In the context of the latest supply chain attack on npm (Shai-Hulud).
Use fixed dependencies version (since it's not deployed using a slightly out of date version is way less of a risk than installing a compromised minor update).
Replace npm install with npm ci --ignore-scripts to use the lock file (in the doc and docker image).
Additionally, updated the playwright docker image to trixie and backported the Keycloak update from the role PR.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6321
**Author:** [@Timshel](https://github.com/Timshel)
**Created:** 9/23/2025
**Status:** ✅ Merged
**Merged:** 10/29/2025
**Merged by:** [@dani-garcia](https://github.com/dani-garcia)
**Base:** `main` ← **Head:** `improvements/playwright`
---
### 📝 Commits (2)
- [`c3ea111`](https://github.com/dani-garcia/vaultwarden/commit/c3ea1114fa3e44ccda343367f61017d68ab6085b) Playwright node improvements
- [`fc8e0b6`](https://github.com/dani-garcia/vaultwarden/commit/fc8e0b6c252b2eff4cce11d1418453b4710fbd3a) Upgrade Keycloak compose to trixie
### 📊 Changes
**8 files changed** (+400 additions, -226 deletions)
<details>
<summary>View changed files</summary>
📝 `playwright/README.md` (+1 -1)
📝 `playwright/compose/keycloak/Dockerfile` (+7 -28)
📝 `playwright/compose/keycloak/setup.sh` (+10 -2)
📝 `playwright/compose/playwright/Dockerfile` (+4 -4)
📝 `playwright/docker-compose.yml` (+4 -5)
📝 `playwright/global-utils.ts` (+1 -1)
📝 `playwright/package-lock.json` (+366 -178)
📝 `playwright/package.json` (+7 -7)
</details>
### 📄 Description
In the context of the latest supply chain attack on npm (Shai-Hulud).
- Use fixed dependencies version (since it's not deployed using a slightly out of date version is way less of a risk than installing a compromised minor update).
- Replace `npm install` with `npm ci --ignore-scripts` to use the lock file (in the doc and docker image).
Additionally, updated the playwright docker image to `trixie` and backported the Keycloak update from the role PR.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/6321
Author: @Timshel
Created: 9/23/2025
Status: ✅ Merged
Merged: 10/29/2025
Merged by: @dani-garcia
Base:
main← Head:improvements/playwright📝 Commits (2)
c3ea111Playwright node improvementsfc8e0b6Upgrade Keycloak compose to trixie📊 Changes
8 files changed (+400 additions, -226 deletions)
View changed files
📝
playwright/README.md(+1 -1)📝
playwright/compose/keycloak/Dockerfile(+7 -28)📝
playwright/compose/keycloak/setup.sh(+10 -2)📝
playwright/compose/playwright/Dockerfile(+4 -4)📝
playwright/docker-compose.yml(+4 -5)📝
playwright/global-utils.ts(+1 -1)📝
playwright/package-lock.json(+366 -178)📝
playwright/package.json(+7 -7)📄 Description
In the context of the latest supply chain attack on npm (Shai-Hulud).
npm installwithnpm ci --ignore-scriptsto use the lock file (in the doc and docker image).Additionally, updated the playwright docker image to
trixieand backported the Keycloak update from the role PR.🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.