1.0.20

Northstar Web Browser 1.0.20

What's Changed

• Start the 1.0.20 development cycle by @andreasrosdal in #131
• README: correct facts against the current tree by @andreasrosdal in #133
• Move lexbor and quickjs-ng to current upstream master by @andreasrosdal in #134
• Load fonts created with the FontFace API (#132) by @andreasrosdal in #135
• Keep security headers on HTTP cache hits by @andreasrosdal in #136
• Require CORS for cross-origin module imports by @andreasrosdal in #137
• Stop late audio loads from overwriting a streaming player by @andreasrosdal in #138
• Refuse new UNIX sockets on content threads by @andreasrosdal in #139
• Backport YouTube and MSE fixes from Nordstjernen Sol by @andreasrosdal in #141
• Decode video through Media Foundation on Windows by default by @andreasrosdal in #142
• Start Media Foundation off the main thread by @andreasrosdal in #143
• Decode video through GStreamer on Linux by default by @andreasrosdal in #140
• Submit frame forms into the frame and apply CSP sandbox to frames by @andreasrosdal in #144
• Ignore HttpOnly cookies written from script by @andreasrosdal in #145
• Classify nested frames against their own embedder by @andreasrosdal in #146
• Block the page's event loop during a synchronous XHR by @andreasrosdal in #147
• Release 1.0.20 by @andreasrosdal in #148
• Update the screenshot for 1.0.20 by @andreasrosdal in #149

Full Changelog: 1.0.19...1.0.20

1.0.19

Northstar Web Browser 1.0.19

What's Changed

• Start the 1.0.19 development cycle by @andreasrosdal in #120
• chess.com guest play: shadow-root tree walks and cross-origin event.source by @andreasrosdal in #121
• BankID sign-in: decode Content-Encoding in the browser, window-scoped sessionStorage by @andreasrosdal in #122
• freecivweb.com: implement Function.prototype.caller by @andreasrosdal in #124
• Local files: say when the sandbox, not file permissions, refuses a file: URL by @andreasrosdal in #126
• chess.com guest pairing: run scripts inserted during a script fetch by @andreasrosdal in #127
• Input: end a pointer drag where the button is released by @andreasrosdal in #128
• Release 1.0.19 by @andreasrosdal in #129
• README: remove the No AI policy section by @andreasrosdal in #130

Full Changelog: 1.0.18...1.0.19

1.0.18

Northstar Web Browser 1.0.18

What's Changed

• Start the 1.0.18 development cycle by @andreasrosdal in #93
• README: restore the screenshot near the top by @andreasrosdal in #94
• Rename Nordstjernen Web Browser to Northstar Web Browser by @andreasrosdal in #95
• CI: publish release checksums by @andreasrosdal in #97
• Add the northstar-browser npm package by @andreasrosdal in #98
• npm: show the browser screenshot on the package page by @andreasrosdal in #99
• Skip the polyfill check on builds with Bellard's QuickJS by @andreasrosdal in #100
• npm: make the installed Northstar programs executable on Unix by @andreasrosdal in #101
• npm: add html, javascript and css package keywords by @andreasrosdal in #102
• Improve chess.com: iframe frames hang, nested calc rem, audio player cap by @andreasrosdal in #103
• net: partition framed requests by the top-level site by @andreasrosdal in #104
• net: limit the TLS override to top-level navigations by @andreasrosdal in #105
• downloads: sanitise page-supplied file names by @andreasrosdal in #106
• ws: pin the WebSocket curl handle to ws and wss by @andreasrosdal in #107
• net: guard the view-source gate against a NULL document URL by @andreasrosdal in #108
• js: treat Access-Control-Expose-Headers "*" literally on credentialed requests by @andreasrosdal in #109
• Open Settings, History and Page Source from the browser UI again by @andreasrosdal in #111
• js: resolve document.defaultView by document node and calling realm by @andreasrosdal in #112
• dom: keep frame documents out of their host's serialization and walkers by @andreasrosdal in #113
• wasm: resync the Memory buffer after wasm code may have grown memory by @andreasrosdal in #114
• js: enforce allow-top-navigation for sandboxed frames by @andreasrosdal in #115
• js: queue link load events instead of firing them inside the insertion by @andreasrosdal in #116
• WebSocket: send the page's cookies with the opening handshake by @andreasrosdal in #117
• Release 1.0.18 by @andreasrosdal in #118
• Update the screenshot for 1.0.18 by @andreasrosdal in #119

Full Changelog: 1.0.17...1.0.18

1.0.17

Northstar Web Browser 1.0.17

What's Changed

• Start the 1.0.17 development cycle by @andreasrosdal in #69
• debian: bring the packaging in line with Nordstjernen Sol's by @andreasrosdal in #70
• src: document non-trivial functions and rewrite the file headers by @andreasrosdal in #71
• gtk: keep following the desktop theme after a status message by @andreasrosdal in #72
• lexbor: grow the tokenizer buffer before writing a named character reference by @andreasrosdal in #73
• quickjs-ng: keep modules whose resolution failed instead of freeing them by @andreasrosdal in #74
• Refuse select.add() of an ancestor of the select, and of non-options by @andreasrosdal in #75
• Check Safe Browsing on redirect hops and form POSTs by @andreasrosdal in #76
• Expire HSTS entries at the end of their max-age by @andreasrosdal in #77
• Verify Subresource Integrity before applying linked stylesheets by @andreasrosdal in #78
• layout: reuse the intrinsic measurement when clamping by intrinsic keywords by @andreasrosdal in #79
• Escape localStorage keys and values in the on-disk key file by @andreasrosdal in #80
• gtk: stop dropping every other animation frame on 60 Hz displays by @andreasrosdal in #81
• net: let libcurl cache the CA store across connections by @andreasrosdal in #82
• css: keep sheets the caches drop alive until the style pass ends by @andreasrosdal in #83
• README: list Southstar and correct the sibling browsers' command names by @andreasrosdal in #84
• headless: let --act click and rightclick take a sel= point by @andreasrosdal in #85
• Add an Arch Linux package, northstar-browser by @andreasrosdal in #90
• Release 1.0.17 by @andreasrosdal in #91

Full Changelog: 1.0.16...1.0.17

1.0.16

Northstar Web Browser 1.0.16

Windows store: https://apps.microsoft.com/detail/9p39zb79jv0t

What's Changed

• Block page writes to internal data-nd-* attributes by @andreasrosdal in #24
• Bind iframe document.cookie to the document's real URL by @andreasrosdal in #25
• Harden iframe and ShadowRealm realm boundaries by @andreasrosdal in #26
• Fix use-after-free when reading DataView-like buffer sources by @andreasrosdal in #27
• Send truthful navigation request metadata and add CORS preflight by @andreasrosdal in #28
• Only honour northstar-unsafe-continue: from the Safe Browsing warning by @andreasrosdal in #29
• Fix heap overflow when rebuilding SFNT data from web fonts by @andreasrosdal in #30
• Fix IndexedDB handle use-after-free and unlocked blob URL tables by @andreasrosdal in #31
• Stop exposing cross-origin stylesheet bodies to page script by @andreasrosdal in #32
• Don't treat about:blank/about:srcdoc as browser chrome by @andreasrosdal in #33
• Harden extension content-script shim, paths, filters and matchers by @andreasrosdal in #34
• Partition the bytecode cache and keep it out of private browsing by @andreasrosdal in #35
• Close several Content-Security-Policy, worker and service-worker gaps by @andreasrosdal in #36
• Tighten the Linux sandbox by @andreasrosdal in #37
• Parse boolean env switches properly; confine test-only hooks by @andreasrosdal in #38
• Pin and checksum the AppImage build tools; pin lexbor by commit by @andreasrosdal in #39
• Make the XHTML well-formedness gate and parser agree on DOCTYPEs by @andreasrosdal in #40
• Scope BroadcastChannel by origin; filter response headers for script by @andreasrosdal in #41
• Fix media/canvas edge cases and races in shared tables by @andreasrosdal in #42
• Keep CR/LF out of request headers and the config file by @andreasrosdal in #43
• Don't leak the parsed SSE field when ignoring a CR/LF event id by @andreasrosdal in #44
• Close gaps found re-reviewing VULN-06/08/09/10/19 by @andreasrosdal in #45
• Close gaps found re-reviewing VULN-01..05 by @andreasrosdal in #46
• Close gaps found re-reviewing VULN-11..15 by @andreasrosdal in #47
• Bring SECURITY.md in line with the code; harden headless allocator by @andreasrosdal in #48
• Rename the internet-browser alias to open-internet-browser by @andreasrosdal in #49
• Label blob: URLs with the calling frame's origin; tighten about:/file: access by @andreasrosdal in #50
• Run a frame's inline code in the frame's realm, never the embedder's by @andreasrosdal in #51
• Take frame origins from the browser's record, not the frame's location by @andreasrosdal in #52
• Judge a frame's requests and workers by the frame's own CSP by @andreasrosdal in #53
• Hand content scripts their helpers directly; serve only web-accessible files by @andreasrosdal in #54
• Drop a duplicate forward declaration that breaks the -Werror Linux build by @andreasrosdal in #55
• Write headless output through pre-opened files; refuse TIOCSTI and SHM_EXEC by @andreasrosdal in #56
• Treat XML the parser rejects as malformed, never as HTML with scripts by @andreasrosdal in #57
• Honour fetch credentials modes; Origin: null; CORS for EventSource by @andreasrosdal in #58
• Second-review fixes: frames, IndexedDB, CSP hops, audio/worker policy, docs by @andreasrosdal in #60
• Give speculative preloads the page's Content-Security-Policy by @andreasrosdal in #59
• Third-review fixes: unknown callers, frame storage, CSP and extension gaps by @andreasrosdal in #61
• Third-review fixes: navigation, IndexedDB, frame CSP, seccomp, config, camera, WASM, nightly by @andreasrosdal in #62
• Navigation API origin check; guard internal attributes; note two known gaps by @andreasrosdal in #63
• Vendor web-text-lib from Nordstjernen Sol in place of the ns-pango subproject by @andreasrosdal in #64
• Drop a doubled availability macro that breaks the gcc build by @andreasrosdal in #65
• Bring README.md up to date with the code by @andreasrosdal in #66
• Release 1.0.16 by @andreasrosdal in #67
• Update the screenshot for 1.0.16 by @andreasrosdal in #68

Full Changelog: 1.0.15...1.0.16

1.0.15

Northstar browser 1.0.15

Windows store: https://apps.microsoft.com/detail/9p39zb79jv0t

What's Changed

• Refuse executable memory on the engine thread; opaque file: origins; live document.cookie by @andreasrosdal in #20
• Remove dead code, duplicate code and bloat across the engine by @andreasrosdal in #21
• Let the sandbox read the XAUTHORITY file, not its directory by @andreasrosdal in #22
• Second size pass: drop disallowed comments, table-drive accessors, fold copy-paste code by @andreasrosdal in #23

Full Changelog: 1.0.14...1.0.15

1.0.14

Northstar Web Browser 1.0.14

Windows store: https://apps.microsoft.com/detail/9p39zb79jv0t

What's Changed

• Fix video streaming by @Gabrielcarvfer in #18
• Fix the Windows and musl CI builds by @andreasrosdal in #19

Full Changelog: 1.0.13...1.0.14

1.0.13

Northstar Web Browser 1.0.13

Northstar Web Browser 1.0.13 released. See Changelog

Windows store: https://apps.microsoft.com/detail/9p39zb79jv0t

Northstar Browser 1.0.12

Northstar Browser 1.0.12

Northstar Browser 1.0.11

Northstar Browser 1.0.11

Northstar is a minimalist web browser written from scratch in C. Its engine targets practical HTML5, modern CSS and JavaScript compatibility without embedding Gecko, WebKit, Blink or another browser engine. Linux is the primary platform; macOS and Windows are also supported.

Northstar is free software, licensed under the GNU General Public License, version 3 or later.

Also see: Nordstjernen Web Browser 1.0.28.

---

Windows store:
https://apps.microsoft.com/detail/9P39ZB79JV0T