• Fix ISR misses with backslashes in segments when deployed on Windows: #97876
• [next/image]: disable avif image optimization: #97875
• fix(wasm): don't enable SWC's plugin host for wasm targets: #97859
• fix(turbopack-node): make process_pool inert on wasm: #97858
• fix(turbopack): make the SWC wasm-plugin backend native-only: #97857
• fix(turbopack-trace-utils): skip the ctrl-c handler on wasm: #97856
• refactor(turbopack-cli-utils): replace crossterm with owo-colors: #97855
• fix(turbo-tasks-fs): create symlinks through the WASI API on wasi: #97854
• fix(turbo-tasks): compile EventListener::wait on wasm: #97853
• fix(turbo-rcstr): allow the napi feature on wasm targets: #97852
• fix(next-napi-bindings): detect the target, not the host, in build.rs: #97576
• Stop printing a stack frame for error message text: #97829
• docs: clarify revalidateTag profile expire semantics: #97836
• docs: param access on use-server: #97865
• docs: fix typos and correctness issues in App Router docs: #97823
• Add deploy release test skill: #97563
• [test] Deflake the page config test for a string config value: #97848
• test: stabilize read-only page recreation: #97674
• Show the errors of an AggregateError behind a cause: #97830
• Upgrade React from eafeac09-20260819 to bd6ea412-20260824: #97812
• fix: reuse a single drain listener when piping Node streams through gzip: #97698
• test: preserve server cache after compile error: #97724

Huge thanks to @eps1lon, @sokra, @unstubbable, @icyJoseph, @timneutkens, @hamidrezahanafi, and @wbinnssmith for helping!

• #5974 8c42922 - Minimap still works after ReactFlow remounts

• #5962 cbf40b9 - Show log if user hides attribution in development

• #5976 3319ef4 - Fix the MiniMap zooming out to include the origin when every node is hidden.

• #5955 965ca70 - Fix MiniMap calling useCallback conditionally for onNodeClick.

• #5962 cbf40b9 - Show log if user hides attribution in development

• #5976 3319ef4 - Fix the MiniMap zooming out to include the origin when every node is hidden.

• #5959 ad025cf - Fix unnecessary edge rerenders

[!IMPORTANT] Two behavior changes worth checking before you upgrade:

• A click on the target no longer closes a hover-opened QMenu/QBtnDropdown while it is still animating into view. A single move-and-click gesture can no longer dismiss what it just opened; once the menu is fully shown, clicking toggles it closed exactly as before.
• Three language packs now report a standards-compliant isoName: kur-CKB reports ckb, mm reports my and sr-CYR reports sr-Cyrl. The old import paths keep working as deprecated aliases for the whole of Quasar v2, but code comparing $q.lang.isoName against the old values needs updating.

• feat(QFab): open on hover -> new hover, hover-delay and hover-hide-delay props, the same contract QMenu and QBtnDropdown got in v2.26. The pointer can cross the gap between the main button and the actions without closing them (150ms grace period by default), touch devices keep tap-toggling, keyboard interaction is untouched, and focus is never moved
• feat(QTd/QTh): new col-name prop -> a QTd or QTh wrapped in your own component inside QTable's #body slot can finally say which column it belongs to. The cells used to resolve their column from the vnode key, which Vue never forwards through $attrs, so a wrapped cell rendered nothing. Existing key="..." usage keeps working; col-name takes precedence (#17830)
• feat(ui/lang): canonical names for three language packs -> import quasar/lang/ckb, quasar/lang/my and quasar/lang/sr-Cyrl for Central Kurdish, Burmese and Serbian Cyrillic. kur-CKB, mm and sr-CYR remain available as deprecated aliases

• fix(QMenu): ignore a click on the target while hover is animating the menu into view -> moving the pointer onto a hover menu's target and clicking it in one gesture closed the menu the hover had just opened. Also applies to QBtnDropdown (#18524)
• fix(QSelect): keep long selected values inside the parent -> a nowrap value made the field grow past its container instead of truncating (#18015). Based on PR #18525 by Timur Arbaev
• fix(QTable): honor the key set on the grid item slot content -> the mapped rows reached Vue as keyless Fragments, so removing a row recreated every card after it instead of moving the surviving instances (#18045)
• fix(QScrollArea): put the vertical thumb on the left side in RTL -> the bar moved to the left edge while the thumb stayed glued to the right one, because its inline right inset could not be flipped by the RTL stylesheet (#17943)
• fix(ui): make overlay content clickable over .q-electron-drag regions in Electron -> menus, dialogs, notifications and tooltips overlapping a draggable title bar lost the overlapping area to window dragging. An explicit drag class on the content itself still wins, and dialogs keep letting you drag the window (#17285)
• fix(use-mask): don't read a fill char that satisfies its own token as data -> with fill-mask="0" and reverse filling, the unmasked value grew by one fill char per keystroke ("0.01" became "00.01", "000.10", ...), which is the docs' own "Price with 2 decimals" example (#18523)
• fix(use-mask): keep the fill padding out of the unmasked value -> with unmasked-value and forward filling, a typed "1" over ###-## with fill-mask="0" was reported as "10000"; with mask AA-AA and fill-mask="A", "X" became "XAAA" (#18523)
• fix(use-mask): follow the data, not the render, when placing the caret -> when the fill char is itself a valid data char, "06" arrived as "60" and, on masks with a leading literal, "09" arrived as "90" (#18523)
• fix(use-mask): unmask masks that mix token types -> under reverse-fill-mask, every mask mixing letters and digits silently rendered nothing for ordinary values ("ab12" over AA-##), including values the control had just rendered itself (#18523)
• fix(use-mask): drop a right-aligned separator nothing filled -> "057" over AA-## rendered "-57", which unmasked back to "57", so what the field displayed was not a value it could read again (#18523)
• fix(ui/lang): repair strings across 51 language packs -> stray quotes and characters, leading/trailing/doubled spaces, broken interpolation, Cyrillic text inside the Latin sr pack, Simplified characters inside zh-TW, untranslated English left in translated packs, and year-range plural/agreement errors in some 40 languages (#18522). Ukrainian was corrected first in PR #18522 by Ihor Diachenko

• docs(popup offset): the offset prop of the position engine does not translate the popup, it inflates the anchor box, so middle/center origins are offset-invariant by construction. That is why QTooltip's horizontal offset reads as broken on its default anchor="bottom middle". Documented on the API of QMenu, QTooltip, QBtnDropdown, QPopupEdit and QSelect, with the direction each offset component expands in, plus the note that QMenu's cover drops the offset entirely (#18212)
• The language-pack build validator now checks string values, not only pack shape: validateStringArray was declared with four parameters and called with three, so its loop never ran. Every string, array entry and formatter result is now checked for padding, doubled spaces and control characters, and formatters are probed across the counts that select their plural branches

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

• Becoming a sponsor on Github
• One-off donation via PayPal

• fix(app-vite): bex -> the bridge now recovers on its own after the MV3 background script is terminated. Chrome (service worker) and Firefox (event page) shut the background down after ~30s of inactivity, taking every bridge port with it, and nothing ever came back: content script and app bridges stayed disconnected forever, while a revived background only knew about the port that woke it up. Store policies forbid keeping the background alive, so recovery happens inside the event-driven model instead: a (re)started background broadcasts a one-off message asking previously connected bridges to re-establish their ports, and a client bridge that lost its connection without an explicit disconnectFromBackground() reconnects transparently on its next send() (which also wakes the background up; concurrent calls share one connection attempt). send() also waits up to 1s for a target port that is not registered yet, covering ports that re-register right after a background restart. Cleanup after a failed connection was removing the onDisconnect handler from the wrong port event, which is fixed too (#17932)
• fix(app-vite): ssr/ssg -> stylesheets of shared chunks are now linked in the server-rendered HTML. Vite's SSR manifest only maps a module id to the files of the chunk that module ended up in, so as soon as a dependency is used from more than one place its CSS is hoisted into a shared chunk that is unreachable from ssrContext.modules -- the typical shape of an external component library used on several pages. The stylesheet then arrived only after hydration, as a flash of unstyled content. quasar.manifest.json is now assembled from both manifests Vite generates for the client build, completing each entry with the CSS of the chunks it statically imports (dynamic imports stay out, and so does CSS the HTML shell already carries). The CSS list is rebuilt depth-first through the static import graph rather than appended, so a dependency's rules land before the importer's and a server-rendered page cascades exactly like the same page reached through client-side navigation (#18171)
• fix(app-vite): dev server -> SSR/SSG-specific options are no longer ignored while the dev server runs. The mode flags live under ctx.mode, so both conditionals guarding those diffs were always falsy: changing ssr.pwa, ssr.middlewares, the manualStore* family, manualPostHydrationTrigger, or the SSR/SSG offline filename and service worker extenders silently did nothing (no entry regeneration, no service worker rebuild) until a full restart
• fix(app-vite): dev server -> reworked run/queue pipeline, fixing several long-standing rough edges. Watcher-triggered rebuilds (PWA manifest and custom service worker, BEX manifest, scripts and firefox UI, SSR webserver boots) now serialize with quasar.config-change runs instead of interleaving with them, and always act on the latest config rather than the one captured when the watcher was created. Toggling ssr.pwa / ssg.pwa while dev is running now works in both directions -- off-then-on previously left a stale snapshot so nothing recompiled, and disabling left the watchers running. A failed watcher rebuild no longer deadens every subsequent rebuild, and a failure while applying quasar.config changes no longer takes the dev server down through an unhandled rejection: both are logged and the server keeps serving. Rapid successive quasar.config edits now supersede cleanly (an obsolete run aborts at the next checkpoint, the newest config always wins) and duplicate pending rebuilds coalesce. clientNeedsReload semantics are now consistent across all modes (bex and pwa included), removing a redundant full reload right after a server reboot, and the SSR webserver reboots exactly when its own inputs change
• fix(app-vite): types -> the ssr/ssg > manualPostHydrationTrigger JSDoc now points out that it is needed when a Suspense boundary delays hydration (async setup()), and that the hook should then be called from the boundary's @resolve. Full recipe on the SSR and SSG configuring pages (#17961)

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

• Becoming a sponsor on Github
• One-off donation via PayPal

• fix(vite-plugin): client bundle alias with custom Vite modes -> production builds started with a custom mode name (vite build --mode qa, --mode staging, ...) no longer get the dev-server treatment. The plugin picked between aliasing bare quasar imports to the single-file client build and excluding quasar from dep prebundling by comparing Vite's mode against production, but the mode is only an env-file selector. The alias now follows command === 'serve', which is exactly what it was meant for: cutting the number of requests the dev server has to answer. The optimizeDeps.exclude half was dead weight and is gone, since Vite no longer prebundles deps during builds (#17942)

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

• Becoming a sponsor on Github
• One-off donation via PayPal

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Release version v3.34.2

2026-08-25

• Allow to analyze function return values in many more cases (#6065)

• #6065: feat: improve function return value tracking (@cyyynthia, @lukastaegert)
• #6482: Remove unused rendered module sources map (@yoominho91, @irontaek, @lukastaegert)
• #6483: chore(deps): update minor/patch updates (@renovate[bot])
• #6484: fix(deps): update swc monorepo (major) (@renovate[bot], @lukastaegert)
• #6485: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)
• #6486: chore(deps): lock file maintenance (@renovate[bot])