0.3.1

X-PLUG/mPLUG-DocOwl0.3.1May 26, 2026by github-actions[bot]

AI Summary

This release introduces new Web APIs such as the File API and WebSocket in workers, adds the webMCP API to the Chrome DevTools Protocol, and improves HTTP networking and caching stability.

Key Highlights

New Web APIs including File API, import.meta.resolve, and WebSocket in workers.
Enhanced CDP with webMCP API and improved Accessibility/Cache APIs.
HTTP networking improvements including fetch integration and cache eviction logic.
Security fixes for URL injection and Cookie validation.

New Features

File API (File/FileList implementation)
import.meta.resolve
WebSocket in workers
webMCP API + webMCP CDP domain
Navigator.appCodeName returns Mozilla
Forms: enctype + 5 submitter form-* IDL accessors

Full Release Notes

## New Web APIs
- **File API** (`File`/`FileList` implementation)
- `import.meta.resolve`
- Custom element reactions v2; `parseHtmlAsChildren` handling for unexpected DOM in custom-element callbacks
- WebSocket now works in workers; Performance API on workers; worker-safe `Event`
- Forms: `enctype` + 5 submitter `form-*` IDL accessors
- `Navigator.appCodeName` returns `Mozilla`

## CSS / styling
- Evaluate `@media` and `matchMedia` against viewport
- `--enable-external-stylesheets` flag (fetch + parse)
- Author `display` rule beats UA `[hidden]` / `display:none`
- Surface at-rules through `insertRule` and `replaceSync`

## CDP (Chrome DevTools Protocol)
- **webMCP API + webMCP CDP domain**
- `Accessibility.queryAXTree` (+ latent frame-binding bug fix); WebDriver `getComputedLabel`
- Cache: `Network.requestServedFromCache`, `fromDiskCache` field on `Network.Response`, `Network.clearBrowserCache` / `canClearBrowserCache`, proper `Network.setCacheDisabled`
- Accessibility: use content for name on specific roles
- Re-organized CDP connection; Main/Network reads CDP socket

## HTTP / Networking
- Send `Accept` header when navigating
- Cache eviction; serve cache from next client tick
- `fetch` uses httpClient (respects `Config.maxConnections`)
- `--json` flag for the `fetch` command

## Security / correctness
- `URL`: fix NUL/CR/LF/TAB character injection through authority
- `Cookie`: honor `SameSite=Strict` on cross-site navigation; cleaner `validateCookieString`
- Correct scheme parsing with leading whitespace
- Emit `null` when JSON-stringifying unserializable values

## Stability fixes
- **Fix CDP server stall / SIGTERM hang in optimized builds** (Network drops CDP sockets from poll set); terminate live CDP connections on shutdown
- Protect against recursive form submits; dangling pointer in `syncRequest`
- Scope frame ID generator to Browser, not Session (#2472)
- Move `FinalizerCallbackIdentity` lifetime from Session to Browser
- Replace active page on synthetic root navigation (about:blank, blob:); ensure about:blank frame visibility
- Dump using latest Frame to prevent segfault on frame change
- Clear pending destroy on `createPage`; don't process scripts that failed to load

## Performance
- `Timers`: integer-optimized hashing
- HttpClient/Transfer cleanup

## Build / CI / dev
- `make download-v8` to fetch prebuilt V8 and skip source build; forward optional `V8_PATH`; `make clean` target
- Reworked `help` command; removed options from main help
- Smoke-test the MCP stdio server; remove CDP logs from e2e tests; force-kill lightpanda between steps
- Dockerfile: fix `curl|sh` pipefail, trim builder stage