nicegui 3.19.0

v3.19.0

on Python PyPI

Security

• ⚠️ Strip Windows drive prefixes like C: from the names of files uploaded via ui.upload, which could escape the upload directory (GHSA-75w7-4mx9-8qqc by @iaohkut, @evnchn, @falkoschindler)

• ⚠️ Stop evaluating :-prefixed keys inside the data of ui.aggrid and ui.echart as JavaScript, e.g. DataFrame column names (GHSA-m47w-xwfc-82pf by @iaohkut, @unbengable12, @SaaSforUS, @evnchn, @falkoschindler)

• ⚠️ Sanitize the HTML value of ui.editor in the browser by default, preventing stored XSS when the value is shared across clients (GHSA-9g7v-h3pr-4qm8 by @evnchn, @falkoschindler)

  Breaking change: ui.editor no longer displays markup that DOMPurify removes, like <iframe> embeds, and drops it from the value once the user edits the content; pass sanitize=False for trusted content.

New features and enhancements

• Introduce ui.uplot for fast canvas charts of large or high-frequency datasets (#2669, #3340, #5917 by @CSharpDummy, @tungchentsai, @NvNielen, @Noghpu, @evnchn, @falkoschindler)
• Add Plane, Cone, Torus, Capsule, Lathe and Polyline objects, a polar_grid parameter and rotate(order=...) to ui.scene (#5989 by @Jepson2k, @evnchn, @falkoschindler)
• Add nicegui.json.register_type() to serialize custom types (#6406 by @KotzaBoss, @falkoschindler)
• Speed up element construction by skipping signature checks for the internal update handlers of classes, style and props (#6098, #6388, #6403 by @maybites, @DiebBlue, @falkoschindler)

Bugfixes

• Fix ui.sub_pages with root_path not leaving the page on links outside its root (#6385, #6400 by @techmatik, @inchang-ing, @evnchn, @falkoschindler)

• Fix ui.sub_pages not converting parameters annotated as int | None or in modules with from __future__ import annotations (#6452, #6454 by @Dengzi555, @evnchn, @falkoschindler)

• Fix Client.page_routes, ui.link and ui.navigate.to ignoring the prefixes of included routers (#6418, #6423 by @falkoschindler, @shi-felix, @evnchn)

  Breaking change: For pages on included routers, app.clients(path) now expects the full path including the include prefix, e.g. app.clients('/v2/p/x') instead of app.clients('/p/x').

• Fix ui.scene and ui.leaflet never initializing when created hidden (#6414, #6424 by @falkoschindler, @shi-felix, @evnchn)

• Fix ui.leaflet going blank after its classes change, e.g. when hiding and showing the map (#6428, #6433 by @evnchn, @falkoschindler)

• Raise a RuntimeError from initialized() of ui.scene when WebGL is unavailable instead of waiting forever (#6405 by @evnchn, @falkoschindler)

• Fix slow style recalculation on pages with many sibling elements, a regression in 3.10 (#6411, #6426 by @phreakocious, @Ayush-kukrety, @evnchn, @falkoschindler)

• Fix template slots being remounted on every render, which swallowed the first click on removable chips of a ui.select (#6284, #6287 by @samuller, @SaadZahem, @evnchn, @falkoschindler)

• Fix ui.highchart failing when the first chart is created in an event handler (#6290, #6391 by @evnchn, @SaadZahem, @falkoschindler)

• Fix an outdated async validation result overwriting the error state of the current input (#6453, #6455 by @Wang-MuFF, @falkoschindler)

• Fix deep-copied observable collections notifying their original parent (#6448, #6449 by @Yzzz88, @falkoschindler)

• Fix ElementFilter.exclude() ignoring markers with multiple names (#6456 by @Dengzi555, @falkoschindler)

• Fix the typing of bindable_dataclass when called with arguments like bindable_fields (#6251, #6252 by @FranzForstmayr, @evnchn, @falkoschindler)

• Fix ui.timer cancelling @await_on_shutdown callbacks on shutdown (#6331, #6372 by @evnchn, @Kshot3000, @falkoschindler)

• Fix shutdown waiting for a ui.timer whose callback swallows the cancellation (#6436, #6442 by @phreakocious, @evnchn, @falkoschindler)

• Fix the native window closing during hot reload on Windows (#6381, #6407 by @abi55, @evnchn, @falkoschindler)

• Fix the process never exiting after closing the native window in a console-less build (#6392, #6396 by @SHDocter, @Boulea7, @evnchn, @falkoschindler)

• Fix ui.mermaid delivering wrong node IDs to on_node_click (#6220 by @evnchn, @falkoschindler)

• Fix ui.code breaking on content with its own code fences (#6404 by @zurrll, @falkoschindler)

• Fix the focus outline of ui.codemirror (#6429 by @falkoschindler, @evnchn)

• Fix deleted ui.upload elements being kept alive by their upload routes (#6384 by @Melvin0hd, @falkoschindler)

• Fix the ES module fallback message blaming the browser when scripts are blocked (#6436, #6439 by @phreakocious, @falkoschindler)

Documentation

• Document that path and remaining_path of PageArguments add up to the full path (#6422, #6430 by @falkoschindler, @evnchn, @shi-felix)
• Document how to run the testing fixtures without a main file (#6436, #6438 by @phreakocious, @falkoschindler)
• Fix the on_point_click parameter name in the ui.echart.from_pyecharts docstring (#6431 by @mmporong, @falkoschindler)
• Harden the "Image Mask Overlay" and "Local File Picker" examples (#6389 by @falkoschindler, @evnchn)

Testing

• Fix the User simulation routing ui.navigate, ui.notify and ui.download to the last User touched (#6413, #6415 by @falkoschindler, @evnchn)
• Fix the User simulation not triggering kebab-case events (#6436, #6437 by @phreakocious, @falkoschindler)
• Fix the user fixture keeping earlier runs of the main file and the elements of earlier tests alive (#6425, #6427 by @rodja, @JamesSmaldon, @evnchn, @falkoschindler)

Special thanks to our top sponsors DiscoLike Inc., TestMu AI and Lechler GmbH ✨

and all our other sponsors and contributors for supporting this project!

🙏 Want to support this project? Check out our GitHub Sponsors page to help us keep building amazing features!