From b91274cc987cec05ee0a998f79322756ab8ba351 Mon Sep 17 00:00:00 2001 From: CloakHQ Date: Wed, 20 May 2026 08:26:04 +0200 Subject: [PATCH] =?UTF-8?q?release:=20v0.3.29=20=E2=80=94=20extension=20lo?= =?UTF-8?q?ading,=20composable=20JS=20helpers,=20cloakserve=20origin=20gua?= =?UTF-8?q?rd?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 13 +++++++++++++ README.md | 4 +++- cloakbrowser/_version.py | 2 +- js/package-lock.json | 7 +++---- js/package.json | 2 +- 5 files changed, 21 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d6088ad..42f6094 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,19 @@ Changes are tagged: **[wrapper]** for Python/JS wrapper, **[binary]** for Chromi ## [Unreleased] +## [0.3.29] — 2026-05-20 + +- **[wrapper]** **Security**: `cloakserve` — guard WebSocket origins to prevent browser-origin CSRF via CDP proxy (thanks [@0xlally](https://github.com/0xlally) for the report, [@honor2030](https://github.com/honor2030) for the fix, #239, #240) +- **[wrapper]** **Security**: Lambda example — add URL scheme validation, SSRF protection, post-navigation re-validation, remove unsafe caller-controlled options (#233) +- **[wrapper]** **Security**: CI — isolate `workflow_dispatch` input to avoid shell injection in attest-release (thanks [@aaronjmars](https://github.com/aaronjmars), #223) +- **[wrapper]** **Security**: JS — bump tar + transitive deps via npm audit fix (thanks [@aaronjmars](https://github.com/aaronjmars), #222) +- **[wrapper]** Add `extension_paths` parameter for loading Chrome extensions in all launch functions (thanks [@zackycodes](https://github.com/zackycodes), #210) +- **[wrapper]** Humanize: add Playwright-style actionability checks — auto-wait for visible, enabled, stable elements before humanized actions (#228) +- **[wrapper]** JS: export composable launch helpers — `buildLaunchOptions()` and `humanizeBrowser()` for custom Playwright integrations (thanks [@honor2030](https://github.com/honor2030), #244) +- **[wrapper]** JS: add `launchPersistentContext()` to Puppeteer wrapper (#261) +- **[wrapper]** Add `flake.nix` for Nix/NixOS (thanks [@Seryiza](https://github.com/Seryiza), #220) +- **[meta]** JS: sync package-lock metadata (thanks [@245678000000](https://github.com/245678000000), #219) + ## [0.3.28] — 2026-05-11 - **[wrapper]** **Security**: `cloakserve` — sanitize fingerprint seed to prevent path traversal, bind to `127.0.0.1` on bare metal, detect Podman containers (#217) diff --git a/README.md b/README.md index 49cda4b..9d66bf6 100644 --- a/README.md +++ b/README.md @@ -128,7 +128,7 @@ Open [http://localhost:8080](http://localhost:8080). Create a profile. Click **L --- -## Latest: v0.3.28 (Chromium 146.0.7680.177.4) +## Latest: v0.3.29 (Chromium 146.0.7680.177.4) - **`launch_context_async()`** — async counterpart to `launch_context()`. Forwards kwargs to `browser.new_context()` for `storage_state`, `permissions`, `extra_http_headers` without a persistent profile folder. - **JS `contextOptions` escape hatch** — forward arbitrary options (including `storageState`) to Playwright's `newContext()` from `launchContext()` / `launchPersistentContext()`. @@ -1209,3 +1209,5 @@ Issues and PRs welcome. If something isn't working, [open an issue](https://gith - [@aaronjmars](https://github.com/aaronjmars) — security fixes (shell injection, dep bumps) - [@Seryiza](https://github.com/Seryiza) — Nix/NixOS flake - [@245678000000](https://github.com/245678000000) — package-lock sync +- [@honor2030](https://github.com/honor2030) — cloakserve WebSocket origin guard, composable JS launch helpers +- [@0xlally](https://github.com/0xlally) — security reports (cloakserve path traversal, WebSocket origin bypass) diff --git a/cloakbrowser/_version.py b/cloakbrowser/_version.py index 818ad96..d91d094 100644 --- a/cloakbrowser/_version.py +++ b/cloakbrowser/_version.py @@ -1 +1 @@ -__version__ = "0.3.28" +__version__ = "0.3.29" diff --git a/js/package-lock.json b/js/package-lock.json index 0ac8a40..7e5c6d6 100644 --- a/js/package-lock.json +++ b/js/package-lock.json @@ -1,12 +1,12 @@ { "name": "cloakbrowser", - "version": "0.3.28", + "version": "0.3.29", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "cloakbrowser", - "version": "0.3.28", + "version": "0.3.29", "license": "MIT", "dependencies": { "tar": "^7.0.0" @@ -1329,8 +1329,7 @@ "resolved": "https://registry.npmjs.org/devtools-protocol/-/devtools-protocol-0.0.1232444.tgz", "integrity": "sha512-pM27vqEfxSxRkTMnF+XCmxSEb6duO5R+t8A9DEEJgy4Wz2RVanje2mmj99B6A3zv2r/qGfYlOvYznUhuokizmg==", "dev": true, - "license": "BSD-3-Clause", - "peer": true + "license": "BSD-3-Clause" }, "node_modules/diff-sequences": { "version": "29.6.3", diff --git a/js/package.json b/js/package.json index 430bb16..e794c0e 100644 --- a/js/package.json +++ b/js/package.json @@ -1,6 +1,6 @@ { "name": "cloakbrowser", - "version": "0.3.28", + "version": "0.3.29", "description": "Stealth Chromium that passes every bot detection test. Drop-in Playwright/Puppeteer replacement with source-level fingerprint patches.", "type": "module", "main": "dist/index.js",