Repository navigation
[Bug]: No security advisories for bundled Node.js #3290
Description
Version
1.64.1
Steps to reproduce
- Have a Python project
- Add
playwright<1.64.1Python package using one of the package managers supported by Dependabot
Expected behavior
Dependabot opens vulnerability alert for playwright package.
Actual behavior
Dependabot does't open vulnerability alert for playwright package.
Additional context
This package bundles Node.js executable. Hence, the package inherits all Node.js vulnerabilities. Therefore, security advisories should be published for the versions of this package using vulnerable Node.js versions.
Environment
N/A
Activity
[-][Bug]: No security advisories[/-][+][Bug]: No security advisories for bundled Node.js[/+]dcrousso commentedon Oct 23, 2026
1.64.1 already bundles Node.js 24.22.1 via #3283, including the recent upstream security fixes (though this does not address the missing Dependabot alerts for older releases)
Dependabot needs a reviewed advisory identifying the affected PyPI
playwrightversionsapplicability and version ranges need to be assessed for each vulnerability, since bundling Node.js does not make every Node.js vulnerability applicable