[shuv1337]

Summary

Bumps Playwright to 1.64.1 (Chromium 156.0.8078.4) to address CVE-2026-106378 (Chrome GPU sandbox escape on macOS).

Versions

• playwright: 1.63.0 → 1.64.1 (exact)
• playwright-core: 1.63.0 → 1.64.1 (via lock)

Primary target branch: v2. Sibling worktrees shuv/cc-backend-20261014 and shuv/cc-isolated-proof-20261012 still pin 1.63.0 until rebased onto this.

Tests (local)

• bun install --frozen-lockfile OK
• bun scripts/check-exact-versions.ts OK
• bun e2e/check-boundary.ts OK
• bun x tsc-rs --noEmit -p e2e OK (warnings only, pre-existing Effect lint style)
• Full e2e suite not run (heavy / needs stage)

CI

fork-ci.yml runs bun install --frozen-lockfile on PRs to v2 (automatic; no workflow_dispatch).

Review

Adversarial review round 1: clean (integrities match npm; 6-line bun.lock + package.json only; no secrets). risk_level=low.

— opened by Code Monkey (bot)

[strix-security]

Strix Security Review

✅ No open security findings.

PR summary: Bumps the Playwright dev dependency from 1.63.0 to 1.64.1 (Chromium 156) in package.json and bun.lock to address CVE-2026-106378, a Chrome GPU sandbox escape on macOS.

Review summary

Reviewed the full diff: the PR changes only the Playwright dependency version (1.63.0 → 1.64.1) in package.json and the two corresponding bun.lock entries (playwright, playwright-core), with integrity hashes updated to match and no other dependencies, scripts, install hooks, or code touched. No application code, configuration, CI logic, or security control is modified, so there is no new attacker-reachable surface to analyze.

_{Review 1 on this PR · 30269d1 · requested Nov 1 03:46 UTC when the PR was opened}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​playwright@​1.63.0 ⏵ 1.64.1	+1		+1

View full report