v 11.0.23
============================================================
x Updated TLDs
x Further refresh syntax parsing leniency (thanks
insertscript)

v 11.0.22
============================================================
x Updated TLDs
x [L10n] Updated he
x Uniform refresh url matching across HTTP and DOM checks
(thanks insertscript)

v 11.0.21rc1
============================================================
x Fixed URL matching regexp (thanks insertscript)

v 11.0.20
============================================================
x More aggressive blocking for data: refresh attempts
(thanks insertscript)

v 11.0.19
============================================================
x Prevent ANY redirection to data: URIs in documents

v 11.0.18
============================================================
x Automated "Updated TLDs" commit
x Updated TLDs
x Apply "font-family: Inter" to the mobile stylesheet only
x Support synonims for "release"

v 11.0.17
============================================================
x Updated TLDs
x Force CSP inheritance for redirections to data: URIs on
Gecko pre-69
x Added CSS reference to Inter font to improve UI look on
Fenix

v 11.0.15
============================================================
x Fixed CapsCSP bug allowing data: URLs to bypass font
blocking (thanks dcent and skriptimaahinen)
x [XSS] Prevent DOS detection from being triggered for
already aborted requests (thanks barbaz)
x [L10n] Updated es and added bn
x [XSS] More accurate base64 checks on hash
x Updated TLDs
x Minor adjustments for Firefox Preview (Fenix)
compatibility
x Refactored XSS filter into an asynchronous worker to
better handle DOS attempts
x [XSS] Abort on InjectionChecker timeouts
x [XSS] Updated recognized HTML events
x Fixed autoreload after popup closing broken on Vivaldi

11.0.13
============================================================
x [Chromium] Fix SyncMessage broken by feature-policy
headers
x Remove "application" manifest.json key from Chromium
packages

v 11.0.12
============================================================
x [L10n] Updated ru
x Unrestricted tab support for service workers and their
included 3rd party scripts
x Record document origins in TabStatus
x Support for reporting service workers and their imported
scripts in UI
x Cross-browser request properties normalization
x Updated TLDs
x Fixed initial requst URL lost across redirections
x Updated copyright statement
x Fixed settings export button broken on Vivaldi (issue
#124)
x Fixed UNTRUSTED domains accidentally set in "match HTTPS
only" mode (issue #126)

v 11.0.11
============================================================
x [L10n] Updated da, de, fr, he, it, mk, nl, ru, sq, tr,
zh_TW
x Fixed UI not working on pages were sessionStorage
is disabled
x Updated TLDs
x Added "ping" (beacon/ping) capability control

v 11.0.10
============================================================
x [Chromium] Fixed no permissions given on first page load
in a session
x Order change in html5 events source
x Updated TLDs
x Removed unused "privacy" permission
x Fixed shortcut and context menu doing nothing unless
browserAction icon is visible on Firefox (issue 58)
x [L10n] Updated de, fr, he, nl, tr
x Updated TLDs
x Fix minor typo regarding appearance redundancy (issue 61)
x Fixed scripts could not be enabled on file: SVG documents

v 11.0.9
============================================================
x [Chromium] Prevent duplicated MSE placeholders (e.g. on
Youtube)
x Fixed external scripts included in HEAD of file:// pages
failing (issue #115)
x [XSS] Updated HTML 5 events inventory
x Best effort to make media placeholders visible and
clickable
x Placeholders for MSE on Chromium too
x Use invalid IP rather than domain name to prevent offline
status from breaking sync messaging in Chromium
x Removed empty exportFunction() Chromium shim
x Updated TLDs

x [L10n] Updated da, ja, lt, mk, nl
x Fixed onionSecure setting persistence issue (Tor ticket
#32362)
x Fixed CSP DOM injection breaking XML documents rendering

v 11.0.7
============================================================
x Use fragments to reinsert and run previously blocked
scripts
x Fetch policies asynchronously for about: and javascript:
URLs
x Remove loop around XHR

v 11.0.6
============================================================
x Compute the correct origin for the policy to be fetched
from about:blank and javascript: URLs
x Work-around for Youtube video elements positioned
off-display at replacement time
x Version numbers for Chromium dev builds compatible with
Chromestore requirements
x Script blocking before policy is fetched only for
synchronous loads
x Make tests not to run automatically on dev mode startup
anymore

v 11.0.4
============================================================
x [Tor] Treat .onion sites whose protocol is HTTP as if it
was HTTPS
x [Mobile] Blocked scripts count displayed in the browser
action menu item
x Consolidated missing endpoint error detection in Messages
x More compatible Messages abstraction
x Progressive count of debug messages to better trace
asynchronous execution
x [XSS] Fixed false positive (property assignment)
x Fixed typo causing initializing promise not being cached
x Avoid unnecessary page reloads on extension updates
x Fixed undefined variable error when in debugging mode
x [Tor] Display .onion sites as "secure" in the UI (tickets
#27313 and #27307)
x Support for splitting sync storage items into chunks, to
allow synchronization of big policies across devices
x IPv4 subnet shortcut matching
x Fallback to local storage for any item exceeding limits
(fixes persistence problems on Chromium)
x Alternate version numbering for Chromium pre-releases
x Simplified, less noisy and more resilient Messages
abstraction implementation (thanks barbaz for reporting)
x Handle edge-case policy retrieval for file:// pages loaded
by session restore on startup and alike
x Improved Chromium development-build workflow
x Fix CSP violation reporting management of "fake"
blocked-uri like "eval"
x Recursive webgl context monkeypatching across same origin
windows (thanks skriptimaahinen for concept and patch)
x Replaced cookie-based hacks with synchronous messaging
(currently shimmed) to retrieve fallback and
per-tab restriction policies
x Work-around for Chromium not supporting frameAncestors
in webRequest
x [L10n] Updated Transifex-managed ca, da, it, nl, ru, sv_SE
x [XSS] Updated HTML5 events
x Updated TLDs
x Fixed "Cascade top document restrictions" option not always
applied to embedded elements (thanks barbaz for reporting)
x Removed XSS prompt for timeouts

v 11.0.3
=============================================================
x [Tor] Work-around for prompts being huge when
resistFingerprinting is enabled
x [XSS] Fixed false positives due to overzealous HTML
attribute checking
x [XSS] Enabled InjectionChecker logging when debugging mode
is on
x Work-around for browser.i18n.getMessage() API in content
scripts giving away browser's real locale (Tor issue #31287)
x Updated TLDs
x [L10n] Updated Transifex-managed he, is, nb, ru, sq, zh_TW

v 11.0.2
=============================================================
+ Restored "classic" pasted HTML sanitization feature, Now
triggered by drag'n'drop too (thanks barbaz for patch)
x Fixed bug in browser type detection by content scripts (
thanks barbaz)
+ Added "Collapse blocked objects" option in Blocked Objects
prompt
x Fixed corner case when application/* content types should
match "media" rather than "object" (thanks skriptimaahinen
for reporting)
x Replacement clicks are now intercepted even if a content
placeholder is obstructed by an overlay
x More graceful handling of chrome: origins (thanks
skriptimaahinen for reporting)
x CSP building optimizations
x Updated TLDs.
x [L10n] Updated Transifex-managed locales br, de, it, ms,
nl, ru, tr, nb, sv_SE and zh_CN

v 11.0
=============================================================
x [XSS] Fixed false positives with parameters named "src"
x Static click-to-play placeholders
+ [L10n] New da, is, pl, sq, zh_TW Transifex-managed locales
x [L10n] Updated sv_SE Transifex-managed locale

v 10.6.3
=============================================================
x Multiple fixes in embeddings replacement (thanks barbaz
for reporting)
x Fixed [Import] settings button on Android
x [XSS] JSON reduction optimizations
x [XSS] XSS checks performance improvements play nicer with
resistFingerprinting
x [XSS] Fully asynchronous InjectionChecker, prevents freezes
on heavy payloads
x Skip page autoreloads on transitions between temporary and
permanent presets of the same kind
x Updated TLDs

v 10.6.2
=============================================================
x Removed work-around for https://bugzil.la/1532530 (now
fixed and backported to the Tor Browser too)
x Fixed media.mediasource.enabled breakage (thanks
skriptimaahinen for patch)
x Reference internal pages as absolute URLs for Chromium
compatibility
x Updated TLDs
x [Locale] Updated Transifex-managed locales (es, ms, tr)

v 10.6.1
=============================================================
x Make RequestGuard's header processing synchronous as needed
x Fixed inconsistencies handling browser-internal URLs
x Fixed resetting options works just once per session
(defaults reference current settings) - issue #69
x [Locale] Updated Transifex-managed locales (de, fr, it, tr,
nl)

v 10.6
=============================================================
x Limit wrappedJSObject usages to compatible browsers
x [Chromium] Merged chromium branch (unified code base)
x [Locale] Updated Transifex-managed locales
x Updated TLDs

v 10.2.5
=============================================================
x [XSS] Improved detection of privileged origins (fixes an
about:tor to DuckDuckGo false positive)