2b4112: fix(context): stop /context polling from slowing down the browser (#356) (@fukouda)
911d14: fix(sessions): settle proxy byte counters before ending a session (#361) (@fukouda)
04f691: fix(cdp): bound storage extraction and skip crashed renderers (#362) (@fukouda)
dacea7: fix(api): align mobile device emulation signals (#366) (@danew)
e5902f: fix(cdp): eliminate dedicated worker network capture race (#327) (@danew)
1131a0: fix(cdp): log blocked requests at debug instead of info (#374) (@fukouda)
d8a4a7: fix(cdp): keep lifecycle hooks bound to the outgoing browser (#376) (@danew)
807bf2: fix(deps): bump @fastify/static, defuddle, file-type and vitest for security advisories (#377) (@fukouda)
8362bb: fix(api): handle PDF URLs in screenshot/pdf and harden action page handling (#383) (@junhsss)
e41160: fix(cdp): keep mobile emulation overrides alive (#382) (@junhsss)
099466: fix(cdp): enable request interception conditionally (#387) (@starboy-3)
7f1bd4: fix(ci): stop release and welcome workflows from failing (#391) (@junhsss)
aca33a: fix(docker): block file:// URLs with a Chrome policy (#390) (@junhsss)
79d601: fix(docker): bump Node to 22.23.4 (CVE-2026-111497) (#392) (@mahfuz-rahman007)
5befc1: fix(api): cleanup session when casting target page is not found (#388) (#389) (@kaiizer777)
582fdc: fix(files): send the real file name in Content-Disposition (#372) (@RaphaelFakhri)
0d4bae: fix(cdp): match blocked hosts case-insensitively and with a trailing root dot (#371) (@RaphaelFakhri)
3cca16: fix(proxy): settle byte counters before close() resolves (#394) (@junhsss)
545fe5: fix: serialize browser launches (#397) (@junhsss)
abbf8f: fix(deploy): clean up self-hosting config (#398) (@junhsss)
50c39d: fix: release stale profile locks and shut down cleanly on signals (#401) (@junhsss)
5151a7: fix(casting): validate session ID from URL against active session (#405) (@kaiizer777)
9fb9b9: fix(browser-socket): reject upgrade requests with unparseable URLs (#413) (@fukouda), reported by @kaiizer777
