chore(security): upgrade Playwright to 1.55.1 and remove patched core override

[darcyYe]

Summary

This PR fixes a high-severity Playwright vulnerability by upgrading playwright to 1.55.1 and removing the old local patch for playwright-core@1.48.2.

Why this issue was not shown in GitHub Security tab

When we checked repository Dependabot alerts, only axios alert #69 was listed as open.
The Playwright advisory (GHSA-7mvr-c777-76hp) exists in the GitHub Advisory Database, but it was not surfaced as an active Dependabot alert for this repo at that time.

In practice, this can happen due to differences in alert surfacing between tools/data pipelines (Dependabot alert presentation vs npm/pnpm audit advisory resolution timing and matching).

How we found it

We ran:

pnpm audit --audit-level high

It reported:

• Package: playwright
• Vulnerable range: <1.55.1
• Patched range: >=1.55.1
• Advisory: GHSA-7mvr-c777-76hp / CVE-2025-59288

How we determined the fix

The audit output and advisory both specify >=1.55.1 as the patched version.
So we upgraded playwright from 1.48.2 to 1.55.1, regenerated the lockfile, and removed the now-unnecessary local playwright-core patch.

Verification

• pnpm audit --audit-level high -> No known vulnerabilities found
• pnpm why playwright -> resolves to 1.55.1
• pnpm astro check -> no errors

[Copilot]

Pull request overview

This PR addresses a high-severity security vulnerability in Playwright by upgrading from version 1.48.2 to 1.55.1 and removing a local patch that is no longer needed. The vulnerability (CVE-2025-59288 / GHSA-7mvr-c777-76hp) was discovered via pnpm audit and the fix is verified by the absence of high-level audit warnings after the upgrade.

Changes:

• Upgraded playwright from 1.48.2 to 1.55.1 to address CVE-2025-59288
• Removed the local patch for playwright-core@1.48.2 which addressed insecure curl -k flags, now fixed upstream
• Updated all transitive dependency references in the lockfile to use the new Playwright version

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
package.json	Updated playwright version to 1.55.1 and removed patchedDependencies configuration
pnpm-lock.yaml	Updated all playwright and playwright-core references to 1.55.1, including transitive dependencies through rehype-mermaid and mermaid-isomorphic
patches/playwright-core@1.48.2.patch	Deleted the patch file that removed insecure -k flags from curl commands (now fixed upstream)

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.