Release 1.0.0 · lightpanda-io/browser

Behavior changes

Classic HTTP WebDriver, built out into a usable driver
Session management; navigate; back/forward; execute
Element endpoints; input (click, clear, sendKeys); cookie and viewport endpoints
Higher default/max HTTP limits

CORS is now enforced by default. Cross-origin fetch/XHR requests that fail a CORS check are blocked. Turn it off with --disable-features cors. The old --experimental-features cors flag is gone.
CORS store with an entry limit (--cors-store-entry-limit, default 1000)
Fetch referrer policy + CorsGate referrer checking
Sec-Fetch-Site and Sec-Fetch-Mode request headers
Limit redirects that carry credentials

WebAssembly.compileStreaming and instantiateStreaming
Sanitizer API (initial)
TextEncoder.encodeInto
element.requestFullscreen (mostly a stub)
inert property; iframe sandbox setter
img srcset support; report natural dimensions for fetched images
new Option() and the legacy constructor API
DOMTokenList setters; more accurate window.isSecureContext
Experimental ServiceWorker (behind --experimental-features serviceworker) with Cache/CacheStorage

<template> content handling
Custom element callbacks may move the element during parse
request.clone() clones headers; correct fetch/response handling of null bodies
XHR/fetch report the status reason from the server; TypeError on XHR send(SharedArrayBuffer)
input.select() no longer throws for email/number; element.focus() only on focusable elements
Correct error on a wrong method; guard headers
Validate the XML declaration
Avoid spurious mutations for unchanged CSS declarations

Split the style cascade into property groups; honor !important on tracked stylesheet properties
Resolve width/height from stylesheet rules; give the document a height and clamp viewport scroll to it
Measure wrapped text for an element's content height
Resolve scroll containers through the style cascade; unify wheel dispatch; clamp scroll offsets and latch a wheel to one container

Optimize Network.getResponseBody
DOM.getFrameOwner returns the owning <iframe>; nodes carry a frameId
Answer inspector commands on the session that sent them; echo the sessionId in browser-level replies
Notify target closure when disposing browser contexts; report the initial about:blank as loaded
window.devicePixelRatio from the viewport scale; char text insertion
Move a kept isolated-world context onto the navigated origin

Improve caching; add x-frame-options support
Keep connections healthy: don't re-use connections likely in a bad state
Lowercase response headers; clamp the response status range and report the server's reason phrase
Add headers to the sync-request path
Accept Netscape cookie format in --cookie; report invalid same-site over CDP
Generate an appropriate error on a bot challenge

Add OpenRouter provider; lightpanda run - reads a script from stdin
Report the HTTP status of a navigation; wait for networkidle after an action-triggered navigation
findElement matches names by /regex/
MCP carries the navigation outcome as structuredContent
REPL output fixes and simpler command dispatch

Report usage errors once, accept -h, show tips only on a terminal; scale the "did you mean" distance with input length
Respect NO_COLOR and disable colors when stderr is not a tty
Per-page context logs; many warn/err logs downgraded to debug
Log the stalled page and JS stack on watchdog termination
Record Linux fatal signals without blocking on stderr

Replace the slab allocator; set M_MMAP_THRESHOLD to 128K on Linux
Convert recursive walks to iterative: XPath, SemanticTree/AXNode, markdown, screenshot, dump
Share one PCRE2 wrapper across the regex paths
Faster V8 background-job scheduling and task wakeup
Track and free abandoned html5ever parsers; drop the allocation for the default sanitizer

Crash fixes: node cycles when the parser reparents moved nodes, a scrolling stack overflow, a double-free in IndexedDB, a rare import crash
Stop load events on a document superseded by navigation
V8 always detaches the global