isConditionalMediationAvailable() always returns false.",
+ "partial_implementation": true,
+ "version_added": "131"
+ },
+ "before": {
+ "version_added": false
+ },
+ "browser": "webview_android",
+ "id": "7adb2f05248ebfd44b11c0a0",
+ "observedInBcdVersion": "8.1.0",
+ "observedInWebFeaturesVersion": "3.37.0",
+ "path": "api.PublicKeyCredential.isConditionalMediationAvailable_static",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-09-03T15:52:15.027Z",
+ "summary": "api.PublicKeyCredential.isConditionalMediationAvailable_static changed for webview_android: {\"version_added\":false} to {\"version_added\":\"131\",\"partial_implementation\":true,\"notes\":\"Conditional mediation (autofill integration) is not sup….",
+ "type": "partial_support_added"
+ },
+ {
+ "after": {
+ "version_added": "14.0"
+ },
+ "before": {
+ "version_added": "15.0"
+ },
+ "browser": "samsunginternet_android",
+ "id": "86c0464bb1e9261c3f6b1a4c",
+ "observedInBcdVersion": "8.1.0",
+ "observedInWebFeaturesVersion": "3.37.0",
+ "path": "http.headers.Permissions-Policy",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-09-03T15:52:15.027Z",
+ "summary": "http.headers.Permissions-Policy changed for samsunginternet_android: {\"version_added\":\"15.0\"} to {\"version_added\":\"14.0\"}.",
+ "type": "support_version_corrected"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-09-22",
+ "status": "nightly",
+ "version": "154"
+ },
+ "browser": "chrome_android",
+ "id": "877fca61a9626dfd88f2b969",
+ "observedInBcdVersion": "8.1.0",
+ "observedInWebFeaturesVersion": "3.37.0",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-09-03T15:52:15.027Z",
+ "summary": "Chrome Android 154 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-07-27",
+ "status": "current",
+ "version": "26.6"
+ },
+ "browser": "safari_ios",
+ "id": "9ac921cc8bdd32cf90d48c84",
+ "observedInBcdVersion": "8.1.0",
+ "observedInWebFeaturesVersion": "3.37.0",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-09-03T15:52:15.027Z",
+ "summary": "Safari on iOS 26.6 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-10-08",
+ "status": "planned",
+ "version": "155"
+ },
+ "browser": "edge",
+ "id": "b28d7c6a10e8b39513082cdc",
+ "observedInBcdVersion": "8.1.0",
+ "observedInWebFeaturesVersion": "3.37.0",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-09-03T15:52:15.027Z",
+ "summary": "Edge 155 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-10-13",
+ "status": "planned",
+ "version": "158"
+ },
+ "browser": "firefox",
+ "id": "cb4899dcb14c351ac163d64d",
+ "observedInBcdVersion": "8.1.0",
+ "observedInWebFeaturesVersion": "3.37.0",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-09-03T15:52:15.027Z",
+ "summary": "Firefox 158 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "version_added": "85"
+ },
+ "before": {
+ "version_added": "88"
+ },
+ "browser": "edge",
+ "id": "cc535ec1126dd819d740c43b",
+ "observedInBcdVersion": "8.1.0",
+ "observedInWebFeaturesVersion": "3.37.0",
+ "path": "http.headers.Permissions-Policy",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-09-03T15:52:15.027Z",
+ "summary": "http.headers.Permissions-Policy changed for edge: {\"version_added\":\"88\"} to {\"version_added\":\"85\"}.",
+ "type": "support_version_corrected"
+ },
+ {
+ "after": {
+ "version_added": "149"
+ },
+ "before": {
+ "impl_url": "https://bugzil.la/1958716",
+ "version_added": false
+ },
+ "browser": "firefox_android",
+ "id": "cf410e6f346230a9f241b525",
+ "observedInBcdVersion": "8.1.0",
+ "observedInWebFeaturesVersion": "3.37.0",
+ "path": "api.CredentialsContainer.create.publicKey_option.extensions.prf",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-09-03T15:52:15.027Z",
+ "summary": "api.CredentialsContainer.create.publicKey_option.extensions.prf changed for firefox_android: {\"version_added\":false,\"impl_url\":\"https://bugzil.la/1958716\"} to {\"version_added\":\"149\"}.",
+ "type": "support_version_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-09-29",
+ "status": "nightly",
+ "version": "157"
+ },
+ "browser": "firefox",
+ "id": "d6bf5e422846117151686980",
+ "observedInBcdVersion": "8.1.0",
+ "observedInWebFeaturesVersion": "3.37.0",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-09-03T15:52:15.027Z",
+ "summary": "Firefox 157 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-09-24",
+ "status": "nightly",
+ "version": "154"
+ },
+ "browser": "edge",
+ "id": "e5592f8181c5392d545dce2a",
+ "observedInBcdVersion": "8.1.0",
+ "observedInWebFeaturesVersion": "3.37.0",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-09-03T15:52:15.027Z",
+ "summary": "Edge 154 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "status": "beta",
+ "version": "27.2"
+ },
+ "browser": "safari_ios",
+ "id": "2317e1d97beed2465d73b1c6",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "Safari on iOS 27.2 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-10-20",
+ "status": "nightly",
+ "version": "156"
+ },
+ "browser": "chrome",
+ "id": "24841353064df9d363785d72",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "Chrome 156 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-10-22",
+ "status": "nightly",
+ "version": "156"
+ },
+ "browser": "edge",
+ "id": "25982a665bb3c7756647b154",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "Edge 156 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-11-10",
+ "status": "planned",
+ "version": "160"
+ },
+ "browser": "firefox_android",
+ "id": "259da8174f9fb1d31fb1bc1f",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "Firefox for Android 160 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-05-11",
+ "status": "current",
+ "version": "30.0"
+ },
+ "browser": "samsunginternet_android",
+ "id": "284ee04f14965b191a18674c",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "Samsung Browser 30.0 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-10-27",
+ "status": "nightly",
+ "version": "159"
+ },
+ "browser": "firefox_android",
+ "id": "56649cddeb047632af3409a6",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "Firefox for Android 159 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-10-27",
+ "status": "nightly",
+ "version": "159"
+ },
+ "browser": "firefox",
+ "id": "72f4af1348e5d5d79dff181a",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "Firefox 159 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "status": "planned",
+ "version": "157"
+ },
+ "browser": "chrome",
+ "id": "79122de93b6b6ebca0671bcc",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "Chrome 157 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-10-20",
+ "status": "nightly",
+ "version": "156"
+ },
+ "browser": "chrome_android",
+ "id": "7cfca20381dcf2de017679b7",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "Chrome Android 156 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-11-10",
+ "status": "planned",
+ "version": "160"
+ },
+ "browser": "firefox",
+ "id": "80c30d4cb1e47e1170f50616",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "Firefox 160 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "status": "planned",
+ "version": "157"
+ },
+ "browser": "webview_android",
+ "id": "834eaed7d80c41b50ff7dc19",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "WebView Android 157 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "version_added": "30.0"
+ },
+ "before": {
+ "version_added": false
+ },
+ "browser": "samsunginternet_android",
+ "id": "856f584c27a60a56f7294a5f",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "path": "http.headers.Integrity-Policy",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "http.headers.Integrity-Policy changed for samsunginternet_android: {\"version_added\":false} to {\"version_added\":\"30.0\"}.",
+ "type": "support_version_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-10-20",
+ "status": "nightly",
+ "version": "156"
+ },
+ "browser": "webview_android",
+ "id": "bdbbc0de7057d2921a97d356",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "WebView Android 156 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "status": "beta",
+ "version": "27.2"
+ },
+ "browser": "safari",
+ "id": "c7c2bda6ded4d9c86ef276f7",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "Safari 27.2 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "status": "planned",
+ "version": "157"
+ },
+ "browser": "chrome_android",
+ "id": "c7c4d441e9916a04c41ad310",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "Chrome Android 157 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
+ },
+ {
+ "after": {
+ "version_added": "30.0"
+ },
+ "before": {
+ "version_added": false
+ },
+ "browser": "samsunginternet_android",
+ "id": "d5c5d41d5c6a5dd21e1f7c33",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "path": "http.headers.Set-Cookie.http_host-http_prefixes",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "http.headers.Set-Cookie.http_host-http_prefixes changed for samsunginternet_android: {\"version_added\":false} to {\"version_added\":\"30.0\"}.",
+ "type": "support_version_added"
+ },
+ {
+ "after": {
+ "version_added": "30.0"
+ },
+ "before": {
+ "version_added": false
+ },
+ "browser": "samsunginternet_android",
+ "id": "f4eed25a2003a719afa9775a",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "path": "http.headers.Integrity-Policy-Report-Only",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "http.headers.Integrity-Policy-Report-Only changed for samsunginternet_android: {\"version_added\":false} to {\"version_added\":\"30.0\"}.",
+ "type": "support_version_added"
+ },
+ {
+ "after": {
+ "releaseDate": "2026-11-05",
+ "status": "planned",
+ "version": "157"
+ },
+ "browser": "edge",
+ "id": "fc51c60d71e976f89f9f784f",
+ "observedInBcdVersion": "8.1.4",
+ "observedInWebFeaturesVersion": "3.40.1",
+ "schemaVersion": 1,
+ "sourceTimestamp": "2026-10-01T10:12:15.059Z",
+ "summary": "Edge 157 was added to the selected BCD release metadata.",
+ "type": "browser_release_added"
}
]
diff --git a/data/selected-bcd.json b/data/selected-bcd.json
index c138556..aca1676 100644
--- a/data/selected-bcd.json
+++ b/data/selected-bcd.json
@@ -1,6 +1,6 @@
{
- "bcdTimestamp": "2026-07-24T16:06:32.098Z",
- "bcdVersion": "8.0.8",
+ "bcdTimestamp": "2026-10-01T10:12:15.059Z",
+ "bcdVersion": "8.1.4",
"browsers": {
"chrome": {
"id": "chrome",
@@ -748,22 +748,42 @@
},
{
"releaseDate": "2026-06-30",
- "status": "current",
+ "status": "retired",
"version": "150"
},
{
"releaseDate": "2026-07-28",
- "status": "beta",
+ "status": "retired",
"version": "151"
},
{
"releaseDate": "2026-08-25",
- "status": "nightly",
+ "status": "retired",
"version": "152"
},
{
- "status": "planned",
+ "releaseDate": "2026-09-08",
+ "status": "retired",
"version": "153"
+ },
+ {
+ "releaseDate": "2026-09-22",
+ "status": "current",
+ "version": "154"
+ },
+ {
+ "releaseDate": "2026-10-06",
+ "status": "beta",
+ "version": "155"
+ },
+ {
+ "releaseDate": "2026-10-20",
+ "status": "nightly",
+ "version": "156"
+ },
+ {
+ "status": "planned",
+ "version": "157"
}
]
},
@@ -1398,22 +1418,42 @@
},
{
"releaseDate": "2026-06-30",
- "status": "current",
+ "status": "retired",
"version": "150"
},
{
"releaseDate": "2026-07-28",
- "status": "beta",
+ "status": "retired",
"version": "151"
},
{
"releaseDate": "2026-08-25",
- "status": "nightly",
+ "status": "retired",
"version": "152"
},
{
- "status": "planned",
+ "releaseDate": "2026-09-08",
+ "status": "retired",
"version": "153"
+ },
+ {
+ "releaseDate": "2026-09-22",
+ "status": "current",
+ "version": "154"
+ },
+ {
+ "releaseDate": "2026-10-06",
+ "status": "beta",
+ "version": "155"
+ },
+ {
+ "releaseDate": "2026-10-20",
+ "status": "nightly",
+ "version": "156"
+ },
+ {
+ "status": "planned",
+ "version": "157"
}
],
"upstream": "chrome"
@@ -1809,23 +1849,43 @@
},
{
"releaseDate": "2026-07-02",
- "status": "current",
+ "status": "retired",
"version": "150"
},
{
- "releaseDate": "2026-07-30",
- "status": "beta",
+ "releaseDate": "2026-07-31",
+ "status": "retired",
"version": "151"
},
{
- "releaseDate": "2026-08-27",
- "status": "nightly",
+ "releaseDate": "2026-08-28",
+ "status": "retired",
"version": "152"
},
{
- "releaseDate": "2026-09-10",
- "status": "planned",
+ "releaseDate": "2026-09-11",
+ "status": "retired",
"version": "153"
+ },
+ {
+ "releaseDate": "2026-09-24",
+ "status": "current",
+ "version": "154"
+ },
+ {
+ "releaseDate": "2026-10-08",
+ "status": "beta",
+ "version": "155"
+ },
+ {
+ "releaseDate": "2026-10-22",
+ "status": "nightly",
+ "version": "156"
+ },
+ {
+ "releaseDate": "2026-11-05",
+ "status": "planned",
+ "version": "157"
}
],
"upstream": "chrome"
@@ -2611,23 +2671,43 @@
},
{
"releaseDate": "2026-07-21",
- "status": "current",
+ "status": "esr",
"version": "153"
},
{
"releaseDate": "2026-08-18",
- "status": "beta",
+ "status": "retired",
"version": "154"
},
{
"releaseDate": "2026-09-01",
- "status": "nightly",
+ "status": "retired",
"version": "155"
},
{
"releaseDate": "2026-09-15",
- "status": "planned",
+ "status": "retired",
"version": "156"
+ },
+ {
+ "releaseDate": "2026-09-29",
+ "status": "current",
+ "version": "157"
+ },
+ {
+ "releaseDate": "2026-10-13",
+ "status": "beta",
+ "version": "158"
+ },
+ {
+ "releaseDate": "2026-10-27",
+ "status": "nightly",
+ "version": "159"
+ },
+ {
+ "releaseDate": "2026-11-10",
+ "status": "planned",
+ "version": "160"
}
]
},
@@ -3317,23 +3397,43 @@
},
{
"releaseDate": "2026-07-21",
- "status": "current",
+ "status": "esr",
"version": "153"
},
{
"releaseDate": "2026-08-18",
- "status": "beta",
+ "status": "retired",
"version": "154"
},
{
"releaseDate": "2026-09-01",
- "status": "nightly",
+ "status": "retired",
"version": "155"
},
{
"releaseDate": "2026-09-15",
- "status": "planned",
+ "status": "retired",
"version": "156"
+ },
+ {
+ "releaseDate": "2026-09-29",
+ "status": "current",
+ "version": "157"
+ },
+ {
+ "releaseDate": "2026-10-13",
+ "status": "beta",
+ "version": "158"
+ },
+ {
+ "releaseDate": "2026-10-27",
+ "status": "nightly",
+ "version": "159"
+ },
+ {
+ "releaseDate": "2026-11-10",
+ "status": "planned",
+ "version": "160"
}
],
"upstream": "firefox"
@@ -3634,12 +3734,22 @@
},
{
"releaseDate": "2026-05-11",
- "status": "current",
+ "status": "retired",
"version": "26.5"
},
{
- "status": "beta",
+ "releaseDate": "2026-07-27",
+ "status": "retired",
+ "version": "26.6"
+ },
+ {
+ "releaseDate": "2026-09-14",
+ "status": "current",
"version": "27"
+ },
+ {
+ "status": "beta",
+ "version": "27.2"
}
]
},
@@ -3924,19 +4034,29 @@
},
{
"releaseDate": "2026-05-11",
- "status": "current",
+ "status": "retired",
"version": "26.5"
},
{
- "status": "beta",
+ "releaseDate": "2026-07-27",
+ "status": "retired",
+ "version": "26.6"
+ },
+ {
+ "releaseDate": "2026-09-14",
+ "status": "current",
"version": "27"
+ },
+ {
+ "status": "beta",
+ "version": "27.2"
}
],
"upstream": "safari"
},
"samsunginternet_android": {
"id": "samsunginternet_android",
- "name": "Samsung Internet",
+ "name": "Samsung Browser",
"releases": [
{
"releaseDate": "2013-04-27",
@@ -4190,8 +4310,13 @@
},
{
"releaseDate": "2025-10-25",
- "status": "current",
+ "status": "retired",
"version": "29.0"
+ },
+ {
+ "releaseDate": "2026-05-11",
+ "status": "current",
+ "version": "30.0"
}
],
"upstream": "chrome_android"
@@ -4802,22 +4927,42 @@
},
{
"releaseDate": "2026-06-30",
- "status": "current",
+ "status": "retired",
"version": "150"
},
{
"releaseDate": "2026-07-28",
- "status": "beta",
+ "status": "retired",
"version": "151"
},
{
"releaseDate": "2026-08-25",
- "status": "nightly",
+ "status": "retired",
"version": "152"
},
{
- "status": "planned",
+ "releaseDate": "2026-09-08",
+ "status": "retired",
"version": "153"
+ },
+ {
+ "releaseDate": "2026-09-22",
+ "status": "current",
+ "version": "154"
+ },
+ {
+ "releaseDate": "2026-10-06",
+ "status": "beta",
+ "version": "155"
+ },
+ {
+ "releaseDate": "2026-10-20",
+ "status": "nightly",
+ "version": "156"
+ },
+ {
+ "status": "planned",
+ "version": "157"
}
],
"upstream": "chrome_android"
@@ -5062,8 +5207,7 @@
],
"firefox_android": [
{
- "impl_url": "https://bugzil.la/1958716",
- "version_added": false
+ "version_added": "149"
}
],
"safari": [
@@ -5222,7 +5366,9 @@
],
"webview_android": [
{
- "version_added": false
+ "notes": "Conditional mediation (autofill integration) is not supported; isConditionalMediationAvailable() always returns false.",
+ "partial_implementation": true,
+ "version_added": "131"
}
]
}
@@ -5300,7 +5446,7 @@
],
"webview_android": [
{
- "version_added": false
+ "version_added": "70"
}
]
}
@@ -6467,7 +6613,7 @@
],
"samsunginternet_android": [
{
- "version_added": false
+ "version_added": "30.0"
}
],
"webview_android": [
@@ -6538,7 +6684,7 @@
],
"samsunginternet_android": [
{
- "version_added": false
+ "version_added": "30.0"
}
],
"webview_android": [
@@ -6629,17 +6775,17 @@
"support": {
"chrome": [
{
- "version_added": "88"
+ "version_added": "85"
}
],
"chrome_android": [
{
- "version_added": "88"
+ "version_added": "85"
}
],
"edge": [
{
- "version_added": "88"
+ "version_added": "85"
}
],
"firefox": [
@@ -6666,12 +6812,12 @@
],
"samsunginternet_android": [
{
- "version_added": "15.0"
+ "version_added": "14.0"
}
],
"webview_android": [
{
- "version_added": "88"
+ "version_added": "85"
}
]
}
@@ -7153,7 +7299,7 @@
],
"samsunginternet_android": [
{
- "version_added": false
+ "version_added": "30.0"
}
],
"webview_android": [
@@ -7547,7 +7693,7 @@
}
}
},
- "schemaFingerprint": "ebad2f9787d9e115700d562ee122e62ba9116b04888263ebdaf922464b36b092",
+ "schemaFingerprint": "55e3832ebde9d4644e72e418bfda3bc9f2104f195a589da318a9fad1cde9a403",
"schemaVersion": 2,
- "webFeaturesVersion": "3.34.2"
+ "webFeaturesVersion": "3.40.1"
}
diff --git a/data/source-history.json b/data/source-history.json
index b9f004c..50d0619 100644
--- a/data/source-history.json
+++ b/data/source-history.json
@@ -51,6 +51,32 @@
"pathCount": 36,
"schemaFingerprint": "ebad2f9787d9e115700d562ee122e62ba9116b04888263ebdaf922464b36b092",
"webFeaturesVersion": "3.34.2"
+ },
+ {
+ "associatedEventCount": 22,
+ "baselineAssociationCount": 28,
+ "bcdTimestamp": "2026-09-03T15:52:15.027Z",
+ "bcdVersion": "8.1.0",
+ "browserCount": 9,
+ "catalogueVersion": "2.2.0",
+ "controlCount": 30,
+ "id": "884691434b0276dad168bd85",
+ "pathCount": 36,
+ "schemaFingerprint": "0faaff2d43d04fb6f962ed22348ce28b9aa8454ce01e70831e0f11cae29b06a9",
+ "webFeaturesVersion": "3.37.0"
+ },
+ {
+ "associatedEventCount": 18,
+ "baselineAssociationCount": 28,
+ "bcdTimestamp": "2026-10-01T10:12:15.059Z",
+ "bcdVersion": "8.1.4",
+ "browserCount": 9,
+ "catalogueVersion": "2.2.0",
+ "controlCount": 30,
+ "id": "2e6b9c3b8aa64649847c2001",
+ "pathCount": 36,
+ "schemaFingerprint": "55e3832ebde9d4644e72e418bfda3bc9f2104f195a589da318a9fad1cde9a403",
+ "webFeaturesVersion": "3.40.1"
}
],
"schemaVersion": 1
diff --git a/docs/attested-evidence.md b/docs/attested-evidence.md
index d720ff4..9e54278 100644
--- a/docs/attested-evidence.md
+++ b/docs/attested-evidence.md
@@ -123,6 +123,18 @@ messages do not enter the reduced policy result.
## Security meaning
+### Compose a verified result without changing its meaning
+
+`verify-evidence --json` produces an envelope with `attestation` and `evidence`.
+For `build-packet`, extract its exact `evidence` member unchanged into a private
+JSON file using a local JSON tool, then pass that file as the evidence input.
+The nested evaluation already carries the verification outcome bound to the
+report fingerprint; do not splice a verification result from another report or
+invent a `verified` value. Retain the original envelope, report and signature
+bundle privately for re-verification. Packet fingerprints prove content binding,
+not independent cryptographic authenticity of a manually edited input. No new
+wrapper or breaking artifact schema is introduced for this composition path.
+
A verified result establishes that:
- the Sigstore bundle passed the configured cryptographic and transparency
diff --git a/docs/authorised-collection.md b/docs/authorised-collection.md
index e3de9b8..a782f5d 100644
--- a/docs/authorised-collection.md
+++ b/docs/authorised-collection.md
@@ -13,7 +13,7 @@ Collection requires all of the following:
- an explicit manifest file;
- one fixed HTTPS origin;
-- one to 32 exact same-origin paths without query strings or fragments;
+- one to 16 exact same-origin paths without query strings or fragments;
- `--confirm-authorised-target`;
- an output path outside the repository or under ignored `private-data/` or
`.private-data/`;
@@ -31,7 +31,12 @@ The collector:
- records a cross-origin redirect relationship but does not follow it;
- performs bounded `GET` requests only;
- caps each response body at 128 KiB;
-- uses a ten-second request timeout;
+- caps retained HTML at 512 KiB in total;
+- reserves one response slot per remaining surface, limiting redirect expansion
+ to the 16-response bundle budget; an exhausted chain remains an explicit
+ redirect observation rather than a successful final response;
+- uses one absolute ten-second deadline per surface, including DNS, headers,
+ response streaming and all redirect hops; trickled bytes do not restart it;
- does not run JavaScript;
- does not submit forms;
- does not use cookies, credentials, browser profiles or authentication state;
@@ -40,6 +45,14 @@ The collector:
bundle;
- discards non-HTML response bodies.
+Repeated response-header values are limited to eight. Overflow produces an
+explicit transport error, never a successful observation of a sliced subset.
+Cookie reduction preserves the most-specific `__Host-Http-`, `__Http-`,
+`__Host-` or `__Secure-` prefix class while removing the actual name and value.
+Derived labels reserve suffix space within 80 characters; the complete opaque
+surface ID remains the association key. Injected transports that exceed the
+body or aggregate budgets fail instead of producing a complete bundle.
+
Loopback HTTP is available only for deliberate local fixture testing with
`--allow-loopback`. It does not permit other private addresses.
diff --git a/docs/data-contract.md b/docs/data-contract.md
index 913db7f..24cfb49 100644
--- a/docs/data-contract.md
+++ b/docs/data-contract.md
@@ -1,5 +1,32 @@
# Data contract
+## Conservative comparison and policy changes
+
+Decision-packet evidence comparison counts the complete event set before its
+512-event display limit. `totalEvents`, `emittedEvents` and `truncated` describe
+that distinction; omitted events still affect regression gates. Reduced-report
+comparisons preserve the underlying comparison totals when wrapped in packets.
+The browser-policy comparison likewise counts before slicing its display list.
+These additive optional summary fields retain the existing schema numbers;
+consumers with strict older schemas must update their schema files. No browser
+storage migration is needed. Evidence analysis is versioned at 5.1.0; comparisons
+across analysis versions are inconclusive, and policies must deliberately review
+their expected version rather than accepting it automatically.
+
+Evidence-policy drift uses `policy:` keys distinct from factual finding keys.
+Removing surfaces or requirements, relaxing a fail rule, introducing/extending
+exceptions, or replacing trust, identity, scope, freshness or expected-version
+constraints requires regression review. Replacements are deliberately conservative:
+even an intended strengthening of a trust boundary requires human review rather
+than being interpreted as a factual fix. Strengthening a result rule and removing
+an exception are resolutions. Adding requirements and role changes are changes.
+An unchanged browser lane cannot conceal weakening in the evidence lane.
+
+Exceptions must name a declared surface and a required evidence/control/composite
+target. Outcomes must be unique and scopes cannot overlap, regardless of expiry
+or ordering. Disjoint outcomes remain permitted. Exceptions cannot target the
+independent trust, identity, freshness or inventory guards and cannot create pass.
+
## Selected snapshot
`data/selected-bcd.json` is a versioned canonical projection, not a source
@@ -90,10 +117,10 @@ normaliser also has explicit behaviour for historic or fixture `true` and
| Reduced evidence export | 512 KiB |
| Reduced comparison events emitted | 512 |
| Collector manifest | 64 KiB |
-| Collector surfaces | 32 |
+| Collector surfaces | 16 |
| Collector response body | 128 KiB |
| Collector redirects | 5 |
-| Collector request timeout | 10 seconds |
+| Collector absolute surface deadline | 10 seconds |
| Evidence-policy exceptions | 128 |
| Evidence-policy findings | 4,096 |
| Browser-policy exceptions | 64 |
diff --git a/docs/deployment-security.md b/docs/deployment-security.md
index 40e26a8..6268316 100644
--- a/docs/deployment-security.md
+++ b/docs/deployment-security.md
@@ -43,6 +43,30 @@ does not alter the checked-out repository or trigger deployment.
## Browser boundary
+### Manual-dispatch parity review
+
+Manual Pages dispatch checks out its exact `github.sha` and runs `npm run verify`.
+It currently bypasses the separate dependency audit and locked browser job that
+automatic publication obtains from CI. This is not complete CI parity. Before
+using manual dispatch, require a successful CI run for that exact SHA or explicitly
+review the bypass. A proposed non-bypass path would make the manual build run
+`npm audit --audit-level=high`, install the locked Chromium build, and run
+`npm run test:e2e` before uploading. Workflow contract tests keep the exact-SHA
+binding and current boundary reviewable. Enabling those additional hosted steps
+or removing an intentional emergency override requires maintainer approval;
+this local repair does not dispatch or change deployment gates.
+
+### Organisation-specific origin review
+
+Use a separate dedicated origin, not a shared project-site path, for sensitive
+local assessment. A header-capable static host should serve the existing
+reviewed `_headers` policy, including response CSP and frame restrictions that
+cannot be supplied by a meta element. Review TLS, origin isolation, resource
+integrity, zero telemetry and cross-origin request behaviour using synthetic
+fixtures before approval. Keep actual evidence on the device and out of build
+artifacts. A host/origin/DNS/account change and any evidence publication need
+separate explicit approval; no such change is performed by local tests.
+
Every generated HTML page carries a restrictive meta Content Security Policy:
- scripts, styles, images, and fonts are limited to the static site's needs;
@@ -152,6 +176,30 @@ CONTROLCURRENT_DEPLOY_TARGET=github-pages npm run audit:public
git diff --check
```
+Optional local cross-engine smoke checks use the locked browser package without
+changing recurring hosted CI or uploading additional artefacts:
+
+```sh
+npx playwright install chromium firefox webkit
+CONTROLCURRENT_BROWSER_SMOKE=1 npx playwright test --grep @smoke
+```
+
+The smoke fixture uses HTTPS with a disposable, locally generated certificate
+because WebKit upgrades loopback subresources under the site's existing CSP.
+It requires local `openssl`; the certificate and key are deleted after reading
+them into the loopback server. Certificate-error checks are disabled in the
+smoke browser context and readiness probe, not pinned to a single certificate.
+This is a local test-only limitation, not production TLS verification; the built
+site's CSP is not weakened.
+
+The cross-engine smoke jobs run serially to avoid local browser resource
+contention. Shared schema validation disables dynamic compilation, including
+the schema library's caught capability probe, instead of allowing `unsafe-eval`.
+
+The smoke scenario checks keyboard use and enlarged text. The complete
+Chromium suite remains the default; a smoke pass is not equivalent to complete
+Firefox or WebKit coverage.
+
After deployment:
1. compare the deployed commit with the reviewed local commit;
diff --git a/docs/engineering-case-study.md b/docs/engineering-case-study.md
index df24f4f..9f2c51c 100644
--- a/docs/engineering-case-study.md
+++ b/docs/engineering-case-study.md
@@ -28,7 +28,7 @@ This creates a reviewable surface:
## Honest unsupported states
-The desired catalogue included CSP nonce and hash sources. BCD 8.0.8 has no
+The desired catalogue included CSP nonce and hash sources. BCD 8.1.4 has no
standalone compatibility statement for either source expression. Mapping both
to the broader `script-src` directive would overstate the evidence, so the
catalogue exposes them with `unsupported_mapping`.
diff --git a/docs/methodology.md b/docs/methodology.md
index 146aa7d..5a184e5 100644
--- a/docs/methodology.md
+++ b/docs/methodology.md
@@ -35,7 +35,7 @@ control definition. Multi-path controls use:
No current catalogue control uses `any`.
Related data is not substituted for a missing feature. CSP nonce and hash
-sources remain unsupported mappings in BCD 8.0.8 because the package does not
+sources remain unsupported mappings in BCD 8.1.4 because the package does not
publish standalone compatibility statements for those source expressions.
## Version comparison
@@ -199,11 +199,31 @@ require that control. A control required nowhere is `not_applicable`; a required
control with insufficient evidence remains missing, invalid, inconclusive,
report-only, or not evaluated.
-Project-authored strict CSP, cross-origin isolation, and cookie attribute
+Project-authored script CSP declaration, cross-origin isolation, and cookie attribute
composites are transparent candidate recipes rather than certification or
policy scores. They are evaluated only for surfaces that explicitly require
them.
+The script CSP declaration candidate (stable ID `strict-csp-candidate`) is not
+a claim about the whole policy being strong. Analysis version 5.1.0 requires
+one enforced policy, `base-uri 'none'` or `base-uri 'self'`, and valid script
+nonce/hash authorisation in both effective element and general script lists.
+A style-only nonce cannot satisfy it. It checks declarations without needing
+HTML; multiple policies remain review-only rather than being guessed equivalent.
+The CSP3 ignored-token rules allow backwards-compatible `unsafe-inline`, host
+and scheme tokens when nonce/hash and `strict-dynamic` make them ineffective.
+Effective broad script allowances and evaluation sources prevent satisfaction.
+Markup correlation and broader style warnings remain separate; unmatched inline
+content or nonce reuse still requires review. Runtime execution and nonce
+unpredictability are not established. See the [CSP3 processing rules](https://www.w3.org/TR/CSP3/#strict-dynamic-usage).
+
+Browser minimums describe the selected release and the later released versions
+recorded in the reviewed source snapshot, not an unlimited future promise.
+Every recorded point in that suffix must retain support. A removal followed by
+reintroduction does not make the earlier minimum valid; unknown or qualified
+points propagate conservatively. Point-release evaluation remains separate.
+This handles the Safari Partitioned-cookie gap without changing source facts.
+
An optional scope inventory can be supplied before the surface manifest. It
contains up to 256 opaque IDs from a declared list, framework manifest,
authorised crawl, or test suite. Included IDs must match assessed surface IDs
diff --git a/docs/policy-as-code.md b/docs/policy-as-code.md
index 3f0b019..61250de 100644
--- a/docs/policy-as-code.md
+++ b/docs/policy-as-code.md
@@ -85,6 +85,14 @@ Browser availability and supplied configuration evidence remain separate
decision lanes. A packet does not prove independent collection, complete
coverage, correct runtime enforcement, or production security.
+Comparison decisions use complete event totals, not the bounded list displayed
+in a report. Truncated lists expose emitted and total counts. JUnit output adds
+an explicit omitted-events case when needed so an adverse event beyond the
+display limit cannot disappear from the CI result. Evidence-policy requirement
+removals and weakened rules are policy regressions, separate from factual
+evidence changes. Changes to pinned trust, identity, scope or freshness contracts
+also require review rather than implying that evidence improved.
+
The command line can build, validate and compare packets. Comparison keeps the
browser-policy and evidence lanes separate, refuses invalid fingerprints, and
classifies incomparable evidence rather than manufacturing a resolution.
@@ -153,6 +161,21 @@ npm run cli -- compare-packets previous-packet.json decision-packet.json \
--format junit
```
+Compare reduced evidence reports with an optional incomparable-result gate:
+
+```sh
+npm run cli -- compare-reports previous-report.json report.json \
+ --fail-regression --fail-incomparable --format junit
+```
+
+`--fail-incomparable` returns exit code `1` when comparison cannot establish a
+like-for-like result. Without that flag, the existing exit-code behaviour is
+unchanged: incomparable results are reported but do not alone fail the command.
+Invalid input still returns `2`. Flags govern the process exit consistently
+across JSON, text, Markdown and JUnit output. Output documents still describe
+all regressions and incomparable results even when an optional exit gate is
+omitted; JUnit may therefore contain failure cases with a non-strict exit `0`.
+
## JSON Schemas
The static site publishes draft 2020-12 schemas for browser policy profiles and
diff --git a/e2e/audit-boundaries.spec.ts b/e2e/audit-boundaries.spec.ts
new file mode 100644
index 0000000..b72901d
--- /dev/null
+++ b/e2e/audit-boundaries.spec.ts
@@ -0,0 +1,409 @@
+import { expect, test, type Page } from "@playwright/test";
+import { readFileSync } from "node:fs";
+import { inspectEvidenceBundle } from "../src/evidence-bundle";
+import { evaluateProfile } from "../src/evaluate";
+import { selectedSnapshotSchema } from "../src/contracts";
+import { evidenceIdentity, evidenceSourceContext } from "../tests/helpers";
+
+const selectedSnapshot = selectedSnapshotSchema.parse(
+ JSON.parse(readFileSync(new URL("../data/selected-bcd.json", import.meta.url), "utf8")) as unknown
+);
+
+async function reportFixture() {
+ return inspectEvidenceBundle(
+ {
+ schemaVersion: 4,
+ name: "Synthetic deferred fixture",
+ identity: evidenceIdentity,
+ surfaces: [
+ {
+ id: "document",
+ role: "document",
+ requiredEvidence: ["response"],
+ requiredControls: ["content-security-policy"],
+ requiredComposites: []
+ }
+ ],
+ responses: [
+ {
+ schemaVersion: 1,
+ name: "Fixture",
+ surfaceId: "document",
+ headers: { "Content-Security-Policy": "default-src 'none'" }
+ }
+ ]
+ },
+ evidenceSourceContext
+ );
+}
+
+async function deferredInputs(page: Page) {
+ await page.addInitScript(() => {
+ const gates: { kind: "file" | "hash"; release: () => Promise