Skip to content

Conversation

@rebloor
Copy link
Collaborator

@rebloor rebloor commented Jan 26, 2026

Implement the following updates:

  • updates advice regarding host permission.
  • add information about replacing extension.lastError with runtime.lastError and extension.getURL with runtime.getURL.

@rebloor rebloor requested a review from Rob--W January 26, 2026 17:35
@rebloor rebloor self-assigned this Jan 26, 2026
@rebloor rebloor requested a review from Rob--W January 29, 2026 18:15
Copy link
Member

@Rob--W Rob--W left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently missing from documentation:

  • fetch and XHR in content scripts no longer allow cross-origin requests through extension permissions. Instead, the destination server should use CORS, or the extension has to send a message to go the background page (or an extension tab or frame) instead, to ask it to make a request on behalf of the content script. This changed in https://bugzilla.mozilla.org/show_bug.cgi?id=1578405
  • userScripts API of MV2 differs from userScripts API in MV3 (maybe one small note in the scripting section? Also emphasize that the AMO only approves of the use of the API for user script managers only)
  • CSP section should also mention that it now includes upgrade-insecure-requests by default, see https://bugzilla.mozilla.org/show_bug.cgi?id=1797086

Although not specific to MV3, should we mention the data_collection_permissions requirement for visibility? (While emphasizing that it is also needed in MV2). I haven't put too much thought into it, the question just crossed my mind.


Two features of the `extension` API are deprecated in Manifest V2 and no longer available in Manifest V3, but have alternatives:

- [`extension.lastError`](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/extension/getURL), use [`runtime.lastError`](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/runtime/lastError) instead.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- [`extension.lastError`](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/extension/getURL), use [`runtime.lastError`](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/runtime/lastError) instead.
- [`extension.lastError`](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/extension/lastError), use [`runtime.lastError`](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/runtime/lastError) instead.

Fixed typo in URL

{% endcapture %}

{% include modules/one-column.liquid,
id: "removed- apis"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
id: "removed- apis"
id: "removed-apis"

Assuming that the extraneous space was a mistake.


{% capture content %}

### Extension API
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
### Extension API
### Removed APIs

"Extension" API sounds too general, adjusted to match the identifier you listed below (also to allow for other content to fit).

"Other changes", "Other deprecations", etc would also work, I don't have strong preferences either way.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants