0.4.1

## CORS (experimental)
CORS is off by default. Enable it with `--experimental-features cors`.

- CORS implementation: obey cross-origin checks on fetch/XHR instead of allowing them unconditionally
- `Origin` header + request header validation
- XHR changes for the CORS WPT tests

## IndexedDB
- WPT conformance pass
- `setName` on `IDBObjectStore` and `IDBIndex`
- `nextunique` / `prevunique` cursor directions
- Keep the `upgradeneeded` event alive past dispatch; better error handling
- Fix use-after-free reading `txn._db` after `releaseRef` frees it

## New Web APIs
- `CountQueuingStrategy` and `ByteLengthQueuingStrategy`
- `resource-timing`; `Performance` is now an `EventTarget`
- `window.stop()`
- `img.decode()`
- `navigator.sendBeacon` returns `true`
- `Headers.getSetCookie`, `customElements.getName`, `Element.part`
- `HTMLInputElement` `valueAsNumber`, `valueAsDate`, `stepUp`/`stepDown`, `showPicker`
- `SVGGraphicsElement.getCTM` and `getScreenCTM`
- `canvas` `measureText` and the drawing methods chart libraries probe
- `matchMedia` change events and real `addListener`/`removeListener`
- Reflect `HTMLElement.contentEditable`
- Basic support for CSS custom properties

## Forms / input
- Text entry: move the cursor on caret keys and to the end on value set; clamp selections against the current value
- Trusted `beforeinput` is cancelable
- A disabled `fieldset` disables its controls' activation and validation
- `option.selected = true` deselects its siblings in a single select
- Fix select value assignment with no matching option

## Custom elements
- Upgrade autonomous custom-element clones in place
- Don't upgrade custom elements in a windowless document
- Skip null nodes when a create callback fails

## CSS / rendering / performance
- Memoize `StyleManager` visibility per element
- Append inserted rules to the buckets instead of rebuilding
- Materialize inline styles where layout reads them
- `--strip-mode` gains `shell` and `clutter` options
- Faster `nth-*` selectors, class matching, attribute lookup, and pseudo-class parsing

## Ad blocker
- Run `/regex/` filters with PCRE2
- Request engine

## Protocols
- WebDriver: HTTP WebDriver session management
- CDP: `DOM.focus`; honor `runImmediately`, `screenWidth`/`screenHeight`, `browserContextId`
- CDP: request interception patterns; a context per isolated world per frame
- CDP: wheel events scroll the viewport unless over a scroll container
- CDP: fix message lifetimes and console argument serialization; remove a terminate/disconnect race

## HTTP / Networking
- Keep connections alive across navigations; better redirect handling; timeout tweaks
- Enable `CURLOPT_PIPEWAIT` on every easy handle
- Update curl to 8.22.0
- Cookies: accept `Secure` and `__Host-` on loopback origins; apply the `SameSite=Lax` exception only on safe methods; compute site-for-cookies from a frame's ancestor chain
- Guard WebSocket message-length parsing against integer overflow
- Fix drive-letter lookalike URL segments on non-file schemes

## CLI / tools
- `--locale` and `--timezone`, with language signals derived from one value
- Suggest the closest flag or command on a typo
- `note` log level can be silenced; log CLI tips
- Scroll the nearest scroll container from the `scroll` tool
- Click dispatches a full pointer/mouse sequence, not a bare click event
- Agent: route REPL output per tool and align page tables of any size

## Stability / memory
- Crash fixes: `TryCatch` copied by value, `history.state` / `Navigation.currentEntry`, V8 re-entry on an unhandled promise
- Fix `Notification` use-after-free
- Disconnect runaway intersection observers; raise timer caps
- Leak fixes: robot store, JS terminated during MutationObserver/IntersectionObserver delivery, cloned HTTP responses, V8 backing store
- V8: notify isolate shutdown, restore the initial heap limit, avoid rearming heap termination during teardown
- Disarm the watchdog before protocol teardown