[brionmario]

Purpose

Unblocks the PR Builder, which is currently failing on every PR (e.g. run 41460584412 on #151).

🎭 Playwright E2E Tests: ubuntu-latest now resolves to Ubuntu 26.04, which Playwright 1.60.0 does not support:

Cannot install dependencies for ubuntu26.04-x64 with Playwright 1.60.0!
Error: ERROR: Playwright does not support chromium on ubuntu26.04-x64

Ubuntu 26.04 support was added in Playwright 1.61. This bumps the playwright and @playwright/test catalog pins to the latest release, 1.64.1.

🔍 Security Audit: pnpm audit --audit-level=high fails on five node-forge advisories, all patched in >=1.4.1:
GHSA-7wch-p9px-956x, GHSA-jc66-7q78-782g, GHSA-8hrf-8g6f-7xwp, GHSA-hqq3-7jhf-c5jx, GHSA-5x38-2vff-x55p.
node-forge comes in transitively through packages/nuxt (nuxt / @nuxt/module-builder > listhen > node-forge). listhen@latest already declares node-forge: ^1.4.0, but pnpm update doesn't move the transitive resolution, so this adds a node-forge: 1.4.2 override with a justification comment explaining when it can be removed.

The lockfile changes cover only Playwright and node-forge.

Open PRs will need a rebase onto main after this merges to pick up the fix.

Related PRs

No parity PRs needed: this is CI tooling and dependency hygiene for this repo only.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: thunder-id/javascript-sdks
• Branch: main
• File: .coderabbit.yaml
• Commit: 9e80e29
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0162dd79-0bba-4c82-9ae4-979645cf313d

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[github-actions]

🔀 Cross-SDK feature parity, no ports needed

This pull request is labelled parity/prs-not-needed: nothing here has to ship in the other ThunderID SDKs. If that changes, swap the label for parity/prs-raised.