• #4264 94e0985 Thanks @chrispezza! - Fixes a layout shift where the table of contents could be painted at the start of the content area and then jump to the end when a page's HTML arrived in several chunks

• #4285 6f22edd Thanks @tunetheweb! - Improves hero image loading by adding fetchpriority="high" hint for browsers

Note: This is an alpha release. Please file new issues for any bugs you find in it.

This release is published to npm under the alpha tag and can be installed via npm install electron@alpha, or npm install electron@46.0.0-alpha.1.

• Changed heap profiling in contentTracing recordings to now use a perfetto heap-profiling data source. #53349 ^{(Also in 45)}
• child.kill() on utilityProcess now sends SIGTERM on POSIX like child_process.kill() and no longer force-kills a child that handles the signal. #53992
• Removed the deprecated synchronous safeStorage.isEncryptionAvailable(), safeStorage.encryptString() and safeStorage.decryptString(); use isAsyncEncryptionAvailable(), encryptStringAsync() and decryptStringAsync() instead. #53662
• Removed the events, timers and url modules and the Buffer, setImmediate and clearImmediate globals from sandboxed preload scripts; use a polyfill. #53891
• webContents.capturePage(), the offscreen paint event and webContents.beginFrameSubscription() now return images with the page's device scale factor, so image.getSize() is in DIPs rather than pixels on HiDPI displays. Also fixed nativeImage.toJPEG() returning an empty buffer for images without a 1x representation. #53813

• Added a globalShortcut registration-resolved event on Linux that reports whether the Wayland GlobalShortcuts portal actually bound a registered accelerator. #52224
• Added a Windows Error Reporting helper (electron_wer.dll, renamed to <app>_wer.dll alongside the executable) so crashReporter captures __fastfail and other crashes that bypass the in-process handler on Windows. #53802 ^{(Also in 45)}
• Added app shims on macOS to show windows under another app's Dock icon. #54932 ^{(Also in 44, 45)}
• Added app.canDeElevate() and app.relaunch({ deElevate }) on Windows. #54383
• Added experimental Widevine CDM support with bundled CDM lookup. #50046
• Added filtering options to session.registerPreloadScript - matches, excludeMatches, includeGlobs, excludeGlobs, matchOriginAsFallback. #54903 ^{(Also in 44, 45)}
• Added initiatorOrigin to webRequest and protocol handler requests, DownloadItem.getInitiatorOrigin(), and a trailing frame argument to the will-download and preconnect session events. #53685 ^{(Also in 43, 44, 45)}
• Added launch-failure reporting with systemErrorCode to the app child-process-gone event. #53946 ^{(Also in 44, 45)}
• Added support for Notification action buttons on Linux. #54516 ^{(Also in 44, 45)}
• Added the ELECTRON_DEBUG_DRAGGABLE_REGIONS environment variable, which visualizes and logs draggable regions in unpackaged apps to help debug custom title bars. #53598 ^{(Also in 43, 44, 45)}
• Added the experimental protocol.registerSource() to serve a custom scheme from directories on disk without a JavaScript handler. #53220 ^{(Also in 44, 45)}
• Added Wayland restore-token support to desktopCapturer.getSources(). #54550

• <webview> without allowpopups also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. #53683 ^{(Also in 42, 43, 44, 45)}
• Added validation to protocol.registerSchemesAsPrivileged() to reject protocol names that do not conform to RFC 3986 URI scheme grammar. #52519 ^{(Also in 44, 45)}
• Backported fix from upstream Chromium for File System Access WSL path checks. #54676
• Changed the default trash implementation on KDE Plasma 6 to kioclient. #54092 ^{(Also in 44, 45)}
• DevTools zoom in/out now uses the same zoom steps as Chromium. #54349 ^{(Also in 44, 45)}
• File System Access permission requests and the file-system-access-restricted event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. #53666 ^{(Also in 42, 43, 44, 45)}
• Fixed --xdg-portal-required-version having no effect and a spurious portal warning being logged for file dialogs on Linux. #54227 ^{(Also in 43, 44, 45)}
• Fixed <select> dropdowns not rendering in offscreen windows on macOS. #53638 ^{(Also in 45)}
• Fixed a bug where content-protected windows could temporarily appear in screen captures during picture-in-picture state changes. #51267 ^{(Also in 45)}
• Fixed a child WebContentsView losing focus when its window is reactivated. #54378 ^{(Also in 43, 44, 45)}
• Fixed a crash in ses.clearData() after a DownloadItem was garbage collected. #54961
• Fixed a crash on Linux when process.env was written while another thread was reading the environment, and a memory leak when a worker thread exits. #53491 ^{(Also in 42, 43, 44, 45)}
• Fixed a crash on navigator.usb.requestDevice() in in-memory sessions. #54608 ^{(Also in 44, 45)}
• Fixed a crash when a WebAuthn request used a security key that required its PIN. #54355 ^{(Also in 43, 44, 45)}
• Fixed a crash when a webContents navigated to the Chrome Web Store and the page invoked the unsupported chrome.webstorePrivate API. #53752 ^{(Also in 44, 45)}
• Fixed a crash when calling node:wasi functions in optimized code. #53262 ^{(Also in 42, 43, 44, 45)}
• Fixed a crash when calling setIgnoreMenuShortcuts() on DevTools. #54014 ^{(Also in 43, 44, 45)}
• Fixed a crash when calling utilityProcess.postMessage() after the utility process had exited. #53293 ^{(Also in 43, 44, 45)}
• Fixed a crash when creating a framed window on Wayland in environments where GTK could not initialize. #54365 ^{(Also in 43, 44, 45)}
• Fixed a crash when sending a DevTools protocol command with a non-string value for an optional string parameter via webContents.debugger. #54418 ^{(Also in 43, 44, 45)}
• Fixed a File System Access blocklist bypass on macOS. #54679
• Fixed a grey border around frameless windows on Linux WMs without compositing. #54376 ^{(Also in 43, 44, 45)}
• Fixed a Linux crash creating a window with a menu bar when GTK failed to load. #54777 ^{(Also in 43, 44, 45)}
• Fixed a main process crash when onSendHeaders observed Blob uploads. #55085 ^{(Also in 44, 45)}
• Fixed a main-process crash when an app called loadURL() again right after a load failed because the renderer process exited before the page committed. #53924 ^{(Also in 43, 44, 45)}
• Fixed a memory leak on Windows when app.getPreferredSystemLanguages() was called. #53853 ^{(Also in 43, 44, 45)}
• Fixed a pending read on a net.request chunked upload stream inside a protocol handler never settling when the request failed or was aborted. #53341 ^{(Also in 43, 44, 45)}
• Fixed a possible crash during process exit when vm.Script or vm contexts created in the main process had been garbage collected shortly before quitting. #53560 ^{(Also in 43, 44, 45)}
• Fixed a possible crash on Windows on ARM when powerMonitor is torn down. #54352 ^{(Also in 44, 45)}
• Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. #53574 ^{(Also in 42, 43, 44, 45)}
• Fixed a possible hang when pressing Esc while a <webview> is fullscreen. #53637 ^{(Also in 45)}
• Fixed a potential crash during application shutdown. #54520 ^{(Also in 45)}
• Fixed a potential crash when cleaning up download items. #54513 ^{(Also in 45)}
• Fixed a potential crash when closing detached DevTools. #54524 ^{(Also in 45)}
• Fixed a potential UAF in app.getPreferredSystemLanguages() on Windows. #53854 ^{(Also in 43, 44, 45)}
• Fixed a potential UAF when a select-usb-device handler destroys the requesting webContents. #53940 ^{(Also in 43, 44, 45)}
• Fixed a renderer crash calling image.toPNG() from a sandboxed preload script. #54488 ^{(Also in 43, 44, 45)}
• Fixed a renderer crash that could occur when printing from an iframe. #53751 ^{(Also in 43, 44, 45)}
• Fixed a renderer crash when a nodeIntegrationInSubFrames preload removed its own iframe from a promise, process.nextTick() or other Node.js callback. #53838
• Fixed a renderer crash when a ResizeObserver loop-limit error handler modified layout. #54281 ^{(Also in 42, 43, 44, 45)}
• Fixed a renderer crash when an iframe was removed right after loading with nodeIntegrationInSubFrames enabled and sandbox disabled, e.g. on pages that embed Meta Pixel. #53833 ^{(Also in 42, 43, 44, 45)}
• Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process window.open() child whose contextIsolation differed from its opener's. #53535 ^{(Also in 42, 43, 44, 45)}
• Fixed a spurious node_init error being logged when creating a ShadowRealm with Node.js integration enabled. #53546 ^{(Also in 44, 45)}
• Fixed a stale nativeTheme.shouldUseDarkColors after resetting themeSource. #54595 ^{(Also in 45)}
• Fixed a window's draggable regions applying under child WebContentsViews. #54936
• Fixed accent-color-changed on Windows reporting a colour that differed from systemPreferences.getAccentColor(). #54353 ^{(Also in 44, 45)}
• Fixed alignment of the text label and popup menu in the macOS save dialog. #53950 ^{(Also in 44, 45)}
• Fixed an "Invalid guestInstanceId" error when removing a loaded <webview> from the DOM. #54089 ^{(Also in 42, 43, 44, 45)}
• Fixed an intermittent crash (access violation) on Windows when an ASAR integrity violation is detected, so the process now exits with code 1 as intended. #53433 ^{(Also in 43, 44, 45)}
• Fixed an intermittent crash at startup on Linux caused by a race between Pango and the main thread initializing fontconfig. #53314 ^{(Also in 43, 44, 45)}
• Fixed an issue where an exception thrown by a property getter on an object passed through contextBridge was swallowed instead of being thrown back to the caller. #53289 ^{(Also in 43, 44, 45)}
• Fixed an issue where crashReporter.setUploadToServer() had no effect after crashReporter.start() was called. #54506 ^{(Also in 44, 45)}
• Fixed an issue where notifications would sometimes not appear from certain long domains on Windows. #54225 ^{(Also in 45)}
• Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled. #53669 ^{(Also in 43, 44, 45)}
• Fixed an uncatchable TypeError in net.fetch when receiving response headers with non-ASCII characters, and preserved multiple Set-Cookie headers. #53550 ^{(Also in 44, 45)}
• Fixed app.getGPUInfo('complete') stalling the GPU process for several seconds on some Windows systems. #53640 ^{(Also in 44, 45)}
• Fixed app.getLoginItemSettings() not finding login items on Windows when the executable path contains spaces. #54364 ^{(Also in 44, 45)}
• Fixed app.getRecentDocuments() omitting documents with non-ASCII paths on Windows. #54351 ^{(Also in 44, 45)}
• Fixed application crash after a large number of IPC messages from renderers. #53398 ^{(Also in 42, 43, 44, 45)}
• Fixed asar archives in non-ASCII folders failing to load on Linux. #54655 ^{(Also in 44, 45)}
• Fixed BrowserWindow.setOpacity(NaN) on macOS returning NaN from getOpacity() instead of treating it as fully opaque. #53413
• Fixed chrome.tabs.query() returning tab url and title to extensions without the tabs permission or host access, aligning with tabs.get. #52597 ^{(Also in 42, 43, 44, 45)}
• Fixed clipboard.read(), readText() and has() resolving seconds late on Linux while the app was idle. #54296 ^{(Also in 42, 43, 44, 45)}
• Fixed crashes in setDisplayMediaRequestHandler when the granted frame had been destroyed or another tab was granted by id. #53665 ^{(Also in 42, 43, 44, 45)}
• Fixed crashes in sharedTexture, service-worker ipcRenderer and utilityProcess.fork() caused by object lifetime bugs. #53259 ^{(Also in 43, 44, 45)}
• Fixed crashes in the main process when a webRequest.onBeforeRequest listener redirected a CORS preflight request, and when calling net.fetch() with a webRequest-permission extension loaded. #53294 ^{(Also in 43, 44, 45)}
• Fixed crashes when a webContents or parent window is destroyed while other APIs still reference it. #53257 ^{(Also in 43, 44, 45)}
• Fixed crashes when certain app event handlers call back into Electron synchronously. #53258 ^{(Also in 43, 44, 45)}
• Fixed Ctrl+Y not yanking text killed with Ctrl+K in text fields on macOS. #53635 ^{(Also in 44, 45)}
• Fixed default protocol client APIs falsely returning true on Windows. #53937 ^{(Also in 43, 44, 45)}
• Fixed desktopCapturer.getSources() leaving non-resizable windows resizable on macOS. #54360 ^{(Also in 43, 44, 45)}
• Fixed fs.constants.O_DIRECTORY, O_NOFOLLOW and O_DIRECT holding x86 values on Linux arm64 and armv7l, which made opening a directory fail with EINVAL, and made require('trace_events') behave the same on cross-compiled builds as on native ones. #53316 ^{(Also in 42, 43, 44, 45)}
• Fixed fs.rmSync failing to remove read-only files on Windows. #54180 ^{(Also in 42, 43, 44, 45)}
• Fixed GDK_BACKEND leaking into processes spawned by Electron apps on Linux. #54379 ^{(Also in 43, 44, 45)}
• Fixed GPU shaders compiled by Skia not being cached between launches. #54113 ^{(Also in 44, 45)}
• Fixed handling of malformed asar archives whose size fields do not match the file length. #55171 ^{(Also in 43, 44, 45)}
• Fixed helper executables on macOS starting a second app instance when launched without a process type, for example through child_process.fork() with the runAsNode fuse disabled; fork() now throws in that configuration. #53831 ^{(Also in 44, 45)}
• Fixed hidden windows continuing to render at full frame rate after setBackgroundThrottling(false) followed by setBackgroundThrottling(true). #54311 ^{(Also in 44, 45)}
• Fixed inconsistent handling of asar archive paths between the main process and child processes. #55173 ^{(Also in 43, 44, 45)}
• Fixed interrupted macOS updates leaving a broken app behind. #54842 ^{(Also in 44, 45)}
• Fixed link-opened windows not using the opener's session and webPreferences. #55030 ^{(Also in 42, 43, 44, 45)}
• Fixed main process crashes when navigating to http://accessibility/ or http://devtools/, when using the LanguageModel API from a Worker with a local AI handler registered, when an extension background page used navigator.mediaDevices, and when calling SerialPort.forget() for a disconnected device. #53305 ^{(Also in 43, 44, 45)}
• Fixed MV3 extension events not arriving to background service workers. #55146 ^{(Also in 43, 44, 45)}
• Fixed native addons deriving from node::ObjectWrap aborting during garbage collection on Node.js 24.19.0 and later. #53390 ^{(Also in 42, 43, 44, 45)}
• Fixed net.fetch and session.fetch failing permanently with net::ERR_FAILED after the Network Service process restarts. #54902 ^{(Also in 42, 43, 44, 45)}
• Fixed net.fetch() / net.request() spending seconds of main-process time buffering large streamed request bodies. #53858 ^{(Also in 44, 45)}
• Fixed non-network Web Worker requests (such as file:// and custom schemes) bypassing protocol.handle() and webRequest handlers. #55119
• Fixed pointerLock permission requests from in-process iframes reporting the parent frame instead of the requesting frame. #54432 ^{(Also in 42, 43, 44, 45)}
• Fixed process.nextTick and promise callbacks queued in protocol/webRequest handlers running at the wrong time. #54292 ^{(Also in 45)}
• Fixed protocol.registerSource schemes not applying the same fetch rules as protocol.handle schemes. #55172 ^{(Also in 44, 45)}
• Fixed ready-to-show never firing for some hidden windows on Windows and Linux. #54090 ^{(Also in 43, 44, 45)}
• Fixed renderer crashes during garbage collection inside ShadowRealms. #54840 ^{(Also in 44, 45)}
• Fixed session.setPermissionCheckHandler receiving the top-level origin and a null webContents for hid and usb checks made from a subframe. #53656 ^{(Also in 42, 43, 44, 45)}
• Fixed setCertificateVerifyProc occasionally not being applied to a request issued concurrently with the first request to a host. #55028 ^{(Also in 42, 43, 44, 45)}
• Fixed setContentProtection(true) having no effect in Windows remote sessions. #54492 ^{(Also in 44, 45)}
• Fixed setIgnoreMouseEvents() taking effect late on X11. #54487 ^{(Also in 43, 44, 45)}
• Fixed setIgnoreMouseEvents(true) being undone by the next resize on X11. #54375 ^{(Also in 43, 44, 45)}
  • Added setIgnoreMouseEvents support on Wayland.
• Fixed several non-functional DevTools integrations: the Security panel's "View certificate" button, Ctrl+wheel zooming inside DevTools, and DevTools keyboard shortcuts (e.g. F8) while the inspected page has focus. #51806 ^{(Also in 43, 44, 45)}
• Fixed several object lifetime issues in Debugger, Menu, Tray, Notification, globalShortcut, utilityProcess, ServiceWorkerMain, WebFrameMain, webFrame, sharedTexture, systemPreferences, netLog, MessagePortMain, net.request and shell.openPath(). #53738 ^{(Also in 44, 45)}
• Fixed shell.showItemInFolder() on Linux for paths containing #, ? or % when the file manager is reached over D-Bus. #54350 ^{(Also in 44, 45)}
• Fixed the default action label on Linux notifications not being localized. #54366 ^{(Also in 43, 44, 45)}
• Fixed the GPU process crash-looping on Windows when the sandbox cannot read the install folder; the folder is now reported instead. #54382 ^{(Also in 43, 44, 45)}
• Fixed the PDF viewer failing to save an edited PDF with NotAllowedError: Third party iframes are not allowed to show a file picker. #53313 ^{(Also in 43, 44, 45)}
• Fixed the tray context menu not working for snap-confined apps because AppArmor blocked the /org/chromium/DbusMenu path. #54027 ^{(Also in 44, 45)}
• Fixed the zoom level resetting on file: and other host-less pages after a location.hash change. #54381 ^{(Also in 43, 44, 45)}
• Fixed Tray icons not appearing when running inside Flatpak or Snap sandboxes on Linux. #53641 ^{(Also in 44, 45)}
• Fixed typing not working after closing an alert() or confirm() on Windows. #54380 ^{(Also in 43, 44, 45)}
• Fixed utilityProcess dropping messages posted with process.parentPort.postMessage() right before the process exits. #54924 ^{(Also in 42, 43, 45)}
• Fixed utilityProcess dropping stdout/stderr output that the child wrote immediately before exiting. #54262 ^{(Also in 42, 43, 44, 45)}
• Fixed V8 code caching for https scripts loaded by file:// and custom-scheme pages. #53676 ^{(Also in 44, 45)}
• Fixed visual zoom limits resetting on navigation and not applying to webviews. #54373 ^{(Also in 43, 44, 45)}
• Fixed WebAssembly modules loaded from the code cache crashing or throwing RuntimeError: unreachable after updating between certain patch releases. #54234 ^{(Also in 42, 43, 44, 45)}
• Fixed webContents emitting unresponsive right after the system wakes from sleep on Windows, and emitting responsive when a hung window was hidden rather than when it recovered. #53529 ^{(Also in 44, 45)}
• Fixed webContents.capturePage() on offscreen windows returning an image resampled to the display's scale factor instead of rendered at the window's offscreen.deviceScaleFactor. #53810 ^{(Also in 43, 44, 45)}
• Fixed webContents.executeJavaScript() with userGesture set not granting browser-side user activation, which could make activation-gated APIs fail. #54923 ^{(Also in 45)}
• Fixed webContents.on(), removeListener() and removeAllListeners() throwing "Object has been destroyed" for console-message listeners after the WebContents was destroyed. #53493 ^{(Also in 42, 43, 44, 45)}
• Fixed webview.findInPage() hanging when the host page also has an iframe. #54508 ^{(Also in 43, 44, 45)}
• Fixed win.isFullScreen() being stale in fullscreen events on Windows. #54990 ^{(Also in 44, 45)}
• Fixed win.setEnabled(false) and modal child windows not blocking input on Wayland. #54427 ^{(Also in 43, 44, 45)}
• Fixed Window Controls Overlay CSS environment variables and navigator.windowControlsOverlay not being populated for WebContentsViews in a BaseWindow. #53639 ^{(Also in 44, 45)}
• Fixed window state not being persisted when a window entered or left fullscreen, or was maximized or unmaximized, without also being moved or resized. #53566 ^{(Also in 44, 45)}
• Fixed Windows tray icons that lost their tooltip when explorer restarted. #54624
• Fixed zoom in/out getting stuck after zooming past the 25%-500% range. #54374 ^{(Also in 43, 44, 45)}
  • Fixed setVisualZoomLevelLimits() shrinking pages when the minimum is under 1.
• getUserMedia with chromeMediaSource: 'desktop' no longer accepts WebContents source ids; use chromeMediaSource: 'tab' with webContents.getMediaSourceId() or setDisplayMediaRequestHandler to capture a WebContents. #53687 ^{(Also in 42, 43, 44, 45)}
• Internal <webview>, window.close() and executeJavaScript reply IPCs are validated against the sending frame. #53684 ^{(Also in 42, 43, 44, 45)}
• nodeIntegrationInWorker now applies only to workers created by frames that themselves have Node integration; enable nodeIntegrationInSubFrames to keep Node in workers created by subframes. #53686 ^{(Also in 42, 43, 44, 45)}
• openExternal permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. #53682 ^{(Also in 42, 43, 44, 45)}
• pointerLock and keyboardLock permission requests now report the requesting frame, and execCommand('paste') requires user activation in the frame that calls it. #53664 ^{(Also in 42, 43, 44, 45)}
• Window geometry APIs now reject non-finite and out-of-range values. #54216

• Fixed BaseWindow.setBounds() throwing when given a partial bounds object. #54333
  • Improved the performance of app.getName(), app.name, app.getVersion() and app.getAppPath().
• Fixed the app becoming unresponsive when a page has a very large number of app-region draggable elements. #53595 ^{(Also in 43, 44, 45)}
• Improved cold-launch time on macOS by prefetching Electron's framework files. #54515 ^{(Also in 45)}
• Improved the performance of APIs that return rectangles, sizes, points and display objects. #54207 ^{(Also in 44, 45)}
• Improved the performance of building and showing menus. #53876
• Improved the performance of fs operations and require() on files inside asar archives. #53852 ^{(Also in 44, 45)}
• Improved the performance of session.getUserAgent(). #54206 ^{(Also in 44, 45)}
• Improved throughput of responses that protocol.handle handlers return straight from net.fetch. #52953 ^{(Also in 44, 45)}
• Made sandboxed renderers without a preload script start faster. #53972
• Reduced sandboxed renderer startup work for preload scripts that do not use Buffer. #53855 ^{(Also in 45)}
• Reduced the cost of calling native methods and properties on BrowserWindow, BaseWindow, WebContents, WebFrameMain, Session and View from JavaScript. #54331 ^{(Also in 45)}

• Deprecated the synchronous safeStorage.isEncryptionAvailable(), safeStorage.encryptString() and safeStorage.decryptString() in favor of isAsyncEncryptionAvailable(), encryptStringAsync() and decryptStringAsync(). #53670 ^{(Also in 45)}
• Electron's internal JavaScript bundles are no longer listed in require('module').builtinModules or loadable through process.getBuiltinModule(). #53547 ^{(Also in 45)}
• Made sandboxed preload scripts start faster; Electron no longer evaluates a JavaScript bundle of its own in sandboxed renderers unless webviewTag is enabled. #53974
• Refactored mouse forwarding on Windows to fix setIgnoreMouseEvents(true, { forward: true }) related issues. #52633 ^{(Also in 44, 45)}
• Removed the no-op enableWebSQL web preference from the documentation and TypeScript definitions. #54229
• Updated Chromium to 158.0.8114.0. #55143
• Updated Node.js to v24.22.1. #55164

• Documentation changes: #54300, #54587, #54739

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

• v16.4.2
• [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
• [lts-active] test: Pin react-virtualized (#100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
• [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Huge thanks to @mischnic, @lukesandberg, @acdlite, @eps1lon, and @sokra for helping!

• 50c15e7: Fixed .breadcrumb link styles applying to the items of a dropdown placed inside it.
• 2bdbab3: Fixed dark mode contrast of .text-muted and other muted theme color utilities with a lighter --tblr-muted value.
• 1745d1f: Fixed the .flag size classes, which were stretched to one height inside flex containers because the height came from aspect-ratio.
• db649f4: Fixed .form-check-label stretching the clickable area of a checkbox or radio across the whole row.
• f076113: Fixed the arrow position and the room kept for it in .form-select-sm and .form-select-lg.
• 0d2e253: Fixed .modal-lg and .modal-xl falling back to the default width in viewports below the lg and xl breakpoints.
• 5d5186e: Fixed Modal and Offcanvas not returning focus to the element that opened them when closed.
• e069052: Fixed .page-text in pagination using the body font size instead of --tblr-pagination-font-size, including pagination-sm and pagination-lg.
• ac8eb82: Fixed ApexCharts demos and Dropzone previews to respect prefers-reduced-motion, with a shared prefersReducedMotion() helper.
• 8336b33: Added a focus ring to .card-body-scrollable and .table-responsive so a scrollable region that is focused with the keyboard is visible.
• cf3ceaa: Fixed the native clear button missing from .form-control search inputs in Chrome and Safari.
• 73392da: Fixed .sortable-drag tilting the dragged element itself in native drag mode, which broke the drag.
• c9e9b9b: Fixed the uneven .table-bordered grid in the dark theme by using the opaque border color.
• f1a49aa: Fixed .text-bg-* and .progress-bar hard-coding white text instead of reading the --tblr-*-fg tokens.
• 3eaeb74: Fixed the Tom Select focus ring leaving the wrapper border visible at the corners.
• 0df5946: Fixed the Tom Select focus ring flashing black before it fades in.
• 7ee278f: Fixed the square start corners of a Tom Select that opens an .input-group.
• 01f6a6c: Fixed the Tom Select dropdown text growing to the mobile font size on phones.
• fa4c175: Fixed the bright dividers before the remove button of Tom Select chips in the dark theme.

• 76b309f: Fixed the unnamed search input in the AdvancedTable demo by adding an aria-label.
• 74f6193: Fixed the heading order on the dashboard and other preview pages so no heading level is skipped.
• 041d4e9: Added an accessible name to the split dropdown toggle and the icon-only button demos.
• 1dfe93d: Fixed the missing accessible name on the invalid state input in the form elements demo by adding aria-label.
• 2225064: Fixed the select all checkbox in the Invoices table on the tables preview page.
• ae7cd30: Added aria-label to the row checkboxes in the invoices, tasks and advanced table demos and the input group checkbox and radio.
• ac6615c: Fixed the page header in DefaultLayout so it sits inside the <main> landmark.
• fcf5276: Added an ariaLabel prop to Pagination and gave each pagination on a page its own name.
• 276c904: Added an ariaLabel prop to Range and named the noUiSlider handles on the form elements pages.
• 6acc5c5: Fixed unlabeled <select> elements on the form demo pages and added an ariaLabel prop to the Select component.
• c15dac2: Added hidden text to empty <th> cells in the Table, AdvancedTable, TopDeals and Invoices demos and the tour page.
• 9beef3a: Updated the demo Toast to use role="status" and aria-live="polite" by default, with an urgent prop for alert.
• c3ae0ed: Fixed the height of the Traffic summary chart on the dashboard page.

• Reduce repeated scans when concatenating imported modules. (by @xiaoxiaojx in #22865)

• Avoid allocating CSS module sets for single-group chunks. (by @xiaoxiaojx in #22866)

• Return the value of every module type loaded with importModule(). (by @alexander-akait in #22869)

• Fix storage GC deleting nothing when one pending object is still referenced #12276 (PR: #12269)
• Fix objects GC stopping file deletion when one file still has a child row #12277 (PR: #12269)
• Fix file restore leaving its storage objects marked for deletion #12278 (PR: #12269)
• Fix backend workers staying parked forever when nested calls take the same concurrency limits #12279 (PR: #12269)
• Fix one profile's activity blocking the audit events of every other profile #12280 (PR: #12269)
• Fix storage garbage collection blocking database vacuum during long deletions #12396 (PR: #12397)
• Fix saving a version taking seconds and the version quota never counting saved versions #12404 (PR: #12405)
• Fix file_change accumulating revisions that the objects GC never collects #12418 (PR: #12419)

• Add a graceful instance drain through the /readyz endpoint #12281 (PR: #12269)
• Add an accumulated queue gauge to the CLIMIT metrics #12282 (PR: #12269)
• Expose the backend log events as a metric by logger and level #12312 (PR: #12313)

• #10658: Add Copy as Markdown buttons for AsyncAPI channels and operations, with customizable action slots for these sections, tags, and introduction.

• #10687: Display operation-level AsyncAPI message payload examples in a dark code card with message and example selection, plus selectable reply payload examples below it. Keep message and reply schemas in the left column.

  Preserve declared AsyncAPI message order in the documentation and example picker.

• #10697: Add urlRouting: false to keep API reference navigation in internal state without reading or changing the host page URL.

• #10711: fix: keep the response copy button in view when the code scrolls

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10718: Hide SDK generation buttons and the local sidebar promotion when developer tools are disabled, and expose the generate-sdk-button CSS class on the client libraries button.

• #10652: Display authored AsyncAPI server-variable examples in the shared Example/Examples popup with copy support, including examples from referenced variables.

  Keep the shared examples popup label clickable when hovered and align server-variable popups with their labels to avoid overlapping the sidebar.

• #10709: Move AsyncAPI navigation cards from tags to channel sections, listing each channel's operations beside its details.

• #10723: List AsyncAPI reply messages that live on the operation's own channel only under Replies, instead of repeating them under Messages or Other Channel Messages.

• #10705: Remove the duplicate standalone OAuth scope list from operation details. Required scopes remain available in the authentication badge popover.

• #10707: Match AsyncAPI channel badge placement and spacing to the OpenAPI modern and classic layouts. Use the shared badge component for Send/Receive while preserving their arrows and colors.

• #10687: Display operation-level AsyncAPI message payload examples in a dark code card with message and example selection, plus selectable reply payload examples below it. Keep message and reply schemas in the left column.

  Preserve declared AsyncAPI message order in the documentation and example picker.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10652: Display authored AsyncAPI server-variable examples in the shared Example/Examples popup with copy support, including examples from referenced variables.

  Keep the shared examples popup label clickable when hovered and align server-variable popups with their labels to avoid overlapping the sidebar.

• #9939: Switch ScalarCodeBlock from @scalar/code-highlight to @scalar/highlight/compat. The markup keeps the same <pre><code class="hljs language-x"> envelope and the same hljs-* token classes, so code.css and every consumer of the rendered string are unchanged, but the highlighter underneath is now a state machine rather than a lowlight instance built per call — around 47 KB gzipped for all forty grammars against 127 KB before.

  Two token colors move, both because the finer scope vocabulary now reaches code.css rules that lowlight's output never hit. JSON true, false and null render green rather than purple: highlight.js nested a hljs-keyword inside hljs-literal, so the keyword color won, and a single hljs-literal span now picks up the green that stylesheet already defines for literals. HTTP header values, previously left unstyled, are colored as well. Python docstrings are scoped as comments instead of strings.

  ScalarMarkdown still uses @scalar/code-highlight for its remark/rehype pipeline, which the compat layer deliberately does not cover.

• #10721: Fix the combobox filter declaration importing a private source alias and restore toast styles after upgrading vue-sonner.
• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.
• #10699: Apply the shared import and Tailwind class formatting to components.
• #10704: Preserve sidebar section spacing when navigation overflows, including AsyncAPI filters with all tags selected.

• #9939: Add a dedicated curl grammar, so curl command lines keep the colouring they had under @scalar/code-highlight.

  curl was mapped to the bash grammar. That is a defensible reading — a curl invocation is a shell command line — but it loses the two tokens a reader actually looks for. @scalar/code-highlight ships a bespoke curl grammar, and code.css is written against it: .hljs.language-curl .hljs-literal and .hljs.language-curl .hljs-string both have curl-specific rules. Under bash, curl and the request method came out unscoped, so the command name lost its keyword colour and POST lost its symbol colour entirely.

  The new grammar mirrors the reference: the command is a keyword, --request/-X and other flags are literals, the method they carry is a symbol, and $(…) inside a double-quoted value reads as a variable. Output now matches the reference class for class.

  This also adds a symbol scope to the vocabulary, mapped to hljs-symbol in the compat layer — a scope highlight.js has and code.css already styles, and the natural home for Ruby symbols and Erlang atoms too.

  A curl sample joins the shared test corpus, so the differential suites compare this grammar against the reference on every run.

• #9939: feat(highlight): colour the names declarations bind in Java, C#, Go and Rust, and PowerShell parameters like shell flags

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #9939: Fix JavaScript comparisons read as generic calls, and keep compiled grammars when a grammar is registered again

  An identifier followed by < read as the start of a generic call, so count in if (count <= max) and b in b <= 10 were painted as function names. The generic branch now requires a type argument list that closes and is followed by (, so useState<number>(0) still scopes and a comparison does not.

  registerLanguage also evicted a grammar's compiled form whenever it was called, even with the grammar already registered under every one of its names. A caller that registers on every render recompiled on every render, which cost close to twenty times the highlight itself. Registering the same grammar again is now a no-op.

• #10696: Upgrade Undici to 8.12.3. JSON Magic, Mock Server, Workspace Store, OpenAPI to Markdown, and Scalar App now require Node.js 22.19.0 or later; Node.js 22.0 through 22.18 are no longer supported. Undici 8 enables HTTP/2 by default.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.
• #10715: fix: keep maps such as components.schemas as objects when partially bundling references whose keys look like numbers (e.g. #/components/schemas/400)
• #10720: Prevent prototype pollution when bundling with unsafe extension keys, isolate URL mappings from inherited or shared objects, and handle prototype property names correctly in the reverse mapping cache.

• #10696: Upgrade Undici to 8.12.3. JSON Magic, Mock Server, Workspace Store, OpenAPI to Markdown, and Scalar App now require Node.js 22.19.0 or later; Node.js 22.0 through 22.18 are no longer supported. Undici 8 enables HTTP/2 by default.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10696: Upgrade Undici to 8.12.3. JSON Magic, Mock Server, Workspace Store, OpenAPI to Markdown, and Scalar App now require Node.js 22.19.0 or later; Node.js 22.0 through 22.18 are no longer supported. Undici 8 enables HTTP/2 by default.

• #10697: Add urlRouting: false to keep API reference navigation in internal state without reading or changing the host page URL.

• #10697: Add urlRouting: false to keep API reference navigation in internal state without reading or changing the host page URL.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10696: Upgrade Undici to 8.12.3. JSON Magic, Mock Server, Workspace Store, OpenAPI to Markdown, and Scalar App now require Node.js 22.19.0 or later; Node.js 22.0 through 22.18 are no longer supported. Undici 8 enables HTTP/2 by default.

• #10687: Display operation-level AsyncAPI message payload examples in a dark code card with message and example selection, plus selectable reply payload examples below it. Keep message and reply schemas in the left column.

  Preserve declared AsyncAPI message order in the documentation and example picker.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10702: Preserve security schemes when expanding a compact chunk index, allowing authentication definitions to load with the initial document. Existing security schemes take precedence over chunk references with the same name.

• #10723: List AsyncAPI reply messages that live on the operation's own channel only under Replies, instead of repeating them under Messages or Other Channel Messages.

• #10721: Update declaration tooling while preserving bundled integration types.
• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update declaration tooling while preserving bundled integration types.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.
• #10721: Declare the Nuxt schema dependency used by the module's published types.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10652: Display authored AsyncAPI server-variable examples in the shared Example/Examples popup with copy support, including examples from referenced variables.

  Keep the shared examples popup label clickable when hovered and align server-variable popups with their labels to avoid overlapping the sidebar.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #9939: Fix a code line rendering shorter than its neighbours when nothing on it is highlighted

  line-height was declared on :where(code.hljs) *, which reaches elements and never text nodes. A highlighter emits a token span only where it has a scope to give, so a line of entirely unscoped text — the content between two JSX tags, for example — carried no element, fell back to the surrounding line height, and rendered about two pixels shorter than the lines around it.

  Line numbers hid this. That mode wraps every line in span.line, which is an element, so the same block rendered evenly with a gutter and unevenly without one. The declaration now sits on code.hljs itself, so it sets the line box for every line and the spans inherit it.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.
• #10719: Preserve URL format tokens and error details when logging failed imports.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10701: Preserve descriptions and specification extensions on OAuth2 and Basic security schemes, and preserve extensions on form-data fields when upgrading OpenAPI 2.0 API descriptions.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.
• #10686: Show AsyncAPI operations as sidebar leaf entries and hide individual messages. Message and reply details remain available in the documentation.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Fix the combobox filter declaration importing a private source alias and restore toast styles after upgrading vue-sonner.
• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.

• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.
• #10696: Upgrade Undici to 8.12.3. JSON Magic, Mock Server, Workspace Store, OpenAPI to Markdown, and Scalar App now require Node.js 22.19.0 or later; Node.js 22.0 through 22.18 are no longer supported. Undici 8 enables HTTP/2 by default.

• #10630: Load the Galaxy OpenAPI document from the registry in production while keeping the local document for previews.

• #10714: Make CmdOrCtrl+W in the desktop app close the active tab, and close the window when only one tab is left.
• #10721: Update compatible dependencies while retaining the existing Node.js support and five-day release-age policy.
• #10696: Upgrade Undici to 8.12.3. JSON Magic, Mock Server, Workspace Store, OpenAPI to Markdown, and Scalar App now require Node.js 22.19.0 or later; Node.js 22.0 through 22.18 are no longer supported. Undici 8 enables HTTP/2 by default.

• @scalar/api-reference@1.76.0

• @scalar/api-reference@1.76.0

• @scalar/api-reference@1.76.0

• @scalar/api-reference@1.76.0

• @scalar/api-reference@1.76.0

• @scalar/api-reference@1.76.0

• @scalar/api-reference@1.76.0

• Drawer: 修复 mode='push' 时，margin 样式异常的问题 @RSS1102 (#4418)
• Form: 修复 1.18.3 版本后，最后一个表单项无 name 时上方字段 margin-bottom 丢失的问题@uyarn (#4427)

---

• Drawer: Fixed an issue where the margin style was incorrect when mode='push' @RSS1102 (#4418)
• Form: Fixed an issue where the preceding field's margin-bottom was missing when the last form item had no name after version 1.18.3 @uyarn (#4427)

• Align skip range API behavior with its documentation (#10753) (90415b0), closes #10752
• CMCD: Keep request URIs intact in CMCD query mode (#10779) (caa53c0)
• DASH: Honor SegmentTemplate@endNumber (#10785) (a3307f8)
• End a network outage with an error instead of switching variants forever (#10784) (1ff7c8d), closes #10782
• Fix relative request URIs failing with CMCD query mode (#10764) (fd852e7)
• HLS: Keep the live availability window anchored to the playlist (#10741) (13b9c62), closes #9346
• Play multiplexed MP4 when forceTransmux is enabled (#10765) (28cea4a), closes #10762
• Stop applying Safari 8-12 MSE workarounds on PlayStation (#10794) (a8d1cbe), closes #10783
• TTML: Resolve cells and other units in a region's origin and extent (#10778) (af45b67)
• WebVTT: Anchor vertical cues to the correct edge (#10775) (36bcbba)
• WebVTT: Clamp cue box size to the space its anchor leaves (#10766) (c8cfcfb)

• Revert "More parity for webpack loader build dependencies (#99549)": #100634
• Cache bundle analysis per output file: #100475

Huge thanks to @mischnic and @wbinnssmith for helping!