Released on 2026-08-22 Headline changes since v4.3.0: jQuery and Bootstrap's JavaScript bundle have been removed entirely (saving some 150KB of minified JavaScript) and accessibility support added throughout; several security hardenings around the settings that may be supplied in the app's URL and around archive source verification; fixes to the Library fallback for older browsers and to clearing the app cache on reset; and the "Bypass AppCache" option is now called "Developer Mode". Detail is given per interim update below — those updates were pushed only to the browser-extension PWA.

FIX: Tooltips in French no longer show a literal " " before a colon
FIX: Follow HTML redirects in Restricted mode
DEV: Renamed the "Bypass AppCache" option to "Developer Mode" in the UI and info
DEV: Removed three dead translation keys
DEV: Fixed flaky Gutenberg author search tests
DEV: Pinned every GitHub workflow action to an immutable ref, so that our workflows no longer track moving branches
DEV: Added a Dependabot configuration for the GitHub Actions ecosystem

SECURITY: The security prompt regarding the source of an archive now appears consistently in ServiceWorkerLocal mode
FIX: The content injection mode is now validated against the modes the app actually supports
FIX: Users who had already chosen ServiceWorkerLocal mode are no longer shown the mode-change alert they had answered before
FIX: In browsers without the ServiceWorker API (e.g. IE11), the "ServiceWorker API not available" dialogue no longer reappears indefinitely when the app is forced into ServiceWorker mode
FIX: The "Developer Mode" setting no longer blocks a switch to Restricted mode, and can now be turned off from Restricted mode
FIX: The "Developer Mode" setting is now shown in every mode in which it is effective, and is hidden only in browsers with no ServiceWorker API
DEV: Added unit tests covering the trust setting and validation across the content injection modes
DEV: Added e2e tests, run in IE Mode, covering the app's recovery from ServiceWorker mode in a browser that cannot support it

SECURITY: Settings supplied in the app's URL are no longer saved permanently, apart from the few the app passes between its own windows
SECURITY: noPrompts, which suppresses dialogues for the automated test suite, now opens an unverified archive in Restricted mode rather than in ServiceWorker mode
FIX: The Library no longer reports "All library servers are currently unreachable" in browsers that cannot run the modern library (e.g. IE11)
FIX: Refreshed the emergency list of download mirrors, removing dead and redirecting entries and adding those currently advertised by the Kiwix catalogue
FIX: Corrected obsolete download.kiwix.org links in the About section
DEV: Library server checks now time out correctly