June in Servo: real world compat, media queries, SharedWorker, and more! - Servo aims to empower developers with a lightweight, high-performance alternative for embedding web technologies in applications.

June in Servo: real world compat, media queries, SharedWorker, and more!

We now have a new way for you to help us write the monthly updates :)

Posted 2026-07-31

Servo 0.4.0 contains all of the changes we landed in June, which came out to yet another record 558 commits (April: 534, May: 391).<br>For security fixes, see § Security .

We’ve shipped several new web platform features:

‘attr()’ , in experimental mode (@Loirooriol, #45041)

‘image()’ , ‘closest-corner’ , and ‘farthest-corner’ in ‘ellipse()’ and ‘circle()’ (@Loirooriol, #45421)

‘calc()’ and other mathematical expressions can now be resolved later than parse time, e.g. sign(1em - 32px) (@Loirooriol, #45421)

‘font-feature-settings’ in ‘@font-face’ (@simonwuelker, #45393)

‘@media (device-width)’ , ‘@media (device-height)’ , ‘@media (height)’ , ‘@media (aspect-ratio)’ , and their min- and max- variants (@jdm, @mrobinson, @nicoburns, @jschwe, #44978, #45707, #45490)

‘@media (orientation)’ (@nicoburns, #45707)

‘@media (pointer)’ and ‘@media (any-pointer)’ (@nicoburns, #45681)

‘@media (hover)’ and ‘@media (any-hover)’ (@nicoburns, #45681)

Plus a bunch of new DOM APIs:

Shared­Worker (@Taym95, #45786)

console­.dir() (@Taym95, #45109)

custom­Element­Registry on Document and Shadow­Root (@shubhamg13, #45872)

initialize() on Custom­Element­Registry (@shubhamg13, @yezhizhen, #45903)

new Custom­Element­Registry() (@shubhamg13, #45791, #45550)

text­Stream() on Request , Response , and Blob (@yezhizhen, #45864, #45861)

set­Pointer­Capture() , release­Pointer­Capture() , has­Pointer­Capture() on Element (@webbeef, #45048)

on­touch­start , on­touch­end , on­touch­move , on­touch­cancel on Element (@stevennovaryo, #45049)

crypto­.subtle­.digest() for KT128 and KT256 (@kkoyung, #45699)

crypto­.subtle­.get­Public­Key() for ML-KEM and ML-DSA (@kkoyung, #45252)

This is another big update, so here’s an outline:

You can help!

Security

Real world compat

Work in progress

Embedding API

For users and developers

More on the web platform

Garbage collection safety

Performance and stability

New contributors

You can help!

Servo is steadily becoming a bigger and busier project every month, and by June 2026, we’ve been reading through over four times the commits as we did when we started in September 2023.

This is hard work, particularly since there are things we need to know that are often difficult to answer just by reading the changes:

Who does the change affect , if anyone? Does it affect users, Servo developers, embedders, or some other group?

What observable difference does the change make , if any?

Does the feature require any preferences to be enabled , or is it enabled for everyone by default?

Are any real-world websites affected by the change?

What issue or broader project is the change related to? This question is answered by Fixes: #xxxxx or Part of: #xxxxx in the PR description.

Thanks to an initiative by @jdm, it’s now easier than ever for you to help us answer those questions , using the Servo Highfive bot!<br>If you’re working on a pull request that you think might be interesting for the next monthly update, even if you’re not 100% sure, tell us about it by following the steps below:

You add the monthly update label to your pull request, or comment @servo-highfive monthly update

Highfive posts a comment asking you some questions

You answer those questions in a comment containing @servo-highfive monthly update answer

Security

Servo’s JS runtime, SpiderMonkey 140.10.1 , had several security bugs that have been fixed in Servo 0.4.0 with the update to SpiderMonkey 140.11.0 (@jschwe, #45584).<br>For more details, see CVE-2026-8388, CVE-2026-8391, CVE-2026-8974, CVE-2026-8975, and MFSA 2026-48.

Several more security bugs in Servo’s JS runtime have been fixed in Servo 0.4.0 with the update to SpiderMonkey 140.12.0 (@jschwe, #45766).<br>The exact CVEs that apply to us are not yet known, but for more details, see MFSA 2026-58.

RSA operations in Subtle­Crypto now do modular exponentiation in constant time (@kkoyung, #45631).<br>Please note that our RSA implementation is currently vulnerable to the Marvin Attack – for more details, see RUSTSEC-2023-0071.

ML-DSA operations in Subtle­Crypto now do the Decompose step in constant time, fixing RUSTSEC-2025-0144 (@kkoyung, #45294).

We’ve fixed an HTML injection bug (XSS) in file:/// directory listings , which affected file names containing (@sahvx655-wq, #45510).

Real world compat

Layout correctness has significantly improved on lichess.org , and many websites have become a lot more readable thanks to our improved handling of variable fonts (@simonwuelker, #45768), including Zulip (servo.zulipchat.com) and Speedtest (speedtest.net) .

v0.3.0

v0.4.0

lichess.org

v0.3.0

v0.4.0

Zulip...