• Safari builds take your own app icon, extension build --browser=safari --app-icon=icon.png uses the PNG as is instead of plating the manifest icon on a white tile. Docs
• A production build warns when a public env variable is named like a secret, so an EXTENSION_PUBLIC_API_KEY never ships in a bundle unnoticed. Docs
• SQLite in DevTools, npx extension@latest create my-extension --template=devtools-typescript-sqlite starts a DevTools panel backed by SQLite in the browser.
• Firefox content scripts run once after a reload, the dev session no longer injects a second copy, and a missing scripting permission is named instead of failing quietly.
• The Edge store zip leaves the manifest key out, dist/edge keeps it, so an unpacked Edge install keeps the pinned id your OAuth redirects depend on.

Features

• Add an exclude config key to leave files out of one browser build (#991) (151892d3d)

Fixes

• Resolve symlinked project paths before naming a reloaded file (#970) (c68fe6349)

• Emulated Chromium needs no flag, extension dev --browser=chromium-emulator opens the emulated browser on its own now that the engine is public, and names the engine origin when it cannot be reached instead of opening a dead page
• The wasm budget reads the surface that fetches the file, a .wasm reached only by pages and workers gets the 32 MiB budget while one a content script or the service worker reaches keeps 1 MiB and still warns, and perfBudgets.ignore excuses any asset by its output path or a glob

• Development-only pages and scripts, a player.dev.html in pages/ or a bench.dev.ts in scripts/ runs in extension dev and never reaches a production build, no HTML, no chunk, no manifest entry
• Extra files in the build with include, map output paths to files or folders in extension.config.js, model weights or an exported tree outside the project included, layered per browser and per command
• A MAIN-world content script leaves nothing on the page, production builds stop publishing the extension's base URL and the cleanup global to the host page, and the dev browser now passes bot checks and keeps sign-in pop-ups responsive
• WebAssembly runtimes get their own 32 MiB budget, an on-device ML build with onnxruntime or ffmpeg ends "compiled" instead of a budget warning it could never act on, and perfBudgets.wasm caps it when you want to

Features

• Add dev-only pages and scripts and an include config key (#951) (cfe62f1f3)

• "Ready" means the extension is running, Chrome dev sessions print ready only once the extension connects, and name the stuck profile when it never does
• A build never overwrites a live dev session, extension build into the folder a running extension dev serves now stops before writing anything and points to --out-dir, so the browser you are working in keeps its files
• Store warnings before you upload, a production build flags localhost and other loopback origins left in the manifest, and an Edge build says when its embedded settings page will be clipped to 368px, with the one-line edge:options_ui fix

Fixes

• Stop the tabs permission warning on tabs.create({url}) (#920) (eeed54671)

• Build beside a running dev session, extension build --out-dir <path> writes <path>/<browser> and leaves dist/<browser> to the dev server, so a test suite or store packaging never stops the window you are working in
• Embedded options pages open every time, a Chromium options_ui page that paints empty until its data arrives used to leave Chrome's options dialog closed; builds now give it a first layout, so the dialog opens and grows with the content
• Your web_accessible_resources scope wins, a resource you already list for a few sites stays on those sites even when a scripts/ file references it, instead of being widened to every origin

Features

• Add --out-dir to build and leave a live dev session alone (#907) (d9982b4bb)
• Add a dispatchable loop of the content-reload spec (#882) (48dfbd3c1)

Fixes

• Fix commit hooks in worktrees and gitignore rule provenance (#902) (9e0037287)
• Fix browser launch reports, dev server port holds and reconnects (#901) (e1d736bed)
• Fix dev session state, workspace installs and Windows renames (#900) (05b6299ff)
• Fix asset rules, host matching, polyfill and web resources (#899) (785bde177)
• Fix runtime file tracing, page scripts and dev root lookup (#898) (2ece71246)
• Fix CSS, resolve and manifest field handling in builds (#897) (1aa9a47eb)

• Sidebar scaffolds name their page, the greeting a fresh extension create sidebar logs now says it is the sidebar page, so a busy console reads at a glance

Features

• Enable a Safari extension and read its UI through Accessibility (#874) (48030be45)

Fixes

• Stop asking for tabs when host permissions already grant every site (#857) (482293d0c)
• Stop managed Firefox self-updates and name the template source (#841) (895b2efa5)
• Restore url override tabs after a dev extension reload (#839) (9597c94e1)

• Safari dev runs leave your Safari alone, the app a run opens stays in the background and is the only one quit on stop. Safari guide: https://extension.js.org/docs/browsers/safari
• Sidebar starters read the page, every extension create sidebar template now asks the open tab for its title through a ready-made message channel, so a panel that follows the page starts from working code

Fixes

• Fix the close code spec port race and wait for state in specs (#799) (fe5ddbae1)

• One sidebar or toolbar key builds for every browser. Declare the Chrome side panel and Firefox gets a working sidebar, declare the Firefox sidebar and Chrome and Edge get the side panel, and the Firefox Manifest V2 recipe gets its toolbar button back. The build translates side_panel, sidebar_action and action to the key each browser reads and says so in one line.
• Zip archives moved, so check your CI paths. extension build --zip writes beside the browser folder as dist/<name>-<version>-<browser>.zip instead of inside dist/<browser>/. --zip-filename=release writes dist/release-chrome.zip, and adding --zip-source writes one dist/release-source.zip, so two browsers built with the same name never write over each other.
• The dev server answers only the hosts it knows. A request under another name, like a Docker service, a tunnel or a .local address, gets a 403 that names the fix: extension dev --allowed-hosts web,.ngrok.app, or commands.dev.allowedHosts in the config.
• Dev says what it really loaded. A changed .env restarts the session with the new value and an edited extension.config.js asks for a restart instead of printing success. A browser that never started or quit early marks ready.json as an error and --wait exits non-zero. extension dev <github url> builds only a folder it downloaded itself and leaves a same-named folder of yours untouched.

Features

• Add the examples catalog nightly lane and typecheck every spec (#766) (73e50b93e)
• Add configResolved, a folders key, define typings and ?raw (#671) (9e9b43b9f)
• Add a define option, a manifest entry and whole locale trees (#665) (f8966b2e2)

Fixes

• Resolve the Sass and Less loaders to absolute paths (#770) (9451400b5)
• Restore the CLI contracts scripts relied on at 4.1.30 (#764) (715cc6455)
• Resolve a remote source to a tree this tool actually fetched (#759) (11a99f545)
• Restore the browser launch and project layouts 4.1.30 accepted (#762) (e4dc4d06b)
• Stop a dev session reporting success for a change it ignored (#758) (d1a0f04d6)
• Stop shipping dev reload scaffolding and duplicate bundles (#755) (fd29e7077)
• Resolve locales per browser and accept _locales inside public (#729) (eb7540873)
• Stop telemetry from swallowing crashes and reprinting the notice (#723) (e45a8b734)
• Harden the dev server HTTP surface, port probe and emulator route (#722) (7e30f06ca)
• Stop the dev log relay from posing as the extension's devtools port (#720) (4363bc925)
• Guard cache groups and runtimeChunk, background.page is a page (#704) (d4fe9f6a2)
• Sweep only staging dirs whose owning build is gone (#681) (2454a9afa)
• Resolve root-owned web accessible resources at their root path (#666) (f556fd007)
• Fix the companion scan, unpacked preview and permission warnings (#664) (dab685f9d)
• Fix CSS module, JSON, extra entry and Vue loader defaults (#663) (33064f0fb)