robgruen · Oct 26, 2026 · Oct 26, 2026 · Oct 26, 2026 · Oct 26, 2026
diff --git a/ts/examples/docuProc/README.md b/ts/examples/docuProc/README.md
@@ -2,6 +2,18 @@
 
 This sample app is used to interactively test the processing of pdf files and querying the documents using structured schema. You can use it to download pdf files from arxiv and process them.
 
+## Python dependencies
+
+Use Python 3.10 or later. From this directory, install the Python dependencies:
+
+```powershell
+python -m pip install --upgrade -r requirements.txt
+```
+
+PyMuPDF is pinned to 1.28.2, which bundles MuPDF 1.28.2 with the native Brotli
+decoder fix for CVE-2026-111497. Installing or upgrading the separate Python
+`brotli` package does not replace this embedded decoder.
+
 ## Trademarks
 
 This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft

diff --git a/ts/examples/docuProc/requirements.txt b/ts/examples/docuProc/requirements.txt
@@ -2,4 +2,4 @@
 # Licensed under the MIT License.
 
 pdfplumber
-pymupdf
+pymupdf>=1.28.2
diff --git a/ts/examples/docuProc/src/pdfChunker.py b/ts/examples/docuProc/src/pdfChunker.py
@@ -7,7 +7,7 @@
 import json
 
 import pdfplumber # type: ignore
-import fitz # type: ignore
+import pymupdf as fitz # type: ignore
 from PIL import Image # type: ignore
 
 import datetime

diff --git a/ts/examples/docuProc/src/srag/pdfChunkerV2.py b/ts/examples/docuProc/src/srag/pdfChunkerV2.py
@@ -7,7 +7,7 @@
 import json
 
 import pdfplumber # type: ignore
-import fitz # type: ignore
+import pymupdf as fitz # type: ignore
 from PIL import Image # type: ignore
 
 import datetime

diff --git a/ts/examples/microdataExtract/package.json b/ts/examples/microdataExtract/package.json
@@ -43,7 +43,7 @@
     "@oclif/core": "^4.2.10",
     "@oclif/plugin-help": "^6",
     "fs-extra": "^11.3.0",
-    "puppeteer": "^24.15.0",
+    "puppeteer": "^25.14.0",
     "ts-node": "^10.9.1",
     "xml2js": "^0.6.2"
   },

diff --git a/ts/examples/microdataExtract/src/commands/scrape.ts b/ts/examples/microdataExtract/src/commands/scrape.ts
@@ -2,7 +2,7 @@
 // Licensed under the MIT License.
 
 import { Command, Flags } from "@oclif/core";
-import puppeteer, { TimeoutError } from "puppeteer";
+import puppeteer, { TimeoutError, type Browser, type Page } from "puppeteer";
 import * as fs from "fs-extra";
 import * as path from "path";
 import { homedir } from "os";
@@ -163,7 +163,7 @@ export default class Scrape extends Command {
         return new Promise((resolve) => setTimeout(resolve, ms));
     }
 
-    async getRestaurantLinks(page: puppeteer.Page): Promise<string[]> {
+    async getRestaurantLinks(page: Page): Promise<string[]> {
         return await page.evaluate(() => {
             const links = Array.from(
                 document.querySelectorAll('a[href*="/Restaurant_Review-"]'),
@@ -178,7 +178,7 @@ export default class Scrape extends Command {
         });
     }
 
-    async extractJsonLdData(page: puppeteer.Page): Promise<any | null> {
+    async extractJsonLdData(page: Page): Promise<any | null> {
         try {
             const jsonLd = await page.$$eval(
                 'script[type="application/ld+json"]',
@@ -205,10 +205,7 @@ export default class Scrape extends Command {
         return null;
     }
 
-    async scrapePage(
-        browser: puppeteer.Browser,
-        url: string,
-    ): Promise<any | null> {
+    async scrapePage(browser: Browser, url: string): Promise<any | null> {
         const page = await browser.newPage();
         try {
             await page.goto(url, { waitUntil: "load" });
@@ -238,7 +235,7 @@ export default class Scrape extends Command {
     }
 
     async runDiscoveryMode(
-        browser: puppeteer.Browser,
+        browser: Browser,
         baseUrl: string,
         numPages: number,
         outputFile: string,
@@ -309,7 +306,7 @@ export default class Scrape extends Command {
     }
 
     async runDirectMode(
-        browser: puppeteer.Browser,
+        browser: Browser,
         inputFile: string,
         outputFile: string,
     ): Promise<void> {

diff --git a/ts/examples/websiteAliases/package.json b/ts/examples/websiteAliases/package.json
@@ -37,7 +37,7 @@
     "debug": "^4.4.0",
     "dotenv": "^16.3.1",
     "fs-extra": "^11.3.0",
-    "puppeteer": "^24.15.0",
+    "puppeteer": "^25.14.0",
     "typechat": "^0.1.1",
     "typescript": "~5.4.5"
   },

diff --git a/ts/packages/agentServer/bundledRuntime/package.json b/ts/packages/agentServer/bundledRuntime/package.json
@@ -27,7 +27,7 @@
     "graphology-metrics": "^2.1.0",
     "keytar": "7.9.0",
     "onnxruntime-node": "1.30.0",
-    "puppeteer": "^24.15.0",
+    "puppeteer": "^25.14.0",
     "puppeteer-extra": "^3.3.6",
     "puppeteer-extra-plugin-adblocker": "^2.13.6",
     "puppeteer-extra-plugin-stealth": "^2.11.2",

diff --git a/ts/packages/agents/browser/README.md b/ts/packages/agents/browser/README.md
@@ -20,6 +20,20 @@ Related packages:
 Run `pnpm run build` in this folder (builds the agent, PDF views, and
 puppeteer helpers).
 
+### Puppeteer browser
+
+The Puppeteer helpers require Node.js 22.12.0 or later. Puppeteer's install
+scripts are disabled by workspace policy, so `pnpm install` does not download
+its browser. After updating Puppeteer, install the matching Chrome binary
+from `ts/`:
+
+```powershell
+pnpm --filter @typeagent/browser exec puppeteer browsers install chrome
+```
+
+When using an existing system Chrome installation instead, update that browser
+separately. Updating Puppeteer does not patch system Chrome.
+
 ## Architecture
 
 ### Schema-defined questions

diff --git a/ts/packages/agents/browser/package.json b/ts/packages/agents/browser/package.json
@@ -109,7 +109,7 @@
     "mermaid": "^11.16.1",
     "pdfjs-dist": "5.3.31",
     "prismjs": "^1.30.0",
-    "puppeteer": "^24.15.0",
+    "puppeteer": "^25.14.0",
     "puppeteer-extra": "^3.3.6",
     "puppeteer-extra-plugin-adblocker": "^2.13.6",
     "puppeteer-extra-plugin-stealth": "^2.11.2",

diff --git a/ts/packages/agents/utility/package.json b/ts/packages/agents/utility/package.json
@@ -41,7 +41,7 @@
     "@typeagent/browser-control-rpc": "workspace:*",
     "@types/html-to-text": "^9.0.4",
     "html-to-text": "^9.0.5",
-    "puppeteer": "^24.15.0",
+    "puppeteer": "^25.14.0",
     "puppeteer-extra": "^3.3.6",
     "puppeteer-extra-plugin-stealth": "^2.11.2"
   },