playwright-audit-deps
Roll runtime dependencies flagged by npm audit
/playwright-audit-deps [issue url]
A runtime dependency is a package whose code ends up in a published Playwright package: it is
inlined into a bundle (listed in a packages/*/lib/**/*.js.txt sidecar) or named in the
dependencies of a packages/*/package.json. Advisories on dev-only packages, such as eslint
plugins or chromium-bidi, are reported as skipped and left alone.
A version is eligible when it is outside every advisory range, was published at least 8 days
ago, and is accepted by every runtime dependent in package-lock.json. The newest eligible
version wins. Packages that npm install pulls in beyond that age are pinned back the same way.
The lint npm run check-dependency-age (part of npm run lint and npm run flint, so CI
runs it on every PR) fails when any version in package-lock.json is less than 7 days old.
The 8-day default here keeps a one-day margin above that limit.