lightpanda-io/browser 0.3.5

on GitHub

New Web APIs

• SharedWorker
• EventSource (including relative URLs)
• IndexedDB (base implementation)
• DOMPoint / DOMPointReadOnly; improved DOMRect
• Various SVG types; SVGAElement.relList
• Static Response.json, Response.error, Response.redirect
• GamepadEvent, new event interfaces
• HTMLScriptElement.supports, DOMTokenList.supports
• Accessibility.getPartialAXTree (CDP)
• 6 more interfaces exposed on Worker
• structuredClone for host (Zig) objects

Events

• Handler returning false cancels the event; window.event rules; createEvent; timeStamp
• Event interface conformance: isTrusted, constructor defaults, handleEvent
• Click activation, shadow retargeting, passive-by-default listeners
• Listener option validation, window-reflecting handlers, exception propagation
• Dispatch passes, trusted clicks; listener exceptions routed to onerror
• Page.navigatedWithinDocument emitted for same-document navigations (CDP)

DOM

• Range: cloneContents/extractContents/createRange/collapse/deleteContents; replaceChild live-range ordering
• TreeWalker, NodeFilter, NodeIterator spec conformance
• Pre-insert validity, Attr adoption, fragment/replaceChild mutation records
• Insert-adjacent semantics; combined mutation records
• moveBefore reactions, script insertion steps, cookie-averse documents, outerText
• HTMLCollection & named-collection property semantics; table row collections
• document.head, getElementsByName, lastModified, wholeText, UTF-16 offsets
• Class-token whitespace handling; foreign-element attribute matching
• AbortSignal conformance (dependent signals, null reason, timeout after detach)
• Custom elements can extend any HTMLElement interface; fix constructor parser endless recursion
• Attribute reflection for HTMLAreaElement
• All interfaces made non-enumerable; more (and better) replaceable properties
• DOMException flag removed (always on)

CSS / selectors

• @layer block rules applied to the cascade
• Fix class selector doing a substring match
• Quirks-mode class matching; :link/:lang/:empty semantics
• getPropertyValue special width/height handling
• ResizeObserver box option default
• Reject focus() on non-rendered elements (display:none)

CDP (Chrome DevTools Protocol)

• Emit non-UTF-8 header values as Latin-1 strings rather than byte arrays
• Support explicit browser-context session_id; expose the Lightpanda version
• Send a going-away close frame (1001) on pending terminate
• Don't warn "unimplemented" when deviceScaleFactor == 1

Agent / MCP / scripting

• MCP: HTTP transport and multi-session support
• Agent: assistant text streaming, markdown rendering in REPL output, Google Vertex AI support
• Agent: multi-line slash commands, --save .js extension, intent comments in saved scripts
• Generate the PandaScript skill from the tool schemas
• Agent regression suite added to CI (consumed from lightpanda-io/demo), published to Slack, run nightly
• Script: reject failed goto starts outside the browser isolate; fix two replay crashes

HTTP / Networking

• HttpClient refactor; curl_easy_setopt refactor
• Cache: simple heuristic caching
• fetch honors the redirect option (manual and error modes)
• Faster certificate loading on Linux/BSD; prefer X509_STORE over ca_blob
• Default max HTTP size set to 1GB (was unlimited); u32 → usize for very large content lengths
• Disable Expect: 100-continue with curl; increase default max connections
• WebSocket messages processed through the delivery queue; reclaim large WS buffers
• Cookies allowed on a bare domain matching the public suffix list
• Don't buffer the body on a non-200 robots response
• Handle text/markdown as plain text; fix charset=unicode HTML prescan fallback

Performance / memory

• Pre-parse HTML to find and preload scripts
• Embed element attributes; replace the attribute linked list with an array
• Cache parsed selectors per frame; cache the computed-style object per element
• Use cachedParse for closest and waitForSelector
• Iframes with loading=lazy no longer delay the parent's load event
• Enforce a minimum timer delay on nested timers
• Bound scroll task allocations; tighten DOM allocation lifetimes
• local_arena added; Request/URLSearchParams and more non-DOM types finalized
• V8 configuration option + heap-limit protection; more headroom at nearHeapLimit

Stability fixes

• Watchdog for JS hangs
• Increase HTMLCollection refcount from u8 to u32 (crash)
• Dupe blobs before use to survive revokeObjectURL (UAF)
• Fix crash when MessageEvent.source is called from a worker
• Rework how v8::Globals are managed; detach from the original context when re-using a window
• Use the element's owner frame when mutating attributes; fix broken cross-frame attribute lookup
• Don't strip a leading BOM for non-document parsing

CLI / Ops

• New update command
• Help output paged through $PAGER when stdout is a tty; standardized help options
• Prometheus metrics
• networkIdle lifecycle events emitted for child frames
• Reduced logging of JsException on event dispatch; stop logging TryCatchRethrow errors
• Use the getrandom syscall for std.crypto.random