• Turbopack: Cache canonicalized paths without turbo-tasks, try to find the longest cached prefix first: #99270
• Record parameter matching usage in build metadata: #99594
• Bundle Analyzer Agent Skill: Stream versioned analyzer graph as JSON Lines: #99387
• Revert "Optimize esm exports by shifting the protocol burden to getters (#98932)": #99704
• [PPF] Log Sync IO errors in runtime prerenders: #99688
• docs: clarify use client directive as a file level directive: #99703
• Stabilize forbidden() and unauthorized(): #99689
• turbopack-ecmascript-runtime: type-check every runtime file: #99670
• test: unflake use-cache-search-params: #99691
• Avoid mutating config for default export paths: #99496
• Keep compile-mode metadata outside configuration: #99491
• Keep dynamic asset prefixes outside configuration: #99490
• eslint-config-next: support ESLint 10: #99628
• Add Instant Insights for prefetch() and navigation(): #97801
• rename RenderStage.Runtime to PrefetchRuntime: #99679
• Collect root param dependencies for 'use cache' at build time: #99274
• Add client fixes for fully static route errors: #99659
• docs: clarify hover prefetching with Partial Prefetching: #99665
• Durable use cache entries: sort env var list: #99657
• next-swc: rebuild native when embedded js/src files change: #99669

Huge thanks to @bgw, @gnoff, @wbinnssmith, @lubieowoce, @kassens, @acdlite, @lukesandberg, @jamiboym, @aurorascharff, @unstubbable, and @mischnic for helping!

• fix: don't recreate a watermark on a disposed group by @mathuo in https://github.com/dockview/dockview/pull/1662
• fix: renderers and panels leaked after disposal by @mathuo in https://github.com/dockview/dockview/pull/1663
• fix(dockview-core): mark popout promise in context menu as intentionally ignored by @mathuo in https://github.com/dockview/dockview/pull/1664
• feat(demo): add a Tauri shell for host-environment testing by @mathuo in https://github.com/dockview/dockview/pull/1644

Full Changelog: https://github.com/dockview/dockview/compare/v8.4.0...v8.4.1

• VOverlay: avoid memory leak when unmounting immediately (ccf2f55), closes #23176

3.3.7 is a security release. It closes a stored XSS in the pad and timeslider renderer (GHSA-4mx2-rqx5-2pp6).

• Renderer — attribute-pool values can no longer forge class tokens (GHSA-4mx2-rqx5-2pp6, #8302). linestylefilter appended the start and list line-attribute values verbatim to the space-delimited class string that domline parses back, and domline emits any tag: token in that string as a raw element. A start value containing a space, which can be planted through a crafted changeset or .etherpad import, therefore smuggled in a token such as tag:img/src=x/onerror=... and rendered a live element with a live event handler for every viewer of the pad and its timeslider. This is the same function as GHSA-f7h5-v9hm-548j but a different token. start is now emitted only when it is an integer and list only when it is a plain list type, and domline accepts only a bare element name (letters, digits and hyphens) for tag: tokens, which also covers class strings contributed by plugins. Reported by @arpitjain099.

• Auth — an empty-string password is refused on both login paths (#8261). A settings.users entry configured as "password": "" authenticated anyone who submitted an empty password, on the OIDC interaction path and on HTTP Basic. Both already failed closed for a nullish password; an empty string slipped through because it is a string and compares equal to an empty submission. Only explicit misconfiguration produces it, so this is hardening rather than a vulnerability. Reported by Wenhao Wu (Southeast University) while verifying the fix for GHSA-62cj-9j72-mfrh.
• Admin — the plugin catalog no longer offers deprecated or known-broken plugins (#8246). The "Available plugins" list was built straight from the plugin feed, so any package the feed knew about could be installed from the admin UI — including packages npm marks deprecated, packages the plugin registry itself could not get working against the current release, and ep_adminpads2, which is archived upstream and takes over /admin/pads with a template whose scripts core no longer ships, hanging the admin page on "Loading…". Those are now filtered out of the catalog, the admin UI refuses to install one if a stale page asks for it anyway (pnpm run plugins i ep_<name> on the server still overrides), and an already-installed plugin in that state is flagged as deprecated in the Installed plugins list. The npm deprecation lookup is cached for 12 hours and fails open: if the registry cannot be reached the full catalog is still listed. Reported by @JohnMcLear.

3.3.7 is a security release. It closes a stored XSS in the pad and timeslider renderer (GHSA-4mx2-rqx5-2pp6).

• Renderer — attribute-pool values can no longer forge class tokens (GHSA-4mx2-rqx5-2pp6, #8302). linestylefilter appended the start and list line-attribute values verbatim to the space-delimited class string that domline parses back, and domline emits any tag: token in that string as a raw element. A start value containing a space, which can be planted through a crafted changeset or .etherpad import, therefore smuggled in a token such as tag:img/src=x/onerror=... and rendered a live element with a live event handler for every viewer of the pad and its timeslider. This is the same function as GHSA-f7h5-v9hm-548j but a different token. start is now emitted only when it is an integer and list only when it is a plain list type, and domline accepts only a bare element name (letters, digits and hyphens) for tag: tokens, which also covers class strings contributed by plugins. Reported by @arpitjain099.

• Auth — an empty-string password is refused on both login paths (#8261). A settings.users entry configured as "password": "" authenticated anyone who submitted an empty password, on the OIDC interaction path and on HTTP Basic. Both already failed closed for a nullish password; an empty string slipped through because it is a string and compares equal to an empty submission. Only explicit misconfiguration produces it, so this is hardening rather than a vulnerability. Reported by Wenhao Wu (Southeast University) while verifying the fix for GHSA-62cj-9j72-mfrh.
• Admin — the plugin catalog no longer offers deprecated or known-broken plugins (#8246). The "Available plugins" list was built straight from the plugin feed, so any package the feed knew about could be installed from the admin UI — including packages npm marks deprecated, packages the plugin registry itself could not get working against the current release, and ep_adminpads2, which is archived upstream and takes over /admin/pads with a template whose scripts core no longer ships, hanging the admin page on "Loading…". Those are now filtered out of the catalog, the admin UI refuses to install one if a stale page asks for it anyway (pnpm run plugins i ep_<name> on the server still overrides), and an already-installed plugin in that state is flagged as deprecated in the Installed plugins list. The npm deprecation lookup is cached for 12 hours and fails open: if the registry cannot be reached the full catalog is still listed. Reported by @JohnMcLear.

• The following workspace dependencies were updated
  • dependencies
    • @formatjs/icu-messageformat-parser bumped to 3.5.21
    • @formatjs/ts-transformer bumped to 4.5.0

• @formatjs/icu-messageformat-parser: tolerate MicrosoftAjax startsWith override (#7549) (6b3869a)

• The following workspace dependencies were updated
  • dependencies
    • @formatjs/icu-messageformat-parser bumped to 3.5.21

• The following workspace dependencies were updated
  • dependencies
    • @formatjs/icu-messageformat-parser bumped to 3.5.21
    • @formatjs/intl bumped to 6.1.3

• @formatjs/ts-transformer: support [content] in idInterpolationPattern (#7530) (cb514c4)

• deps: update oxc to 0.151 (#7524) (b20b90c)
• deps: update oxc to 0.152 (#7548) (e35b510)
• deps: update ruff to v0.16.9 (#7541) (b91479f)

• macOS Apple Silicon: formatjs_cli-darwin-arm64
• Linux ARM64: formatjs_cli-linux-arm64
• Linux x86_64: formatjs_cli-linux-x64
• Windows x64: formatjs_cli-win32-x64.exe

# macOS (Apple Silicon)
curl -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.8.0/formatjs_cli-darwin-arm64
chmod +x formatjs_cli-darwin-arm64
sudo mv formatjs_cli-darwin-arm64 /usr/local/bin/formatjs

# Linux
curl -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.8.0/formatjs_cli-linux-x64
chmod +x formatjs_cli-linux-x64
sudo mv formatjs_cli-linux-x64 /usr/local/bin/formatjs

# Linux ARM64
curl -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.8.0/formatjs_cli-linux-arm64
chmod +x formatjs_cli-linux-arm64
sudo mv formatjs_cli-linux-arm64 /usr/local/bin/formatjs

# Windows x64 (PowerShell)
curl.exe -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.8.0/formatjs_cli-win32-x64.exe

Verify the checksums:

curl -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.8.0/checksums.txt
shasum -a 256 -c checksums.txt

• The following workspace dependencies were updated
  • dependencies
    • @formatjs/icu-messageformat-parser bumped to 3.5.21
    • @formatjs/ts-transformer bumped to 4.5.0