May in Servo: user scripts, mp4 compat, blackboxing in DevTools, and more! - Servo aims to empower developers with a lightweight, high-performance alternative for embedding web technologies in applications.

May in Servo: user scripts, mp4 compat, blackboxing in DevTools, and more!

Plus seven new commands for execCommand(), and Sanitizer API now experimental.

Posted 2026-06-30

Servo 0.3.0 contains all of the changes we landed in May, which came out to 391 commits (March: 534).<br>For security fixes, see § Security .

We’ve shipped several new web platform features:

‘font-kerning: none’ (@simonwuelker, #44634)

‘font-variant-east-asian’ (@simonwuelker, #44989)

‘font-variant-ligatures’ (@simonwuelker, #44903)

‘font-variant-numeric’ (@simonwuelker, #44950)

‘font-variant-position’ (@simonwuelker, #45142)

mp4 files without fast start in (@calvaris, #45084)

(@yezhizhen, #45028)

(@yezhizhen, #45111)

layout (@mrobinson, #44791)

Plus a bunch of new DOM APIs:

onslotchange property on Shadow­Root (@jdm, #44688)

screen­Left and screen­Top on Window (@TG199, #45128)

new Blob() with {endings: "native"} (@yezhizhen, #44803)

new Performance­Mark() (@shubhamg13, #44702)

parse­HTML() on Document (@kkoyung, #44952)

read­As­Binary­String() on File­Reader (@yezhizhen, #44858, #44921)

performance.measure() with mark values ‘redirect­Start’ , ‘redirect­End’ , ‘secure­Connection­Start’ , and ‘response­End’ (@shubhamg13, #44673, #44624, #44850, #44739)

We’ve also fixed some build issues on Windows (@mukilan, #45079), FreeBSD (@delan, @mrobinson, @mukilan, #44600), and for anyone building Servo on NixOS or with Nix (@freyacodes, #45051, #45135).

This is another big update, so here’s an outline:

Security<br>– memory safety fixes

Work in progress<br>– execCommand(), Sanitizer, IndexedDB, accessibility, workers

Embedding API<br>– MSRV, cookies, preferences, diagnostics

For users and developers<br>– --host-file, --userscripts, DevTools Debugger

More on the web platform<br>– focus, forms, navigation, SubtleCrypto, WebGPU

Performance<br>– about:memory, threads, layout, DOM, build times

Stability<br>– crashes, hangs, static analysis

Security

Servo’s JS runtime, SpiderMonkey 140.10.0 , had several memory safety bugs that have been fixed in Servo 0.3.0 with the update to SpiderMonkey 140.10.1 (@jschwe, #44755).<br>For more details, see CVE-2026-7322, CVE-2026-7323, and MFSA 2026-36.

Work in progress

We’re continuing to implement document.exec­Command() for rich text editing , under --pref dom­_exec­_command­_enabled (@TimvdLippe, #44735, #44973, #44887).<br>This release adds support for the ‘back­Color’ , ‘fore­Color’ , ‘create­Link’ , ‘unlink’ , ‘superscript’ , ‘subscript’ , and ‘remove­Format’ commands (@TimvdLippe, #44644, #44682, #44657, #44710, #44677), plus partial support for the ‘insert­Paragraph’ command (@TimvdLippe, #44909).

We’re also working on the Sanitizer API, under --pref dom­_sanitizer­_enabled.<br>With the feature now enabled in servoshell’s experimental mode (@kkoyung, #44701), this release adds support for set­Comments() , set­Data­Attributes() , allow­Processing­Instruction() , remove­Processing­Instruction() , and remove­Unsafe() on Sanitizer (@kkoyung, #44734, #44983).

IndexedDB continues to improve, under --pref dom­_indexeddb­_enabled.<br>This release brings a more conformant abort() on IDB­Transaction (@Taym95, #43950).

All of the features above are enabled in servoshell’s experimental mode.

We’ve made more progress towards accessibility support, including the name from contents algorithm (@alice, @delan, @mrobinson, #44439) and several changes towards building the accessibility tree incrementally (@alice, @delan, @mrobinson, #44766, #45035, #45207, #44768, #44785, #44801, #44767, #45029).<br>The latter is critical for performance in real-world web content.

We’re now working on SharedWorker and ServiceWorker , under --pref dom­_sharedworker­_enabled and --pref dom­_serviceworker­_enabled respectively.<br>This release adds support for new Shared­Worker() (@Taym95, #44761), and parts of the ServiceWorker API (@gterzian, @arihant2math, #45082, #44787).

Embedding API

Servo now requires Rust 1.88.0 or newer, up from the old MSRV of 1.86.0 (@sagudev, #44815).<br>We run compile tests with the MSRV, but most of our testing is now done with Rust 1.95.0 (@simonwuelker, #44632).

Breaking changes to the cookies methods in our SiteDataManager API (@longvatrong111, #44708):

Site­Data­Manager::clear­_cookies now takes an additional callback argument, allowing it to be called async – to continue calling it sync, pass None as the callback

Site­Data­Manager::clear­_session­_cookies now takes an additional callback argument, allowing it to be called async – to continue calling it sync, pass None as the callback

Site­Data­Manager::set­_cookie­_for­_url now takes an additional callback argument, allowing it to be called async – to continue calling it sync, pass None as the callback

Site­Data­Manager::set­_cookie­_for­_url­_async has...