[dependabot]

Bumps cloakbrowser from 0.5.9 to 0.6.2.

Release notes

Sourced from cloakbrowser's releases.

Chromium v154.0.8037.57.2 — Stealth Build (Pro)

CloakBrowser Pro: Linux Stable advances to Chromium 154.0.8037.57.2

Chromium 154.0.8037.57.2 is now Stable on Linux (x64 and ARM64). Windows and macOS Stable stay on 154.0.8037.57.1.

With a valid CloakBrowser key, the wrapper automatically selects the Stable build for your platform. No version pin is required.

What's new since 154.0.8037.57.1 (Linux)

• 3 to 6 times less CPU when running headed in Docker or on a GPU-less Linux server. Headless mode and machines with a real GPU are not affected.
• Safer proxy handling. Proxy passwords with special characters now work, and a proxy setting the browser cannot read stops the connection instead of going out without the proxy.
• A more patient license connection, with a new --license-route=auto|direct|proxy flag. auto is the default and works as before.
• Windows persona hardware follows the graphics model. On Intel graphics profiles, a fixed seed may report different core and memory values than before.
• Windows persona fonts match real Windows by default when the real Windows fonts are installed, so --fingerprint-windows-font-metrics is no longer needed.
• The macOS persona on Linux matches a real Mac in two more details.

Your profiles, cookies, and seeds are untouched. Only the browser itself is replaced.

Current wrapper: v0.6.2

Update the wrapper before launching:

pip install -U cloakbrowser
npm update cloakbrowser
dotnet add package CloakBrowser --version 0.6.2

Roll back if needed

If a workload regresses, pin the previous Linux Stable build:

export CLOAKBROWSER_VERSION=154.0.8037.57.1

Remove the pin to return to the newest Stable build.

If you hit a regression, please tell us. Open an issue or email support@cloakbrowser.dev with the site and what you saw. Pinning the old build gets you unblocked; a report gets it fixed for everyone.

Checksums (SHA-256)

version=154.0.8037.57.2
cee9eeda5d64b0a477b3a3f2ea6c99edb6fdd3ef840b91eca90ff4f37e538a63  cloakbrowser-linux-x64.tar.gz
4a648032b2a1f96fc30bc1dcb73c608abe1c09654e92d28844c50e50e915fb61  cloakbrowser-linux-arm64.tar.gz

The signed manifest (SHA256SUMS and SHA256SUMS.sig) is attached. The wrapper verifies its Ed25519 signature and each archive's SHA-256 checksum automatically.

... (truncated)

Changelog

Sourced from cloakbrowser's changelog.

[0.6.2] — 2026-10-12

• [wrapper] Humanized actions (click, hover, fill, type, check and the rest) work again on Playwright 1.64. They timed out with element is not visible even on visible elements, because Playwright 1.64 changed how it checks visibility. Older Playwright versions are unaffected. Python, JavaScript, and .NET (thanks @​laplace-anon, #586, #587)

[0.6.1] — 2026-10-11

• [wrapper] Element reads are now humanized: page.input_value(), page.text_content(), page.inner_text(), page.inner_html(), page.get_attribute() and dispatch_event() (page, frame, locator and element handle; sync and async) resolve and read through the humanize isolated world, like every other humanized call. A dispatched event is built by Playwright's own helper, so a page listener sees the same event it would from any other dispatch. page._original.input_value(...) / page._original.dispatch_event(...) still give the raw Playwright path. Python, JavaScript and .NET (InputValueAsync, TextContentAsync, InnerTextAsync, InnerHTMLAsync, GetAttributeAsync, DispatchEventAsync on every wrapper; Original / Humanize.Unwrap(page) for the raw path).

• [wrapper] Humanized select_option() on a dropdown now types the first letters of the option, like a person does on a long list, plus a few arrow keys when that is shorter, instead of pressing an arrow key once per row. A pick on a 200-option list takes about 1.5-2s instead of up to 30s, and timeout= now bounds it (#581). The keys typed land on the same option wherever the open popup's highlight starts, so a popup that opens under the mouse pointer no longer picks the wrong option on headed Linux (#580). On a macOS host the shortest unique prefix of the label is typed instead of the whole label. Python, JavaScript Playwright, and .NET (thanks @​evelaa123, #582)

• [wrapper] Humanized select_option() now reaches dropdown options whose label starts with an emoji (e.g. a flag before a country name) with arrow keys, because the browser's dropdown search ignores a typed emoji. On a macOS host, where the dropdown also ignores arrow keys, such an option raises a clear error that points to page._original.select_option(...) instead of failing with a mismatched selection. Python, JavaScript Playwright, and .NET.

• [wrapper] launch_persistent_context(humanize=True) (JS launchPersistentContext()) now humanizes the page the profile opens with. That first page could silently run Playwright's own unhumanized methods. Python (sync and async) and JavaScript; .NET was not affected.

• [wrapper] Python: humanize=True now works when Playwright is compiled into the app (e.g. a Nuitka build). The internals check no longer reports a supported Playwright as missing ElementHandle._frame and fails every humanized launch (thanks @​bercedev, #583)

• [wrapper] JavaScript Puppeteer and .NET: a launch refused by the license (e.g. over the session limit) now raises CloakBrowserLicenseError with the reason, instead of a raw browser-launch crash.

• [wrapper] The session-limit error now explains how to free a seat: close browsers with browser.close() (e.g. in a finally block), and a crashed or killed session releases its seat on its own within 4 min (free/trial/solo), 15 min (team) or 30 min (business/scale). Python, JavaScript, and .NET.

• [wrapper] The local-configuration license error now also names an invalid --license-route value as a possible cause, not only an unwritable ~/.cloakbrowser. Python, JavaScript, and .NET.

[0.6.0] — 2026-10-08

• [wrapper] The first-launch Pro banner now names the current Pro major (v154) instead of v152. Python, JavaScript, and .NET.
• [binary] CloakBrowser Pro Stable is now Chromium 154.0.8037.57.1 on every platform: Linux x64/ARM64, Windows x64, and macOS (Apple Silicon and Intel). macOS moves up from Chromium 151.
• [binary] Linux preview channel (x64/ARM64) is now 154.0.8037.57.2: much lower CPU in headed mode on GPU-less Linux, safer proxy handling, a more patient license connection with a new --license-route=auto|direct|proxy flag, and the Windows persona's system and code fonts now match real Windows by default.
• [wrapper] cloakserve: a browser launched through /json/version or /json/list with no WebSocket client attaching now gets idle cleanup, instead of running forever when --idle-timeout is set (thanks @​dstosch, #558)
• [wrapper] Concurrent first launches on an empty cache are now safe. Several processes or threads downloading the binary at once could delete each other's install mid-extraction or start a binary that was still being written (ETXTBSY on Linux, dlopen failures on macOS), sometimes leaving the cache permanently incomplete. Each download now extracts into its own staging directory and is moved into place, and the first complete install wins. Python, JavaScript, and .NET (thanks @​Shub3am, #555)
• [wrapper] Behaviour change: launch_persistent_context() (JS launchPersistentContext(), .NET LaunchPersistentContextAsync()) now keeps one fingerprint seed per profile. The seed is stored in <user_data_dir>/.cloakbrowser-seed on first launch and reused afterwards, so a profile keeps the same identity across sessions instead of getting a new random one each launch. Existing profiles get their seed saved on their next launch. An explicit --fingerprint= in args wins and leaves the file untouched, stealth_args=False skips it, and non-persistent launches stay random. Concurrent first launches agree on a single seed. Python, JavaScript (Playwright + Puppeteer), and .NET.
• [wrapper] context.request / page.request / route.fetch() now log a one-time warning when the proxy is a SOCKS5 or credentialed HTTP proxy. That proxy is set on the browser itself, so Playwright's request client does not use it and sends from your real IP. Use an in-page fetch() instead (see the README). Python and JavaScript; documented for .NET (#579)
• [wrapper] JavaScript: binary and GeoIP download status messages now go to stderr instead of stdout, so they no longer corrupt MCP stdio servers or tools that parse stdout on first run. Python and .NET already did this.
• [wrapper] JavaScript: CommonJS require('cloakbrowser') now works, including the cloakbrowser/puppeteer and cloakbrowser/human subpaths. Requires Node 20.19+ or 22.12+ (the npm package's engines field now says so).
• [wrapper] Python, JavaScript Playwright and .NET: humanized actions now use one engine with full Playwright selector support, for every action on pages, frames, frame_locator, locators, element handles, mouse and keyboard (sync and async). get_by_role, >> chains, filter(has=/has_text=), :visible, nth and frame_locator now work (#522; thanks @​evelaa123, #578).
• [wrapper] Python, JavaScript Playwright and .NET, behaviour change: strict mode. An ambiguous locator (page.locator(".dup").click()) now raises strict mode violation like Playwright instead of silently using the first match. Use .first / .nth() / a more specific locator.
• [wrapper] Python, JavaScript Playwright and .NET, behaviour change: errors instead of silent fallbacks. When a humanized action cannot be performed it raises Playwright Error / TimeoutError with a call log (e.g. <div id="over"> intercepts pointer events, element is outside of the viewport) instead of falling back to Playwright's own action. Off-viewport elements no longer report the misleading "covered by " (follow-up to #521). The ActionabilityError / Element…Error, StealthDomError and UnsupportedHumanizeSelectorError classes stay importable (cloakbrowser.human, the JS human module, CloakBrowser.Human) so existing imports keep working, but actions no longer raise them.
• [wrapper] Python and JavaScript Playwright, behaviour change: Playwright 1.53 or newer is now required. The Python package depends on playwright>=1.53 (was >=1.40), so installing or upgrading cloakbrowser also upgrades an older Playwright. JS keeps its playwright-core>=1.53.0 peer range. With an older version, launching with humanize=True raises an error that names the installed version instead of running some actions un-humanized.
• [wrapper] Python, JavaScript Playwright and .NET: Playwright options are honoured instead of dropped: button, click_count, modifiers (incl. ControlOrMeta; held during the move for hover), position, delay, trial, steps, scroll="none", force, strict; mouse.click(button=, click_count=), mouse.move(steps=). Timeouts follow set_default_timeout / context defaults, and timeout=0 means no limit.
• [wrapper] Python, JavaScript Playwright and .NET, behaviour change: value fields and select_option() are operated like a person, with trusted input events only. Date/time/datetime-local/month/week inputs are typed part by part in whatever order the browser locale shows; sliders are clicked near the target value and nudged with arrow keys; dropdowns are opened with a click and moved with arrow keys + Enter (on a macOS host, whose native dropdown ignores arrow keys, the option is picked by typing its label); list boxes get option clicks (Ctrl/Cmd to add). <input type=color> opens a native colour dialog that cannot be driven, so fill() on it raises (use page._original.fill; .NET: Humanize.Unwrap(page).FillAsync). Checkboxes, radios, files etc. raise Input of type "…" cannot be filled; non-numeric text into type=number raises. Simulated typos are skipped in number/email/password/tel/url fields, and a typo the page rejects (input masks) is no longer "corrected" by deleting a real character.
• [wrapper] Python, JavaScript Playwright and .NET, behaviour change: fields are focused by scrolling to them and clicking; an element that can never be brought on screen (e.g. at negative offsets) fails with element is outside of the viewport. press() / type() still send the keys when the click does not move focus (a <canvas>, document-level key handlers), like Playwright.
• [wrapper] Python, JavaScript Playwright and .NET: select-all, ControlOrMeta and the caret follow the browser persona (--fingerprint-platform=macos uses Meta), not the host OS, so fill() no longer appends under a macOS persona. type() / press_sequentially() continue at the end of existing text on every persona.
• [wrapper] Python, JavaScript Playwright and .NET: frames are scrolled with the wheel (also below an iframe's own fold), clicks in frames are hit-tested through every ancestor <iframe>, double clicks emit a real detail=1, 2 sequence, uppercase typos are typed with Shift, handle.press() focuses its element, check() keeps the cursor in place and honours human_config, a target replaced or removed while the cursor travels is never pressed, an element handle whose page navigated raises not attached right away instead of acting on the new page, and element handles work when a parent and child share the same box (a link wrapping an image, a list item filled by its link). scroll_overshoot_chance / scroll_overshoot_px keep working.
• [wrapper] Python, removed: scroll_to_element and human_scroll_into_view (scrolling is part of each action), the async_human_move / async_human_click / async_human_idle / async_human_type / async_scroll_to_element / async_human_scroll_into_view helpers, the RawMouse / RawKeyboard / AsyncRawMouse / AsyncRawKeyboard re-exports from cloakbrowser.human, and ensure_actionable / ensure_stable / check_pointer_events (+ _handle and async_ variants, CHECKS_*). Use the humanized Playwright actions (page.click(), locator.scroll_into_view_if_needed() …) instead.
• [wrapper] JavaScript Playwright: the per-call options use Playwright's names (clickCount, modifiers, position, trial, force, steps, timeout); HumanConfig overrides go in human_config (flat HumanConfig keys in the options object keep working). Removed: patchSingleElementHandle (every ElementHandle is humanized automatically), scrollToElement and humanScrollIntoView (scrolling is part of each action).
• [wrapper] .NET: Humanize = true now runs on the same engine for IPage, IFrame, ILocator (any shape: GetByRole, >>, Filter, FrameLocator, ContentFrame), IElementHandle, IMouse and IKeyboard. FrameLocator(), QuerySelector(All)Async, WaitForSelectorAsync, ElementHandle(s)Async, FrameElementAsync, ContentFrameAsync and OwnerFrameAsync now return humanized objects. Mouse DownAsync/UpAsync/WheelAsync and keyboard DownAsync/UpAsync/PressAsync/InsertTextAsync are passed through 1:1, as in Python/JS. Failures throw PlaywrightException / System.TimeoutException with a call log. The standalone Actionability checks (EnsureActionableAsync, EnsureStableAsync, CheckPointerEventsAsync, …HandleAsync, Checks*), HumanScroll / ScrollResult / IRawScrollPage and IsolatedWorld keep their public signatures; Actionability now accepts any Playwright selector and still throws the typed errors. The explicit HumanPage API is unchanged and uses the same engine; HumanActionOptions.Timeout = 0 means no limit. Removed: the unused public CloakBrowser.Human.StealthStatus enum.
• [wrapper] JavaScript Puppeteer and .NET HumanScroll: smooth wheel scrolling no longer sends an occasional empty (0, 0) wheel event at the end of a scroll.
• [wrapper] JavaScript Puppeteer: frame.click / hover / type / select / focus / tap now resolve the selector inside that frame (they used to look it up in the top document and fail) (#184). page.click, elementHandle.click and mouse.click honour button (right / middle clicks were sent as left) and count / clickCount with a real detail = 1, 2 sequence, and delay as the hold time. Uppercase typos are typed with Shift. Known gap: a target below an iframe's own scroll fold is not scrolled into view.

---

[0.5.12] — 2026-10-04

• [wrapper] Fix humanize=True clicks on targets past the right edge of a horizontally overflowing page (#521). Scroll-into-view now also scrolls the x axis, so the click no longer times out with "element is covered by ". Python, JavaScript Playwright/Puppeteer, and .NET.
• [wrapper] Scroll-into-view no longer sends a needless upward scroll on an unscrolled page when layout reports a sub-pixel negative top edge. Python, JavaScript, and .NET.
• [wrapper] Fix humanize=True typing into <input type="number">: a simulated typo on a digit is now always another digit, so the correcting Backspace no longer deletes a real digit (1999 → 999) (#573). Python, JavaScript Playwright/Puppeteer, and .NET.
• [wrapper] Dev tooling: vitest 5, playwright-core 1.63 for the JS test suite; CI runs on Node 22. No runtime dependency changes.

... (truncated)

Commits

• 4a1b8f9 release: v0.6.2 — humanize fix for Playwright 1.64
• c3e0f91 chore(deps-dev): bump the javascript group in /js with 3 updates (#588)
• 9a93487 chore(deps): bump actions/setup-node (#589)
• bd89505 fix(humanize): pass frameVisible to InjectedScript state checks (#586) (#587)
• e1b81de release: v0.6.1 — humanize and license fixes
• 9b0c30d fix(license): name an invalid --license-route in the config-error message
• 60f35e0 fix(humanize): apply humanize before the license guard on persistent contexts
• e439d89 feat(humanize): element reads and dispatch_event run in the humanize world
• 29ef063 fix(license): explain held seats in the session-limit error
• 3c7f1ac fix(license): surface license exits on Puppeteer and .NET launch failures (#584)
• Additional commits viewable in compare view

[factory-droid]

Droid encountered an error —— View job

---

[dependabot]

Superseded by #697.