Axis Browser v0.2.3

Upgraded the runtime from Electron 37 to Electron 39.8.5 (newer Chromium and Node), aligning with current security fixes—including high-severity issues addressed in recent Electron releases (see Dependabot / advisory details on the upgrade PR).
devDependency pinned to 39.8.5 in package.json so installs match the audited version rather than a loose range.
Main process compatibility
- session.registerPreloadScript now uses the Electron 39 shape: { filePath, type: 'frame' } (a bare path string is no longer valid).
- webPreferences on the main and incognito windows were trimmed to supported options for this Electron line: removed long-removed / ignored keys (enableRemoteModule, old enableWebGL-style flags, legacy network/GPU toggles inside webPreferences, etc.) and kept performance-related settings that still exist (v8CacheOptions, enableBlinkFeatures, webgl, experimentalFeatures, webSecurity, backgroundThrottling). Command-line performance switches in applyPerformanceFlags are unchanged.

Problem: Global shortcuts (new tab, close tab, refresh, sidebar, etc.) were wired to the main browser window. With incognito focused, shortcuts could do nothing useful or appear to affect the wrong window—even when the normal window was not the one you were using.
Fix: Shortcut registration now targets the currently focused Axis window (getActiveAxisWindow), with focus/blur hooks so accelerators follow whichever window is frontmost. Incognito and normal windows both receive the same shortcut behavior when active.

Reduced opacity on core chrome variables so the window frame and sidebar read as tinted glass rather than solid panels: background, sidebar, and subtle popup surfaces use lower-alpha fills so desktop and content behind the app show through more clearly.
Keeps readability while making the shell feel lighter and more atmospheric, especially on macOS where the desktop wallpaper or other windows contribute to the look.

Optional setting (transparentSites): injects compact CSS into each webview so page background (html / body) can go transparent, letting site chrome visually merge with the more translucent browser shell and sidebar.
Uses insertCSS / removeInsertedCSS with a stable key, flushTransparentSitesForWebview, and applies across all tabs on dom-ready and did-finish-load (main frame) so background tabs stay consistent; disabling the option removes injected styles everywhere.
URL bar stays on the glass treatment when this mode is on (no solid white bar): theme sampling and extractUrlBarTheme / applyAppThemeToUrlBar paths respect transparent-site mode, with sequencing so stale theme updates do not flash the wrong fill.

Settings include a speech voice control populated from speechSynthesis.getVoices()—typically dozens to 100+ entries on macOS/Windows depending on installed system voices and language packs.
The first option is Default (empty URI) so Axis uses the system default voice without forcing a specific engine; selection is applied when speaking selected text (utterance.voice when available, with a short wait if the voice list is still loading).

Settings: enable/disable, preset (e.g. rain, warm, focus, ocean, wind, still), and volume (0–100%).
Implemented with Web Audio synthesis in the renderer: light background texture without requiring bundled media files; resume when the window becomes visible again if the browser throttled the audio context.

When sites ask: permission prompts respect per-site overrides stored in sitePermissionOverrides (origin → allow / deny per type; Default means no override).
Handlers on defaultSession, persist:main, and incognito so behavior matches normal vs private browsing; Electron’s media permission is tied to camera and microphone columns (consistent allow/deny semantics).
Settings → Site permissions: clear table with Default / Allow / Block per column, add origin and remove row; persisted via IPC (get-site-permission-overrides / set-site-permission-overrides).
In-app link: opening “site settings” from the security UI goes to Settings → Site permissions instead of an external page.

Lockfile updated so @xmldom/xmldom resolves to 0.8.12 (replacing 0.8.11 pulled in through plist under electron-builder / app-builder-lib).
package.json → overrides also sets @xmldom/xmldom@0.8.12 (honored by npm 8.3+ alongside the lockfile).
Addresses a high severity Dependabot alert on @xmldom/xmldom by taking the patched release from the 0.8.11 → 0.8.12 upgrade path.

Full Changelog: v0.2.2...v0.2.3

Screen.Recording.2026-04-06.at.12.24.07.PM.mov

Provide feedback