chore(deps): update playwright monorepo 1.58.1#2174
chore(deps): update playwright monorepo 1.58.1#2174colinaaa merged 2 commits intolynx-family:mainfrom
Conversation
|
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (3)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including You can disable this status message by setting the
📝 WalkthroughWalkthroughThis PR updates Playwright test dependencies from v1.57.0 to v1.58.1 across multiple web-platform packages, upgrades the Playwright container image in the GitHub Actions workflow, and bumps the MCP SDK and undici dependencies to newer versions. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| permissions: {} | ||
| container: | ||
| image: ${{ inputs.is-web && 'mcr.microsoft.com/playwright:v1.57.0-noble' || null }} | ||
| image: ${{ inputs.is-web && 'mcr.microsoft.com/playwright:v1.58.1-noble' || null }} |
Check failure
Code scanning / zizmor
unpinned image references Error
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.github/workflows/workflow-test.yml:
- Line 45: Replace the mutable tag reference under the image: key that uses
'mcr.microsoft.com/playwright:v1.58.1-noble' with an immutable digest-pinned
reference; obtain the digest by pulling the image (docker pull
mcr.microsoft.com/playwright:v1.58.1-noble) and inspecting the repo digest
(docker image inspect --format '{{index .RepoDigests 0}}'
mcr.microsoft.com/playwright:v1.58.1-noble), then update the expression that
sets image: ${{ inputs.is-web && 'mcr.microsoft.com/playwright:v1.58.1-noble' ||
null }} to use the returned digest string in place of the tag.
| permissions: {} | ||
| container: | ||
| image: ${{ inputs.is-web && 'mcr.microsoft.com/playwright:v1.57.0-noble' || null }} | ||
| image: ${{ inputs.is-web && 'mcr.microsoft.com/playwright:v1.58.1-noble' || null }} |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
git ls-files .github/workflows/workflow-test.ymlRepository: lynx-family/lynx-stack
Length of output: 101
🏁 Script executed:
cat -n .github/workflows/workflow-test.yml | sed -n '40,50p'Repository: lynx-family/lynx-stack
Length of output: 484
🏁 Script executed:
# Search for all container image references to understand the pattern used
rg 'image:' .github/workflows/workflow-test.yml -A 1 -B 1Repository: lynx-family/lynx-stack
Length of output: 181
🏁 Script executed:
# Check if there are any other container images in the repository to see what pattern is used
rg 'image:' .github/workflows/ -A 1 | head -30Repository: lynx-family/lynx-stack
Length of output: 238
🌐 Web query:
mcr.microsoft.com/playwright:v1.58.1-noble mutable tag digest pinning container security
💡 Result:
-
Yes,
mcr.microsoft.com/playwright:v1.58.1-nobleis a tag, and tags are not inherently immutable. In container registries, a tag can be moved to point at a different manifest digest unless the registry/repository enforces immutability. Microsoft’s own Azure Container Registry docs state that tagged images are mutable by default (unless you explicitly lock/prevent writes). [1] -
For supply-chain/container security, prefer digest pinning (immutable reference), e.g.
mcr.microsoft.com/playwright@sha256:<digest>, because a digest identifies the exact image content you reviewed/scanned. Microsoft’s container registry concepts doc explicitly describes pulling by manifest digest. [2] -
How to get and pin the digest (CLI):
docker pull mcr.microsoft.com/playwright:v1.58.1-noble docker image inspect --format '{{index .RepoDigests 0}}' mcr.microsoft.com/playwright:v1.58.1-noble # then use the printed value in FROM / deployments, e.g. # FROM mcr.microsoft.com/playwright@sha256:...
(Equivalent:
docker buildx imagetools inspect mcr.microsoft.com/playwright:v1.58.1-nobleto see per-arch digests.) -
Extra Playwright-specific security note: the Playwright Docker docs warn the image is intended for testing/dev and recommend additional hardening (e.g., non-root + seccomp) especially when visiting untrusted sites. [3]
Sources: [1] Microsoft Learn (ACR: tagged images mutable by default) (learn.microsoft.com), [2] Microsoft Learn (pull by digest) (learn.microsoft.com), [3] Playwright Docker docs (security notes & recommendations) (playwright.dev)
Citations:
- 1: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-image-lock?utm_source=openai
- 2: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-concepts?utm_source=openai
- 3: https://playwright.dev/docs/docker?utm_source=openai
Pin the Playwright container image by digest.
Line 45 uses a mutable tag reference. Tags can be re-pushed to point to different image content, creating a supply-chain risk. Replace with an immutable digest pin:
Example format
- image: ${{ inputs.is-web && 'mcr.microsoft.com/playwright:v1.58.1-noble' || null }}
+ image: ${{ inputs.is-web && 'mcr.microsoft.com/playwright@sha256:<digest>' || null }}To find the digest: docker pull mcr.microsoft.com/playwright:v1.58.1-noble && docker image inspect --format '{{index .RepoDigests 0}}' mcr.microsoft.com/playwright:v1.58.1-noble
🧰 Tools
🪛 GitHub Check: zizmor
[failure] 45-45:
unpinned image references
🤖 Prompt for AI Agents
In @.github/workflows/workflow-test.yml at line 45, Replace the mutable tag
reference under the image: key that uses
'mcr.microsoft.com/playwright:v1.58.1-noble' with an immutable digest-pinned
reference; obtain the digest by pulling the image (docker pull
mcr.microsoft.com/playwright:v1.58.1-noble) and inspecting the repo digest
(docker image inspect --format '{{index .RepoDigests 0}}'
mcr.microsoft.com/playwright:v1.58.1-noble), then update the expression that
sets image: ${{ inputs.is-web && 'mcr.microsoft.com/playwright:v1.58.1-noble' ||
null }} to use the returned digest string in place of the tag.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
CodSpeed Performance ReportMerging this PR will not alter performanceComparing Summary
Footnotes
|
Web Explorer#7518 Bundle Size — 383.67KiB (0%).c115957(current) vs 6ec0b1d main#7517(baseline) Bundle metrics
|
| Current #7518 |
Baseline #7517 |
|
|---|---|---|
 Initial JS |
154.83KiB |
154.83KiB |
| Initial CSS |
35.05KiB |
35.05KiB |
| Cache Invalidation |
0% |
0% |
| Chunks |
8 |
8 |
| Assets |
8 |
8 |
 Modules |
238(-0.42%) |
239 |
| Duplicate Modules |
16 |
16 |
| Duplicate Code |
2.99% |
2.99% |
| Packages |
4 |
4 |
| Duplicate Packages |
0 |
0 |
Bundle size by type no changes
| Current #7518 |
Baseline #7517 |
|
|---|---|---|
| JS |
252.78KiB |
252.78KiB |
| Other |
95.85KiB |
95.85KiB |
| CSS |
35.05KiB |
35.05KiB |
Bundle analysis report Branch colinaaa:colin/0201/playwright Project dashboard
Generated by RelativeCI Documentation Report issue
4 participants
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.
Checklist