[dependabot]

Bumps invisible-playwright from 0.34.0 to 0.35.8.

Release notes

Sourced from invisible-playwright's releases.

v0.35.8

The pin moves to invisible-core 47.39.0, which seals the firefox-47 engine.

Fixed

• A page can no longer tell that the engine carries the automation protocol (#336). Every engine until firefox-47 registered the protocol as a chrome package named juggler, and a page tells a registered package from an absent one with one line, new Worker("chrome://juggler/..."): it returns on our engine and throws SecurityError on Firefox. Captcha vendors started probing it in October 2026, which is why a challenge solved by hand was still refused. firefox-47 loads the protocol from resource://gre/modules/juggler/, a namespace every Firefox has and inside which a page cannot tell which files exist; the engine now registers exactly the chrome packages and resource substitutions Firefox 151 does, and its release is refused if it registers any name that Firefox does not.
• A goto the page stops on its way no longer answers OK on the old page, nor waits out its timeout. document.open() and window.stop() in the page being left stop the navigation on its way, and the engine dropped every such stop of the main frame (a workaround meant for the spurious one a Fission process swap fires): goto answered OK while the page was still the previous one, or waited for its timeout. It now raises NS_BINDING_ABORTED at once, as Playwright does on Firefox. Every way a page or the caller can stop or replace a goto (document.open, window.stop, location.replace and assign, a form submit, an iframe navigating the top, history.back, pushState, a meta refresh, a second goto) is tested against upstream Playwright's answers, in one process and across a process swap.
• goto refuses a success the engine made up: when the commit attributed to its navigation is not where that navigation's request went (redirects included), it raises "Navigation to ... was reported committed on ..., which is not where it went" instead of answering OK.
• A goto that the caller's next goto stops says "is interrupted by another navigation to" the new address, as upstream; it said NS_BINDING_ABORTED.
• goto(until="load") counts only its own document's load: the states were cleared when a navigation started, not when it committed.
• A goto that waited out its timeout no longer says "the current navigation is nav-N, not our nav-N": it says that our navigation started and neither committed nor was aborted.
• The wheel is born before the page sees it, as keys and mouse moves are since 0.35.7: event.timeStamp was the instant the wheel reached the page, 0 to 2 ms below performance.now() in the handler where a real wheel is 6 to 14, and half of the wheel events failed the filter a tracker applies.

v0.35.7

The pin moves to invisible-core 45.39.0, which seals the firefox-45 engine.

Fixed

• A key or a mouse move is born before the page sees it, as on a real machine, where the system takes a few milliseconds between the hardware and the page's handler. The engine stamped every input event at the instant it

... (truncated)

Changelog

Sourced from invisible-playwright's changelog.

[0.35.8] - 2026-10-14

The pin moves to invisible-core 47.39.0, which seals the firefox-47 engine.

Fixed

• A page can no longer tell that the engine carries the automation protocol (#336). Every engine until firefox-47 registered the protocol as a chrome package named juggler, and a page tells a registered package from an absent one with one line, new Worker("chrome://juggler/..."): it returns on our engine and throws SecurityError on Firefox. Captcha vendors started probing it in October 2026, which is why a challenge solved by hand was still refused. firefox-47 loads the protocol from resource://gre/modules/juggler/, a namespace every Firefox has and inside which a page cannot tell which files exist; the engine now registers exactly the chrome packages and resource substitutions Firefox 151 does, and its release is refused if it registers any name that Firefox does not.
• A goto the page stops on its way no longer answers OK on the old page, nor waits out its timeout. document.open() and window.stop() in the page being left stop the navigation on its way, and the engine dropped every such stop of the main frame (a workaround meant for the spurious one a Fission process swap fires): goto answered OK while the page was still the previous one, or waited for its timeout. It now raises NS_BINDING_ABORTED at once, as Playwright does on Firefox. Every way a page or the caller can stop or replace a goto (document.open, window.stop, location.replace and assign, a form submit, an iframe navigating the top, history.back, pushState, a meta refresh, a second goto) is tested against upstream Playwright's answers, in one process and across a process swap.
• goto refuses a success the engine made up: when the commit attributed to its navigation is not where that navigation's request went (redirects included), it raises "Navigation to ... was reported committed on ..., which is not where it went" instead of answering OK.
• A goto that the caller's next goto stops says "is interrupted by another navigation to" the new address, as upstream; it said NS_BINDING_ABORTED.
• goto(until="load") counts only its own document's load: the states were cleared when a navigation started, not when it committed.
• A goto that waited out its timeout no longer says "the current navigation is nav-N, not our nav-N": it says that our navigation started and neither committed nor was aborted.
• The wheel is born before the page sees it, as keys and mouse moves are since 0.35.7: event.timeStamp was the instant the wheel reached the page, 0 to 2 ms below performance.now() in the handler where a real wheel is 6 to 14, and half of the wheel events failed the filter a tracker applies.

[0.35.7] - 2026-10-13

The pin moves to invisible-core 45.39.0, which seals the firefox-45 engine.

Fixed

• A key or a mouse move is born before the page sees it, as on a real machine, where the system takes a few milliseconds between the hardware and

... (truncated)

Commits

• bf9af85 0.35.8: the pin moves to invisible-core 46.39.0 (firefox-46) (#347)
• a61169c record 0.35.7 as published (#346)
• 1839425 0.35.7: the pin moves to invisible-core 45.39.0 (firefox-45) (#345)
• 2aa4292 record 0.35.6 as published (#344)
• 102913d 0.35.6: the pin moves to invisible-core 44.39.0 (firefox-44) (#343)
• 49e4d73 record 0.35.5 as published (#342)
• 857de63 0.35.5: firefox-43 (invisible-core 43.39.0) (#341)
• 70285c5 record 0.35.4 as published (#340)
• be0620f 0.35.4: firefox-42 (invisible-core 42.39.0) (#339)
• 91ea73b record 0.35.3 as published (#338)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[pat-agent]

Available PR Commands

• /migrate - Applies this PR's database migrations to the staging DB (can only be run by someone on @Patina-Network/codebloom)
• /copy - Triggers copy from production to staging db (can only be run by tahminator or angelayu0530)

[pat-agent]

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-standup-bot-arm/tags under the following tags:

• codebloom-standup-bot-arm:staging-latest
• codebloom-standup-bot-arm:staging-2026.10.17-19.02.40
• codebloom-standup-bot-arm:staging-e68586e

[pat-agent]

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-leetcode-auth-stealer-service-arm/tags under the following tags:

• codebloom-leetcode-auth-stealer-service-arm:staging-latest
• codebloom-leetcode-auth-stealer-service-arm:staging-2026.10.17-19.03.45
• codebloom-leetcode-auth-stealer-service-arm:staging-e68586e

[pat-agent]

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-standup-bot/tags under the following tags:

• codebloom-standup-bot:staging-latest
• codebloom-standup-bot:staging-2026.10.17-19.02.54
• codebloom-standup-bot:staging-e68586e

[pat-agent]

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-leetcode-auth-stealer-service/tags under the following tags:

• codebloom-leetcode-auth-stealer-service:staging-latest
• codebloom-leetcode-auth-stealer-service:staging-2026.10.17-19.08.13
• codebloom-leetcode-auth-stealer-service:staging-e68586e

[sonarqubecloud]

Quality Gate passed for 'codebloom_frontend'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[pat-agent]

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-arm/tags under the following tags:

• codebloom-arm:staging-latest
• codebloom-arm:staging-2026.10.17-19.15.12
• codebloom-arm:staging-e68586e

[pat-agent]

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom/tags under the following tags:

• codebloom:staging-latest
• codebloom:staging-2026.10.17-19.18.45
• codebloom:staging-e68586e

[dependabot]

Superseded by #1044.