chore: update vulnerable dependencies bundled in utilsBundle #43899

Activity

1. Pavel Feldman (pavelfeldman)

   added

   needs-triage

   on Nov 4, 2026
2. github-actions commented on Nov 4, 2026

   

   github-actionsBot

   on Nov 4, 2026 – with GitHub Actions · Hidden as outdated

   show commentMore actions
3. microsoft-playwright-automation commented on Nov 4, 2026

   

   microsoft-playwright-automationBot

   on Nov 4, 2026 – with microsoft/playwright-automation

   Contributor

   More actions

   Hi, I'm the Playwright bot. I checked the bundled dependencies and verified an update on Linux.

   Confirmed on 1.66.0-next, commit 97dd3b70dbbf64cc326a6e1c04652b91ffa79746. The proposal updates zod to 4.6.7, minimatch to 11.0.4, brace-expansion to 5.0.12, and ip-address to 10.7.6. npm audit no longer flags these four bundled package instances; other dependency findings remain outside this change.

   The new minimatch dependency has no repository URL. The license report now permits that missing field while preserving its license text and the existing checks on supplied URLs.

   Verification

   • Compared npm audit --json before and after the update, and checked the versions in the generated utilsBundle.js.LICENSE.
   • Extended the existing bundle-license test: generating a license report for the new dependency fails before the report fix and passes after it.
   • Build and full lint checks passed.
   • Bundle-license and bundle-size tests: 4 passed.
   • Test matching, ignore rules, and grep tests: 34 passed.
   • Proxy tests on Chromium, Firefox, and WebKit: 104 passed, 1 existing skip.
   • MCP configuration tests on Chrome: 103 passed.

   Draft PR: #43902

   _{Triaged on Linux by the Playwright bot - agent run}
4. Pavel Feldman (pavelfeldman)

   added 2 commits that reference this issue on Nov 4, 2026

   chore(deps): bump runtime deps

   ...

   05acff7

   chore(deps): bump runtime deps

   ...

   e65ee03
5. Pavel Feldman (pavelfeldman)

   closed this as completedon Nov 4, 2026