All pull requests

Pull requests

• fix(js): block unparsable fetch URLs instead of skipping the SSRF gate

  #1076·mnaza opened Sep 24, 2026Contributor·

  ·

• fix(js): reject cross-origin URLs in history.pushState and replaceState

  #1075·mnaza opened Sep 24, 2026Contributor·

  ·

• fix(js): expose session history to window.history

  #1074·Micaso opened Sep 24, 2026·

  ·
  1

• fix(net): bound Expires fields and stop suffix-matching IP cookie domains

  #1073·mnaza opened Sep 24, 2026Contributor·

  ·

• fix(render): apply the SSRF deny-set to the renderer's standalone HTTP loader

  #1072·mnaza opened Sep 24, 2026Contributor·

  ·

• fix(js): implement checkVisibility() and inherit computed visibility

  #1071·Micaso opened Sep 24, 2026·

  ·
  1

• fix(browser): enforce the file:// navigation gate in Page itself

  #1070·mnaza opened Sep 24, 2026Contributor·

  ·
  1

• fix(net): bound the robots.txt cache

  #1064·mnaza opened Sep 21, 2026Contributor·

  ·
  1

• fix(net): grow the TextDecoder output buffer instead of truncating

  #1063·mnaza opened Sep 21, 2026Contributor·

  ·
  1

• fix(render): bound image and mask rasters that CSS sizes

  #1062·mnaza opened Sep 21, 2026Contributor·

  ·
  1

• fix(js): fail closed when a Continue intercept URL override can't be parsed

  #1058·mnaza opened Sep 21, 2026Contributor·

  ·
  1

• fix(js): enforce same-origin in history.pushState/replaceState

  #1057·mnaza opened Sep 21, 2026Contributor·

  ·
  1

• fix(net): don't suffix-match cookie domains for IP-address hosts

  #1054·mnaza opened Sep 21, 2026Contributor·

  ·
  1

• Fix #1046, #1036: bound year/day ranges in parse_http_date

  #1052·Ray0907 opened Sep 21, 2026·

  ·

• fix(net): bound cookie Expires year to stop a parse_http_date CPU DoS

  #1047·mnaza opened Sep 20, 2026Contributor·

  ·
  1

• fix(browser): address linked stylesheet <link> by node id, not query index

  #1045·mnaza opened Sep 20, 2026Contributor·

  ·
  1

• ci: retain font dependency maintenance exceptions

  #1042·AntonioRossi opened Sep 20, 2026Contributor·

  ·
  1

• fix(obscura-js): release native linked-stylesheet state on subtree removal (#1039)

  #1041·mnaza opened Sep 20, 2026Contributor·

  ·
  1

• fix(obscura-net): reject out-of-range day in parse_http_date (#1036)

  #1037·mnaza opened Sep 20, 2026Contributor·

  ·
  1

• fix(obscura-net): enforce __Host-/__Secure- cookie name prefixes (#1034)

  #1035·mnaza opened Sep 20, 2026Contributor·

  ·
  1

• fix(render): ignore transforms on ordinary inline boxes

  #1033·lisa0314 opened Sep 20, 2026Contributor·

  ·
  1

• Deliver media-query changes and apply reduced-motion emulation

  #1028·AntonioRossi opened Sep 19, 2026Contributor·

  ·
  1

• Emit document replacement lifecycle for Playwright setContent

  #1027·AntonioRossi opened Sep 19, 2026Contributor·

  ·
  1

• Enforce modal focus and inert background input

  #1026·AntonioRossi opened Sep 19, 2026Contributor·

  ·
  1

• innerText returns rendered text, not source text

  #1023·zorahrel opened Sep 19, 2026·

  ·