Bump the frontend-dependencies group in /ui/menu-website with 21 updates - #1356

Sourced from @​tanstack/vue-query's releases.

@​tanstack/vue-query@​5.107.1

Patch Changes

• #12542 025773a - fix(vue-query): keep query-core's enabled(query) callback. Zero-argument getters and refs stay reactive; the query callback is passed through to query-core.

• #12541 f4199ab - feat(vue-query): return a reactive state from useQuery so status === 'success' narrows data without unwrapping refs

• Updated dependencies []:

  • @​tanstack/query-core@​5.107.1

@​tanstack/vue-query@​5.107.0

Patch Changes

• #12494 00dc8de - Reset isRestoring in VueQueryPlugin when the clientPersister promise rejects, so queries no longer wait forever for a failed restore, and handle the rejection instead of leaving it unhandled.

• #12537 2cdba60 - fix(vue-query/useInfiniteQuery): return 'UseInfiniteQueryDefinedReturnType' from the 'Defined' overload so 'data' is no longer typed as possibly 'undefined' when 'initialData' is defined

• Updated dependencies [b6add89]:

  • @​tanstack/query-core@​5.107.0

@​tanstack/vue-query@​5.106.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.106.1

@​tanstack/vue-query@​5.106.0

Patch Changes

• #12525 e712412 - Accept reactive query options in Vue QueryClient execution methods.

• #12226 3ccb007 - fix(vue-query/queryClient): preserve union narrowing in 'setQueryData' updaters for tagged query keys

• Updated dependencies []:

  • @​tanstack/query-core@​5.106.0

Sourced from @​tanstack/vue-query's changelog.

5.107.1

Patch Changes

• #12542 025773a - fix(vue-query): keep query-core's enabled(query) callback. Zero-argument getters and refs stay reactive; the query callback is passed through to query-core.

• #12541 f4199ab - feat(vue-query): return a reactive state from useQuery so status === 'success' narrows data without unwrapping refs

• Updated dependencies []:

  • @​tanstack/query-core@​5.107.1

5.107.0

Patch Changes

• #12494 00dc8de - Reset isRestoring in VueQueryPlugin when the clientPersister promise rejects, so queries no longer wait forever for a failed restore, and handle the rejection instead of leaving it unhandled.

• #12537 2cdba60 - fix(vue-query/useInfiniteQuery): return 'UseInfiniteQueryDefinedReturnType' from the 'Defined' overload so 'data' is no longer typed as possibly 'undefined' when 'initialData' is defined

• Updated dependencies [b6add89]:

  • @​tanstack/query-core@​5.107.0

5.106.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.106.1

5.106.0

Patch Changes

• #12525 e712412 - Accept reactive query options in Vue QueryClient execution methods.

• #12226 3ccb007 - fix(vue-query/queryClient): preserve union narrowing in 'setQueryData' updaters for tagged query keys

• Updated dependencies []:

  • @​tanstack/query-core@​5.106.0

• 3875d1d ci: Version Packages (#12543)
• f4199ab feat(vue-query): return a reactive state from useQuery so `status=== 'suc...
• 025773a fix(vue-query): keep query-core's enabled(query) callback (#12542)
• d01e358 ci: Version Packages (#12535)
• 00dc8de fix(vue-query): reset isRestoring when the client persister fails (#12494)
• 2cdba60 fix(vue-query/useInfiniteQuery): return 'UseInfiniteQueryDefinedReturnType' f...
• 284abac ci: Version Packages (#12526)
• 925168e ci: Version Packages (#12501)
• e712412 fix(vue-query): accept shared options in imperative queries (#12525)
• 3ccb007 fix(vue-query/queryClient): preserve union narrowing in 'setQueryData' update...
• See full diff in compare view

Sourced from @​tanstack/vue-query-devtools's releases.

@​tanstack/vue-query-devtools@​6.4.1

Patch Changes

• Updated dependencies [025773a, f4199ab]:
  • @​tanstack/vue-query@​5.107.1
  • @​tanstack/query-devtools@​5.107.1

@​tanstack/vue-query-devtools@​6.4.0

Patch Changes

• Updated dependencies [a4d72f7, 00dc8de, 2cdba60]:
  • @​tanstack/query-devtools@​5.107.0
  • @​tanstack/vue-query@​5.107.0

@​tanstack/vue-query-devtools@​6.3.11

Patch Changes

• Updated dependencies [c4ed956]:
  • @​tanstack/query-devtools@​5.106.1
  • @​tanstack/vue-query@​5.106.1

@​tanstack/vue-query-devtools@​6.3.10

Patch Changes

• #12499 46d0477 - Let inline devtools panels fill their container height while keeping a 500px default height when the container has no set height.
• Updated dependencies [46d0477, f69b28a, 1176d37, 254350f, e712412, 3ccb007]:
  • @​tanstack/query-devtools@​5.106.0
  • @​tanstack/vue-query@​5.106.0

Sourced from @​tanstack/vue-query-devtools's changelog.

6.4.1

Patch Changes

• Updated dependencies [025773a, f4199ab]:
  • @​tanstack/vue-query@​5.107.1
  • @​tanstack/query-devtools@​5.107.1

6.4.0

Patch Changes

• Updated dependencies [a4d72f7, 00dc8de, 2cdba60]:
  • @​tanstack/query-devtools@​5.107.0
  • @​tanstack/vue-query@​5.107.0

6.3.11

Patch Changes

• Updated dependencies [c4ed956]:
  • @​tanstack/query-devtools@​5.106.1
  • @​tanstack/vue-query@​5.106.1

6.3.10

Patch Changes

• #12499 46d0477 - Let inline devtools panels fill their container height while keeping a 500px default height when the container has no set height.
• Updated dependencies [46d0477, f69b28a, 1176d37, 254350f, e712412, 3ccb007]:
  • @​tanstack/query-devtools@​5.106.0
  • @​tanstack/vue-query@​5.106.0

• 3875d1d ci: Version Packages (#12543)
• d01e358 ci: Version Packages (#12535)
• 284abac ci: Version Packages (#12526)
• 925168e ci: Version Packages (#12501)
• 46d0477 fix(devtools): let inline panels fill their container height (#12499)
• See full diff in compare view

Sourced from quasar's releases.

quasar-v2.35.3

Security fixes

• fix(Platform): DOM clobbering of the native bridge globals -> an element with an id or name attribute (and a named iframe) is also reachable as a window property, so markup rendered before Quasar boots (SSR/SSG output of user-provided HTML) could pass for a native wrapper. A <div id="Capacitor"> set Platform.is.capacitor and the app then failed to boot; elements named after cordova, InAppBrowser or StatusBar made openURL() and AddressbarColor.set() throw; a cross-origin iframe named after a bridge threw a SecurityError. Capacitor, Cordova, StatusBar and SafariViewController are now picked up only when the global is not an element, a collection of elements or a window, and each bridge method is checked to be a function before it gets called. A bridge global set to null is no longer detected as a native wrapper. This completes the SafariViewController hardening of v2.32.2

New

• feat(format): getDecimalsCount() -> new util on the format object, telling how many decimals a number (or a numeric string) needs when written in fixed notation, which is what toFixed() asks for when rounding a float back to the precision of its operands. Unlike splitting String(value) on the dot, it also handles the numbers JS prints in exponent notation (getDecimalsCount(1e-7) is 7); a string keeps its trailing zeros ('1.50' counts two decimals)

Fixes

• fix(QSlider/QRange): fractional min -> the values stay aligned to a min (or inner-min) that has decimals. With min 0.5 and step 1 the valid values are 0.5, 1.5, 2.5 and so on, yet the pointer and the keyboard alike were rounding 1.5 to 2 (#18578)
• fix(QSlider/QRange/QKnob): step written in exponent notation -> a step below 1e-6 (which JS prints as 1e-7) counted as having no decimals, so every new value was rounded to a whole number: a slider from 0 to 1e-6 with a step of 1e-7 could never leave 0
• fix(QKnob): step grid starts at inner-min -> the pointer and the keyboard now land on the same values, as QSlider and QRange do. Before, the pointer snapped to multiples of the step counted from zero while the keyboard added the step to the current value (min 5 with step 10 gave 10, 20... with the pointer and 15, 25... with the keyboard), and with min 0.5 and step 1 the right arrow jumped from 0.5 to 2. Behavior change: when min is not a multiple of the step, a pointer adjustment now lands on min + n * step instead of n * step. Knobs with the default min of 0 are not affected
• fix(QTooltip): repeated hover/focus events -> pointer and keyboard events overlapping on the target while the tooltip was opening or closing no longer cancel the end of its transition. The tooltip could stay visible without ever emitting show, or never finish hiding, and a focus() requested meanwhile stayed queued until the pointer left the target (#18582, #18583)
• fix(QTooltip): focus requests while a tooltip opens -> a focus() going through QInput, QField, QForm, QEditor or a dialog/menu autofocus is no longer held back until the tooltip transition ends. A button with a tooltip that focuses an input on click now does so right away, inside the click
• fix(QTree): children removed and restored on an expanded node -> a node whose children got emptied and then restored within the slide duration no longer ends up with them hidden while still expanded. Removing and restoring children neither slides nor emits after-show/after-hide anymore, as before v2.32. Regression from v2.32.0 (#18584)
• fix(lang): Turkish (tr) -> corrected mistranslated labels: the table filter and pagination, the tree expand/collapse, the color picker alpha, the uploader "remove queued" and several QEditor ones (italic, lists, subscript, superscript, justify, formatting, fullscreen) (#18581)

Other

• perf(ui): fewer inner functions recreated -> QDate, QTime, QForm, QSlider/QRange and the Loading and LoadingBar plugins no longer rebuild some of their helper functions each time they run

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

• Becoming a sponsor on Github
• One-off donation via PayPal

• ae0a894 chore(ui): bump version
• 31d5e0a chore(app-vite;docs;ui/playground): restrict Hono caching to static files
• 5e7e27e fix(ui): do not take DOM named properties for native bridges
• 9618a89 perf(ui): avoid uselessly recreating some inner functions
• d2ba682 feat(all): upgrade deps
• b92a217 fix(QTree): children removed and restored on an expanded node stay visible (f...
• 62433d4 fix(QTooltip): an opening tooltip no longer holds focus requests back
• bd09b73 fix(QTooltip): preserve transition completion across repeated events (fix #18...
• f7950cc fix(ui): QKnob step grid starts at inner-min, same as QSlider
• b7000ce fix(ui): QSlider/QRange/QKnob step written in exponent notation
• Additional commits viewable in compare view

Sourced from vue's releases.

v3.5.45

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Sourced from vue's changelog.

3.5.45 (2026-11-05)

Bug Fixes

• compiler-core: copy loc in cloneLoc instead of recomputing it (#16092) (3cee79a), closes #16091
• compiler-dom: preserve static boolean binding semantics (#16055) (05db7e8), closes #16051
• compiler-sfc: respect catch and switch lexical scopes (fix #16098) (#16101) (0f20152)
• hmr: retry reloads after pending async roots resolve (#16060) (fbaa794)
• hydration: only update component el when replacing its host node (#16001) (51fd0cb)
• KeepAlive: cache a resolved Suspense child right away (#16119) (716a29e)
• KeepAlive: unmount a child deactivated before it was cached (#15981) (02d2c2b)
• reactivity: run onScopeDispose in a stopped scope (#16108) (21dd33c)
• runtime-core: anchor on the async placeholder when a component root has no el (#16122) (b5abf8c)
• runtime-core: call directive mounted hooks with the latest binding (#16120) (6416207), closes #12460 #12482
• runtime-core: remove the placeholder of an unmounted pending async component (#15982) (2b9a0bb)
• runtime-core: render nothing for a component whose async setup rejects (#16111) (f64bfa5)
• runtime-core: skip stopped error boundaries for async failures (#16061) (0326ed8)
• runtime-dom: treat disablepictureinpicture and disableremoteplayback as boolean attributes (#15952) (ef81ddc)
• suspense: do not mount the fallback after the boundary is unmounted (#15939) (4fd6a6b)
• suspense: drop the unmount hooks of a pending branch when the boundary is unmounted (d04b662)
• suspense: enter transitions nested in the pending branch on reveal (#16121) (b8074de), closes #12435 #15294
• suspense: keep a discarded component marked unmounted (1dc8cdf)
• suspense: keep the async root update retry across a discarded pending branch (#16107) (06bea73)
• suspense: keep the internal cleanup of a discarded component (79b80b7)
• suspense: keep the timeout counting when the root is switched again while pending (#16143) (a045acd)
• suspense: patch same-root updates of nested boundaries in retained content (#16109) (2dbcea8), closes #15878
• suspense: release parent dep on suspensible unmount (#15870) (46e5dbf)
• suspense: resolve async deps whose pending cycle was discarded (#15980) (f7d0811)
• suspense: resolve the boundary when an async setup rejects without an error handler in dev (#16110) (a14aa0b)
• suspense: skip a root replacement in a retained nested boundary showing its fallback (#16125) (a47af77)
• suspense: skip the out-in afterLeave of an unmounted boundary (#16115) (85e71c0), closes #11037 #11059
• transition: handle leave immediately done in out-in mode (#11824) (70599b5), closes #15727
• transition: switch modes around a keyed suspense boundary (#16124) (ff0b341)
• types: add dialog closedby attribute (#16064) (24c9d0b)
• v-model: respect number modifier for Set select values (0ff253b)

Performance Improvements

• compiler-sfc: skip unused tsconfig include enumeration (#15899) (1612403), closes #15898
• compiler-ssr: render static style attributes at compile time (#16010) (2629c89)
• mark internal initializers as pure (#16012) (34fbeb1)
• runtime-core: copy raw attrs when setup context attrs are passed as vnode props (#16129) (823c744)

• 8b479a8 release: v3.5.45
• 9f9b71c chore(deps): bump source-map-js from 1.2.1 to 1.2.2 (#16150)
• 1d718d2 chore(deps): update dependency @​types/node to v26 (#16087)
• 68583ce chore(deps): bump undici from 8.9.0 to 8.12.3 (#16149)
• 91f2625 chore(deps): bump fast-uri from 3.1.0 to 3.1.9 (#16148)
• a8ab1f8 chore(deps): update build (#15918)
• a0d1388 chore(deps): update dependency minimatch to v11 [security] (#16145)
• 923f70d fix(deps): update compiler (#15920)
• 3cb1161 chore(deps): update lint (#15921)
• 0ce9e16 chore(deps): update dawidd6/action-download-artifact action to v28 (#16086)
• Additional commits viewable in compare view

Sourced from vue-router's releases.

v5.5.0

   🚀 Features

• Warn on colliding query with params  -  by @​posva (57a20)
• experimental:
  • Customize scroll restoration capture listeners  -  by @​posva (062fa)
  • Export default scroll capture listener setup  -  by @​posva (ce337)
  • Support type safe route record props  -  by @​posva (f7f8f)
• scroll-restoration:
  • Make capture triggers configurable  -  by @​posva (607f2)
• unplugin:
  • Declare route params in defineProps() with definePage props true  -  by @​posva (b659e)
• volar:
  • Type defineProps() with route params when definePage props is true  -  by @​posva (ca85a)
  • Add typedDefineProps option to sfc-typed-router  -  by @​posva (bc409)

   🐞 Bug Fixes

• Avoid replaceState on pagehide if scrollRestoration is manual  -  by @​posva (e9f34)
• Fallback to useId for vapor  -  by @​posva (89bc7)
• Preserve named-view props and detect quoted props keys  -  by @​posva (f6836)
• Keep non-object props when merging  -  by @​Mini-ghost in vuejs/router#2862 (efa71)
• experimental:
  • Match root paths with multiple optional params  -  by @​posva in vuejs/router#2830 (04016)
  • Remove query param set to undefined  -  by @​posva (700de)
  • Keep query value for params omitted from params  -  by @​posva (cc734)
  • Compare query values element by element in R0123  -  by @​posva (e6191)
• matcher:
  • Avoid exponential backtracking on .* repeatable params  -  by @​re-thc in vuejs/router#2819 (42462)
• router-view:
  • UseRoute() returns the route prop in descendants  -  by @​posva in vuejs/router#2846 (11baa)
  • Handle pending async component roots in onRouteRendered  -  by @​posva in vuejs/router#2856 (c97c8)
• scroll:
  • Save scroll positions in sessionStorage instead of history.state  -  by @​posva (baa5f)
  • Keep scroll positions in memory when sessionStorage fails  -  by @​posva (3ffae)
  • Ignore invalid scroll positions in sessionStorage  -  by @​posva (101f5)
• scroll-restoration:
  • Overwrite parent capture and restore  -  by @​posva (cb771)
  • Reserve keys for pending async pages  -  by @​posva (35cf5)
  • Restore position after native hash links  -  by @​posva (57304)
• types:
  • Add hotUpdateCallback to auto-resolver handleHotUpdate  -  by @​posva in vuejs/router#2836 (0729c)
  • Accept classic parseQuery in RouterOptions  -  by @​ondrhn in vuejs/router#2848 (6ef7a)
  • Allow undefined on push for query params with default  -  by @​posva (0c74c)
• unplugin:
  • Support definePage with webpack and rspack  -  by @​Nsttt in vuejs/router#2829 (8c91f)
  • Keep aliased named imports in definePage extraction  -  by @​re-thc in vuejs/router#2832 (6dec1)
  • Reload pages with stale route props  -  by @​posva (f0563)

   🏎 Performance

... (truncated)

• 7a1cf56 release: vue-router@5.5.0
• efed179 test: add tests for later
• f0ab0c1 test(scroll): cover consumed positions on anchor links and auto restoration
• 1bc7a4a refactor(scroll): build scroll keys inside saveScrollPosition
• 101f579 fix(scroll): ignore invalid scroll positions in sessionStorage
• 3ffae5c fix(scroll): keep scroll positions in memory when sessionStorage fails
• baa5f6f fix(scroll): save scroll positions in sessionStorage instead of history.state
• e407f0d perf(unplugin): watch page files only in dev server
• e619138 fix(experimental): compare query values element by element in R0123
• 57a2057 feat: warn on colliding query with params
• Additional commits viewable in compare view

Sourced from @​playwright/test's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

• There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
• Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
• Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
• Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

• New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

  test('restart the server', { lock: '-exclusive-' }, async () => {
    // No other test runs while this one is running.
  });

• test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

  test('upload a file', async ({ page }) => {
    test.skip('Not implemented yet');
  });

... (truncated)

• a1f35e1 chore: mark v1.65.0 (#43925)
• a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
• 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
• daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
• 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
• 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
• 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
• d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
• 6e3f5ff docs: release notes for v1.65 (#43874)
• aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
• Additional commits viewable in compare view

Sourced from @​quasar/app-vite's releases.

@​quasar/app-vite-v3.10.4

Security fixes

• fix(app-vite): SSR with Hono -> the default SSR webserver template was sending Cache-Control: public, max-age=2592000000 on every GET response that went through it in production: server-rendered pages (logged-in ones included), redirects, 404/500 pages and the GET routes of your SSR middlewares, not only on static files. Browsers, CDNs and reverse proxies were therefore allowed to store those responses and hand them to other visitors, and returning visitors kept the old HTML after a deploy. The value was also expressed in milliseconds while max-age counts seconds, so the intended 30 days became about 82 years. The header is now set only when a static file is actually served, with the correct 30 days value; everything else is left to your own cache policy. Dev mode and the Express, Fastify and Koa templates were not affected (GHSA-j5fg-jh38-f8q6)

• This only fixes newly generated SSR projects. Adding the SSR mode copies the template into your project, so upgrading @quasar/app-vite does not touch an existing /src-ssr/server.js (or server.ts). If you use Hono, please edit that file by hand and replace this block in serveStaticContent:

  if (cacheAge > 0) {
    app.get(routePath, async (c, next) => {
      c.header('Cache-Control', `public, max-age=${cacheAge}`)
      await next()
    })
  }

  with:

  if (cacheAge > 0) {
    const { onFound } = serveOpts
    const cacheControlValue = `public, max-age=${Math.floor(cacheAge / 1000)}`
    serveOpts.onFound = async (path, c) => {
      c.header('Cache-Control', cacheControlValue)
      await onFound?.(path, c)
    }
  }

  In the TypeScript template the options object is named staticOpts: move its const staticOpts = { ...serveOpts } declaration above this block and use it instead of serveOpts. After deploying, purge the HTML cached by your CDN or reverse proxy. Browsers that already stored a page keep it until they evict it; sending Clear-Site-Data: "cache" on a response that still reaches your server (the logout one, for example) clears it for browsers supporting that header

Fixes

• fix(app-vite): TypeScript -> .vue files are now covered by the generated .quasar/tsconfig.json. Its include relied on a bare wildcard, which Rolldown (like tsc) matches against TS/JS files only, so <script lang="ts"> blocks were compiled without your compilerOptions (experimentalDecorators, useDefineForClassFields, verbatimModuleSyntax and the like were ignored) while vue-tsc type-checking looked fine. In a monorepo with a root solution tsconfig, the build could even abort with TSCONFIG_ERROR ... Tsconfig not found. The file is regenerated on the next quasar dev, quasar build or quasar prepare (#18589, #18590)
• fix(app-vite): SSG -> quasar build -m ssg no longer fails on Windows with ERR_UNSUPPORTED_ESM_URL_SCHEME when it starts rendering the pages (#17840)

Other

• chore(app-vite): upgraded deps -> vite ~8.3.6 and rolldown ~1.2.16 (both now held to their minor version), @vitejs/plugin-vue ^6.0.10, sass-embedded ^1.108.1, @types/chrome ^0.3.7, confbox ^0.3.2, fs-extra ^11.4.1, semver ^7.8.6 and serialize-javascript ^7.1.4

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

• Becoming a sponsor on Github
• One-off donation via PayPal

• 8da4354 chore(app-vite): bump version
• 31d5e0a chore(app-vite;docs;ui/playground): restrict Hono caching to static files
• 0e7f13b fix(app-vite): restrict Hono caching to static files
• 9618a89 perf(ui): avoid uselessly recreating some inner functions
• d2ba682 feat(all): upgrade deps
• 82e4085 fix(app-vite): SSG build mode -> ERR_UNSUPPORTED_ESM_URL_SCHEME error on Wind...
• 40eefd7 fix(app-vite): include .vue files in the generated tsconfig #1...

  Description has been truncated