[dependabot]

Bumps puppeteer from 25.13.0 to 25.17.0.

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v25.17.0

25.17.0 (2026-11-10)

🎉 Features

• add console events to Browser and BrowserContext (#15710) (e9894e3)
• add HTTPResponse.stream() (#15717) (8fab4dc)
• add page and worker methods on HTTPRequest (#15514) (9b2fe5e)
• add request events to Browser and BrowserContext (#15539) (b99132a)
• add scriptId to ConsoleMessageLocation (#15537) (f3511d8)
• cdp: expose DomContentLoaded and NavigationStart in page.metrics() (#15676) (5862b81)
• expose HTTPResponse.encodedDataLength() (#15678) (9abca26)
• introduce other network event on browser and browserContext (#15726) (9319ada)
• locators: support passing arguments to Locator.filter and Locator.map (#15684) (a0b2b8d)
• report dedicated worker console messages on Browser and BrowserContext (#15711) (092e6e6)
• roll to Chrome 157.0.8103.38 (#15716) (591d736)
• roll to Firefox 159.0 (#15685) (de2e9f9)

🛠️ Fixes

• bidi: apply downloadBehavior from launch and connect options (#15687) (d8cc590)
• bidi: deliver console messages replayed while connecting (#15712) (5115e5c)
• bidi: enforce exhaustive switch in getBidiKeyValue and support Abort/NumpadEnter (#15654) (7cb1c0b)
• bidi: keep the plain GMT timezone ID in page.emulateTimezone() (#15728) (026b426)
• bidi: let contentType replace a content-type header in respond() (#15653) (7cb283c)
• bidi: make page.setCacheEnabled() enable the cache by default (#15698) (4b211de)
• bidi: respect waitForFonts in page.pdf() (#15714) (0814ac1)
• bidi: return domain cookies for the domain itself in page.cookies() (#15689) (884a8c3)
• bidi: send the default accuracy in page.setGeolocation() (#15704) (8dfe2ff)
• bidi: send the Enter code for the Enter key (#15743) (27e017c)
• bidi: tolerate respond() and abort() failures for gone requests (#15697) (1c4e4ad)
• bidi: update Request.isBlocked on network lifecycle events (#15677) (a0d910a)
• cdp: allow calling exposed functions after deleting from globalThis (#15683) (5c11065)
• cdp: handle internal redirects not paused by Fetch.requestPaused (#15644) (176afa2)
• cdp: include null and undefined in ConsoleMessage.text() (#15693) (e54f1db)
• deflake BiDi navigation and flaky tests from main CI (#15638) (d8ef67a)
• do not mutate options.args in defaultArgs (#15664) (1581677)
• do not throw in evaluate when the caller stack frame is missing (#15666) (28782a2)
• extensions: support Target.attachToTarget in ExtensionTransport (#15647) (c615311)
• fail pending worker requests on worker termination (#15538) (7231774)
• network: emit requestfailed when loadingFailed precedes requestPaused (#15576) (5b0c34a)
• roll to Chrome 156.0.8078.73 (#15686) (33f2ad6)
• roll to Chrome 156.0.8078.80 (#15696) (715534b)
• roll to Chrome 157.0.8103.50 (#15747) (5a0d6de)
• roll to Firefox 159.0.1 (#15715) (62d357a)
• type wildcard event emitter handlers correctly (#15643) (08e7b1a)
• validate CRLF in input HTTPRequest headers (#15601) (d830850)
• webdriver: dispose requests that complete with a 3xx status but are not redirected (#15631) (fac3a5b)

... (truncated)

Commits

• f255d23 chore: release main (#15637)
• b40ada9 chore(deps-dev): bump the dev-dependencies group across 1 directory with 10 u...
• 026b426 fix(bidi): keep the plain GMT timezone ID in page.emulateTimezone() (#15728)
• 9abca26 feat: expose HTTPResponse.encodedDataLength() (#15678)
• 5a0d6de fix: roll to Chrome 157.0.8103.50 (#15747)
• 27e017c fix(bidi): send the Enter code for the Enter key (#15743)
• 8fab4dc feat: add HTTPResponse.stream() (#15717)
• 40a88f1 chore(deps): bump ws from 8.22.0 to 8.22.1 in the dependencies group (#15736)
• dc67a65 chore(deps): bump the all group in /website with 3 updates (#15738)
• 7cb283c fix(bidi): let contentType replace a content-type header in respond() (#15653)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2021d79e-2ecd-45fe-b6f1-545266498e05

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.