Lightpanda Browser Files

CORS (experimental)

CORS is off by default. Enable it with --experimental-features cors.

• CORS implementation: obey cross-origin checks on fetch/XHR instead of allowing them unconditionally
• Origin header + request header validation
• XHR changes for the CORS WPT tests

IndexedDB

• WPT conformance pass
• setName on IDBObjectStore and IDBIndex
• nextunique / prevunique cursor directions
• Keep the upgradeneeded event alive past dispatch; better error handling
• Fix use-after-free reading txn._db after releaseRef frees it

New Web APIs

• CountQueuingStrategy and ByteLengthQueuingStrategy
• resource-timing; Performance is now an EventTarget
• window.stop()
• img.decode()
• navigator.sendBeacon returns true
• Headers.getSetCookie, customElements.getName, Element.part
• HTMLInputElement valueAsNumber, valueAsDate, stepUp/stepDown, showPicker
• SVGGraphicsElement.getCTM and getScreenCTM
• canvas measureText and the drawing methods chart libraries probe
• matchMedia change events and real addListener/removeListener
• Reflect HTMLElement.contentEditable
• Basic support for CSS custom properties

Forms / input

• Text entry: move the cursor on caret keys and to the end on value set; clamp selections against the current value
• Trusted beforeinput is cancelable
• A disabled fieldset disables its controls' activation and validation
• option.selected = true deselects its siblings in a single select
• Fix select value assignment with no matching option

Custom elements

• Upgrade autonomous custom-element clones in place
• Don't upgrade custom elements in a windowless document
• Skip null nodes when a create callback fails

CSS / rendering / performance

• Memoize StyleManager visibility per element
• Append inserted rules to the buckets instead of rebuilding
• Materialize inline styles where layout reads them
• --strip-mode gains shell and clutter options
• Faster nth-* selectors, class matching, attribute lookup, and pseudo-class parsing

Ad blocker

• Run /regex/ filters with PCRE2
• Request engine

Protocols

• WebDriver: HTTP WebDriver session management
• CDP: DOM.focus; honor runImmediately, screenWidth/screenHeight, browserContextId
• CDP: request interception patterns; a context per isolated world per frame
• CDP: wheel events scroll the viewport unless over a scroll container
• CDP: fix message lifetimes and console argument serialization; remove a terminate/disconnect race

HTTP / Networking

• Keep connections alive across navigations; better redirect handling; timeout tweaks
• Enable CURLOPT_PIPEWAIT on every easy handle
• Update curl to 8.22.0
• Cookies: accept Secure and __Host- on loopback origins; apply the SameSite=Lax exception only on safe methods; compute site-for-cookies from a frame's ancestor chain
• Guard WebSocket message-length parsing against integer overflow
• Fix drive-letter lookalike URL segments on non-file schemes

CLI / tools

• --locale and --timezone, with language signals derived from one value
• Suggest the closest flag or command on a typo
• note log level can be silenced; log CLI tips
• Scroll the nearest scroll container from the scroll tool
• Click dispatches a full pointer/mouse sequence, not a bare click event
• Agent: route REPL output per tool and align page tables of any size

Stability / memory

• Crash fixes: TryCatch copied by value, history.state / Navigation.currentEntry, V8 re-entry on an unhandled promise
• Fix Notification use-after-free
• Disconnect runaway intersection observers; raise timer caps
• Leak fixes: robot store, JS terminated during MutationObserver/IntersectionObserver delivery, cloned HTTP responses, V8 backing store
• V8: notify isolate shutdown, restore the initial heap limit, avoid rearming heap termination during teardown
• Disarm the watchdog before protocol teardown