v3.0.0

3.0.0 (2026-10-12)

• feat(iframe)!: default postMessageToIframe targetOrigin to the iframe's origin (#262) (859e907), closes #253

Bug Fixes

• common: guard getUserAgent/getBrowserLanguage on isBrowser for SSR (#245) (50b6259), closes #237
• draganddrop: return cleanup functions instead of cloning the node (#249) (ec71ff2), closes #233
• intersection: observeOnce fires only when intersecting (#248) (889ea85), closes #232
• keyboard: onShortcut clears pressed keys on window blur (#251) (f4028e1), closes #238
• screencapture,webauthn,urlpattern: reject instead of throwing synchronously (#244) (525db52), closes #235
• ssr: guard DOM access so calls no-op in Node (#246) (c667668), closes #234 #234

Features

• mediaquery: add a matchMedia wrapper (#250) (4351fde), closes #241 #241
• visibility: add Page Visibility wrapper (#247) (4e59fc0), closes #242
• window,iframe: opt-in noopener for openWindow, warn on '*' targetOrigin (#254) (73221e4), closes #236

BREAKING CHANGES

• postMessageToIframe no longer defaults targetOrigin to ''.
  Callers that relied on the default and post to a cross-origin frame whose
  src origin differs from the current one, or to an opaque-origin src, must
  now pass targetOrigin explicitly ('' to keep the old behaviour).