From 3b3ab520cde406f733ddd33b739ee53576678277 Mon Sep 17 00:00:00 2001 From: delan azabani Date: Thu, 3 Sep 2026 10:46:33 +0800 Subject: [PATCH 1/7] blog: August in Servo (2026) --- commits.txt | 7579 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 7579 insertions(+) create mode 100644 commits.txt diff --git a/commits.txt b/commits.txt new file mode 100644 index 000000000..013de92ad --- /dev/null +++ b/commits.txt @@ -0,0 +1,7579 @@ +>>> 2026-08-01T23:32:55Z +https://github.com/servo/servo/pull/46553 (@shubhamg13, #46553) script: Wire `element` for `LargestContentfulPaint` (#46553) + ^ commit 3f08ca6d1664a50265140090b7faf3fcb86d82b1 + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # Wire the logic for `element` on `LargestContentfulPaint` using `OpaqueNode` + # + # While processing the `ReflowResult`, `OpaqueNode` is resolved and `Element` is stored in HashMap located in `document`. + # + # Testing: New WPT Passed (+ To be Added in #46851) + # Fixes: Part of #42000 + # +https://github.com/servo/servo/pull/46917 (@Taym95, @yezhizhen, #46917) fetch: implement Request navigation flags (#46917) + ^ commit d97c8c97a9a32f7aff09a340fa8443d68c2e7997 + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + ^ /!\ contains WebIDL changes! did we ship a new API? + # Implement Request.isReloadNavigation and Request.isHistoryNavigation. + # + # Testing: tests/wpt/meta/fetch/api/idlharness.https.any.js.ini and tests/wpt/meta/fetch/api/request/request-structure.any.js.ini + # +https://github.com/servo/servo/pull/46926 (@veyndan, #46926) android: Make `ServoView.GLThread` a static class (#46926) + ^ commit d26754353eda205f8ef9bbcb30425f38547828c8 + # Similar to ae3dbaa17d7c6bdd27a300e79a57e30816e798a7, this makes the inner class easier to reason about and makes the future conversion of `ServoView` to Kotlin easier. + # + # Testing: There are no automated tests for Android. +>>> 2026-08-02T23:26:51Z +https://github.com/servo/servo/pull/46928 (@servo-wpt-sync, #46928) Sync WPT with upstream (02-08-2026) (#46928) + ^ commit e7fdc0c794bbff47ad5b338fe46871451966fb2a + # Automated downstream sync of changes from upstream as of 02-08-2026 + # [no-wpt-sync] +https://github.com/servo/servo/pull/46923 (@mrobinson, #46923) More gracefully handle header parsing errors (#46923) + ^ commit f4dde2701bacd4972e6cfa319a3f0cbc9be21f64 + # This change is mainly a code health improvement which more gracefully handles + # the case that a header name or value cannot be parsed. Instead a + # panicking, a warning is issued in more cases. In addition, a few other + # `unwrap`s are replaced with graceful error handling in + # `xmlhttprequest.rs`. Finally, some header addition is done via typed + # headers. This cannot be used for the "Content-Type" header as `hyper` + # seems to destroy the original case of the header, leading to WPT + # failures. + # + # Testing: This change shold not modify behavior so should be covered by existing tests. + # +https://github.com/servo/servo/pull/46930 (@sagudev, #46930) script: Stop using an unforgeable holder for global objects with unforgeable properties (#46930) + ^ commit aaacc0e62d5e471091aad9df67f60563b97e70e8 + # Porting https://hg-edge.mozilla.org/mozilla-central/rev/256ea0d0de34 (from FF 51!) to servo + # + # This will help with SM bump I am working on. + # + # Testing: Should be covered by WPT tests +https://github.com/servo/servo/pull/46937 (@nicoburns, #46937) Upgrade to resvg v0.48.0 (#46937) + ^ commit 89c1ccd8ff4034c69c052065a1208d85bc545f31 + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # - Upgrade resvg to v0.48.0 + # - Also upgrade base64 to 0.23.0 seeing resvg pulls in the new version anyway + # + # There are lots of new passing tests due to resvg now exposing a more web compatible width and height. + # + # Testing: WPT tests + # +https://github.com/servo/servo/pull/46919 (@Gae24, #46919) script: Don't cache HTTP errors in the module map (#46919) + ^ commit f8ab249c71d9d904b093547659cf7b88457dd6b5 + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # Align Servo with the recent changes done in https://github.com/whatwg/html/pull/10327. Modules that are null due to network errors or MIME type mismatches are now ignored, allowing fetches to be retried. This change also simplifies the implementation by moving away from the previous Promise-based approach. + # + # Testing: New passes, expectations updated + # +https://github.com/servo/servo/pull/46925 (@veyndan, #46925) android: Convert `Servo` to Kotlin (#46925) + ^ commit 35672cc3d4beb768489f5218e73bee7aff0ddb01 + # Some types in other files have become non-nullable, since with the conversion of `Servo` to Kotlin, the Kotlin compiler can infer that these types are in fact non-nullable. + # + # Some types have also become nullable, as they were incorrectly labelled nullable in Kotlin since the caller was Java. Now that the invoker is also written in Kotlin, the incorrectly specified nullability produces a run time error. + # + # Testing: There are no automated tests for Android. + # Fixes: Part of #46701. +>>> 2026-08-03T23:34:33Z +https://github.com/servo/servo/pull/46940 (@veyndan, #46940) android: Remove unused code in `ServoView` (#46940) + ^ commit 2b3d009af9d8763a77a870e249f2700c21ab96e6 + # In preparation for converting this file to Kotlin (see #46701), this removes unused code so we're not migrating dead code. + # + # Testing: There are no automated tests for Android. +https://github.com/servo/servo/pull/46943 (@dependabot[bot], @dependabot[bot], #46943) build: bump zerocopy from 0.8.54 to 0.8.55 (#46943) + ^ commit dac85f094b6e9744e676fac5f584f4c2449617fb + # Bumps [zerocopy](https://github.com/google/zerocopy) from 0.8.54 to 0.8.55. + #
+ # Release notes + #

Sourced from zerocopy's releases.

+ #
+ #

v0.8.55

+ # + #

What's Changed

+ # + #

Full Changelog: https://github.com/google/zerocopy/compare/v0.8.54...v0.8.55

+ #
+ #
+ #
+ # Commits + # + #
+ #
+ # + # + # [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=zerocopy&package-manager=cargo&previous-version=0.8.54&new-version=0.8.55)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) + # + # Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. + # + # [//]: # (dependabot-automerge-start) + # [//]: # (dependabot-automerge-end) + # + # --- + # + #
+ # Dependabot commands and options + #
+ # + # You can trigger Dependabot actions by commenting on this PR: + # - `@dependabot rebase` will rebase this PR + # - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it + # - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency + # - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) + # + # + #
+https://github.com/servo/servo/pull/46944 (@dependabot[bot], @dependabot[bot], #46944) build: bump time from 0.3.53 to 0.3.54 (#46944) + ^ commit e081179e43d61aa5781253585a771782337d4b0d + # Bumps [time](https://github.com/time-rs/time) from 0.3.53 to 0.3.54. + #
+ # Release notes + #

Sourced from time's releases.

+ #
+ #

v0.3.54

+ #

See the changelog for details.

+ #
+ #
+ #
+ # Changelog + #

Sourced from time's changelog.

+ #
+ #

0.3.54 [2026-07-20]

+ #

Added

+ #
    + #
  • PrimitiveDateTime has been renamed to PlainDateTime.
    • + #
  • Duration has been renamed to SignedDuration.
    • + #
  • Iteration is now possible over Date, Month, and Weekday. Relevant iterator methods have been + # overridden to ensure maximum performance.
    • + #
+ #

For both PlainDateTime and SignedDuration, a non-deprecated type alias has been added for + # backwards compatibility. The new names should be preferred.

+ #

Changed

+ #
    + #
  • The associated metadata type (for powerfmt implementations) for various types has been changed + # to () and made public. This guarantees that no additional metadata will be present.
    • + #
+ #

Performance

+ #
    + #
  • More gains when parsing RFC 2822.
    • + #
+ #
+ #
+ #
+ # Commits + # + #
+ #
+ # + # + # [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=time&package-manager=cargo&previous-version=0.3.53&new-version=0.3.54)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) + # + # Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. + # + # [//]: # (dependabot-automerge-start) + # [//]: # (dependabot-automerge-end) + # + # --- + # + #
+ # Dependabot commands and options + #
+ # + # You can trigger Dependabot actions by commenting on this PR: + # - `@dependabot rebase` will rebase this PR + # - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it + # - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency + # - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) + # + # + #
+https://github.com/servo/servo/pull/46945 (@dependabot[bot], @dependabot[bot], #46945) build: bump bpaf from 0.9.26 to 0.9.27 (#46945) + ^ commit 7113b5b84e8fc1386a0b213427be901e3bfe1bb5 + # Bumps [bpaf](https://github.com/pacak/bpaf) from 0.9.26 to 0.9.27. + #
+ # Changelog + #

Sourced from bpaf's changelog.

+ #
+ #

bpaf [0.9.27], bpaf_derive [0.5.26] - 2026-07-29

+ #
    + #
  • improve error message if user passes an empty value to argument or positional
    • + #
+ #
+ #
+ #
+ # Commits + # + #
+ #
+ # + # + # [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=bpaf&package-manager=cargo&previous-version=0.9.26&new-version=0.9.27)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) + # + # Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. + # + # [//]: # (dependabot-automerge-start) + # [//]: # (dependabot-automerge-end) + # + # --- + # + #
+ # Dependabot commands and options + #
+ # + # You can trigger Dependabot actions by commenting on this PR: + # - `@dependabot rebase` will rebase this PR + # - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it + # - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency + # - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) + # + # + #
+https://github.com/servo/servo/pull/46946 (@dependabot[bot], @dependabot[bot], #46946) build: bump pastey from 0.2.2 to 0.2.3 (#46946) + ^ commit d4195103b22bab6e3e18000ad4217a30fa2fcd3d + # Bumps [pastey](https://github.com/as1100k/pastey) from 0.2.2 to 0.2.3. + #
+ # Release notes + #

Sourced from pastey's releases.

+ #
+ #

v0.2.3

+ #

Improved

+ #
    + #
  • Improved Branch Coverage #34
    • + #
  • Improved Line Coverage #32
    • + #
+ #

Full Changelog: https://github.com/AS1100K/pastey/compare/v0.2.2...v0.2.3

+ #
+ #
+ #
+ # Changelog + #

Sourced from pastey's changelog.

+ #
+ #

[0.2.3] - 2026-05-20

+ #

Improved

+ #
    + #
  • Improved Branch Coverage #34
    • + #
  • Improved Line Coverage #32
    • + #
+ #
+ #
+ #
+ # Commits + # + #
+ #
+ # + # + # [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pastey&package-manager=cargo&previous-version=0.2.2&new-version=0.2.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) + # + # Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. + # + # [//]: # (dependabot-automerge-start) + # [//]: # (dependabot-automerge-end) + # + # --- + # + #
+ # Dependabot commands and options + #
+ # + # You can trigger Dependabot actions by commenting on this PR: + # - `@dependabot rebase` will rebase this PR + # - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it + # - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency + # - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) + # + # + #
+https://github.com/servo/servo/pull/46947 (@dependabot[bot], @dependabot[bot], #46947) build: bump clang-sys from 1.8.1 to 1.9.1 (#46947) + ^ commit 5b8e417fdc0a4156216d6a33f7e602d1917f994a + # Bumps [clang-sys](https://github.com/KyleMayes/clang-sys) from 1.8.1 to 1.9.1. + #
+ # Release notes + #

Sourced from clang-sys's releases.

+ #
+ #

v1.9.1

+ #

Added

+ #
    + #
  • Added support for clang 19.0.x
    • + #
  • Added support for clang 20.0.x
    • + #
  • Added rewriter API.
    • + #
+ #

Changed

+ #
    + #
  • Search for libraries in LIBRARY_PATH in addition to LD_LIBRARY_PATH.
    • + #
+ #

Fixed

+ #
    + #
  • Reverted executable search that caused header search path failure on macOS.
    • + #
  • Improved Visual Studio search paths.
    • + #
  • Improved support for Cygwin.
    • + #
+ #

v1.9.0 [YANKED]

+ #

Changed

+ #
    + #
  • Added --link-static flag when listing static libraries to link to
    • + #
+ #

v1.8.2 [YANKED]

+ #

Changed

+ #
    + #
  • Improved Clang::find to first check directories related to the runtime-loaded libclang instance (if any)
    • + #
+ #

Fixed

+ #
    + #
  • Fixed linking to libclang on Windows with MSYS2
    • + #
  • Fixed Clang::find to support both the -target and --target arguments + # when using target-prefixed clang binaries
    • + #
+ #
+ #
+ #
+ # Changelog + #

Sourced from clang-sys's changelog.

+ #
+ #

[1.9.1] - 2026-06-29

+ #

Added

+ #
    + #
  • Added support for clang 19.0.x
    • + #
  • Added support for clang 20.0.x
    • + #
  • Added rewriter API.
    • + #
+ #

Changed

+ #
    + #
  • Search for libraries in LIBRARY_PATH in addition to LD_LIBRARY_PATH.
    • + #
+ #

Fixed

+ #
    + #
  • Reverted executable search that caused header search path failure on macOS.
    • + #
  • Improved Visual Studio search paths.
    • + #
  • Improved support for Cygwin.
    • + #
+ #

[1.9.0] - 2024-09-24 [YANKED]

+ #

Changed

+ #
    + #
  • Added --link-static flag when listing static libraries to link to
    • + #
+ #

[1.8.2] - 2024-05-29 [YANKED]

+ #

Fixed

+ #
    + #
  • Fixed linking to libclang on Windows with MSYS2
    • + #
  • Fixed Clang::find to support both the -target and --target arguments when using target-prefixed clang binaries
    • + #
+ #
+ #
+ #
+ # Commits + # + #
+ #
+ # + # + # [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=clang-sys&package-manager=cargo&previous-version=1.8.1&new-version=1.9.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) + # + # Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. + # + # [//]: # (dependabot-automerge-start) + # [//]: # (dependabot-automerge-end) + # + # --- + # + #
+ # Dependabot commands and options + #
+ # + # You can trigger Dependabot actions by commenting on this PR: + # - `@dependabot rebase` will rebase this PR + # - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it + # - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency + # - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) + # + # + #
+https://github.com/servo/servo/pull/46886 (@SimonSapin, #46886) script: More consistent compareDocumentPosition for disconnected nodes (#46886) + ^ commit 469f9721e58f65125fe28d88092f275436fcbe6b + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # When comparing disconnected nodes by pointer addresses, use stable GC-owned pointers rather than temporary pointers to pointers. + # + # Testing: extending WPT to test the relation is anti-commutative (`a < b => b < a`) and manually checking that it fails before the code change + # +https://github.com/servo/servo/pull/46951 (@veyndan, #46951) android: Make `glThread` immutable (#46951) + ^ commit e84dbee53e37fd00171e31f631b407516a2f98ca + # By doing the initialisation steps directly in the constructor's initialisation section, we can make `glThread` final as the Java compiler knows that we only initialise `glThread` on instantiation. Previously, we could've theoretically called `init()` from elsewhere, hence we couldn't make the immutable guarantee to Java. + # + # Testing: There are no automated tests for Android. +https://github.com/servo/servo/pull/46829 (@mrobinson, #46829) layout: Allow shaping across inline box boundaries (#46829) + ^ commit da291ca3c487fa525866776a5bcfdc0c34684a88 + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # Allow shaping across inline box boundaries by collecting text to shape during + # inline formatting context construction in a `ShapingQueue`. The `ShapingQueue` + # is responsible for shaping all text as well as placing it into its originating + # `TextRun`. The queue is flushed when an incompatible piece of text (using CSS + # specification rules) is pushed. + # + # Testing: This causes a good number of WPT tests to start to pass. + # Fixes: #35397. + # +https://github.com/servo/servo/pull/46836 (@mrobinson, #46836) font: Expose `ShapedTextSliceType` to clarify different `ShapedTextSlice`s (#46836) + ^ commit 72c9b0c8df5e13d76f0e69ba10075fe0feada0bf + # Instead of using two boolean fields that could encode unreachable + # behavior, this change makes it so that the `ShapedTextSlice` holds a + # type. This type more clearly defines the kinds of `ShapedTextSlice`s + # making it easier to read what's happening as they are created and + # simplifying the constructor. + # + # Testing: This does not change behavior, so should be covered by existing tests. + # +https://github.com/servo/servo/pull/46955 (@veyndan, #46955) android: Split `SurfaceHolderCallback` into own class (#46955) + ^ commit 40dba3dd1f4cef8b442d5768b8cd4861dfc792da + # Responding to `SurfaceHolder` callback events from `GLThread` is confusing, as these callback events are unrelated to thread management. Splitting these out into two separate classes creates a separation of concerns. + # + # Testing: There are no automated tests for Android. +https://github.com/servo/servo/pull/46959 (@jschwe, #46959) mach: Fix windows servoshell version bump regex (#46959) + ^ commit 26c53dbddfc03fa3bd989a193dfe2db1ba5a35ef + # Recent refactoring broke `./mach release`: + # + # - The path to the `wxs.mako` file is now lowercase. + # - The added `InstallerVersion` field meant `./mach release` now changed the wrong field (InstallerVersion instead of version). This is fixed by performing lazy matching, requiring whitespace before `Version`, and not requiring the closing `>` tag after Version anymore. + # + # Testing: `./mach release` is not covered by automated tests + # +https://github.com/servo/servo/pull/46960 (@mulhalloisin@gmail.com, #46960) webcrypto: Add remaining error messages. (#46960) + ^ commit f02ab1bb8f586cccb3927ad3da3c187bbc340b06 + # Part of: #40756 + # + # + # + # +https://github.com/servo/servo/pull/46956 (@jschwe, #46956) release: Validate tag before release workflow (#46956) + ^ commit d908aa399f3162533d806f628295c73de0b0c9ea + # We should consistently use the `v` prefix for real releases. This doesn't completely prevent issues, since the job just creates a release draft, which can be edited manually before publish, but getting the tag right here, makes it less likely to forget to add the `v` prefix. + # Motivated by https://github.com/servo/servo/issues/46908. + # + # Testing: Not covered by automated tests. Manually verified `0.0.5` fails and `v0.0.5` passes in my fork. + # +https://github.com/servo/servo/pull/46962 (@jschwe, #46962) release: Bump version to 0.5.0 (#46962) + ^ commit d6ade2f68725062eb04db7670766aad01192320c + ^ /!\ contains servoshell changes! does it affect the user experience? + # Monthly version bump, slightly delayed this time. + # Created by running `./mach release 0.5.0` + # + # Testing: Not required + # +>>> 2026-08-05T00:00:26Z +https://github.com/servo/servo/pull/46970 (@dependabot[bot], @dependabot[bot], #46970) build: bump cc from 1.2.67 to 1.4.0 (#46970) + ^ commit 76771ba28b6cacbde2335e536646ce434dc04a2d + # Bumps [cc](https://github.com/rust-lang/cc-rs) from 1.2.67 to 1.4.0. + #
+ # Release notes + #

Sourced from cc's releases.

+ #
+ #

cc-v1.4.0

+ #

Added

+ #
    + #
  • support trim paths with clang-cl.exe (#1799)
    • + #
+ #

cc-v1.3.0

+ #

Added

+ #
    + #
  • inherit path remap rules from cargo trim-paths (#1794)
    • + #
+ #
+ #
+ #
+ # Changelog + #

Sourced from cc's changelog.

+ #
+ #

1.4.0 - 2026-07-24

+ #

Added

+ #
    + #
  • support trim paths with clang-cl.exe (#1799)
    • + #
+ #

1.3.0 - 2026-07-18

+ #

Added

+ #
    + #
  • inherit path remap rules from cargo trim-paths (#1794)
    • + #
+ #
+ #
+ #
+ # Commits + # + #
+ #
+ # + # + # [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cc&package-manager=cargo&previous-version=1.2.67&new-version=1.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) + # + # Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. + # + # [//]: # (dependabot-automerge-start) + # [//]: # (dependabot-automerge-end) + # + # --- + # + #
+ # Dependabot commands and options + #
+ # + # You can trigger Dependabot actions by commenting on this PR: + # - `@dependabot rebase` will rebase this PR + # - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it + # - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency + # - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) + # + # + #
+https://github.com/servo/servo/pull/46971 (@dependabot[bot], @dependabot[bot], #46971) build: bump async-compression from 0.4.42 to 0.4.43 (#46971) + ^ commit 577e946d839dd79fc76482613b5269c51c41bee5 + # Bumps [async-compression](https://github.com/Nullus157/async-compression) from 0.4.42 to 0.4.43. + #
+ # Release notes + #

Sourced from async-compression's releases.

+ #
+ #

async-compression-v0.4.43

+ #

Other

+ #
    + #
  • Fix hang when decoding a corrupt subsequent zstd frame (#470)
    • + #
+ #
+ #
+ #
+ # Commits + # + #
+ #
+ # + # + # [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=async-compression&package-manager=cargo&previous-version=0.4.42&new-version=0.4.43)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) + # + # Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. + # + # [//]: # (dependabot-automerge-start) + # [//]: # (dependabot-automerge-end) + # + # --- + # + #
+ # Dependabot commands and options + #
+ # + # You can trigger Dependabot actions by commenting on this PR: + # - `@dependabot rebase` will rebase this PR + # - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it + # - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency + # - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) + # + # + #
+https://github.com/servo/servo/pull/46972 (@dependabot[bot], @dependabot[bot], #46972) build: bump clap from 4.6.4 to 4.6.5 (#46972) + ^ commit dcfb42a210c815873a5a5dc582810218e99631ff + # Bumps [clap](https://github.com/clap-rs/clap) from 4.6.4 to 4.6.5. + #
+ # Release notes + #

Sourced from clap's releases.

+ #
+ #

v4.6.5

+ #

[4.6.5] - 2026-07-31

+ #

Fixes

+ #
    + #
  • (help) Correctly mark which value_names are optional with num_args
    • + #
+ #
+ #
+ #
+ # Changelog + #

Sourced from clap's changelog.

+ #
+ #

[4.6.5] - 2026-07-31

+ #

Fixes

+ #
    + #
  • (help) Correctly mark which value_names are optional with num_args
    • + #
+ #
+ #
+ #
+ # Commits + # + #
+ #
+ # + # + # [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=clap&package-manager=cargo&previous-version=4.6.4&new-version=4.6.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) + # + # Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. + # + # [//]: # (dependabot-automerge-start) + # [//]: # (dependabot-automerge-end) + # + # --- + # + #
+ # Dependabot commands and options + #
+ # + # You can trigger Dependabot actions by commenting on this PR: + # - `@dependabot rebase` will rebase this PR + # - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it + # - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency + # - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) + # + # + #
+https://github.com/servo/servo/pull/46973 (@dependabot[bot], @dependabot[bot], #46973) build: bump hybrid-array from 0.4.13 to 0.4.14 (#46973) + ^ commit a75f0318b6727974171fb5cf9d77350552244dae + # Bumps [hybrid-array](https://github.com/RustCrypto/hybrid-array) from 0.4.13 to 0.4.14. + #
+ # Changelog + #

Sourced from hybrid-array's changelog.

+ #
+ #

0.4.14 (2026-07-30)

+ #

Added

+ #
    + #
  • Sizes for sntrup (#231)
    • + #
+ #

#231: RustCrypto/hybrid-array#231

+ #
+ #
+ #
+ # Commits + # + #
+ #
+ # + # + # [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hybrid-array&package-manager=cargo&previous-version=0.4.13&new-version=0.4.14)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) + # + # Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. + # + # [//]: # (dependabot-automerge-start) + # [//]: # (dependabot-automerge-end) + # + # --- + # + #
+ # Dependabot commands and options + #
+ # + # You can trigger Dependabot actions by commenting on this PR: + # - `@dependabot rebase` will rebase this PR + # - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it + # - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency + # - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) + # + # + #
+https://github.com/servo/servo/pull/46953 (@niyabits, #46953) crown: allow `std::collections::hash_map::Values` in `unrooted_must_root` lint. (#46953) + ^ commit 75ec1dc635009c3da4ee9cff10339e6532eadded + # Adds a new case for `is_unrooted_ty` for the `std::collections::hash_map::Values` type. + # Removes the cases relating to `accountable_refcell` as the crate was removed: https://github.com/servo/servo/issues/44709 + # Refactors existing hashmap `iter()`s that don't use the key to use `values()` instead. + # + # Testing: Added a new run-pass test to validate all pointer-like types in the std library that we currently allow. + # Fixes: #46920 +https://github.com/servo/servo/pull/46976 (@kkoyung, #46976) script: Tidy up comments in `subtlecrypto.rs` (#46976) + ^ commit e01c44c0e6a7e3c547baefa820678d28b11aea36 + # - Add spec link to `struct SubtleCrypto` block. + # - Add missing spec links on algorithm registrations. + # - Change the regular comments for `DecapsulateOperation` and `GetPublicKeyOperation` to outer documentation comments. + # + # Testing: No test since there is no actual code change. +https://github.com/servo/servo/pull/46978 (@simonwuelker, #46978) fonts: Remove manual definition of `FT_LOAD_TARGET_LIGHT` (#46978) + ^ commit 5bbf8e075acf5824a835603b922199aa3c297ee5 + # The constant is now included in the bindings, so there's no need for us to re-define it ourselves. +https://github.com/servo/servo/pull/46965 (@veyndan, #46965) android: Convert `ServoView` to Kotlin (#46965) + ^ commit d325a76433a5151a1540127f69b8e77b8943188a + # I've deliberately kept some non-null assertions. They were always there in the Java world, but they weren't explicit. I'm keeping the assertions as converting them to nullable assertions will balloon out the number of decision paths, making this whole class even harder to reason about. + # + # Testing: There are no automated tests for Android. + # Fixes: #46701 +https://github.com/servo/servo/pull/46963 (@mrobinson, @SimonSapin, #46963) layout: No longer combine adjacent text nodes into the same `TextRun` (#46963) + ^ commit 9453067361cf1ac4b5cbdd3f1309947b60ac2bac + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # Previously, adjacent text nodes (for instance those separated by a + # comment) were combined into the same `TextRun`. This ensured that the + # text was shaped together. Servo now supports shaping across node + # boundaries, so this is no longer necessary. For selection, it will be + # useful for every `TextFragment` to correspond to, at most, one DOM + # node. This change makes that possible. + # + # Testing: One WPT test starts to pass as we no longer combine text fragments before BiDi reordering. +https://github.com/servo/servo/pull/46906 (@mrobinson, #46906) script: More carefully handle dirty root and descendant damage marking (#46906) + ^ commit 2eab09483c8783c6f516a2d60c1a6ef83bb0f991 + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # Script passes a dirty root to layout along with setting the + # HAS_DIRTY_DESCENDANTS flag on elements at or below that root indicating + # that children need to be traversed. There was an undocumented invariant + # that no nodes above that dirty root were marked with + # HAS_DIRTY_DESCENDANTS, as the flag itself was used to determine + # when the dirty root is raised to some common ancestor of the old dirty + # root and a damaged node. + # + # There were some problems with the old implementation and this change + # fixes them by hewing closer to Gecko (from which we took this design). + # Notably: + # + # - In the complex situation where we cannot trivially calculate the dirty + # root, we now calculate it by walking up from the old dirty root and + # finding the first element which already has the flag set. + # - When removing nodes from the flat tree, if they were the previous + # dirty root, the dirty root is cleared. + # - Ensure that all marking traversals for the HAS_DIRTY_DESCENDANTS flag + # marking happen in the flat tree. + # - When slotting nodes into `` elements, the style and layout data + # of fallback content is cleared, and the dirty root is potentially reset. + # - Comments are added everywhere in this tricky algorithm explaining what + # the heck is going on. + # - The new debug assertion for the invariant found a case where we were + # triggering restyles too late before a relayout -- when setting selection flags. + # This is moved earlier in the method. + # + # Testing: This change adds a new WPT crash test. + # Fixes: #46024. + # Fixes: #46883. + # +https://github.com/servo/servo/pull/46867 (@jschwe, #46867) deps: Update bundled harfbuzz to 14.2.1 (#46867) + ^ commit 679c211fda1cc353b9dbfda908b8be76054abc2a + # pending crates.io release + # + # Testing: Dependency update, covered by existing tests. + # +https://github.com/servo/servo/pull/46985 (@Narfinger, #46985) paint: Switch forgotten IpcChannel to GenericChannel (#46985) + ^ commit 655f052f26a6a19438ceaccb40c3cacf6b059608 + # This just switches the channel for profiling exit msg to GenericChannel to be more consistent. + # + # Testing: Does not change functionality. + # +https://github.com/servo/servo/pull/46983 (@yezhizhen, #46983) paint: Lock touch panning to its initial dominant axis (#46983) + ^ commit 882810b5568a1b7d1e6b10b8443cd0ff870300ad + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # Lock a touch pan gesture to the axis dominant at pan-start, for the whole sequence, to match FF/Chrome. + # The video in https://github.com/servo/servo/issues/46954 explains visual difference better. + # + # Testing: For existing test `/pointerevents/touch-action-with-swipe-dir-change.html`, + # - New Passing in: + # touch-action:pan-x with right,down swipe + # touch-action:pan-y with down,right swipe + # - New failure in: + # touch-action:auto with right,down swipe + # touch-action:auto with down,right swipe + # + # The passing/failure are accidental, as we don't support `touch-action` yet, which controls gesture within element's region. + # + # For right, down, we would now only move horizontally. This matches `pan-x` expectation, but fails `auto` which expects both axis to move. + # + # Also added a new test similar to `touch-action-with-swipe-dir-change.html` to match our issue. This reuses logic introduced in https://github.com/web-platform-tests/wpt/pull/57804 to avoid accelerated scrolling & out of bound error, as we scroll the viewport. + # + # Fixes: https://github.com/servo/servo/issues/46954 which has strange jitter when we pan. + # +https://github.com/servo/servo/pull/46981 (@Narfinger, #46981) script: Cleanup custom node dirty inclusive ancestor walk (#46981) + ^ commit 21faece5673d75323f6c3084d0dc96e754b4f8ba + # This replaces the custom method in Node::dirty to do an inclusive ancestor walk without rooting with our unrooted iterator, cleaning up the code. + # This requires no_gc to be propagates through places. + # + # Testing: This should not change functionality. + # +https://github.com/servo/servo/pull/41309 (@Narfinger, #41309) OHOS: More efficient window buffer mode (#41309) + ^ commit 5ad865393fdef9b45e9c0c17dbc410e2f9b335c5 + ^ /!\ contains servoshell changes! does it affect the user experience? + # According to https://developer.huawei.com/consumer/en/doc/harmonyos-faqs/faqs-arkgraphics-2d-14 we can enable a performance hint here. + # + # Signed-off-by: Narfinger + # + # Testing: Tested on device and it doesn't crash. + # +https://github.com/servo/servo/pull/46988 (@jdm, #46988) constellation: Do not request permission for initial about:blank loads. (#46988) + ^ commit 66d034cfc8cbd9824da5a4a19164f1afb063c678 + # The initial about:blank document is intended to be synchronously available. Our current implementation is too tied to our asynchronous navigation infrastructure, and this gets in the way of the work happening in #46975. This change removes one source of intermittent failures due to timing when a test attempts to navigate the initial about:blank shortly after it is created—when the constellation observes that there is a pending navigation approval for the about:blank, it will silently discard any navigation attempt for the pipeline. I expect to revisit this later after we have decoupled about:blank from our asynchronous navigation infrastructure. + # + # Testing: Not observable behaviour within WPT except via timing changes in tests that involve navigating about:blank iframes/windows. + # Fixes: part of #43149 + # +>>> 2026-08-05T23:44:36Z +https://github.com/servo/servo/pull/46994 (@veyndan, #46994) android: Inline `InitOptions` (#46994) + ^ commit 8d959efeb696b493de0e7ede89dcfc54a6e25f2b + ^ /!\ contains servoshell changes! does it affect the user experience? + # This can be seen as the Rust equivalent to #46916. Wrapping some of these `init()` options in a `struct` and then immediately unwrapping them makes the code harder to following by being a bit obtuse. + # + # Testing: There are no automated tests for Android. +https://github.com/servo/servo/pull/47000 (@dependabot[bot], @dependabot[bot], #47000) build: bump rustls from 0.23.42 to 0.23.43 (#47000) + ^ commit cc5aa44dc3e13b60eb93973a9b2969cf976f8232 + # Bumps [rustls](https://github.com/rustls/rustls) from 0.23.42 to 0.23.43. + #
+ # Commits + #
    + #
  • fcf61cd Prepare 0.23.43
    • + #
  • f0dad4c Check server's proposed suite against actual offer
    • + #
  • b480cc6 Test for server choosing a non-QUIC TLS1.3 suite
    • + #
  • 883a44d Consider Protocol in ServerConfig::supports_version
    • + #
  • c2f1fd9 Check suitability of server version in QUIC client
    • + #
  • d98e1b9 Add test for server Tls13RequiredForQuic
    • + #
  • e63d9bf Bound ticket age calculation
    • + #
  • 79cd462 Defensiveness improvement for binder suffix arithmetic
    • + #
  • 4a9f025 use checked_sub for the mac tag offset in Rfc5077Ticketer::decrypt
    • + #
  • 3131e5c Accept that libcrux deps are vulnerable
    • + #
  • Additional commits viewable in compare view
    • + #
+ #
+ #
+ # + # + # [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=rustls&package-manager=cargo&previous-version=0.23.42&new-version=0.23.43)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) + # + # Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. + # + # [//]: # (dependabot-automerge-start) + # [//]: # (dependabot-automerge-end) + # + # --- + # + #
+ # Dependabot commands and options + #
+ # + # You can trigger Dependabot actions by commenting on this PR: + # - `@dependabot rebase` will rebase this PR + # - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it + # - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency + # - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) + # + # + #
+https://github.com/servo/servo/pull/47003 (@dependabot[bot], @dependabot[bot], #47003) build: bump bytemuck from 1.25.1 to 1.25.2 (#47003) + ^ commit a8c9c9007a648e29621666fdd90ec8c7ab5eec1b + # Bumps [bytemuck](https://github.com/Lokathor/bytemuck) from 1.25.1 to 1.25.2. + #
+ # Changelog + #

Sourced from bytemuck's changelog.

+ #
+ #

1.25.2

+ #
    + #
  • implement NoUninit for char, bool, NonZero* arrays
    • + #
+ #
+ #
+ #
+ # Commits + # + #
+ #
+ # + # + # [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=bytemuck&package-manager=cargo&previous-version=1.25.1&new-version=1.25.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) + # + # Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. + # + # [//]: # (dependabot-automerge-start) + # [//]: # (dependabot-automerge-end) + # + # --- + # + #
+ # Dependabot commands and options + #
+ # + # You can trigger Dependabot actions by commenting on this PR: + # - `@dependabot rebase` will rebase this PR + # - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it + # - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency + # - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) + # + # + #
+https://github.com/servo/servo/pull/46991 (@jschwe, #46991) canvas: Limit worker threads for vello_cpu (#46991) + ^ commit 49fa5106cac95620e985ede1c0ddf744709e6c62 + # The default implementation (as of 0.0.9) spawns too many threads: + # + # ``` + # num_threads: (std::thread::available_parallelism() + # .unwrap() + # .get() + # .saturating_sub(1) as u16) + # .min(8), + # ``` + # + # We override this and define a minimum canvas size to use multi-threading and limit the amount of threads to 3, since upstream docs suggest 2-4 is usually best. + # I don't see an immediate need to add a pref! to finetune the behavior, but could be an idea for the future. + # + # Testing: No functional changes. No automated performance tests for canvas. + # + # +https://github.com/servo/servo/pull/46989 (@TimvdLippe, #46989) script: Move form controls into form_controls (#46989) + ^ commit a7a5eff507bf4054c93020d12535ecd80b810087 + # Testing: it compiles + # Part of #46329 +https://github.com/servo/servo/pull/46986 (@mrobinson, #46986) script: Only note dirty `Element`s (#46986) + ^ commit 61f178247759dfe44416d0d025eec3a73e9123f8 + # In practice this is always the case, except when the `Document` itself + # is marked. In that case, we just need to do some bookkeeping for removed + # documents. This changes removes a long-standing FIXME and simplifies the + # way the dirty root is calculated quite a bit. + # + # Testing: This should not change behavior so is covered by existing tests. + # +https://github.com/servo/servo/pull/47005 (@jdm, #47005) script: Prevent borrow hazards in Element::ensure_rare_data. (#47005) + ^ commit 6e8d1679605b48e4c4181e6411a30cf3623a3589 + # Element::ensure_rare_data returns a dynamic mutable borrow, so by using safe_borrow_mut we can statically prevent multiple lurking borrow hazards. First noticed in an unexpected test failure in #46990. + # + # Testing: Existing test coverage suffices. + # Fixes: #47004 + # +https://github.com/servo/servo/pull/46980 (@RichardTjokroutomo, @yezhizhen, #46980) script: Fire `focusin`/`focusout` (#46980) + ^ commit c17ddb2cdf641e1935fa175b2199bda059e4ad1b + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # Add basic support for `focusin`/`focusout` `FocusEvent` type. + # The code fires focusin/focusout **unconditionally** alongside focus/blur. Same-document scenarios work correctly, but cross-document cases (e.g. across iframes) have known gaps because FocusEvent's impl is not complete yet: + # https://github.com/servo/servo/blob/49fa5106cac95620e985ede1c0ddf744709e6c62/components/script/dom/document/focus.rs#L273. Cross-document support will be addressed in a follow-up (subtask 2 of #46979). + # + # Also fix a minor issue, to set composed flag for https://html.spec.whatwg.org/multipage/interaction.html#fire-a-focus-event + # + # Testing: Existing WPT tests. There are some new passing & failling tests. For detail, see https://github.com/servo/servo/pull/46980#issuecomment-5177445471 + # Fixes: part of #46979 + # +https://github.com/servo/servo/pull/46982 (@mrobinson, @SimonSapin, #46982) layout: Unify the way that selection is represented in the box tree (#46982) + ^ commit f785b0658aa5d89683ca2e43b107995cbb654f61 + # Previously, document selection and form control selection were handled + # through different paths in layout. This change makes it so that they + # share more of the same code. Selection is now always handled + # per-`TextRun` rather than at the IFC level. This will simplify the way + # that text offsets are calculated during hit testing. + # + # Testing: This should not change observable behavior so should be + # covered by existing tests. + # +https://github.com/servo/servo/pull/46856 (@niyabits, #46856) script: fix worklet implementation to fetch modules instead of classic scripts (#46856) + ^ commit 086a3d63f099c68749f0510668425c29abb0ebbd + # Fix the existing Worklet implementation by adding the necessary infrastructure for fetching modules (e.g., implementing task manager on Worklet) and using our implementation of `fetch a worklet/module worker script graph` instead of fetching classic scripts using `load_whole_resource`. + # + # Testing: Tests in `tests/wpt/mozilla/tests/mozilla/worklets` already cover the changes, some fixes were made to comply with the specs. + # + # Fixes: https://github.com/servo/servo/issues/45306 +https://github.com/servo/servo/pull/46990 (@jdm, @aniebietafia87@gmail.com, #46990) script: Make `performance.timing` a PerformanceTiming object (#46990) + ^ commit 68fdd5155964f83342bf7384b4db868f56db49be + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + ^ /!\ contains WebIDL changes! did we ship a new API? + # Rebased and expanded version of #36441. These changes ensure the document load timing information is shared between the various interfaces that use it so we don't need to duplicate the code that marks when certain events occur. + # + # Testing: New passing tests. + # Fixes: #33334 + # Fixes: #36171 + # +https://github.com/servo/servo/pull/46891 (@calvaris, #46891) media: avoid crash in pulsesink (#46891) + ^ commit c03e7adb28a7e554545c8dbb858716dcd8367f80 + # Hold a reference to pulsesink to avoid the crash. Real fix will be in https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12194 . + # + # Fixes: https://github.com/servo/servo/issues/46251 + # +https://github.com/servo/servo/pull/47016 (@niyabits, #47016) script: Move `WorkletThreadPool` intialization out of `ScriptThread` (#47016) + ^ commit 6ca7f7d5808a7075c17e7cad3cecc926eb9cf0af + # This PR is a part of refactoring Worklet for implementing AudioWorklet + # + # Remove Worklet Thread Pool from `ScriptThread`. + # The Worklet Thread Pool is currently unused by the `ScriptThread`. + # + # For `AudioWorklet`s, each `AudioContext` will need its own `Worklet`, so `Worklet`s can be defined on the `AudioContext`. + # + # For the Paint Worklet, the initialization will be done by `Window` in a follow up PR. + # + # Testing: existing worklet WPT covers the changes. +https://github.com/servo/servo/pull/47015 (@mrobinson, @SimonSapin, #47015) layout: Add `TextFragmentRunData` (#47015) + ^ commit 8e22026ef30d53b20f8fc8d6cb92b14c8e846d62 + # Add a shared data structure to be used with all `TextFragment`s that + # are generated by a `TextRun`. The idea here is that no matter how many + # `TextFragment`s a `TextRuns` generates, the shared data is only in + # memory once. This opens up the way for exposing more data (such as the + # `InlineFormattingContext`'s `OffsetMap`) on each `TextFragment`. This + # will be used converting glyph offsets into DOM offsets and for + # incremental layout of `Document` selections. Longer-term the in-memory + # size of `TextFragment`s will be minimized using an approach like this. + # + # Testing: This should not change observable behavior so is covered by existing tests. + # +https://github.com/servo/servo/pull/47014 (@averyrudelphe@gmail.com, #47014) constellation: Remove broken built-in sampling profiler (#47014) + ^ commit 69de7f3dc8b5bdf61e0ad0f940d859771893963d + ^ /!\ contains libservo or embedder_traits changes! does it affect our public API? + ^ /!\ contains servoshell changes! does it affect the user experience? + # As discussed [on Zulip](https://servo.zulipchat.com/#narrow/channel/263398-general/topic/Poking.20at.20the.20built-in.20sampling.20profiler/with/613859819), there's no reason to keep this maintained when better profiling solutions exist. The removal includes the code in Servo as well as the tool for converting from this profiler's output to the Firefox profiler. + # + # This includes an embedder API change, since toggling the profiler was exposed to the embedder to make the keybind work. + # + # Companion book PR will be made shortly. + # + # Testing: Manual - it compiles and Ctrl+P no longer does anything + # +https://github.com/servo/servo/pull/46950 (@jschwe, #46950) deps: Do not enable the `webrender` `capture` feature (#46950) + ^ commit 1df1dba0e1de2726ef142f4a67d179b7321cf5ce + # The feature isn't needed in production, only for debugging. Since we can't make features conditional on profiles. we disable the capture feature. It can still be enabled if necessary, but that should be rare. + # This removes ~1MB binary size. + # + # Testing: It compiles + # Fixes: #46685 + # +https://github.com/servo/servo/pull/47022 (@mrobinson, @SimonSapin, #47022) layout: Map between pre-transformed and post-transformed selection offsets during display list construction (#47022) + ^ commit 58a582c5b29784df8ba35953dd72e475f6fc1737 + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # There are two types of DOM-node-relative text offsets to consider in + # layout. One is pre-transformed, that is before any white space collapse + # or `text-transform` is applied to the node's text content. This is how + # selections are stored, so that they can be updated without triggering a + # full layout. The other is post-transformed, that is after white space + # collapse and `text-transform`. This is how glyph character advances are + # measured. This changes moves the mapping from the first to the second to + # display list construction, so that it is done also for form control + # selections. This fixes the behavior of visual selections and + # `text-transform` in form control elements and is also foundational for + # ensuring that the reverse transform can happen during hit testing. + # + # Testing: This change adds a new WPT test. + # +https://github.com/servo/servo/pull/43376 (@shubhamg13, #43376) layout: Pass `poster_url` for `LargestContentfulPaint` Entry (#43376) + ^ commit dce660c1921fe1a1e34d96a6535ec34b7073d8fc + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # Fetches the `poster_url` from `HTMLVideoElement` and pass it for `LargestContentfulPaint` + # + # Testing: More WPT Passed + # Fixes: Part of #42000 + # +>>> 2026-08-07T01:16:51Z +https://github.com/servo/servo/pull/47034 (@dependabot[bot], @dependabot[bot], #47034) build: bump ipnet from 2.12.0 to 2.12.1 (#47034) + ^ commit 5128b4cffee29be705068dabb0c2ab91c2627a3e + # Bumps [ipnet](https://github.com/krisprice/ipnet) from 2.12.0 to 2.12.1. + #
+ # Changelog + #

Sourced from ipnet's changelog.

+ #
+ #

Version 2.12.1

+ #
    + #
  • Fixes bug where Ipv4Subnets(0.0.0.0, u32::MAX-1, 0) and Ipv6Subnets(::, u128::MAX-1, 0) incorrectly included u32::MAX and u128::MAX. See issue #70.
    • + #
  • Fixes some typos in documentation and error messages
    • + #
+ #
+ #
+ #
+ # Commits + # + #
+ #
+ # + # + # [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ipnet&package-manager=cargo&previous-version=2.12.0&new-version=2.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) + # + # Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. + # + # [//]: # (dependabot-automerge-start) + # [//]: # (dependabot-automerge-end) + # + # --- + # + #
+ # Dependabot commands and options + #
+ # + # You can trigger Dependabot actions by commenting on this PR: + # - `@dependabot rebase` will rebase this PR + # - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it + # - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency + # - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) + # + # + #
+https://github.com/servo/servo/pull/47037 (@dependabot[bot], @dependabot[bot], #47037) build: bump libredox from 0.1.18 to 0.1.19 (#47037) + ^ commit 803ce95d4f7d516a021e04149867b7e5da58b51b + # Bumps libredox from 0.1.18 to 0.1.19. + # + # + # [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=libredox&package-manager=cargo&previous-version=0.1.18&new-version=0.1.19)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) + # + # Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. + # + # [//]: # (dependabot-automerge-start) + # [//]: # (dependabot-automerge-end) + # + # --- + # + #
+ # Dependabot commands and options + #
+ # + # You can trigger Dependabot actions by commenting on this PR: + # - `@dependabot rebase` will rebase this PR + # - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it + # - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency + # - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) + # - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) + # + # + #
+https://github.com/servo/servo/pull/47038 (@jschwe, #47038) fonts: Optimize hasher by using `FxHashMap` in CachedShapeData (#47038) + ^ commit 0d31f6f3ebc6808fa7fd45f88f4a236f101e9cd9 + # For they glyph caches using the faster FxHasher should be fine from a DoS perspective and FxHashMap should probably be the default choice for integer / integer-like keys. For shaped_text we keep the standard hashmap since it contains a web controlled string. I don't expect this change to be measurable (and i didn't attempt to), it's a drive-by change while looking at surrounding code. + # + # Testing: No observable behavior change, so existing tests should suffice. + # +https://github.com/servo/servo/pull/46851 (@shubhamg13, #46851) wpt: Add tests for LCP element removed after paint (#46851) + ^ commit b74b0418b44182a8e82a0544c7a23b868e56cf3c + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # Adding new WPT tests for LCP element removed. + # + # There is one existing test [element-only-when-fully-active.html](https://github.com/web-platform-tests/wpt/blob/master/largest-contentful-paint/element-only-when-fully-active.html). But contains `Text` (missing support in Servo yet) inside iframe. + # + # So, adding simpler version with image. + # + # Testing: No Code changes. + # +https://github.com/servo/servo/pull/47040 (@jschwe, @mrobinson, #47040) ci: Add sccache for faster try wpt builds in forks (#47040) + ^ commit 44ab2c88f0476609576eb6f33f0751ab9aca4d71 + # [trial run (pushed to main)](https://github.com/jschwe/servo/actions/runs/31079634622/job/92545361508) in my fork, shows that the variables take effect, so based on our previous experience it should just work. + # + # Testing: CI changes are not covered by automated tests. + # Fixes: #46635 + # +https://github.com/servo/servo/pull/47039 (@shubhamg13, #47039) layout: Report LCP only once per element (#47039) + ^ commit d32404331defffd789ef4fe468d3e3f28ec1a6dc + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # Adds a HashSet for LCP Nodes to check if they are already reported. + # + # Testing: Additional WPT + # Fixes: Part of #42000 + # +https://github.com/servo/servo/pull/46958 (@janeoa, @jdm, #46958) canvas: report malloc sizeof vello_cpu (#46958) + ^ commit fefcb83a2b44ccedcc8bd29bd45d40019561f5a5 + # I've added the `malloc_size_of` as a dependancy, so that we `impl MallocSizeOf for vello_cpu::Pixmap` + # Added a `memory_report` to the canvas. + # As we have two backends (vello and vello_cpu), I did one common `CanvasStoreSizesPerType` to report them in the `backend.rs`. + # Added `mem_profiler_chan.clone()` to the constellation. + # + # Vello_cpu does have a nice + # ```rust + # /// Returns a reference to the underlying data as premultiplied RGBA8. + # /// + # /// The pixels are in row-major order. + # pub fn data(&self) -> &[PremulRgba8] { + # &self.buf + # } + # ``` + # to hook into. But for the Vello I have left a `TODO` instead and report 0. + # + # image + # + # Testing: I have no auto tests, but I did spawn some canvases and saw them being reported. + # Fixes: https://github.com/servo/servo/issues/46785 + # +https://github.com/servo/servo/pull/47020 (@Loirooriol, #47020) layout: Fix interaction of margin and stretch size on block-level box inside inline box (#47020) + ^ commit 7b34e567726cf4424ec04f16ddcaa67633eb1b39 + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # For the purpose of resolving a stretch size of a block-level in the block axis, sometimes we need to treat margins as zero. The spec said to check a condition on the parent. + # + # However, it wasn't clear what to do inside of an inline formatting context, since the parent is an inline box. Then we were never treating margins as zero. + # + # But in https://github.com/w3c/csswg-drafts/issues/13260 the CSSWG has resolved to check the condition on the containing block. + # + # So this amends #35904 to implement the new resolution. + # + # Testing: Adding a test + # +https://github.com/servo/servo/pull/46232 (@Taym95, #46232) script: Deliver animation frames to dedicated workers (#46232) + ^ commit 12c190817bde4fb823a6cbb615a4c27d6259d369 + ^ /!\ contains libservo or embedder_traits changes! does it affect our public API? + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + ^ /!\ contains WebIDL changes! did we ship a new API? + # this exposess AnimationFrameProvider on DedicatedWorkerGlobalScope, stores and cancels worker rAF callbacks on the worker global, and delivers callbacks through the worker event loop + # + # Testing: + # tests/wpt/tests/workers/WorkerGlobalScope_requestAnimationFrame.worker.js + # tests/wpt/tests/workers/worker-request-animation-frame.html + # tests/wpt/tests/html/dom/idlharness.any.js + # + # + # +https://github.com/servo/servo/pull/47029 (@jschwe, #47029) fonts: Eagerly memory-map local FreeType fonts (#47029) + ^ commit c0c4dbe78f37723f0d1fdbbba8871ded0afee00e + # Since the font data is memory mapped anyway, we can simply move the memory mapping up and create the `face` via `new_from_memory`. With the bundled freetype new_from_file is not backed with mmap (see #46808). + # + # We can then simplify `FreeTypeFace` and remove the load from file path, and improve the `new_from_memory` safety, by storing the backing memory in the FreeTypeFace struct, so the type system ensures we don't accidentally free the backing memory. + # + # In the example from #45199 tested on a HarmonyOS device this removes around ~1 ms of kernel-time per frame (~85% reduction of time spent in kernel in that thread), since the file-based read would execute many times, when accessing glyph information. + # + # Testing: This should not change any behavior, hence covered by existing tests + # +https://github.com/servo/servo/pull/47030 (@Ms2ger, #47030) script: Pass the prefix from the parser when creating attributes (#47030) + ^ commit dda6e3d11dd0f033d7e2bde06a760972b474e705 + ^ /!\ contains changes to WPT expectations! it probably affects the web platform + # Follow-up to #46868: now passing the correct prefix and qualified name when creating elements from the parser. + # + # Testing: WPTs now pass. +https://github.com/servo/servo/pull/44032 (@jschwe, #44032) allocator: Make jemalloc code optional (#44032) + ^ commit b29cc74b7cb51976ade6481949f1ea91545b9fd0 + ^ /!\ contains libservo or embedder_traits changes! does it affect our public API? + ^ /!\ contains servoshell changes! does it affect the user experience? + # Add a feature, so we can avoid compiling the tikv-jemalloc crates, when they are not needed. + # Reviewer feedback requested the jemalloc and and the system allocator backends to be mutually exclusive, meaning that `use-system-allocator` and the new `use-jemalloc` feature shouldn't be able to be used together. + # That leads to the removal of the `use-system-allocator` feature, since we can also detect the absense of custom allocator features instead, which means we remove on error path. + # For convenience purposes, this PR also adds feature groups, which bundle certain features: Our default web features, and bundled options. In servoshell we consolidate those into a `default_without_allocator` feature, so that in our ASAN build we can use the system allocator, while keeping other default dependencies. + # + # These feature groups should also be more generally useful, e.g. if we start feature-gating more web-platform features. + # + # + # Testing: Requires manual testing, to test the non-default allocator (system allocator) is still selected via `./mach build --no-default-features --features default_without_allocator`. +>>> 2026-08-08T23:20:57Z +https://github.com/servo/servo/pull/47018 (@jschwe, #47018) canvas: Add pref to control thread_pool_canvas_workers (#47018) + ^ commit d149710e4b19626d67429169c2fa1c1e38b26243 + ^ /!\ may contain changes to feature flags + # Local experimentation showed that after pinning canvas threads to non-little cores, I can't observe a performance benefit on my device using multithreading. + # The potential benefits of multithreading likely highly vary depending on the scenario and device, so having a pref to be able to turn off multithreading or fine-tune the workers, seems useful. + # + # Testing: No behavior change. + # + # +https://github.com/servo/servo/pull/47025 (@mrobinson, @SimonSapin, #47025) layout: Take `OffsetMap` into account when getting glyph character index (#47025) + ^ commit 93b30d41e4414ce3d9214b789f832d9a076531c0 + # When text is transformed by `InlineFormattingContext` construction, we + # keep an `OffsetMap` to map between indices pre-and-post-transform. + # This change ensures the map is used when mapping back to + # pre-transformed DOM indices, meaning that moving the edit point with + # the mouse in `