Skip to content

stagehand

v@browserbasehq/[email protected] Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 13d AI Agents & Assistants
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agents ai llms playwright puppeteer selenium

Affected surfaces

auth rbac

ReleasePort's take

Moderate signal
editorial:auto 12d

Stagehand 3.7.0 adds domain‑policy controls and a new Gemini model while fixing several bugs; it also introduces a breaking change to the screenshot provider API.

Why it matters: The `setScreenshotProvider` callback now requires `{ base64, mediaType }`; update integrations before upgrading to avoid runtime errors (severity 70).

Summary

AI summary

Updates Patch Changes, https://github.com/seanmcguire12, and Minor Changes across a mixed release.

Changes in this release

Breaking High

Changes `setScreenshotProvider` callback to return `{ base64, mediaType }` instead of bare base64 string.

Changes `setScreenshotProvider` callback to return `{ base64, mediaType }` instead of bare base64 string.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Medium

Adds `context.setDomainPolicy({ allowedDomains: [...] })` to define accessible domains.

Adds `context.setDomainPolicy({ allowedDomains: [...] })` to define accessible domains.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Medium

Adds `context.setDomainPolicy({ blockedDomains: [...] })` to block specific domains.

Adds `context.setDomainPolicy({ blockedDomains: [...] })` to block specific domains.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Medium

Allows modelName "auto" in constructor and per‑primitive overrides via Stagehand API.

Allows modelName "auto" in constructor and per‑primitive overrides via Stagehand API.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Medium

Automatically closes popups that violate user‑defined domain policy.

Automatically closes popups that violate user‑defined domain policy.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Medium

Adds support for the new `google/gemini-3.5-flash` computer‑use tools model.

Adds support for the new `google/gemini-3.5-flash` computer‑use tools model.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Bugfix Medium

Removes noisy AI SDK warning on every hybrid/DOM `agent.execute()` call.

Removes noisy AI SDK warning on every hybrid/DOM `agent.execute()` call.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Bugfix Medium

Fixes CUA `keypress` actions to press key combinations as a single chord.

Fixes CUA `keypress` actions to press key combinations as a single chord.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Bugfix Medium

Repairs malformed UTF‑16 snapshot text before sending model prompts.

Repairs malformed UTF‑16 snapshot text before sending model prompts.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Bugfix Medium

Fixes TypeError when creating an agent with circular MCP integration objects.

Fixes TypeError when creating an agent with circular MCP integration objects.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Full changelog

Minor Changes

  • #2283 871ca7e Thanks @seanmcguire12! - add context.setDomainPolicy({ allowedDomains: ["allowed.domain"] }) which allows users to define a set of domains that are accessible to stagehand

  • #2274 f31980f Thanks @seanmcguire12! - add context.setDomainPolicy({blockedDomains: ["some.domain"]}) which allows users to define a list of domains that will be blocked by stagehand

Patch Changes

  • #2305 cd1daad Thanks @shrey150! - Remove the noisy AI SDK "system message in messages" warning logged on every hybrid/DOM agent.execute() call.

  • #2328 d287ff4 Thanks @miguelg719! - Allow modelName "auto" in the constructor and per-primitive model overrides when running through the Stagehand API

  • #2294 3938590 Thanks @seanmcguire12! - automatically close popups that violate user defined domain policy

  • #2298 892701a Thanks @seanmcguire12! - Fix CUA keypress actions to press key combinations as a single chord.

  • #2345 21826c7 Thanks @monadoid! - Repair malformed UTF-16 snapshot text before it reaches model prompts.

  • #2306 8dcef1b Thanks @seanmcguire12! - Use the screenshot provider's declared media type when sending CUA image payloads. The setScreenshotProvider callback now returns ScreenshotProviderResult ({ base64, mediaType }) instead of a bare base64 string.

  • #2273 93a23d3 Thanks @miguelg719! - Add support for the new google/gemini-3.5-flash computer-use tools model

  • #2278 022d68f Thanks @shrey150! - Fix TypeError: Converting circular structure to JSON when creating an agent with MCP integrations that include a Client instance (e.g. a local/stdio server from connectToMCPServer). The agent-creation log serialized the raw integrations array, and a live MCP Client is circular. It now logs a safe descriptor (URL strings kept, client instances summarized) so agent({ integrations: [client] }) works.

  • #2288 bb5ffa6 Thanks @seanmcguire12! - clean up cdp session event handlers on target detach

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track stagehand

Get notified when new releases ship.

Sign up free

About stagehand

The SDK For Browser Agents

All releases →

Related context

Earlier breaking changes

Beta — feedback welcome: [email protected]