esdev@0.26.0

Security

• --tls-crl=<file> (DECISIONS D202) is taken wherever --tls-ca is, and
  esdev start passes it to its server. Programs run by esdev get client
  certificates (D201) and setSecureContext (D200) as under esrun.

• esdev upgrade refuses a release whose archive is not listed in, or does
  not match, its checksums.txt (DECISIONS D198); it used to install the
  download unchecked. esdev create's npm registry lookups and the program's
  fetch use the runtime's own HTTP client, as under esrun.

• --tls-ca=<file|bundled> (DECISIONS D197) is taken by every command that
  runs a program, and by esdev start and esdev preview, which use it for
  the server they start and for an https dev.server.proxy target. As under
  esrun, the program's fetch now verifies against the bundled roots or what
  --tls-ca lists, not the operating system's store.

• A program run by esdev no longer sends fetch requests or --otel spans
  through a proxy named by HTTP_PROXY, HTTPS_PROXY or ALL_PROXY, the
  same as under esrun.

• esdev's dev proxy no longer trusts the eMudhra roots Mozilla removed after
  the October 2026 intermediate CA key compromise ("emSign Root CA - C1",
  "emSign ECC Root CA - C3"; webpki-roots 1.0.11).

Fixed

• esdev test --browser resolves runtime:test again. The 0.25 alias plugin
  treated every URL-shaped specifier as a path and skipped it, so
  runtime:test — which parses as scheme runtime — was left as an external
  import the browser could not load. An exact alias match now always applies;
  only a prefix match on a path or URL is skipped.