jQuery UI 1.13.2 released

We’re happy to announce the second patch release to jQuery 1.13 is out. It includes a security fix for the Checkboxradio widget, a few localization updates for Datepicker and some fixes for issues submitted by the community. Built jQuery UI files are now included in the npm package; this was important to some CDNs that rely on it as the source of truth.

More details about the security issue fixed:

Please remember jQuery UI is in a maintenance state: we’ll make sure the library is compatible with new jQuery releases and that security issues are fixed but no new significant feature work is planned. We’ll also try to fix important regressions from jQuery UI 1.12.1; older long-standing bugs may not get fixed. Note that this does not affect jQuery Core which is still actively maintained.

Download

File Downloads

Git (contains source files, with @VERSION replaced with 1.13.2, base theme only)

Install via npm

  • npm install jquery-ui@1.13.2

Install via bower

  • bower install jquery/jquery-ui#1.13.2

jQuery CDN, powered by StackPath

Google Ajax Libraries API (CDN)

Microsoft Ajax CDN (CDN)

Custom Download Builder

Changelog

See the 1.13 Upgrade Guide for a list of changes that may affect you when upgrading from 1.12.x. For full details on what’s included in this release see the 1.13.2 Changelog.

Thanks

Thanks to all who helped with this release, specifically: Adam Lidén Hällgren, Christian Oliff, Denny Septian Panggabean, Felix Nagel, James Hinderks, Michał Gołębiowski-Owczarek.

Comments

Note: please report bugs to the jQuery UI Bug Tracker; support questions should be posted on Stack Overflow with the jquery-ui tag. Please don’t use comments to report bugs.

If you have feedback on us doing our release for jQuery UI 1.13.2, feel free to leave a comment below. Thank you.

Source: jQuery UI

jQuery UI 1.13.1 released

We’re happy to announce the first patch release to jQuery 1.13 is out. It mostly consists of fixes for 1.13 regressions reported to us since the 1.13.0 release. Fixes involve the Widget, Autocomplete, Sortable & Tooltip modules.

Please remember jQuery UI is in a maintenance state: we’ll make sure the library is compatible with new jQuery releases and that security issues are fixed but no new significant feature work is planned. We’ll also try to fix important regressions from jQuery UI 1.12.1; older long-standing bugs may not get fixed. Note that this does not affect jQuery Core which is still actively maintained.

Download

File Downloads

Git (contains source files, with @VERSION replaced with 1.13.1, base theme only)

Install via bower

  • bower install jquery/jquery-ui#1.13.1

jQuery CDN, powered by StackPath

Google Ajax Libraries API (CDN)

Microsoft Ajax CDN (CDN)

Custom Download Builder

Changelog

See the 1.13 Upgrade Guide for a list of changes that may affect you when upgrading from 1.12.x. For full details on what’s included in this release see the 1.13.1 Changelog.

Thanks

Thanks to all who helped with this release, specifically: Ben Mullins, Felix Nagel, GitHub, Josep Sanz, Michał Gołębiowski-Owczarek.

Comments

Note: please report bugs to the jQuery UI Bug Tracker; support questions should be posted on Stack Overflow with the jquery-ui tag. Please don’t use comments to report bugs.

If you have feedback on us doing our release for jQuery UI 1.13.1, feel free to leave a comment below. Thank you.

Source: jQuery UI

jQuery maintainers continue modernization initiative with deprecation of jQuery Mobile

By: Michał Gołębiowski-Owczarek, Felix Nagel, and the jQuery team

Editor’s Note: the following blog post was originally published to the OpenJS Foundation Blog.

jQuery maintainers are continuing to modernize its overall project that still is one of the most widely deployed JavaScript libraries today. The team announced that the cross-platform jQuery Mobile project under its umbrella will be fully deprecated as of October 7, 2021. New technologies for mobile app development have evolved since this project was launched in 2010, so we’re encouraging developers to plan for this jQuery Mobile transition.

Please note that:

  • The Download Builder will remain available.
  • Mobile 1.4 is not compatible with the new jQuery Core.
  • Issues will be turned off. Please report critical security bugs via email to security@jquery.com. 

Celebrating jQuery Mobile’s History

jQuery Mobile was conceived and announced in 2010, three years after the launch of jQuery.  The project was exciting and ambitious. At announcement, jQuery Mobile promised compatibility across multiple platforms, browsers, and versions. Several mobile browser vendors, including Palm and Mozilla, signed on to sponsor the project: 


“The jQuery community has focused on making the Web as productive and fun as possible. When we heard the mission behind jQuery Mobile, we wanted to help. With webOS we have shown that the Web platform is fantastic for developers, so we are excited to help make jQuery Mobile as good as it can be.” -Dion Almaer – Palm

At the time, the mobile web was desperately in need of a framework capable of working across all browsers, allowing developers to build truly mobile web applications. jQuery had already changed the way developers were building on the web, making it easier (and faster) to create secure, compliant applications. 

With jQuery Mobile, the project’s goals were to bring the ease-of-use of jQuery to HTML-capable mobile device browsers and to make it easier for developers to build progressively enhanced web applications. Led by Todd Parker of Filament Group, a development studio known for their work on cross platform and accessibility-first applications, jQuery Mobile launched its alpha release in October 2010. 

Alpha features included several components, layouts and theming tools that simplified the process of building a mobile web application. Progressive enhancement and graceful degradation, which were hot (and tricky) topics in web development at the time, featured heavily: jQuery Mobile promised developers and users the best possible experience their platform could handle. Accessibility was another key feature, with Mobile promising a user experience that could be navigated by touch, keyboard, or screen reader via ARIA compatible components. Additional features such as simplicity, file size, and the ability to deploy jQuery Mobile applications through an app store drove further excitement. 

Over the next year, the jQuery Mobile team continued to add compatible platforms and browsers, new components and themes, and eventually a themeroller tool that allowed developers to configure and download themes without writing any CSS. 

The community response was overwhelming – by the time 1.0 was released in November 2011, jQuery Mobile had gathered over 125 contributors, dozens of articles, tutorials and demos, 8 published books, and a gallery of sites, plugins and extensions to welcome and introduce new developers to the project. 

jQuery Mobile continued to make monthly releases throughout 2012 and 2013, regularly adding and improving components, resolving compatibility issues with mobile browsers, and making performance improvements to speed up page rendering times. The development team also continued to prioritize and highlight the importance of responsive web design and accessibility principles with each new release. 

As the number of components and widgets swelled – both those that were officially supported or widely adopted in the community, performance and compatibility issues with mobile platforms, browsers, and jQuery core were also exacerbated. Though the project did have some automated tests, there were still a number of items that needed to be tested manually, which slowed down the development process. 

In mid 2013, Jasper de Groot became the project lead and announced tighter development collaboration between jQuery UI and jQuery Mobile teams, sharing goals, roadmaps and code in order to ease the workload for both groups. The team continued to provide maintenance releases and support, but progress continued to slow under the burden of testing and supporting such a large community. 

Alex Schmitz took over the lead in July 2014, but by that time the size of the project, combined with the pace and availability of new mobile browser features, made finding a viable path forward for the project increasingly difficult. 

The latest stable version was released October 2014. Alex and team made a big push to update jQuery Mobile again in 2017 with the release of an alpha version of 1.5; this version would see compatibility with jQuery 3.0 and npm support among other things.

jQuery Mobile became an OpenJS Foundation Emeritus project in 2018, signifying that the goals of the project had been achieved.

jQuery modernization initiative

The depreciation of jQuery mobile follows the careful transition of another project under the jQuery project umbrella, jQuery UI.

jQuery Core is still actively maintained and widely implemented. As part of its modernization initiative, the team also has been making a series of updates this year to its infrastructure, including migrating and improving its CDN.

Celebrating jQuery Mobile Maintainers and Contributors

The contributions to jQuery Mobile opened up opportunities for people and organizations around the world, and we are thankful for all the contributions over the years. We would like to give an extra shout out of gratitude to the past maintainers of jQuery Mobile: Alexander Schmitz, Jasper de Groot, and Todd Parker.

Source: jQuery UI

jQuery maintainers update and transition jQuery UI as part of overall modernization efforts

By: Michał Gołębiowski-Owczarek, Felix Nagel, and the jQuery team

Editor’s Note: the following blog post was originally published to the OpenJS Foundation Blog.

The jQuery project is actively maintained and widely implemented — it’s used by 73% of 10 million most popular websites. As part of its ongoing effort to modernize the project, jQuery maintainers have taken steps to wind down one of its projects under the jQuery umbrella through a careful transition. 

Today, jQuery UI announced version 1.13 — its first release in 5 years and the project’s final planned release. Perhaps the most important update is that jQuery UI 1.13 now runs on the latest version of jQuery Core, providing a number of browser compatibility and security updates that have been missing from previous releases, in addition to community fixes and improvements. The jQuery UI Download Builder has also been restored and updated so developers can continue to download UI along with their favorite themes. The release is part of an ongoing series of updates across all jQuery projects.

jQuery UI is in maintenance-only mode. Users should not expect any new releases, though patches may be issued to resolve critical security, interoperability, or regression bugs. Trac, the project’s bug-tracking tool, has been put in read-only mode and developers are asked to file any critical issues on the project’s GitHub repository

jQuery UI was first launched in September 2007 as a curated set of user interface interactions, effects, widgets, and themes built on top of the jQuery library. It quickly gained popularity because it was one of the best tested and most accessible UI frameworks of its time. The tool helped developers build UI components such as form controls and date pickers using the best practices back then. In its heyday, jQuery UI was adopted by a broad set of enterprises including Pinterest, PayPal, IMDB, Huffington Post, and Netflix. 

Today, jQuery UI continues to be an important testbed for jQuery Core updates, helping the maintainer team spot bugs and interoperability issues that arise as the web platform evolves. 

Celebrating jQuery UI’s History

With the launch of jQuery in 2006, web developers were able to access and manipulate DOM and CSS faster and easier than ever before. Thousands of open source jQuery widgets and plugins were created to handle previously tricky problems, like showing and hiding elements, rotating through image carousels, or picking dates on a calendar. The jQuery ecosystem became a playground full of tools for making new and interesting interactions possible on the web. 

‘New and interesting’ doesn’t always translate to ‘good and useful’ — though there were many good plugins available, it was not always easy to tell which would be the most performant or provide the best user experience. Developers might have to go searching for the right tools or worse, spend significant time swapping through several plugins to figure out which one worked best. Further, there were few examples of best practices in user experience on the web, so visitors to one website could have vastly different (and thus confusing) interactions when they performed a similar task on another website. 

Members of the jQuery Core team wanted to help developers write performant, high-quality, and reusable jQuery components for their sites and applications. After some discussion, the idea for a second library with strict standards for coding, documentation, and theming was born. The project’s vision and goals included: developing a collaborative design process; providing flexible styling and themes; creating elegant visual and interaction design; providing a robust API; and prioritizing progressive enhancement, accessibility, internationalization and localization support.

In September 2007, jQuery UI officially launched as a set of user interface interactions, effects, widgets, and themes built on top of jQuery. Soon after, the team shifted their focus to provide a full set of APIs and methods to allow developers to create flexible, full-featured widgets that met high standards of quality. CSS effects such as easing and animation were added in and helped developers create more modern, enhanced experiences. The team at Filament Group later added a ThemeRoller, allowing developers to get started quickly by providing customizable theme boilerplate. ThemeRoller is still operational today.  

By the end of 2008, jQuery UI had an exploding community of users, developers, and interaction designers regularly providing updates and improvements to the project as best practices and style preferences evolved. Between 2009 and 2016, the community provided a variety of new official and unofficial themes and plugins, interoperability and other bug fixes, robust testing processes, and support for multiple versions of jQuery. 

jQuery UI’s prior official release came in September 2016, nearly a decade after it started. In that timeframe, the jQuery community had helped inspire dozens of other open source projects, pattern and component libraries. But newer CSS frameworks and approaches were taking hold, and slowly the community moved on to other projects. The UI team and jQuery Mobile teams merged, and the group focused more on maintenance and compatibility with jQuery Core.  

jQuery UI became an OpenJS Foundation Emeritus project in 2018, recognizing that it was winding down while noting the significance it had for the JavaScript ecosystem.

Celebrating jQuery UI Maintainers and Contributors

The scope of the project and the inclusiveness of the community was responsible for helping countless web makers develop a love and appreciation for user experience, localization, internationalization, accessibility, and clean, reusable code. Though many hours of work and contribution went into making jQuery UI a successful library, the jQuery UI core team deserves extra recognition for more than a decade of hard work shepherding the work and the community throughout the project’s lifecycle. Alex Schmitz, Jörn Zaefferer, Felix Nagel, Mike Sherov, Rafael Xavier de Souza, and Scott González led a team of many core contributors and more than 300 additional authors.

Additional gratitude is owed to Michał Gołębiowski-Owczarek for preparing the 1.13 release and stewarding the repository for the past year. 

OpenJS Foundation will forever be grateful for the work of these open source developers and the impact they had on the ecosystem through their work. Please join us in celebrating these developers and jQuery UI!

Source: jQuery UI

jQuery UI 1.13.0 released

After a long break, it is our pleasure to announce the 1.13.0 release. The main focus of this release was improving compatibility with recent jQuery versions so we postponed most breaking changes like removal of deprecated APIs and removal of legacy browser support to a possible future release.

Usage of deprecated jQuery APIs have been removed. jQuery UI 1.13 triggers no jQuery Migrate warnings when running its test suite against jQuery 3.6.0 with jQuery Migrate 3.3.2, i.e. the latest versions at the moment of this release.

A few security issues have been fixed:

Support for jQuery 1.7 has been dropped; jQuery 1.8 & newer remain supported.

In this release, all individual module files as well as bundled jQuery UI copies produced by the Download Builder have all its code running in strict mode. This shouldn’t matter for most users as jQuery has been running in strict mode since 3.0 released in 2016.

Apart from that, two small features were added:

  1. Accordion’s header option may now accept not only a selector matching header elements but also a function taking the accordion element as a parameter and returning the header elements; more details in the docs for the header option.
  2. Datepicker options now include the optional onUpdateDatepicker callback, called when the datepicker widget’s DOM is updated.

To simplify the maintenance of jQuery UI, we’re sunsetting the old bug tracker at https://bugs.jqueryui.com (we’ll keep it in read-only mode) in favor of GitHub issues.

jQuery UI has struggled with finding contributors for the past few years; our goal is to move it more to a maintenance state: we’ll make sure the library is compatible with new jQuery releases and that security issues are fixed but no new significant feature work is planned. We’ll also try to fix important regressions from jQuery UI 1.12.1; older long-standing bugs may not get fixed. We’ll get a longer blog post about the state of jQuery UI when we release 1.13 final. Note that this does not affect jQuery Core which is still actively maintained.

Download

File Downloads

Git (contains source files, with @VERSION replaced with 1.13.0, base theme only)

Install via bower

  • bower install jquery/jquery-ui#1.13.0

jQuery CDN, powered by StackPath

Google Ajax Libraries API (CDN)

Microsoft Ajax CDN (CDN)

Custom Download Builder

Changelog

See the 1.13 Upgrade Guide for a list of changes that may affect you when upgrading from 1.12.x. For full details on what’s included in this release see the 1.13.0 Changelog.

Thanks

Thanks to all who helped with this release, specifically: A. Wells, Albert Johansson, Alexander Schmitz, c-lambert, claudi, Eirik Sletteberg, Evelyn Masso, Fatér Zsolt, Felix Nagel, Florian Wegscheider, Gez Quinn, GitHub, Horus68, Hrvoje Novosel, Jeremy Mickelson, jigar gala, Jo Liss, Jérémy Munsch, Jörn Zaefferer, Kevin Cupp, Konstantin Dinev, Kyle Rosenberg, Luke Brookhart, Maksymenkov Eugene, Micah Miller, Michał Gołębiowski-Owczarek, Mikolaj Wolicki, milk54, OskarNS, pallxk, Patrick McKay, Paul Capron, Petri Partio, Robert Brignull, Robin, Ryan Oriecuia, sakshi87, Scott González, Sergei Ratnikov, Simon Asika, Szabolcs Szabolcsi-Toth.

Comments

Note: please report bugs to the jQuery UI Bug Tracker; support questions should be posted on Stack Overflow with the jquery-ui tag. Please don’t use comments to report bugs.

If you have feedback on us doing our release for jQuery UI 1.13.0, feel free to leave a comment below. Thank you.

Source: jQuery UI

jQuery UI 1.13.0-rc.3 released

We’re happy to announce the 1.13.0-rc.3 release of jQuery UI. The only changes in that version compared to 1.13.0-rc.2 that we announced a few weeks ago are fixes to themes.

Due to a CSS specificity issue, blank icons in 1.13.0-rc.2 weren’t actually blank; we increased the specificity of a relevant selector to fix the issue.

The next set of issues were caused by a few changes to themes that were made to fix other issues and to improve how various themes look. Unfortunately, those changes were incomplete and caused bigger issues. Given the maintenance status of jQuery UI, we’ve decided to revert the changes instead. While it brings some issues from jQuery UI 1.12 back, those issues have been there for many years so existing projects already had to adapt. Old & known bugs are better than new & unknown ones, especially with limited resources to maintain the project. This should also make it easier to update from jQuery UI 1.12 to 1.13.

See the 1.13.0-rc.2 blog post for more details about the goals of the 1.13 release.

Download

File Downloads

Git (contains source files, with @VERSION not yet replaced with 1.13.0-rc.3, base theme only)

Comments

Note: please report bugs to the jQuery UI Bug Tracker; support questions should be posted on Stack Overflow with the jquery-ui tag. Please don’t use comments to report bugs.

If you have feedback on us doing our RC release for jQuery UI 1.13.0, feel free to leave a comment below. Thank you.

Source: jQuery UI

jQuery UI 1.13.0-rc.2 released

After a long break, it is our pleasure to announce the 1.13.0-rc.2 release. The release is feature-complete, we just wanted to give developers some time to test it & report any critical issues before we release the final. We didn’t find any such issues during our internal testing. If no blocking issues get reported, we expect to release 1.13.0 final in a few weeks.

You might be wondering what happened to 1.13.0-rc.1. A critical issue in the release script made the final built file not work at all, only individual AMD modules were fine. This made us not announce that release.

The main focus of this release was improving compatibility with recent jQuery versions so we postponed most breaking changes like removal of deprecated APIs and removal of legacy browser support to a possible future release.

Usage of deprecated jQuery APIs have been removed. jQuery UI 1.13 triggers no jQuery Migrate warnings when running its test suite against jQuery 3.6.0 with jQuery Migrate 3.3.2, i.e. the latest versions at the moment of this release.

Support for jQuery 1.7 has been dropped; jQuery 1.8 & newer remain supported.

In this release, all individual module files as well as bundled jQuery UI copies produced by the Download Builder have all its code running in strict mode. This shouldn’t matter for most users as jQuery has been running in strict mode since 3.0 released in 2016.

Apart from that, two small features were added:

  1. Accordion’s header option may now accept not only a selector matching header elements but also a function taking the accordion element as a parameter and returning the header elements; more details in the docs for the header option.
  2. Datepicker options now include the optional onUpdateDatepicker callback, called when the datepicker widget’s DOM is updated.

To simplify the maintenance of jQuery UI, we’re sunsetting the old bug tracker at https://bugs.jqueryui.com (we’ll keep it in read-only mode) in favor of GitHub issues.

jQuery UI has struggled with finding contributors for the past few years; our goal is to move it more to a maintenance state: we’ll make sure the library is compatible with new jQuery releases and that security issues are fixed but no new significant feature work is planned. We’ll also try to fix important regressions from jQuery UI 1.12.1; older long-standing bugs may not get fixed. We’ll get a longer blog post about the state of jQuery UI when we release 1.13 final. Note that this does not affect jQuery Core which is still actively maintained.

Download

File Downloads

Git (contains source files, with @VERSION not yet replaced with 1.13.0-rc.2, base theme only)

Comments

Note: please report bugs to the jQuery UI Bug Tracker; support questions should be posted on Stack Overflow with the jquery-ui tag. Please don’t use comments to report bugs.

If you have feedback on us doing our RC release for jQuery UI 1.13.0, feel free to leave a comment below. Thank you.

Source: jQuery UI

jQuery project updates addressing temporary CDN issues

As part of its ongoing infrastructure updates, the jQuery infrastructure team is making configuration and deployment changes to address intermittent outages reported by some users. The issue is the result of faulty IP allowlisting which affects users downloading jQuery project assets from certain IP addresses.

This issue is expected to be resolved in the next few weeks. In the interim, users can mitigate the issue by downloading and serving the files they need.

CDN migration is part of a package of infrastructure improvement projects the project has been undertaking this year. The infrastructure team plans to provide a full overview of these improvements, which will help support the long-term maintenance of jQuery and its related projects, later this summer.

jQuery continues to be a widely-used open source project with active maintainers. While many sites host jQuery locally, others rely upon the jQuery CDN to deliver the library on demand. On average, the jQuery CDN delivers over 2 petabytes of code per month. The project is hosted at the OpenJS Foundation, the vendor-neutral organization to grow and sustain the JavaScript and web ecosystem.

Source: jQuery

jQuery 3.6.0 Released!

jQuery 3.6.0 has been released! In jQuery 3.5.0, the major change was a security fix for the html prefilter. This release does not include a security fix, but does have some good bug fixes and improvements. We still have our eyes on a jQuery 4.0 release, but until then we will continue to support the 3.x branch and address important issues.

As usual, the release is available on our cdn and the npm package manager. Other third party CDNs will probably have it soon as well, but remember that we don’t control their release schedules and they will need some time. Here are the highlights for jQuery 3.6.0:

Returning JSON even for JSONP errors

You may have guessed from the minor version that a feature snuck into this release. In previous versions, when a JSONP request responded with an error, often the response was still an executable script. We’ve changed the default behavior to try and execute the response in this situation. Normal scripts will still be skipped when an error is encountered. See gh-4771 for more information.

Fixes

One bug worth highlighting has to do with redirecting focus to another element in a focus handler. Take this example where a focus handler is triggered inside another focus handler:

elem1.on( "focus", function() {
  elem2.trigger( "focus" );
} );

Due to their synchronous nature everywhere outside of IE, a fix added in 3.4.0 to leverage native events caused the native .focus() method to be called last for the initial element, making it steal the focus back. While the code continues to leverage native focus and blur events, we were able to fix this by aligning even more with native methods and only propagating the last focus event up the DOM tree.

Other bug fixes and improvements include a fix for retrieving dimensions on table rows in Firefox, a fix for a crash in Chrome when a focusout event was triggered on a removed element, several improvements to some tests, and more. You’ll find the full changelog below.

Upgrading

Aside from the change to no longer ensure XHTML-compliant tags for you, we do not expect other compatibility issues when upgrading from a jQuery 3.0+ version. To upgrade, have a look at the new 3.5 Upgrade Guide. If you haven’t yet upgraded to jQuery 3+, first have a look at the 3.0 Upgrade Guide.

The jQuery Migrate plugin will help you to identify compatibility issues in your code. Please try out this new release and let us know about any issues you experienced.

If you can’t yet upgrade to 3.5+, Daniel Ruf has kindly provided patches for previous jQuery versions.

Download

You can get the files from the jQuery CDN, or link to them directly:

https://code.jquery.com/jquery-3.6.0.js

https://code.jquery.com/jquery-3.6.0.min.js

You can also get this release from npm:

npm install jquery@3.6.0

Slim build

Sometimes you don’t need ajax, or you prefer to use one of the many standalone libraries that focus on ajax requests. And often it is simpler to use a combination of CSS and class manipulation for web animations. Along with the regular version of jQuery that includes the ajax and effects modules, we’ve released a “slim” version that excludes these modules. The size of jQuery is very rarely a load performance concern these days, but the slim build is about 6k gzipped bytes smaller than the regular version. These files are also available in the npm package and on the CDN:

https://code.jquery.com/jquery-3.6.0.slim.js

https://code.jquery.com/jquery-3.6.0.slim.min.js

These updates are already available as the current versions on npm and Bower. Information on all the ways to get jQuery is available at https://jquery.com/download/. Public CDNs receive their copies today, please give them a few days to post the files. If you’re anxious to get a quick start, use the files on our CDN until they have a chance to update.

Thanks

Thank you to all of you who participated in this release by submitting patches, reporting bugs, or testing, including Dallas Fraser, Michal Golebiowski-Owczarek, Wonseop Kim, Wonhyoung Park, Beatriz Rezener, Natalia Sroka, and the whole jQuery team.

Changelog

Full changelog: 3.6.0

Ajax

Core

Deferred

Dimensions

  • Modify reliableTrDimensions support test to account for FF (#4529, bcd40aa7)

Docs

  • Change JS Foundation mentions to OpenJS Foundation (db43ef0b)

Event

Selector

Support

  • ensure display is set to block for the support div (#4844) (#4832, f8bdb127)

Tests

  • Fix tests for not auto-executing scripts without dataType (7298e04f)
  • Skip the jQuery.parseXML error reporting test in Legacy Edge (bf06dd47)
  • Fix the jQuery.parseXML error reporting test (1ec36332)
  • Recognize callbacks with dots in the Node.js mock server (4c572a7f)
  • Skip the “jQuery.ajax() on unload” test in Safari (4f016c64)
  • Remove an unused local variable (beea433d)
  • Remove remaining obsolete jQuery.cache references (5e028c76)
  • Remove obsolete jQuery data tests (8ad78cdb)

Source: jQuery

jQuery 3.5.1 Released: Fixing a Regression

I’ve never gotten to say this on a jQuery release, but May the 4th be with you! A short time ago in a galaxy exactly like this one, we released jQuery 3.5.0. We have a quick fix for a regression in that release.

Specifically, we had changed our internal data object to use Object.create( null ) instead of a plain object ({}). We did that to prevent collisions with keys on Object.prototype properties. However, this also meant that users (especially plugins) could no longer check what was in jQuery data with the native .hasOwnProperty() method, and it broke some code. We’ve reverted that change, but plan to put it back in jQuery 4.0. This change is the only code change in this release. Other changes include some minor updates to our docs and build system.

Security fixes in 3.5.0

jQuery 3.5.0 included fixes for two security issues in jQuery’s DOM manipulation methods, as in .html(), .append(), and the others. Security advisories for both of these issues have been published on GitHub. While we provided all of the details on the first issue in the jQuery 3.5.0 blog post, we did not provide all of the details on the second and would like to do that in this post.

The second issue was very similar to the first. It was an XSS vulnerability that had to do with passing <option> elements to jQuery’s DOM manipulation methods. Essentially, we’re using a regex to wrap <option> elements with <select> elements to ensure those elements get parsed correctly in old IE (IE <= 9 replaces any <option> tags with their contents when inserted outside of a <select> element).

Our fix is to only apply this code where it is needed. Fortunately, because of the different parsing behavior in IE9, we can keep the fix in IE9 without exposing it to the same vulnerability as other browsers. Please upgrade when you get a chance to avoid these vulnerabilities.

Upgrading

If you haven’t yet upgraded to jQuery 3.5, have a look at the 3.5 Upgrade Guide. If you haven’t yet upgraded to jQuery 3+, first have a look at the 3.0 Upgrade Guide. Also, the jQuery Migrate plugin will help you to identify compatibility issues in your code.

If you can’t yet upgrade to 3.5+, Daniel Ruf has kindly provided patches for previous jQuery versions. Please try out this new release and let us know about any issues you experienced.

Download

You can get the files from the jQuery CDN, or link to them directly:

https://code.jquery.com/jquery-3.5.1.js

https://code.jquery.com/jquery-3.5.1.min.js

You can also get this release from npm:

npm install jquery@3.5.1

Slim build

Sometimes you don’t need ajax, or you prefer to use one of the many standalone libraries that focus on ajax requests. And often it is simpler to use a combination of CSS and class manipulation for web animations. Along with the regular version of jQuery that includes the ajax and effects modules, we’ve released a “slim” version that excludes these modules. The size of jQuery is very rarely a load performance concern these days, but the slim build is about 6k gzipped bytes smaller than the regular version. These files are also available in the npm package and on the CDN:

https://code.jquery.com/jquery-3.5.1.slim.js

https://code.jquery.com/jquery-3.5.1.slim.min.js

These updates are already available as the current versions on npm and Bower. Information on all the ways to get jQuery is available at https://jquery.com/download/. Public CDNs receive their copies today, please give them a few days to post the files. If you’re anxious to get a quick start, use the files on our CDN until they have a chance to update.

Thanks

Thank you to all of you who participated in this release by submitting patches, reporting bugs, or testing, including Pierre Grimaud, Michal Golebiowski-Owczarek, Ed S, vanillajonathan, and the whole jQuery team.

Changelog

Full changelog: 3.5.1

Build

  • Test on Node.js 14, stop testing on Node.js 8 & 13 (205dd134)
  • Enable reportUnusedDisableDirectives in ESLint (b21d6710)
  • Updating the 3.x-stable version to 3.5.1-pre. (898784ab)

Data

Docs

Tests

  • Workaround failures in recent XSS tests in iOS 8 – 12 (ea2d0d50)
  • Add tests for recently fixed manipulation XSS issues (58a8e879)
  • Cleanup `window` & `document` handlers in a new event test (c1c0598d)
  • Fix flakiness in the “jQuery.ajax() – JSONP – Same Domain” test (46ba70c5)

Source: jQuery