lightpanda-io/browser 1.0.2 on GitHub

Behavior changes

JS page errors now log under a new page_error scope at WARN (silence with --log-filter).
Each top-level page now has its own session history; a second page no longer shows up in the first page's back/forward.
--block-private-networks now blocks more non-routable ranges (CGNAT, benchmarking, multicast, reserved, NAT64).
no-cors fetches with a non-safelisted method are now rejected.
An unreadable --http-cache-dir database is now discarded instead of exiting.
Console values written to the log are now escaped and capped.

Web Crypto: Ed25519, X25519, ECDSA, RSA-PSS, RSASSA-PKCS1-v1_5, wrapKey/unwrapKey + AES-KW; EC and RSA-OAEP import/export
WebCodecs, OfflineAudioContext, WebVTT improvements
XML document parsing
setRangeText() on <input> and <textarea>; textarea.textLength
HTMLProgressElement value/max/position; HTMLOptionElement.index; missing table APIs
document.hasFocus(); window.outerWidth/outerHeight/screenX/screenY/screenLeft/screenTop
:nth-child(An+B of S) and :nth-last-child(An+B of S)
PermissionStatus is now an EventTarget; DOMException is now structured-cloneable; ImageData overload
Missing global event handlers added to window, document and body

Element widths are now resolved relative to their parent (block, inline, floats, %, min/max-width, basic flex)
Client rects (getBoundingClientRect, getClientRects) are now viewport-relative
Mouse events now reach into shadow DOM and iframes
Escape now closes the topmost modal dialog
Iframes inside a shadow root now load when their host connects
replaceWith compliance and cross-document adoption; isEqualNode(null) now returns false
insertAdjacentHTML now works on SVG elements
Trusted key events now report Chrome's legacy keyCode/which/charCode
Text selection offsets now count UTF-16 code units
TextDecoder now only strips a BOM for UTF-8/UTF-16
form.elements now lists fieldset, object and output
Sequence arguments now accept any iterable
Better getComputedStyle().transform
Fixed CSS nested rule parsing; escapes are now decoded in unquoted attribute selectors
Cookies are now sent longest path first, then oldest first
401/407 responses are now delivered as-is when no auth challenge header is present

Fetch.continueRequest interceptResponse is now supported
Fetch.continueWithAuth with Default/CancelAuth now delivers the original 401/407, as Chrome does
Runtime.exceptionThrown is now emitted for unhandled promise rejections, with the context the exception was thrown in
Log.entryAdded is now emitted for resources that fail to load
DOM.scrollIntoViewIfNeeded is now supported (previously a no-op)
LP.getPageStatus added: page issue summary (JS errors, skipped resources, fetch stats). Also included in fetch output when --json is used
Custom ARIA states and focusability are now exposed in the AX tree
Non-UTF-8 status text and headers are now reported as strings rather than a byte array
Permission overrides are now cleared when a browser context closes

serve --unix-socket <path> added: CDP over a Unix domain socket
--remote-allow-origins added: allow CDP connections that send an Origin header (rejected by default), matching Chrome
serve now honors --cookie-jar: the jar is saved when a connection closes. With multiple connections, last write wins
fetch --dump structured_data added
fetch --markdown-alternate added: follow a page's text/markdown alternate. text/markdown documents are now dumped as-is

Reworked TaggedOpaque (less memory)
The scheduler now runs from a snapshot and no longer runs after every script evaluation
Faster forgiving base64 decode
UAF fixes: blob navigation, attribute change, file→blob layout; recursive close during load
Script rejects no longer run microtasks mid-evaluation