Firefox 148 release notes for developers (Beta)

Changes for web developers

HTML

• The initial about:blank document now loads synchronously. A browsing context's first navigation may resolve to about:blank (for example, when the initial URL is empty or explicitly set to about:blank). In these cases, Firefox no longer replaces the initial empty document with a second, asynchronously loaded one, and instead fires the load event synchronously on the initial document. (Firefox bug 543435).

APIs

• The Trusted Types API is now supported. This provides mechanisms to ensure that properties and functions that can potentially be used as vectors for XSS attacks are only able to be called with data that has been passed through a transformation function. The mechanisms allow auditing of unsafe uses of code. They don't mandate how the data is transformed, but might, for example, be used to sanitize unsafe HTML elements from user-provided strings. (Firefox bug 1994690).

• The Location.ancestorOrigins property is now supported, which enables you to determine whether a document is being embedded in an <iframe> and, if so, by which site(s). (Firefox bug 1085214).

• The movementX and movementY properties on the pointerrawupdate event are now populated when the pointer is moved — previously these were set to zero. (Firefox bug 1987671).

Changes for add-on developers

Experimental web features

These features are shipping in Firefox 148 but are disabled by default. To experiment with them, search for the appropriate preference on the about:config page and set it to true. You can find more such features on the Experimental features page.

• Document Picture-in-Picture API (Nightly): dom.documentpip.enabled

  The Document Picture-in-Picture API makes it possible to open an always-on-top window that can be populated with arbitrary HTML content such as a video with custom controls or a set of streams showing the participants of a video conference call. (Firefox bug 1858562).