June in Servo: real world compat, media queries, SharedWorker, and more! - Servo aims to empower developers with a lightweight, high-performance alternative for embedding web technologies in applications.

Servo 0.4.0 contains all of the changes we landed in June, which came out to yet another record 558 commits (April: 534, May: 391). For security fixes, see § Security. We’ve shipped several new web platform features: ‘attr()’, in experimental mode (@Loirooriol, #45041) ‘image(<color>)’, ‘closest-corner’, and ‘farthest-corner’ in ‘ellipse()’ and ‘circle()’ (@Loirooriol, #45421) ‘calc()’ and other mathematical expressions can now be resolved later than parse time, e.g. sign(1em - 32px) (@Loirooriol, #45421) ‘font-feature-settings’ in ‘@font-face’ (@simonwuelker, #45393) ‘@media (device-width)’, ‘@media (device-height)’, ‘@media (height)’, ‘@media (aspect-ratio)’, and their min- and max- variants (@jdm, @mrobinson, @nicoburns, @jschwe, #44978, #45707, #45490) ‘@media (orientation)’ (@nicoburns, #45707) ‘@media (pointer)’ and ‘@media (any-pointer)’ (@nicoburns, #45681) ‘@media (hover)’ and ‘@media (any-hover)’ (@nicoburns, #45681) Plus a bunch of new DOM APIs: SharedWorker (@Taym95, #45786) console.dir() (@Taym95, #45109) customElementRegistry on Document and ShadowRoot (@shubhamg13, #45872) initialize() on CustomElementRegistry (@shubhamg13, @yezhizhen, #45903) new CustomElementRegistry() (@shubhamg13, #45791, #45550) textStream() on Request, Response, and Blob (@yezhizhen, #45864, #45861) setPointerCapture(), releasePointerCapture(), hasPointerCapture() on Element (@webbeef, #45048) ontouchstart, ontouchend, ontouchmove, ontouchcancel on Element (@stevennovaryo, #45049) crypto.subtle.digest() for KT128 and KT256 (@kkoyung, #45699) crypto.subtle.getPublicKey() for ML-KEM and ML-DSA (@kkoyung, #45252) This is another big update, so here’s an outline: You can help! Security Real world compat Work in progress Embedding API For users and developers More on the web platform Garbage collection safety Performance and stability New contributors You can help! Servo is steadily becoming a bigger and busier project every month, and by June 2026, we’ve been reading through over four times the commits as we did when we started in September 2023. This is hard work, particularly since there are things we need to know that are often difficult to answer just by reading the changes: Who does the change affect, if anyone? Does it affect users, Servo developers, embedders, or some other group? What observable difference does the change make, if any? Does the feature require any preferences to be enabled, or is it enabled for everyone by default? Are any real-world websites affected by the change? What issue or broader project is the change related to? This question is answered by Fixes: #xxxxx or Part of: #xxxxx in the PR description. Thanks to an initiative by @jdm, it’s now easier than ever for you to help us answer those questions, using the Servo Highfive bot! If you’re working on a pull request that you think might be interesting for the next monthly update, even if you’re not 100% sure, tell us about it by following the steps below: You add the monthly update label to your pull request, or comment @servo-highfive monthly update Highfive posts a comment asking you some questions You answer those questions in a comment containing @servo-highfive monthly update answer Security Servo’s JS runtime, SpiderMonkey 140.10.1, had several security bugs that have been fixed in Servo 0.4.0 with the update to SpiderMonkey 140.11.0 (@jschwe, #45584). For more details, see CVE-2026-8388, CVE-2026-8391, CVE-2026-8974, CVE-2026-8975, and MFSA 2026-48. Several more security bugs in Servo’s JS runtime have been fixed in Servo 0.4.0 with the update to SpiderMonkey 140.12.0 (@jschwe, #45766). The exact CVEs that apply to us are not yet known, but for more details, see MFSA 2026-58. RSA operations in SubtleCrypto now do modular exponentiation in constant time (@kkoyung, #45631). Please note that our RSA implementation is currently vulnerable to the Marvin Attack – for more details, see RUSTSEC-2023-0071. ML-DSA operations in SubtleCrypto now do the Decompose step in constant time, fixing RUSTSEC-2025-0144 (@kkoyung, #45294). We’ve fixed an HTML injection bug (XSS) in file:/// directory listings, which affected file names containing </script> (@sahvx655-wq, #45510). Real world compat Layout correctness has significantly improved on lichess.org, and many websites have become a lot more readable thanks to our improved handling of variable fonts (@simonwuelker, #45768), including Zulip (servo.zulipchat.com) and Speedtest (speedtest.net). v0.3.0 v0.4.0 lichess.org v0.3.0 v0.4.0 Zulip (servo.zulipchat.com) v0.3.0 v0.4.0 Speedtest (speedtest.net) Many websites worked in Servo even before version 0.4.0, including Google Photos (photos.google.com) and Cash Converters (cashconverters.com.au), and continue to work in version 0.4.0. Other websites, like Google Maps (maps.google.com) and OpenStreetMap (www.openstreetmap.org), render well but have some issues with interactivity. Google Photos (photos.google.com) Cash Converters (cashconverters.com.au) Google Maps (maps.google.com) OpenStreetMap (www.openstreetmap.org) We’re interested to hear how well your favourite websites run in Servo! Report successes in this Zulip thread, and failures in our GitHub issues. Work in progress We’re implementing the more powerful version of ‘attr()’ that can be used anywhere, not just in ‘content’, under --pref layout_css_attr_enabled (@Loirooriol, #45041, #45421, #45495, #45752). WebGPU support has improved, under --pref dom_webgpu_enabled: implemented copyExternalImageToTexture() on GPUQueue (@sagudev, #45646) implemented createQuerySet() on GPUDevice and resolveQuerySet() on GPUCommandEncoder (@sagudev, #45644) implemented pushDebugGroup(), popDebugGroup(), and insertDebugMarker() on GPUCommandEncoder, GPUComputePassEncoder, and GPURenderPassEncoder (@jschwe, #45489) more conformant GPUTexture (@sagudev, #45300) more conformant requestAdapter() on GPU (@sagudev, #45424) more conformant secure context enforcement (@sagudev, #45279) All of the features above are enabled in servoshell’s experimental mode. We’ve made more progress towards accessibility support, under --pref accessibility_enabled (@alice, @delan, #45555, #45554, #44949). We’ve started implementing visible and interactive text selection (@mrobinson, @SimonSapin, #46107), one of the most long-awaited features of any web browser. Stay tuned! We’ve also started working on Web Animations, under --pref dom_web_animations_enabled (@simonwuelker, #45522, #45983), as well as webkitRelativePath on File, under --pref dom_entries_api_enabled (@yezhizhen, #45666). Rust doesn’t have a stable ABI, so it has generally not been possible to embed Servo in another application without building Servo from source. To make it possible, we’ve started designing a wrapper C API that will let you consume Servo as a prebuilt shared library using the stable and ubiquitous C ABI (@mukilan, #44984). Eventually the idea is that we’ll create a wrapper Rust API around that wrapper C API, so you can have both the ergonomics of Rust and the build simplicity of C. Embedding API New in the Servo API: WebView::rendering_context (@mrobinson, #46047) Breaking changes: WebView::send_error has been removed (@mukilan, #45502) – this method was always meant to be internal, and has become unused after we introduced the new WebView- and WebViewDelegate-based API We’ve improved the docs for WebView, WebViewDelegate, JSValue, AlertDialog, AllowOrDenyRequest, AuthenticationResponse, BluetoothDeviceDescription, ConfirmDialog, ConsoleLogLevel, CreateNewWebViewRequest, EmbedderControl, EmbedderControlResponse, FilePicker, Image, JavaScriptErrorInfo, NavigationRequest, PermissionRequest, PixelFormat, PromptDialog, ProtocolHandlerRegistration, ProtocolHandlerUpdateRegistration, Scroll, SelectElement, SelectElementRequest, and WebViewVector (@mukilan, #45282, #45467). For users and developers In servoshell: the Android version now requires Android 13+ (@jschwe, #46104) the desktop version now lets you drag and drop files to open them (@simonwuelker, #45454) the desktop version now lets the tab bar scroll horizontally if you have too many tabs open, but from one tab hoarder to another, maybe you should reconsider having so many tabs open (@Nylme, #44884) the desktop version enters fullscreen on the monitor containing the window, even if you’ve moved it to a different monitor (@rhit-kapilaar, #45556) the desktop UI is more performant, resizes more smoothly, and no longer gets stuck in hovered states (@mrobinson, #45289, #45456, #45290) <select multiple> should now be interactable on all desktop platforms (@alexcat3, #45419) localhost:<port> now implies http:// in the location bar and on the command line, rather than treating localhost: as an unsupported URL scheme (@SteveSharonSam, #45729, #45832) When using the Firefox DevTools: in the Console tab, uncaught exceptions are reported correctly (@jdm, #45549) in the Console and Debugger tabs, you can now inspect the elements of nested arrays and the entries of Map objects (@atbrakhi, #45435, #45514, #45767) in the Debugger tab, the Scopes panel now shows any ‘(uninitialized)’ variables, the value of this, and the global scope (@atbrakhi, @eerii, #45824, #45517) We’ve fixed some build issues on riscv32, riscv64, and arm64 (@fxzjshm, @saschanaz, #45285, #45731), and modernised servoshell for Android to use Compose UI and Kotlin (@veyndan, #45923, #45932, #45941, #45982, #45985, #46015, #46035, #46037, #46046, #46053, #46061, #46071, #45641, #45643, #45650, #45665, #45671, #45676, #45679, #45683, #45712, #45713, #45734, #45738). For developers of Servo itself: mach try --help now lists all of the kinds of try jobs you can run (@shubhamg13, #45607) mach test-wpt --update-expectations lets you run Web Platform Tests and update expectations in a single command (@TimvdLippe, #45521), rather than having to run mach test-wpt --log-raw <path> followed by mach update-wpt <path> More on the web platform