Support for Manifest V3

[varjolintu]

Expected Behavior

The extension should support Manifest V3. The final deadline is January 2023 when Google no longer allows updating existing extension to Chrome Web Store if only Manifest V2 is present: https://developer.chrome.com/docs/extensions/mv3/mv2-sunset/

Migration checklist: https://developer.chrome.com/docs/extensions/mv3/mv3-migration-checklist/ Mozilla's migration guide: https://extensionworkshop.com/documentation/develop/manifest-v3-migration-guide/

The following are affected:

• Replace the webRequestBlocking permission with declarativeNetRequest. Probably only affects Chromium based browsers.
• browser.runtime.getBackgroundPage() will not work. Service workers must be used instead.
• content_security_policy must be replaced.
• Using inline scripts or styles is no longer possible. Investigate if Scripting API can be used instead.
• Make a separate manifest for Firefox and update the install script

[varjolintu]

Branch created: https://github.com/keepassxreboot/keepassxc-browser/tree/manifest_v3

Notes:

• Chromium based browsers can already load the extension, Firefox cannot because it doesn't support service_workerin background in the manifest.
• HTTP Auth needs a fix, mostly because Chrome doesn't allow using webRequestBlocking anymore.
• getBackgroundPage() was no longer allowed in popups. Switched to messaging instead.

[varjolintu]

Seems Chromium still doesn't support onAuthRequired needed by HTTP Basic Authentication. Not much months left until January 2023.. https://bugs.chromium.org/p/chromium/issues/detail?id=1135492

[varjolintu]

Considering the possible support status with Firefox, I'd prefer the first step to be the following (if it's possible to do this):

• When making a build, Firefox is still made with V2, Chrome with V3 using a separate manifest file
• Loading the extension directly from the sources will only support V2

Step two is when Firefox also fully supports V3.

[droidmonkey]

This means we would break support for HTTP Basic Auth only on Chromium based browsers until they support that API?

[varjolintu]

This means we would break support for HTTP Basic Auth only on Chromium based browsers until they support that API?

If Google doesn't finish the API before January 2023, it will break, yes. But we don't have a choice because you cannot update the extension to a new version if it's not V3 in January. Google also states that V2 extensions cannot be used with Chrome.

Edge has the same schedule: https://docs.microsoft.com/en-us/microsoft-edge/extensions-chromium/developer-guide/manifest-v3

[varjolintu]

A draft PR is created for the issue: https://github.com/keepassxreboot/keepassxc-browser/pull/1723

With that it's already possible to build a Manifest V3 version of the extension and use it with Chromium based browsers.

[varjolintu]

According to Google, they are postponing V2 shutoff to June 2023: https://developer.chrome.com/blog/more-mv2-transition/

[varjolintu]

For a reminder to myself: https://blog.mozilla.org/addons/2022/10/31/begin-your-mv3-migration-by-implementing-new-features-today/

[varjolintu]

Google just provided some more information about this: https://groups.google.com/a/chromium.org/g/chromium-extensions/c/zQ77HkGmK9E

In short, they are still working with the timeline, but will provide a six month migration period. Talking about next year, so no MV3 in 2023.