[dependabot]

Behavior

The original dependency batch cannot install: Playwright 1.64.1 requires pyee>=13,<15, while the batch selected pyee 16.0.0. Keep pyee 13.0.1 and apply the remaining runtime and test updates on the current playwright-next baseline.

Runtime updates: certifi 2026.10.23, FastAPI 0.162.0, multidict 7.2.1, Playwright 1.64.1, python-engineio 4.15.0, Starlette 1.10.0 and tzdata 2026.6. Test/tool updates: pytest 9.2.0, pytest-asyncio 1.4.1 and Ruff 0.17.3. No engine logic, database or recipe-schema change.

Retain the original Dependabot commit and merge the current fork history without force-pushing. Final candidate 4898cc572602325effed6e3bf795956f08994aab has the same Git tree as the qualified local correction 7b3f79bd690acb05443830038ef662cc4c7fceda (06d1a72f881afc1ad8d772989e7d42058cad895e).

Verification

• Before: uv pip install --dry-run 'playwright==1.64.1' 'pyee==16.0.0' rejects the incompatible constraints.
• After: install all runtime, development and security requirements on Python 3.12.13; python -m pip check reports no broken requirements (98 packages).
• LC_ALL=C python -m pytest tests/ -q --tb=short: 905 passed, 6 skipped, 104 subtests passed.
• Ruff 0.17.3 full/F821, Bandit 1.9.4 high-severity gate, pip-audit 2.10.1 runtime pins, compileall and shell syntax pass.
• Local Docker image sha256:0ab784b2983a3aa8dab06390bcee2d68e12b4d11bd10590d96c4df44371fa46c, revision 7b3f79b: tests/qualify_bourse_direct_image.py passes 159 tests, confirms packaged source hashes, exercises headless/headed Chromium and NiceGUI startup, and passes the legacy regression (7 expected scenarios, 8 PDFs). Trivy 0.70.0 finds zero fixable HIGH/CRITICAL vulnerabilities.

Tests use synthetic credentials, loopback fixtures and isolated DB/profile/output. The retained image-proof container exited 0 with network disabled, UID 1003 and GID 1000. Image fixtures inject credentials and consumers; they do not qualify a real vault, provider or Paperless deployment. GitHub CI must validate the final PR head before merge.

Infra handoff

N/A: dependency maintenance, no deployment. Recipe schema remains 023dd141a90db23d1d6d9f182d40fe9347f7901ef0fb582f9cfa8de6a6c50e75. Default-branch image automation runs after merge; Infra selects and deploys an immutable image separately. Rollback is a focused dependency-pin revert.

AI assistance

Codex prepared the compatible pins and checked the resolver, installed metadata, complete diff, synthetic suite and local image proof. Existing Dependabot and published history are preserved.

Pullfrog review

Pullfrog is the sole reviewer. Require a completed review of the final head, resolved actionable threads and green CI. Ignore CodeRabbit and the known sticky pullfrog-approval status only.

Review evidence: completed Pullfrog review of 4898cc572602325effed6e3bf795956f08994aab. No blocking issues and no unresolved review threads. All required CI checks passed; pr-ship merged the exact reviewed head at 83f5bfa8645bb6016c69eb996619cd2ad46e6dd8. The nonblocking version-reference observation is resolved by PR #92, merged at fffae499d26857f8259c8461a315e1079548e73c after green CI and completed Pullfrog review. Automatic image publication succeeded: ghcr.io/flowcool/billcollector-playwright:sha-83f5bfa@sha256:0de48b6dbfaae66d8e6ce61b11490c86ed9232926d1284a9ed836bb53d148038.

[flowcool]

@pullfrog Please review PR #86 at current head 4898cc5 against playwright-next and submit a completed GitHub pull request review on that exact head, even if there are no findings. The original dependency batch had no review; this update preserves its history and retains pyee 13.0.1 within Playwright 1.64.1's >=13,<15 constraint. Inspect the final diff and dependency compatibility. Review only: do not implement changes, push commits, or merge.

[pullfrog]

ℹ️ No blocking issues. The pins resolve and install cleanly. One documented contract still names the old Playwright pin.

Reviewed changes

I reviewed head 4898cc5 against the current playwright-next tip (4a6e981). That tip is an ancestor of the head, and the merge commit's tree matches 7b3f79b exactly. The effective change therefore covers only 4 files. GitHub's 26-file list is computed from a stale base (b2ec6fe). The other 22 files are already on playwright-next through #91 and earlier merges, so they add no change here.

• Runtime pins — apps/requirements.txt moves certifi to 2026.10.23, FastAPI to 0.162.0, multidict to 7.2.1, Playwright to 1.64.1, python-engineio to 4.15.0, Starlette to 1.10.0 and tzdata to 2026.6. pyee==13.0.1 stays unchanged.
• Test/tool pins — pytest 9.2.0, pytest-asyncio 1.4.1 and Ruff 0.17.3 in apps/requirements-dev.txt and .github/requirements-security.txt.
• Changelog — one ### Changed entry under [Unreleased].

How I checked compatibility:

• Install — all three requirement files install together on Python 3.12 (the ubuntu:24.04 image Python line). pip check reports no broken requirements.
• Declared constraints — read from installed metadata:
  • playwright 1.64.1 requires pyee>=13,<15 and greenlet>=3.1.1,<4 (13.0.1 and 3.5.6 both satisfy them).
  • fastapi 0.162.0 requires starlette>=0.46.0, and nicegui 3.18.0 requires starlette>=1.3.1, fastapi>=0.109.1,!=0.123.5, multidict>=6.9.1 and python-socketio>=5.16.2.
  • python-socketio 5.17.0 requires python-engineio>=4.13.2.
  • aiohttp requires multidict<8.
  • pytest-asyncio 1.4.1 requires pytest>=8.4,<10.
• No new unpinned runtime dependencies — the only installed packages missing from the pin files are existing transitive dependencies of pytest, Bandit and pip-audit.
• Playwright chain surface — the public members and signatures of Page, Locator, Frame, FrameLocator and ElementHandle are identical between 1.64.0 and 1.64.1: 320 members, zero differences.
• Tests — tests/test_bc_method_validation.py passes except its one real-browser test, which fails only because no Chromium is installed in this sandbox. The test_bc_ui_app, test_bc_ui_auth, test_bc_ui_settings and test_bc_ui_recipes files pass (40 tests), and ruff check apps tests passes. When I submitted this review, Unit and browser tests and Image security were still running on this head.

ℹ️ The recipe method contract still pins playwright==1.64.0

doc/RECIPE_METHODS.md §6 says "a pin bump is a contract change: re-derive the surface and re-run the compatibility baseline." It names playwright==1.64.0 at lines 75 and 338. doc/BOURSE_DIRECT_ADAPTER.md:137 also tells operators to use "the browser cache that matches Playwright 1.64.0". This PR changes the pin to 1.64.1 but leaves those references unchanged. The re-derived surface is identical, so runtime behavior is unaffected, but the documented contract and the proof instructions no longer match the pin. Separately, the comment at apps/billcollector/ui/app.py:91 describes python-engineio 4.14.0 as "(latest)". 4.15.0 still has the same empty-environ REQUEST_METHOD path (engineio/async_drivers/asgi.py:162, async_server.py:238), so the wrapper is still needed and only the version wording is stale.

Technical details

# Stale Playwright/engineio version references after the pin bump

## Affected sites
- doc/RECIPE_METHODS.md:75 — "pinned Playwright version** (`playwright==1.64.0`, ...)"
- doc/RECIPE_METHODS.md:338 — "(`playwright==1.64.0`); the introspected allowlist is only as valid as the pin"
- doc/BOURSE_DIRECT_ADAPTER.md:137 — "browser cache that matches Playwright 1.64.0"
- apps/billcollector/ui/app.py:91 — "python-engineio 4.14.0 (latest) still ships this"

## Required outcome
- All three doc references name `playwright==1.64.1`, matching `apps/requirements.txt`.
- The engineio comment names a version that still ships the bug (4.15.0 does) without claiming it is the latest.

## Evidence that the surface is unchanged
- Public members and `inspect.signature` of Page/Locator/Frame/FrameLocator/ElementHandle are identical between 1.64.0 and 1.64.1 (320 members, 0 diffs), so the §6 re-derivation is satisfied and only the text needs updating.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using claude-opus-5-5 ｜ 𝕏}