quasarframework/quasar quasar-v2.32.2 on GitHub

Security fixes

fix(openURL): DOM clobbering of the iOS SafariViewController bridge -> on iOS, attacker-controlled HTML rendered into the page (a <a id="SafariViewController"> through QEditor, or QSelect / QChatMessage with HTML rendering enabled) shadowed the native bridge global, so every later openURL() call threw TypeError: window.SafariViewController.isAvailable is not a function and the URL never opened. openURL() now hands the URL to the bridge only when it exposes the expected isAvailable() and show() functions, and opens a regular window otherwise (GHSA-89vp-x45c-52cq)

Fixes

fix(types): framework.config.globalNodes -> the option has been honored since #8634 (it sets the CSS class of the nodes Quasar appends to <body> for portals, Notify, Loading and LoadingBar) but was never declared in QuasarUIConfiguration, so a typed quasar.config file or app.use(Quasar, { config: { globalNodes } }) rejected it. It is typed now, with its class member documented

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following: