Update Playwright to v1.65.0

Release-Bump: minor

e2e-tests/Dockerfile

@@ -1,6 +1,6 @@
 # Playwright runner — browsers preinstalled, pinned to match @playwright/test in e2e-tests/.
 # Built/run via e2e-tests/compose.visual.yml; targets the `web` service over the network.
-FROM mcr.microsoft.com/playwright:v1.64.1-noble
+FROM mcr.microsoft.com/playwright:v1.65.0-noble
 
 WORKDIR /e2e-tests
 

e2e-tests/package-lock.json

@@ -6,19 +6,19 @@
     "": {
       "name": "plainpages-e2e",
       "devDependencies": {
-        "@playwright/test": "1.64.1",
+        "@playwright/test": "1.65.0",
         "@types/node": "24.19.2",
         "typescript": "7.0.2"
       }
     },
     "node_modules/@playwright/test": {
-      "version": "1.64.1",
+      "version": "1.65.0",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.64.1.tgz",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.65.0.tgz",
-      "integrity": "sha512-IaYGml/nSOiZWROfPtuIL7neuu9qDOZ3TNvNljUIrhDMxiGTgPjzj/g9p9RxpS2tSepPDRY+UwAaEeiKtUvIAg==",
+      "integrity": "sha512-iGURLGuKDLakSEl7Pgfv8h7f+XLT+V861Wfhz0zlEl5nyFuKUopdkFBPKqTllTUp06aOwPuH8iuUEb3yp3MpbQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright": "1.64.1"
+        "playwright": "1.65.0"
       },
       "bin": {
         "playwright": "cli.js"
@@ -378,13 +378,13 @@
       }
     },
     "node_modules/playwright": {
-      "version": "1.64.1",
+      "version": "1.65.0",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.64.1.tgz",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.65.0.tgz",
-      "integrity": "sha512-HCrVhHr5QQuwYoswEUGTb7gGp522yflbv/ST8nF4sFWGuLjQCt17Q/EubpGGSNKYn1tsTCPZxqHhHCfVURu7UA==",
+      "integrity": "sha512-F3AMWcR44qMBt4kq+6Kb6mX7bjGXshktKFOPULd7reED6ZJWevjbNRqysP7q+AATE9kdPEZBibex1BYsvpVoeA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright-core": "1.64.1"
+        "playwright-core": "1.65.0"
       },
       "bin": {
         "playwright": "cli.js"
@@ -394,9 +394,9 @@
       }
     },
     "node_modules/playwright-core": {
-      "version": "1.64.1",
+      "version": "1.65.0",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.64.1.tgz",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.65.0.tgz",
-      "integrity": "sha512-BC4s8y6SEVA6Q1rSxZTto8hI1KUI3xXlHGZgvGqP4IqPdI/a6FX9H29IDNz7vKo9l21b6LfYosScPL6M3xxyDQ==",
+      "integrity": "sha512-vNSKgH6YqtN7cdT/L334zo0a+YwkrpicyrHJlWWPIm/Q+Nn2SWInil01oT0mbu96U4GgoRtCYQD9CzJQgju+lA==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {

e2e-tests/package.json

@@ -8,7 +8,7 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@playwright/test": "1.64.1",
+    "@playwright/test": "1.65.0",
     "@types/node": "24.19.2",
     "typescript": "7.0.2"
   }

package-lock.json

@@ -8,7 +8,7 @@
       "dependencies": {
         "@larvit/log": "2.3.0",
         "ejs": "6.0.1",
-        "lucide-static": "1.67.0",
+        "lucide-static": "1.68.0",
         "postgres": "3.4.9"
       },
       "devDependencies": {
@@ -421,9 +421,9 @@
       }
     },
     "node_modules/lucide-static": {
-      "version": "1.67.0",
+      "version": "1.68.0",
-      "resolved": "https://registry.npmjs.org/lucide-static/-/lucide-static-1.67.0.tgz",
+      "resolved": "https://registry.npmjs.org/lucide-static/-/lucide-static-1.68.0.tgz",
-      "integrity": "sha512-Lu/Ntwfw1GOQiNgTC2iHd/PC4QbqzwktLVFHTB84tldlfUjFgQ+EBWiZc/UPrlNdX97O/KXWRn792hIdQh6nhA==",
+      "integrity": "sha512-sInxhr771A4UUu8D1gXZjj3mmGwqRTYDVNbfwN25Yx6vwA9Hnq9t+P9rF49UW8MirAe1iaYpqe+3vq99bbH8zg==",
       "license": "ISC"
     },
     "node_modules/postgres": {

package.json

@@ -18,7 +18,7 @@
   "dependencies": {
     "@larvit/log": "2.3.0",
     "ejs": "6.0.1",
-    "lucide-static": "1.67.0",
+    "lucide-static": "1.68.0",
     "postgres": "3.4.9"
   },
   "devDependencies": {

todo.md

@@ -6,7 +6,7 @@
 
 `Bar = 1`
 
-`Next ID = 57`
+`Next ID = 58`
 
 ## Items
 
@@ -17,6 +17,7 @@
 | 6 | 0.5.0 |  |  | **Warn at discovery when a route or nav node gates on a permission no plugin declares.** | 2 | 1 | 1 | 2 | 2 | 7 by 3, 9 by 3 | 8.0 |
 | 23 | 0.5.0 |  |  | **Give list pages one view-model helper from query to pagination, instead of ~40 hand-written lines each.** | 3 | 1 | 2 | 4 | 5 | 1 by 4, 9 by 2, code health by 3 | 7.9 |
 | 43 | 0.5.0 |  |  | **Let a plugin version the scripts and other `/public/` files its own markup links, so they are cached as immutable too.** | 2 | 2 | 1 | 3 | 3 | 8 by 3, 7 by 2 | 5.0 |
+| 57 | 0.5.0 |  | owner | **Put the caller's IP, user agent and host on every request's span and `request` log line, under OpenTelemetry's HTTP semantic conventions, reading the IP through a proxy only where configuration names it trusted.** | 2 | 2 | 2 | 4 | 3 | 1 by 3 | 3.3 |
 | 19 | 0.6.0 |  | question | **Run the documented Docker commands on macOS and fix whatever misbehaves.** | 2 | 2 | 1 | 3 | 3 | 1 by 3 | 3.3 |
 | 16 | 0.6.0 |  | question | **Decide whether the single Keto `Resource` namespace splits into per-domain namespaces.** | 3 | 2 | 3 | 6 | 6 | 7 by 2 | 0.5 |
 | 28 | 0.6.0 |  |  | **Let a plugin add entries to the profile menu through the plugin API.** | 2 | 2 | 2 | 4 | 4 | 7 by 4, 1 by 2 | 4.2 |
@@ -66,6 +67,23 @@ favicon and logo, and a plugin's `styles`. A file a plugin's own markup links, s
 the plugin API, hence a minor. Pick one with the plugin authors' panel, then document it in README →
 Reserved view locals.
 
+### 57. Put the caller's IP, user agent and host on every request's span and `request` log line, under OpenTelemetry's HTTP semantic conventions, reading the IP through a proxy only where configuration names it trusted.
+
+Today the `request` line and span in `src/http/app.ts` carry only method, path, status and `ms`, so
+a dashboard can't filter requests by site or tell one caller from another. Add `server.address`
+(the `Host`), `user_agent.original`, `client.address` and `http.route` where a route matched, and
+rename the four fields already there to their convention names (`http.request.method`, `url.path`,
+`http.response.status_code`, and the span's own duration for `ms`). Every plugin gains them with no
+code of its own.
+
+`client.address` is the socket's peer unless a new setting, such as `TRUSTED_PROXIES`, lists that
+peer. Only then does the host take the address `X-Forwarded-For` names (goal 10: an explicit
+choice). Trusting the header from anyone would let a caller write any IP into the logs.
+
+A caller's IP and user agent are personal data, so the README says the host logs them, and a
+deployment's privacy policy must say so too. bender-infra's Requests dashboard (its todo.md item
+117) reads these names, and fastjira (its item 161) is the first plugin to send them.
+
 ### 19. Run the documented Docker commands on macOS and fix whatever misbehaves.
 
 Needs a Mac. Two suspects, both from `--user "$(id -u):$(id -g)"`: a macOS `id -g` is `20`, which is