Version 2.0.5 prioritizes security enhancements.
- Enhanced workspace import validation and migration processes, including the rejection of potentially hazardous keys, the implementation of size and count restrictions, the verification of finite coordinates, the rejection of unsafe trigger-filter configurations, and the removal of unknown source fields following validation.
- Reinforced overlay/hotkey runtime message validation and eliminated reliance on message-provided tab IDs and URLs.
- Introduced trusted-event guards for overlay pointer events and OverlayInput keyboard and mouse capture functionalities.
- Implemented content-script restrictions for page text, raw HTML, and link retrievals.
- Updated security assistance documentation, bundled workspace compatibility metadata, manifests, and package versions.

URL Alchemist 2.0 is a Chrome extension for building browser workflows from visual blocks. Create editable workspaces, compile them into portable binary Action Packs, and run those packs from page input data, hotkeys, context menus, intervals, or visible overlay events

The update was focused entirely on hardening and security.
- Unsafe redirect/output handling: packs can no longer transform a tab into j
avascript:, other non-web schemes, malformed absolute URLs, or file:// when
local files are disabled.
- Import hardening: .urlpack imports are now capped at 1 MB, numeric fields
are validated more strictly, failed imports clear any previously staged
pack, and the staging modal blocks imports that would reuse an installed
pack ID or fail the same regex/hotkey safety checks as the Forge.
- Regex correctness bug: $1-style capture groups now expand correctly for
NTH_OCCURRENCE, BEFORE_PATTERN, and AFTER_PATTERN, not just standard
replacements.
- Hotkey message hardening: background execution now prefers the real sender
tab URL over the message-provided URL to avoid spoofable intra-extension
input.