v1.30.0
gildas-lormeau/SingleFilev1.30.0Oct 13, 2026by gildas-lormeau
Upgrading?
AI Summary
This release adds a 'Copy details' button for debugging save failures and improves security by restricting option profile exposure to child frames. It also includes a Chromium fix to prevent extension detection and updates the core library to improve image preservation and caching.
Key Highlights
- Added 'Copy details' button to the error bar for easier debugging
- Fixed security vulnerability where option profiles (credentials) were exposed to child frames
- Prevented extension detection on Chromium by setting `use_dynamic_url` on web accessible resources
- Fixed tab saving order to match the tab order instead of injection order
- Settings like `maxParallelWorkers` now refresh dynamically without requiring a browser restart
Breaking Changes
- Child frames can no longer receive the full options profile via `postMessage`; they must fetch settings via runtime messaging
- User-script events no longer expose destination and credential options
- Chromium users can no longer detect the extension by fetching web accessible resources at the fixed extension URL
New Features
- Added a 'Copy details' button to the error bar that copies error messages, stack traces, and environment info for issue reporting
Full Release Notes
### Changes - The error bar displayed when a save fails gets a "Copy details" button. It copies the error message, the stack of the content script and of the background, the step reached, the version, the user agent and the page URL, ready to paste into an issue. ### Fixes - The options profile is no longer sent to child frames. The frame tree used to post the whole profile, including the credentials of the upload destinations, to every frame of the page with `postMessage(…, "*")`, so a third-party or sandboxed frame could read it. A frame now receives only its window and session ids and fetches the capture settings it needs from the top frame through the runtime messaging of the extension (`singlefile.frameTree.getOptions`, relayed by the background). Reported by @agnosticlines. - The user-script events no longer expose the destination and credential options, and a user script can no longer change them through its response. - Chromium: `use_dynamic_url` is set on the web accessible resources, so a page can no longer detect the extension by fetching one of them at the fixed extension URL. Reported by @agnosticlines. - When saving several tabs, the pages are saved in the order of the tabs. The tasks used to be queued in the order the scripts were injected, so `maxParallelWorkers: 1` did not save the tabs in sequence. Reported by Pierre. - `maxParallelWorkers` and `processInForeground` are read again on every batch instead of once per browser session, so a value imported from a settings file applies without a restart. - Update single-file-core to 1.6.29: the matched `<source>` of a `<picture>` keeps its size on the saved image, and the serialised adopted stylesheets are cached for one capture only.
Related Repositories
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
The library for web and native user interfaces.
Node.js JavaScript runtime ✨🐢🚀✨
Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages
A fancy self-hosted monitoring tool