4.1.37 (October 31, 2026)

• Development-only pages and scripts, a player.dev.html in pages/ or a bench.dev.ts in scripts/ runs in extension dev and never reaches a production build, no HTML, no chunk, no manifest entry
• Extra files in the build with include, map output paths to files or folders in extension.config.js, model weights or an exported tree outside the project included, layered per browser and per command
• A MAIN-world content script leaves nothing on the page, production builds stop publishing the extension's base URL and the cleanup global to the host page, and the dev browser now passes bot checks and keeps sign-in pop-ups responsive
• WebAssembly runtimes get their own 32 MiB budget, an on-device ML build with onnxruntime or ffmpeg ends "compiled" instead of a budget warning it could never act on, and perfBudgets.wasm caps it when you want to

Features

• Add dev-only pages and scripts and an include config key (#951) (cfe62f1f3)

Other changes (13)

• Give WebAssembly runtimes a 32 MiB budget of their own (#955) (1bd9a73e3)
• Write the 4.1.37 release highlights (#954) (b612631b0)
• Refuse a folder of projects and name versions on the build line (#953) (232b1c981)
• Keep the cleanup registry off the page in a shipped MAIN bundle (#952) (ae7dce445)
• Keep dev content-script names stable and index worker chunks (#950) (4f7af0f6c)
• Let a Chromium MAIN-world bundle find its base without the bridge (#949) (44a41ab5a)
• Drop the MAIN-world bridge in production when nothing reads it (#948) (8a872848b)
• Transliterate accented letters in the zip file name (#947) (12f42d6d7)
• Keep a use_dynamic_url resource out of a second static WAR group (#946) (24556bf13)
• Group CodeQL bumps, patch flagged deps, fix a scanning alert (#945) (092314322)
• Bump github/codeql-action init and analyze to 4.39.1 (#941) (0f1b34125)
• Keep a require() aliased to false out of the bundle (#939) (4d6fab5bd)
• Attach the extension's own CDP targets explicitly, no auto-attach (#938) (ed2d765ec)