chore(deps): bump cloakbrowser from 0.3.32 to 0.5.8 in /browser-search

[dependabot]

Bumps cloakbrowser from 0.3.32 to 0.5.8.

Changelog

Sourced from cloakbrowser's changelog.

[0.5.8] — 2026-08-18

• [wrapper] Fix humanize=True actions (fill, click, type) failing with an element-not-attached error after a navigation driven by a click or form submission instead of goto. The pre-action element checks could stay bound to the previous document and never recover; they now refresh on every navigation. Regression from 0.5.6. Python, JavaScript Playwright/Puppeteer, and .NET.
• [wrapper] Fix humanize=True page.selectOption() hanging until timeout instead of selecting. The saved original delegated back to the patched main-frame method and recursed indefinitely. JavaScript Playwright only; Python and .NET were unaffected.
• [wrapper] Stop a humanized action from spending its full scroll budget (~7s) on an element that is already fully visible but off-center while the page is pinned at the top or bottom and cannot scroll any further toward the target zone. The scroll now bails immediately in that case instead of looping to no effect. Python, JavaScript, and .NET.
• [binary] Chromium 150.0.7871.114.6 (Pro Stable, Linux x64 + arm64 and Windows x64) — 71 source-level patches. Linux advances from 150.0.7871.114.4; Windows advances from 150.0.7871.114.3. macOS remains on Stable 150.0.7871.114.3.
  • Identity and hardware: expanded the Windows hardware-profile pool and tightened alignment between graphics, CPU, memory, and display characteristics. Fixed seeds may resolve to a different complete hardware identity than on the previous Stable build.
  • Windows fidelity: completed text measurements and font availability across a broader real-world font set, refined platform-specific path handling, improved headed window geometry, and expanded locale coverage including Greek.
  • Browser consistency: aligned identity across top-level and nested frames under automation overrides, normalized storage reporting across contexts, improved deterministic rendering behavior, stabilized native Linux profiles across seeds, and unified the reported browser build number.
  • Network identity: improved consistency for IPv4, IPv6, dual-stack, direct, proxied, and automatically located sessions, including automatic proxy fallback for licensing connectivity.
  • Runtime and compatibility: improved extension and worker reliability under cross-platform profiles, strengthened interrupted-session cleanup and local license diagnostics, and improved host-font isolation for cross-platform personas.

---

[0.5.7] — 2026-08-11

• [wrapper] Preserve the caller-specified delay for humanized key press actions instead of replacing it with an immediate key-up or an internally generated hold time. Covers page, frame, locator, element-handle, and keyboard press paths across Python, JavaScript Playwright/Puppeteer, and .NET.
• [wrapper] Apply humanize=True recursively to frames nested more than one level deep instead of patching only the main frame and its direct children. Python and JavaScript Playwright.

---

[0.5.6] — 2026-08-08

• [wrapper] Fix humanize=True triggering invisible CAPTCHA challenges during clicks. Humanized pre-click checks are now stealth-safe without sacrificing actionability, smooth scrolling, accurate targeting, or common selector support. Python, JavaScript, and .NET.
• [wrapper] Humanize frames created after page load instead of leaving dynamically attached frames with raw Playwright/Puppeteer behavior. Python, JavaScript, Puppeteer, and .NET.
• [wrapper] Fix .NET NewCDPSessionAsync() throwing NullReferenceException when passed a wrapped page or frame. Adds Humanize.Unwrap() for APIs that require Playwright's concrete handles.

---

[0.5.5] — 2026-08-05

• [wrapper] cloakbrowser info --proxy <url> now resolves the exit IP, timezone, and locale a launch would apply through that proxy. Previously info only reported whether the GeoIP database file was present; it never resolved anything, so there was no way to confirm a proxy hands you a timezone and locale that match its exit IP before launching. Passing --proxy runs the same resolution geoip=True uses at launch (downloading the GeoIP database if it is not cached) and prints the exit IP, timezone, and locale, in text and --json output. Plain info is unchanged and still makes no network call; it now points at the new flag. Python, JavaScript, and .NET.
• [wrapper] humanize=True no longer raises TypeError on Python 3.14 with a license key set. Python 3.14 made functools.partial a method descriptor. The license guard stored each wrapped page method as a partial, relying on it not being a descriptor so that humanize could copy the methods onto a holder object and read them back unchanged. Under 3.14 the partial re-bound on access and injected a spurious first argument, so the first humanized page call raised TypeError (#488). The guard now wraps methods in a non-descriptor callable, inert wherever it is stored, on every Python version. Python only; JavaScript and .NET were unaffected.
• [wrapper] humanize=True no longer misses clicks on pages that are still loading. When a page kept reflowing after the element was scrolled into view, the wrapper waited for the position to settle but never scrolled again — by then the element could have been pushed off screen, so the click was dispatched at coordinates outside the viewport and landed on nothing. The action reported success and the click had simply not happened. The element is now re-scrolled into view after the settle wait, and the pointer-events check no longer downgrades an already-confirmed miss to "undetermined" when a later probe times out, so a click that cannot land raises instead of passing silently. Measured on a page reflowing for 10–25 seconds: previously a silent miss after ~32s, now a successful click. Pages that reflow longer than the call's timeout still raise, as before. Python, JavaScript, and .NET.

---

[0.5.4] — 2026-08-04

• [wrapper] A concurrent-session limit that is reached after the browser has already connected now surfaces as a clear CloakBrowserLicenseError on your first page action, instead of a generic "target closed" error (#477). It covers the persistent-context flow, where the first page is already open, as well as pages created from your own browser contexts. Python, JavaScript (Playwright + Puppeteer), and .NET.

---

[0.5.3] — 2026-07-30

• [wrapper] When the Windows font-metrics profile is requested, the launch feature set now matches a stock Chrome install rather than Playwright's test-harness defaults, which switch off a feature stock Chrome ships enabled. Merged into any --enable-features value you pass instead of adding a second flag. Python, JavaScript, and .NET.
• [wrapper] A second browser launched from the same Node process no longer inherits the first one's proxy identity. When one process called launch() more than once with different proxies, every launch after the first reused the earlier connection to the exit-IP lookup service, because Node pools those connections by destination and the destination is the same for every proxy. The tunnel opened through the new proxy was built and then discarded, so later browsers were given the first proxy's exit IP, timezone and locale while their traffic correctly went out through their own proxy. Each launch now resolves its own exit IP. Single-launch processes were never affected. JavaScript only; Python and .NET open a fresh client per lookup.
• [wrapper] Fix GeoIP and WebRTC exit-IP resolution dropping the credentials of an authenticated HTTP proxy given as a settings object — {"server": ..., "username": ..., "password": ...} — instead of a URL with inline credentials (#469). Only SOCKS proxies kept their credentials, so the HTTP lookup was rejected and fell back to resolving the proxy gateway's hostname. That returns a real address, so resolution appeared to succeed while reporting the gateway's timezone and locale rather than the session's actual exit IP, and --fingerprint-webrtc-ip=auto was dropped entirely. Both forms of the same proxy now resolve identically. Python, JavaScript, and .NET.
• [wrapper] cloakbrowser info no longer aborts partway through on a Windows console. cmd.exe defaults to a code page that cannot represent the report's check mark and arrow, so the command stopped with an encoding error at the first one and the remaining diagnostics were never printed. Those marks now degrade to plain text when the console cannot take them, per character. UTF-8 consoles, including Linux, macOS and Windows Terminal, are unchanged. Python.
• [wrapper] cloakbrowser info no longer reports a false launch failure on Windows. Chromium handles --version only on POSIX, so on Windows the switch was ignored and a browser started instead of printing — the probe then timed out and a healthy install was reported as broken, briefly putting a window on screen each run. The check now exits immediately on Windows, without a window, and still fails loudly on a genuinely broken binary; it reports no version there, since nothing is printed. Linux and macOS are unchanged. Python, JavaScript, and .NET.

... (truncated)

Commits

• 2e5d493 release: v0.5.8 — humanize post-nav, selectOption, and scroll fixes
• a91d105 fix(humanize): refresh pre-action element checks after click/form navigation ...
• cf194eb chore(deps-dev): bump the javascript group across 1 directory with 2 updates ...
• 5494ac1 fix(humanize): skip futile scroll for fully-visible boundary elements
• b27ccd9 fix(humanize): stop selectOption infinite recursion in JS wrapper
• 289c820 release: v0.5.7 — humanize input fixes
• ec88026 fix(humanize): humanize frames nested below the first level
• 2442c32 fix(humanize): preserve keyboard press timing
• caf21e9 release: v0.5.6 — humanize stealth fixes
• 9fa2472 refactor(humanize): route pre-click element reads through a shared DOM helper
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #31.