4.1.13 (September 5, 2026)

Fixes

• Resolve manifest JSON resources from a public folder beside the manifest (feb10505)
• Resolve a re-pointed output folder the way the bundler does (a5e63c18)
• Resolve a session path the way dev anchors it in every reader command (d2759640)
• Resolve the lockfile under the release-age rule Dependabot applies (76917323)

Other changes (61)

• Match emitted asset names with forward slashes in the WAR scan (386178eb)
• List the minimizer parity output with posix separators in the spec (5cdc94e7)
• Print public folder placement notes with forward slashes (99b54b32)
• Canonicalize the CSS issuer path before naming its url() targets (1ace0855)
• Pin the create failure telemetry to the advertised starter rule (9800a9ea)
• Ask a package manager for its version through a shell on Windows (cd732872)
• Rewrite CSS module urls for content scripts and match sheets through symlinks (a095c8b7)
• Name the copied public file when a plain JSON ref lives under public (6884d63b)
• Point a content script stylesheet's url() targets at the extension (cbd7bce6)
• End a logs follow when the session it follows is gone (452d4530)
• Reload the extension when a file under the public folder changes in dev (9587e5ff)
• Publish the asset module declares from a script file so they apply (b5b1cfb6)
• List the chunks a content script imports on demand in the production WAR (e30d1083)
• Name a page's static assets by their path so two pages never collide (1c97780e)
• Keep theme images and theme icons apart when they share a basename (67a8e934)
• Keep one action surface on a chromium MV2 manifest and say which (57d76451)
• Treat storage/managed_schema as critical JSON under either spelling (042e501f)
• Refuse a gesture-gated open surface up front and name a 4003 cause (b7177e9f)
• Replay programmatic script injections after a scripts folder edit (a1fc60e8)
• Pin the css parity rubrics and the logs file round trip in specs (73187c93)
• Emit the asset and stylesheet module declares into extension-env.d.ts (98601b8c)
• Keep extension-create at the released version (c0f2f3c4)
• Key dev instrumentation on the dev session, not the bundler mode (fcbc64e2)
• Keep a stylesheet the parser rejects on the same rules in production (b652657a)
• Narrow a log line once at the parse boundary (b90f25ff)
• Warn when a PostCSS config exists but cannot be loaded (c33dd2ef)
• Say what the optional-deps resolver swallowed under verbose (12ac213c)
• Emit dev source maps that point at the author's source lines (25966430)
• Honor an ISO --since in logs and name a missing locale file (b4922e5b)
• Give a scaffold one package manager from declaration to install (51c29b06)
• Read a _MSG reference the same way in the build and the launch check (f440606e)
• Derive the messaging checker's surface from the files that print (e6048ea4)
• Send only an advertised starter name in create telemetry (cd0ea07d)
• Default create to typescript with a bundled offline fallback (218e3b85)
• Scaffold into an existing repository without taking it over (93b751b6)
• Keep the author's security contract in a dev build and name what changes (6ff27eed)
• Finish SWC setup before a one-shot development build starts (9a9fdc63)
• Let a page accept its own hot update and clear the root it mounts on (b54cf07f)
• Honor the per-command browser in extension.config on every command (a647166f)
• Describe the folder preview loaded in its run record (7fe3c4da)
• Tell a companion entry that is not a store link or a folder apart (8458cc04)
• Load a browser-named companion folder only for that browser (2845856f)
• Layer env files at config time and keep shell values on top (fb3128f3)
• Let a browser config section outrank a top-level default (789cd5b5)
• Keep a page's base href for its links and its files for the build (ae6b83fd)
• Compile JSX pages for the framework a project installs (6826a4d0)
• Derive swc targets from the floor of the browser being built (63b9862f)
• Ship the page_action popup as its own page beside the toolbar popup (72e5a5cb)
• Emit the Firefox theme stylesheet and settings files the manifest names (13443e5c)
• Give icons that leave the extension root a slot of their own in the output (92242c87)
• Point every manifest resource at an emitted path and watch broken files (19d0e421)
• Ship a public folder beside the manifest and name the folder in use (28289754)
• Make every promised CLI flag behave on the commands that list it (cf7048c5)
• Find extension.config beside the manifest when the package root has none (7f98f45c)
• Show the new-tab override page on Firefox launches via the manager add-on (86c4ebe7)
• Print the real launch plan on --dry-run for chromium and firefox (bd681896)
• Restart the dev session when a manifest entrypoint is added mid-watch (9fb362a0)
• Survive stray RDP frames and fail Firefox requests fast on a dead socket (bd0747e7)
• Reload an extension page when its own HTML changes under HMR (de003c7b)
• Pin the patched dependency overrides to releases older than three days (8b5e01fa)
• Let a publish resume after its tag and wait longer for npm (37fbfb56)