v1.14.0

smicallef/spiderfootv1.14.0Aug 19, 2026by skyfallsin

Upgrading?

AI Summary

Adds an opt-in local browser window for Camofox to allow users to inspect and interact with the browser during scans, alongside various stability and maintenance improvements.

Key Highlights

  • Opt-in local browser window activated via `CAMOFOX_INTERACTIVE=desktop`
  • Per-user browser recovery prevents disruption of other active users
  • Timed-out actions now retire their tab instead of running in the background
  • Direct installs now support Node 24
  • Docker image published with ARM64 support

New Features

  • Local interactive browser window
  • Per-user navigation recovery
  • Automatic tab retirement for timeouts
  • Fixed double-click download handling
  • Fixed image URL loading
  • VNC display cleanup

Full Release Notes

## See the browser when you need to

Camofox usually works best out of sight. But when a login needs attention, a page looks wrong, or you want to understand what an agent is doing, a hidden browser is hard to help with.

`v1.14.0` adds an opt-in local browser window:

```bash
CAMOFOX_INTERACTIVE=desktop
```

Start Camofox with that setting and it opens a real local Camoufox window. You can watch the task, inspect the page, and step in when needed. This is for direct local installs, including Hermes running on your own computer.

It is off by default. Existing installs remain headless, and desktop mode does not expose VNC, noVNC, or a remote browser-control port. If you need a browser-based remote view, use the existing VNC plugin in a supported Linux or Docker setup; it is a separate interactive path, not a second view of the same browser session.

You can also set it in `camofox.config.json`:

```json
{
  "interactive": { "mode": "desktop" }
}
```

Set `CAMOFOX_INTERACTIVE=off`, or remove the setting, to return to normal headless behavior.

## Other improvements

- Browser recovery stays with the affected user instead of disrupting other active users.
- Timed-out actions retire their tab rather than continuing in the background.
- Download clicks are not accidentally sent twice, and image URLs finish loading correctly.
- Direct installs support Node 24; the published Docker image supports ARM64 and includes the MCP files needed at runtime.
- VNC-backed displays clean up their own temporary display files after they stop.
- `npm test` now runs its test layers in the right order, and audited transitive dependencies were updated.

## Thanks

Thank you to the contributors whose work informed or was incorporated into this release:

- @e-Garcia for the health-probe compatibility fix (#9253) and the Xvfb cleanup investigation (#9252).
- @dyiapanis for the per-user navigation recovery and single-flight restart work (#9324).
- @ibrahiem9 for the ARM64 Docker runtime and MCP reliability work (#9329).

Related Repositories