0.3.4

dubinc/dub0.3.4Jul 1, 2026by github-actions[bot]

AI Summary

Release 0.3.4 introduces multi-page session support and expands the Web API compatibility, while also improving stability with crash fixes and performance optimizations for the rendering engine.

Key Highlights

  • Multi-page sessions with concurrent navigation
  • New Web APIs: sendBeacon, hashchange, and domain setter
  • Stability fixes for iframe loads and requestAnimationFrame
  • CDP improvements for layout metrics and redirect handling

New Features

  • Multi-page sessions support
  • Navigator.sendBeacon API
  • HashChangeEvent support
  • Document.domain setter
  • UAF fixes in BrowserContext

Full Release Notes

## Multi-page sessions
- Concurrent page navigations in the script runtime
- Runner and session support for multiple pages
- `cli`: fetch multiple URLs in one invocation

## New Web APIs
- `Navigator.sendBeacon`
- `HTMLSelectElement.add`
- `Node.moveBefore`
- `HashChangeEvent` + `Window` `hashchange` event
- `document.domain` setter
- `Worker` is now a proper `DedicatedWorkerGlobalScope`

## Web API behavior / fixes
- `replaceWith` with a `DocumentFragment` appends its children
- `innerHTML` parsing respects the target element
- Reject `XMLHttpRequest.send()` when a send is already active
- Cookie accessor moved from `HTMLDocument` to `Document`
- `innerText` uses the `StyleManager`'s visibility

## CSS / styling
- `getComputedStyle` resolves inline `style=` declarations
- Normalize fractions without a leading `0`
- Skip inline-style allocation for elements without inline styles (perf)
- Skip `CSSStyleProperty` creation when there is no `style` attribute (perf)

## URL
- Reworked `URL.resolve` on top of the new URL implementation

## CDP (Chrome DevTools Protocol)
- Follow redirects on request-interception fulfillment
- Fix `Page.frameAttached` params double-wrapping that broke sub-frame interception
- `Page.getLayoutMetrics` returns the browser's viewport
- Store viewport override at the browser level

## HTTP / Networking
- Update libcurl and nghttp2
- Work around libcurl Brotli trailing-byte rejection (`CURLE_WRITE_ERROR`)
- Fix cross-origin `MessageEvent.source` `WindowProxy` identity

## Telemetry
- Smaller telemetry payload
- Telemetry worker moved to its own thread

## Stability / crash fixes
- Fix handlescope corruption on iframe load
- Prevent double-free on `BrowserContext` deinit with pending interception (UAF)
- Fix crash on `requestAnimationFrame` from a `Worker`
- Flush deferred transfers after a synchronous stylesheet fetch

## CLI / Ops
- `LIGHTPANDA_DISABLE_CORE_DUMP` to suppress crash core dumps
- New `--strip-mode invisible`

## Build / CI
- Update V8
- Generate a `versions.json` file
- Release: Docker registry login + read permissions, homebrew workflow fixes, trigger homebrew-browser formula update after release