scrapely 1.2.39 → 1.2.40

package/CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [1.2.40] - 2026-10-30
+
+- Actors on puppeteer 25 (ESM-only) are sent to the remote browser when puppeteer is loaded with `require()` before the SDK on a run without the preload. The SDK only recognised puppeteer's old `lib/cjs` build, so such a `puppeteer.launch()` tried to start a local browser; the named `launch` export (`const { launch } = require('puppeteer')`) is covered too. puppeteer 24 and older behave as before.
+
 ## [1.2.39] - 2026-10-29
 
 - A refused charge names the limit that refused it. When a charge is refused or cut short, the platform now says why (HTTP 402 `error.data.reason`, and `limitedBy` on a partial acceptance): the run's item limit (`maxItems`), its maximum total charge (`maxTotalChargeUsd`) or the account balance. The SDK used to call all of them the spending limit. Now its log lines name the real limit; `ChargingManager.getChargeLimitReason()` returns `'max-items'`, `'max-charge'` or `'insufficient-funds'` and `getChargeLimitMessage()` the stop message ("Stopped: reached the item limit you set (800 items)", "Stopped: reached the maximum charge you set ($3.00)", "Stopped: your account has no credit left for this run"); and once a limit was reached, a status message (`Actor.setStatusMessage`, `Actor.exit`, `Actor.fail`) whose clause blames the maximum charge gets that clause replaced by the real stop message. Platforms that do not send the reason yet: inferred from the 402 message and `ACTOR_MAX_PAID_DATASET_ITEMS`. What is charged and saved does not change.

package/dist/crypto/secrets.js

@@ -20,6 +20,7 @@ const PBKDF2_ITERATIONS = 100_000;
 const PBKDF2_HASH = 'sha256';
 const SALT_LENGTH = 32;
 const KEY_LENGTH = 32;
+const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 // ─── Private Key Decryption ───────────────────────────────────────────────────
 /**
  * Read the private key file from disk and decrypt it with the run passphrase.
@@ -101,6 +102,9 @@ function decryptAllSecrets(encryptedSecrets, privateKeyPem) {
 function mergeDecryptedInput(input, decryptedSecrets) {
     const merged = { ...input };
     for (const [fieldName, value] of Object.entries(decryptedSecrets)) {
+        // Never walk into or write onto an object's prototype chain.
+        if (fieldName.split('.').some((part) => UNSAFE_KEYS.has(part)))
+            continue;
         if (fieldName.includes('.')) {
             // Handle nested paths
             const parts = fieldName.split('.');

package/dist/patch-browser-pool.js

@@ -791,8 +791,31 @@ function patchRawPuppeteerModule(mod, moduleName) {
                 // read-only export binding — the default export is still patched
             }
         }
+        // ESM-only puppeteer (v25+) loaded through require(): the named
+        // `launch` is a read-only binding to the original method, which hands
+        // off to a BrowserLauncher. Patch that class so it redirects too.
+        if (mod.launch === origBoundLaunch)
+            patchPuppeteerBrowserLauncherClass(mod.BrowserLauncher, moduleName);
     }
 }
+/**
+ * Patch puppeteer's BrowserLauncher class (base of ChromeLauncher and
+ * FirefoxLauncher), which every PuppeteerNode launch goes through. Calls that
+ * already went through a patched launch decide the same way again (no CDP URL
+ * → local launch). Idempotent per class.
+ */
+function patchPuppeteerBrowserLauncherClass(BrowserLauncher, moduleName) {
+    const proto = BrowserLauncher?.prototype;
+    if (!proto || typeof proto.launch !== 'function')
+        return;
+    if (Object.prototype.hasOwnProperty.call(proto, '_scrapelyRawCdpPatched'))
+        return;
+    const origLaunch = proto.launch;
+    proto.launch = function browserLauncherLaunchPatched(launchOptions) {
+        return puppeteerLaunchPatched(this.puppeteer, (options) => origLaunch.call(this, options), moduleName, launchOptions);
+    };
+    proto._scrapelyRawCdpPatched = true;
+}
 /**
  * Requests that load (a part of) some copy of @crawlee/browser-pool:
  * - the bare package name (require from @crawlee/playwright etc.),
@@ -804,8 +827,11 @@ const BROWSER_POOL_REQUEST_RE = /^@crawlee\/browser-pool$|[/\\]@crawlee[/\\]brow
 const BROWSER_POOL_FILENAME_RE = /[/\\]@crawlee[/\\]browser-pool[/\\](index|playwright[/\\]playwright-plugin|puppeteer[/\\]puppeteer-plugin)\.js$/;
 /** playwright / playwright-core package entry, by filename (ESM imports and require.cache). */
 const PLAYWRIGHT_ENTRY_FILENAME_RE = /[/\\]node_modules[/\\](playwright|playwright-core)[/\\]index\.js$/;
-/** puppeteer / puppeteer-core CJS package entry (default instance), by filename. */
-const PUPPETEER_ENTRY_FILENAME_RE = /[/\\]node_modules[/\\](puppeteer|puppeteer-core)[/\\]lib[/\\]cjs[/\\]puppeteer[/\\](puppeteer|puppeteer-core)\.js$/;
+/**
+ * puppeteer / puppeteer-core package entry (default instance), by filename:
+ * `lib/cjs/puppeteer/…` up to v24, `lib/puppeteer/…` in the ESM-only v25+.
+ */
+const PUPPETEER_ENTRY_FILENAME_RE = /[/\\]node_modules[/\\](puppeteer|puppeteer-core)[/\\]lib[/\\](?:cjs[/\\])?puppeteer[/\\](puppeteer|puppeteer-core)\.js$/;
 /** puppeteer-core's PuppeteerNode class file (CJS), as requested by node/node.js or cached. */
 const PUPPETEER_NODE_REQUEST_RE = /(^|[/\\])PuppeteerNode(\.js)?$/;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "scrapely",
-    "version": "1.2.39",
+    "version": "1.2.40",
     "description": "Scrapely SDK for building JavaScript and TypeScript Actors",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
@@ -89,20 +89,20 @@
         "crawlee": "^3.16.0",
         "dockerode": "^4.0.9",
         "ioredis": "^6.0.0",
-        "ip-address": "10.3.1",
+        "ip-address": "10.6.0",
         "lodash": "^4.18.1",
         "mysql2": "^3.23.1",
         "playwright": "^1.58.2",
         "scrapely-client": "^2.25.9",
         "tar-fs": "2.1.5",
-        "ws": "^8.18.0"
+        "ws": "^8.21.0"
     },
     "devDependencies": {
         "@types/dockerode": "^4.0.1",
         "@types/node": "^25.5.0",
         "@types/ws": "^8.5.10",
         "dotenv": "^17.3.1",
-        "puppeteer-core": "^24.43.1",
+        "puppeteer-core": "^25.16.0",
         "tsx": "^4.21.0",
         "typescript": "^5.7.0"
     },
@@ -113,8 +113,10 @@
         "axios": "^1.20.0",
         "brace-expansion": "5.0.9",
         "fast-xml-builder": "^1.2.1",
+        "strnum": "^2.4.2",
         "file-type": "^21.3.3",
         "follow-redirects": "^1.16.1",
+        "protobufjs": "^7.6.6",
         "@crawlee/core": {
             "ow": "0.28.2"
         },