quasarframework/quasar quasar-v2.35.3 on GitHub

Security fixes

fix(Platform): DOM clobbering of the native bridge globals -> an element with an id or name attribute (and a named iframe) is also reachable as a window property, so markup rendered before Quasar boots (SSR/SSG output of user-provided HTML) could pass for a native wrapper. A <div id="Capacitor"> set Platform.is.capacitor and the app then failed to boot; elements named after cordova, InAppBrowser or StatusBar made openURL() and AddressbarColor.set() throw; a cross-origin iframe named after a bridge threw a SecurityError. Capacitor, Cordova, StatusBar and SafariViewController are now picked up only when the global is not an element, a collection of elements or a window, and each bridge method is checked to be a function before it gets called. A bridge global set to null is no longer detected as a native wrapper. This completes the SafariViewController hardening of v2.32.2

New

feat(format): getDecimalsCount() -> new util on the format object, telling how many decimals a number (or a numeric string) needs when written in fixed notation, which is what toFixed() asks for when rounding a float back to the precision of its operands. Unlike splitting String(value) on the dot, it also handles the numbers JS prints in exponent notation (getDecimalsCount(1e-7) is 7); a string keeps its trailing zeros ('1.50' counts two decimals)

Fixes

fix(QSlider/QRange): fractional min -> the values stay aligned to a min (or inner-min) that has decimals. With min 0.5 and step 1 the valid values are 0.5, 1.5, 2.5 and so on, yet the pointer and the keyboard alike were rounding 1.5 to 2 (#18578)
fix(QSlider/QRange/QKnob): step written in exponent notation -> a step below 1e-6 (which JS prints as 1e-7) counted as having no decimals, so every new value was rounded to a whole number: a slider from 0 to 1e-6 with a step of 1e-7 could never leave 0
fix(QKnob): step grid starts at inner-min -> the pointer and the keyboard now land on the same values, as QSlider and QRange do. Before, the pointer snapped to multiples of the step counted from zero while the keyboard added the step to the current value (min 5 with step 10 gave 10, 20... with the pointer and 15, 25... with the keyboard), and with min 0.5 and step 1 the right arrow jumped from 0.5 to 2. Behavior change: when min is not a multiple of the step, a pointer adjustment now lands on min + n * step instead of n * step. Knobs with the default min of 0 are not affected
fix(QTooltip): repeated hover/focus events -> pointer and keyboard events overlapping on the target while the tooltip was opening or closing no longer cancel the end of its transition. The tooltip could stay visible without ever emitting show, or never finish hiding, and a focus() requested meanwhile stayed queued until the pointer left the target (#18582, #18583)
fix(QTooltip): focus requests while a tooltip opens -> a focus() going through QInput, QField, QForm, QEditor or a dialog/menu autofocus is no longer held back until the tooltip transition ends. A button with a tooltip that focuses an input on click now does so right away, inside the click
fix(QTree): children removed and restored on an expanded node -> a node whose children got emptied and then restored within the slide duration no longer ends up with them hidden while still expanded. Removing and restoring children neither slides nor emits after-show/after-hide anymore, as before v2.32. Regression from v2.32.0 (#18584)
fix(lang): Turkish (tr) -> corrected mistranslated labels: the table filter and pagination, the tree expand/collapse, the color picker alpha, the uploader "remove queued" and several QEditor ones (italic, lists, subscript, superscript, justify, formatting, fullscreen) (#18581)

Other

perf(ui): fewer inner functions recreated -> QDate, QTime, QForm, QSlider/QRange and the Loading and LoadingBar plugins no longer rebuild some of their helper functions each time they run

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following: