fix: relax selenium exact pin to allow Appium 3 compatibility (#1312)

[mikahanninen]

Summary

• Fixes RPA Framework 31.1.0 pins selenium==4.15.2, breaking Edge auto-driver download due to deprecated msedgedriver.azureedge.net #1312 — selenium==4.15.2 exact pin prevented installing rpaframework alongside appium-python-client (Appium 3)
• Constraint changed to selenium>=4.16.0,<5.0.0 — allows any 4.x release ≥ 4.16.0 (4.16 needed for native FirefoxOptions.binary_location)
• Selenium upgraded in lock file: 4.15.2 → 4.41.0
• Bumped rpaframework version: 31.1.2 → 31.2.0
• Bumped rpaframework-core version: 12.1.0 → 12.1.1 (EdgeDriver BOM fix, see below)

Changes

Bug fixes / compatibility

File	Change
packages/main/pyproject.toml	==4.15.2 → >=4.16.0,<5.0.0, version bump to 31.2.0
packages/main/uv.lock + root uv.lock	selenium 4.15.2 → 4.41.0
Selenium.py imports	Switched to concrete submodule paths to fix pylint no-name-in-module
Selenium.py _send_command_and_get_result	Replaced removed _url HTTP hack with execute_cdp_cmd; added Chromium guard
Selenium.py FirefoxOptions	Removed subclass workaround for binary._start_cmd (obsolete since 4.16)
Selenium.py add_virtual_authenticator	Use constructor kwargs instead of post-construction attribute assignment

EdgeDriver UTF-16 BOM fix (rpaframework-core 12.1.1)

Root cause: Microsoft's LATEST_RELEASE_<major>_WINDOWS endpoint returns the version string as UTF-16 LE with a BOM (\xff\xfe bytes). requests decodes this to a Python string starting with \ufeff. webdriver-manager 4.0.2 only calls .rstrip() which strips trailing whitespace but leaves the leading \ufeff intact. That BOM gets URL-encoded as %EF%BB%BF in the download URL → 404.

Reproducer:

import requests
r = requests.get("https://msedgedriver.microsoft.com/LATEST_RELEASE_145_WINDOWS")
print(repr(r.text[:20]))  # '\ufeff145.0.3800.97\r\n'

Fix: EdgeChromiumDriver subclass in RPA.core.webdriver overrides get_latest_release_version() and get_stable_release_version() to strip \ufeff before returning. Registered via a matching EdgeChromiumDriverManager subclass.

This is a bug in webdriver-manager 4.0.2 (latest). The fix lives in rpaframework-core so users are not blocked waiting for an upstream release.

Release order after merge:

1. Publish rpaframework-core 12.1.1
2. Bump rpaframework-core>=12.1.1 in packages/main/pyproject.toml, regenerate lock, publish rpaframework 31.2.0

New keywords (selenium 4.x)

Keyword	Description
Find Element Above/Below/To Left Of/To Right Of/Near	Relative locators (selenium 4.x)
Get Browser Logs	Chromium-only; returns CDP log entries
Block URLs / Unblock URLs	CDP network interception
Wait For Network Request	Polls window.performance resources; raises TimeoutException
Add Virtual Authenticator / Remove Virtual Authenticator	WebAuthn testing (Chromium-only)

All Chromium-only keywords raise NotImplementedError with a clear message on non-Chromium drivers.

Tests & tooling

File	Change
test_browser.py	TestRelativeLocators, TestBrowserLogs, TestNetworkInterception, TestVirtualAuthenticator classes; updated import guard
tests/resources/relative_locator_test.html	New HTML fixture for relative locator tests
packages/core/tests/python/test_edge_driver.py	Standalone EdgeDriver integration test (run on Windows); verifies BOM strip + download + headless session
.github/workflows/main.yaml	build-wheel PR job: builds wheel, uploads artifact, posts comment with download link; pinned to Python 3.11
packages/main/scripts/pre-push.sh	Pre-push hook: pylint + fast tests + AI review before every push
packages/main/scripts/ai-review.sh	Pipes branch diff through claude --print for local Cursor-bot-style review (advisory, never blocks push)

Test plan

• CI passes on all matrix (Windows/Ubuntu/macOS × Python 3.9/3.10/3.11)
• test_selenium_api_imports — all production selenium imports remain resolvable
• test_selenium_constraint_is_not_exact_pin — guards against re-introducing an exact pin
• test_edge_driver.py — run manually on Windows where Edge is installed; verifies BOM strip, EdgeDriver download, and headless session

🤖 Generated with Claude Code

[github-actions]

Wheel artifact

Built from commit d156ddd — download from the workflow run (Artifacts section at the bottom of the page).

Artifact name: rpaframework-wheel (retained 14 days)

[cursor]

Browser logs test misplaced in network interception class

Low Severity

The parametrized test_get_browser_logs_raises_for_non_chromium test is placed inside TestNetworkInterception instead of TestBrowserLogs, where it logically belongs. This makes the test organization misleading since there's already a dedicated TestBrowserLogs class for browser log tests.

 

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Shell expansion mangles diff content in review script

Low Severity

The PROMPT variable is assigned using double quotes, and $DIFF is interpolated inside it at line 58. Any $, backtick, or $(...) sequences in the git diff content will be interpreted by the shell — $HOME becomes the home directory path, $(cmd) gets executed, etc. Python code diffs frequently contain $ (regex, string templates). The PROMPT assignment or the echo "$PROMPT" pipe needs to avoid shell expansion of the diff content.