Tighten visual and install-script policies

AUDIT.md

@@ -119,6 +119,10 @@ desktop and mobile, adds layout diagnostics without arbitrary delays, and preser
 reports, traces, screenshots, and diffs when protected CI or trusted publishing detects a visual
 change.
 
+Version 1.1.3 tightens visual comparisons to an absolute 500-pixel budget and explicitly denies
+install scripts for every resolved `fsevents` version, keeping the visual and dependency policies
+precise as the toolchain evolves.
+
 The repository now validates Node 24 and 26 with real FFmpeg on Linux, macOS, and Windows, uses
 private vulnerability reporting, required pull-request checks, immutable Action references, and npm
 trusted publishing with provenance. Representative downstream media corpora and high-volume service

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.1.3 - 2026-08-21
+
+### Testing and supply-chain hardening
+
+- Replaced the one-percent visual tolerance with an absolute 500-pixel limit for full-page snapshots
+- Explicitly disabled install scripts for Playwright's nested `fsevents@2.3.2` dependency
+- Kept the existing `fsevents@2.3.3` denial so the install-script policy covers the complete dependency tree
+
 ## 1.1.2 - 2026-08-21
 
 ### Testing and release engineering

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ffmpeg",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "A modern, typed Node.js API for processing media with FFmpeg",
   "keywords": [
     "ffmpeg",
@@ -88,6 +88,7 @@
   },
   "allowScripts": {
     "esbuild@0.28.1": true,
+    "fsevents@2.3.2": false,
     "fsevents@2.3.3": false
   }
 }

test/browser/landing-page.pw.ts

@@ -57,7 +57,7 @@ test('landing page matches its full-page visual baseline', async ({ page }) => {
     animations: 'disabled',
     caret: 'hide',
     fullPage: true,
-    maxDiffPixelRatio: 0.01,
+    maxDiffPixels: 500,
     scale: 'css',
   });