v1.25.0

gildas-lormeau/SingleFilev1.25.0Sep 15, 2026by gildas-lormeau

Upgrading?

AI Summary

This release significantly improves the security and user experience of the SingleFile extension. It introduces new configuration options for content control and visual customization, while fixing critical security vulnerabilities and enhancing the stability of multi-page archives.

Key Highlights

  • Enhanced Security: The extension now sanitizes javascript: URIs, prevents form submissions, isolates the content script UI, and trusts resource bytes over declared content types.
  • Save Controls: Users can now cancel a save in progress using a dedicated button or the Escape key.
  • New Options: Added settings for bounding zoom levels during deferred content loading and saving the canonical link of the page.
  • MAFF Improvements: The MAFF metadata option is fixed to recover the original URL and date of the archived page.
  • Visual Updates: The interface adapts to dark mode, and saved pages feature a new icon with a ripple animation.

New Features

  • Cancel save functionality (button and Escape key)
  • Option to save the canonical link
  • Option to bound zoom out during deferred content loading
  • Dark mode support for the saving mask interface
  • Ripple animation on saved page icon

Full Release Notes

### Changes

- A save in progress can be cancelled, from a Cancel button in the saving mask or with the Escape key, registered at `document_start` so it precedes any page listener (#1994)
- New option bounding the zoom out applied to the page while deferred content is loaded
- The deferred images options are renamed to deferred content, and the section now comes before the network section in the options page
- New option to save the canonical link of the page, which can be turned off
- The MAFF metadata option is renamed and its two defects are fixed: it recovers the original URL and date of the archived page
- The interface shown while saving follows `prefers-color-scheme: dark`
- The icon of the infobar added to saved pages shows a ripple animation (#1504)
- Multi-page archives open on their table of contents and honor the root directory option, and one re-saved from the editor keeps its pages under the same root
- `single-file-core` updated to 1.6.1, which brings zip.js 2.15.0

### Fixes

- Saved pages can no longer submit forms or set a base URI, and `javascript:` URIs are sanitized in every attribute and namespace
- The saving mask is removed when a capture fails, instead of staying on screen with the Escape shortcut still armed
- The Escape key that cancels an area selection is swallowed on the window in the capture phase and no longer reaches the page
- The content script UI is isolated from the page
- The page document is exempt from the resource size cap
- The bytes of a resource are trusted over its declared content type
- Response headers are relayed in full and looked up case-insensitively
- Page content is sent as a Blob rather than an array where the messaging preserves it
- `FileReader` is feature-detected in the extension UI, so importing settings, choosing a custom archive image and saving to GitHub work in Safari with Lockdown Mode enabled
- `build-extension.sh` requires `zip`, and `jq` on MV3, up front instead of attempting `sudo apt install`

Related Repositories