chore(deps): bump cloakbrowser from 0.3.32 to 0.5.2 in /browser-search

[dependabot]

Bumps cloakbrowser from 0.3.32 to 0.5.2.

Changelog

Sourced from cloakbrowser's changelog.

[0.5.2] — 2026-07-25

• [wrapper] Preview release channel. Opt in with release_channel="preview" (releaseChannel in JavaScript, ReleaseChannel in .NET) or CLOAKBROWSER_RELEASE_CHANNEL=preview for every launch and CLI command. Preview means the newest build available for the current platform: a newer Preview is selected when present, otherwise it resolves to Stable, including when Stable has moved ahead. It is a standing setting, not a version pin, so a platform with no Preview build simply tracks Stable until one exists. CLI diagnostics report the requested and resolved channel plus the exact version that will launch. Python, JavaScript, and .NET.
• [wrapper] cloakbrowser info now prints the wrapper version alongside the binary diagnostics, so a bug report carries both without a second command. Python, JavaScript, and .NET.
• [docker] cloakserve gained POST /fingerprint/{seed}/close, which tears down that seed's browser immediately and frees its slot instead of waiting out the idle timeout. The profile is preserved and the call is idempotent.
• [binary] Chromium 150.0.7871.114.4 (Pro, Linux x64 + arm64) — 73 source-level patches (up from 71). A coherence release. Windows and macOS stay on Stable 150.0.7871.114.3; the fixes below that apply to those platforms ship with their next build.
  • Consistent identity under CDP user-agent overrides — subframes no longer disagree with the top frame about the browser identity when a custom user agent is set over CDP. Mainly affects Puppeteer, which sets one on every page session.
  • Closer Windows persona text rendering — font availability and text measurements track a real Windows install more closely.
  • Complete locale coverage — every supported locale now resolves to a coherent profile, with Greek (el-GR, el-CY) added.
  • Headed window geometry coherence on the Windows persona; headless is unchanged.
  • More stable results across seeds when the spoofed platform matches the host, i.e. the native Linux persona.
  • One consistent reported build number — --version and chrome://version now read the public version from a single source. Web-reachable surfaces, including the user agent, are unchanged.
  • No unsupported-flag warning bar when the sandbox is disabled, as required when running as root (e.g. in Docker).

[0.5.1] — 2026-07-23

• [wrapper] Fix GeoIP exit-IP resolution through authenticated HTTP proxies in the JavaScript wrapper. The CONNECT request sent the proxy's address in the Host header instead of the tunnel target, which strict proxies (e.g. Oxylabs backconnect) reject; the wrapper then silently fell back to the proxy gateway's location, producing a wrong timezone/locale for the session's real exit IP. The Host header now names the tunnel target per RFC 9110. JavaScript only; Python and .NET were unaffected.

[0.5.0] — 2026-07-22

• [wrapper] Free tier via GitHub sign-in. New cloakbrowser login command: sign in with GitHub to get a free license key (or save a paid key), cloakbrowser logout to revert. The launch banner and cloakbrowser info are now tier-aware (keyless / free / pro). Free keys always track the latest free build. Python, JavaScript, and .NET.
• [wrapper] Fix geoip=True overriding a timezone or locale that was passed explicitly as a raw flag via args= (--fingerprint-timezone, --lang, --fingerprint-locale). A raw flag now counts as explicit and is preserved, matching the behavior of the timezone=/locale= parameters; GeoIP only fills the values you did not set. Python, JavaScript, and .NET.

[0.4.13] — 2026-07-22

• [wrapper] Fix the GeoIP database never refreshing and re-downloading on every launch (#458). The atomic replace used a rename that cannot overwrite an existing file on Windows, so a stale database was never updated and each launch re-fetched the ~70 MB database in a loop; with no lock, concurrent launches each started their own download. The refresh now replaces the file atomically and guards against duplicate concurrent downloads. Python, JavaScript, and .NET.
• [wrapper] Quote cloakbrowser[geoip] in the install hints printed when the optional GeoIP dependency is missing (#459), so copy-pasting the hint into a shell that globs brackets (e.g. zsh) no longer errors.

[0.4.12] — 2026-07-18

• [binary] Chromium 150.0.7871.114.3 (Pro, all platforms) — 71 source-level patches. A full rebase onto the Chromium 150 line with the complete patch set ported forward, plus a round of coherence work. Pro license required; v146 stays free.
  • Closer alignment with a real Chrome install across speech and language profiles, font handling, and graphics parameters.
  • More self-consistent identities — values that a real browser reports consistently now stay consistent across repeat reads and across launch modes.
  • macOS coherence — display characteristics hold together across headed and headless launches.
  • The reported Chrome version tracks real Chrome, independent of the version we build from.
  • New --fingerprint-sapi-voices=false for the Windows voice tables (see the flags table in the README).
  • Clearer license failures — the license gate now exits with a distinct code per denial reason, which the wrapper surfaces as a specific CloakBrowserLicenseError.
• [wrapper] Fix the first-launch banner reporting the wrong Pro major version — a Pro install downloading the Chromium 150 binary printed "Pro active (v148)", and the free-tier upgrade hint named the same stale version. Cosmetic only; binary download, verification, and launch were unaffected. Python, JS, and .NET.

[0.4.11] — 2026-07-16

• [wrapper] When the Pro binary refuses a launch for a license reason, launch() now raises a clear CloakBrowserLicenseError (invalid, expired, or missing key; session limit reached; license server unreachable; or a local config problem) instead of an opaque "target/browser closed" error. Non-license launch failures are re-raised unchanged. New exported CloakBrowserLicenseError type. Python, JavaScript, Puppeteer, and .NET.
• [wrapper] Authenticated HTTP/HTTPS proxies now use the browser's native proxy authentication on every platform whose binary supports it — resolved per platform and binary version — and fall back to the standard proxy path on older binaries that don't. Fixes credentialed HTTP/HTTPS proxies on macOS and ARM, which previously could not use the native path. Python, JavaScript, Puppeteer, and .NET.
• [wrapper] cloakbrowser info now shows the number of Pro sessions currently in use ("Sessions: N seats in use") for a valid Pro license, so you can see how many concurrent sessions are running without contacting support. The count is never cached, skipped under --quick, and reports "unavailable" rather than a guessed number when it cannot be determined. Python, JS, and .NET.

[0.4.10] — 2026-07-09

• [wrapper] Fix JS CLI silently exiting with no output when run via npx/node_modules/.bin (#427). The entry-point guard compared import.meta.url to an unresolved process.argv[1]; symlinked bin installs (npm/pnpm/npx) never matched, so no subcommand ran. Now realpath-resolves the invoked path before comparing.
• [wrapper] Fix humanize=True breaking interactions with elements inside iframes (#428). frame.locator("#btn").click() / fill() / hover() / etc. (and the frame-level frame.click(...) equivalents) now resolve the selector in the owning sub-frame's own document instead of misrouting to the top page, which previously raised ElementNotAttachedError. Humanized mouse motion is preserved inside iframes. Python only (the JS and .NET wrappers were already frame-correct).

... (truncated)

Commits

• a5f2c33 release: v0.5.2 — preview release channel + Chromium 150.0.7871.114.4 (Linux)
• 240bf61 feat(cli): print the wrapper version in info across all wrappers
• 69a168a test: isolate Python/JS suites from the real ~/.cloakbrowser
• f709dba feat: add preview release channel across all wrappers
• 36390b5 release: v0.5.1 — geoip CONNECT Host header fix (js)
• d640970 fix(geoip): send tunnel target in CONNECT Host header (js)
• 46a2b03 chore(deps): bump the javascript group across 1 directory with 5 updates (#440)
• efe6f50 release: v0.5.0 — free tier via GitHub sign-in + geoip raw-flag fix
• 1b1e349 feat(free-tier): GitHub-login free tier across all three wrappers
• 0c2d191 fix(geoip): preserve explicit tz/locale raw flags in args over geoip
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #28.