Roll runtime dependencies flagged by npm audit

/playwright-audit-deps [issue url]

A runtime dependency is a package whose code ends up in a published Playwright package: it is inlined into a bundle (listed in a packages/*/lib/**/*.js.txt sidecar) or named in the dependencies of a packages/*/package.json. Advisories on dev-only packages, such as eslint plugins or chromium-bidi, are reported as skipped and left alone.

A version is eligible when it is outside every advisory range, was published at least 8 days ago, and is accepted by every runtime dependent in package-lock.json. The newest eligible version wins. Packages that npm install pulls in beyond that age are pinned back the same way.

The lint npm run check-dependency-age (part of npm run lint and npm run flint, so CI runs it on every PR) fails when any version in package-lock.json is less than 7 days old. The 8-day default here keeps a one-day margin above that limit.

Steps

1. Start from a clean checkout of main with npm run build done, so the bundle sidecars exist. Create the branch: fix-<issue number> when an issue is given, else bump-runtime-deps.
2. Plan: node .claude/skills/playwright-audit-deps/audit-deps.mjs. It prints, per runtime advisory, the version it would roll to, or why it cannot (no fixed version, fixed version too new, a runtime dependent rejects it, or a major bump of a package pinned in package.json).
3. Apply: node .claude/skills/playwright-audit-deps/audit-deps.mjs --apply --report=<scratchpad>/deps-report.md. Pass --allow-major only when the user asked for a major bump; otherwise leave those packages in the "Not rolled" list and tell the user. Options: --max-age-days=N (default 8), --severity=low|moderate|high|critical (default moderate), --base=<ref> for the report diff.
4. Verify: npm run build, then npm run itest tests/installation/bundle-licenses.spec.ts tests/installation/bundle-size.spec.ts and npm run check-dependency-age. A new dependency without a repository field, a bigger bundle, or a version younger than 7 days fails here. Fix the cause or drop that roll, then rerun the report.

5. Commit package.json and package-lock.json as one commit:

   chore(deps): bump runtime deps
   
   <the markdown table and the "Not rolled" list from the report>
   
   Fixes: <issue url, when given>

6. Report the table and the not-rolled packages to the user. Never push. When told to open the PR, use the same title and a body of one bullet naming the packages rolled for an advisory, the table, and the Fixes line.

Notes

• npm audit lists a package that only depends on a vulnerable one (chromium-bidi via zod) as its own finding; the script follows the actual advisory, so such entries are not acted on.
• A root-pinned package is bumped with npm install <name>@<version> --save-exact. Any other package is rewritten in place in package-lock.json and reconciled with npm install. The script fails if npm ls reports a problem afterwards.
• Run the apply step once from the clean base; a second run labels the already rolled packages as plain dependencies in the "Reason" column, because the audit no longer flags them.