
• e5b4a6e test: deep-sign the signed-app NODE_OPTIONS specs' app only once (#54991)
• f9e29ba test: report child process failures from the import/require parity fixture (#...
• 2de3681 test: serve a checked-in file in the no-cors registerFileProtocol spec (#54972)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[qawatake]

Update review: npm-minor-patch group — @playwright/test 1.64.0 → 1.64.1, electron 43.7.9 → 43.8.0

Reviewed head: 71be9d612e115ccb680f458bfb8b5b2cdcb0f72e (base ead3a5b452eff22dbf8588833336a14c9caaf25e)

Final verdict: Proceed
Risk: Medium — axes hit: change type (electron is a minor release that moves the embedded Node.js 24.21.0 → 24.22.0; playwright changes a Chromium launch flag and _electron.launch window handling), supply chain (electron is published without npm provenance, as 43.7.9 was; compensated by the integrity and GitHub-release checksum cross-checks below). The other axes are low: both are devDependencies used only by the e2e runner, no untrusted input, rollback is reverting the lockfile, the e2e suite exercises the changed paths, licenses unchanged.
Review type: Approve
Release/deploy: Not needed (no-release) — reason: this repository is a sample / reference setup and ships no artifact: no GitHub releases or tags, main.js is gitignored, no release workflow, nothing published. Readers consume the repository itself, which the merge updates directly. Independently of that, neither package is bundled: @playwright/test and electron only run the e2e suite (pnpm build output is produced by esbuild, which is not touched). I add no-release so the PR does not read as "undecided".

Changes reviewed (2.1)

• Primary sources read: electron GitHub releases v43.7.10, v43.7.11, v43.8.0 and releases.electronjs.org/releases.json; playwright GitHub release v1.64.1 and its 5 commits; undici GitHub release v7.30.1 and compare v7.30.0...v7.30.1 (transitive); the npm registry metadata of every moved package.
• Version range covered: electron 43.7.9 → 43.7.10 → 43.7.11 → 43.8.0; @playwright/test 1.64.0 → 1.64.1 (with playwright and playwright-core 1.64.1); transitive undici 7.30.0 → 7.30.1 (electron > @electron/get > undici, range dep re-resolved). The lockfile diff contains exactly these packages; the set of package names is unchanged.
• Breaking / behavior changes: electron: none labeled breaking. Node.js 24.21.0 → 24.22.0 in the main process (Chromium 150.0.7871.250 and V8 15.0.245.31 unchanged across all four versions); Linux GTK / no-display-server crash fixes; net.fetch no longer fails permanently after a network-service restart; utilityProcess.postMessage before exit; macOS background-app click; electron.d.ts corrections for utilityProcess 'login' args and setSSLConfig.minVersion (docs fix, not runtime). playwright: Chromium is launched with AvoidCorsURLLoaderRestartOnRedirect disabled (#43249); _electron.launch no longer drops windows that have not navigated yet while connecting (#43250); bundled browser set unchanged. undici 7.30.1: security release — fix(fetch): abort excessive content encoding responses (07ded494, the 7.x fix for GHSA-xjj6-f33q-929c) plus TLS-renegotiation DoS, Agent TLS option preservation, cache/redirect confusion, cookie/eventsource/websocket bounds (14 commits).

Impact and adequacy of the PR (2.2, 2.3)

Change	Affected location / none	Evidence	PR handling adequate?
playwright #43250 _electron.launch window handling	tests/e2e-setup/setup.ts (electron.launch, app.windows(), app.firstWindow()), tests/e2e-setup/cleanup.ts, tests/e2e/sample.spec.ts	grep _electron in tests/: those three files	Yes: improvement direction (the setup flow waits for the first window, exactly the path #43250 fixes); all e2e jobs passed on this head
playwright #43249 route / redirect flag	None	grep .route( in tests/: no hits	Yes
playwright browser set	None: the e2e drives the electron binary, no playwright install step and no PLAYWRIGHT_BROWSERS_PATH (grep in .github/workflows, tests/: none)	—	Yes
electron 43.8.0 runtime (Node 24.22.0, fixes)	The e2e Obsidian process: scripts/setup-obsidian.sh runs Obsidian's unpacked sources on the npm electron binary and checks that its major matches Obsidian's bundled Electron	e2e / test-e2e-tools logs: + electron 43.8.0, Downloading Electron binary..., tests passed; major check unchanged (43)	Yes
electron Linux GTK / display fixes	None: e2e and test-e2e-tools run on macos-latest	ci.yml	Yes
electron d.ts changes (utilityProcess 'login', setSSLConfig)	None	grep `utilityProcess	setSSLConfig
electron download knobs (electron_use_remote_checksums, ELECTRON_OVERRIDE_DIST_PATH, electron_config_cache, ELECTRON_SKIP_BINARY_DOWNLOAD)	None	grep in workflows / scripts / pnpm-workspace.yaml: no hits; the workspace file documents that electron ≥ 42 has no postinstall and downloads on first require, which the log confirms	Yes
undici 7.30.1 (transitive)	The Electron binary download done by @electron/get during e2e	logs: Downloading Electron binary... completed with 7.30.1 in the lockfile	Yes; this also removes GHSA-xjj6-f33q-929c from main's audit
Files dependabot does not touch (mise.toml, $schema, CI-hardcoded versions)	None	No version of these packages appears outside package.json / pnpm-lock.yaml (grep `43.7.9	1.64.0in workflows, scripts, configs: none);check-config-schema.mjs/check-toolchain.mjs` passed

Verification (2.4)

• CI on this head (https://github.com/qawatake/obsidian-e2e-sample/actions/runs/40000626685): build passed (frozen install with pnpm v10.33.2, toolchain / actions-pinned / config-schema checks, pnpm audit --audit-level=high "No known vulnerabilities found", lint, typecheck, build, bundled-deps check), e2e passed on macOS (e2e:setup "1 passed", e2e:test "1 passed"), test-e2e-tools passed (e2e:setup and e2e:cleanup, "1 passed" each), all with @playwright/test 1.64.1 and electron 43.8.0 installed (install summary in each job's log). I read the logs.
• Timing caveat on the audit step: this CI ran 2026-10-23T18:06Z. GHSA-jr5w-w6x2-84p9 (electron < 43.8.1, high) and GHSA-xjj6-f33q-929c (undici < 7.30.1, high) were published later that day (20:53Z / 22:14Z). I ran pnpm audit --audit-level=high locally against this head's lockfile today: it reports exactly one finding, electron 43.8.0 < 43.8.1 (GHSA-jr5w-w6x2-84p9); the undici finding is gone because this PR moves undici to 7.30.1. main (eea83f1, https://github.com/qawatake/obsidian-e2e-sample/actions/runs/40065247461) currently fails on both. So the post-merge ci run on main will still fail on the electron advisory alone until electron ≥ 43.8.1 lands (see Unverified). I consider that acceptable for merging: the finding is pre-existing on main, this PR narrows it, electron is the e2e runner binary only, and the fix PR (#58) is open.
• Base moved since this CI ran: main is now eea83f1 (#57). git log ead3a5b..origin/main --stat shows exactly one commit touching mise.toml and package.json (packageManager pnpm 10.33.2 → 10.34.7, 2 insertions / 2 deletions), not the dependency lines or the lockfile. GitHub reports the merge state as CLEAN. The lockfile is lockfileVersion: '9.0' on both sides, and #58's CI did a frozen install of a lockfile with the same layout under pnpm 10.34.7, so the pnpm bump does not interact with this change.
• Additional checks I did: tarball diff of electron 43.7.9 → 43.8.0 (9 files; only package.json version, checksums.json and electron.d.ts differ; cli.js, index.js, install.js byte-identical); checksums.json of 43.8.0 matches the GitHub release SHASUMS256.txt for all 75 entries.
• Not covered: no manual run of the e2e suite outside CI.

Rollback, supply chain, license (2.5, 2.6, 2.7)

• Rollback: revert the lockfile / package.json change. No persistent data involved; the Electron binary cache is per-runner.
• Supply chain: @playwright/test, playwright, playwright-core 1.64.1 have npm provenance from microsoft/playwright publish_release.yml at refs/tags/v1.64.1, commit cfe490d9 = the tag (same repo / workflow as 1.64.0); published 2026-10-14 (10 days). electron 43.8.0 has no npm provenance (43.7.9 had none either): same publisher electron-nightly, same maintainers, GitHub release by sudowoodo-release-bot[bot], annotated tag v43.8.0 → commit 071a136f, published 2026-10-16 (8 days, past the repo's 7-day minimum-release-age); integrity matches the registry; the tarball diff is confined to version strings and checksums; the binary it downloads is verified against checksums.json, which equals the release SHASUMS256.txt. undici 7.30.1 has provenance from nodejs/undici release.yml at refs/heads/v7.x, commit 7507102a = tag v7.30.1 (same path as 7.30.0); published 2026-10-15 (9 days); it has no dependencies. Lifecycle scripts: none for electron and playwright; undici's prepare (husky) is unchanged and does not run for registry installs. Every integrity in the lockfile diff matches the registry. The lockfile's set of package names is unchanged.
• License: electron MIT → MIT (LICENSE identical); @playwright/test, playwright, playwright-core Apache-2.0 → Apache-2.0; undici MIT → MIT.

Blocking conditions

• Hit: none.

Requests

• None for the PR author. Merge-order note: this PR and #58 (electron 43.7.9 → 43.8.1, opened by dependabot today) change the same lines of package.json / pnpm-lock.yaml. This one lands first; #58 will be rebased by dependabot and needs a re-review on its new head. #55 is workflow-only and does not overlap.

Unverified / notes for other reviewers (2.9)

• electron 43.8.0 stays inside GHSA-jr5w-w6x2-84p9 (fixed in 43.8.1, published 2026-10-20). #58 brings 43.8.1, but that version (4 days) and the @electron-internal/extract-zip 1.0.6 it pulls in (2 days) are both younger than the 7-day minimum-release-age; dependabot resolved them with the gate disabled. Whether to take them before they age is the repository owner's call per the policy in .github/dependabot.yml; it is not part of this review.
• The Node.js 24.21.0 → 24.22.0 changes inside electron were not read.
• The npm electron tarball cannot be tied to a GitHub commit (no provenance, no gitHead); the compensating evidence is the identical JS and the checksum match above.
• Each playwright / electron fix was not tested individually; verification relies on the e2e suite plus the code-path search above.