The fourth beta of Leaflet 2.0 fixes zoom animations getting cut short on pages with many markers, makes the layers control work from the keyboard, and fixes jitter during flyTo, along with over a dozen other fixes.

• Fix zoom animations getting cut short on pages with many markers, where a 250 ms fallback timer ended them before the browser got to run them, and stop forcing a style recalc of every marker when a zoom animation adds a tile level or a pointer moves during it
• Make animated panning (drag inertia, keyboard panning, panBy / panTo) with many markers several times faster in Chrome, which re-rendered every marker on every frame of the animation

• Hide a layer's attribution while the map zoom is outside the layer's minZoom / maxZoom (#5253, #7716)
• Use detectRetina only at a device pixel ratio of 1.5 or higher, so tile labels stay readable on screens scaled to 125% (#6721 by @vpithart)
• Don't capture pointers that start on form controls inside the map, so native widgets like the clear button of a search input work (#10567 by @Misyuk-T, #10565)
• Show tiles fully opaque when printing, even if they're still fading in (#3202)

• Make the layers control work from the keyboard: opening it moves focus into the list, Escape closes it and returns focus to the toggle, and moving focus out of it collapses it (#10560 by @ogchicken)

• Fix tiles, markers and overlays jittering during flyTo (#3194)
• Fix marker tooltips with direction set to top, bottom, left or center attaching to the wrong side of the icon (#7302, #7519)
• Fix icons in zoom and other bar control buttons not being centered, a regression in beta.3 (#10554)
• Fix LatLngBounds and Bounds throwing on empty arrays, such as an empty ring, a regression in beta.3 (#10569 by @ogchicken)
• Fix clicks on overlapping shapes from canvas renderers in panes with the same z-index going to the shape underneath, a regression in beta.3 (#10570 by @ogchicken)
• Fix circle radii and fitBounds / getBoundsZoom with projections that rotate the axes (#5246)
• Fix getCenter() of a polygon with all points on one line returning its first point (#10555 by @kevin9327)
• Fix distanceTo() returning NaN for some antipodal points (#10561 by @SwastikTripathi)
• Fix URL templates throwing on a space before the closing brace, like {x } (#10562 by @Kernel-Hunter)

• List the keyboard shortcuts and the core FullscreenControl in the accessibility tutorial (#10558 by @ogchicken)
• Fix the contrast and an invalid alt on the Translatable badge (#10556 by @ogchicken)

• Fix the build and check scripts on Windows (#10559 by @ogchicken)
• Fix GeoJSON specs that asserted nothing (#10564 by @dylanpulver)

• detectRetina needs a device pixel ratio of 1.5 or higher, up from anything above 1 (#6721)
• tooltipAnchor is mirrored for tooltips with direction: 'left' (not only auto ones that open to the left), is ignored for top and bottom tooltips, which attach to the middle of the icon's top or bottom edge, and only its y applies to center ones (#7302, #7519)
• Marker icons and shadows have will-change: transform, and a tile layer's container has the leaflet-zoom-animated class

• fix(Body): SSR brand colors could inject HTML or CSS -> on SSR, the config.brand colors are written into a <style> tag in the page head, and their names and values went in as-is. A value containing </style> closed the tag and whatever followed became page markup (a <script> included), while one containing } or ; could add CSS rules of its own. A brand color whose name or value contains <, {, } or ; is now left out of the server-rendered page, as no CSS color needs these characters. Only apps passing untrusted data as brand colors on the server were exposed; a brand set in the quasar.config file is not attacker-controlled
• fix(Lang): SSR language pack isoName could inject HTML -> on SSR, the isoName of the active language pack is written as the lang attribute of the <html> tag, unquoted and unescaped, so a name containing a space or > could add attributes to the tag or close it and inject markup. The lang attribute is now set only when isoName is a language tag (hyphen-separated groups of letters and digits, like en-US); otherwise only dir is. The client follows the same rule and removes the lang attribute for such a pack. Only apps building the language pack object from untrusted data were exposed; the packs shipped with Quasar are not affected, even when picked based on a request header or cookie. Behavior change: a custom pack whose isoName is not a language tag (en_US, or a missing one, which used to render lang=undefined) no longer gets a lang attribute

• fix(QTable/QTree/QField/QPopupEdit): memory leak in Chrome -> the first instance of these components to render a scoped slot was kept in memory for the lifetime of the page after being unmounted, along with its rows, vnodes and detached DOM. Chrome 153+ never releases the first getter defined on such a slot scope object, and that getter held on to the component instance. The props of the slot scopes (expand, selected, value, expanded, ticked, indeterminate, field) work as before (#18577)

• perf(Meta): SSR escaping -> the script and noscript content written by the Meta plugin on SSR no longer builds a regular expression on each call

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

• Becoming a sponsor on Github
• One-off donation via PayPal

• #4382 d44af25 Thanks @delucis! - Fixes a documentation example for the clientOptionsModule config

• #4332 ad19424 Thanks @RaphaelFakhri! - Fixes the twitter:site meta tag including a trailing slash when the configured X or Twitter social link ends with /

• #10967: fix: parse YAML documents that merge shared anchors into many operations

  Since yaml 2.9.1, merge keys (<<: *anchor) count toward the alias limit, so large API Gateway exports failed with "Excessive alias count indicates a resource exhaustion attack". The limit is now 100,000 and shared through YAML_MAX_ALIAS_COUNT from @scalar/helpers.

• #10979: Preserve question marks inside query values when merging a URL and path.

• #10977: Use the API title for JSON and YAML download filenames, encoding Unicode titles safely in the response headers.

• #10967: Use the shared YAML alias limit when editing structured YAML request bodies.

• #10967: Use the shared YAML alias limit when rendering RAML and Avro schemas.

• #10967: fix: parse YAML documents that merge shared anchors into many operations

  Since yaml 2.9.1, merge keys (<<: *anchor) count toward the alias limit, so large API Gateway exports failed with "Excessive alias count indicates a resource exhaustion attack". The limit is now 100,000 and shared through YAML_MAX_ALIAS_COUNT from @scalar/helpers.

• #10990: Use the canonical js target when generating JavaScript code examples.

• #10967: Use the shared YAML alias limit when generating JSON example documents.

• #10967: Use the shared YAML alias limit when importing API descriptions from URLs and embedded content.

• #10967: fix: parse YAML documents that merge shared anchors into many operations

  Since yaml 2.9.1, merge keys (<<: *anchor) count toward the alias limit, so large API Gateway exports failed with "Excessive alias count indicates a resource exhaustion attack". The limit is now 100,000 and shared through YAML_MAX_ALIAS_COUNT from @scalar/helpers.

• #10967: Use the shared YAML alias limit when validating YAML documents.

• #10937: fix: generate valid base64 examples for format: byte and contentEncoding: base64/base64url strings

• #10967: fix: parse YAML documents that merge shared anchors into many operations

  Since yaml 2.9.1, merge keys (<<: *anchor) count toward the alias limit, so large API Gateway exports failed with "Excessive alias count indicates a resource exhaustion attack". The limit is now 100,000 and shared through YAML_MAX_ALIAS_COUNT from @scalar/helpers.

• #10967: fix: parse YAML documents that merge shared anchors into many operations

  Since yaml 2.9.1, merge keys (<<: *anchor) count toward the alias limit, so large API Gateway exports failed with "Excessive alias count indicates a resource exhaustion attack". The limit is now 100,000 and shared through YAML_MAX_ALIAS_COUNT from @scalar/helpers.

• #10937: fix: generate valid base64 examples for format: byte and contentEncoding: base64/base64url strings

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

No changes in this release.

• @scalar/api-reference@1.78.1

• #10974: feat: add .NET 11 support (net11.0 target framework)

• #10973: Update Aspire.Hosting to 13.6.5 and MessagePack to 2.5.307 to resolve security advisories and NuGet package downgrade errors. Use Aspire's renamed Services property in resource configuration.

• @scalar/api-reference@1.78.1

• #10974: feat: add .NET 11 support (net11.0 target framework)

• @scalar/api-reference@1.78.1

• #10974: feat: add .NET 11 support (net11.0 target framework)

• @scalar/api-reference@1.78.1

• #10974: feat: add .NET 11 support (net11.0 target framework)

• #10974: feat: add .NET 11 support (net11.0 target framework)

• #10994: Publish a new patch release through PyPI trusted publishing to recover from the previous failed uploads.

• #10994: Publish a new patch release through PyPI trusted publishing to recover from the previous failed uploads.

• #10988: Use the shared theme reset for link text decoration.
• #10967: Use the shared YAML alias limit when parsing YAML in the collection editor.

• @scalar/api-reference@1.78.1

No changes in this release.

• @scalar/api-reference@1.78.1

No changes in this release.

• @scalar/api-reference@1.78.1

No changes in this release.

No changes in this release.

• @formatjs/cli: verify native Apple string resources (#7922) (f747e83)

• The following workspace dependencies were updated
  • optionalDependencies
    • @formatjs/cli-native-darwin-arm64 bumped to 1.1.35
    • @formatjs/cli-native-darwin-x64 bumped to 1.1.3
    • @formatjs/cli-native-linux-arm64 bumped to 1.2.35
    • @formatjs/cli-native-linux-arm64-musl bumped to 1.0.33
    • @formatjs/cli-native-linux-x64 bumped to 1.1.35
    • @formatjs/cli-native-linux-x64-musl bumped to 1.0.33
    • @formatjs/cli-native-win32-arm64 bumped to 1.1.3
    • @formatjs/cli-native-win32-x64 bumped to 1.1.36

• The following workspace dependencies were updated
  • dependencies
    • @formatjs/cli-lib bumped to 10.3.0

• @formatjs/cli: verify native Apple string resources (#7922) (f747e83)

• deps: update oxc to 0.157 (#7905) (ecf9930)

• macOS Apple Silicon: formatjs_cli-darwin-arm64
• Linux ARM64: formatjs_cli-linux-arm64
• Linux x86_64: formatjs_cli-linux-x64
• Windows x64: formatjs_cli-win32-x64.exe

# macOS (Apple Silicon)
curl -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.11.0/formatjs_cli-darwin-arm64
chmod +x formatjs_cli-darwin-arm64
sudo mv formatjs_cli-darwin-arm64 /usr/local/bin/formatjs

# Linux
curl -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.11.0/formatjs_cli-linux-x64
chmod +x formatjs_cli-linux-x64
sudo mv formatjs_cli-linux-x64 /usr/local/bin/formatjs

# Linux ARM64
curl -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.11.0/formatjs_cli-linux-arm64
chmod +x formatjs_cli-linux-arm64
sudo mv formatjs_cli-linux-arm64 /usr/local/bin/formatjs

# Windows x64 (PowerShell)
curl.exe -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.11.0/formatjs_cli-win32-x64.exe

Verify the checksums:

curl -LO https://github.com/formatjs/formatjs/releases/download/formatjs_cli_v1.11.0/checksums.txt
shasum -a 256 -c checksums.txt