fix(mcp): keep upload modal, skip short secrets and bad headers by SebTardif · Pull Request #42713 · microsoft/playwright

Sebastien Tardif (SebTardif) · 2026-09-14T19:58:20Z

Summary

Skip MCP secret redaction for values shorter than 4 characters.
Ignore browser_route header lines that have no name.
Clear the file-chooser modal only after setFiles succeeds.

Problem

Short secrets such as e ran through replaceAll and rewrote the whole tool response. Header strings without : became a header named "". browser_file_upload cleared modal state before setFiles, so a failed upload could not be retried.

Change

redactSecrets ignores empty and length-less-than-4 values (empty was already skipped).
Route header parsing skips entries whose : is missing or first.
clearModalState runs after setFiles completes.

Validation

tests/mcp/secrets.spec.ts: short secret e does not inject <secret> markers into hello.
tests/mcp/route.spec.ts: NotAHeader is ignored; X-Custom-Header still applies.
tests/mcp/files.spec.ts: missing path keeps the chooser; a second upload succeeds.

Do not redact secret values shorter than 4 characters. Ignore route header lines that have no name. Clear the file chooser only after setFiles succeeds so a failed upload can be retried. Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

waitForCompletion returns immediately when a fileChooser modal is already listed, so wrapping setFiles in it skipped the upload. Call setFiles first, keep the chooser on failure, then settle. Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

Return an argument error for values that are not Name: Value. Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

Devin Rousso (dcrousso) · 2026-09-17T18:02:39Z

  redactSecrets(text: string): string {
    for (const [secretName, secretValue] of Object.entries(this.config.secrets ?? {})) {
-      if (!secretValue)
+      if (!secretValue || secretValue.length < 4)


please avoid configuring guessable values such as abc as secrets rather than silently disabling redaction for short values (see microsoft/playwright-mcp#1106 (comment))

Devin Rousso (@dcrousso)

please avoid configuring guessable values such as abc as secrets rather than silently disabling redaction for short values

Removed the length < 4 skip. Empty values are still ignored. The short-secret test is gone. 36971b002

Devin Rousso (dcrousso) · 2026-09-17T18:03:22Z

+      }
+    }
+    tab.clearModalState(modalState);
+    await tab.waitForCompletion(async () => {});


starting the completion wait after setFiles() misses requests triggered by the upload on WebKit, so the tool can return before those requests finish

Devin Rousso (@dcrousso)

starting the completion wait after setFiles() misses requests triggered by the upload on WebKit

setFiles is back inside waitForCompletion. The file chooser is cleared first so the wait actually runs. 36971b002

Devin Rousso (dcrousso) · 2026-09-17T18:03:39Z

-      if (paths)
+    if (paths) {
+      try {
        await modalState.fileChooser.setFiles(paths);


awaiting setFiles() outside waitForCompletion() makes uploads whose change handler opens a dialog time out instead of returning the dialog for handling

Devin Rousso (@dcrousso)

awaiting setFiles() outside waitForCompletion() makes uploads whose change handler opens a dialog time out instead of returning the dialog for handling

Same change: setFiles runs inside waitForCompletion after the chooser is cleared, so a dialog from the change handler is returned. If setFiles throws, the chooser is restored. 36971b002

Clear the file chooser first so waitForCompletion can run, then setFiles inside it so WebKit upload requests and change-handler dialogs are observed. Restore the chooser if setFiles fails. Redact all non-empty secret values. Do not skip short ones. Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

github-actions · 2026-09-17T20:33:17Z

Test results for "MCP"

2 failed
❌ [firefox] › mcp/annotate.spec.ts:269 › should start dashboard and annotate when no dashboard is running @mcp-windows-latest-firefox
❌ [firefox] › mcp/cli-session.spec.ts:54 › idle timeout shuts the session down @mcp-windows-latest-firefox

8614 passed, 1446 skipped

Merge workflow run.

Devin Rousso (dcrousso)

thanks for the fix!

Pavel Feldman (pavelfeldman) · 2026-09-18T00:08:21Z

Please file those issues next time!

## What's New ### New Tools - **`browser_emulate_media`** — Emulate color scheme, reduced motion, forced colors, contrast, and screen/print media. Pass `null` to clear an override ([#42668](microsoft/playwright#42668)). ### Other Changes - **Tool removal:** `browser_webmcp_list` and `browser_webmcp_call` are now skill-only and no longer exposed as MCP tools ([#42671](microsoft/playwright#42671)). ## Bug Fixes - Failed `browser_file_upload` calls preserve the file chooser, allowing another upload attempt without reopening it ([#42713](microsoft/playwright#42713)). - Corrected the Playwright import in the published configuration types ([#1762](#1762)). Co-authored-by: pavelfeldman <883973+pavelfeldman@users.noreply.github.com>

## ✨ Highlights - **🎬 Smooth 60 fps, styleable videos** — `video-start --fps=60` records smooth 60 fps videos instead of the default 25, and `video-start --cursor` renders an animated mouse cursor that travels to each action point and stays visible between actions. `video-show-actions` takes `--point-style`, `--highlight-style` and `--title-style` CSS declarations; the action point marker and the target highlight are now only shown when styled. ([microsoft/playwright#42752](microsoft/playwright#42752), [microsoft/playwright#42758](microsoft/playwright#42758)) - **🧰 WebMCP tools show up in the snapshot** — the tools a page registers are listed at the top of the page snapshot with their descriptions and input schemas, so `webmcp-call` can be used without running `webmcp-list` first. Set `webmcp: false` in the config file (env `PLAYWRIGHT_MCP_WEBMCP=false`) to stop collecting page-registered tools. ([microsoft/playwright#42671](microsoft/playwright#42671)) - **🌗 Switch between light and dark color scheme** ([microsoft/playwright#42243](microsoft/playwright#42243)) — an agent working on a dark theme had no way to see it mid-session. New `set-color-scheme`, `set-reduced-motion`, `set-forced-colors`, `set-contrast` and `set-media` commands emulate media features on the fly, and the matching `clear-*` commands reset them. ([microsoft/playwright#42668](microsoft/playwright#42668)) - **📁 Absolute paths in results** ([microsoft/playwright#42497](microsoft/playwright#42497)) — links to snapshots, screenshots, console logs and downloads are relative to the working directory, which a consumer without one cannot resolve. Set `filePaths: "absolute"` in the config file (env `PLAYWRIGHT_MCP_FILE_PATHS=absolute`) to get absolute paths instead. ([microsoft/playwright#42673](microsoft/playwright#42673)) ## 🐛 Fixes - `fix(chromium): bypass service workers on the storage state page` — `state-save` no longer runs the site's own scripts, or fails when they redirect, for origins with an active service worker ([microsoft/playwright#42656](microsoft/playwright#42656)). ([#42664](microsoft/playwright#42664), [#42741](microsoft/playwright#42741)) - `fix(mcp): keep upload modal, skip short secrets and bad headers` — a failed `upload` keeps the file chooser open so it can be retried, secrets shorter than 4 characters no longer rewrite the whole output with `<secret>` markers, and `route` ignores header lines that have no name. ([#42713](microsoft/playwright#42713)) ## 📦 Upgrading ```bash npm install -g @playwright/cli@0.1.21 ```

## ✨ Highlights - **🧰 WebMCP tools become real MCP tools** — the tools a page registers through the [WebMCP](https://webmachinelearning.github.io/webmcp/) API now show up right in the tool list as `webmcp_<tool>`, with the page's own input schema and annotations, so an agent can call them directly and let the page do the work instead of driving its UI. The list follows the current tab, and clients get a `tools/list_changed` notification when it changes. This replaces `browser_webmcp_list` / `browser_webmcp_call` from v0.0.81, which are no longer exposed over MCP. Tool names, descriptions, schemas and results come from the page, so treat them as untrusted input. Pass `--no-webmcp` (config `webmcp: false`, env `PLAYWRIGHT_MCP_WEBMCP=false`) to opt out. WebMCP is experimental, see [WebMCP in Chrome](https://developer.chrome.com/docs/ai/webmcp) for how to enable it. ([microsoft/playwright#42671](microsoft/playwright#42671)) - **🌗 Switch between light and dark color scheme** ([microsoft/playwright#42243](microsoft/playwright#42243)) — an agent working on a dark theme had no way to see it mid-session. The new **`browser_emulate_media`** tool emulates media features on the fly: `colorScheme`, `reducedMotion`, `forcedColors`, `contrast` and the `media` type (screen / print). Omitted parameters are left unchanged, `null` clears an override. ([microsoft/playwright#42668](microsoft/playwright#42668)) - **📁 Absolute paths in results** ([microsoft/playwright#42497](microsoft/playwright#42497)) — links to snapshots, screenshots, console logs and downloads are relative to the workspace root, which a client without one cannot resolve. Pass `--file-paths=absolute` (config `filePaths: "absolute"`, env `PLAYWRIGHT_MCP_FILE_PATHS=absolute`) to get absolute paths instead. ([microsoft/playwright#42673](microsoft/playwright#42673)) ## 🐛 Fixes - `fix(mcp): keep upload modal and reject bad headers` — a failed `browser_file_upload` (e.g. a missing file) reports the error and keeps the file chooser open so it can be retried, and `browser_route` (opt-in via `--caps=network`) returns an error for a header that is not in the `Name: Value` form instead of setting a header named `""`. ([microsoft/playwright#42713](microsoft/playwright#42713)) - `fix(chromium): bypass service workers on the storage state page` — `browser_storage_state` (opt-in via `--caps=storage`) no longer runs the site's own scripts, or fails when they redirect, for origins with an active service worker ([microsoft/playwright#42656](microsoft/playwright#42656)). ([microsoft/playwright#42664](microsoft/playwright#42664), [microsoft/playwright#42741](microsoft/playwright#42741)) ## 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.82 ```

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | [`^26.6.1` → `^26.6.2`](https://renovatebot.com/diffs/npm/@types%2fnode/26.6.1/26.6.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/26.6.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/26.6.1/26.6.2?slim=true) | | [npm:@playwright/mcp](https://playwright.dev) ([source](https://redirect.github.com/microsoft/playwright-mcp)) | `0.0.81` → `0.0.82` | ![age](https://developer.mend.io/api/mc/badges/age/npm/@playwright%2fmcp/0.0.82?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@playwright%2fmcp/0.0.81/0.0.82?slim=true) | --- ### Release Notes <details> <summary>microsoft/playwright-mcp (npm:@playwright/mcp)</summary> ### [`v0.0.82`](https://redirect.github.com/microsoft/playwright-mcp/releases/tag/v0.0.82) [Compare Source](https://redirect.github.com/microsoft/playwright-mcp/compare/v0.0.81...v0.0.82) #### ✨ Highlights - **🎬 Smooth 60 fps, styleable videos** — `browser_start_video` (opt-in via `--caps=devtools`) takes `fps`, so `fps: 60` records smooth 60 fps videos instead of the default 25, and `cursor: true` renders an animated mouse cursor that travels to each action point and stays visible between actions. `browser_video_show_actions` takes a `style` with `point`, `highlight` and `title` CSS declarations; the action point marker and the target highlight are now only shown when styled. ([microsoft/playwright#42752](https://redirect.github.com/microsoft/playwright/pull/42752), [microsoft/playwright#42758](https://redirect.github.com/microsoft/playwright/pull/42758)) - **🧰 WebMCP tools become real MCP tools** — the tools a page registers through the [WebMCP](https://webmachinelearning.github.io/webmcp/) API now show up right in the tool list as `webmcp_<tool>`, with the page's own input schema and annotations, so an agent can call them directly and let the page do the work instead of driving its UI. The list follows the current tab, and clients get a `tools/list_changed` notification when it changes. This replaces `browser_webmcp_list` / `browser_webmcp_call` from v0.0.81, which are no longer exposed over MCP. Tool names, descriptions, schemas and results come from the page, so treat them as untrusted input. Pass `--no-webmcp` (config `webmcp: false`, env `PLAYWRIGHT_MCP_WEBMCP=false`) to opt out. WebMCP is experimental, see [WebMCP in Chrome](https://developer.chrome.com/docs/ai/webmcp) for how to enable it. ([microsoft/playwright#42671](https://redirect.github.com/microsoft/playwright/pull/42671)) - **🌗 Switch between light and dark color scheme** ([microsoft/playwright#42243](https://redirect.github.com/microsoft/playwright/issues/42243)) — an agent working on a dark theme had no way to see it mid-session. The new **`browser_emulate_media`** tool emulates media features on the fly: `colorScheme`, `reducedMotion`, `forcedColors`, `contrast` and the `media` type (screen / print). Omitted parameters are left unchanged, `null` clears an override. ([microsoft/playwright#42668](https://redirect.github.com/microsoft/playwright/pull/42668)) - **📁 Absolute paths in results** ([microsoft/playwright#42497](https://redirect.github.com/microsoft/playwright/issues/42497)) — links to snapshots, screenshots, console logs and downloads are relative to the workspace root, which a client without one cannot resolve. Pass `--file-paths=absolute` (config `filePaths: "absolute"`, env `PLAYWRIGHT_MCP_FILE_PATHS=absolute`) to get absolute paths instead. ([microsoft/playwright#42673](https://redirect.github.com/microsoft/playwright/pull/42673)) #### 🐛 Fixes - `fix(mcp): keep upload modal and reject bad headers` — a failed `browser_file_upload` (e.g. a missing file) reports the error and keeps the file chooser open so it can be retried, and `browser_route` (opt-in via `--caps=network`) returns an error for a header that is not in the `Name: Value` form instead of setting a header named `""`. ([microsoft/playwright#42713](https://redirect.github.com/microsoft/playwright/pull/42713)) - `fix(chromium): bypass service workers on the storage state page` — `browser_storage_state` (opt-in via `--caps=storage`) no longer runs the site's own scripts, or fails when they redirect, for origins with an active service worker ([microsoft/playwright#42656](https://redirect.github.com/microsoft/playwright/issues/42656)). ([microsoft/playwright#42664](https://redirect.github.com/microsoft/playwright/pull/42664), [microsoft/playwright#42741](https://redirect.github.com/microsoft/playwright/pull/42741)) #### 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.82 ``` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/soodoh/dotfiles).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [@playwright/mcp](https://playwright.dev) ([source](https://redirect.github.com/microsoft/playwright-mcp)) | `0.0.81` → `0.0.82` | ![age](https://developer.mend.io/api/mc/badges/age/npm/@playwright%2fmcp/0.0.82?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/@playwright%2fmcp/0.0.82?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/@playwright%2fmcp/0.0.81/0.0.82?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@playwright%2fmcp/0.0.81/0.0.82?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>microsoft/playwright-mcp (@playwright/mcp)</summary> ### [`v0.0.82`](https://redirect.github.com/microsoft/playwright-mcp/releases/tag/v0.0.82) [Compare Source](https://redirect.github.com/microsoft/playwright-mcp/compare/v0.0.81...v0.0.82) #### ✨ Highlights - **🎬 Smooth 60 fps, styleable videos** — `browser_start_video` (opt-in via `--caps=devtools`) takes `fps`, so `fps: 60` records smooth 60 fps videos instead of the default 25, and `cursor: true` renders an animated mouse cursor that travels to each action point and stays visible between actions. `browser_video_show_actions` takes a `style` with `point`, `highlight` and `title` CSS declarations; the action point marker and the target highlight are now only shown when styled. ([microsoft/playwright#42752](https://redirect.github.com/microsoft/playwright/pull/42752), [microsoft/playwright#42758](https://redirect.github.com/microsoft/playwright/pull/42758)) - **🧰 WebMCP tools become real MCP tools** — the tools a page registers through the [WebMCP](https://webmachinelearning.github.io/webmcp/) API now show up right in the tool list as `webmcp_<tool>`, with the page's own input schema and annotations, so an agent can call them directly and let the page do the work instead of driving its UI. The list follows the current tab, and clients get a `tools/list_changed` notification when it changes. This replaces `browser_webmcp_list` / `browser_webmcp_call` from v0.0.81, which are no longer exposed over MCP. Tool names, descriptions, schemas and results come from the page, so treat them as untrusted input. Pass `--no-webmcp` (config `webmcp: false`, env `PLAYWRIGHT_MCP_WEBMCP=false`) to opt out. WebMCP is experimental, see [WebMCP in Chrome](https://developer.chrome.com/docs/ai/webmcp) for how to enable it. ([microsoft/playwright#42671](https://redirect.github.com/microsoft/playwright/pull/42671)) - **🌗 Switch between light and dark color scheme** ([microsoft/playwright#42243](https://redirect.github.com/microsoft/playwright/issues/42243)) — an agent working on a dark theme had no way to see it mid-session. The new **`browser_emulate_media`** tool emulates media features on the fly: `colorScheme`, `reducedMotion`, `forcedColors`, `contrast` and the `media` type (screen / print). Omitted parameters are left unchanged, `null` clears an override. ([microsoft/playwright#42668](https://redirect.github.com/microsoft/playwright/pull/42668)) - **📁 Absolute paths in results** ([microsoft/playwright#42497](https://redirect.github.com/microsoft/playwright/issues/42497)) — links to snapshots, screenshots, console logs and downloads are relative to the workspace root, which a client without one cannot resolve. Pass `--file-paths=absolute` (config `filePaths: "absolute"`, env `PLAYWRIGHT_MCP_FILE_PATHS=absolute`) to get absolute paths instead. ([microsoft/playwright#42673](https://redirect.github.com/microsoft/playwright/pull/42673)) #### 🐛 Fixes - `fix(mcp): keep upload modal and reject bad headers` — a failed `browser_file_upload` (e.g. a missing file) reports the error and keeps the file chooser open so it can be retried, and `browser_route` (opt-in via `--caps=network`) returns an error for a header that is not in the `Name: Value` form instead of setting a header named `""`. ([microsoft/playwright#42713](https://redirect.github.com/microsoft/playwright/pull/42713)) - `fix(chromium): bypass service workers on the storage state page` — `browser_storage_state` (opt-in via `--caps=storage`) no longer runs the site's own scripts, or fails when they redirect, for origins with an active service worker ([microsoft/playwright#42656](https://redirect.github.com/microsoft/playwright/issues/42656)). ([microsoft/playwright#42664](https://redirect.github.com/microsoft/playwright/pull/42664), [microsoft/playwright#42741](https://redirect.github.com/microsoft/playwright/pull/42741)) #### 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.82 ``` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/paulnsorensen/dotfiles).   ## Summary by CodeRabbit - **Chores** - Updated the Playwright MCP package to version 0.0.82. - Synchronized the package version used by the Codex profile test.  --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: dep-harvest-bot <paulnsorensen@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@playwright/mcp](https://playwright.dev) ([source](https://redirect.github.com/microsoft/playwright-mcp)) | [`0.0.81` → `0.0.82`](https://renovatebot.com/diffs/npm/@playwright%2fmcp/0.0.81/0.0.82) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@playwright%2fmcp/0.0.82?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@playwright%2fmcp/0.0.81/0.0.82?slim=true) | --- ### Release Notes <details> <summary>microsoft/playwright-mcp (@playwright/mcp)</summary> ### [`v0.0.82`](https://redirect.github.com/microsoft/playwright-mcp/releases/tag/v0.0.82) [Compare Source](https://redirect.github.com/microsoft/playwright-mcp/compare/v0.0.81...v0.0.82) #### ✨ Highlights - **🎬 Smooth 60 fps, styleable videos** — `browser_start_video` (opt-in via `--caps=devtools`) takes `fps`, so `fps: 60` records smooth 60 fps videos instead of the default 25, and `cursor: true` renders an animated mouse cursor that travels to each action point and stays visible between actions. `browser_video_show_actions` takes a `style` with `point`, `highlight` and `title` CSS declarations; the action point marker and the target highlight are now only shown when styled. ([microsoft/playwright#42752](https://redirect.github.com/microsoft/playwright/pull/42752), [microsoft/playwright#42758](https://redirect.github.com/microsoft/playwright/pull/42758)) - **🧰 WebMCP tools become real MCP tools** — the tools a page registers through the [WebMCP](https://webmachinelearning.github.io/webmcp/) API now show up right in the tool list as `webmcp_<tool>`, with the page's own input schema and annotations, so an agent can call them directly and let the page do the work instead of driving its UI. The list follows the current tab, and clients get a `tools/list_changed` notification when it changes. This replaces `browser_webmcp_list` / `browser_webmcp_call` from v0.0.81, which are no longer exposed over MCP. Tool names, descriptions, schemas and results come from the page, so treat them as untrusted input. Pass `--no-webmcp` (config `webmcp: false`, env `PLAYWRIGHT_MCP_WEBMCP=false`) to opt out. WebMCP is experimental, see [WebMCP in Chrome](https://developer.chrome.com/docs/ai/webmcp) for how to enable it. ([microsoft/playwright#42671](https://redirect.github.com/microsoft/playwright/pull/42671)) - **🌗 Switch between light and dark color scheme** ([microsoft/playwright#42243](https://redirect.github.com/microsoft/playwright/issues/42243)) — an agent working on a dark theme had no way to see it mid-session. The new **`browser_emulate_media`** tool emulates media features on the fly: `colorScheme`, `reducedMotion`, `forcedColors`, `contrast` and the `media` type (screen / print). Omitted parameters are left unchanged, `null` clears an override. ([microsoft/playwright#42668](https://redirect.github.com/microsoft/playwright/pull/42668)) - **📁 Absolute paths in results** ([microsoft/playwright#42497](https://redirect.github.com/microsoft/playwright/issues/42497)) — links to snapshots, screenshots, console logs and downloads are relative to the workspace root, which a client without one cannot resolve. Pass `--file-paths=absolute` (config `filePaths: "absolute"`, env `PLAYWRIGHT_MCP_FILE_PATHS=absolute`) to get absolute paths instead. ([microsoft/playwright#42673](https://redirect.github.com/microsoft/playwright/pull/42673)) #### 🐛 Fixes - `fix(mcp): keep upload modal and reject bad headers` — a failed `browser_file_upload` (e.g. a missing file) reports the error and keeps the file chooser open so it can be retried, and `browser_route` (opt-in via `--caps=network`) returns an error for a header that is not in the `Name: Value` form instead of setting a header named `""`. ([microsoft/playwright#42713](https://redirect.github.com/microsoft/playwright/pull/42713)) - `fix(chromium): bypass service workers on the storage state page` — `browser_storage_state` (opt-in via `--caps=storage`) no longer runs the site's own scripts, or fails when they redirect, for origins with an active service worker ([microsoft/playwright#42656](https://redirect.github.com/microsoft/playwright/issues/42656)). ([microsoft/playwright#42664](https://redirect.github.com/microsoft/playwright/pull/42664), [microsoft/playwright#42741](https://redirect.github.com/microsoft/playwright/pull/42741)) #### 📦 Upgrading Configs that use `@playwright/mcp@latest` pick this release up on the next client restart. To pin it: ```bash npx @playwright/mcp@0.0.82 ``` </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Tokyo) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/izumin5210/dotfiles).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This comment has been minimized.

Sign in to view

JustasM (JustasMonkev) mentioned this pull request Sep 15, 2026

Review upstream browser failure paths on Playwright 1.63.0 JustasMonkev/mcp-accessibility-scanner#226

Closed

Devin Rousso (dcrousso) requested changes Sep 15, 2026

View reviewed changes

Comment thread packages/playwright-core/src/tools/backend/route.ts Outdated

fix(mcp): error on route headers without a colon

b69aeeb

Return an argument error for values that are not Name: Value. Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

Sebastien Tardif (SebTardif) requested a review from Devin Rousso (dcrousso) September 15, 2026 23:56

github-actions Bot mentioned this pull request Sep 16, 2026

feat(trace-viewer): show screencast frames during playback #42751

Merged

Devin Rousso (dcrousso) requested changes Sep 17, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

github-actions Bot mentioned this pull request Sep 17, 2026

devops(bidi): fix publishing when a single csv report is uploaded #42764

Merged

Devin Rousso (dcrousso) approved these changes Sep 17, 2026

View reviewed changes

Devin Rousso (dcrousso) merged commit 464318b into microsoft:main Sep 17, 2026
17 of 18 checks passed

This was referenced Sep 18, 2026

chore: mark v0.0.82 microsoft/playwright-mcp#1764

Merged

chore: mark v0.1.21 microsoft/playwright-cli#469

Merged

This was referenced Sep 18, 2026

docs(cli): mention webmcp-list next to the status and snapshot in the skill #42783

Merged

chore(coverage): istanbul instrumentation for the trace viewer and html reporter #42785

Merged

github-actions Bot mentioned this pull request Sep 19, 2026

feat(coverage): generate html coverage report without istanbul libs #42784

Open

This was referenced Sep 21, 2026

test: roll stable-test-runner to 1.64.0-alpha-2026-09-21 #42826

Merged

fix(firefox): preserve response header field boundaries #42832

Open

This was referenced Sep 25, 2026

fix(mcp): do not crash when download fails after browser close #42922

Merged

[ca] Update CLI and scanner pins for latest stable releases github/gh-aw#63364

Closed

docs(request): list all resource types in resourceType() #42997

Merged

Navigation Menu

fix(mcp): keep upload modal, skip short secrets and bad headers - #42713

fix(mcp): keep upload modal, skip short secrets and bad headers#42713
Devin Rousso (dcrousso) merged 4 commits into
microsoft:mainfrom
SebTardif:fix-mcp-upload-route-secrets

Sebastien Tardif (SebTardif) commented Sep 14, 2026

Uh oh!

This comment has been minimized.

Uh oh!

Devin Rousso (dcrousso) Sep 17, 2026

Uh oh!

Sebastien Tardif (SebTardif) Sep 17, 2026

Uh oh!

Devin Rousso (dcrousso) Sep 17, 2026

Uh oh!

Sebastien Tardif (SebTardif) Sep 17, 2026

Uh oh!

Devin Rousso (dcrousso) Sep 17, 2026

Uh oh!

Sebastien Tardif (SebTardif) Sep 17, 2026

Uh oh!

This comment has been minimized.

github-actions Bot commented Sep 17, 2026

Uh oh!

Devin Rousso (dcrousso) left a comment

Uh oh!

Uh oh!

Pavel Feldman (pavelfeldman) commented Sep 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Sebastien Tardif (SebTardif) commented Sep 14, 2026

Summary

Problem

Change

Validation

Uh oh!

This comment has been minimized.

Uh oh!

Devin Rousso (dcrousso) Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

Sebastien Tardif (SebTardif) Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

Devin Rousso (dcrousso) Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

Sebastien Tardif (SebTardif) Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

Devin Rousso (dcrousso) Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

Sebastien Tardif (SebTardif) Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

github-actions Bot commented Sep 17, 2026

Test results for "MCP"

Uh oh!

Devin Rousso (dcrousso) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Pavel Feldman (pavelfeldman) commented Sep 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants