v0.1.876 Aug 2026·Rendering, Web APIs & DOM

Message authentication: real HMAC signing and verifying

This release completes the cryptographic core the previous one started. Where 0.1.86 added real hashing, this adds real message authentication: crypto.subtle can now import a raw HMAC key and sign and verify with it, over any of the four hashes already present (SHA-1, SHA-256, SHA-384, SHA-512). The implementation is standard HMAC and was checked byte-for-byte against the published RFC 4231 test vector - signing produces the exact expected code, verifying accepts the true message and rejects a tampered one. Together with the hashing from the previous release, this is the path that JSON Web Token verification, signed webhooks and API-request signing take, so code that authenticates a request now gets a correct answer instead of a broken fallback. The engine gate holds at 6375 of 6375 and the work carries a test against the standard vector. This is a capability release rather than a coverage move: SubtleCrypto still lacks encryption and key generation, so the Web APIs figure holds where it honestly is.

Parity with the reference browser

74overall, as of v0.1.343

Web APIs / DOM surface42

Security architecture66

GPU / graphics acceleration68

DevTools / extensions72

Networking85

Media85

Accessibility85

Real-world site compatibility99

HTML parsing100

CSS parsing + selectors100

Layout: block / flex / grid / tables / writing-modes100

Paint + visual100

JavaScript language100

JavaScript performance (JIT)100

HTML parsing100

What changed 3 changes

Rendering	New: crypto.subtle.importKey / sign / verify for HMAC over SHA-1/256/384/512 - real message authentication (RFC 2104), verified byte-for-byte against the RFC 4231 test vector: signing produces the exact code, verifying accepts the true message and rejects a tampered one. This is the JWT / signed-webhook / request-signing path.
Rendering	Built on the hashing added in 0.1.86, so importing a key and choosing any of the four hash algorithms works with no new dependency; an unsupported hash rejects cleanly.
Web APIs & DOM	Capability, not coverage: SubtleCrypto now has digest plus HMAC but still lacks encryption and key generation, so the Web APIs aspect holds at 46; the record is the RFC-verified test and the gate at 6375 of 6375.