What's Changed
Security, Isolation & Cookie Policies
- fix: validate request headers and randomize CDP identities #2342
- fix(fetch): enforce CORP before redirect and response delivery #2286
- fix(stylesheets): validate integrity before installing CSSOM #2264
- fix(shared-worker): keep agent isolation independent of creator policies #2283
- fix(cookies): apply age-aware Lax-by-default request policy #2181
- fix(cookies): enforce native SameSite contexts for script and network access #2316
Storage, SQLite & IndexedDB
- feat(storage): persist cookies and localStorage in partition SQLite databases #2200
- perf(sqlite): share Tokio task machinery across storage owners #2300
- fix(indexeddb): release finished transaction resources #2210
- fix(indexeddb): keep argument errors in the binding realm #2223
- fix(indexeddb): store native WebTransportError payloads #2112
- fix(cookies): restore Secure cookies with nonsecure source metadata #2236
- fix(storage): scope CDP quota usage to first-party StorageKey #2238
CDP, WebDriver & Browser Automation
- fix(system-info): accept the frontend's browser session (SystemInfo always rejected over real connections) by @neosun100 in #2295
- fix(serve): honor --document-start-script in protocol-server pages by @neosun100 in #2292
- fix(renderer): never reuse backendNodeIds across Documents by @neosun100 in #2293
- fix(webdriver): restore Classic opt-out and BiDi client workflows #2237
- fix(webdriver): preserve scoped node references across Classic and BiDi #2356
- fix(webdriver): unify Classic and BiDi node references #2359
- fix(cdp): resume queued evaluations after history navigation #2358
- fix(cdp): preserve command lifecycle during multi-page Fetch teardown #2163
- fix(cdp): publish timer output while document loading remains pending #2180
- chore(browser-profile): update default Chrome version to 156.0.8078.74 #2227
- perf(drag): read payloads only for accepted interception #2218
Fetch, Referrer & Resource Timing
- feat(dom): retain delivered meta referrer policy on each Document #1358
- fix(referrer): use delivered Document policies for Fetch and XHR #2198
- fix(fetch): propagate explicit referrers and preflight policies #1544
- fix(performance): distinguish cached and validated resource transfers #1678
- fix(fetch): gate Metadata headers on each trustworthy destination #2202
- fix(worker): send typed Fetch Metadata for worker main scripts #2203
- fix(fetch): preserve raw Location bytes across redirect paths #2296
- fix(fetch): preserve combined Content-Type syntax in Body.blob() #2297
Messaging, Workers, Streams & WebSocket
- fix(messaging): derive Window postMessage input conversions #2176
- fix(messaging): prepare transfers before Window target checks #2177
- fix(messaging): preserve closed MessagePort transfer identity #2185
- fix(messaging): cancel closed port queues and release nested transfers #2186
- fix(messaging): preserve accepted Window message source identities #2187
- fix(messaging): preserve opaque origins in Wasm message checks #2193
- refactor(messaging): decouple opaque origins from storage partitions #2234
- fix(clone): allow default payloads with non-default transfer descriptors #2164
- fix(streams): serialize transferred chunks with MessagePort metadata #2173
- fix(streams): cancel readable sources when transfer fails #2174
- fix(streams): notify transfer peers of deserialization errors #2175
- perf(message-port): poll endpoint and queue under one lock #2220
- fix(websocket): ignore unknown binaryType attribute values #2165
- fix(websocket): validate receivers with native brands #2166
- fix(websocket): preserve WebSocketError message code units #2228
- fix(worker): keep navigator caches out of Window identity checks #2219
- fix(runtime): resolve bound owners without author property lookups #2172
- refactor(runtime): remove legacy current-context owner carriers #2204
DOM, HTML & Web APIs
- fix(dom): validate XPathResult receivers and preserve native alias state #1864
- fix(dom): resolve CustomElementRegistry receivers through their native owner #2178
- fix(dom): derive getHTML options and ShadowRoot sequence conversion #2170
- fix(dom): derive slot assignment option dictionaries #2167
- fix(dom): distinguish declarative shadow roots from template contents #2179
- fix(dom): compare foreign node trees in their own arenas #2249
- refactor(dom): derive required nullable Node namespace arguments #2254
- fix(dom): restore copied document URL after cloned base removal #2278
- fix(iframe): finish initial loads around javascript navigation failures #2169
- refactor(dom): remove obsolete fragment prototype lookup #2221
- fix(url): restrict object URL statics to supported realms #2216
- perf(dom): skip frame projection when no child contexts exist #2284
Geometry, SVG, CSS & Events
- feat(geometry): expose native geometry interfaces in workers #2191
- fix(geometry): complete native point operations and WebIDL descriptors #2192
- fix(geometry): convert matrix constructor union inputs #2199
- fix(geometry): preserve non-finite 2D point transforms #2201
- refactor(canvas): derive clearRect receivers and numeric arguments #2257
- fix(svg): preserve inherited fonts and resolve missing families by @KentLee86 in #2255
- fix(stylesheets): recognize unconditional screen media lists by @johannespfeiffer in #2279
- fix(events): derive nullable CSS animation event associations #2333
Modules, Encoding & XML
- feat(modules): support native text module imports #2350
- fix(encoding): preserve x-user-defined form and URL output #2213
- fix(xml): derive and validate XMLSerializer Node arguments #2256
- perf(xml): serialize subtrees into one output buffer #2215
WPT, Testing & CI
- chore(wpt): refresh full wpt-cross case statuses #2162
- test(cdp): arm prepared document.open after parser EOF #2205
- test(bidi): validate locale extension stress-test prefixes #2222
- fix(test-support): drive local producers while awaiting Page work #2224
- test(webidl): cover native TextEncoder destination view policies #2229
- test(ci): bound live cursor probes and synchronize navigation checks #2235
- test(webidl): cover clamped unsigned long derived conversions #2240
- test(svg): cover fill rules and nonfinite query points #2241
- test(webidl): cover ordered derived dictionary sequences #2243
- test(cssom): cover Typed OM font shorthand and adjustment snapshots #2245
- test(dom): preserve MutationRecord node lists across replacement #2246
- test(webidl): cover BufferSource partial write bounds #2242
- test(fonts): cover lazy FontFace loaded rejection ownership #2251
- test(core): prove fetch deadlines interrupt an entered navigation grace #2340
- test(scripts): gate parser stylesheet after runtime load mutation #2339
- test(modules): cover CSS imports in unattached auxiliary Pages #2338
- test(indexeddb): cover retained pending upgrades after realm retirement #2337
- test(indexeddb): cover queued transaction and wrapper collection #2334
New Contributors
- @neosun100 made their first contribution in #2295
- @johannespfeiffer made their first contribution in #2279
- @KentLee86 made their first contribution in #2255
Special Thanks
Special thanks to @neosun100 for responsibly reporting a security vulnerability through a detailed private report. We greatly appreciate the responsible disclosure, thoughtful investigation, and contributions to Moli.
Full Changelog: v1.1.20...v1.1.21