v0.21.1

Fixed

• DocumentFragment appendChild no longer kills the JS thread — document.createDocumentFragment was a stub returning a plain object with a bogus __nodeId (1100000); appending it into the document forwarded that id to the Blitz render doc, which panicked with "invalid key", and the unwind permanently killed the session's JS thread (every later Runtime.evaluate failed with "JS thread has died" while captureScreenshot kept returning 200 via its blank-PNG fallback). DocumentFragment now tracks its children, element appendChild splices them into the document per spec (emptying the fragment and flattening nesting), and native-binding panics on the eval path are contained into a per-evaluation error instead of killing the thread. Follow-up hardening: warn instead of silently dropping fragment children lacking a __nodeId, gate connectedCallback firing on an actual insertion, contain panics in SetDocument/SetFrameDocument navigation scripts too (the frame context stays registered), and guard the fragment stub against self-append (infinite flatten loop) and null children (TypeError per spec). Fixes #2.
• Bing search results decoded past tracking redirects — organic results wrapped in bing.com/ck/a tracking links now expose the real destination (base64url payload after u=a1) instead of the tracking URL, and response bytes are decoded as UTF-8 directly because Bing mislabels charset headers on some locales, which mojibake'd CJK snippets through reqwest's .text().

Security

• h2 bumped to 0.4.19 — resolves the RUSTSEC advisory on unbounded DATA frames (Cargo.lock-only bump; no manifest change).

Full changelog: https://github.com/project-oxi/oxibrowser/blob/main/CHANGELOG.md

v0.18.0 — Full Web Platform + CDP Parity

Highlights

OxiBrowser v0.18.0 is the first release with full CDP parity for AI-agent automation: page scripts execute on navigation, async fetch/XHR/WebSocket, per-iframe isolated JS execution contexts, Shadow DOM slot composition, CORS/preflight, multi-tab, and real PDF export.

What's New (Phase 1-9)

Script Execution and Web Platform (Phase 1-4)

• Page <script> execution on navigation (inline + external, document order, DOMContentLoaded/load)
• Async non-blocking fetch() / XMLHttpRequest with concurrent request parallelism
• WebSocket API (ws + wss, binary + text, full event surface)
• FormData + Blob + multipart upload, AbortController/AbortSignal
• Canvas 2D context shim (full surface), matchMedia, Element.matches/closest

Network Correctness (Phase 6)

• CORS + preflight (OPTIONS) with Access-Control-* validation
• Cookie expiry/Max-Age, Public Suffix List, __Host-/__Secure- prefixes, CHIPS
• HTTP/HTTPS/SOCKS proxy, Basic + Digest auth, automatic Referer
• Streaming response bodies

Render and Interaction (Phase 7)

• Hit-testing (DOM.getNodeForLocation, getBoxModel, getContentQuads)
• Page.printToPDF — real PDF output via printpdf

Iframe Per-Frame Contexts (Phase 8)

• Each child iframe gets its own isolated boa_engine::Context + RenderDocument
• Runtime.evaluate contextId routing, Page.getFrameTree recursive child reporting
• executionContextCreated emitted per frame; main-frame isolation verified

Shadow DOM (Phase 4-5)

• Full slot composition (default + named slots, flattened tree)
• attachShadow({mode:'closed'}), declarative <template shadowrootmode>
• Shadow-aware screenshot rasterization

CDP Completeness (Phase 9)

• Multi-tab (Target.createTarget creates real sessions)
• JS-fetch interception (Fetch.requestPaused then continue/fail/fulfill)
• Tracing domain, geolocation/timezone overrides
• Runtime.consoleAPICalled / exceptionThrown / Log.entryAdded
• Concurrent CDP command dispatch (no head-of-line blocking)

Verification

• 604 workspace tests pass (0 failed)
• clippy -D warnings clean
• cargo deny check clean
• CDP acceptance probes: 11/11 (iframe contexts), 10/10 (shadow DOM)
• Release binary: 51 MB (arm64)

Known Limitations

• @font-face web fonts not loaded (Blitz fontdb is pub(crate))
• Canvas/WebGL not rasterized (2D shim only)
• window.parent/window.top cross-frame access not implemented (Phase 8 v1 non-goal)

v0.16.0

Full Changelog: v0.15.0...v0.16.0

v0.6.0

v0.6.0 — 2026-05-14

Added

• Input domain: dispatchKeyEvent, dispatchMouseEvent, insertText → JS KeyboardEvent/MouseEvent dispatch
• document.activeElement + document.elementFromPoint(x,y) JS APIs
• Page.captureScreenshot: Real PNG output with built-in 8x16 bitmap font
• Fetch domain complete: continueRequest, failRequest, fulfillRequest, getResponseBody
• PausedRequestRegistry + HttpClient.intercept() for Fetch integration

Tests

• 208 tests (164 core + 23 E2E + 18 webapi + 3 smoke)
• clippy: 0 warnings

Crates published to crates.io

• oxibrowser-webapi v0.6.0
• oxibrowser-core v0.6.0
• oxibrowser-cdp v0.6.0
• oxibrowser v0.6.0