• devtools: enable dev server integration (#23333) (68aeb8a)

• build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
• deps: update all non-major dependencies (#23445) (fc7c104)
• html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
• shortcuts extend error (#23447) (4ec58d1)

• introducing @e18e/eslint-plugin (#23357) (f794133)
• remove unnecessary comment (#23448) (b919a1a)

• #9937: Add a way to open the request body editor in the Form view by default. Set the defaultRequestBodyView: 'form' config option, or the x-scalar-default-request-body-view extension in your OpenAPI document (which also works per source). Defaults to raw, and falls back to raw when a body cannot be shown as a form.

• #10046: Stop sending optional form-body properties by default. Optional multipart/form-data and application/x-www-form-urlencoded properties now start unchecked and are left out of the request unless you enable them, matching how optional parameters already behave. Required properties are unaffected.

• #9937: Add a way to open the request body editor in the Form view by default. Set the defaultRequestBodyView: 'form' config option, or the x-scalar-default-request-body-view extension in your OpenAPI document (which also works per source). Defaults to raw, and falls back to raw when a body cannot be shown as a form.

• #10066: Show referenced model names for array branches in schema composition selectors.
• #10058: chore: upgrade to Storybook 10.5.10 and drop the third-party dark mode addon

• #9981: Load the modern ESM build of the API Reference by default

  The generated HTML now loads the code-split ESM build (.../@scalar/api-reference/esm.js, added in #9871) as a <script type="module"> by default, instead of the monolithic UMD bundle. Because it is code-split, less JavaScript blocks the first render.

  To keep the classic UMD bundle (loaded via <script src> and the window.Scalar global), set cdn to a UMD URL — for example to pin a version — or pass bundle: false. You can also pass bundle: 'https://.../esm.js' to load a specific ESM build.

  When a nonce is set (a strict, nonce-based CSP) the UMD bundle is used automatically, because the ESM build's import-loaded chunks cannot be nonced. Pass bundle: true to force the ESM build if your CSP uses 'strict-dynamic'.

• #10014: Flesh out the OpenAPI 3.2 example document with the features new to 3.2: named servers, hierarchical tags (parent/kind/summary), the query HTTP method, additionalOperations, the querystring parameter location, sequential/streaming media types via itemSchema, positional multipart encoding (prefixEncoding/itemEncoding), the OAuth 2.0 device authorization flow, oauth2MetadataUrl, a deprecated security scheme, and XML nodeType.

• #10082: Run x-handler and x-seed code in a real sandbox

  Handler and seed code used to run with the Function constructor, which gave it full access to the Node.js host (process, require, and more). It now runs inside a QuickJS WebAssembly sandbox with memory and time limits, so even untrusted code from a remote or $ref-loaded document cannot reach the host.

  The store, faker, req, res, schema, and seed APIs work as before. The one exception is faker methods that take a callback (for example faker.helpers.multiple(fn)), which are no longer supported because functions cannot cross the sandbox boundary.

• #10079: Harden the mock server against SSRF and local file disclosure through OpenAPI $refs. External $ref resolution now refuses to fetch private, loopback, link-local, and metadata addresses, and confines local file reads to the document's directory. The fetchUrls and readFiles bundling plugins gain opt-in blockPrivateNetworks and basePath options, so other callers keep their current behavior unless they opt in.

• #9981: Load the modern ESM build of the API Reference by default

  The generated HTML now loads the code-split ESM build (.../@scalar/api-reference/esm.js, added in #9871) as a <script type="module"> by default, instead of the monolithic UMD bundle. Because it is code-split, less JavaScript blocks the first render.

  To keep the classic UMD bundle (loaded via <script src> and the window.Scalar global), set cdn to a UMD URL — for example to pin a version — or pass bundle: false. You can also pass bundle: 'https://.../esm.js' to load a specific ESM build.

  When a nonce is set (a strict, nonce-based CSP) the UMD bundle is used automatically, because the ESM build's import-loaded chunks cannot be nonced. Pass bundle: true to force the ESM build if your CSP uses 'strict-dynamic'.

• #9937: Add a way to open the request body editor in the Form view by default. Set the defaultRequestBodyView: 'form' config option, or the x-scalar-default-request-body-view extension in your OpenAPI document (which also works per source). Defaults to raw, and falls back to raw when a body cannot be shown as a form.

• #9981: Load the modern ESM build of the API Reference by default

  The generated HTML now loads the code-split ESM build (.../@scalar/api-reference/esm.js, added in #9871) as a <script type="module"> by default, instead of the monolithic UMD bundle. Because it is code-split, less JavaScript blocks the first render.

  To keep the classic UMD bundle (loaded via <script src> and the window.Scalar global), set cdn to a UMD URL — for example to pin a version — or pass bundle: false. You can also pass bundle: 'https://.../esm.js' to load a specific ESM build.

  When a nonce is set (a strict, nonce-based CSP) the UMD bundle is used automatically, because the ESM build's import-loaded chunks cannot be nonced. Pass bundle: true to force the ESM build if your CSP uses 'strict-dynamic'.

• #9937: Add a way to open the request body editor in the Form view by default. Set the defaultRequestBodyView: 'form' config option, or the x-scalar-default-request-body-view extension in your OpenAPI document (which also works per source). Defaults to raw, and falls back to raw when a body cannot be shown as a form.

• #9990: Fix @scalar/types leaking into the published type declarations. @scalar/openapi-parser referenced @scalar/types from its .d.ts files while only depending on it as a devDependency, so consumers hit TS2307 (cannot find module). @scalar/types is now a regular dependency, and the package uses the shared UnknownObject and AnyObject utility types from @scalar/types/utils directly instead of defining its own local copies (AnyObject was added to @scalar/types/utils alongside the existing UnknownObject).

  The generic AnyObject and UnknownObject types are no longer re-exported from @scalar/openapi-parser. Import them from @scalar/types/utils instead.

• #9937: Add a way to open the request body editor in the Form view by default. Set the defaultRequestBodyView: 'form' config option, or the x-scalar-default-request-body-view extension in your OpenAPI document (which also works per source). Defaults to raw, and falls back to raw when a body cannot be shown as a form.

• #10046: Stop sending optional form-body properties by default. Optional multipart/form-data and application/x-www-form-urlencoded properties now start unchecked and are left out of the request unless you enable them, matching how optional parameters already behave. Required properties are unaffected.
• #10090: Stop truncating large numeric strings entered into type: string array query and header parameters. A value like a 20-digit reference number was accepted as valid JSON, parsed into a JS number, and lost precision beyond Number.MAX_SAFE_INTEGER before being sent. Such values now fall back to the comma-split string handling instead of being parsed as a number.
• #9938: Fix OAuth2 scope selection freezing in the API reference auth panel. Selecting or deselecting scopes (including Select All and Deselect All) now updates the counter and checkboxes after the first change instead of getting stuck.
• #10077: Escape OpenAPI component keys when writing static workspace chunks so a document with a key like ../../evil cannot write files outside the assets directory

• #10058: chore: upgrade to Storybook 10.5.10 and drop the third-party dark mode addon

• #10058: feat(helpers): add applyColorMode and the DarkLightMode type, and use them from useColorMode

• #10079: Harden the mock server against SSRF and local file disclosure through OpenAPI $refs. External $ref resolution now refuses to fetch private, loopback, link-local, and metadata addresses, and confines local file reads to the document's directory. The fetchUrls and readFiles bundling plugins gain opt-in blockPrivateNetworks and basePath options, so other callers keep their current behavior unless they opt in.

• #10078: Guard mergeObjects (used by join) against prototype pollution, so a __proto__, constructor, or prototype key in an input document can no longer reach Object.prototype

• #9990: Fix @scalar/types leaking into the published type declarations. @scalar/openapi-parser referenced @scalar/types from its .d.ts files while only depending on it as a devDependency, so consumers hit TS2307 (cannot find module). @scalar/types is now a regular dependency, and the package uses the shared UnknownObject and AnyObject utility types from @scalar/types/utils directly instead of defining its own local copies (AnyObject was added to @scalar/types/utils alongside the existing UnknownObject).

  The generic AnyObject and UnknownObject types are no longer re-exported from @scalar/openapi-parser. Import them from @scalar/types/utils instead.

• #10058: feat(helpers): add applyColorMode and the DarkLightMode type, and use them from useColorMode

• fix(ui): every directive guards its context again in updated/beforeUnmount -> Vue defers a directive's updated to the post-flush queue but runs beforeUnmount synchronously, so a queued updated can outlive the element's unmount and find its context already gone. v2.30.0 dropped the early return that covered this, and the hook threw a TypeError. In production Vue logs it; in development it rethrows, flushJobs never clears currentFlushPromise and nothing reactive is ever flushed again, freezing the app on whatever was painted. Reported for the four touch directives (a QScrollArea inside <keep-alive :include>, dropped from the cache in the same tick it re-renders), the guard is restored across all eleven: v-close-popup, v-intersection, v-morph, v-mutation, v-ripple, v-scroll, v-scroll-fire and v-touch-hold/v-touch-pan/v-touch-repeat/v-touch-swipe (#18543)
• fix(QInfiniteScroll): decide the first load at mount, not from the observer's opening report -> since the sentinel took over the trigger condition in v2.30.0, the first load waited for the observer's opening report, which lands a frame after mount. An app that fetches its first page from @load and renders a loading placeholder taller than offset while that runs (from its own mounted hook, a nextTick or an async component) had already grown the content by then, so that report read "out of reach" and an observer never re-reports a state that merely holds: @load never fired and the placeholder waited for data nobody had asked for. The first load is decided on mount again, off the DOM as it stands, by the same reach test the observer applies, and it is no longer routed through the debounced poll, so a paused fake clock (Playwright's page.clock) does not hold it back either. A component mounted out of reach stays quiet as before, and the observer still owns every load after the first (#18542)
• fix(Ripple): the argument and the modifiers follow runtime changes -> v-ripple re-read its argument and modifiers only when the value reference changed and only for an object value, so three things were frozen at mount: v-ripple:[color] with no value never picked up a new color, a modifiers object that changed while the value did not was ignored (QBtn hits this on its own, so toggling its round prop left the ripple starting from the press point instead of the center, or the other way round), and setting the value back to true after an object kept that object's options. All three now re-derive (#18541)
• fix(utils/is): deepEqual() handles null-prototype objects -> comparing two objects created with Object.create(null) threw, because the valueOf fallback saw a missing method as an override of Object.prototype's and called it. Both conversion fallbacks now require an actual callable on both sides, so null-prototype objects, and objects whose own valueOf/toString is not a function, compare by their keys. Two objects of the same constructor where only one carries such an override are compared key by key too, instead of through that one side's conversion (#18540)
• fix(QTree): let header slot content size its own icons -> the header-<name> slot defaults styled .q-icon and .q-avatar inside the node header at a specificity that tied with each component's own icon sizing and won on source order, so a QBtn placed in a header slot rendered a fixed 21px icon whatever its size prop said. The defaults are scoped through :where() and lose every tie, while still applying to plain slot icons (#16753)

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

• Becoming a sponsor on Github
• One-off donation via PayPal

[!WARNING] Stepper context compatibility: v0.5.3 changed the package-exported StepperContextValue / useStepperContext shape, and v0.5.4 does not repair that compatibility break. Ordinary <Stepper> and <Step> usage is unaffected, but consumers that call the context hook directly or construct StepperContextValue should remain on v0.5.2 while a source-compatible repair is evaluated. See #5659.

Astryx 0.5.4 updates the fixed-version core package family.

npx astryx upgrade --apply

• DropdownMenu keeps focus where it is when a controlled menu mounts already open. ArrowDown on the focused trigger enters an already-open menu without requiring a close and reopen. (#5976)
• DropdownMenuRadioGroup now renders a working, selectable menu in the docsite properties preview. (#5976)

• CLI integrations preserve block showcase metadata, letting packages ship their own docsite previews. Charts now includes its primary bar-chart showcase. (#5583)
• Stepper documentation now accurately describes the exported context surface while compatibility work continues. (#6088)

Thanks to @Kyujenius and @cixzhang.

Full Changelog: https://github.com/facebook/astryx/compare/v0.5.3...v0.5.4

• 🐞 Fix DatePicker and TimePicker rendering issues when prefix, suffixIcon, allowClear.clearIcon, or the value returned by renderExtraFooter is 0. #59212 react-component/picker#1009 @github-actions @QDyanbing
• 🐞 Fix Modal and Drawer mask click closing behavior when reusing a mask configuration object. #59233 @giaBaoJS
• 🤖 Fix Select, AutoComplete, Cascader, and TreeSelect popupRender types to accept ReactElement and return ReactNode. #59207 @QDyanbing
• DatePicker
  • 🇩🇪 Fix DatePicker using incorrect default date and date-time formats with the German locale, using DD.MM.YYYY and DD.MM.YYYY HH:mm:ss respectively. #59151 @nrps9909
  • 🐞 Fix DatePicker popup closing unexpectedly when navigating to the month boundary set by minDate or maxDate. #59212 react-component/picker#1012 @github-actions @zombieJ
  • 🐞 Fix DatePicker.RangePicker losing the pending date selection highlight when hovering over another date with showTime enabled. #59212 react-component/picker#1010 @github-actions @zombieJ
  • 🌐 Add missing DatePicker year, quarter, month, week, and range placeholders in 32 locales. #59219 @stop1love1
  • 🌐 Correct Traditional Chinese (Taiwan) text for the DatePicker confirmation button and ColorPicker gradient color. #59129 @nrps9909
• Icon
  • 🆕 Add MetaFilled and NetflixFilled brand icons to Icon. #59178 ant-design-icons#755 @github-actions @mohamedkhaled4053
  • 🐞 Fix Icon XFilled rendering as a solid square. #59178 ant-design-icons#758 @github-actions @QDyanbing
  • 🐞 Fix Icon failing to render when bundled with Bun. #59178 ant-design-icons#768 @github-actions @zombieJ
  • 🐞 Fix Icon crashing the page when an icon definition is invalid. #59178 ant-design-icons#762 @github-actions @nrps9909
• Input
  • 🐞 Fix Input.Password ignoring controlled visibility when activating the visibility toggle. #59168 @QDyanbing
  • ⌨️ Fix Input.Password repeatedly toggling password visibility when holding down Enter or Space. #59135 @nrps9909
  • 🐞 Fix Input.Search not calling the custom enterButton onMouseDown handler. #59180 @QDyanbing
• 🐞 Fix Dropdown throwing errors when popupRender returns null, arrays, or numbers. #59207 @QDyanbing
• 🐞 Fix Checkbox.Group losing default selections and failing to update selections when value is undefined. #59217 @dogledogle
• 🐞 Fix Radio.Group not updating its selection when value is undefined. #59162 @dogledogle
• 🐞 Fix Layout.Sider not collapsing when clicking its trigger with collapsed set to undefined. #59175 @dogledogle
• 🐞 Fix Table single-select tree filters not selecting empty string values. #59141 @QDyanbing
• 🐞 Fix Image.PreviewGroup navigation arrows pointing in the wrong direction in RTL mode. #59145 @dogledogle
• ⌨️ Fix Tag close buttons and Tag.CheckableTag being activated repeatedly when holding down Enter or Space. #59134 @nrps9909
• ♿ Improve Steps progress icon accessibility semantics and remove its hardcoded English name. #59073 @giaBaoJS
• 🌐 Add localized accessible names for Carousel navigation arrows in 45 locales. #59218 @stop1love1

• 🐞 修复 DatePicker 和 TimePicker 的 prefix、suffixIcon、allowClear.clearIcon 或 renderExtraFooter 返回值为 0 时渲染异常的问题。#59212 react-component/picker#1009 @github-actions @QDyanbing
• 🐞 修复 Modal 和 Drawer 复用 mask 配置对象时点击遮罩关闭行为异常的问题。#59233 @giaBaoJS
• 🤖 修正 Select、AutoComplete、Cascader 和 TreeSelect 的 popupRender 类型，支持接收 ReactElement 并返回 ReactNode。#59207 @QDyanbing
• DatePicker
  • 🇩🇪 修复 DatePicker 在德语地区设置下默认日期和日期时间格式不正确的问题，分别使用 DD.MM.YYYY 和 DD.MM.YYYY HH:mm:ss。#59151 @nrps9909
  • 🐞 修复 DatePicker 设置 minDate 或 maxDate 后，切换到边界月份时面板意外关闭的问题。#59212 react-component/picker#1012 @github-actions @zombieJ
  • 🐞 修复 DatePicker.RangePicker 开启 showTime 时，悬停其他日期导致待确认日期的选中样式丢失的问题。#59212 react-component/picker#1010 @github-actions @zombieJ
  • 🌐 补充 DatePicker 在 32 个语言包中缺失的年、季度、月、周及对应范围选择占位文案。#59219 @stop1love1
  • 🌐 修正 DatePicker 确认按钮和 ColorPicker 渐变色的繁体中文（台湾）文案。#59129 @nrps9909
• Icon
  • 🆕 新增 Icon 品牌图标 MetaFilled 和 NetflixFilled。#59178 ant-design-icons#755 @github-actions @mohamedkhaled4053
  • 🐞 修复 Icon 的 XFilled 图标显示为实心方块的问题。#59178 ant-design-icons#758 @github-actions @QDyanbing
  • 🐞 修复 Icon 在 Bun 打包后无法显示的问题。#59178 ant-design-icons#768 @github-actions @zombieJ
  • 🐞 修复 Icon 遇到无效图标定义时导致页面崩溃的问题。#59178 ant-design-icons#762 @github-actions @nrps9909
• Input
  • 🐞 修复 Input.Password 切换显隐时未遵循受控显隐状态的问题。#59168 @QDyanbing
  • ⌨️ 修复 Input.Password 在长按回车键或空格键时反复切换密码可见状态的问题。#59135 @nrps9909
  • 🐞 修复 Input.Search 未触发自定义 enterButton 的 onMouseDown 回调的问题。#59180 @QDyanbing
• 🐞 修复 Dropdown 的 popupRender 返回 null、数组或数字等内容时抛出错误的问题。#59207 @QDyanbing
• 🐞 修复 Checkbox.Group 的 value 为 undefined 时默认选中项失效且无法更新选中状态的问题。#59217 @dogledogle
• 🐞 修复 Radio.Group 在 value 为 undefined 时无法更新选中项的问题。#59162 @dogledogle
• 🐞 修复 Layout.Sider 在 collapsed 为 undefined 时无法点击收起的问题。#59175 @dogledogle
• 🐞 修复 Table 树形单选筛选无法选择空字符串值的问题。#59141 @QDyanbing
• 🐞 修复 Image.PreviewGroup 在 RTL 模式下切换按钮箭头方向错误的问题。#59145 @dogledogle
• ⌨️ 修复 Tag 关闭按钮和 Tag.CheckableTag 在长按回车键或空格键时重复触发操作的问题。#59134 @nrps9909
• ♿ 优化 Steps 进度图标的无障碍语义，并移除硬编码英文名称。#59073 @giaBaoJS
• 🌐 补充 Carousel 在 45 个语言包中的前后翻页箭头无障碍名称。#59218 @stop1love1

• @wangeditor-next/core@6.4.1

Release 2026-09-06 21:27

• history: handle blockers consistently across history traversal (#8264) (9035abc411) by @Sheraff
• router-core: fix dangling references in published declarations (#8207) (08eff50c44) by @Sheraff
• react-router: avoid rewriting unchanged head assets (#8257) (cf166d160e) by @schiller-manuel
• router-core: skip lifecycle callbacks below fallback boundaries (#8165) (2f20c00224) by @Sheraff
• router: handle unknown error boundary values (#8209) (28a5e4504e) by @Sheraff
• router-core: retain not-found boundary during navigation (#8161) (f0b5eda544) by @Sheraff
• docs: Ensure we use normal install for query integration package (#8228) (650acb4a89) by @sommeeeer
• preserve shouldThrow in route-scoped hooks (#8169) (0caf6b9a2b) by @mizukendesu

• router-core: reduce navigation promise chains (#8259) (216c0c4803) by @Sheraff
• router: use URL.canParse for absolute URL checks (#8251) (0497caeef3) by @Sheraff
• router-core: avoid redundant promises for ready routes (#8244) (c18e690814) by @Sheraff
• router-core: avoid quadratic cache resource handoff (#8240) (2f9150309b) by @Sheraff
• router-core: gate JSON.parse attempts behind jsonStart guard in parseSearchWith (#8142) (50eafcaebb) by @Sheraff
• router-core: replace the LRU cache with a trimmed SIEVE cache (#8230) (ee283480df) by @Sheraff
• router-core: share settle chain between superseded navigation waiters (#8222) (edf0e16ebf) by @Sheraff
• start: optimize Rsbuild import protection reporting (#8164) (37877da166) by @SyMind

• simplify bundle optimization commands (#8253) (af2f9d1c44) by @schiller-manuel

• @tanstack/history@1.162.2
• @tanstack/nitro-v2-vite-plugin@1.155.1
• @tanstack/react-router@1.170.33
• @tanstack/react-start@1.168.50
• @tanstack/react-start-client@1.168.31
• @tanstack/react-start-rsc@0.1.49
• @tanstack/react-start-server@1.167.38
• @tanstack/router-cli@1.167.34
• @tanstack/router-core@1.171.28
• @tanstack/router-generator@1.167.34
• @tanstack/router-plugin@1.168.36
• @tanstack/router-vite-plugin@1.167.36
• @tanstack/solid-router@1.170.31
• @tanstack/solid-start@1.168.48
• @tanstack/solid-start-client@1.168.30
• @tanstack/solid-start-server@1.167.37
• @tanstack/start-client-core@1.170.28
• @tanstack/start-plugin-core@1.171.40
• @tanstack/start-server-core@1.169.32
• @tanstack/start-static-server-functions@1.167.33
• @tanstack/start-storage-context@1.167.30
• @tanstack/vue-router@1.170.30
• @tanstack/vue-start@1.168.47
• @tanstack/vue-start-client@1.167.33
• @tanstack/vue-start-server@1.167.37

• #8165 2f20c00 - Exclude structural descendants below error and not-found boundaries from route lifecycle callbacks. Preserve lifecycle membership through invalidation, hydration, background reloads, and superseded navigation publication.

• #8209 28a5e45 - Preserve falsy thrown values in React and Vue error boundaries. Type React and Vue boundary error components and onCatch callbacks as unknown. Solid boundary errors remain typed as Error; SSR now wraps non-Error loader errors to match Solid’s native boundary behavior, preserving the original value in cause. Router state and loader onError values are unchanged.

  When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.

• #8161 f0b5eda - Retain successful not-found matches as terminal shared boundaries during client navigation, preserving route context while the destination loads.

• #8251 0497cae - Use URL.canParse for absolute URL checks in links, navigation, redirects, and build configuration. Preserve a URL constructor fallback for older browsers.

• #8169 0caf6b9 - Fix route-scoped useMatch, useSearch, and useParams APIs to forward the shouldThrow option and preserve optional return types when shouldThrow: false.

• Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, ee28348, 9035abc, c18e690]:

  • @tanstack/router-core@1.171.28
  • @tanstack/history@1.162.2

• Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, ee28348, c18e690]:
  • @tanstack/router-core@1.171.28

• Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, 0caf6b9, ee28348, c18e690]:
  • @tanstack/router-core@1.171.28
  • @tanstack/vue-router@1.170.30
  • @tanstack/start-server-core@1.169.32