selenium

vselenium-4.46.0 scope: selenium Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 16d API Development

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

.net java javascript python ruby rust

+2 more

selenium webdriver

Affected surfaces

auth rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 11d

Selenium 4.46.0 patches a path‑traversal flaw in Rust tar/pkg extraction and deprecates internal BiDi methods on the Java driver.

Why it matters: The high‑severity (severity 90) security fix prevents directory traversal attacks; the breaking change (severity 70) removes deprecated Java API methods, requiring code updates before upgrade.

Summary

AI summary

Updates https://github.com/SeleniumHQ/selenium/blob/trunk/dotnet/CHANGELOG, https://github.com/SeleniumHQ/selenium/blob/trunk/java/CHANGELOG, and https://github.com/SeleniumHQ/selenium/blob/trunk/py/CHANGES across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Prevent path traversal in tar and pkg extraction (Rust) Prevent path traversal in tar and pkg extraction (Rust) Source: llm_adapter@2026-07-15 Confidence: high	—
Breaking	High	Deprecate methods exposing internal BiDi connection on Java driver Deprecate methods exposing internal BiDi connection on Java driver Source: llm_adapter@2026-07-15 Confidence: low	—
Feature
Feature	Medium	Add ClientConfig for HTTP client customization in Ruby bindings Add ClientConfig for HTTP client customization in Ruby bindings Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Show browser version and available CDP versions in Java driver info Show browser version and available CDP versions in Java driver info Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Route Safari, STP and WebView2 to dedicated handlers in Python bindings Route Safari, STP and WebView2 to dedicated handlers in Python bindings Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Support multiple names for Firefox binary in Linux (Rust) Support multiple names for Firefox binary in Linux (Rust) Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Dependency	Low	Upgrade rules_rs to 0.0.92 in build system (Rust) Upgrade rules_rs to 0.0.92 in build system (Rust) Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix
Bugfix	Medium	Fix classpath packaging for Redis-backed SessionQueue in Grid Fix classpath packaging for Redis-backed SessionQueue in Grid Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fix comparator of Docker versions in Java implementation Fix comparator of Docker versions in Java implementation Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Trim whitespace around NO_PROXY entries in Ruby client configuration Trim whitespace around NO_PROXY entries in Ruby client configuration Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fix JSON parser EOF sentinel collision with U+FFFF (Java) Fix JSON parser EOF sentinel collision with U+FFFF (Java) Source: llm_adapter@2026-07-15 Confidence: low	—

Full changelog

Detailed Changelogs by Component

Java | Python | DotNet | Ruby | JavaScript

What's Changed

[build] Upgrade rules_rs to 0.0.90 and build Rust against @llvm on macOS by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17683
[dotnet] Thread safe product info determination by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17684
[release] Skip release if package is already published by @diemol in https://github.com/SeleniumHQ/selenium/pull/17686
[docs] add design decision record process and template by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17665
[rust] Support pbzx-compressed macOS .pkg payloads by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17691
[java] Mark all current BiDi related classes beta by @pujagani in https://github.com/SeleniumHQ/selenium/pull/17690
[build] Upgrade rules_rs to 0.0.92 by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17688
[ci] Ignore changes in docs/decisions directory for pull requests by @diemol in https://github.com/SeleniumHQ/selenium/pull/17693
[build] Upgrade @llvm to 0.8.9 by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17703
[rust] Use PKG again for Firefox macOS downloads by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17702
[rb] trim whitespace around NO_PROXY entries by @aguspe in https://github.com/SeleniumHQ/selenium/pull/17565
Treat prefix literally in UrlTemplate.match(url, prefix) by @vasiliy-mikhailov in https://github.com/SeleniumHQ/selenium/pull/17713
[java] show browser version and available CDP versions by @asolntsev in https://github.com/SeleniumHQ/selenium/pull/17708
Make Either.stream() and iterator() empty for a left value by @vasiliy-mikhailov in https://github.com/SeleniumHQ/selenium/pull/17714
[java] Handle system proxy setting for arguments passed to selenium manager by @bhecquet in https://github.com/SeleniumHQ/selenium/pull/17402
[js] Add binding-neutral BiDi schema with cddl2ts-gated fidelity by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17700
[build] add copyright headers to rbs, pyi, ts, mjs, and erb files by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17720
[rb] add ClientConfig for HTTP client customization by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17699
[rb] Add copyright header for client_config.rbs by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17722
[dotnet] [bidi] Split event stream backed subscription and enumeration by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17705
[dotnet] [test] Moves Urls knowledge to testing web server by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17724
[java] fix comparator of Docker versions by @asolntsev in https://github.com/SeleniumHQ/selenium/pull/17723
[dotnet] [test] Driver is protected through fixtures by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17726
[dotnet] [test] Clean driver fixture from expected page titles by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17727
[py] Route Safari, STP and WebView2 to their handlers by @v-dermichev in https://github.com/SeleniumHQ/selenium/pull/17728
[grid] Fix classpath packaging Redis-backed for SessionQueue by @VietND96 in https://github.com/SeleniumHQ/selenium/pull/17706
[rust][selenium-manager]: do not ignore browser path when version is specified by @Delta456 in https://github.com/SeleniumHQ/selenium/pull/17659
[json] Allow constructor args to be used when coercing from json by @shs96c in https://github.com/SeleniumHQ/selenium/pull/17733
[py] Fix example WebDriverWait import in docstring by @cgoldberg in https://github.com/SeleniumHQ/selenium/pull/17735
[dotnet] [test] Eliminate stub driver for testing events in Support package by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17736
[java] Fix JSON parser EOF sentinel collision with U+FFFF by @shs96c in https://github.com/SeleniumHQ/selenium/pull/17737
[java] Reject unescaped control characters in JSON strings by @shs96c in https://github.com/SeleniumHQ/selenium/pull/17740
[rust] Support multiple names for Firefox binary in Linux (#17695) by @bonigarcia in https://github.com/SeleniumHQ/selenium/pull/17732
build: update Node.js toolchain version to 24.18.0 by @diemol in https://github.com/SeleniumHQ/selenium/pull/17742
[java] Tighten JSON number lexer to match RFC 8259 by @shs96c in https://github.com/SeleniumHQ/selenium/pull/17739
[java] Enforce commas between JSON elements; accept trailing commas by @shs96c in https://github.com/SeleniumHQ/selenium/pull/17738
[java] Deprecate methods to avoid internal BiDi connection surfacing on driver by @pujagani in https://github.com/SeleniumHQ/selenium/pull/17751
[js] Update cddl to 0.21.0 to fix quoted reserved-word parsing in BiDi codegen by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17752
[rb] generate the BiDi protocol layer from the shared binding-neutral schema by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17731
[docs] ADR implementation updates - track by PR number, clarify PR body vs ADR, tracking status by issue by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17697
[build] Add update_cddl script to refresh pinned w3c/webref CDDL files by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17743
Add guidance for testing conventions in each language by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/16734
[build] document .local customization and add PR review guidance by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17756
Move BiDi creation to RemoteWebDriver. Allow enabling BiDi in Safari options. by @pujagani in https://github.com/SeleniumHQ/selenium/pull/17753
[java][bidi] Track events subscriptions using subscription ids by @pujagani in https://github.com/SeleniumHQ/selenium/pull/17759
[build] Resolve Chrome milestone from Chrome-for-Testing channel version by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17747
[rust] Prevent path traversal in tar and pkg extraction by @bonigarcia in https://github.com/SeleniumHQ/selenium/pull/17668
bumping ts rules by @diemol in https://github.com/SeleniumHQ/selenium/pull/17760

New Contributors

@vasiliy-mikhailov made their first contribution in https://github.com/SeleniumHQ/selenium/pull/17713
@v-dermichev made their first contribution in https://github.com/SeleniumHQ/selenium/pull/17728

Full Changelog: https://github.com/SeleniumHQ/selenium/compare/selenium-4.45.0...selenium-4.46.0

Breaking Changes

Deprecate methods to avoid internal BiDi connection surfacing on driver in Java
.NET Bidi event stream split into subscription-backed and enumeration modes

Security Fixes

Rust selenium-manager prevents path traversal in tar and pkg extraction
Rust Firefox download handler no longer ignores browser path when version is specified

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track selenium

Get notified when new releases ship.

About selenium

All releases →

Related context

Related tools

Earlier breaking changes

vselenium-4.44.0 `UnhandledPromptBehavior` option as string and map supported (breaking change)
vselenium-4.44.0 'native' methods inside Java HttpClient interface deprecated