October brings HtmlUnit 5.6.0 with Chrome/Edge 154 and Firefox 157 support. Highlights of this release include:

  • A major rewrite of JavaScript scope handling;
  • Comprehensive improvements to HTML parsing and serialization;
  • Better keyboard support; and
  • WebSocket improvements.

🚀 Version 5.6.0 - October 11, 2026

JavaScript Engine: Major Scope Handling Overhaul

The Rhino team has undertaken a significant rewrite of scope handling. Variable scoping and const handling are now in sync with the ECMAScript specification—a major step forward in ES6 compliance.

This wasn’t a small change. Proper variable scoping is fundamental to JavaScript correctness, affecting how var, let, and const declarations interact with block scopes, function scopes, and global scope.

Additional JavaScript Fixes:

  • Symbol.keyFor() now correctly throws a TypeError when its argument is not a Symbol value
  • Date.parse() now properly rejects out-of-range values
  • escape() function corruption bug fixed
  • Variable-length Unicode escapes (\u{}) properly capped at U+10FFFF
  • Accessor property handling fixed (values are not constant)
  • Numeric type handling in equality comparisons corrected
  • Race condition with GC during call site bootstrapping fixed
  • Java value conversion on reads improved

Uint8Array Methods: Added fromBase64, fromHex, setFromBase64, setFromHex, toBase64, and toHex methods for modern binary data handling.

ArrayBuffer Implementation: Switched from raw byte[] to ByteBuffer for better memory management and performance.

HTML Parsing and Serialization Compliance

I’ve made comprehensive changes to how HtmlUnit parses and serializes HTML, bringing it much closer to real browser behavior:

Trailing Slash Handling:

  • Trailing slashes on non-void elements are now honored only for XHTML pages and XHTML document fragments (innerHTML, etc.)
  • In HTML documents, trailing slashes are ignored, matching browser behavior
  • XHTML pages now correctly honor trailing slashes for iframe and script elements

Raw Text Elements:

  • Text in raw text elements (iframe, xmp, noembed, noframes, plaintext, noscript) is no longer escaped
  • Non-breaking spaces are written as   for HTML documents only
  • Children of void elements are not serialized
  • Script and style elements are serialized like any other element in XHTML documents

NUL Character Handling:

  • NUL characters are now replaced by U+FFFD in the content of title, textarea, style, xmp, iframe, noscript, noframes, noembed, and plaintext
  • NUL characters in comments and attribute values are properly handled
  • Regular text content follows HTML5 tokenizer rules

Parser Configuration:

  • allow-selfclosing-tags, allow-selfclosing-iframe, and allow-selfclosing-script flags are now handled independently for more flexible and secure parsing (thanks to aws-sec-vdp)
  • Self-closed elements like noembed, noframes, noscript, plaintext, title, textarea, style, and xmp are now properly treated as empty elements

Title Element Fix:

  • HTMLTitleElement.text getter now correctly returns the text of all text node children (elements and comments are skipped)
  • Setter properly replaces all children

Security Enhancements:

  • Enhanced escaping for innerHTML() to prevent security vulnerabilities and align with browser behavior

Parser Stack Overflow Fix:

  • Fixed stack overflow when noframes tag precedes the html tag (thanks to quantmode).

Keyboard Support Enhancements

Added comprehensive keyboard navigation support to text inputs and textareas:

  • Space key now activates or toggles checkboxes, radio buttons, and button controls
  • Up/Down arrow keys provide navigation support
  • Ctrl+Left/Right arrow improved for word navigation and selection
  • Ctrl+Backspace/Delete now supports word deletion
  • Right arrow key movement fixed when caret is at index 0
  • HOME/END keys in textareas now move to start/end of current line
  • Ctrl+HOME/END moves to document start/end
  • Backspace key now properly clears non-empty selections

WebSocket Improvements

Robustness: Enhanced error and state handling and parameter validation at construction time.

Spec Compliance:

  • readyState now immediately transitions to closing (2) upon calling close()
  • binaryType property (‘blob’ and ‘arraybuffer’) is now properly used for correct handling of incoming binary messages

Dependency: Updated Jetty (websocket-client) to 12.1.14.

Document API Improvements

Added getDocumentTitle() method to HtmlPage that returns the same values as document.title, providing better programmatic access to the page title.

XPath Engine Improvements

The XPath engine received significant cleanup and optimization work.

Browser Compatibility

  • Chrome/Edge 154 and Firefox 157 support

Version 5.6.0 is available on Maven Central. Check out the full changes report for the complete list of changes.

This release marks another significant step in our ES6 compliance journey. The scope handling rewrite with the Rhino team is a major architectural improvement that enables correct execution of modern JavaScript patterns. Thanks also to aws-sec-vdp and quantmode for their security and parser contributions.

Happy testing!

— RBRi

Resources: