The update was focused entirely on hardening and security.
- Unsafe redirect/output handling: packs can no longer transform a tab into j
avascript:, other non-web schemes, malformed absolute URLs, or file:// when
local files are disabled.
- Import hardening: .urlpack imports are now capped at 1 MB, numeric fields
are validated more strictly, failed imports clear any previously staged
pack, and the staging modal blocks imports that would reuse an installed
pack ID or fail the same regex/hotkey safety checks as the Forge.
- Regex correctness bug: $1-style capture groups now expand correctly for
NTH_OCCURRENCE, BEFORE_PATTERN, and AFTER_PATTERN, not just standard
replacements.
- Hotkey message hardening: background execution now prefers the real sender
tab URL over the message-provided URL to avoid spoofable intra-extension
input.