• round measured container width to whole pixels (#2271) - #2272 by @STRML
• pass the native event to resize callbacks (#2264) - #2274 by @STRML
• measure the content box in useContainerWidth's measureWidth - #2273 by @STRML

• measure the content box in useContainerWidth's measureWidth - #2273 by @STRML

July 29, 2026

• Fixed a TypeError when resizing events in dayGrid views and in the all-day slot (656)
• Fixed incorrect date calculation when resizing events in dayGrid views, in the all-day slot and in the popup (658)

Special thanks to the following sponsors of EventСalendar:

@ekwi-tech @syncsynchalt @aurawindsurfing

• #17543 bbc1ec9 Thanks @ematipico! - Fixes a bug where Cloudflare couldn't load chunked collections via experimental.collectionStorage: 'chunked'.

• Updated dependencies []:

  • @astrojs/underscore-redirects@1.0.3

• #17536 ff97b86 Thanks @dmgawel! - Fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes

• #17383 296e1b0 Thanks @thelazylamaGit! - Fixes stale dev CSS after editing component style blocks and CSS files in dev

• #17543 bbc1ec9 Thanks @ematipico! - Adds a feature to experimental.collectionStorage that allows to change the size of chunks.

  For example, you can reduce the size of chunks to 1MB:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  
  export default defineConfig({
    experimental: {
      collectionStorage: {
        type: 'chunked',
        chunkSize: 1024 * 1024,
      },
    },
  });

• #17545 5214663 Thanks @ematipico! - Bumps the Astro compiler to the latest version. Changelog.

• fix(ssl-certificate): restrict development TLS credentials
• feat+fix(app-vite): safeguard build artifact cleanup; new prop (boolean, default false) for quasar.config > build > allowOutsideProjectDistDir
• fix(app-vite): SSR/SSG -> secure error diagnostics while on development
• fix(app-vite): validate SSR/SSG nonce attributes

• feat(app-vite): BEX -> adapt to latest Vite specs on HMR protocol/port/etc
• feat+fix(app-vite): dev -> preserve Electron app identity (#18467)
• feat(app-vite): dev -> preserve Electron app tray icon for Linux & macOS hosts too (already handled for Windows)
• feat+refactor+fix(app-vite): vue-devtools > should be handled by --devtools or quasar.config > devServer > vueDevtools; fix types; use vite-plugin-vue-devtools

• fix(app-vite): dev -> re-generate entry files when quasar.config > build > vueRouterMode changes

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

• Becoming a sponsor on Github
• One-off donation via PayPal

This is the optional globally-installed part of the Quasar CLI

• fix(ssl-certificate): restrict development TLS credentials

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider the following:

• Becoming a sponsor on Github
• One-off donation via PayPal

• Fix the bright outline around MSDF text glyphs by @mvaligursky in #9139

Full Changelog: https://github.com/playcanvas/engine/compare/v2.21.2...v2.21.3

3.3.3 is a security release. It closes a critical unauthenticated arbitrary-file-read in the /static/* handler (GHSA-mc8w-wjhw-45x5) and bundles the fixes for a batch of privately reported issues that had already landed on develop: an OpenID Connect provider hardcoded cookie key and permissive CORS reflection (GHSA-pp5v-mvwg-76mp), session-fixation on authentication (GHSA-73h9-c5xp-gfg4), a same-socket cross-pad write TOCTOU (GHSA-6mcx-x5h6-rpw2), and a pad-id delimiter injection in copyPad/movePad (GHSA-wg58-mhwv-35pq). Alongside the security work it migrates the server build to TypeScript 7 (tsgo), fixes PageDown/PageUp navigation across consecutive long wrapped lines, and makes the docker plugin_packages volume mountpoint writable.

• Prevent pre-auth path traversal / arbitrary file read in /static/* (GHSA-mc8w-wjhw-45x5, #8081). On POSIX a backslash is an ordinary filename byte, so sanitizePathname() deliberately leaves an ..\..\.. segment untouched — but Minify.ts then converted backslashes to forward slashes unconditionally, after the sanitiser, turning those bytes back into ../ traversal components with no re-check. Because the route is mounted on expressPreSession (before the auth middleware), any unauthenticated client could read any file readable by the Etherpad process — e.g. GET /static/plugins/ep_etherpad-lite/static/..%5C..%5C..%5Cetc/passwd — escalating via disclosed settings.json/credentials.json//proc/self/environ to an admin session and, through the plugin installer, RCE. The backslash conversion is now guarded to Windows only (path.sep === '\\'), matching the invariant already enforced in sanitizePathname.ts. Adds a backend regression test that fails on the pre-fix code. Reported by @gcm-explo1t.
• Stop shipping a hardcoded OIDC cookie key and reflecting arbitrary CORS origins (GHSA-pp5v-mvwg-76mp, #8070, #8071, #8072). The embedded OpenID Connect provider shipped a hardcoded cookie-signing key (allowing forged provider cookies) and clientBasedCORS reflected any request Origin. The provider now derives its cookie keys from the instance secret, CORS reflection is constrained, the soffice export path strips remote images to match the native path, and public routes that echo x-proxy-path set Vary to prevent cache poisoning. Reported by meifukun.
• Regenerate the session id on authentication (GHSA-73h9-c5xp-gfg4, #8074). Etherpad did not rotate the session identifier when a user authenticated, so a pre-auth session id fixed by an attacker (most impactfully via ep_openid_connect SSO) survived login, enabling session-fixation account/admin takeover. The session id is now regenerated on the authentication boundary.
• Apply queued USER_CHANGES to the enqueue-time pad (GHSA-6mcx-x5h6-rpw2, #8075). A same-socket CLIENT_READY pad-swap could redirect an already-queued USER_CHANGES onto a different (read-only or unauthorized) pad, a cross-pad write. Queued changes are now bound to the pad they were enqueued against.
• Reject the ueberdb key delimiter : in copyPad/movePad destination ids (GHSA-wg58-mhwv-35pq, #8073). A destination id containing : could bypass the force=false overwrite guard and corrupt another pad's revision records. Such ids are now rejected.

• Migrate the server build to TypeScript 7 / tsgo (#8039). The server now type-checks and builds under the native-Go TypeScript compiler.

• Editor — PageDown/PageUp now advance across consecutive long wrapped lines (#7555). Paging no longer stalls when several long soft-wrapped lines follow one another.
• Docker — make the plugin_packages volume mountpoint writable (#8042). Mounting a plugin-packages volume no longer fails on a read-only mountpoint.

3.3.3 is a security release. It closes a critical unauthenticated arbitrary-file-read in the /static/* handler (GHSA-mc8w-wjhw-45x5) and bundles the fixes for a batch of privately reported issues that had already landed on develop: an OpenID Connect provider hardcoded cookie key and permissive CORS reflection (GHSA-pp5v-mvwg-76mp), session-fixation on authentication (GHSA-73h9-c5xp-gfg4), a same-socket cross-pad write TOCTOU (GHSA-6mcx-x5h6-rpw2), and a pad-id delimiter injection in copyPad/movePad (GHSA-wg58-mhwv-35pq). Alongside the security work it migrates the server build to TypeScript 7 (tsgo), fixes PageDown/PageUp navigation across consecutive long wrapped lines, and makes the docker plugin_packages volume mountpoint writable.

• Prevent pre-auth path traversal / arbitrary file read in /static/* (GHSA-mc8w-wjhw-45x5, #8081). On POSIX a backslash is an ordinary filename byte, so sanitizePathname() deliberately leaves an ..\..\.. segment untouched — but Minify.ts then converted backslashes to forward slashes unconditionally, after the sanitiser, turning those bytes back into ../ traversal components with no re-check. Because the route is mounted on expressPreSession (before the auth middleware), any unauthenticated client could read any file readable by the Etherpad process — e.g. GET /static/plugins/ep_etherpad-lite/static/..%5C..%5C..%5Cetc/passwd — escalating via disclosed settings.json/credentials.json//proc/self/environ to an admin session and, through the plugin installer, RCE. The backslash conversion is now guarded to Windows only (path.sep === '\\'), matching the invariant already enforced in sanitizePathname.ts. Adds a backend regression test that fails on the pre-fix code. Reported by @gcm-explo1t.
• Stop shipping a hardcoded OIDC cookie key and reflecting arbitrary CORS origins (GHSA-pp5v-mvwg-76mp, #8070, #8071, #8072). The embedded OpenID Connect provider shipped a hardcoded cookie-signing key (allowing forged provider cookies) and clientBasedCORS reflected any request Origin. The provider now derives its cookie keys from the instance secret, CORS reflection is constrained, the soffice export path strips remote images to match the native path, and public routes that echo x-proxy-path set Vary to prevent cache poisoning. Reported by meifukun.
• Regenerate the session id on authentication (GHSA-73h9-c5xp-gfg4, #8074). Etherpad did not rotate the session identifier when a user authenticated, so a pre-auth session id fixed by an attacker (most impactfully via ep_openid_connect SSO) survived login, enabling session-fixation account/admin takeover. The session id is now regenerated on the authentication boundary.
• Apply queued USER_CHANGES to the enqueue-time pad (GHSA-6mcx-x5h6-rpw2, #8075). A same-socket CLIENT_READY pad-swap could redirect an already-queued USER_CHANGES onto a different (read-only or unauthorized) pad, a cross-pad write. Queued changes are now bound to the pad they were enqueued against.
• Reject the ueberdb key delimiter : in copyPad/movePad destination ids (GHSA-wg58-mhwv-35pq, #8073). A destination id containing : could bypass the force=false overwrite guard and corrupt another pad's revision records. Such ids are now rejected.

• Migrate the server build to TypeScript 7 / tsgo (#8039). The server now type-checks and builds under the native-Go TypeScript compiler.

• Editor — PageDown/PageUp now advance across consecutive long wrapped lines (#7555). Paging no longer stalls when several long soft-wrapped lines follow one another.
• Docker — make the plugin_packages volume mountpoint writable (#8042). Mounting a plugin-packages volume no longer fails on a read-only mountpoint.