3.3.16 is a security release. It fixes a race in the collaboration socket that could expose and write to pads the user was not allowed to open, and picks up the ueberDB MSSQL fix. Upgrade as soon as you can.

• Collaboration — every socket message now stays bound to the pad it was authorized for (GHSA-c36r-65p6-q3m9, #8458). The earlier fix for GHSA-6mcx-x5h6-rpw2 only pinned the target pad for USER_CHANGES. Chat, history (CHANGESET_REQ), saved revisions, pad options and pad deletion still read the pad from the socket's session when they ran. A second CLIENT_READY on the same socket rewrote that session before its own access check. A message authorized for one pad could then run against another, which leaked the other pad's text, history and chat and let chat messages and saved revisions be written into it, including on pads the user could only view. CLIENT_READY now changes the session only after access is granted, and each message carries the pad and access mode it was authorized with. Reported by @leograntquinn-crypto.
• Database — ueberdb2 6.1.19 (#8444). Fixes SQL injection in the MSSQL driver's bulk writes (GHSA-xmqq-59rx-x7pf). Only installs using "dbType": "mssql" are affected.

• The default-content author test no longer depends on the local defaultPadText setting (#8445).
• The Docker workflow now records the release version (#8456).
• Dependency updates, including undici 8.12.4, mssql 12.7.14, entities 9.0.0, surrealdb 2.2.2 and resolve 1.22.14.

3.3.16 is a security release. It fixes a race in the collaboration socket that could expose and write to pads the user was not allowed to open, and picks up the ueberDB MSSQL fix. Upgrade as soon as you can.

• Collaboration — every socket message now stays bound to the pad it was authorized for (GHSA-c36r-65p6-q3m9, #8458). The earlier fix for GHSA-6mcx-x5h6-rpw2 only pinned the target pad for USER_CHANGES. Chat, history (CHANGESET_REQ), saved revisions, pad options and pad deletion still read the pad from the socket's session when they ran. A second CLIENT_READY on the same socket rewrote that session before its own access check. A message authorized for one pad could then run against another, which leaked the other pad's text, history and chat and let chat messages and saved revisions be written into it, including on pads the user could only view. CLIENT_READY now changes the session only after access is granted, and each message carries the pad and access mode it was authorized with. Reported by @leograntquinn-crypto.
• Database — ueberdb2 6.1.19 (#8444). Fixes SQL injection in the MSSQL driver's bulk writes (GHSA-xmqq-59rx-x7pf). Only installs using "dbType": "mssql" are affected.

• The default-content author test no longer depends on the local defaultPadText setting (#8445).
• The Docker workflow now records the release version (#8456).
• Dependency updates, including undici 8.12.4, mssql 12.7.14, entities 9.0.0, surrealdb 2.2.2 and resolve 1.22.14.

Univer 1.4.0 adds Office attachment workflows, shape merging in Slides, richer pivot filtering, and GETPIVOTDATA. This release also separates product-specific comment integrations and introduces several package and API migrations.

Preserve embedded OLE files when working with Office documents, with actions to preview, download, rename, and delete attachments. Supported Office files can also be converted into independent online documents when the application provides the required collaboration, attachment, and exchange services.

Office export keeps the original embedded file by default. Applications can request the current confirmed version of a converted online document instead:

import { ExchangeFormat } from '@univerjs-pro/exchange-client';

const file = await univerAPI.exportSheetByUnitIdAsync(
    unitId,
    ExchangeFormat.XLSX,
    undefined,
    { oleAttachmentSource: 'online' }
);

The server must support this export option. Cross-type Office previews require the corresponding existing product UI module; conversion and preview use the existing drawing and exchange plugins.

Combine supported selections with Union, Combine, Fragment, Intersect, and Subtract. The operations create new shape geometry and support undo/redo and collaboration. The first selected object determines the primary formatting and the subtraction direction.

Pivot tables and pivot charts can combine different filter categories on the same field after enabling Allow multiple filters per field. The option is off by default.

Fixed date filters also support whole-day comparison, so timestamps from the same day can match without requiring identical time values.

await pivotTable.setOptions({ allowMultipleFilters: true });

await pivotTable.setDateFilter(fieldId, {
    operator: univerAPI.Enum.ST_PivotFilterOperatorEnum.dateEqual,
    expected: dateSerial,
    useWholeDay: true,
});

Disabling multiple filters while combined filters are active clears the report's filters and the corresponding shared slicer/timeline selections. The UI asks for confirmation.

Use GETPIVOTDATA to retrieve aggregated values from a visible PivotTable report:

=GETPIVOTDATA("Sales",$A$3,"Region","East")

The initial implementation reads the visible report from a single-cell anchor, searching up to 200 rows below and 50 columns to its right.

Docs now respects paragraph settings that allow Latin words to break across lines. A new control in paragraph settings makes this behavior editable and supports inherited and mixed paragraph states.

Image and chart comment Facade integrations have moved out of the generic shape-thread-comment Facade into four new packages:

These packages provide the existing createCommentAsync, getComments, and listCommentsAsync methods for their respective objects. Generic FShape comments remain in @univerjs-pro/shape-thread-comment.

• Formulas: Improve array-spill invalidation, shared-formula dependencies, and recalculation after worksheet-reference changes. Writing cell values through setValue/setValues now persists removal of the replaced formula.
• Sheets: Preserve imported XLSX table differential formats and inherited font sizes while editing; improve merged-cell rendering, autofill after scrolling, and sheet renaming.
• UI and mobile: Compact the two-row Ribbon before moving groups into More, improve keyboard navigation, and enforce permissions consistently in mobile controls and dialogs.
• Collaboration: Reconnect after Chrome page freeze/resume, include filter/table models during snapshot formula replay, and authorize comment-only changesets with the Unit Comment permission.
• Rendering and performance: Defer SmartArt reference-data initialization, correct spacing for charts with empty titles, preserve LaTeX formula backgrounds, and improve dark-mode editing panels.

Keep all @univerjs/* and @univerjs-pro/* dependencies used by your application on the same version.

Applications using image or chart comment methods must add the corresponding package and its Facade import. For example, in an existing Sheets application:

import { UniverSheetsDrawingThreadCommentPlugin } from '@univerjs-pro/sheets-drawing-thread-comment';
import '@univerjs-pro/sheets-drawing-thread-comment/facade';

univer.registerPlugin(UniverSheetsDrawingThreadCommentPlugin);

Apply the same pattern to the other integrations in the table above. Retain the generic shape-comment integration when using FShape comments.

The @univerjs-pro/ink/facade entry has been removed. Board ink methods now belong to FBoard:

-import '@univerjs-pro/ink/facade';
+import '@univerjs-pro/boards/facade';

Import Board ink enums and IBoardInkFacadeInsertOptions from @univerjs-pro/boards/facade as well.

Use dedicated /worker entry points for worker-side plugins. For example:

-import { UniverRPCWorkerThreadPlugin } from '@univerjs/rpc';
-import { UniverSheetsPivotChartWorkerPlugin } from '@univerjs-pro/sheets-pivot-chart';
+import { UniverRPCWorkerThreadPlugin } from '@univerjs/rpc/worker';
+import { UniverSheetsPivotChartWorkerPlugin } from '@univerjs-pro/sheets-pivot-chart/worker';

The retained root exports for worker-only APIs are deprecated in 1.4.0, with removal planned for 1.5.0 as described below. Docs workers can now register UniverDocsWorkerPlugin from @univerjs/docs/worker instead of calling startDocsLayoutWorker directly. Worker presets have been updated to use the dedicated entries.

Redundant version/schemaVersion fields have been removed from affected resource payloads, including document formulas, external references, Slides tables, and Slides fonts. Update custom serializers, validators, and imports of the removed schema-version constants.

For example, a document-formula resource is now:

-const resource = { schemaVersion: 1, formulas: {} };
+const resource = { formulas: {} };

• Applying worksheet/range protection or setting worksheet permission points clears the affected workbook's undo/redo history. Review workflows that apply protection after editing.
• Deployments using the new OLE, shape-merge, or pivot-filter workflows need corresponding server-side support. Use an OLE-capable drawing model and compatible native exchange runtime at the import/export boundary.
• The new table differential-format import requires matching Sheets, Sheets Numfmt, and native exchange components. Historical snapshots are not rewritten automatically; re-import the original XLSX when possible to adopt the new format handling.
• Update self-hosted collaboration runtimes to receive the snapshot-replay and comment-permission fixes.

Removal of the deprecated Worker root exports is planned for 1.5.0, tracked in #8079 and its companion update. These exports are still available in 1.4.0, so custom Worker entry scripts can migrate before the next release.

Import the following APIs from their package's /worker entry instead of its root:

The two manual startup helpers also need migration:

• Replace startDocsLayoutWorker from @univerjs/docs with UniverDocsWorkerPlugin from @univerjs/docs/worker.
• Replace startPdfPageThumbnailWorker from @univerjs-pro/pdfs-ui with UniverPdfsUIWorkerPlugin from @univerjs-pro/pdfs-ui/worker.

For a Docs Worker entry:

import { Univer } from '@univerjs/core';
import { UniverDocsWorkerPlugin } from '@univerjs/docs/worker';

const univer = new Univer();
univer.registerPlugin(UniverDocsWorkerPlugin);

For a PDF thumbnail Worker entry:

import { UniverPdfsUIWorkerPlugin } from '@univerjs-pro/pdfs-ui/worker';
import { Univer } from '@univerjs/core';

const univer = new Univer();
univer.registerPlugin(UniverPdfsUIWorkerPlugin);

Apply these changes inside the Worker entry files. The built-in Worker presets in 1.4.0 already use the dedicated entry points.

Full changelog: v1.3.1…v1.4.0

• b433c95720ced6f987d2379913933d49517cb48f #4770 Thanks @kubk! - Faster transforms: files that cannot contain components, hooks or flows are skipped without being parsed, and the Vite plugin only generates code when something changed. Code generation options for the Vite plugin now go in babel.generatorOpts.

• fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in https://github.com/honojs/hono/pull/5608
• fix(utils/url): do not match a query key across separators in https://github.com/honojs/hono/pull/5607
• fix(etag,pretty-json): cancel the discarded response body in https://github.com/honojs/hono/pull/5606
• fix(client): detect the JSON media type with whitespace before a parameter in https://github.com/honojs/hono/pull/5609
• fix(timing): honor a precision of 0 in setMetric in https://github.com/honojs/hono/pull/5363
• fix(utils/mime,ssg): match media types case-insensitively in https://github.com/honojs/hono/pull/5449
• fix(timing): escape double quotes and backslashes in Server-Timing descriptions in https://github.com/honojs/hono/pull/5478
• fix(etag): preserve commas within quoted entity tags in https://github.com/honojs/hono/pull/5353
• fix(accepts): preserve exact media type quality over subtype wildcards in https://github.com/honojs/hono/pull/5427
• fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in CookieConstraint in https://github.com/honojs/hono/pull/5611
• fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary in https://github.com/honojs/hono/pull/5430
• fix(ssg): do not reuse created directories across toSSG runs in https://github.com/honojs/hono/pull/5381
• fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events in https://github.com/honojs/hono/pull/5483
• fix(jsx): escape element and object attribute values in https://github.com/honojs/hono/pull/5512
• fix(jsx): do not render ref objects as attributes in https://github.com/honojs/hono/pull/5615
• fix(factory): keep independent return types for nine handlers in https://github.com/honojs/hono/pull/5618

Full Changelog: https://github.com/honojs/hono/compare/v4.13.16...v4.13.17

• fix(app-render): stop prerendered Link headers from accumulating on revalidation: #100960
• Align eslint-config-next TypeScript peer with typescript-eslint: #101247
• Reduce header allocations in NodeNextResponse: #101225
• [image-optimizer] Move next/image-optimizer-transform under the next/experimental namespace: #101252
• [image-optimizer] Don't use NextConfigComplete for the imageOptimizerTransform public API: #101184
• Improve Request Insights context menus and trace interactions: #97796
• Build and analyze in one pass: #99962

• docs: clarify SVG handling in the Image Optimization API: #101301
• Turbopack: use hash collections for turbo-tasks values whose order is unobserved: #100939
• Turbopack: don't split page entries into a facade: #101152
• Turbopack: replace Next.js entry kinds with an opaque entry tag: #101291
• docs: map BFF proxy example routes to fixed backend endpoints: #101286
• docs: explain ESLint setup with TypeScript 7: #101246
• Durable use cache conditional reads: #101283
• docs: read the URL in history API event handlers instead of calling hooks: #101224
• review: escalate Next.js concepts in Turbopack code: #101278
• test: enable HMR dependency acceptance coverage for webpack: #101196
• test: Replace itTurbopack with test gates: #101195

Huge thanks to @styfle, @lukesandberg, @linyiru, @icyJoseph, @kassens, @mischnic, @eps1lon, @bgw, @DavidIlie, and @wbinnssmith for helping!

Release 2026-11-06 23:04

• vue-query: return a reactive state from useQuery so status=== 'success' narrows data without unwrapping refs (#12541) (f4199ab51) by @DamianOsipiuk

• vue-query: keep query-core's enabled(query) callback (#12542) (025773a83) by @DamianOsipiuk

• @tanstack/angular-query-experimental@5.107.1
• @tanstack/eslint-plugin-query@5.107.1
• @tanstack/lit-query@0.2.38
• @tanstack/preact-query@5.107.1
• @tanstack/preact-query-devtools@5.107.1
• @tanstack/preact-query-persist-client@5.107.1
• @tanstack/query-async-storage-persister@5.107.1
• @tanstack/query-broadcast-client-experimental@5.107.1
• @tanstack/query-core@5.107.1
• @tanstack/query-devtools@5.107.1
• @tanstack/query-persist-client-core@5.107.1
• @tanstack/query-sync-storage-persister@5.107.1
• @tanstack/react-query@5.107.1
• @tanstack/react-query-devtools@5.107.1
• @tanstack/react-query-next-experimental@5.107.1
• @tanstack/react-query-persist-client@5.107.1
• @tanstack/solid-query@5.107.1
• @tanstack/solid-query-devtools@5.107.1
• @tanstack/solid-query-persist-client@5.107.1
• @tanstack/svelte-query@6.4.1
• @tanstack/svelte-query-devtools@6.4.1
• @tanstack/svelte-query-persist-client@6.4.1
• @tanstack/vue-query@5.107.1
• @tanstack/vue-query-devtools@6.4.1

Release 2026-11-06 23:04

• vue-query: return a reactive state from useQuery so status=== 'success' narrows data without unwrapping refs (#12541) (f4199ab51) by @DamianOsipiuk

• vue-query: keep query-core's enabled(query) callback (#12542) (025773a83) by @DamianOsipiuk

• @tanstack/angular-query-experimental@5.107.1
• @tanstack/eslint-plugin-query@5.107.1
• @tanstack/lit-query@0.2.38
• @tanstack/preact-query@5.107.1
• @tanstack/preact-query-devtools@5.107.1
• @tanstack/preact-query-persist-client@5.107.1
• @tanstack/query-async-storage-persister@5.107.1
• @tanstack/query-broadcast-client-experimental@5.107.1
• @tanstack/query-core@5.107.1
• @tanstack/query-devtools@5.107.1
• @tanstack/query-persist-client-core@5.107.1
• @tanstack/query-sync-storage-persister@5.107.1
• @tanstack/react-query@5.107.1
• @tanstack/react-query-devtools@5.107.1
• @tanstack/react-query-next-experimental@5.107.1
• @tanstack/react-query-persist-client@5.107.1
• @tanstack/solid-query@5.107.1
• @tanstack/solid-query-devtools@5.107.1
• @tanstack/solid-query-persist-client@5.107.1
• @tanstack/svelte-query@6.4.1
• @tanstack/svelte-query-devtools@6.4.1
• @tanstack/svelte-query-persist-client@6.4.1
• @tanstack/vue-query@5.107.1
• @tanstack/vue-query-devtools@6.4.1

• Updated dependencies []:
  • @tanstack/query-persist-client-core@5.107.1
  • @tanstack/svelte-query@6.4.1

• Updated dependencies []:
  • @tanstack/query-devtools@5.107.1
  • @tanstack/svelte-query@6.4.1