This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+11 more
ReleasePort's take
Light signalWeb extensions now support optional per‑locale `display_name_i18n` attributes for navigation tabs.
Why it matters: Test locale handling in dev before upgrading to v0.9.6; the API adds an empty `display_name_i18n` field by default.
Summary
AI summaryAdded optional per‑locale labels for web‑extension navigation tabs
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Web extensions can now include optional per‑locale `display_name_i18n` attribute for nav tabs. Web extensions can now include optional per‑locale `display_name_i18n` attribute for nav tabs. Source: llm_adapter@2026-05-22 Confidence: high |
— |
| Feature | Low |
HTTP `/api/extensions` response includes a new empty `display_name_i18n` field per entry when not declared. HTTP `/api/extensions` response includes a new empty `display_name_i18n` field per entry when not declared. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Feature | Low |
Front-end code reads current locale and updates nav tab labels on `mureo:locale_changed` events without page reload. Front-end code reads current locale and updates nav tab labels on `mureo:locale_changed` events without page reload. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Refactor | Low |
`WebExtensionEntry` gains a default-empty `display_name_i18n` field without breaking existing constructors. `WebExtensionEntry` gains a default-empty `display_name_i18n` field without breaking existing constructors. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Refactor | Low |
Discovery validates `display_name_i18n` as a mapping of strings, emitting a warning for invalid shapes. Discovery validates `display_name_i18n` as a mapping of strings, emitting a warning for invalid shapes. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
Full changelog
Added — Optional per-locale labels for web-extension nav tabs (#129)
Web extensions can now ship an optional display_name_i18n: Mapping[str, str] class attribute alongside display_name so the configure-UI nav tab follows the active locale. Built-in nav tabs (Setup / Demo / BYOD / Danger Zone) are already translated via data-i18n keys in i18n.json; extension tabs now follow the same convention without extension authors having to touch the OSS i18n.json catalog.
class MyExtension:
name = "acme-vault"
display_name = "Acme Vault setup" # fallback for any locale
display_name_i18n = {
"en": "Acme Vault",
"ja": "Acme Vault 設定",
}
Lookup priority on the renderer side: display_name_i18n[active_locale] → display_name_i18n["en"] → display_name. Operators who toggle the configure-UI locale see your tab name update without a page reload — the renderer listens for the existing mureo:locale_changed event.
mureo.web.extensions—WebExtensionEntrygains adisplay_name_i18n: Mapping[str, str]field that defaults to{}so existing constructors continue to work unchanged. TheWebExtensionProtocol is unchanged — the new attribute is read defensively viagetattrso every pre-feature extension keeps loading without modification. Discovery validates the value asMapping[str, str](strkeys and values both required) and skips the extension with aWebExtensionWarningif the shape is wrong (explicitNone, list of pairs,intkeys,intvalues).- HTTP —
GET /api/extensionsincludes a newdisplay_name_i18nfield per entry (empty{}when the extension did not declare any). JSON-only addition; existing consumers ignore unknown keys. - Front-end (
mureo/_data/web/extensions.js) — initial render readsdocument.documentElement.langand looks updisplay_name_i18n[locale]with the fallback chain above. Amureo:locale_changedlistener (fired byapp.js#setLocale) re-runs the lookup so every nav label updates the moment the operator toggles 日本語 / English. - Plugin author docs —
docs/plugin-authoring.md§13 gains a Localising the nav-tab label subsection with the example class attribute, the documented lookup priority, and the empty-string fallthrough note.
Security: labels are injected via textContent (never innerHTML), so a label containing <script> or similar is harmless DOM text. The configure-UI Content-Security-Policy (script-src 'self'; style-src 'self') is unchanged.
Backward compatibility: extensions that do not declare display_name_i18n get an empty dict in their WebExtensionEntry; the renderer's fallback chain resolves to display_name, so the nav tab looks byte-identical to v0.9.5.
Install
pip install --upgrade mureo
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About logly/mureo
Framework for AI agents (Claude Code, Cursor, Codex, Gemini) to operate Google Ads, Meta Ads, and Search Console. Grounded in a local STRATEGY.md — not metric-chasing. Defense-in-depth security, local-first. Apache 2.0.
Related context
Related tools
Beta — feedback welcome: [email protected]