LvcidPsyche/auto-browser

v1.1.3 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 1d MCP Browser & Automation

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

ai-agent ai-agents browser-automation claude docker fastapi

+6 more

llm local-first mcp novnc playwright self-hosted

Summary

AI summary

Fixed background‑task reliability loss due to garbage collection.

Type	Severity	Summary	CVE
Deprecation	Low	Removed social media clients (YouTube, Instagram, Reddit, X) and Veo3/viral-research integration with associated unit tests and packaging excludes. Removed social media clients (YouTube, Instagram, Reddit, X) and Veo3/viral-research integration with associated unit tests and packaging excludes. Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Background-task reliability fixed by retaining task references until completion. Background-task reliability fixed by retaining task references until completion. Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Audit attribution now mints fresh anonymous identity when none is set, avoiding mutable default sharing. Audit attribution now mints fresh anonymous identity when none is set, avoiding mutable default sharing. Source: llm_adapter@2026-06-03 Confidence: high	—
Refactor	Low	Bumped controller, client, LangChain integration, and browser‑node metadata to version 1.1.3; refreshed release‑facing version strings across dashboard badge, webhook user‑agent, README, launch notes, and good‑first‑issue docs. Bumped controller, client, LangChain integration, and browser‑node metadata to version 1.1.3; refreshed release‑facing version strings across dashboard badge, webhook user‑agent, README, launch notes, and good‑first‑issue docs. Source: llm_adapter@2026-06-03 Confidence: high	—

Full changelog

Bug-fix and cleanup patch on top of 1.1.2.

Background-task reliability — fire-and-forget work (network-capture listeners, the on-detach pending flush, approval webhook dispatch, and post-session curator review) was scheduled without a retained task reference, so CPython could garbage-collect those tasks before they completed. They now route through a shared spawn_background_task helper that holds a strong reference until completion.
Audit attribution — operator identity no longer shares a single mutable OperatorIdentity instance as a ContextVar default across all request contexts; get_current_operator() mints a fresh anonymous identity when none is set.

Removed the previously extracted social (YouTube/Instagram/Reddit/X) clients and the Veo3/viral-research integration, plus their unit tests and the now-empty packaging exclude. They were already unwired from routes, tools, the orchestrator, and startup, and excluded from the wheel build. The guard tests that assert those routes/tools stay unshipped are retained.

Bumped controller, client, LangChain integration, and browser-node metadata to 1.1.3, and refreshed release-facing version strings in the dashboard badge, webhook user-agent, README, launch notes, and good-first-issue docs.

Removed social clients (YouTube, Instagram, Reddit, X) and Veo3/viral‑research integration along with their unit tests.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track LvcidPsyche/auto-browser

Get notified when new releases ship.

About LvcidPsyche/auto-browser

Give your AI agent a real browser — with a human in the loop. Open-source MCP-native browser agent.