[dependabot]

Bumps cloakbrowser from 0.5.9 to 0.6.3.

Release notes

Sourced from cloakbrowser's releases.

Chromium v154.0.8037.57.2 — Stealth Build (Pro)

CloakBrowser Pro: Linux Stable advances to Chromium 154.0.8037.57.2

Chromium 154.0.8037.57.2 is now Stable on Linux (x64 and ARM64). Windows and macOS Stable stay on 154.0.8037.57.1.

With a valid CloakBrowser key, the wrapper automatically selects the Stable build for your platform. No version pin is required.

What's new since 154.0.8037.57.1 (Linux)

• 3 to 6 times less CPU when running headed in Docker or on a GPU-less Linux server. Headless mode and machines with a real GPU are not affected.
• Safer proxy handling. Proxy passwords with special characters now work, and a proxy setting the browser cannot read stops the connection instead of going out without the proxy.
• A more patient license connection, with a new --license-route=auto|direct|proxy flag. auto is the default and works as before.
• Windows persona hardware follows the graphics model. On Intel graphics profiles, a fixed seed may report different core and memory values than before.
• Windows persona fonts match real Windows by default when the real Windows fonts are installed, so --fingerprint-windows-font-metrics is no longer needed.
• The macOS persona on Linux matches a real Mac in two more details.

Your profiles, cookies, and seeds are untouched. Only the browser itself is replaced.

Current wrapper: v0.6.2

Update the wrapper before launching:

pip install -U cloakbrowser
npm update cloakbrowser
dotnet add package CloakBrowser --version 0.6.2

Roll back if needed

If a workload regresses, pin the previous Linux Stable build:

export CLOAKBROWSER_VERSION=154.0.8037.57.1

Remove the pin to return to the newest Stable build.

If you hit a regression, please tell us. Open an issue or email support@cloakbrowser.dev with the site and what you saw. Pinning the old build gets you unblocked; a report gets it fixed for everyone.

Checksums (SHA-256)

version=154.0.8037.57.2
cee9eeda5d64b0a477b3a3f2ea6c99edb6fdd3ef840b91eca90ff4f37e538a63  cloakbrowser-linux-x64.tar.gz
4a648032b2a1f96fc30bc1dcb73c608abe1c09654e92d28844c50e50e915fb61  cloakbrowser-linux-arm64.tar.gz

The signed manifest (SHA256SUMS and SHA256SUMS.sig) is attached. The wrapper verifies its Ed25519 signature and each archive's SHA-256 checksum automatically.

... (truncated)

Changelog

Sourced from cloakbrowser's changelog.

[0.6.3] — 2026-10-14

• [wrapper] geoip=True no longer fails the launch when the exit IP's country has no locale in the map. It logs a warning and uses en-US. Python, JavaScript, and .NET (#591)
• [wrapper] GeoIP maps Seychelles (SC) to the en-SC locale. Python, JavaScript, and .NET (#596)
• [wrapper] Async launches no longer freeze the caller's event loop. launch_async(), launch_context_async() and launch_persistent_context_async() ran the binary/license check and the GeoIP and WebRTC exit-IP lookups directly on the event loop, so every other coroutine (a server's health endpoint, WebSockets, other browsers) stalled for up to 20s per launch behind a slow proxy. They now run in a worker thread. .NET: the license check and Pro version lookup inside async launches no longer hold the caller's thread (e.g. a UI thread). Python and .NET; JavaScript was not affected.
• [wrapper] Fix humanized select_option() raising element is not attached to the DOM when the pick navigates the page (e.g. a dropdown that submits its form on change). The option was selected and the page navigated, but the check after the pick ran on the new page. It now returns the chosen values, as Playwright does. A pick that lands on the wrong option without navigating still raises. Python, JavaScript Playwright, and .NET (#597)
• [wrapper] Humanized clicks, hovers and taps now reach a position: fixed element (e.g. a modal) whose DOM parent is a scrolling panel, and a position: absolute element that escapes a static scroller. They timed out with element is outside of the viewport because the scroll container was looked up through DOM parents instead of the element's containing blocks. Elements that the scroller really clips are still scrolled into view as before. Python, JavaScript, and .NET (#593, #595)
• [wrapper] Humanized typing now matches measured human keystroke timing (Aalto 136M Keystrokes dataset): keys are held about 100 ms (was 15-35 ms); the next key often goes down before the previous one is released (rollover, about 20% of pairs); Shift is often let go before the letter key. The gap between keys depends on the keys: after a space, the same hand, the other hand, or a repeated letter. The default typing speed is about 150 ms between keys (was 70 ms). The typo rate is 4% (was 2%; 5% on careful). Overall typing speed stays about the same: the gaps are longer, but keys overlap. A key is never pressed again while it is still held (including the same letter in lower then upper case, as in xX), and every held key is released if the action fails. In .NET, a \r\n line break in typed text is still inserted as text, as before. typing_delay, key_hold, shift_down_delay and shift_up_delay keep their meaning. Python, JavaScript Playwright and Puppeteer, and .NET (#595)
• [wrapper] Humanized mouse moves now follow Fitts' law: a move takes longer the farther it goes, so short moves are a little slower and long moves faster than before (new mouse_time_base, mouse_time_per_bit, mouse_time_spread), with human run-to-run variation. Speed peaks in the first third of the move, as in recorded human strokes, not in the middle. Events are spaced at display frame rate. A move never reports zero movement, and an occasional overshoot past the target is corrected with a short second stroke. Python, JavaScript Playwright and Puppeteer, and .NET (#595)
• [wrapper] Humanized scrolling now sends whole mouse-wheel notches for the persona's platform (100 px on Windows, 40 px on macOS, 120 px on Linux), in short flicks, so a page's deltaY agrees with wheelDeltaY the way a real wheel's does. Previously it sent 20-40 px chunks with a one-notch wheelDeltaY, which no real wheel produces. Override the notch with the new scroll_notch_px setting (0 = auto). The standalone .NET HumanScroll helper also wheels in whole notches. Behaviour change (JavaScript Puppeteer): page.mouse.wheel({ deltaY }) now scrolls a whole number of notches, at least one, so wheel({ deltaY: 10 }) scrolls a full notch (100 px on a Windows persona). Python, JavaScript Playwright and Puppeteer, and .NET (#595)
• [wrapper] Removed the humanize settings mouse_steps_divisor, mouse_burst_size, mouse_burst_pause, scroll_delta_base and scroll_delta_variance (.NET MouseStepsDivisor, MouseBurstSize, MouseBurstPause, ScrollDeltaBase, ScrollDeltaVariance). Mouse moves are now timed by mouse_time_* and scrolling by scroll_notch_px, so these had no effect. A human_config that still passes them keeps working: Python drops them with a FutureWarning (shown by default and pointing at your own code), and JavaScript and the .NET override dictionary ignore them. .NET code that sets the properties directly no longer compiles.

[0.6.2] — 2026-10-12

• [wrapper] Humanized actions (click, hover, fill, type, check and the rest) work again on Playwright 1.64. They timed out with element is not visible even on visible elements, because Playwright 1.64 changed how it checks visibility. Older Playwright versions are unaffected. Python, JavaScript, and .NET (thanks @​laplace-anon, #586, #587)

[0.6.1] — 2026-10-11

• [wrapper] Element reads are now humanized: page.input_value(), page.text_content(), page.inner_text(), page.inner_html(), page.get_attribute() and dispatch_event() (page, frame, locator and element handle; sync and async) resolve and read through the humanize isolated world, like every other humanized call. A dispatched event is built by Playwright's own helper, so a page listener sees the same event it would from any other dispatch. page._original.input_value(...) / page._original.dispatch_event(...) still give the raw Playwright path. Python, JavaScript and .NET (InputValueAsync, TextContentAsync, InnerTextAsync, InnerHTMLAsync, GetAttributeAsync, DispatchEventAsync on every wrapper; Original / Humanize.Unwrap(page) for the raw path).

• [wrapper] Humanized select_option() on a dropdown now types the first letters of the option, like a person does on a long list, plus a few arrow keys when that is shorter, instead of pressing an arrow key once per row. A pick on a 200-option list takes about 1.5-2s instead of up to 30s, and timeout= now bounds it (#581). The keys typed land on the same option wherever the open popup's highlight starts, so a popup that opens under the mouse pointer no longer picks the wrong option on headed Linux (#580). On a macOS host the shortest unique prefix of the label is typed instead of the whole label. Python, JavaScript Playwright, and .NET (thanks @​evelaa123, #582)

• [wrapper] Humanized select_option() now reaches dropdown options whose label starts with an emoji (e.g. a flag before a country name) with arrow keys, because the browser's dropdown search ignores a typed emoji. On a macOS host, where the dropdown also ignores arrow keys, such an option raises a clear error that points to page._original.select_option(...) instead of failing with a mismatched selection. Python, JavaScript Playwright, and .NET.

• [wrapper] launch_persistent_context(humanize=True) (JS launchPersistentContext()) now humanizes the page the profile opens with. That first page could silently run Playwright's own unhumanized methods. Python (sync and async) and JavaScript; .NET was not affected.

• [wrapper] Python: humanize=True now works when Playwright is compiled into the app (e.g. a Nuitka build). The internals check no longer reports a supported Playwright as missing ElementHandle._frame and fails every humanized launch (thanks @​bercedev, #583)

• [wrapper] JavaScript Puppeteer and .NET: a launch refused by the license (e.g. over the session limit) now raises CloakBrowserLicenseError with the reason, instead of a raw browser-launch crash.

• [wrapper] The session-limit error now explains how to free a seat: close browsers with browser.close() (e.g. in a finally block), and a crashed or killed session releases its seat on its own within 4 min (free/trial/solo), 15 min (team) or 30 min (business/scale). Python, JavaScript, and .NET.

• [wrapper] The local-configuration license error now also names an invalid --license-route value as a possible cause, not only an unwritable ~/.cloakbrowser. Python, JavaScript, and .NET.

[0.6.0] — 2026-10-08

• [wrapper] The first-launch Pro banner now names the current Pro major (v154) instead of v152. Python, JavaScript, and .NET.
• [binary] CloakBrowser Pro Stable is now Chromium 154.0.8037.57.1 on every platform: Linux x64/ARM64, Windows x64, and macOS (Apple Silicon and Intel). macOS moves up from Chromium 151.
• [binary] Linux preview channel (x64/ARM64) is now 154.0.8037.57.2: much lower CPU in headed mode on GPU-less Linux, safer proxy handling, a more patient license connection with a new --license-route=auto|direct|proxy flag, and the Windows persona's system and code fonts now match real Windows by default.
• [wrapper] cloakserve: a browser launched through /json/version or /json/list with no WebSocket client attaching now gets idle cleanup, instead of running forever when --idle-timeout is set (thanks @​dstosch, #558)
• [wrapper] Concurrent first launches on an empty cache are now safe. Several processes or threads downloading the binary at once could delete each other's install mid-extraction or start a binary that was still being written (ETXTBSY on Linux, dlopen failures on macOS), sometimes leaving the cache permanently incomplete. Each download now extracts into its own staging directory and is moved into place, and the first complete install wins. Python, JavaScript, and .NET (thanks @​Shub3am, #555)
• [wrapper] Behaviour change: launch_persistent_context() (JS launchPersistentContext(), .NET LaunchPersistentContextAsync()) now keeps one fingerprint seed per profile. The seed is stored in <user_data_dir>/.cloakbrowser-seed on first launch and reused afterwards, so a profile keeps the same identity across sessions instead of getting a new random one each launch. Existing profiles get their seed saved on their next launch. An explicit --fingerprint= in args wins and leaves the file untouched, stealth_args=False skips it, and non-persistent launches stay random. Concurrent first launches agree on a single seed. Python, JavaScript (Playwright + Puppeteer), and .NET.
• [wrapper] context.request / page.request / route.fetch() now log a one-time warning when the proxy is a SOCKS5 or credentialed HTTP proxy. That proxy is set on the browser itself, so Playwright's request client does not use it and sends from your real IP. Use an in-page fetch() instead (see the README). Python and JavaScript; documented for .NET (#579)
• [wrapper] JavaScript: binary and GeoIP download status messages now go to stderr instead of stdout, so they no longer corrupt MCP stdio servers or tools that parse stdout on first run. Python and .NET already did this.
• [wrapper] JavaScript: CommonJS require('cloakbrowser') now works, including the cloakbrowser/puppeteer and cloakbrowser/human subpaths. Requires Node 20.19+ or 22.12+ (the npm package's engines field now says so).
• [wrapper] Python, JavaScript Playwright and .NET: humanized actions now use one engine with full Playwright selector support, for every action on pages, frames, frame_locator, locators, element handles, mouse and keyboard (sync and async). get_by_role, >> chains, filter(has=/has_text=), :visible, nth and frame_locator now work (#522; thanks @​evelaa123, #578).
• [wrapper] Python, JavaScript Playwright and .NET, behaviour change: strict mode. An ambiguous locator (page.locator(".dup").click()) now raises strict mode violation like Playwright instead of silently using the first match. Use .first / .nth() / a more specific locator.
• [wrapper] Python, JavaScript Playwright and .NET, behaviour change: errors instead of silent fallbacks. When a humanized action cannot be performed it raises Playwright Error / TimeoutError with a call log (e.g. <div id="over"> intercepts pointer events, element is outside of the viewport) instead of falling back to Playwright's own action. Off-viewport elements no longer report the misleading "covered by " (follow-up to #521). The ActionabilityError / Element…Error, StealthDomError and UnsupportedHumanizeSelectorError classes stay importable (cloakbrowser.human, the JS human module, CloakBrowser.Human) so existing imports keep working, but actions no longer raise them.
• [wrapper] Python and JavaScript Playwright, behaviour change: Playwright 1.53 or newer is now required. The Python package depends on playwright>=1.53 (was >=1.40), so installing or upgrading cloakbrowser also upgrades an older Playwright. JS keeps its playwright-core>=1.53.0 peer range. With an older version, launching with humanize=True raises an error that names the installed version instead of running some actions un-humanized.
• [wrapper] Python, JavaScript Playwright and .NET: Playwright options are honoured instead of dropped: button, click_count, modifiers (incl. ControlOrMeta; held during the move for hover), position, delay, trial, steps, scroll="none", force, strict; mouse.click(button=, click_count=), mouse.move(steps=). Timeouts follow set_default_timeout / context defaults, and timeout=0 means no limit.
• [wrapper] Python, JavaScript Playwright and .NET, behaviour change: value fields and select_option() are operated like a person, with trusted input events only. Date/time/datetime-local/month/week inputs are typed part by part in whatever order the browser locale shows; sliders are clicked near the target value and nudged with arrow keys; dropdowns are opened with a click and moved with arrow keys + Enter (on a macOS host, whose native dropdown ignores arrow keys, the option is picked by typing its label); list boxes get option clicks (Ctrl/Cmd to add). <input type=color> opens a native colour dialog that cannot be driven, so fill() on it raises (use page._original.fill; .NET: Humanize.Unwrap(page).FillAsync). Checkboxes, radios, files etc. raise Input of type "…" cannot be filled; non-numeric text into type=number raises. Simulated typos are skipped in number/email/password/tel/url fields, and a typo the page rejects (input masks) is no longer "corrected" by deleting a real character.
• [wrapper] Python, JavaScript Playwright and .NET, behaviour change: fields are focused by scrolling to them and clicking; an element that can never be brought on screen (e.g. at negative offsets) fails with element is outside of the viewport. press() / type() still send the keys when the click does not move focus (a <canvas>, document-level key handlers), like Playwright.
• [wrapper] Python, JavaScript Playwright and .NET: select-all, ControlOrMeta and the caret follow the browser persona (--fingerprint-platform=macos uses Meta), not the host OS, so fill() no longer appends under a macOS persona. type() / press_sequentially() continue at the end of existing text on every persona.
• [wrapper] Python, JavaScript Playwright and .NET: frames are scrolled with the wheel (also below an iframe's own fold), clicks in frames are hit-tested through every ancestor <iframe>, double clicks emit a real detail=1, 2 sequence, uppercase typos are typed with Shift, handle.press() focuses its element, check() keeps the cursor in place and honours human_config, a target replaced or removed while the cursor travels is never pressed, an element handle whose page navigated raises not attached right away instead of acting on the new page, and element handles work when a parent and child share the same box (a link wrapping an image, a list item filled by its link). scroll_overshoot_chance / scroll_overshoot_px keep working.
• [wrapper] Python, removed: scroll_to_element and human_scroll_into_view (scrolling is part of each action), the async_human_move / async_human_click / async_human_idle / async_human_type / async_scroll_to_element / async_human_scroll_into_view helpers, the RawMouse / RawKeyboard / AsyncRawMouse / AsyncRawKeyboard re-exports from cloakbrowser.human, and ensure_actionable / ensure_stable / check_pointer_events (+ _handle and async_ variants, CHECKS_*). Use the humanized Playwright actions (page.click(), locator.scroll_into_view_if_needed() …) instead.
• [wrapper] JavaScript Playwright: the per-call options use Playwright's names (clickCount, modifiers, position, trial, force, steps, timeout); HumanConfig overrides go in human_config (flat HumanConfig keys in the options object keep working). Removed: patchSingleElementHandle (every ElementHandle is humanized automatically), scrollToElement and humanScrollIntoView (scrolling is part of each action).

... (truncated)

Commits

• fbf005b release: v0.6.3 — humanize timing, mouse and scroll realism, GeoIP fixes
• e156f89 test(dotnet): expect normalized newlines in CRLF typing test
• 1966ff8 fix(humanize): human-like key timing, Fitts-law mouse, notch wheels; containi...
• 04c3c02 fix(humanize): select_option returns when the pick navigates the page (#597)
• 2571290 fix(geoip): fall back to en-US for unmapped countries (#591)
• 160f56d fix(geoip): map Seychelles (SC) to a locale (#596)
• 214a2be docs: Linux Pro Stable 154.0.8037.57.2, --license-route flag
• 485f678 docs: version pinning requires a paid Pro key
• 89fb671 fix(async): run blocking launch lookups off the event loop
• 4a1b8f9 release: v0.6.2 — humanize fix for Playwright 1.64
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[factory-droid]

Droid encountered an error —— View job

---