v0.2.2
A wide compatibility and robustness pass: generated CDP clients (chromiumoxide, spider) now work end to end, Playwright form filling and context setup complete, one page script can no longer starve or crash the engine, and the stealth transport closes its remaining SSRF gaps. 126 commits since v0.2.1.
Highlights
• Generated CDP clients work. Page.enable emits the initial load sequence once per page with a schema-complete frame, so chromiumoxide's new_page no longer hangs before the first navigation and its strict Frame parser accepts every payload (#833, #703).
• Playwright form filling and context setup complete. Input.insertText is implemented, Element.labels and HTMLLabelElement.control follow the HTML labelable-element rules so getByLabel resolves, Browser.grantPermissions is accepted during context init, and PerformanceObserver.supportedEntryTypes reports the types the engine emits (#577).
• One bad script cannot starve a page. A throwing script or unhandled rejection is logged and the event loop keeps scheduling, matching Chrome; the bounded, quiescent, autonomous, and load-delaying pumps all continue (#699).
• Worker processes survive deep and hostile pages. The style cascade runs on an explicit stack instead of recursing per DOM level, deeply nested timers are clamped, fetched_urls and fetch response bodies are capped, and watchdog threads are cancelled on drop (#705, #580).
• Binary content survives end to end. XHR and fetch response bodies are read as bytes, Request headers and binary bodies are preserved, and Response.body/bodyUsed are exposed (#818).
CDP and protocol
• Runtime.evaluate and callFunctionOn report thrown or rejected values through exceptionDetails, the field clients rebuild page errors from (#746).
• Execution contexts are owned by their session, and evaluation handles survive tab switches (#800).
• Input.dispatchKeyEvent embeds key and code as JSON string literals, and objectId lookup sites embed the id the same way (#819).
• DOM.getBoxModel returns Chrome-shaped integer coordinates, and a resolution failure is a real protocol error instead of a placeholder quad (#576).
• The initial containing block is the viewport, so fixed and absolute boxes resolve bottom and percentage insets correctly (#675).
Security
• The SSRF deny-set covers IPv6 embedded-IPv4 (6to4/NAT64), CGNAT, and IANA special-purpose ranges, and the stealth client applies the same DNS guard and honors --allow-private-network (#810, #816).
• Platform and user-agent overrides are embedded as JSON string literals, closing a script-injection path through profile setters (#792).
• URL.createObjectURL rejects non-Blob input and mints Chrome-shaped blob URLs from a CSPRNG (#820).
• PBKDF2 iteration and output caps landed earlier in this cycle (#580).
Rendering
• Text inputs paint their value, and textarea lays out as a real control box (#685).
• The screenshot warmup fetches only the font sources the renderer will use, not every entry in a src list (#667), and the capture fallback reuses the retained resource cache.
• SVG symbol glyph fallbacks render, and image paint is skipped only when the source truly failed (#698).
DOM and JavaScript
• postMessage honors targetOrigin, stopping cross-origin leaks between frames (#704).
• HTMLInputElement.indeterminate is implemented, and label activation clicks the associated control (#732).
• new FormData(form) reads the form and keys()/values() are iterable (#803).
• Promise rejections dispatch unhandledrejection events, and the ICU default locale is pinned so Intl agrees with navigator.language (#734).
• <body onload> content attributes fire, and inline text whitespace serializes correctly (#768, #785).
MCP and packaging
• MCP drains a synthesized navigation before the tool replies, so a click on a submit button issues its request before the answer returns (#618).
• Binaries self-report their version: the tag at release time, and 0.1.0-dev+ for local builds. MCP serverInfo reports the same value as the CLI.
• The bundled-stealth download note was corrected: WebGL/GPU rendering claims removed (#733).
Contributors
Thanks to @mnaza, @xrip, @963s, @ntdatt812, @enginespot, @alkaz-nodemaven, @lisa0314, @alexskinner, @aech, @Jerc92, @Vrejf, @ousamabenyounes, @rubenssoto, and @404human for contributions to this release.
Full Changelog: v0.2.1...v0.2.2