playwright-rs 0.20.1

Fixed

• The crate installs again: zip moves from 8 to 9. The zip maintainers yanked every 8.x release, and the build script depends on zip to unpack the Windows Node archive, so a project without a lockfile could no longer resolve 0.20.0 at all. With the trace feature, playwright_rs::trace::TraceError::Zip now wraps zip 9's ZipError, through playwright-rs-trace 0.2.2.

Security

• Bumped transitive rustls 0.23.45 → 0.23.46 (RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0349) in the workspace lockfile and in the excluded site-e2e and fuzz lockfiles. The one that can reach this crate is RUSTSEC-2026-0349: a network attacker could answer one handshake with an unauthenticated ServerHello and push later connections to the same server name down to classical key exchange, losing post-quantum confidentiality but not authentication. The other three need a custom ClientSessionStore, EchMode::Enable, or rustls's brotli feature, none of which this crate uses. rustls reaches this crate through ureq (driver download) and the rustls-tls features. A downstream project picks up the fix with cargo update -p rustls.