TLC Meeting - July 23, 2026

Meetings are happening weekly on Thursday at 0700 Pacific / 1000 Eastern / 1500 UK / 1930 India as a video call, and the invite is posted to the #selenium-tlc channel on Selenium Slack. To add items to the agenda for the next meeting, please see our public Rolling Agenda

Participation

Agenda

Meeting Summary

The TLC continued reviewing the network async/event API ADR point by point, covering handler references, URL pattern filtering, and authentication handlers. They confirmed handler references should be handle objects, converged on accepting strings and native URL objects for URL patterns while erroring on unsupported wildcards for now, and leaned toward pairing the callable-based authentication handler with a simpler username, password, and URL convenience method. AutomatedTester also noted progress on hermetic Selenium Manager builds and a newly raised concern that the bundled Selenium Manager binary ships without third-party license and SBOM information.

Decisions

  • Network handler references will be handle objects rather than string or integer IDs, so behavior can be added to them later. This reaffirms the prior week’s direction; a bare string or number leaves no room to extend.
  • URL pattern filtering will accept a string, a list of strings, and an object of the URL components the remote end supports. A native URL object may also be accepted; it is converted to a string and passed through rather than decomposed into components, and does not error.
  • Unsupported wildcard or glob patterns will error client side for now, with a message directing users to do that matching inside their callable. Filtering such patterns client side may be revisited later based on demand.
  • The network API will keep a callable-based authentication handler, following the existing handler pattern, because a callable is required so a handler can either supply credentials or cancel the request. titusfortner leaned toward also adding a separate convenience method that accepts a username, password, and URL for the common case; p0deje considered it a nice addition but not a requirement, and it will be reflected in the next ADR revision.

Discussion Notes

Network async/event API ADR

titusfortner recapped that the group is walking through the four ADRs the Selenium 5 charter requires. The BiDi implementation boundaries ADR was merged the prior week and its tracking issue has since been created; this meeting continued on the network async/event API ADR.

On handler references, AutomatedTester reaffirmed that a handler should return a handle object rather than a plain string, comparing passing strings around to magic numbers. titusfortner noted the earlier string-based idea came from the Firefox add-on pattern, where an extension id string is returned and later passed back to remove it, but agreed an object gives room to add features later.

On URL patterns, titusfortner laid out three places filtering could happen: what the remote end supports, a filter applied in the add handler method, and matching the user does inside their own callable. He proposed focusing on what the remote end supports so performance and compatibility are preserved, and initially suggested erroring when a passed value included anything the specification does not support. AutomatedTester pushed to keep the client side minimal and pass values through to the remote end, doing the hard work but not all of it, noting URLs are complex and even the URL specification authors keep finding edge cases. p0deje argued the interface should be as simple as possible, so users can pass a URL or string and let Selenium do the parsing rather than destructuring components themselves.

The group converged on accepting a string, a list of strings, and an object of the supported URL components, and on accepting a native URL object that is converted to a string and passed through rather than decomposed. AutomatedTester argued the string and URL forms should not error, since users have legitimate reasons to pass such values and will work around it otherwise.

On wildcards, titusfortner noted the specification does not currently support them, that a pending PR would add the WHATWG URL pattern syntax rather than shell-style globs, and that supporting globs now would require Selenium to match them locally against every intercepted request, which he expected to be a performance problem. diemol asked what the general approach should be, observing that WebdriverIO added a client-side helper for wildcard matching after users requested it, and that curating such a feature might help users even if the specification does not support it. He was explicit that he was not proposing to open the door to arbitrary features, only asking whether cases like this one warrant a hand. The group agreed to error on wildcards now, with a message pointing users to their callable, and to revisit client-side filtering later if people ask for it.

AutomatedTester preferred that URL patterns be represented as a simple object with properties rather than plain text. titusfortner agreed and asked whether that should be required in the ADR or left idiomatic; the group leaned toward noting it as the ideal in the ADR while leaving the concrete shape to each binding, observing it fits Java, .NET, Python, and Ruby better than modern JavaScript. titusfortner noted that in Java this would likely become a request options class with a URL pattern builder rather than many method overloads, but treated that as an implementation detail.

On authentication, p0deje said a callable is needed because a handler may either authenticate with a username and password or cancel and reject the request, which cannot both be expressed through parameters, and that this keeps authentication consistent with request handling. titusfortner agreed the callable is necessary and proposed a separate add authentication method that takes a username, password, and URL for the roughly 99% common case, rather than folding both forms into one method. AutomatedTester preferred the simpler username and password signature for the common case, since a bare callable is a foot gun for less experienced users, while keeping the callable available for advanced cases. titusfortner said he did not like Ruby’s current approach of generating the callable under the hood and preferred two clearly distinct methods. p0deje considered the convenience method a nice addition but not a requirement.

Selenium Manager license and SBOM information

AutomatedTester gave an FYI that he is still working toward hermetic builds for Selenium Manager. titusfortner raised that someone had opened an issue about Selenium Manager shipping as a bundled binary without publishing third-party license and SBOM information, which may put the release out of license compliance, and noted it was surprising this had not come up in the three years of shipping it. He said a first attempt at generating that information did not work well across platforms and may need a native approach, which would complicate the build and SBOM generation that AutomatedTester is working on. AutomatedTester was skeptical the practical risk matched the perceived risk, suggested that noting the licenses in the release notes might be sufficient, and said he would double-check his understanding of how the licenses apply. titusfortner agreed to share what he had been attempting so they could reconcile it against the hermetic build work.

Generated client example code

titusfortner noted he tagged AutomatedTester on a Python generated example so the current user-facing code could be compared side by side with the generated version, and that generation is now part of the build process. He expected to tweak one more thing before it is pushed and is working on making the Java code follow the same approach, with an ADR review to follow later as a lower priority.

Action Items

  • titusfortner will update the network async/event API ADR to reflect URL patterns accepting a string, list, or component object plus an optional native URL object converted to a string, wildcards erroring with an informative message, the note that URL patterns should ideally be a simple object with the shape left idiomatic, and a separate username, password, and URL authentication convenience method alongside the callable handler.
  • titusfortner will message AutomatedTester about the Selenium Manager license and SBOM work he attempted so it can be reconciled with the hermetic build effort.
  • AutomatedTester will research third-party license and SBOM compliance for the bundled Selenium Manager binary and confirm whether noting the licenses in the release notes is sufficient.
  • titusfortner will finish wiring the generated client examples into the build process and extend the same approach to Java.
Last modified July 23, 2026: Add TLC meeting minutes for July 23, 2026 (b2cf6227ec9)