- Block cross-origin fetch/XHR for custom protocols unless `corsEnabled:true`; no‑cors requests now return opaque responses.
- Fix Squirrel.Mac installer path resolution and backport GPU command‑buffer route ID validation.
- Backport multiple security patches and upstream fixes for Skia, ANGLE, and WebRTC.