3.14.0 (April 21, 2026)

• Drop ?url query bypass in CSS loaders, add end-to-end regression spec (0e529e9)
• Pin @rspack/dev-server to ^1.2.1 until @rspack/core 2.x ships stable (64bbd22)
• Default --install to off on extension create (ecef884)
• Collapse CLI telemetry to 2 events with sampling, cap, and dedup (450206d)
• Fix follow-redirects auth header leak vulnerability (GHSA-r4q5-vmmm-2653) (43fcde8)
• Update --help and --ai-help with Docker, --host, and Flatpak Firefox docs (2064138)
• Add CDP pipe transport and CDP-first extension loading (d54c790)
• Add --host flag and Docker/devcontainer support (6ff4c5c)
• Harden --source across platforms and tighten commands/* orchestration (91ee110)