4.1.19 (September 15, 2026)

Features

• Bundle the Vue runtime build and drop the rspack global shim (#524) (2289e502)
• Add a CODEOWNERS file naming the maintainer as owner (#521) (797b2416)
• Add one always-reporting CI passed check and run CI on every PR (#516) (6e730661)
• Add property tests for the prefix resolver, path keys and MV2 host fold (80335ba0)

Fixes

• Harden browser installs, template URLs and the control socket (#528) (b981dd0b)

Other changes (15)

• Keep build paths out of import.meta.url in production bundles (#529) (6a03e852)
• Ship the chrome, node and polyfill types with extension (#527) (d4e96a1d)
• Document release verification, architecture and security (#525) (0887a6f8)
• Make chrome: and edge: manifest prefixes vendor exact (#526) (9dd8dbb1)
• Clear the companion AMO warnings in Firefox builds (#523) (78e2c756)
• Pass optional deps matrix values to the smoke step through env (#520) (22696758)
• Attest release tarballs with the commit-pinned GitHub action (#522) (b722a348)
• Retry a failed template install once and show the pnpm error (#519) (0d7dbdda)
• Push release commits with a deploy key that bypasses the ruleset (#517) (00fd8f33)
• Render the Scorecard badge in the project blue like the other badges (2bf90156)
• Mirror the contributing section on the published package README (bf2dbd70)
• Build the resolved manifest with own properties so a proto key survives (5ebf2301)
• Attach SLSA provenance and the npm tarballs to every GitHub release (445627bf)
• State the security response window and point every entry at the guide (aa50ae22)
• Run CodeQL from a workflow so Scorecard's SAST check can see it (4a0a5fec)