Skip to content

4.1.39 (November 6, 2026)

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Nov 11:37
· 6 commits to main since this release
v4.1.39
42867f5
  • Safari builds take your own app icon, extension build --browser=safari --app-icon=icon.png uses the PNG as is instead of plating the manifest icon on a white tile. Docs
  • A production build warns when a public env variable is named like a secret, so an EXTENSION_PUBLIC_API_KEY never ships in a bundle unnoticed. Docs
  • SQLite in DevTools, npx extension@latest create my-extension --template=devtools-typescript-sqlite starts a DevTools panel backed by SQLite in the browser.
  • Firefox content scripts run once after a reload, the dev session no longer injects a second copy, and a missing scripting permission is named instead of failing quietly.
  • The Edge store zip leaves the manifest key out, dist/edge keeps it, so an unpacked Edge install keeps the pinned id your OAuth redirects depend on.

Features

  • Add an exclude config key to leave files out of one browser build (#991) (151892d3d)

Fixes

  • Resolve symlinked project paths before naming a reloaded file (#970) (c68fe6349)
Other changes (29)
  • Stamp the Safari app version and sharpen the build's warnings (#992) (0f5b204fd)
  • Keep the controlled preview copy outside the folder it copies (#990) (4fb2e2fb6)
  • Compile a module script on a runtime-opened page as ESM (#989) (20428c462)
  • Drop extension.dev pointers from the CLI, READMEs and templates (#988) (ad5863177)
  • Write the 4.1.39 highlights (#986) (67ae97524)
  • Name an unpruned dist file and clear what the code audit found (#985) (1bd95a428)
  • Give the dev watch specs a 30s rebuild window and a 90s budget (#983) (ec0be495f)
  • Drop the manifest key from the Edge store zip only, not from dist (#982) (c7afecebf)
  • Bound the Playwright install steps and keep lint off worktrees (#984) (44b4959bf)
  • Publish again once when Sigstore's log answers 409 after a 502 (#981) (51583f892)
  • Repin the template catalog to add the SQLite devtools template (#980) (b99353b0b)
  • Warn when a public env variable is named like a secret (#979) (2fa49b40e)
  • Show a public env example that is not a secret in the AI help (#978) (1bec7126c)
  • Let the dependency canary name a known upstream break instead of red (#977) (a4fe2db27)
  • Raise follow-redirects and minimatch to clear two alerts (#976) (282267534)
  • Declare the Safari config keys in the public config types (#975) (0c194e2dd)
  • Hold a Firefox dev session at starting until its RDP port is known (#972) (ebfda7f0f)
  • Name changed files and indexed modules by one project-relative path (#971) (4e405e9fc)
  • Keep emulated Chromium reloads partial and write each content script anew (#969) (6e336f0c4)
  • Build the Safari app icon from a supplied PNG, not a plated tile (#967) (08b683456)
  • Wait for Safari, name what blocks Settings, renew WebDriver (#964) (d584469a3)
  • Give every CI job a timeout and bound the xvfb apt step (#968) (9a240c8ef)
  • Wait for the recompile in the second dev session spec (#966) (7f97862dd)
  • Skip the reinject after a Firefox reload, which injects on its own (#965) (7cf52a56b)
  • Open the starting URL in the Safari automation window, or say why not (#960) (5408ad895)
  • Read the Xcode 26 team key so the Safari remedy lists a known team (#962) (e9fe63a9f)
  • Park every console level before the bridge connects and replay it in order (#961) (f062d1810)
  • Name the missing scripting permission when Firefox cannot inject (#959) (acf885a93)
  • Note a folded sidebar key and hint at a missing default export (#958) (d2160f5be)
Assets 7
Loading