[ruifigueira]

JIRA: BRAPI-1861

Summary

This PR upgrades @cloudflare/puppeteer from puppeteer v24.40.0 (Chrome 146) to puppeteer v25.10.0 (Chrome 152). Browser Run moves to Chrome 152, and puppeteer v25.10.0 is the upstream release for that Chrome version.

Changes

• chore(puppeteer): upgrade to puppeteer v25.10.0: This commit moves submodules/puppeteer to puppeteer-v25.10.0 and rebases patches/puppeteer.patch. It also updates the wrapper for the new environment file helpers, the ESM-only output path (lib/puppeteer) and the *.test.ts file names. It bumps devtools-protocol to 0.0.1666840.
• docs(puppeteer): document the Node.js compatibility requirement: The README tells you when Node.js compatibility and the Workers file system are necessary.
• fix(puppeteer): match output path globs inside dot directories: In a checkout under a dot directory, the build wrote modules to lib/submodules/.... As a result, the ./internal/* export pointed only at type declarations. This problem is also on main.
• test(puppeteer): use Browser.connected instead of isConnected(): v25 removed Browser.isConnected(). The keep_alive session test still called it.
• chore(puppeteer): drop the unused debug dependency: puppeteer-core v25 does not use the debug package. Nothing in the build imports it.
• fix(puppeteer): update skipTests for the upstream v25 test suite: The skip list matches on the full test title, and the title starts with the file name. After the upstream rename, none of the 129 entries matched. Every entry still resolves to a test in v25.10.0. This commit also skips four new v25 tests:
  • Two network restriction tests and one dialog test connect a second client with browser.wsEndpoint(). Browser Run connects through the binding and a session ID.
  • Page.record uses Page.startScreenRecording, which is not available before Chrome 153. Puppeteer's TestExpectations.json also expects this test to fail on Chrome.

Breaking changes for users

These upstream v25 changes are visible to @cloudflare/puppeteer users:

• Browser.isConnected() is removed. Use browser.connected.
• MouseOptions.clickCount is removed. Use count.
• The sameParty cookie attribute is removed.
• Headers that were separated by newlines are now separated by commas.
• page.record() is new and experimental. It does not work on Browser Run before Chrome 153.

The ESM-only change does not affect users, because the package was already ESM-only. The new Node.js minimum (22) applies only when you build this package.

I recommend 2.0.0 for the next release. The isConnected() removal breaks code at run time, and users on ^1.x get it from npm update. This PR does not change the package version.

Tests

• npm run check:patch:puppeteer, npm run check:submodules and npm run build:puppeteer pass.
• npm run test:bundle and npm --prefix tests run test-types pass in packages/puppeteer-cloudflare.
• Smoke tests against wrangler dev: 9 passed, 1 failed. The failed test is should collect code coverage. It fails in the same way on main, because the remote browser gets an error page from the test domain.
• The keep_alive session test passes. Tests from the skip list are reported as skipped.

Known gaps

• blocklist and allowlist are new connect() options. The Workers connect path passes them to the browser, but no test covers this path. The upstream tests for these options need launch options or browser.wsEndpoint(), so they are skipped.
• packages/playwright-cloudflare/vite.config.ts has the same dot directory problem. This PR does not change it.

beep-boop-🤖

[clanky-the-clanker]

💬 Approved with comments — The skip-list update is correct. One WARNING remains (no tests for the new blocklist/allowlist path, a known gap the description already lists), plus INFO notes about a stale nested lockfile and files this pass did not re-check.

Findings: 1 warning · 2 info

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

🔧 Fix with your agent

Paste the following into your coding agent to investigate and fix these issues.

Fix the following code review issues found in pull request #248.

Before making changes, review each issue and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g., the fix would require disproportionate changes
  for minimal ROI, or the finding is factually incorrect), explain why
- If you need to clarify something before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

## WARNING (1)

### [Code Quality] Nothing tests the new `blocklist`/`allowlist` connect options that are passed to `CdpBrowser._create`, so the navigation-restriction path in the Workers bundle is unverified. The description lists this as a known gap.
- **File:** packages/puppeteer-cloudflare/src/cloudflare/utils.ts:60

## INFO (2)

### [Code Quality] `packages/puppeteer-cloudflare/package-lock.json` is stale: it still lists `debug` and `devtools-protocol` 0.0.1581282. The root workspace lockfile is the authoritative one, so regenerate this file or remove it.

### [Code Quality] Not re-checked in this pass: package-lock.json, package.json, WorkersWebSocketTransport.ts, src/index.ts, tsconfig.types.json, utils/copy_types.js, utils/generate_worker_tests.js, vite.config.ts, patches/puppeteer.patch, submodules/puppeteer. None of these changed since the last review, which covered them.

---

📋 Code Quality: ⚠️ 1 warning · 2 info

No new issues in skipTests.ts. Two earlier findings are still open, and the files that have not changed were not re-checked in this pass.

Recommendation: 📝 Minor Comments

• [WARNING] Nothing tests the new blocklist/allowlist connect options that are passed to CdpBrowser._create, so the navigation-restriction path in the Workers bundle is unverified. The description lists this as a known gap. (packages/puppeteer-cloudflare/src/cloudflare/utils.ts:60)
• [INFO] packages/puppeteer-cloudflare/package-lock.json is stale: it still lists debug and devtools-protocol 0.0.1581282. The root workspace lockfile is the authoritative one, so regenerate this file or remove it.
• [INFO] Not re-checked in this pass: package-lock.json, package.json, WorkersWebSocketTransport.ts, src/index.ts, tsconfig.types.json, utils/copy_types.js, utils/generate_worker_tests.js, vite.config.ts, patches/puppeteer.patch, submodules/puppeteer. None of these changed since the last review, which covered them.

View full review

Untested blocklist and allowlist options (WARNING)

• src/cloudflare/utils.ts:60 passes blocklist and allowlist to CdpBrowser._create.
• No test runs this navigation-restriction path in the Workers bundle.
• The only upstream tests for these options are skipped because they need browser.wsEndpoint() (skipTests.ts:170-171).
• Suggested test: connect with an allowlist and check that a page.goto to a non-matching URL is rejected.

Stale nested lockfile (INFO)

• packages/puppeteer-cloudflare/package-lock.json still lists debug and devtools-protocol 0.0.1581282.
• A workspace install uses the root lockfile, so this file is misleading rather than harmful. Regenerate it or delete it.

skipTests.ts: no issues

• The .spec.ts to .test.ts renames are applied to every entry, and no .spec.ts entries are left.
• Each of the four new skips has a comment that explains it.

Not re-checked in this pass (INFO)

• This pass did not re-check the correctness of the files that have not changed since the last review. The last review covered them.

---

✅ All other checks passed

🚀 Release: ✅ LGTM

Risk: Low.

The pull request does not change the package version. The description recommends 2.0.0 for the next release because v25 removes Browser.isConnected(), and that recommendation is sound.

---

🔒 Security: ✅ LGTM

No security issues found in this change.

---

📖 AGENTS.md: ✅ LGTM

No issues in the scope of this change.

---

⚡ Performance: ✅ LGTM

No performance issues found.

---

📝 Documentation: ✅ LGTM

The README sections on Node.js compatibility and the Workers file system are clear.

---

_{Reviewed commit: 5350cbbb}

[github-actions]

@cloudflare/puppeteer preview for commit 5350cbb

npm i https://pkg.pr.new/cloudflare/browser-run/@cloudflare/puppeteer@5350cbbb51f38a47a1137b8184c0a27c01a27526

Published by this workflow run. New pushes and reruns update this comment.