1.0.1

Behavior changes

• setImmediate and clearImmediate were removed (deprecated, not part of the web platform).
• MCP and agent modes now load external stylesheets by default.
• Max HTTP redirects raised from 10 to 20, matching the Fetch spec.
• Unsupported protocols are no longer navigated to; javascript: URLs are run instead of navigated to.

New Web APIs

• Web Locks
• Compression Streams API
• RSA-OAEP in Web Crypto (generateKey, importKey, encrypt, decrypt)
• Custom elements: ElementInternals and form-associated callbacks
• Request.body and Request.textStream
• HTMLFormElement.reset, form numeric and named index, form.field
• HTMLTableElement.rows, HTMLSelectElement.remove(index), select.length setter
• textarea.type, fieldset.type, output.type; HTMLMeterElement accessors
• GlobalEventHandlers attributes on Window and Document; document named index
• Performance secondary buffer; performance.timeOrigin relative to the Unix epoch
• Console and CSS are now proper namespaces; more missing namespace methods

Forms / input

• Implicit submit on Enter; improved form submission; GET submissions replace the action's query
• Fire change when typed text is committed by blur or Enter
• Ctrl+A selects the whole value in text fields
• All text edits go through one gated path; better contenteditable detection
• Single-contact touch for CDP, testdriver and BiDi
• One WebDriver key table shared by BiDi, testdriver and press
• Click press/release sequences shared across input paths and matched to Chrome
• Keydown default actions run only for trusted events
• Range and color inputs get their default value; input.value reflects to the attribute in default modes
• Skip inputs with an empty name; :checked applies to options; option text strips and collapses whitespace

Web API behavior / fixes

• fetch resolves after headers are received; an abort signal aborts a fetch
• XHR response header compliance; improved data-URL parsing
• Exceptions from timers, animation frames, on* handlers, observers and microtasks go to reportError
• on* handler attributes behave like any other event listener
• document.open resets loaded frame state; several document.close crash fixes
• Fire popstate on a fragment navigation; history traverses within a document by entry
• Each Window gets its own History; Location URLs resolve against the calling document
• Dynamic <base> updates the document base URL
• iframe reflects and reacts to src; sandbox token queries; iframe removal cleanup
• replaceChildren adopts nodes from another document
• Classic scripts are decoded with their charset
• Timers accept any value; negative delays clamp to zero
• IntersectionObserver only intersects connected targets
• Fix custom element upgrade ordering during fragment parsing; undefined custom elements use the HTMLElement prototype

CSS / selectors / rendering

• Computed style reports initial values and a resolved font-size; padding, margin and border widths default to 0px
• text-transform applied in innerText and resolved in getComputedStyle
• revert and revert-layer treated like inherit
• Decode fetched stylesheets; fix tokenizer exponent and hyphen-escape bugs; external stylesheet cap raised to 4 MiB
• Hit testing honors pointer-events:none and visibility:hidden
• Visibility inheritance matches Chromium in styles and the AX tree
• Hide a [popover] that is not showing
• Block-level flex and grid containers no longer grow with their items
• Selectors: :valid/:invalid on every validity constraint, :read-write/:read-only per HTML, case-insensitive attribute values, type selectors on XML and foreign elements, pseudo-elements accepted

CDP (Chrome DevTools Protocol)

• Pause requests at the Fetch response stage
• Start of the Debugger domain
• Emit Runtime.exceptionThrown for uncaught page exceptions
• Page.navigatedWithinDocument for fragment navigations and traversals; Target.targetInfoChanged on URL/title change
• Honor Page.navigate referrer/referrerPolicy and client target filters in setAutoAttach
• Keyboard input reaches the focused element inside an iframe; rawKeyDown dispatches keydown
• AX tree: depth param, properties written closer to Chrome, accepted without params
• Accept the cookie fields Chrome accepts, so deleteCookie works

WebDriver / BiDi

• BiDi browser.getClientWindow
• WebDriver window close
• CDP and BiDi cookies built through one Chrome-checked constructor

HTTP / Networking

• Update libcurl to 8.23.0; enable zstd
• Check more HTTP caching headers
• Cookies: keep a session cookie set with expires -1; accept a UTC zone in expires
• --http-curves to set TLS key exchange groups; --http-debug for libcurl verbose output
• serve accepts the --advertise-host name as the WebSocket Host

MCP / agent / tools

• MCP runs each HTTP session on its own thread; idle sessions can be reaped with --http-session-timeout (off by default)
• Agent: --trace writes one JSON line per step; --trace-results adds tool result text
• Agent: tells the model today's date, flags 4xx/5xx navigations, drops stale tool results
• Tree tool: maxBytes budget with [more] markers; iframes listed with their URL
• Search drops results the browser would block
• Telemetry records tool calls and the MCP client name

Dump / markdown / PDF

• PDF output includes the actual text
• --render-font adds fonts for characters the bundled DejaVu fonts lack (e.g. CJK)
• More aggressive clutter stripping; <template> contents serialized; fenced code blocks keep their language

CLI

• completion command prints shell completion for bash, fish and zsh

Performance / memory

• Return freed malloc memory to the OS when a connection closes (glibc)
• Cache computed ancestry values and the root node during parse
• Faster Node.getDocument, owner frame lookup and anchor query matching
• Backtrack limit on user-supplied regex
• Limit V8 ArrayBuffer allocation to 4 GB; don't copy ReadableStream chunks into the page arena

Stability fixes

• Fix UAF in MutationObserver
• Refuse native calls when terminating; run microtasks only at call depth 0
• Commit an error document when a root navigation fails
• Re-implement __clear_cache on Linux arm64 to work around a Zig bug
• Log the script that ran out of JS heap

Build / CI

• Upgrade to Zig 0.17
• Unit tests run across parallel processes (about 3x faster)
• Nightly builds strip debug symbols