Griefed/ServerPackCreator
Griefed/ServerPackCreator
Watch
1
0
Fork
You've already forked ServerPackCreator
 0
Code Issues 20 Pull requests Projects Releases 386 Packages Wiki Activity Actions

deps(deps): update dependency @quasar/app-vite to v3 - autoclosed #705

Closed
renovate-bot wants to merge 1 commit from renovate/quasar-app-vite-3.x into main
pull from: renovate/quasar-app-vite-3.x
merge into: Griefed:main
Conversation 1 Commits 1 Files changed 1 +1 -1
renovate-bot commented 2026-10-09 07:10:51 +02:00
Collaborator
Copy link

This PR contains the following updates:

Package Change Age Confidence
@quasar/app-vite (source) ^2.4.0 → ^3.0.0 age confidence

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

CVE-2026-106107 / GHSA-5m6h-8g35-p3m7

More information

Details

Several @​quasar/app-vite SSR and SSG renderer paths interpolate ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML.

Cryptographically generated base64 or base64url nonces are not directly affected because they do not contain HTML attribute delimiters. Exploitation requires an application to place attacker-controlled or otherwise unsafe data in ssrContext.nonce.

The remediation centralizes nonce handling across development SSR/SSG, production SSR, production SSG, critical CSS, store-state scripts, and Vue Devtools. It validates the value as a non-empty base64/base64url CSP nonce and HTML-encodes the attribute value before rendering.

Severity

  • CVSS Score: 8.3 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

CVE-2026-106105 / GHSA-fh39-c73x-5pjv

More information

Details

The @quasar/ssl-certificate development utility caches a combined PEM containing a generated private key and certificate without explicitly restricting its filesystem permissions. On systems with a typical process umask, the PEM can be readable by other local users. A local attacker with filesystem access could copy and reuse the private key to impersonate a development TLS endpoint in an environment that trusts the certificate.

The generated certificate was also unnecessarily CA-capable and included broad key usages beyond its localhost HTTPS purpose. Its IPv6 loopback entry was encoded as a DNS name rather than an IP subject alternative name.

The remediation writes and repairs the cached PEM with owner-only permissions on supported platforms, generates a non-CA server-auth leaf certificate with constrained key usage, corrects the IPv6 loopback SAN, and bases cache expiry on content modification time so permission metadata changes cannot extend the certificate lifetime. This issue does not expose the key remotely by itself; exploitation requires another local user to be able to read the cached PEM file.

Severity

  • CVSS Score: 8.4 / 10 (High)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

CVE-2026-106109 / GHSA-q9mq-245r-4g93

More information

Details

Summary

@quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project.

Details

The build command and mode builders passed the resolved output directory directly to fs-extra recursive removal. Existing symlink ancestors were not resolved before deletion either, so a path that appeared to be inside the project could operate on a directory outside it.

quasar.config is trusted application code, and no attacker-controlled input reaches build.distDir by default. This issue is primarily destructive-build safety hardening. It can become a security boundary when build configuration is generated or influenced by less-trusted automation.

Impact

Running a normal Quasar build with an unsafe build.distDir can delete data accessible to the build user before compilation begins.

Remediation

Validate the effective deletion target before every artifact cleanup. Always reject filesystem roots, the user home directory and the project root; resolve existing symlink ancestors; require an explicit build.allowOutsideProjectDistDir opt-in for external output directories; and log the exact resolved target before removal.

Severity

  • CVSS Score: 4.1 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its escape is bypassable

CVE-2026-106106 / GHSA-r5mf-4r5x-q78f

More information

Details

Summary

The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the developer's cloud keys, registry tokens and database URLs from a single unauthenticated GET. The same page embeds that data inside a <script> element behind a replaceAll('</script>', ...) guard that is ASCII-case-sensitive and requires a literal >, so </SCRIPT>, </script > and </script/> all escape the element and give script execution in the dev server's origin.

Details

renderSSRError() builds the page by splicing a JSON blob into a prebuilt bundle (utils/render-ssr-error/src/index.js):

errorHtml:
  before +
  JSON.stringify(data).replaceAll('</script>', String.raw`<\/script>`) +
  after

before and after are the two halves of the compiled error-page UI, split inside a <script type="module"> element, so data is emitted as a JS object literal in raw script text. The data itself comes from utils/render-ssr-error/src/env.js:

function getEnvironmentVariablesData () {
  return Object.keys(process.env).reduce((acc, name) => {
    acc[ name ] = process.env[ name ]
    return acc
  }, {})
}

export function getEnv (req) {
  return {
    Request: getRequestData(req),
    Headers: getHeadersData(req),
    Cookies: getCookiesData(req),
    'Shell environment variables': getEnvironmentVariablesData()
  }
}

The page is served by serve.devError({ err, req }) in app-vite/lib/modes/ssr/ssr-devserver.js and by the SSG equivalent, which the generated render middleware calls on any render exception. The dev server listens on every interface because app-vite/lib/quasar-config-file.js overrides Vite's localhost default:

} else if (!cfg.devServer.host) {
  cfg.devServer.host = '0.0.0.0'
}

The escape fails because the HTML tokenizer ends script raw text on </ followed by a case-insensitive script followed by any of tab, newline, form feed, space, / or >. replaceAll with a string pattern matches one exact spelling. </SCRIPT>, </ScRiPt>, </script > and </script/> are all untouched and all close the element. JSON.stringify does not escape < or >, and cookie values are additionally run through decodeURIComponent before being placed in the blob, so percent-encoded payloads decode into working markup.

The project already implements this correctly elsewhere. ui/src/plugins/meta/Meta.js uses a case-insensitive pattern with no trailing >:

function protectRawText (value, tagName) {
  return String(value).replaceAll(new RegExp(`</${tagName}`, 'gi'), `<\\/${tagName}`)
}
PoC

Harness that replicates the dev server's error branch using the published @quasar/render-ssr-error@2.2.3, with two canary values planted in the environment:

import http from 'node:http'
import renderSSRError from '@quasar/render-ssr-error'

process.env.AWS_SECRET_ACCESS_KEY = 'CANARY_AWS_SECRET_dev_machine_9f3a1c'
process.env.NPM_TOKEN = 'CANARY_npm_TOKEN_abcdef'

http.createServer((req, res) => {
  const err = new Error('Cannot read properties of undefined (reading "x")')
  const { errorHeaders, errorHtml } = renderSSRError({ err, req, rootFolder: process.cwd() })
  res.writeHead(500, errorHeaders)
  res.end(errorHtml)
}).listen(3200, '0.0.0.0')

Disclosure needs no payload at all. A plain GET / returns a 957 KB page containing both canaries:

ENV DISCLOSURE (plain GET, no injection): 2/2 canary secrets present in the 500 page
  -> CANARY_AWS_SECRET_dev_machine_9f3a1c, CANARY_npm_TOKEN_abcdef

For the injection, the payload goes in an ordinary request header. JSON.stringify escapes " as \", so the handler uses single quotes:

<TAG><img src=/nonexistent-image onerror='window.__QPWN=document.domain+":"+location.port'>

Loaded in headless Chromium:

POSITIVE  </SCRIPT >  (uppercase + space)   window.__QPWN=127.0.0.1:3200  injectedImg=1  ATTACKER SCRIPT EXECUTED
POSITIVE  </script >  (lowercase + space)   window.__QPWN=127.0.0.1:3200  injectedImg=1  ATTACKER SCRIPT EXECUTED
POSITIVE  </script/>  (lowercase + slash)   window.__QPWN=127.0.0.1:3200  injectedImg=1  ATTACKER SCRIPT EXECUTED
POSITIVE  </ScRiPt>   (mixed case)          window.__QPWN=127.0.0.1:3200  injectedImg=1  ATTACKER SCRIPT EXECUTED
NEG-CTRL  </script>   (what the filter matches)
                                            window.__QPWN=null            injectedImg=0  no execution

The negative control is the same payload with the one spelling replaceAll actually matches. Nothing is injected and nothing runs, which isolates the bug to the escape rather than to the surrounding page. Confirming the injection context, a probe header comes back inside the single <script type="module"> element:

..."Headers":{"host":"127.0.0.1:3200","user-agent":"curl/8.18.0","accept":"*/*",
   "x-probe":"</SCRIPT ><img src=/nope onerror=\"window.__QPWN=1\">MARKEREND"},...

No Content-Security-Policy is sent with the page.

Impact

Exposure of sensitive system information, plus HTML injection into a page that carries it. This is development only, since serve.devError does not exist in a production build, and it requires the app's SSR render to throw. That is the routine state this page exists to display, and an attacker who can reach the port can simply poll for it.

The disclosure is the substantive half and needs nothing but a TCP connection: shell environment, all request headers, all cookies, and ten lines of source around every stack frame. On a developer machine that typically means cloud credentials, npm or GitHub tokens and database connection strings. Because Quasar overrides Vite's localhost default with 0.0.0.0, everyone on the same network segment or in a shared container network can ask for it.

The injection is best treated as a chained issue on top of that rather than as a drive-by. A raw HTTP client can set the header but only poisons its own page. For the code to run in the developer's browser the payload has to travel with the developer's own request, which in practice means the cookie channel, since cookie values are URL-decoded and any page on a localhost or 127.0.0.1 origin can set a cookie that is sent to every port on that host. Cross-origin fetch does not work: CORS-safelisted headers forbid < and >, and browsers percent-encode them in the URL while req.url is never decoded.

Fixing the escape alone leaves the disclosure. Serializing with something that escapes <, such as the serialize-javascript already used correctly in app-vite/lib/modes/ssr/ssr-utils.js, closes the injection; redacting or omitting process.env and cookie values closes the disclosure; defaulting devServer.host to localhost as Vite does would reduce who can ask.

Severity

  • CVSS Score: 7.1 / 10 (High)
  • Vector String: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

quasarframework/quasar (@​quasar/app-vite)

v3.3.0

Compare Source

Security fixes

  • fix(ssl-certificate): restrict development TLS credentials
  • feat+fix(app-vite): safeguard build artifact cleanup; new prop (boolean, default false) for quasar.config > build > allowOutsideProjectDistDir
  • fix(app-vite): SSR/SSG -> secure error diagnostics while on development
  • fix(app-vite): validate SSR/SSG nonce attributes

New

  • feat(app-vite): BEX -> adapt to latest Vite specs on HMR protocol/port/etc
  • feat+fix(app-vite): dev -> preserve Electron app identity (#​18467)
  • feat(app-vite): dev -> preserve Electron app tray icon for Linux & macOS hosts too (already handled for Windows)
  • feat+refactor+fix(app-vite): vue-devtools > should be handled by --devtools or quasar.config > devServer > vueDevtools; fix types; use vite-plugin-vue-devtools

Other

  • fix(app-vite): dev -> re-generate entry files when quasar.config > build > vueRouterMode changes

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

v3.2.0

Compare Source

New

  • feat(app-vite): SSR/SSG dev -> handle critical CSS paths on the server-side render

Fixes

  • fix(app-vite): SSR/SSG dev -> server-side render doubles the js entry point

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

v3.1.0

Compare Source

[!IMPORTANT]
Quasar UI v2.22 or newer is now required for all Quasar application modes.

The new SSG mode API is currently in a short beta stage. Based on the community feedback, its API may change, so check every subsequent releases for potentially such information before upgrading.

The deployed documentation PWA may continue showing cached content until its service worker installs the latest version. As a result, the new SSG and Hybrid SSR + partial CSR documentation might not appear immediately.

Huge new features

This release feels more like a 4.0 (with no breaking changes) for us rather than simply 3.1, but here we go:

  • feat(app-vite): Add SSG mode, with optional PWA takeover and partial CSR
  • feat(app-vite): Add Hybrid SSR + partial CSR mode
  • perf(app-vite): Improve SSR development and production runtime performance
  • feat(app-vite): Resolve App Extension assets and injected ~ references relative to the extension package, including dependencies nested within its pnpm dependency tree

Other new features

  • feat(app-vite): Add support for Pinia v4
  • feat(app-vite): Add new quasar.config > ssr options: clientSideRenderingRoutes, noPreloadTagRoutes, and extendSSRManifestJson
  • feat(app-vite): Harden ctx.mode typing
  • feat+fix(app-vite): Ensure development and production use the same serialize-javascript package when needed, providing predictable output
  • feat(app-vite): Enhance logger.progress() with an optional { target?: string; doneAction?: string } parameter
  • feat(app-vite): Improve SSR manifest and preload processing, including route-specific preload control
  • feat(docs): Revamped all Quasar CLI pages. They now include updated and more useful content.

Fixes

  • fix(app-vite): Correct numeric environment-variable inference (#​18352)
  • fix(QTooltip): show on keyboard focus & dismiss with ESC (fix #​18241) (#​18318)
  • fix(app-vite): For the spawned SSR Hono template -> Rewrite request paths when serving an SSR application with Hono and a non-default production publicPath
  • fix(app-vite): Correct multi-slash path handling
  • fix(app-vite): Correct the vueDevtools type
  • fix(app-vite): Correct the capacitor.capacitorCliPreparationParams configuration contract
  • fix(app-vite): Correctly handle injectPWAMetaTags when provided as a function
  • fix(app-vite): Wait for temporary Capacitor packages to finish installing before continuing
  • fix(app-vite): Correct and align Cordova types
  • fix(app-vite): Add the missing Electron beforePackaging type
  • fix(app-vite): Correct registerQuasarRuntime() usage and types; it was previously declared as asynchronous
  • fix(app-vite): Correct the dev command help, including removal of the unsupported --ide option and clarification of quasar run
  • fix(app-vite): Correct the Cordova development and build banners
  • fix(app-vite): Align lifecycle-hook types with their runtime behavior
  • fix(app-vite): Correctly update the Browser Extension development folder
  • fix(app-vite): Align App Extension APIs with their runtime contracts
  • fix(app-vite): Correctly handle environment-variable prefixes containing $
  • fix(app-vite): Add the missing display_override property to PwaManifestOptions
  • fix(app-vite): Align SSG, SSR, and PWA runtime behavior, types, templates, and documentation

Notes on upgrading

If you use @intlify/unplugin-vue-i18n, update its ssr option so it also recognizes SSG mode: ssr: ctx.mode.ssr || ctx.mode.ssg. This ensures the plugin applies the appropriate server-rendering behavior in both SSR and SSG builds.

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

v3.0.1

Compare Source

Changes

  • fix(app-vite): Capacitor & Cordova modes -> www folder not cleaned before build #​18351

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider the following:

v3.0.0

Compare Source

Bird's eye view on what's new

  • ⚡ Blazing Fast Compilation: We've replaced esbuild with Rolldown for /src-* folders and completely redesigned the build architecture. Build steps are now parallelized across all Quasar modes, resulting in significantly faster speeds and a smaller footprint for your production distributables.

  • ⚙️ Next-Gen Environment Management: We’ve redesigned env file management from the ground up. You will no longer need to restart the dev server when making changes to these files, and you can now use them directly within your quasar.config file too!

  • 🔒 Enhanced Security & Modern Standards: We’ve migrated from process.env to the modern import.meta.env (aligning with Vite's native model) with full TypeScript support. A new security layer ensures client-side files only use a configurable prefix for env definitions, preventing potential leaks of sensitive data.

  • 📦 Smarter Dependency Isolation: We now have a clear separation of dependencies for each Quasar mode. You can install mode-specific packages directly in their respective /src-* folders. For example, the default Electron app will no longer require dependencies to be installed in its dist folder—only what you explicitly install in /src-electron will be included.

  • 🌍 Redesigned SSR Architecture: SSR mode now features superior support for custom web servers and proper TypeScript integration. When adding SSR, the CLI will prompt you to spawn a preconfigured /src-ssr folder using Hono, Fastify, Express, or Koa (let us know what other out-of-the-box servers you’d like!).

  • 📂 New Server Assets Folder for SSR: We've introduced a /src-ssr/server-assets folder alongside helpful utility functions. This makes it incredibly easy to reference assets (like HTTPS certificates) across dev and production runtimes, eliminating the strict need for an Apache/Nginx wrapper. We've also made the serverless support a breeze.

  • 🚀 Paving the Way for SSG: This new SSR architecture lays the necessary groundwork for us to finally release Static Site Generation (SSG) mode in the future.

  • 🖥️ Revamped Electron Mode: We’ve added lots of new features to make desktop development smoother. Similar to SSR, we've introduced a /src-electron/electron-assets folder. Referencing files from here (or from the /public folder) is now much easier via new utility methods available in both /src-electron and /src.

  • 🛣️ Vue Router: First-class support for the filename-based routing.

  • 🚀 Smarter reloads (when absolutely needed): You'll notice the DX on dev has improved significantly, with even smarter heuristics when changing the quasar.config file or the dotenv files.

  • 🛠️ Modernized Core: The codebase has been updated to take full advantage of Node.js v22+ features, alongside countless other small but significant improvements across all Quasar modes to boost your productivity. The CLI uses significantly less dependencies.

  • ...and sooo many other new features and enhancements!

Upgrade Guide

Please refer to docs for the Upgrade Guide. Read top to bottom first.

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider the following:

v2.6.2

Compare Source

Changes

  • fix(app-vite): correctly resolve AE packages/scripts when installing a tagged AE, e.g. @beta suffix

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider the following:

v2.6.1

Compare Source

Changes

  • Explicitly define compatibility with @quasar/extras v2 so the package managers won't complain about it.

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider the following:

v2.6.0

Compare Source

Breaking

We're sorry for this, but you need to lookup {*path} and replace it with * in your /src-ssr folder. This is due to reverting back to Express v4, otherwise SSR with non-express server gets broken.

Changes

  • feat(app-vite): support for Capacitor v8
  • feat(app-vite): remove now obsolete temporary fix for Vue flags
  • feat(app-vite): drop the build.sourcemap conversion to "inline"; allow all possible values
  • feat(app-vite): decouple q/extras types from the UI package (requires q/extras v1.18+)
  • fix(app-vite): replace mentions of useBridge with correct createBridge
  • fix(app-vite): logger > warn() pill
  • fix(app-vite): revert back to Express v4 due to SSR breaking with non-express server
  • fix(app-vite): "inspect" cmd failing for SSR config
  • fix(app-vite): correctly watch for changes on all quasar.config > framework props
  • chore(app-vite): remove unused PWA dev quasar.config diff (pwaFilenames)

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider the following:

v2.5.4

Compare Source

Changes

  • fix(app-vite): fix analyze option (fix: #​18263)
  • fix(app-vite): downgrade isbinaryfile to v5.0.2 from v6 to avoid node v24 requirement (fix: #​18264)
  • fix(app-vite): correctly check min node version

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider the following:

v2.5.3

Compare Source

Changes

  • fix(quasar/app-vite): [security] upgrade to our newer quasar/ssl-certificate
  • perf(quasar/app-vite): various small perf tweaks

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider the following:

v2.5.2

Compare Source

Changes

  • feat(app-vite): account for newer router.beforeResolve() Vue Router v5 specs #​18234
  • perf(app-vite): quasar.config -> run some cache getters in parallel

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider the following:

v2.5.1

Compare Source

Changes

  • fix(app-vite): browser target type in BuildTargetOptions (#​18248)

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider the following:

v2.5.0

Compare Source

Important!

We have upgraded to Vite 8, so you might want to check its release notes. Unless you have tampered with advanced rollupOptions (now rolldownOptions) settings, you can safely upgrade. 99.9% of the users won't be affected by this, which is why we have released this as a minor version of q/app-vite.

Also, in order to fully support Vite 8, we are forced to bump up the minimum Node.js version to v22. Since the latest LTS is 24 (as of writing these lines), most you have probably upgraded from Node.js v20 anyway.

We highly recommend updating the build target in your /quasar.config file:

build: {
  target: {
    browser: 'baseline-widely-available',
    node: 'node22'
  }

Changes

  • feat(app-vite): security patches
  • feat(app-vite): Vite 8 support
  • feat(app-vite): support for @​electron/packager v19
  • feat(app-vite): Express v5 support (and forward compat for catch-all route)
  • feat(app-vite): upgrade deps
  • feat(render-ssr-error): upgrade to vite 8
  • fix(app-vite): PWA dev error on index.html

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider the following:

v2.4.1

Compare Source

Changes

  • feat(app-vite;app-webpack): vue-router v5 support (#​18222)
  • feat(app-vite): Add --silent option to prepare command (#​18213)
  • fix(app-vite): improve pnpm monorepo support for capacitor (#​18218)
  • fix(config): update electron-builder config outdated link (#​18225)

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If you are interested in supporting this project, please consider the following:

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@quasar/app-vite](https://quasar.dev) ([source](https://github.com/quasarframework/quasar/tree/HEAD/app-vite)) | [`^2.4.0` → `^3.0.0`](https://renovatebot.com/diffs/npm/@quasar%2fapp-vite/2.4.0/3.3.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@quasar%2fapp-vite/3.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@quasar%2fapp-vite/2.4.0/3.3.0?slim=true) | --- ### Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained [CVE-2026-106107](https://nvd.nist.gov/vuln/detail/CVE-2026-106107) / [GHSA-5m6h-8g35-p3m7](https://github.com/advisories/GHSA-5m6h-8g35-p3m7) <details> <summary>More information</summary> #### Details Several @&#8203;quasar/app-vite SSR and SSG renderer paths interpolate `ssrContext.nonce` directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML. Cryptographically generated base64 or base64url nonces are not directly affected because they do not contain HTML attribute delimiters. Exploitation requires an application to place attacker-controlled or otherwise unsafe data in `ssrContext.nonce`. The remediation centralizes nonce handling across development SSR/SSG, production SSR, production SSG, critical CSS, store-state scripts, and Vue Devtools. It validates the value as a non-empty base64/base64url CSP nonce and HTML-encodes the attribute value before rendering. #### Severity - CVSS Score: 8.3 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/quasarframework/quasar/security/advisories/GHSA-5m6h-8g35-p3m7](https://github.com/quasarframework/quasar/security/advisories/GHSA-5m6h-8g35-p3m7) - [https://nvd.nist.gov/vuln/detail/CVE-2026-106107](https://nvd.nist.gov/vuln/detail/CVE-2026-106107) - [https://github.com/quasarframework/quasar/commit/91271c38859bec51e154b60c24497a637ce903d7](https://github.com/quasarframework/quasar/commit/91271c38859bec51e154b60c24497a637ce903d7) - [https://github.com/quasarframework/quasar](https://github.com/quasarframework/quasar) - [https://github.com/quasarframework/quasar/releases/tag/@&#8203;quasar/app-vite-v3.3.0](https://github.com/quasarframework/quasar/releases/tag/@&#8203;quasar/app-vite-v3.3.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-5m6h-8g35-p3m7) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions [CVE-2026-106105](https://nvd.nist.gov/vuln/detail/CVE-2026-106105) / [GHSA-fh39-c73x-5pjv](https://github.com/advisories/GHSA-fh39-c73x-5pjv) <details> <summary>More information</summary> #### Details The `@quasar/ssl-certificate` development utility caches a combined PEM containing a generated private key and certificate without explicitly restricting its filesystem permissions. On systems with a typical process umask, the PEM can be readable by other local users. A local attacker with filesystem access could copy and reuse the private key to impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also unnecessarily CA-capable and included broad key usages beyond its localhost HTTPS purpose. Its IPv6 loopback entry was encoded as a DNS name rather than an IP subject alternative name. The remediation writes and repairs the cached PEM with owner-only permissions on supported platforms, generates a non-CA server-auth leaf certificate with constrained key usage, corrects the IPv6 loopback SAN, and bases cache expiry on content modification time so permission metadata changes cannot extend the certificate lifetime. This issue does not expose the key remotely by itself; exploitation requires another local user to be able to read the cached PEM file. #### Severity - CVSS Score: 8.4 / 10 (High) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv](https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv) - [https://nvd.nist.gov/vuln/detail/CVE-2026-106105](https://nvd.nist.gov/vuln/detail/CVE-2026-106105) - [https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575](https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575) - [https://github.com/quasarframework/quasar](https://github.com/quasarframework/quasar) - [https://github.com/quasarframework/quasar/releases/tag/@&#8203;quasar/app-vite-v3.3.0](https://github.com/quasarframework/quasar/releases/tag/@&#8203;quasar/app-vite-v3.3.0) - [https://github.com/quasarframework/quasar/releases/tag/@&#8203;quasar/cli-v5.0.4](https://github.com/quasarframework/quasar/releases/tag/@&#8203;quasar/cli-v5.0.4) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fh39-c73x-5pjv) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories [CVE-2026-106109](https://nvd.nist.gov/vuln/detail/CVE-2026-106109) / [GHSA-q9mq-245r-4g93](https://github.com/advisories/GHSA-q9mq-245r-4g93) <details> <summary>More information</summary> #### Details ##### Summary `@quasar/app-vite` recursively removes `build.distDir` before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project. ##### Details The build command and mode builders passed the resolved output directory directly to `fs-extra` recursive removal. Existing symlink ancestors were not resolved before deletion either, so a path that appeared to be inside the project could operate on a directory outside it. `quasar.config` is trusted application code, and no attacker-controlled input reaches `build.distDir` by default. This issue is primarily destructive-build safety hardening. It can become a security boundary when build configuration is generated or influenced by less-trusted automation. ##### Impact Running a normal Quasar build with an unsafe `build.distDir` can delete data accessible to the build user before compilation begins. ##### Remediation Validate the effective deletion target before every artifact cleanup. Always reject filesystem roots, the user home directory and the project root; resolve existing symlink ancestors; require an explicit `build.allowOutsideProjectDistDir` opt-in for external output directories; and log the exact resolved target before removal. #### Severity - CVSS Score: 4.1 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93](https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93) - [https://nvd.nist.gov/vuln/detail/CVE-2026-106109](https://nvd.nist.gov/vuln/detail/CVE-2026-106109) - [https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1](https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1) - [https://github.com/quasarframework/quasar](https://github.com/quasarframework/quasar) - [https://github.com/quasarframework/quasar/releases/tag/@&#8203;quasar/app-vite-v3.3.0](https://github.com/quasarframework/quasar/releases/tag/@&#8203;quasar/app-vite-v3.3.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-q9mq-245r-4g93) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable [CVE-2026-106106](https://nvd.nist.gov/vuln/detail/CVE-2026-106106) / [GHSA-r5mf-4r5x-q78f](https://github.com/advisories/GHSA-r5mf-4r5x-q78f) <details> <summary>More information</summary> #### Details ##### Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in `process.env`, every request header and every cookie into the HTTP response, and the dev server binds `0.0.0.0` by default. Any host that can reach the port therefore gets the developer's cloud keys, registry tokens and database URLs from a single unauthenticated GET. The same page embeds that data inside a `<script>` element behind a `replaceAll('</script>', ...)` guard that is ASCII-case-sensitive and requires a literal `>`, so `</SCRIPT>`, `</script >` and `</script/>` all escape the element and give script execution in the dev server's origin. ##### Details `renderSSRError()` builds the page by splicing a JSON blob into a prebuilt bundle (`utils/render-ssr-error/src/index.js`): ```js errorHtml: before + JSON.stringify(data).replaceAll('</script>', String.raw`<\/script>`) + after ``` `before` and `after` are the two halves of the compiled error-page UI, split inside a `<script type="module">` element, so `data` is emitted as a JS object literal in raw script text. The data itself comes from `utils/render-ssr-error/src/env.js`: ```js function getEnvironmentVariablesData () { return Object.keys(process.env).reduce((acc, name) => { acc[ name ] = process.env[ name ] return acc }, {}) } export function getEnv (req) { return { Request: getRequestData(req), Headers: getHeadersData(req), Cookies: getCookiesData(req), 'Shell environment variables': getEnvironmentVariablesData() } } ``` The page is served by `serve.devError({ err, req })` in `app-vite/lib/modes/ssr/ssr-devserver.js` and by the SSG equivalent, which the generated render middleware calls on any render exception. The dev server listens on every interface because `app-vite/lib/quasar-config-file.js` overrides Vite's `localhost` default: ```js } else if (!cfg.devServer.host) { cfg.devServer.host = '0.0.0.0' } ``` The escape fails because the HTML tokenizer ends script raw text on `</` followed by a case-insensitive `script` followed by any of tab, newline, form feed, space, `/` or `>`. `replaceAll` with a string pattern matches one exact spelling. `</SCRIPT>`, `</ScRiPt>`, `</script >` and `</script/>` are all untouched and all close the element. `JSON.stringify` does not escape `<` or `>`, and cookie values are additionally run through `decodeURIComponent` before being placed in the blob, so percent-encoded payloads decode into working markup. The project already implements this correctly elsewhere. `ui/src/plugins/meta/Meta.js` uses a case-insensitive pattern with no trailing `>`: ```js function protectRawText (value, tagName) { return String(value).replaceAll(new RegExp(`</${tagName}`, 'gi'), `<\\/${tagName}`) } ``` ##### PoC Harness that replicates the dev server's error branch using the published `@quasar/render-ssr-error@2.2.3`, with two canary values planted in the environment: ```js import http from 'node:http' import renderSSRError from '@quasar/render-ssr-error' process.env.AWS_SECRET_ACCESS_KEY = 'CANARY_AWS_SECRET_dev_machine_9f3a1c' process.env.NPM_TOKEN = 'CANARY_npm_TOKEN_abcdef' http.createServer((req, res) => { const err = new Error('Cannot read properties of undefined (reading "x")') const { errorHeaders, errorHtml } = renderSSRError({ err, req, rootFolder: process.cwd() }) res.writeHead(500, errorHeaders) res.end(errorHtml) }).listen(3200, '0.0.0.0') ``` Disclosure needs no payload at all. A plain `GET /` returns a 957 KB page containing both canaries: ``` ENV DISCLOSURE (plain GET, no injection): 2/2 canary secrets present in the 500 page -> CANARY_AWS_SECRET_dev_machine_9f3a1c, CANARY_npm_TOKEN_abcdef ``` For the injection, the payload goes in an ordinary request header. `JSON.stringify` escapes `"` as `\"`, so the handler uses single quotes: ``` <TAG><img src=/nonexistent-image onerror='window.__QPWN=document.domain+":"+location.port'> ``` Loaded in headless Chromium: ``` POSITIVE </SCRIPT > (uppercase + space) window.__QPWN=127.0.0.1:3200 injectedImg=1 ATTACKER SCRIPT EXECUTED POSITIVE </script > (lowercase + space) window.__QPWN=127.0.0.1:3200 injectedImg=1 ATTACKER SCRIPT EXECUTED POSITIVE </script/> (lowercase + slash) window.__QPWN=127.0.0.1:3200 injectedImg=1 ATTACKER SCRIPT EXECUTED POSITIVE </ScRiPt> (mixed case) window.__QPWN=127.0.0.1:3200 injectedImg=1 ATTACKER SCRIPT EXECUTED NEG-CTRL </script> (what the filter matches) window.__QPWN=null injectedImg=0 no execution ``` The negative control is the same payload with the one spelling `replaceAll` actually matches. Nothing is injected and nothing runs, which isolates the bug to the escape rather than to the surrounding page. Confirming the injection context, a probe header comes back inside the single `<script type="module">` element: ``` ..."Headers":{"host":"127.0.0.1:3200","user-agent":"curl/8.18.0","accept":"*/*", "x-probe":"</SCRIPT ><img src=/nope onerror=\"window.__QPWN=1\">MARKEREND"},... ``` No `Content-Security-Policy` is sent with the page. ##### Impact Exposure of sensitive system information, plus HTML injection into a page that carries it. This is development only, since `serve.devError` does not exist in a production build, and it requires the app's SSR render to throw. That is the routine state this page exists to display, and an attacker who can reach the port can simply poll for it. The disclosure is the substantive half and needs nothing but a TCP connection: shell environment, all request headers, all cookies, and ten lines of source around every stack frame. On a developer machine that typically means cloud credentials, npm or GitHub tokens and database connection strings. Because Quasar overrides Vite's `localhost` default with `0.0.0.0`, everyone on the same network segment or in a shared container network can ask for it. The injection is best treated as a chained issue on top of that rather than as a drive-by. A raw HTTP client can set the header but only poisons its own page. For the code to run in the developer's browser the payload has to travel with the developer's own request, which in practice means the cookie channel, since cookie values are URL-decoded and any page on a `localhost` or `127.0.0.1` origin can set a cookie that is sent to every port on that host. Cross-origin `fetch` does not work: CORS-safelisted headers forbid `<` and `>`, and browsers percent-encode them in the URL while `req.url` is never decoded. Fixing the escape alone leaves the disclosure. Serializing with something that escapes `<`, such as the `serialize-javascript` already used correctly in `app-vite/lib/modes/ssr/ssr-utils.js`, closes the injection; redacting or omitting `process.env` and cookie values closes the disclosure; defaulting `devServer.host` to `localhost` as Vite does would reduce who can ask. #### Severity - CVSS Score: 7.1 / 10 (High) - Vector String: `CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N` #### References - [https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f](https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f) - [https://nvd.nist.gov/vuln/detail/CVE-2026-106106](https://nvd.nist.gov/vuln/detail/CVE-2026-106106) - [https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15](https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15) - [https://github.com/quasarframework/quasar](https://github.com/quasarframework/quasar) - [https://github.com/quasarframework/quasar/releases/tag/@&#8203;quasar/app-vite-v3.3.0](https://github.com/quasarframework/quasar/releases/tag/@&#8203;quasar/app-vite-v3.3.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r5mf-4r5x-q78f) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>quasarframework/quasar (@&#8203;quasar/app-vite)</summary> ### [`v3.3.0`](https://github.com/quasarframework/quasar/releases/tag/%40quasar/app-vite-v3.3.0) [Compare Source](https://github.com/quasarframework/quasar/compare/@quasar/app-vite-v3.2.0...@quasar/app-vite-v3.3.0) #### Security fixes - fix(ssl-certificate): restrict development TLS credentials - feat+fix(app-vite): safeguard build artifact cleanup; new prop (boolean, default `false`) for quasar.config > build > allowOutsideProjectDistDir - fix(app-vite): SSR/SSG -> secure error diagnostics while on development - fix(app-vite): validate SSR/SSG nonce attributes #### New - feat(app-vite): BEX -> adapt to latest Vite specs on HMR protocol/port/etc - feat+fix(app-vite): dev -> preserve Electron app identity ([#&#8203;18467](https://github.com/quasarframework/quasar/issues/18467)) - feat(app-vite): dev -> preserve Electron app tray icon for Linux & macOS hosts too (already handled for Windows) - feat+refactor+fix(app-vite): vue-devtools > should be handled by --devtools or quasar.config > devServer > vueDevtools; fix types; use vite-plugin-vue-devtools #### Other - fix(app-vite): dev -> re-generate entry files when quasar.config > build > vueRouterMode changes #### Donations Quasar Framework is an open-source MIT-licensed project made possible due to the **generous contributions** by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following: - [Becoming a sponsor on Github](https://github.com/sponsors/rstoenescu) - [One-off donation via PayPal](https://paypal.me/rstoenescu1) ### [`v3.2.0`](https://github.com/quasarframework/quasar/releases/tag/%40quasar/app-vite-v3.2.0) [Compare Source](https://github.com/quasarframework/quasar/compare/@quasar/app-vite-v3.1.0...@quasar/app-vite-v3.2.0) #### New - feat(app-vite): SSR/SSG dev -> handle critical CSS paths on the server-side render #### Fixes - fix(app-vite): SSR/SSG dev -> server-side render doubles the js entry point #### Donations Quasar Framework is an open-source MIT-licensed project made possible due to the **generous contributions** by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following: - [Becoming a sponsor on Github](https://github.com/sponsors/rstoenescu) - [One-off donation via PayPal](https://paypal.me/rstoenescu1) ### [`v3.1.0`](https://github.com/quasarframework/quasar/releases/tag/%40quasar/app-vite-v3.1.0) [Compare Source](https://github.com/quasarframework/quasar/compare/@quasar/app-vite-v3.0.1...@quasar/app-vite-v3.1.0) > \[!IMPORTANT] > Quasar UI v2.22 or newer is now required for all Quasar application modes. > > The new SSG mode API is currently in a short beta stage. Based on the community feedback, its API may change, so check every subsequent releases for potentially such information before upgrading. > > The deployed documentation PWA may continue showing cached content until its service worker installs the latest version. As a result, the new SSG and Hybrid SSR + partial CSR documentation might not appear immediately. #### Huge new features This release feels more like a 4.0 (with no breaking changes) for us rather than simply 3.1, but here we go: - feat(app-vite): Add SSG mode, with optional PWA takeover and partial CSR - feat(app-vite): Add Hybrid SSR + partial CSR mode - perf(app-vite): Improve SSR development and production runtime performance - feat(app-vite): Resolve App Extension assets and injected `~` references relative to the extension package, including dependencies nested within its pnpm dependency tree #### Other new features - feat(app-vite): Add support for Pinia v4 - feat(app-vite): Add new `quasar.config > ssr` options: `clientSideRenderingRoutes`, `noPreloadTagRoutes`, and `extendSSRManifestJson` - feat(app-vite): Harden `ctx.mode` typing - feat+fix(app-vite): Ensure development and production use the same `serialize-javascript` package when needed, providing predictable output - feat(app-vite): Enhance `logger.progress()` with an optional `{ target?: string; doneAction?: string }` parameter - feat(app-vite): Improve SSR manifest and preload processing, including route-specific preload control - feat(docs): Revamped all Quasar CLI pages. They now include updated and more useful content. #### Fixes - fix(app-vite): Correct numeric environment-variable inference ([#&#8203;18352](https://github.com/quasarframework/quasar/issues/18352)) - fix(QTooltip): show on keyboard focus & dismiss with ESC (fix [#&#8203;18241](https://github.com/quasarframework/quasar/issues/18241)) ([#&#8203;18318](https://github.com/quasarframework/quasar/issues/18318)) - fix(app-vite): For the spawned SSR Hono template -> Rewrite request paths when serving an SSR application with Hono and a non-default production `publicPath` - fix(app-vite): Correct multi-slash path handling - fix(app-vite): Correct the `vueDevtools` type - fix(app-vite): Correct the `capacitor.capacitorCliPreparationParams` configuration contract - fix(app-vite): Correctly handle `injectPWAMetaTags` when provided as a function - fix(app-vite): Wait for temporary Capacitor packages to finish installing before continuing - fix(app-vite): Correct and align Cordova types - fix(app-vite): Add the missing Electron `beforePackaging` type - fix(app-vite): Correct `registerQuasarRuntime()` usage and types; it was previously declared as asynchronous - fix(app-vite): Correct the `dev` command help, including removal of the unsupported `--ide` option and clarification of `quasar run` - fix(app-vite): Correct the Cordova development and build banners - fix(app-vite): Align lifecycle-hook types with their runtime behavior - fix(app-vite): Correctly update the Browser Extension development folder - fix(app-vite): Align App Extension APIs with their runtime contracts - fix(app-vite): Correctly handle environment-variable prefixes containing `$` - fix(app-vite): Add the missing `display_override` property to `PwaManifestOptions` - fix(app-vite): Align SSG, SSR, and PWA runtime behavior, types, templates, and documentation #### Notes on upgrading If you use `@intlify/unplugin-vue-i18n`, update its `ssr` option so it also recognizes SSG mode: `ssr: ctx.mode.ssr || ctx.mode.ssg`. This ensures the plugin applies the appropriate server-rendering behavior in both SSR and SSG builds. #### Donations Quasar Framework is an open-source MIT-licensed project made possible due to the **generous contributions** by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following: - [Becoming a sponsor on Github](https://github.com/sponsors/rstoenescu) - [One-off donation via PayPal](https://paypal.me/rstoenescu1) ### [`v3.0.1`](https://github.com/quasarframework/quasar/releases/tag/%40quasar/app-vite-v3.0.1) [Compare Source](https://github.com/quasarframework/quasar/compare/@quasar/app-vite-v3.0.0...@quasar/app-vite-v3.0.1) #### Changes - fix(app-vite): Capacitor & Cordova modes -> www folder not cleaned before build [#&#8203;18351](https://github.com/quasarframework/quasar/issues/18351) #### Donations Quasar Framework is an open-source MIT-licensed project made possible due to the **generous contributions** by [sponsors and backers](https://github.com/sponsors/rstoenescu). If you are interested in supporting this project, please consider the following: - [Becoming a sponsor on Github](https://github.com/sponsors/rstoenescu) - [One-off donation via PayPal](https://paypal.me/rstoenescu1) ### [`v3.0.0`](https://github.com/quasarframework/quasar/releases/tag/%40quasar/app-vite-v3.0.0) [Compare Source](https://github.com/quasarframework/quasar/compare/@quasar/app-vite-v2.6.2...@quasar/app-vite-v3.0.0) #### Bird's eye view on what's new - ⚡ Blazing Fast Compilation: We've replaced esbuild with Rolldown for /src-\* folders and completely redesigned the build architecture. Build steps are now parallelized across all Quasar modes, resulting in significantly faster speeds and a smaller footprint for your production distributables. - ⚙️ Next-Gen Environment Management: We’ve redesigned env file management from the ground up. You will no longer need to restart the dev server when making changes to these files, and you can now use them directly within your quasar.config file too! - 🔒 Enhanced Security & Modern Standards: We’ve migrated from `process.env` to the modern `import.meta.env` (aligning with Vite's native model) with full TypeScript support. A new security layer ensures client-side files only use a configurable prefix for env definitions, preventing potential leaks of sensitive data. - 📦 Smarter Dependency Isolation: We now have a clear separation of dependencies for each Quasar mode. You can install mode-specific packages directly in their respective /src-\* folders. For example, the default Electron app will no longer require dependencies to be installed in its dist folder—only what you explicitly install in /src-electron will be included. - 🌍 Redesigned SSR Architecture: SSR mode now features superior support for custom web servers and proper TypeScript integration. When adding SSR, the CLI will prompt you to spawn a preconfigured /src-ssr folder using Hono, Fastify, Express, or Koa (let us know what other out-of-the-box servers you’d like!). - 📂 New Server Assets Folder for SSR: We've introduced a /src-ssr/server-assets folder alongside helpful utility functions. This makes it incredibly easy to reference assets (like HTTPS certificates) across dev and production runtimes, eliminating the strict need for an Apache/Nginx wrapper. We've also made the serverless support a breeze. - 🚀 Paving the Way for SSG: This new SSR architecture lays the necessary groundwork for us to finally release Static Site Generation (SSG) mode in the future. - 🖥️ Revamped Electron Mode: We’ve added lots of new features to make desktop development smoother. Similar to SSR, we've introduced a /src-electron/electron-assets folder. Referencing files from here (or from the /public folder) is now much easier via new utility methods available in both /src-electron and /src. - 🛣️ Vue Router: First-class support for the [filename-based routing](https://quasar.dev/quasar-cli-vite/page-routing-with-vue-router#filename-based-routing). - 🚀 Smarter reloads (when absolutely needed): You'll notice the DX on dev has improved significantly, with even smarter heuristics when changing the quasar.config file or the dotenv files. - 🛠️ Modernized Core: The codebase has been updated to take full advantage of Node.js v22+ features, alongside countless other small but significant improvements across all Quasar modes to boost your productivity. The CLI uses significantly less dependencies. - ...and sooo many other new features and enhancements! #### Upgrade Guide Please refer to [docs](https://quasar.dev/quasar-cli-vite/upgrade-guide) for the Upgrade Guide. Read top to bottom first. #### Donations Quasar Framework is an open-source MIT-licensed project made possible due to the **generous contributions** by [sponsors and backers](https://github.com/sponsors/rstoenescu). If you are interested in supporting this project, please consider the following: - [Becoming a sponsor on Github](https://github.com/sponsors/rstoenescu) - [One-off donation via PayPal](https://paypal.me/rstoenescu1) ### [`v2.6.2`](https://github.com/quasarframework/quasar/releases/tag/%40quasar/app-vite-v2.6.2) [Compare Source](https://github.com/quasarframework/quasar/compare/@quasar/app-vite-v2.6.1...@quasar/app-vite-v2.6.2) #### Changes - fix(app-vite): correctly resolve AE packages/scripts when installing a tagged AE, e.g. `@beta` suffix #### Donations Quasar Framework is an open-source MIT-licensed project made possible due to the **generous contributions** by [sponsors and backers](https://github.com/sponsors/rstoenescu). If you are interested in supporting this project, please consider the following: - [Becoming a sponsor on Github](https://github.com/sponsors/rstoenescu) - [One-off donation via PayPal](https://paypal.me/rstoenescu1) ### [`v2.6.1`](https://github.com/quasarframework/quasar/releases/tag/%40quasar/app-vite-v2.6.1) [Compare Source](https://github.com/quasarframework/quasar/compare/@quasar/app-vite-v2.6.0...@quasar/app-vite-v2.6.1) #### Changes - Explicitly define compatibility with `@quasar/extras` v2 so the package managers won't complain about it. #### Donations Quasar Framework is an open-source MIT-licensed project made possible due to the **generous contributions** by [sponsors and backers](https://github.com/sponsors/rstoenescu). If you are interested in supporting this project, please consider the following: - [Becoming a sponsor on Github](https://github.com/sponsors/rstoenescu) - [One-off donation via PayPal](https://paypal.me/rstoenescu1) ### [`v2.6.0`](https://github.com/quasarframework/quasar/releases/tag/%40quasar/app-vite-v2.6.0) [Compare Source](https://github.com/quasarframework/quasar/compare/@quasar/app-vite-v2.5.4...@quasar/app-vite-v2.6.0) #### Breaking We're sorry for this, but you need to lookup `{*path}` and replace it with `*` in your `/src-ssr` folder. This is due to reverting back to Express v4, otherwise SSR with non-express server gets broken. #### Changes - feat(app-vite): support for Capacitor v8 - feat(app-vite): remove now obsolete temporary fix for Vue flags - feat(app-vite): drop the build.sourcemap conversion to "inline"; allow all possible values - feat(app-vite): decouple q/extras types from the UI package (requires q/extras v1.18+) - fix(app-vite): replace mentions of useBridge with correct createBridge - fix(app-vite): logger > warn() pill - fix(app-vite): revert back to Express v4 due to SSR breaking with non-express server - fix(app-vite): "inspect" cmd failing for SSR config - fix(app-vite): correctly watch for changes on all quasar.config > framework props - chore(app-vite): remove unused PWA dev quasar.config diff (pwaFilenames) #### Donations Quasar Framework is an open-source MIT-licensed project made possible due to the **generous contributions** by [sponsors and backers](https://github.com/sponsors/rstoenescu). If you are interested in supporting this project, please consider the following: - [Becoming a sponsor on Github](https://github.com/sponsors/rstoenescu) - [One-off donation via PayPal](https://paypal.me/rstoenescu1) ### [`v2.5.4`](https://github.com/quasarframework/quasar/releases/tag/%40quasar/app-vite-v2.5.4) [Compare Source](https://github.com/quasarframework/quasar/compare/@quasar/app-vite-v2.5.3...@quasar/app-vite-v2.5.4) #### Changes - fix(app-vite): fix analyze option (fix: [#&#8203;18263](https://github.com/quasarframework/quasar/issues/18263)) - fix(app-vite): downgrade isbinaryfile to v5.0.2 from v6 to avoid node v24 requirement (fix: [#&#8203;18264](https://github.com/quasarframework/quasar/issues/18264)) - fix(app-vite): correctly check min node version #### Donations Quasar Framework is an open-source MIT-licensed project made possible due to the **generous contributions** by [sponsors and backers](https://github.com/sponsors/rstoenescu). If you are interested in supporting this project, please consider the following: - [Becoming a sponsor on Github](https://github.com/sponsors/rstoenescu) - [One-off donation via PayPal](https://paypal.me/rstoenescu1) ### [`v2.5.3`](https://github.com/quasarframework/quasar/releases/tag/%40quasar/app-vite-v2.5.3) [Compare Source](https://github.com/quasarframework/quasar/compare/@quasar/app-vite-v2.5.2...@quasar/app-vite-v2.5.3) #### Changes - fix(quasar/app-vite): \[security] upgrade to our newer quasar/ssl-certificate - perf(quasar/app-vite): various small perf tweaks #### Donations Quasar Framework is an open-source MIT-licensed project made possible due to the **generous contributions** by [sponsors and backers](https://github.com/sponsors/rstoenescu). If you are interested in supporting this project, please consider the following: - [Becoming a sponsor on Github](https://github.com/sponsors/rstoenescu) - [One-off donation via PayPal](https://paypal.me/rstoenescu1) ### [`v2.5.2`](https://github.com/quasarframework/quasar/releases/tag/%40quasar/app-vite-v2.5.2) [Compare Source](https://github.com/quasarframework/quasar/compare/@quasar/app-vite-v2.5.1...@quasar/app-vite-v2.5.2) #### Changes - feat(app-vite): account for newer router.beforeResolve() Vue Router v5 specs [#&#8203;18234](https://github.com/quasarframework/quasar/issues/18234) - perf(app-vite): quasar.config -> run some cache getters in parallel #### Donations Quasar Framework is an open-source MIT-licensed project made possible due to the **generous contributions** by [sponsors and backers](https://github.com/sponsors/rstoenescu). If you are interested in supporting this project, please consider the following: - [Becoming a sponsor on Github](https://github.com/sponsors/rstoenescu) - [One-off donation via PayPal](https://paypal.me/rstoenescu1) ### [`v2.5.1`](https://github.com/quasarframework/quasar/releases/tag/%40quasar/app-vite-v2.5.1) [Compare Source](https://github.com/quasarframework/quasar/compare/@quasar/app-vite-v2.5.0...@quasar/app-vite-v2.5.1) #### Changes - fix(app-vite): `browser` target type in `BuildTargetOptions` ([#&#8203;18248](https://github.com/quasarframework/quasar/issues/18248)) #### Donations Quasar Framework is an open-source MIT-licensed project made possible due to the **generous contributions** by [sponsors and backers](https://github.com/sponsors/rstoenescu). If you are interested in supporting this project, please consider the following: - [Becoming a sponsor on Github](https://github.com/sponsors/rstoenescu) - [One-off donation via PayPal](https://paypal.me/rstoenescu1) ### [`v2.5.0`](https://github.com/quasarframework/quasar/releases/tag/%40quasar/app-vite-v2.5.0) [Compare Source](https://github.com/quasarframework/quasar/compare/@quasar/app-vite-v2.4.1...@quasar/app-vite-v2.5.0) #### Important! We have upgraded to Vite 8, so you might want to check its release notes. Unless you have tampered with advanced rollupOptions (now rolldownOptions) settings, you can safely upgrade. 99.9% of the users won't be affected by this, which is why we have released this as a minor version of q/app-vite. Also, in order to fully support Vite 8, we are forced to bump up the minimum Node.js version to v22. Since the latest LTS is 24 (as of writing these lines), most you have probably upgraded from Node.js v20 anyway. We **highly recommend** updating the build target in your /quasar.config file: ``` build: { target: { browser: 'baseline-widely-available', node: 'node22' } ``` #### Changes - feat(app-vite): security patches - feat(app-vite): Vite 8 support - feat(app-vite): support for [@&#8203;electron/packager](https://github.com/electron/packager) v19 - feat(app-vite): Express v5 support (and forward compat for catch-all route) - feat(app-vite): upgrade deps - feat(render-ssr-error): upgrade to vite 8 - fix(app-vite): PWA dev error on index.html #### Donations Quasar Framework is an open-source MIT-licensed project made possible due to the **generous contributions** by [sponsors and backers](https://github.com/sponsors/rstoenescu). If you are interested in supporting this project, please consider the following: - [Becoming a sponsor on Github](https://github.com/sponsors/rstoenescu) - [One-off donation via PayPal](https://paypal.me/rstoenescu1) ### [`v2.4.1`](https://github.com/quasarframework/quasar/releases/tag/%40quasar/app-vite-v2.4.1) [Compare Source](https://github.com/quasarframework/quasar/compare/@quasar/app-vite-v2.4.0...@quasar/app-vite-v2.4.1) #### Changes - feat(app-vite;app-webpack): vue-router v5 support ([#&#8203;18222](https://github.com/quasarframework/quasar/issues/18222)) - feat(app-vite): Add --silent option to prepare command ([#&#8203;18213](https://github.com/quasarframework/quasar/issues/18213)) - fix(app-vite): improve pnpm monorepo support for capacitor ([#&#8203;18218](https://github.com/quasarframework/quasar/issues/18218)) - fix(config): update electron-builder config outdated link ([#&#8203;18225](https://github.com/quasarframework/quasar/issues/18225)) #### Donations Quasar Framework is an open-source MIT-licensed project made possible due to the **generous contributions** by [sponsors and backers](https://github.com/sponsors/rstoenescu). If you are interested in supporting this project, please consider the following: - [Becoming a sponsor on Github](https://github.com/sponsors/rstoenescu) - [One-off donation via PayPal](https://paypal.me/rstoenescu1) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40MS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNDEuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiLCJzZWN1cml0eSJdfQ==-->
deps(deps): update dependency @quasar/app-vite to v3
Some checks failed
renovate/stability-days Updates have met minimum release age requirement
Details
renovate/artifacts Artifact file update failure
Docker Test / build image (push) Failing after 13m51s
Details
Test / build (push) Failing after 4m11s
Details
Grinder Container IT / containers (push) Successful in 7m44s
Details
Qodana / scan (push) Successful in 13m36s
Details
Qodana / notify (push) Successful in 8s
Details
2c4861de1a
renovate-bot commented 2026-10-09 07:10:53 +02:00
Author
Collaborator
Copy link

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: serverpackcreator-web-frontend/package-lock.json
npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn Unknown project config "shamefully-hoist". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn Unknown project config "strict-peer-dependencies". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn Unknown project config "resolution-mode". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: serverpackcreator-web-frontend@2.1.1
npm error Found: vue-router@4.6.4
npm error node_modules/vue-router
npm error   vue-router@"^4.6.3" from the root project
npm error
npm error Could not resolve dependency:
npm error peer vue-router@">= 5" from @quasar/app-vite@3.10.1
npm error node_modules/@quasar/app-vite
npm error   dev @quasar/app-vite@"^3.0.0" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /tmp/renovate/cache/others/npm/_logs/2026-10-09T05_10_40_849Z-eresolve-report.txt
npm error A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2026-10-09T05_10_40_849Z-debug-0.log
### ⚠️ Artifact update problem Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens: - any of the package files in this branch needs updating, or - the branch becomes conflicted, or - you click the rebase/retry checkbox if found above, or - you rename this PR's title to start with "rebase!" to trigger it manually The artifact failure details are included below: ##### File name: serverpackcreator-web-frontend/package-lock.json ``` npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options. npm warn Unknown project config "shamefully-hoist". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options. npm warn Unknown project config "strict-peer-dependencies". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options. npm warn Unknown project config "resolution-mode". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options. npm error code ERESOLVE npm error ERESOLVE unable to resolve dependency tree npm error npm error While resolving: serverpackcreator-web-frontend@2.1.1 npm error Found: vue-router@4.6.4 npm error node_modules/vue-router npm error vue-router@"^4.6.3" from the root project npm error npm error Could not resolve dependency: npm error peer vue-router@">= 5" from @quasar/app-vite@3.10.1 npm error node_modules/@quasar/app-vite npm error dev @quasar/app-vite@"^3.0.0" from the root project npm error npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution. npm error npm error npm error For a full report see: npm error /tmp/renovate/cache/others/npm/_logs/2026-10-09T05_10_40_849Z-eresolve-report.txt npm error A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2026-10-09T05_10_40_849Z-debug-0.log ```
renovate-bot changed title from deps(deps): update dependency @quasar/app-vite to v3 to deps(deps): update dependency @quasar/app-vite to v3 - autoclosed 2026-10-16 07:13:31 +02:00
renovate-bot closed this pull request 2026-10-16 07:13:32 +02:00
Some checks failed
renovate/stability-days Updates have met minimum release age requirement
Details
renovate/artifacts Artifact file update failure
Docker Test / build image (push) Failing after 13m51s
Details
Test / build (push) Failing after 4m11s
Details
Grinder Container IT / containers (push) Successful in 7m44s
Details
Qodana / scan (push) Successful in 13m36s
Details
Qodana / notify (push) Successful in 8s
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
accepted
Feature Ask which got accepted.

  
bug
Something isn't working

  
dependencies
Pull requests that update a dependency file

  
docker
Docker dependency updates

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature, request or improvement

  
github-actions
GitHub-Actions dependency updates

  
github_actions
Pull requests that update GitHub Actions code

  
good first issue
Good for newcomers

  
gradle
Gradle dependency updates

  
hacktoberfest-accepted

   
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
javascript
Pull requests that update Javascript code

  
not-an-issue
Not a problem, rather something for documentation purposes

  
npm
NPM dependency updates

  
question
Further information is requested

  
rejected
Feature Ask which got rejected.

  
wontfix
This will not be worked on

  
Working on it
Indicates that work is being done on this issue/pr

No labels
accepted
bug
dependencies
docker
documentation
duplicate
enhancement
github-actions
github_actions
good first issue
gradle
hacktoberfest-accepted
help wanted
invalid
javascript
not-an-issue
npm
question
rejected
wontfix
Working on it
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
Griefed
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Griefed/ServerPackCreator!705
No description provided.