docs: changelog 2026-06-09, release 149.0.7827.59 with WebKit-family profiles and Canvas Replay updates

Author: MSTU0

ADVANCED_FEATURES.md

@@ -2,13 +2,13 @@
 
 Technical architecture and implementation details behind BotBrowser's fingerprint protection. This document covers the design and capabilities of each subsystem. For configuration syntax and usage examples, see the [CLI Flags Reference](CLI_FLAGS.md).
 
-> License tiers: Some capabilities show tier hints in parentheses (PRO, ENT Tier1/Tier2/Tier3); those options are subscription-gated.
+> License tiers: Some capabilities show tier hints in parentheses (PRO, ENT Tier1/Tier2/Tier3/Tier4); those options are subscription-gated.
 
 ---
 
 ## Capabilities Index
 
-[navigator.webdriver removal](#chrome-behavior-emulation), [main-world isolation](#playwright-puppeteer-integration), [JS hook isolation](#playwright-puppeteer-integration), [Canvas noise](#multi-layer-fingerprint-noise), [WebGL/WebGPU param control](#multi-layer-fingerprint-noise), [Skia anti-alias](#cross-platform-font-engine), [HarfBuzz shaping](#cross-platform-font-engine), [MediaDevices protection](#complete-fingerprint-control), [font list authenticity](#cross-platform-font-engine), [UA congruence](#browser-os-fingerprinting), [custom User-Agent (ENT Tier3)](CLI_FLAGS.md#profile-configuration-override-flags), [per-context proxy (ENT Tier1) geo](CLI_FLAGS.md#enhanced-proxy-configuration), [DNS-through-proxy](#network-fingerprint-control), [active window emulation](#active-window-emulation), [HTTP headers/HTTP2/HTTP3](#chrome-behavior-emulation), [headless parity](#headless-incognito-compatibility), [WebRTC SDP/ICE control](#webrtc-leak-protection), [TLS fingerprint (JA3/JARM)](#network-fingerprint-control), [port protection (PRO)](#port-protection), [dynamic proxy switching (ENT Tier3)](#dynamic-proxy-switching), [distributed privacy consistency](#mirror-distributed-privacy-consistency), [CDP quick reference](#cdp-quick-reference)
+[navigator.webdriver removal](#chrome-behavior-emulation), [main-world isolation](#playwright-puppeteer-integration), [JS hook isolation](#playwright-puppeteer-integration), [Canvas noise](#multi-layer-fingerprint-noise), [Canvas replay (ENT Tier4)](#multi-layer-fingerprint-noise), [WebGL/WebGPU param control](#multi-layer-fingerprint-noise), [Skia anti-alias](#cross-platform-font-engine), [HarfBuzz shaping](#cross-platform-font-engine), [MediaDevices protection](#complete-fingerprint-control), [font list authenticity](#cross-platform-font-engine), [UA congruence](#browser-os-fingerprinting), [custom User-Agent (ENT Tier3)](CLI_FLAGS.md#profile-configuration-override-flags), [WebKit-family profile consistency (ENT Tier4)](#webkit-family-profile-consistency), [per-context proxy (ENT Tier1) geo](CLI_FLAGS.md#enhanced-proxy-configuration), [DNS-through-proxy](#network-fingerprint-control), [active window emulation](#active-window-emulation), [HTTP headers/HTTP2/HTTP3](#chrome-behavior-emulation), [headless parity](#headless-incognito-compatibility), [WebRTC SDP/ICE control](#webrtc-leak-protection), [TLS behavior consistency](#network-fingerprint-control), [port protection (PRO)](#port-protection), [dynamic proxy switching (ENT Tier3)](#dynamic-proxy-switching), [distributed privacy consistency](#mirror-distributed-privacy-consistency), [CDP quick reference](#cdp-quick-reference)
 
 ---
 
@@ -33,7 +33,7 @@ Smart auto-configuration: timezone, locale, and languages derive from your proxy
 - **DNS Routing:** SOCKS5 proxies route all lookups through the proxy tunnel, preventing local DNS leakage.
 - **UDP over SOCKS5 (ENT Tier3):** Automatic UDP associate when supported to tunnel QUIC and STUN; ICE presets often unnecessary if UDP is available.
 - **WebRTC:** SDP/ICE manipulation and candidate filtering to prevent local IP disclosure (see [WebRTC Leak Protection](#webrtc-leak-protection)).
-- **TLS Fingerprints (JA3/JARM/ALPN):** Roadmap: cipher/extension ordering and ALPN tuning under evaluation.
+- **TLS behavior consistency:** Network protocol behavior is aligned with the active profile family across supported platforms.
 
 **Stack differentiators:**
 - [Per-context proxies](PER_CONTEXT_FINGERPRINT.md) with proxy-based geo detection (timezone/locale/language) across contexts and sessions
@@ -105,6 +105,7 @@ await page.goto('https://example.co.uk');
 Deterministic noise generation prevents fingerprint collection while maintaining session consistency.
 
 - **Canvas**: Controlled variance applied to Canvas 2D rendering
+- **Canvas Replay (ENT Tier4)**: Profile-backed deterministic Canvas responses for approved validation workflows
 - **WebGL image**: Controlled variance applied to WebGL readback
 - **WebGPU**: Deterministic noise applied to WebGPU canvases by default so GPU-only probes inherit the same reproducible noise characteristics
 - **AudioContext**: Inaudible noise calibration (Chromium 141+) with cross-worker consistency
@@ -347,11 +348,20 @@ Comprehensive hardware emulation and fingerprint management.
 |-----------|-------------|
 | **User Agent** | Version control, userAgentData brands, full version override, custom UA with placeholders (ENT Tier3) |
 | **Platform Detection** | Windows/macOS/Android(PRO) with authentic APIs |
-| **Browser Features** | Debugger control, CDP leak protection, Chrome-specific behavior, WebView brand (ENT Tier3) |
+| **Browser Features** | Debugger control, CDP leak protection, Chrome-specific behavior, WebView brand (ENT Tier3), WebKit-family profile consistency (ENT Tier4) |
 | **Font System** | Built-in cross-platform fonts, Blink features, authentic fallback chains |
 | **Client Hints** | DPR, device-memory, UA-CH, and other CH values stay aligned with JavaScript-visible metrics |
 | **userAgentData** | Full control over platform, platformVersion, model, architecture, bitness, mobile (ENT Tier3) |
 
+<a id="webkit-family-profile-consistency"></a>
+### WebKit-Family Profile Consistency (ENT Tier4)
+
+WebKit-family Profile Consistency extends premium profiles beyond browser-brand metadata. The browser runtime, CSS behavior, media capability behavior, navigation headers, TLS behavior, HTTP/2 behavior, and per-context isolation are shaped to match the selected WebKit-family profile across supported host platforms.
+
+Supported profile bundles cover desktop and mobile WebKit-family identities. Use this capability for authorized privacy validation when a workflow needs browser-family consistency while keeping BotBrowser's profile, automation, and per-context control model.
+
+See [WebKit-family Profile Consistency](WEBKIT_PROFILE_CONSISTENCY.md) for the full feature page and setup notes.
+
 ### Location & Time Management
 
 | Component | Capabilities |
@@ -493,7 +503,7 @@ All commands live under the `BotBrowser` CDP domain. Send them through a **brows
 - [Per-Context Fingerprint](PER_CONTEXT_FINGERPRINT.md) - Independent fingerprint per BrowserContext
 - [Validation Results](VALIDATION.md) - Research and testing data
 - [Mirror](tools/mirror/) - Distributed privacy consistency verification
-- [CanvasLab](tools/canvaslab/) - Canvas 2D / WebGL / WebGL2 forensics and tracking analysis tool
+- [CanvasLab](tools/canvaslab/) - Canvas 2D / WebGL / WebGL2 forensics and privacy validation tool
 - [AudioLab](tools/audiolab/) - Web Audio API forensics and audio fingerprint collection analysis tool
 - [V8Log Forensics](tools/v8log/) - Browser-runtime evidence for authorized fingerprint protection sessions
 - [Examples](examples/) - Playwright, Puppeteer, bot-script integration

CHANGELOG.md

@@ -3,6 +3,17 @@
 > **Research scope:** Entries in this changelog describe features evaluated in authorized labs and defensive benchmarking programs. Follow the [Legal Disclaimer](DISCLAIMER.md) and [Responsible Use Guidelines](RESPONSIBLE_USE.md). We work with security vendors to investigate any misuse, so report concerns to [support@botbrowser.io](mailto:support@botbrowser.io).
 
 
+## [2026-06-09]
+### Major
+- **Chromium Core -> 149.0.7827.59**: Updated to Chrome 149 stable (149.0.7827.59). Web Platform consistency, rendering accuracy, and security patches stay aligned with upstream Chrome.
+
+### New
+- **WebKit-Family Profile Consistency (ENT Tier4)**: Added premium WebKit-family profile support for desktop and mobile browser-family identity consistency on the BotBrowser browser core. This extends profile consistency beyond browser brand and platform metadata into engine-level runtime behavior, CSS behavior, media capability behavior, navigation headers, TLS behavior, HTTP/2 behavior, and BrowserContext isolation, giving privacy teams a controlled way to validate WebKit-family profile bundles across supported host platforms.
+
+### Improvements
+- **Per-Context Fingerprint Flag Coverage**: Expanded validated per-context support for `--bot-profile-dir`, `--bot-script`, `--bot-cookies`, graphics mode controls, lifecycle controls, and WebRTC ICE settings.
+
+
 ## [2026-06-06]
 ### Major
 - **Chromium Core -> 148.0.7778.254**: Updated the Chrome 148 stable line to 148.0.7778.254. Web Platform consistency, rendering accuracy, and security patches stay aligned with upstream Chrome.
@@ -1040,7 +1051,6 @@ Refined per-OS rendering differences (fonts, CSS, anti-aliasing, text sizing) so
 - **Browser Brand Config**: New `configs.browserBrand` option for `chromium`, `chrome`, `brave`, or `edge`, enabling high-fidelity brand emulation.
 - **Brave Simulation**: Full Brave browser emulation including `userAgent`, `userAgentData`, and `navigator.brave.isBrave` properties.
 - **Edge Simulation**: Full Microsoft Edge emulation covering `userAgent`, `userAgentData`, and Edge-specific APIs.
-- **WebKit Emulation**: Preliminary WebKit engine simulation for basic Safari-like behaviors.
 - **Random History Augmentation**: `configs.injectRandomHistory` adds realistic history entries (URLs, timestamps) on new page loads without an opener.
 
 ### Improved

CLI_FLAGS.md

@@ -8,7 +8,7 @@ This document explains BotBrowser's CLI configuration system. These flags extend
 
 > Dynamic configuration: `--bot-*` flags (config overrides + behavior toggles) enable runtime fingerprint control, which is ideal for CI/CD and multi-instance scenarios.
 
-> License tiers: Some flags show tier hints in parentheses (PRO, ENT Tier1/Tier2/Tier3); those options are subscription-gated.
+> License tiers: Some flags show tier hints in parentheses (PRO, ENT Tier1/Tier2/Tier3/Tier4); those options are subscription-gated.
 
 ## Table of Contents
 
@@ -50,6 +50,7 @@ Specify a directory containing multiple `.enc` profile files. BotBrowser will ra
 - Each startup randomly selects a different profile from the directory
 - Useful for multi-instance deployments requiring fingerprint variation
 - Cannot be used together with `--bot-profile` (directory takes precedence if both are specified)
+- Can be used at BrowserContext creation time through Per-Context Fingerprint when a context should select its own profile from a directory
 
 ---
 
@@ -210,7 +211,7 @@ Sets custom browser window title and taskbar/dock icon label.
 ### `--bot-cookies` (PRO)
 Session restoration and cookie management.
 
-Accepts cookie data as either inline JSON or from a file.
+Accepts cookie data as either inline JSON or from a file. In Per-Context Fingerprint workflows, cookies can be imported at BrowserContext creation time so each context starts with its own session state.
 
 **Inline JSON:**
 ```bash
@@ -238,10 +239,12 @@ Guide: [Bookmark Seeding](https://botbrowser.io/docs/identity/bookmark-seeding/)
 
 <a id="--bot-canvas-record-file"></a>
 ### `--bot-canvas-record-file`
-Canvas forensics and tracking analysis.
+Canvas forensics and privacy validation.
 
 Records all Canvas 2D, WebGL, WebGL2, and WebGPU API calls to a JSONL file for forensic analysis and replay.
 
+CanvasLab recording is a diagnostic workflow. Profile-backed Canvas Replay is an ENT Tier4 capability for approved validation workflows that require deterministic graphics protection from embedded profile data.
+
 ```bash
 --bot-canvas-record-file="/tmp/canvaslab.jsonl"
 ```
@@ -304,7 +307,7 @@ Learn more: [V8Log Guide](docs/guides/getting-started/V8LOG.md) | [V8Log Tool](t
 ### `--bot-script`
 Framework-less approach with a privileged JavaScript context.
 
-Execute a JavaScript file right after BotBrowser starts in a privileged, non-extension context where `chrome.debugger` is available.
+Execute a JavaScript file right after BotBrowser starts in a privileged, non-extension context where `chrome.debugger` is available. In Per-Context Fingerprint workflows, bot scripts can also be attached at BrowserContext creation time.
 
 ```bash
 --bot-script="/path/to/script.js"
@@ -389,7 +392,7 @@ BotBrowser supports command-line flags that override profile configuration value
 Flags that directly map to profile `configs` and override them at runtime.
 
 **Identity & Locale** - Guides: [Browser Brand Alignment](https://botbrowser.io/docs/identity/browser-brand-alignment/), [Custom User-Agent](https://botbrowser.io/docs/identity/custom-user-agent/), [Timezone, Locale, and Language](https://botbrowser.io/docs/identity/timezone-locale-language/)
-- `--bot-config-browser-brand=chrome` (ENT Tier2, webview requires ENT Tier3): Browser brand: chrome, chromium, edge, brave, opera, webview
+- `--bot-config-browser-brand=chrome` (ENT Tier2, webview requires ENT Tier3): Browser brand: chrome, chromium, edge, brave, opera, webview. WebKit-family identities are delivered through ENT Tier4 premium profiles.
 - `--bot-config-brand-full-version=142.0.3595.65` (ENT Tier2): Brand-specific full version (Edge/Opera cadence) for UA-CH congruence
 - `--bot-config-ua-full-version=142.0.7444.60` (ENT Tier2): User agent version: full version string matching Chromium major
 - `--bot-config-languages=auto`: Languages: `auto` (IP-based, default) or custom value like `en-US,fr-FR` (ENT Tier1)

PER_CONTEXT_FINGERPRINT.md

@@ -298,17 +298,18 @@ Most `--bot-*` flags from [CLI_FLAGS.md](CLI_FLAGS.md) work with per-context con
 
 | Category | Example Flags |
 |----------|---------------|
-| Profile | `--bot-profile` (load a completely different profile per context) |
+| Profile | `--bot-profile` (load a completely different profile per context), `--bot-profile-dir` (select from a directory at context creation) |
 | Noise Seed | [`--bot-noise-seed`](CLI_FLAGS.md#behavior--protection-toggles) for deterministic fingerprint variance |
 | Timing | [`--bot-time-scale`](CLI_FLAGS.md#behavior--protection-toggles) for performance timing control, [`--bot-time-seed`](ADVANCED_FEATURES.md#performance-timing-protection) for deterministic timing diversity, [`--bot-stack-seed`](ADVANCED_FEATURES.md#stack-depth-control) for stack depth variation, [`--bot-fps`](CLI_FLAGS.md#behavior--protection-toggles) for frame rate control |
 | Network | [`--bot-network-info-override`](ADVANCED_FEATURES.md#network-info-privacy) for profile-defined `navigator.connection` values |
 | WebRTC | [`--bot-webrtc-ice`](ADVANCED_FEATURES.md#webrtc-leak-protection) for ICE endpoint control |
 | Window | [`--bot-always-active`](ADVANCED_FEATURES.md#active-window-emulation) to maintain active window state |
-| Session | `--bot-inject-random-history` for session authenticity (supports precise count, e.g., `=15`) |
+| Session | `--bot-inject-random-history` for session authenticity (supports precise count, e.g., `=15`), `--bot-cookies` for context-scoped cookie import at creation time |
+| Automation | `--bot-script` for context-scoped framework-less automation bootstrap at creation time |
 | Google Headers | [`--bot-enable-variations-in-context`](CLI_FLAGS.md#behavior--protection-toggles) for `X-Client-Data` consistency in incognito contexts (ENT Tier2) |
 | Proxy | [`--proxy-server`](CLI_FLAGS.md#enhanced-proxy-configuration) (configure proxy per-context via `botbrowserFlags`), `--proxy-ip` to skip IP lookups |
 | HTTP | [`--bot-custom-headers`](CLI_FLAGS.md#--bot-custom-headers-pro) for custom HTTP request headers per context |
-| Config | [`--bot-config-platform`, `--bot-config-timezone`, `--bot-config-noise-canvas`, etc.](CLI_FLAGS.md#profile-configuration-override-flags) |
+| Config | [`--bot-config-platform`, `--bot-config-timezone`, `--bot-config-noise-canvas`, `--bot-config-webgl=disabled`, `--bot-config-webgpu=disabled`, etc.](CLI_FLAGS.md#profile-configuration-override-flags) |
 
 See [CLI_FLAGS.md](CLI_FLAGS.md) for the complete flag reference.
 
@@ -317,7 +318,7 @@ See [CLI_FLAGS.md](CLI_FLAGS.md) for the complete flag reference.
 **Privacy Research at Scale**
 - Run fingerprint protection validation across multiple configurations simultaneously
 - Compare behavior across different platform/locale combinations
-- Study tracking mechanisms with controlled, isolated contexts
+- Study signal collection behavior with controlled, isolated contexts
 
 **Cross-Platform Testing**
 - Validate application behavior across different platform fingerprints