1 hours ago
next.js

v16.3.1-canary.24

Misc Changes

  • style(examples): remove redundant justify-content declaration: #97222
  • docs: rename Vercel Edge Config to Global Config in redirecting guide: #97456
  • fix: improve form accessibility by associating labels with inputs: #96335
  • [docs] fix: grammar typos in linking and navigating guide: #95544
  • fix(examples): correct error message typo: #97223
  • docs: fix typos in example links: #97149
  • Model prerenders as render candidates: #97431
  • Turbopack: support character class ranges in regex: #97502
  • docs: warn when catching permanentRedirect: #97496
  • Remove the development debug channel persistence: #97510
  • Stop the browser from restoring stale pages in development: #97505
  • Turbopack: gracefully handle outputFileTracingIncludes matching a symlink: #97507
  • docs: mention Valibot as validation library option in forms guides: #97468

Credits

Huge thanks to @niketchandivade, @molebox, @seanbeirnes, @0ldh, @gnoff, @mischnic, @DavidIlie, @unstubbable, and @fabian-hiller for helping!

4 hours ago
officeParser

v7.8.0

v7.8.0: 📺 Standard Markdown for Embeds, Safe Iframe Capture, and a Cleaner HTML Round Trip

I am pleased to announce the release of officeParser v7.8.0! Embeds were the one construct in the Markdown dialect with no borrowed convention and the worst degrade: a YouTube video could only be written as an invented <div data-youtube-video> block that renders as an invisible empty box on GitHub, and a raw <iframe> was escaped into a wall of literal text. This release gives embeds a real, selectable Markdown form, adds a safe path for capturing untrusted iframes, and fixes an HTML round-trip whitespace bug.

Everything here follows the same rule as recent releases: no regression on any consumer. Every change is additive, a genuine bug fix, or non-standard becoming standard; where a default would move, the old behavior stays and is deprecated. The default embed output is byte-identical to 7.7.0.


✨ What's New

1. A Markdown form for embeds, selected by mdConfig.dialect.embeds

Choose how an embed node is written:

  • 'html' (default): the <div data-youtube-video> / <iframe> single-line block this library has always emitted and re-reads.
  • 'directive': a remark-directive leaf, ::youtube[Label]{id=… width=… align=…} / ::embed[Label]{src=… …}, both parsed and generated. An editor round-trip form (GitHub renders it verbatim rather than as a player, so it is not a GitHub-interop format).
  • 'link': a plain [YouTube](url) / [Embed](url).
  • 'thumbnail': a YouTube-only clickable preview [![Label](…/vi/ID/…)](watch), the best GitHub degrade.

::youtube parses unconditionally (rendered from a validated id via a fixed template). ::embed carries an arbitrary src, so it is gated behind preserveIframes (the trust input) and stays literal text otherwise. Unknown ::names stay literal, with no catch-all.

2. Safe capture of untrusted iframes: htmlConfig.gatedEmbeds

Off by default. When on, a generic (non-YouTube) iframe embed is emitted as an inert <div data-embed-gated data-embed-src> placeholder that never auto-loads its src. An editor renders a click-to-load control from it, and HtmlParser reads it back to the same embed node. The src is scheme-checked on emit. The default output (a live <iframe>) is unchanged. Combined with the existing preserveIframes gate, untrusted input is never escaped-as-text and never auto-rendered.

3. Opt-in import of ambiguous "folk" forms: htmlParserConfig.embedFolkForms

Off by default. When on, a standalone Obsidian image whose URL is a YouTube link (![](…watch?v=ID)) and a clickable thumbnail-link ([![](…/vi/ID/…)](watch)) import as safe YouTube embeds. Off by default because auto-upgrading an image or link is a heuristic that could mangle a genuinely-intended image link. The unambiguous forms are always recognized regardless of this flag.

4. EmbedMetadata.label

The human label of a ::youtube[Label] / ::embed[Label] directive (and a gated embed's caption). It round-trips through the directive form, the generic gated data-embed-label, and the YouTube editor-HTML shape.


⚠️ Deprecated

fallbackToHtml.embeds (boolean). Use mdConfig.dialect.embeds instead, which also selects the 'directive' and 'thumbnail' forms. While dialect.embeds is unset the boolean is still honored (true maps to 'html', false to 'link'). It will be removed in the next major.


🔧 What's Fixed

1. Markdown and HTML now parse a YouTube iframe the same way

The Markdown parser read a YouTube <iframe> as a generic 'iframe' embed with no videoId, and only under preserveIframes, while the HTML parser read it as 'youtube' unconditionally. Both parsers now detect a YouTube src the same way, before the preserveIframes gate, so the same input yields the same 'youtube' embed. The youtube-via-iframe HTML path now also carries the iframe's width/height.

2. An inline link was fenced by blank lines on md → HTML

HtmlGenerator appended a readability blank line after every node, including inline text and link runs, so See this [video](url). emitted a paragraph with \n\n around the <a>, which reparsed as a stray space before the punctuation. The blank line is now added only after block-level nodes; inline runs concatenate directly. This is a whitespace-only change to generated HTML (semantically identical), and it makes the md → HTML → md round trip correct.


🛠 Getting Started

npm install officeparser@7.8.0

🔗 Full Changelog: View v7.8.0 details 🔗 Documentation & Visualizer: officeparser.harshankur.com

6 hours ago
varlet

v3.20.4

更新内容请查看CHANGELOG。 Please refer to CHANGELOG for details.

8 hours ago
quasar

quasar-v2.25.1

[!IMPORTANT] A few behavior changes worth checking before you upgrade:

  • lazy-rules now clears an error while you type: while an error is displayed, the field re-checks on each model change instead of waiting for the next blur. Rules that were only ever meant to run on blur will now also run on every keystroke for as long as the field is in error.
  • Async rules re-validate when the value changes or the field blurs mid-flight: a slow rule that settles after the user moved on no longer paints its verdict onto the newer value; a second validation run is triggered instead.
  • The field's hint/error/counter area sits in normal flow: a message taller than one line now grows the field instead of painting over the content below it. Geometry is unchanged for every one-line message, except item-aligned fields, which now reserve that one line (about 20px taller) instead of bleeding messages into the next item. Custom CSS leaning on .q-field--with-bottom's padding-bottom or on the absolutely positioned .q-field__bottom--animated needs a second look.
  • QLayout can emit one extra @scroll: a scroll update suppressed while the body scroll lock was held is now applied when the lock releases without restoring the position.

Fixes

  • fix(QField/QInput/QSelect/QFile): lazy-rules re-validates on model change while an error is displayed -> the error clears as soon as what you type becomes valid, instead of staying up until the next blur (#17456)
  • fix(QField/QInput/QSelect/QFile): re-validate when the model changes or the field blurs during a pending async validation -> a slow rule can no longer settle onto a value the user has already replaced, leaving the field showing a verdict for text that is no longer there
  • fix(QForm): report a child whose validate() throws synchronously -> that child now fails and gets focused, exactly as a rejected async rule already did, instead of the exception breaking the whole submit()
  • fix(QField): flow the hint/error/counter area in-layout -> a message longer than one line grows the field instead of painting over whatever follows it, and item-aligned fields no longer bleed their messages into the next item (#17807)
  • fix(QLayout): re-sync the scroll state when a scroll lock releases on a changed route -> navigating away from inside a Dialog or under the Loading plugin left the layout holding the pre-navigation scroll state, so a reveal QHeader never reappeared at the top of the new page (#12994)
  • fix(QMenu/QTooltip): re-anchor when the iOS visual viewport moves -> with the soft keyboard open or while pinch-zoomed, iOS scrolls only the visual viewport and no window scroll event fires, so an open popup ended up detached from its anchor by the scrolled amount (#16849)
  • fix(QSelect): keep the field width stable while loading with hide-dropdown-icon -> with no icon to swap for, the default spinner appended net-new width and the field jumped on every filter round-trip. The default spinner is now suppressed when the dropdown icon is hidden (an explicit loading slot still renders), and the clearable icon keeps its place while loading instead of vanishing (#17375)
  • fix(QTabs): show the overflow arrows when align="right" -> Blink and Gecko keep start-side overflow out of the scrollable overflow region, which collapsed the measurement and hid both arrows, leaving the overflowing tabs unreachable by pointer (#17847)
  • fix(QInfiniteScroll): stop polling while a Dialog or an overlay Drawer scroll-locks the page -> opening one over an infinite scroll fired @load in a loop until the whole list had been fetched (#13257)
  • fix(QInput): don't lose a typed char that equals a mask literal -> mask 11## swallowed a typed "1" and 04## ### ### a typed "0", because the char could not be told apart from the literal sitting at that position (#15624, #18051)
  • fix(QInput): soft-keyboard backspace over a mask literal deletes the data char before it -> on iOS the browser removed only the literal, the remask put it straight back, and the edit became a silent no-op that left the caret misplaced, so every digit typed next landed one slot early and scrambled the value (#17639)
  • fix(QInput): re-anchor the caret after a dynamic mask change -> with a mask computed from the value being typed, the caret could land inside the value after the layout shifted, so the next digits scrambled it and the last char read as never registering (#7777)
  • fix(QInput): drop a stale debounced emission when the mask restores the model's value -> cutting a whole masked value and pasting it back before the debounce fired emptied the model while the input showed the pasted text (#17568)
  • fix(ui): resolve a custom Dialog's show/hide through arbitrarily nested components -> a QDialog sitting behind two or more single-root wrapper components failed with "Incorrectly defined Dialog component" and never opened (#18159)

Other

  • Regression coverage for the two families reworked here: the validation composable (async races, the QForm submit flow, reset/unmount/disable, reactive rules) and the mask engine (chars equal to a literal, dynamic masks, backspace bursts, the multiple-masks pattern), plus cross-engine sweep scenarios that also run on the iOS Simulator, where the mask and QTabs bugs above behave differently than on any desktop engine

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

8 hours ago
quasar

@quasar/app-vite-v3.7.0

Changes

  • fix(app-vite): boot files & preFetch -> behavior change: urlPath is now the router-facing URL in every mode. It is path + query (+ hash) as Vue Router sees it, without the publicPath prefix and without hash mode's # wrapper, so you can match it against your routes or feed it straight to router.resolve(). Previously its shape depended on where it was read (raw req.url on the server, window.location on the client), which made every string check mode-dependent: the documented auth-guard example (urlPath.startsWith('/login')) infinite-reload-looped in hash mode and under a non-default publicPath. On top of that, the client-side preFetch hook read window.location during beforeResolve, before vue-router commits the navigation, so every hook saw the PREVIOUS page's URL and a redirect() guarded by urlPath looped until vue-router aborted the navigation. If you need the raw browser URL, use window.location (client-side) or ssrContext.req.url (server-side). The publicPath param is also now passed to the two addPreFetchHooks() call sites that were missing it (SPA-family modes, and SSR/SSG client-side rendered pages), where hooks received undefined (#16423)
  • fix(app-vite): capacitor -> dependencies installed in /src-capacitor are now resolvable from /src code in every mode, not only when running in Capacitor mode. Capacitor plugins ship web implementations, so shared code may import them behind an import.meta.env.QUASAR_CAPACITOR_MODE guard (the guarded branch is dead-code eliminated in production builds) -- that import previously failed to resolve in SPA/PWA/SSR builds. The generated TypeScript compilerOptions.paths mirror this whenever Capacitor mode is installed (#17681)
  • fix(app-vite): ssr/ssg -> Map, Set, Date, RegExp, BigInt and undefined values now survive in the serialized store state. The state was serialized as plain JSON, so Map/Set collapsed to empty objects, Date degraded to a string and undefined values were dropped from window.__INITIAL_STATE__; it is now emitted as a live JS expression, making SSR/SSG state behave identically to SPA mode. HTML-unsafe character escaping is unchanged, and no client runtime or hydration change is needed. Measured cost is roughly 3x the serialization time, which in absolute terms is 34us vs 102us for a 12KB state (about 1ms at 120KB); apps needing full control keep ssr.manualStoreSerialization / manualStoreHydration (#11382)

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

8 hours ago
electron

electron v42.9.3

Release Notes for v42.9.3

Fixes

  • Fixed a graphical glitch on Linux where thin borders appeared past the drop shadows on frameless windows when multiple windows were created. #52772 (Also in 43, 44)
  • Fixed a memory leak when creating BrowserWindows. #52893 (Also in 43, 44)
  • Fixed an issue on Windows where the app process could fail to exit after app.quit() while a shell.openExternal() or shell.openPath() call was still waiting on a system "Open with" dialog. #52900 (Also in 41, 43, 44)
  • Fixed custom V8 snapshots (electron-mksnapshot, and the loadBrowserProcessSpecificV8Snapshot fuse) having no effect in the main process on macOS arm64, Linux x64 and Windows x64. #52876 (Also in 43, 44)

Other Changes

  • Backported fix for 524628213. #52869
  • Reduced idle main-process CPU wakeups caused by Node.js timers and immediates. #52907 (Also in 43, 44)
8 hours ago
electron

electron v41.10.6

Release Notes for v41.10.6

Fixes

  • Fixed registerFileProtocol and registerHttpProtocol returning readable responses to cross-origin no-cors fetches; they now return opaque responses like protocol.handle. #52854 (Also in 42, 43, 44)
  • Fixed an issue on Windows where the app process could fail to exit after app.quit() while a shell.openExternal() or shell.openPath() call was still waiting on a system "Open with" dialog. #52899 (Also in 43, 44)
  • Fixed windows opened by a sandboxed top-level frame not inheriting the opener's sandbox restrictions. #52849 (Also in 42, 43, 44)
  • <webview> and window.open now inherit nodeIntegrationInWorker from the embedder, consistent with the other Node and sandbox preferences. #52829 (Also in 42, 43, 44)

Other Changes

  • Backported fixes from upstream ANGLE, Chromium and Skia. #52707
  • Backported fixes from upstream Chromium and V8. #52775
9 hours ago
router

Release 2026-08-18 15:18

Release 2026-08-18 15:18

Changes

Fix

  • router-core: remove navigation rollback (#8092) (63d2cc9155) by @Sheraff
  • router-core: preserve pending UI across retained routes (#8084) (5d3785dcc3) by @Sheraff

Performance

  • react-router: direct export of CatchBoundary class component, remove function wrapper (#8068) (f75cada017) by @Sheraff

Chore

  • localize package dependencies (#8078) (f97188fdb4) by @Sheraff

Packages

  • @tanstack/react-router@1.170.30
  • @tanstack/react-start@1.168.47
  • @tanstack/react-start-client@1.168.28
  • @tanstack/react-start-rsc@0.1.46
  • @tanstack/react-start-server@1.167.35
  • @tanstack/router-cli@1.167.31
  • @tanstack/router-core@1.171.25
  • @tanstack/router-generator@1.167.31
  • @tanstack/router-plugin@1.168.33
  • @tanstack/router-vite-plugin@1.167.33
  • @tanstack/solid-router@1.170.28
  • @tanstack/solid-start@1.168.45
  • @tanstack/solid-start-client@1.168.27
  • @tanstack/solid-start-server@1.167.34
  • @tanstack/start-client-core@1.170.25
  • @tanstack/start-plugin-core@1.171.37
  • @tanstack/start-server-core@1.169.29
  • @tanstack/start-static-server-functions@1.167.30
  • @tanstack/start-storage-context@1.167.27
  • @tanstack/vue-router@1.170.27
  • @tanstack/vue-start@1.168.44
  • @tanstack/vue-start-client@1.167.30
  • @tanstack/vue-start-server@1.167.34
9 hours ago
router

@tanstack/vue-start@1.168.44

Patch Changes

  • Updated dependencies [5d3785d]:
    • @tanstack/vue-router@1.170.27
    • @tanstack/start-client-core@1.170.25
    • @tanstack/start-plugin-core@1.171.37
    • @tanstack/start-server-core@1.169.29
    • @tanstack/vue-start-client@1.167.30
    • @tanstack/vue-start-server@1.167.34