[build] Prepare for release of Selenium 4.40 by selenium-ci · Pull Request #16931 · SeleniumHQ/selenium

selenium-ci · 2026-01-17T07:56:44Z

User description

Updates Applied

Component	Status
Browser and driver versions	✅ Updated
CDP version	✅ Updated
Selenium Manager version	✅ Updated
Maven dependencies	✅ Updated
Update Authors	✅ Updated
Bump Versions	✅ Updated
Draft Changelogs	✅ Updated

Auto-generated by release-preparation workflow

PR Type

Enhancement

Description

Updated Chrome DevTools Protocol (CDP) to version 144 across all language bindings (Java, .NET, Ruby, Python)
Updated browser and driver versions: Firefox 147.0.1, Edge 144.0.3719.82
Updated Selenium Manager artifacts for Linux, macOS, and Windows platforms
Bumped Selenium version to 4.40.0 across all language bindings
Updated Maven dependencies with new artifact hashes and versions
Added comprehensive changelogs for v4.40.0 in Java, Python, .NET, and Ruby
Updated AUTHORS file with new contributors
Enhanced Chrome DevTools Protocol definitions with new accessibility properties, audit issue types, and network conditions emulation
Updated issue template to reference latest version 4.40

Diagram Walkthrough

flowchart LR
  A["Version 4.40.0"] --> B["Java Bindings"]
  A --> C[".NET Bindings"]
  A --> D["Python Bindings"]
  A --> E["Ruby Bindings"]
  F["CDP v144"] --> B
  F --> C
  F --> D
  E --> F
  G["Browser Updates"] --> H["Firefox 147.0.1"]
  G --> I["Edge 144.0.3719.82"]
  J["Dependencies"] --> K["Maven Updates"]
  J --> L["Selenium Manager"]
  M["Documentation"] --> N["Changelogs"]
  M --> O["AUTHORS"]

File Walkthrough

Relevant files

Configuration changes

31 files

v144Target.java `Update DevTools Target class to version 144` java/src/org/openqa/selenium/devtools/v144/v144Target.java Updated package declaration from `v141` to `v144` Renamed class from `v141Target` to `v144Target` Updated all import statements to reference `v144` instead of `v141` Updated all internal references to use `v144` package paths	+12/-12
v144Network.java `Update DevTools Network class to version 144` java/src/org/openqa/selenium/devtools/v144/v144Network.java Updated package declaration from `v141` to `v144` Renamed class from `v141Network` to `v144Network` Updated all import statements and references to use `v144` package Updated logger initialization to reference new class name	+15/-15
v144Events.java `Update DevTools Events class to version 144` java/src/org/openqa/selenium/devtools/v144/v144Events.java Updated package declaration from `v141` to `v144` Renamed class from `v141Events` to `v144Events` Updated all import statements to reference `v144` package Updated constructor to match new class name	+9/-9
v144Domains.java `Update DevTools Domains class to version 144` java/src/org/openqa/selenium/devtools/v144/v144Domains.java Updated package declaration from `v141` to `v144` Renamed class from `v141Domains` to `v144Domains` Updated all field declarations to use `v144` class names Updated constructor to instantiate `v144` versions of domain classes	+13/-13
v144Javascript.java `Update DevTools Javascript class to version 144` java/src/org/openqa/selenium/devtools/v144/v144Javascript.java Updated package declaration from `v141` to `v144` Renamed class from `v141Javascript` to `v144Javascript` Updated all import statements to reference `v144` package Updated constructor to match new class name	+7/-7
v144Log.java `Update DevTools Log class to version 144` java/src/org/openqa/selenium/devtools/v144/v144Log.java Updated package declaration from `v141` to `v144` Renamed class from `v141Log` to `v144Log` Updated all import statements to reference `v144` package	+5/-5
v144CdpInfo.java `Update DevTools CDP Info class to version 144` java/src/org/openqa/selenium/devtools/v144/v144CdpInfo.java Updated package declaration from `v141` to `v144` Renamed class from `v141CdpInfo` to `v144CdpInfo` Updated CDP version number from `141` to `144` Updated constructor to reference `v144Domains`	+4/-4
V144Domains.cs `Update .NET DevTools Domains class to version 144` dotnet/src/webdriver/DevTools/v144/V144Domains.cs Updated copyright file name from `V141Domains.cs` to `V144Domains.cs` Updated namespace from `V141` to `V144` Renamed class from `V141Domains` to `V144Domains` Updated `DevToolsVersion` property from `141` to `144` Updated all property implementations to use `V144` versions	+11/-11
V144Network.cs `Update .NET DevTools Network class to version 144` dotnet/src/webdriver/DevTools/v144/V144Network.cs Updated copyright file name from `V141Network.cs` to `V144Network.cs` Updated namespace and class name from `V141` to `V144` Updated using statements to reference `V144` namespaces Updated all type references in method implementations to use `V144`	+12/-12
V144JavaScript.cs `Update .NET DevTools JavaScript class to version 144` dotnet/src/webdriver/DevTools/v144/V144JavaScript.cs Updated copyright file name from `V141JavaScript.cs` to `V144JavaScript.cs` Updated namespace and class name from `V141` to `V144` Updated using statements to reference `V144` namespaces Updated constructor documentation and implementation	+8/-8
V144Target.cs `Update .NET DevTools Target class to version 144` dotnet/src/webdriver/DevTools/v144/V144Target.cs Updated copyright file name from `V141Target.cs` to `V144Target.cs` Updated namespace and class name from `V141` to `V144` Updated using statement to reference `V144` namespace Updated constructor documentation and implementation	+7/-7
V144Log.cs `Update .NET DevTools Log class to version 144` dotnet/src/webdriver/DevTools/v144/V144Log.cs Updated copyright file name from `V141Log.cs` to `V144Log.cs` Updated namespace and class name from `V141` to `V144` Updated using statement to reference `V144` namespace Updated constructor documentation and implementation	+7/-7
DevToolsDomains.cs `Update supported DevTools versions to include 144` dotnet/src/webdriver/DevTools/DevToolsDomains.cs Updated `SupportedDevToolsVersions` array to include `144` instead of `141` Updated `CreateDevToolsDomain` switch statement to map version `144` to `V144.V144Domains`	+2/-2
DevToolsTargetTest.cs `Update DevTools tests to use version 144` dotnet/test/common/DevTools/DevToolsTargetTest.cs Updated `CurrentCdpVersion` alias from `V143` to `V144` Updated test constant `id` from `143` to `144`	+2/-2
DevToolsTabsTest.cs `Update DevTools tabs test to version 144` dotnet/test/common/DevTools/DevToolsTabsTest.cs Updated `CurrentCdpVersion` alias from `V143` to `V144`	+1/-1
DevToolsPerformanceTest.cs `Update DevTools performance test to version 144` dotnet/test/common/DevTools/DevToolsPerformanceTest.cs Updated `CurrentCdpVersion` alias from `V143` to `V144`	+1/-1
DevToolsProfilerTest.cs `Update DevTools profiler test to version 144` dotnet/test/common/DevTools/DevToolsProfilerTest.cs Updated `CurrentCdpVersion` alias from `V143` to `V144`	+1/-1
DevToolsSecurityTest.cs `Update DevTools security test to version 144` dotnet/test/common/DevTools/DevToolsSecurityTest.cs Updated `CurrentCdpVersion` alias from `V143` to `V144`	+1/-1
DevToolsConsoleTest.cs `Update DevTools console test to version 144` dotnet/test/common/DevTools/DevToolsConsoleTest.cs Updated `CurrentCdpVersion` alias from `V143` to `V144`	+1/-1
DevToolsLogTest.cs `Update DevTools log test to version 144` dotnet/test/common/DevTools/DevToolsLogTest.cs Updated `CurrentCdpVersion` alias from `V143` to `V144`	+1/-1
DevToolsNetworkTest.cs `Update DevTools network test to version 144` dotnet/test/common/DevTools/DevToolsNetworkTest.cs Updated `CurrentCdpVersion` alias from `V143` to `V144`	+1/-1
__init__.py `Update Python WebDriver version to 4.40.0` py/selenium/webdriver/init.py Updated `__version__` from `4.40.0.202512070022` to `4.40.0`	+1/-1
__init__.py `Update Python Selenium version to 4.40.0` py/selenium/init.py Updated `__version__` from `4.40.0.202512070022` to `4.40.0`	+1/-1
conf.py `Update Python documentation version to 4.40.0` py/docs/source/conf.py Updated `release` variable from `4.40.0.202512070022` to `4.40.0`	+1/-1
selenium-dotnet-version.bzl `Update .NET version and DevTools support to 4.40.0` dotnet/selenium-dotnet-version.bzl Updated `SE_VERSION` from `4.40.0-nightly202512070022` to `4.40.0` Updated `SUPPORTED_DEVTOOLS_VERSIONS` to include `v144` instead of `v141`	+2/-2
versions.bzl `Update Java CDP versions to include 144` java/src/org/openqa/selenium/devtools/versions.bzl Updated `CDP_VERSIONS` list to include `v144` instead of `v141`	+1/-1
version.bzl `Update Java version to 4.40.0` java/version.bzl Updated `SE_VERSION` from `4.40.0-SNAPSHOT` to `4.40.0`	+1/-1
version.rb `Update Ruby DevTools version to 0.144.0` rb/lib/selenium/devtools/version.rb Updated `VERSION` from `0.143.0` to `0.144.0`	+1/-1
version.rb `Update Ruby WebDriver version to 4.40.0` rb/lib/selenium/webdriver/version.rb Updated `VERSION` from `4.40.0.nightly` to `4.40.0`	+1/-1
js_protocol.pdl `Update Chrome DevTools Protocol v144 definitions` common/devtools/chromium/v144/js_protocol.pdl Added `stackDepth` optional parameter to HeapProfiler sampling configuration Added `trustedtype` subtype to Runtime RemoteObject type definitions	+8/-0
Rakefile `Update Rakefile DevTools version target` Rakefile Updated Java release target from `v141` to `v144` DevTools version	+1/-1

Dependencies

3 files

repositories.bzl `Update browser and driver versions in repositories` common/repositories.bzl Updated Firefox release from `147.0` to `147.0.1` with new SHA256 hash Updated Firefox beta from `148.0b2` to `148.0b3` with new SHA256 hash Updated Microsoft Edge from `143.0.3650.139` to `144.0.3719.82` with new SHA256 hash Updated Edge driver URL and SHA256 hash to match new version	+13/-13
selenium_manager.bzl `Update Selenium Manager artifact versions` common/selenium_manager.bzl Updated Selenium Manager Linux release hash and download URL Updated Selenium Manager macOS release hash and download URL Updated Selenium Manager Windows release hash and download URL	+6/-6
maven_install.json `Update Maven dependencies and artifact hashes` java/maven_install.json Updated Maven dependency hashes for multiple packages Removed Jackson databind and dataformat dependencies Updated versions for javaparser, google-java-format, protobuf, grpc, lettuce, netty, opentelemetry, byte-buddy, htmlunit, log4j, checker-qual, mockito, and redisson	+164/-310

Documentation

6 files

CHANGELOG `Add v4.40.0 changelog entries` java/CHANGELOG Added comprehensive changelog for v4.40.0 with 40+ entries Includes BiDi improvements, refactoring, bug fixes, and performance enhancements Documents removal of Guava collections, JSpecify annotations, and various optimizations	+40/-0
AUTHORS `Update AUTHORS file with new contributors` AUTHORS Added new contributors: `Delta456`, `Michal Zyndul` (two entries), `pixelsapphire`, and `RENATO SPENCER`	+5/-0
CHANGES `Add Python 4.40.0 changelog entries` py/CHANGES Added comprehensive changelog for Selenium 4.40.0 with 17 entries Includes type hints improvements, BiDi enhancements, and debugging features Documents removal of deprecated classes and dependency cleanup	+18/-0
CHANGELOG `Add .NET 4.40.0 changelog entries` dotnet/CHANGELOG Added comprehensive changelog for v4.40.0 with 16 entries Includes BiDi improvements, nullability fixes, and event handling enhancements	+17/-0
CHANGES `Add Ruby 4.40.0 changelog entries` rb/CHANGES Added changelog for 4.40.0 with 12 entries Includes synchronization improvements, BiDi enhancements, and grid reliability fixes	+13/-0
bug-report.yml `Update issue template with latest version` .github/ISSUE_TEMPLATE/bug-report.yml Updated latest released version reference from `4.39` to `4.40`	+1/-1

Enhancement

1 files

browser_protocol.pdl `Chrome DevTools Protocol v144 Updates and Refactoring` common/devtools/chromium/v144/browser_protocol.pdl Updated Chrome DevTools Protocol (CDP) definitions for Chromium v144 Added new accessibility properties and audit issue types for improved error detection Refactored CSS stylesheet identifier type from local `StyleSheetId` to `DOM.StyleSheetId` across multiple domains Enhanced network conditions emulation with new URL pattern-based rules and navigator state override commands Added new permission element issue detection and improved autofill form filling capabilities Deprecated legacy network and storage commands in favor of newer alternatives	+310/-148

Additional files

11 files

MODULE.bazel	+15/-15
BUILD.bazel	[link]
BUILD.bazel	+1/-1
BUILD.bazel	+2/-2
CHANGES.md	+8/-0
package.json	+1/-1
pyproject.toml	+1/-1
BUILD.bazel	+1/-1
BUILD.bazel	+1/-1
CHANGELOG.md	+7/-0
Cargo.toml	+1/-1

qodo-code-review · 2026-01-18T03:57:26Z

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢	No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
🔴	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Errors silently ignored: Bazel query failures are suppressed via `2>/dev/null \|\| true`, which can silently hide real failures and produce incomplete `test_targets` without actionable error context. Referred Code if [[ "$py_changed" == true ]]; then echo "Python files changed, querying all Python tests..." result=$(bazel query --keep_going --noshow_progress \ "kind(test, //py/...) except attr('tags','manual', //py/...) except attr('tags','lint', //py/...)" 2>/dev/null \|\| true) if [[ -n "$result" ]]; then count=$(echo "$result" \| wc -l \| tr -d ' ') echo "Finished //py/...: ${count} targets" test_targets="$result" else echo "Finished //py/...: 0 targets" fi fi bindings=("//java/..." "//rb/..." "//dotnet/..." "//javascript/selenium-webdriver/...") for binding in "${bindings[@]}"; do echo "Starting query for ${binding}..." result=$(bazel query --keep_going --noshow_progress \ "kind(test, rdeps(set(${binding}), set(${source_targets}))) \ except attr('tags','manual', set(${binding})) \ except attr('tags','lint', set(${binding}))" 2>/dev/null \|\| true) ... (clipped 8 lines) Learn more about managing compliance generic rules or creating your own custom rules
⚪	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Unvalidated HTTP responses: External HTTP responses are parsed and dereferenced (e.g., `r.data` and nested fields like `release["artifacts"]`) without checking HTTP status or validating expected keys/types, which may cause incorrect pinning or crashes on malformed API responses. Referred Code def get_edge_versions(platform): """Fetch all available Edge browser versions for a platform from enterprise API.""" r = http.request( "GET", "https://edgeupdates.microsoft.com/api/products?view=enterprise" ) all_data = case_insensitive_json_loads(r.data) platform_name = "MacOS" if platform == "mac" else "Linux" artifact_name = "pkg" if platform == "mac" else "deb" versions = [] for data in all_data: if data.get("product") != "Stable": continue for release in data["releases"]: if release.get("platform") != platform_name: continue for artifact in release["artifacts"]: if artifact["artifactname"] == artifact_name: versions.append( { ... (clipped 6 lines) Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

qodo-code-review · 2026-01-18T03:58:59Z

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
High-level	Re-evaluate the CDP versioning strategy The current method of copying entire packages for new CDP versions leads to code bloat. It is suggested to improve the code generation to use abstract templates, reducing duplication and easing future updates. Examples: java/src/org/openqa/selenium/devtools/v144/v144Target.java [18-110] package org.openqa.selenium.devtools.v144; import java.util.List; import java.util.Map; import java.util.Optional; import java.util.function.Function; import java.util.stream.Collectors; import org.openqa.selenium.devtools.Command; import org.openqa.selenium.devtools.ConverterFunctions; import org.openqa.selenium.devtools.Event; ... (clipped 83 lines) dotnet/src/webdriver/DevTools/v144/V144Domains.cs [22-70] namespace OpenQA.Selenium.DevTools.V144; /// <summary> /// Class containing the domain implementation for version 144 of the DevTools Protocol. /// </summary> public class V144Domains : DevToolsDomains { private readonly DevToolsSessionDomains domains; /// <summary> ... (clipped 39 lines) Solution Walkthrough: Before: // Before: Duplicated adapter classes for each CDP version // In v141 package: // File: java/src/org/openqa/selenium/devtools/v141/v141Target.java public class v141Target implements org.openqa.selenium.devtools.idealized.target.Target { @Override public Command<SessionID> attachToTarget(TargetID targetId) { Function<JsonInput, org.openqa.selenium.devtools.v141.target.model.SessionID> mapper = ConverterFunctions.map("sessionId", org.openqa.selenium.devtools.v141.target.model.SessionID.class); return new Command<>( "Target.attachToTarget", Map.of("targetId", new org.openqa.selenium.devtools.v141.target.model.TargetID(targetId.toString()), ...), ... ); } } // In v144 package (largely a copy of v141): // File: java/src/org/openqa/selenium/devtools/v144/v144Target.java public class v144Target implements org.openqa.selenium.devtools.idealized.target.Target { @Override public Command<SessionID> attachToTarget(TargetID targetId) { Function<JsonInput, org.openqa.selenium.devtools.v144.target.model.SessionID> mapper = ConverterFunctions.map("sessionId", org.openqa.selenium.devtools.v144.target.model.SessionID.class); return new Command<>( "Target.attachToTarget", Map.of("targetId", new org.openqa.selenium.devtools.v144.target.model.TargetID(targetId.toString()), ...), ... ); } } After: // After: A single, generic adapter class using reflection or a factory public class GenericTargetAdapter implements org.openqa.selenium.devtools.idealized.target.Target { private final CdpVersionBridge cdpBridge; public GenericTargetAdapter(int cdpVersion) { this.cdpBridge = CdpVersionBridgeFactory.create(cdpVersion); } @Override public Command<SessionID> attachToTarget(TargetID targetId) { Class<?> sessionIDClass = cdpBridge.getClass("target.model.SessionID"); Function<JsonInput, ?> mapper = ConverterFunctions.map("sessionId", sessionIDClass); return new Command<>( "Target.attachToTarget", Map.of("targetId", cdpBridge.createInstance("target.model.TargetID", targetId.toString()), ...), input -> { Object id = mapper.apply(input); return new SessionID(id.toString()); } ); } } Suggestion importance[1-10]: 8 __ Why: The suggestion correctly identifies a significant source of code duplication and maintenance overhead in the CDP versioning strategy and proposes a valid architectural improvement.	Medium
Possible issue	Make cookie expiration property optional Make the `expires` property in `Network.Cookie` optional to align with its comment stating it can be `null`, preventing potential client-side deserialization errors. common/devtools/chromium/v144/browser_protocol.pdl [7733-7737] # Cookie expiration date as the number of seconds since the UNIX epoch. # The value is set to -1 if the expiry date is not set. # The value can be null for values that cannot be represented in # JSON (±Inf). -number expires +optional number expires Apply / Chat Suggestion importance[1-10]: 8 __ Why: This suggestion correctly identifies a contradiction between the comment and the schema for the `expires` property, which could cause deserialization errors in clients.	Medium
Possible issue	Check HTTP status before parsing Add an HTTP status check after the request to `edgeupdates.microsoft.com` to ensure the response is successful before parsing the JSON data. scripts/pinned_browsers.py [179-182] r = http.request( "GET", "https://edgeupdates.microsoft.com/api/products?view=enterprise" ) +if r.status != 200: + return [] all_data = case_insensitive_json_loads(r.data) `[To ensure code accuracy, apply this suggestion manually]` Suggestion importance[1-10]: 6 __ Why: The suggestion correctly identifies a missing HTTP status check, which improves the script's robustness by preventing potential errors from non-200 responses.	Low
Learned best practice	Remove redundant null handling Since callers already guard `description != null`, remove the redundant null check and make the helper non-null to avoid dead logic and clarify expectations. java/src/org/openqa/selenium/devtools/CdpClientGenerator.java [1417-1423] private static String sanitizeJavadoc(String description) { - if (description == null) { - return null; - } // Escape / sequences which would prematurely close the JavaDoc comment return description.replace("/", "/"); } Apply / Chat* Suggestion importance[1-10]: 6 __ Why: Relevant best practice - Reduce duplication and remove redundant/dead logic by centralizing behavior without ineffective checks.	Low
General	Fix typo in comment Correct a typo in a comment, changing "noode" to "node". common/devtools/chromium/v144/browser_protocol.pdl [118] -# - from 'activeFullscreenElement' to 'uninteresting': reasons why this noode is hidden +# - from 'activeFullscreenElement' to 'uninteresting': reasons why this node is hidden Apply / Chat Suggestion importance[1-10]: 2 __ Why: This suggestion correctly identifies and fixes a typo in a comment, which improves code clarity and maintainability.	Low
More

Copilot

Pull request overview

This PR prepares Selenium for the 4.40.0 release by updating versions, browser/driver versions, CDP support, and dependencies across all language bindings (Java, Python, Ruby, JavaScript, .NET, and Rust).

Changes:

Updated Selenium version from 4.40.0-SNAPSHOT/nightly to 4.40.0 across all bindings
Updated CDP support from v141 to v144 for Chrome DevTools Protocol
Updated browser versions (Edge 143 → 144, Firefox 147.0 → 147.0.1)
Updated Maven dependencies (multiple libraries including netty, opentelemetry, junit, mockito)
Improved Edge browser/driver matching logic in pinned_browsers.py
Fixed Windows batch script variable escaping in .NET nuget_push.bzl
Updated AUTHORS file and changelogs

Reviewed changes

Copilot reviewed 56 out of 60 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
java/version.bzl	Java version updated to 4.40.0
py/selenium/init.py	Python version updated to 4.40.0
rb/lib/selenium/webdriver/version.rb	Ruby version updated to 4.40.0
javascript/selenium-webdriver/package.json	JavaScript version updated to 4.40.0
dotnet/selenium-dotnet-version.bzl	.NET version updated to 4.40.0
rust/Cargo.toml	Selenium Manager version updated to 0.4.40
java/src/org/openqa/selenium/devtools/v144/*	New CDP v144 implementation files
dotnet/src/webdriver/DevTools/v144/*	New CDP v144 .NET implementation files
scripts/pinned_browsers.py	Refactored Edge browser/driver matching logic
java/maven_install.json	Updated Maven dependencies
dotnet/private/nuget_push.bzl	Fixed Windows batch variable escaping
common/devtools/chromium/v144/*	Updated CDP protocol definition files
AUTHORS	Added new contributors

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

MODULE.bazel

qodo-code-review · 2026-01-18T22:10:47Z

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
⚪	Supply chain integrity Description: The PR updates remote binary downloads (Selenium Manager executables) fetched at build time, and while `sha256` pinning is present, there is no additional authenticity verification (e.g., signature/cosign/SLSA provenance), leaving a realistic supply-chain risk if the upstream release account or distribution path is compromised. selenium_manager.bzl [6-25] Referred Code http_file( name = "download_sm_linux", executable = True, sha256 = "90c81fbaf5b6c3ba6a5d00481634917cf714074783d8543de737c31f6652b687", url = "https://github.com/SeleniumHQ/selenium_manager_artifacts/releases/download/selenium-manager-966ed44/selenium-manager-linux", ) http_file( name = "download_sm_macos", executable = True, sha256 = "ee4c1db828eb7a370d2defc67adf77364b7362ccd413714bd4405ea8fc2d917f", url = "https://github.com/SeleniumHQ/selenium_manager_artifacts/releases/download/selenium-manager-966ed44/selenium-manager-macos", ) http_file( name = "download_sm_windows", executable = True, sha256 = "088599c2f7d69a392b02ef44da98e77d1aa423673c7c5e265bdfadde99f4fdf5", url = "https://github.com/SeleniumHQ/selenium_manager_artifacts/releases/download/selenium-manager-966ed44/selenium-manager-windows.exe", )
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
🔴	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Unclear constant name: The new constant `id` is not self-describing and does not follow conventional constant naming, obscuring that it represents the CDP/DevTools protocol version. Referred Code private const int id = 144; Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

qodo-code-review · 2026-01-18T22:11:53Z

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
High-level	Consider a more scalable CDP versioning strategy The current method of copying entire packages for new CDP versions creates significant code duplication. Adopt a more scalable approach using inheritance or composition to only implement the differences between versions, reducing code bloat and simplifying future updates. Examples: java/src/org/openqa/selenium/devtools/v144/v144Domains.java [29-44] public class v144Domains implements Domains { private final v144Javascript js; private final v144Events events; private final v144Log log; private final v144Network network; private final v144Target target; public v144Domains(DevTools devtools) { Require.nonNull("DevTools", devtools); ... (clipped 6 lines) dotnet/src/webdriver/DevTools/v144/V144Domains.cs [27-70] public class V144Domains : DevToolsDomains { private readonly DevToolsSessionDomains domains; /// <summary> /// Initializes a new instance of the V144Domains class. /// </summary> /// <param name="session">The DevToolsSession to use with this set of domains.</param> /// <exception cref="ArgumentNullException">If <paramref name="session"/> is <see langword="null"/>.</exception> public V144Domains(DevToolsSession session) ... (clipped 34 lines) Solution Walkthrough: Before: // File: .../devtools/v141/v141Domains.java public class v141Domains implements Domains { private final v141Javascript js; private final v141Events events; private final v141Log log; private final v141Network network; private final v141Target target; public v141Domains(DevTools devtools) { events = new v141Events(devtools); js = new v141Javascript(devtools); // ... more initializations } // ... methods returning v141 domain objects } // File: .../devtools/v144/v144Domains.java (newly added, mostly a copy) public class v144Domains implements Domains { private final v144Javascript js; private final v144Events events; // ... other domains public v144Domains(DevTools devtools) { events = new v144Events(devtools); js = new v144Javascript(devtools); // ... more initializations } // ... methods returning v144 domain objects } After: // Base implementation for a generic CDP version public abstract class CdpDomainsBase implements Domains { // ... common logic and fields } // v141 implementation public class v141Domains extends CdpDomainsBase { public v141Domains(DevTools devtools) { // ... initialize v141 domains } // ... v141 specific implementations } // v144 implementation inherits from v141 public class v144Domains extends v141Domains { // Only override what has changed in v144. private final v144Network network; // Assume Network domain changed public v144Domains(DevTools devtools) { super(devtools); // Initialize with v141 logic // Override only the changed parts this.network = new v144Network(devtools); } @Override public Network getNetwork() { return this.network; // Return the new v144 network implementation } // Other domains (js, events, log, target) are inherited from v141Domains } Suggestion importance[1-10]: 9 __ Why: This is an excellent high-level architectural suggestion that correctly identifies significant code duplication and maintenance issues in the current CDP versioning strategy, which is a major part of this PR.	High
General	Make deprecated command parameter required In the deprecated `grantPermissions` command, make the `origin` parameter required instead of optional to avoid ambiguity. common/devtools/chromium/v144/browser_protocol.pdl [1856-1864] # Grant specific permissions to the given origin and reject all others. Deprecated. Use # setPermission instead. experimental deprecated command grantPermissions parameters array of PermissionType permissions - # Origin the permission applies to, all origins if not specified. - optional string origin + # Origin the permission applies to. + string origin # Context to override. When omitted, default browser context is used. optional BrowserContextID browserContextId Apply / Chat Suggestion importance[1-10]: 5 __ Why: The suggestion correctly identifies that the `origin` parameter is optional in the deprecated `grantPermissions` command and proposes making it mandatory to improve clarity, which is a reasonable API design improvement.	Low
	Sort the versions array Sort the `SupportedDevToolsVersions` array numerically to improve readability and maintainability. dotnet/src/webdriver/DevTools/DevToolsDomains.cs [37-42] private static int[] SupportedDevToolsVersions => [ 142, + 143, 144, - 143, ]; Apply / Chat Suggestion importance[1-10]: 3 __ Why: The suggestion correctly identifies that the `SupportedDevToolsVersions` array is unsorted and proposes sorting it, which improves code readability and maintainability.	Low
	Sort the versions list Sort the `SUPPORTED_DEVTOOLS_VERSIONS` list to improve readability and maintainability. dotnet/selenium-dotnet-version.bzl [7-11] SUPPORTED_DEVTOOLS_VERSIONS = [ + "v142", "v143", "v144", - "v142", ] Apply / Chat Suggestion importance[1-10]: 3 __ Why: The suggestion correctly identifies that the `SUPPORTED_DEVTOOLS_VERSIONS` list is unsorted and proposes sorting it, which improves code readability and maintainability.	Low
	Mark deprecated command as experimental Mark the deprecated `getStorageKeyForFrame` command as `experimental` for consistency with the new `getStorageKey` command. common/devtools/chromium/v144/browser_protocol.pdl [12624-12630] # Returns a storage key given a frame id. # Deprecated. Please use Storage.getStorageKey instead. -deprecated command getStorageKeyForFrame +experimental deprecated command getStorageKeyForFrame parameters Page.FrameId frameId returns SerializedStorageKey storageKey Apply / Chat Suggestion importance[1-10]: 3 __ Why: The suggestion proposes adding the `experimental` keyword to a command that is already marked as `deprecated`. While this might improve consistency, its impact is minor as the command is already being phased out.	Low
	Fix typo in comment Fix a typo in a comment, changing "noode" to "node" for clarity. common/devtools/chromium/v144/browser_protocol.pdl [118] -# - from 'activeFullscreenElement' to 'uninteresting': reasons why this noode is hidden +# - from 'activeFullscreenElement' to 'uninteresting': reasons why this node is hidden Apply / Chat Suggestion importance[1-10]: 2 __ Why: The suggestion correctly identifies and fixes a typo in a code comment, which is a minor but useful improvement for code clarity and maintainability.	Low
More

selenium-ci force-pushed the release-preparation-4.40 branch 2 times, most recently from f97ef11 to bc4c724 Compare January 18, 2026 00:13

titusfortner requested a review from Copilot January 18, 2026 03:55

titusfortner marked this pull request as ready for review January 18, 2026 03:56

Copilot started reviewing on behalf of titusfortner January 18, 2026 03:56 View session

qodo-code-review bot added the Review effort 4/5 label Jan 18, 2026

Copilot AI reviewed Jan 18, 2026

View reviewed changes

MODULE.bazel Show resolved Hide resolved

titusfortner marked this pull request as draft January 18, 2026 05:39

selenium-ci force-pushed the release-preparation-4.40 branch 2 times, most recently from e1c96c0 to 4825efb Compare January 18, 2026 11:16

selenium-ci added 7 commits January 18, 2026 20:46

update pinned browser versions

a05430f

update devtools versions

7cf901f

update selenium manager versions

086303f

update maven dependency versions

83cb853

update authors file

c33e842

bump versions in preparation for release

d9fb021

changelogs updated

38e37bd

selenium-ci force-pushed the release-preparation-4.40 branch from 4825efb to 38e37bd Compare January 18, 2026 20:53

titusfortner marked this pull request as ready for review January 18, 2026 22:09

qodo-code-review bot added the Review effort 3/5 label Jan 18, 2026

titusfortner merged commit b3333f1 into trunk Jan 18, 2026
55 checks passed

titusfortner deleted the release-preparation-4.40 branch January 18, 2026 22:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[build] Prepare for release of Selenium 4.40#16931

[build] Prepare for release of Selenium 4.40#16931
titusfortner merged 7 commits intotrunkfrom
release-preparation-4.40

selenium-ci commented Jan 17, 2026 •

edited by qodo-code-review bot

Loading

Uh oh!

qodo-code-review bot commented Jan 18, 2026

Uh oh!

qodo-code-review bot commented Jan 18, 2026

Examples:

Solution Walkthrough:

Before:

After:

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

qodo-code-review bot commented Jan 18, 2026

Uh oh!

qodo-code-review bot commented Jan 18, 2026

Examples:

Solution Walkthrough:

Before:

After:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

selenium-ci commented Jan 17, 2026 • edited by qodo-code-review bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Updates Applied

PR Type

Description

Diagram Walkthrough

File Walkthrough

Uh oh!

qodo-code-review bot commented Jan 18, 2026

PR Compliance Guide 🔍

Uh oh!

qodo-code-review bot commented Jan 18, 2026

PR Code Suggestions ✨

Examples:

Solution Walkthrough:

Before:

After:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

qodo-code-review bot commented Jan 18, 2026

PR Compliance Guide 🔍

Uh oh!

qodo-code-review bot commented Jan 18, 2026

PR Code Suggestions ✨

Examples:

Solution Walkthrough:

Before:

After:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

selenium-ci commented Jan 17, 2026 •

edited by qodo-code-review bot

Loading