chore(deps): bump cloakbrowser from 0.3.32 to 0.5.7 in /browser-search

[dependabot]

Bumps cloakbrowser from 0.3.32 to 0.5.7.

Changelog

Sourced from cloakbrowser's changelog.

[0.5.7] — 2026-08-11

• [wrapper] Preserve the caller-specified delay for humanized key press actions instead of replacing it with an immediate key-up or an internally generated hold time. Covers page, frame, locator, element-handle, and keyboard press paths across Python, JavaScript Playwright/Puppeteer, and .NET.
• [wrapper] Apply humanize=True recursively to frames nested more than one level deep instead of patching only the main frame and its direct children. Python and JavaScript Playwright.

---

[0.5.6] — 2026-08-08

• [wrapper] Fix humanize=True triggering invisible CAPTCHA challenges during clicks. Humanized pre-click checks are now stealth-safe without sacrificing actionability, smooth scrolling, accurate targeting, or common selector support. Python, JavaScript, and .NET.
• [wrapper] Humanize frames created after page load instead of leaving dynamically attached frames with raw Playwright/Puppeteer behavior. Python, JavaScript, Puppeteer, and .NET.
• [wrapper] Fix .NET NewCDPSessionAsync() throwing NullReferenceException when passed a wrapped page or frame. Adds Humanize.Unwrap() for APIs that require Playwright's concrete handles.

---

[0.5.5] — 2026-08-05

• [wrapper] cloakbrowser info --proxy <url> now resolves the exit IP, timezone, and locale a launch would apply through that proxy. Previously info only reported whether the GeoIP database file was present; it never resolved anything, so there was no way to confirm a proxy hands you a timezone and locale that match its exit IP before launching. Passing --proxy runs the same resolution geoip=True uses at launch (downloading the GeoIP database if it is not cached) and prints the exit IP, timezone, and locale, in text and --json output. Plain info is unchanged and still makes no network call; it now points at the new flag. Python, JavaScript, and .NET.
• [wrapper] humanize=True no longer raises TypeError on Python 3.14 with a license key set. Python 3.14 made functools.partial a method descriptor. The license guard stored each wrapped page method as a partial, relying on it not being a descriptor so that humanize could copy the methods onto a holder object and read them back unchanged. Under 3.14 the partial re-bound on access and injected a spurious first argument, so the first humanized page call raised TypeError (#488). The guard now wraps methods in a non-descriptor callable, inert wherever it is stored, on every Python version. Python only; JavaScript and .NET were unaffected.
• [wrapper] humanize=True no longer misses clicks on pages that are still loading. When a page kept reflowing after the element was scrolled into view, the wrapper waited for the position to settle but never scrolled again — by then the element could have been pushed off screen, so the click was dispatched at coordinates outside the viewport and landed on nothing. The action reported success and the click had simply not happened. The element is now re-scrolled into view after the settle wait, and the pointer-events check no longer downgrades an already-confirmed miss to "undetermined" when a later probe times out, so a click that cannot land raises instead of passing silently. Measured on a page reflowing for 10–25 seconds: previously a silent miss after ~32s, now a successful click. Pages that reflow longer than the call's timeout still raise, as before. Python, JavaScript, and .NET.

---

[0.5.4] — 2026-08-04

• [wrapper] A concurrent-session limit that is reached after the browser has already connected now surfaces as a clear CloakBrowserLicenseError on your first page action, instead of a generic "target closed" error (#477). It covers the persistent-context flow, where the first page is already open, as well as pages created from your own browser contexts. Python, JavaScript (Playwright + Puppeteer), and .NET.

---

[0.5.3] — 2026-07-30

• [wrapper] When the Windows font-metrics profile is requested, the launch feature set now matches a stock Chrome install rather than Playwright's test-harness defaults, which switch off a feature stock Chrome ships enabled. Merged into any --enable-features value you pass instead of adding a second flag. Python, JavaScript, and .NET.
• [wrapper] A second browser launched from the same Node process no longer inherits the first one's proxy identity. When one process called launch() more than once with different proxies, every launch after the first reused the earlier connection to the exit-IP lookup service, because Node pools those connections by destination and the destination is the same for every proxy. The tunnel opened through the new proxy was built and then discarded, so later browsers were given the first proxy's exit IP, timezone and locale while their traffic correctly went out through their own proxy. Each launch now resolves its own exit IP. Single-launch processes were never affected. JavaScript only; Python and .NET open a fresh client per lookup.
• [wrapper] Fix GeoIP and WebRTC exit-IP resolution dropping the credentials of an authenticated HTTP proxy given as a settings object — {"server": ..., "username": ..., "password": ...} — instead of a URL with inline credentials (#469). Only SOCKS proxies kept their credentials, so the HTTP lookup was rejected and fell back to resolving the proxy gateway's hostname. That returns a real address, so resolution appeared to succeed while reporting the gateway's timezone and locale rather than the session's actual exit IP, and --fingerprint-webrtc-ip=auto was dropped entirely. Both forms of the same proxy now resolve identically. Python, JavaScript, and .NET.
• [wrapper] cloakbrowser info no longer aborts partway through on a Windows console. cmd.exe defaults to a code page that cannot represent the report's check mark and arrow, so the command stopped with an encoding error at the first one and the remaining diagnostics were never printed. Those marks now degrade to plain text when the console cannot take them, per character. UTF-8 consoles, including Linux, macOS and Windows Terminal, are unchanged. Python.
• [wrapper] cloakbrowser info no longer reports a false launch failure on Windows. Chromium handles --version only on POSIX, so on Windows the switch was ignored and a browser started instead of printing — the probe then timed out and a healthy install was reported as broken, briefly putting a window on screen each run. The check now exits immediately on Windows, without a window, and still fails loudly on a genuinely broken binary; it reports no version there, since nothing is printed. Linux and macOS are unchanged. Python, JavaScript, and .NET.

[0.5.2] — 2026-07-25

• [wrapper] Preview release channel. Opt in with release_channel="preview" (releaseChannel in JavaScript, ReleaseChannel in .NET) or CLOAKBROWSER_RELEASE_CHANNEL=preview for every launch and CLI command. Preview means the newest build available for the current platform: a newer Preview is selected when present, otherwise it resolves to Stable, including when Stable has moved ahead. It is a standing setting, not a version pin, so a platform with no Preview build simply tracks Stable until one exists. CLI diagnostics report the requested and resolved channel plus the exact version that will launch. Python, JavaScript, and .NET.
• [wrapper] cloakbrowser info now prints the wrapper version alongside the binary diagnostics, so a bug report carries both without a second command. Python, JavaScript, and .NET.
• [docker] cloakserve gained POST /fingerprint/{seed}/close, which tears down that seed's browser immediately and frees its slot instead of waiting out the idle timeout. The profile is preserved and the call is idempotent.
• [binary] Chromium 150.0.7871.114.4 (Pro, Linux x64 + arm64) — 73 source-level patches (up from 71). A coherence release. Windows and macOS stay on Stable 150.0.7871.114.3; the fixes below that apply to those platforms ship with their next build.
  • Consistent identity under CDP user-agent overrides — subframes no longer disagree with the top frame about the browser identity when a custom user agent is set over CDP. Mainly affects Puppeteer, which sets one on every page session.
  • Closer Windows persona text rendering — font availability and text measurements track a real Windows install more closely.
  • Complete locale coverage — every supported locale now resolves to a coherent profile, with Greek (el-GR, el-CY) added.
  • Headed window geometry coherence on the Windows persona; headless is unchanged.
  • More stable results across seeds when the spoofed platform matches the host, i.e. the native Linux persona.
  • One consistent reported build number — --version and chrome://version now read the public version from a single source. Web-reachable surfaces, including the user agent, are unchanged.
  • No unsupported-flag warning bar when the sandbox is disabled, as required when running as root (e.g. in Docker).

... (truncated)

Commits

• 289c820 release: v0.5.7 — humanize input fixes
• ec88026 fix(humanize): humanize frames nested below the first level
• 2442c32 fix(humanize): preserve keyboard press timing
• caf21e9 release: v0.5.6 — humanize stealth fixes
• 9fa2472 refactor(humanize): route pre-click element reads through a shared DOM helper
• 7f19b2f fix(humanize): preserve behavior in dynamic frames
• c1dd589 release: v0.5.5 — info --proxy geoip resolution + Python 3.14 humanize fix
• 9021e0c feat(cli): info --proxy resolves exit IP + timezone + locale
• 306261a chore(deps): bump the javascript group across 1 directory with 5 updates (#482)
• e4d4c68 fix(humanize): re-scroll after the settle wait so clicks land
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #30.