quasarframework/quasar @quasar/app-vite-v3.10.4 on GitHub

Security fixes

fix(app-vite): SSR with Hono -> the default SSR webserver template was sending Cache-Control: public, max-age=2592000000 on every GET response that went through it in production: server-rendered pages (logged-in ones included), redirects, 404/500 pages and the GET routes of your SSR middlewares, not only on static files. Browsers, CDNs and reverse proxies were therefore allowed to store those responses and hand them to other visitors, and returning visitors kept the old HTML after a deploy. The value was also expressed in milliseconds while max-age counts seconds, so the intended 30 days became about 82 years. The header is now set only when a static file is actually served, with the correct 30 days value; everything else is left to your own cache policy. Dev mode and the Express, Fastify and Koa templates were not affected (GHSA-j5fg-jh38-f8q6)
This only fixes newly generated SSR projects. Adding the SSR mode copies the template into your project, so upgrading @quasar/app-vite does not touch an existing /src-ssr/server.js (or server.ts). If you use Hono, please edit that file by hand and replace this block in serveStaticContent:
```
if (cacheAge > 0) {
  app.get(routePath, async (c, next) => {
    c.header('Cache-Control', `public, max-age=${cacheAge}`)
    await next()
  })
}
```
with:
```
if (cacheAge > 0) {
  const { onFound } = serveOpts
  const cacheControlValue = `public, max-age=${Math.floor(cacheAge / 1000)}`
  serveOpts.onFound = async (path, c) => {
    c.header('Cache-Control', cacheControlValue)
    await onFound?.(path, c)
  }
}
```
In the TypeScript template the options object is named staticOpts: move its const staticOpts = { ...serveOpts } declaration above this block and use it instead of serveOpts. After deploying, purge the HTML cached by your CDN or reverse proxy. Browsers that already stored a page keep it until they evict it; sending Clear-Site-Data: "cache" on a response that still reaches your server (the logout one, for example) clears it for browsers supporting that header

Fixes

fix(app-vite): TypeScript -> .vue files are now covered by the generated .quasar/tsconfig.json. Its include relied on a bare wildcard, which Rolldown (like tsc) matches against TS/JS files only, so <script lang="ts"> blocks were compiled without your compilerOptions (experimentalDecorators, useDefineForClassFields, verbatimModuleSyntax and the like were ignored) while vue-tsc type-checking looked fine. In a monorepo with a root solution tsconfig, the build could even abort with TSCONFIG_ERROR ... Tsconfig not found. The file is regenerated on the next quasar dev, quasar build or quasar prepare (#18589, #18590)
fix(app-vite): SSG -> quasar build -m ssg no longer fails on Windows with ERR_UNSUPPORTED_ESM_URL_SCHEME when it starts rendering the pages (#17840)

Other

chore(app-vite): upgraded deps -> vite ~8.3.6 and rolldown ~1.2.16 (both now held to their minor version), @vitejs/plugin-vue ^6.0.10, sass-embedded ^1.108.1, @types/chrome ^0.3.7, confbox ^0.3.2, fs-extra ^11.4.1, semver ^7.8.6 and serialize-javascript ^7.1.4

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following: