NiceGUI Files

Security

• ⚠️ Prevent unauthenticated memory exhaustion via clients leaked on socket disconnect (GHSA-46f2-xhpw-8vh3 by @evnchn, @falkoschindler)
• ⚠️ Prevent XSS via prop injection in ColorPicker.set_color() and ui.color_input (GHSA-955g-h32v-mvrr by @mingijunggrape, @evnchn, @falkoschindler)

New features and enhancements

• Refactor ui.scene (nicegui.io) to a modular object system, supporting custom three.js objects and fixing the white axes_helper regression (#4120, [#6085], [#6246] by @HosseyNJF, @phenolophthaleinum, @evnchn, @SaadZahem, @python-and-novella, @falkoschindler)

  Breaking change: The following patterns are deprecated and will be removed in NiceGUI 4.0 (they still work but emit a one-time warning): importing from nicegui.elements.scene.scene_objects (use nicegui.elements.scene.objects instead), subclassing Object3D without a component= argument, instantiating objects with a leading type string like Object3D('group'), and the Object3D.data and Object3D.type properties.

• Add line-anchor tracking to ui.codemirror (nicegui.io), giving you stable references to specific lines that survive edits (#5988, [#6282] by @Jepson2k, @evnchn, @falkoschindler)

• Add h2, h3, h4, h5 and h6 HTML elements (#6238 by @SaadZahem, @evnchn, @falkoschindler)
• Sync ui.table (nicegui.io)'s fullscreen state back to the server when toggled from the client (#6181 by @evnchn, @falkoschindler)
• Avoid downloading an unused font subset for the connection-lost popup's warning glyph (#6210 by @evnchn, @falkoschindler)
• Remove dead props from ui.chip (nicegui.io), ui.carousel_slide and the ui.date (nicegui.io) input (#6177, [#6184], [#6185] by @evnchn, @falkoschindler)

Bugfixes

• Fix error when a repeating ui.timer (nicegui.io)'s client is deleted while waiting for the connection (#6226, [#6228], [#6229] by @benvc, @AJ-ing, @evnchn, @falkoschindler)
• Fix task leak by resolving awaited ui.dialog (nicegui.io)s when they are deleted (#6250 by @denniswittich, @evnchn, @falkoschindler)
• Fix On Air reconnect when the relay silently drops the connection while Socket.IO's connected flag is stale (#6212, [#6213] by @dennis-agentic, @evnchn, @denniswittich, @falkoschindler)
• Route mouse-button and exact modifiers of generic events correctly and preserve hyphenated key modifiers (#6199, [#6206] by @evnchn, @falkoschindler)
• Disconnect resize observers of ui.header and ui.echart (nicegui.io) and document key listeners of ui.keyboard (nicegui.io) when the element is unmounted (#6189, [#6190], [#6196] by @evnchn, @falkoschindler)
• Remove bindings when a ui.scene (nicegui.io) Object3D is deleted and guard "dragend" events against deleted objects (#6192, [#6195] by @evnchn, @falkoschindler)
• Fix Redis storage so key deletions propagate across instances (#6194 by @evnchn, @falkoschindler)
• Fix element.move() orphaning an element when the target slot is invalid and guard against moving an element into its own descendant (#6176, [#6180] by @evnchn, @falkoschindler)
• Handle parameter coercion errors in ui.sub_pages builders like builder errors (#6186 by @evnchn, @falkoschindler)
• Fix error reporting when an async ui.sub_pages builder raises after its client has been deleted (#6231, [#6270] by @evnchn, @SaadZahem, @falkoschindler)
• Clean up the spilled temporary file when a ui.upload (nicegui.io) fails mid-transfer (#6187 by @evnchn, @falkoschindler)
• Remove leaked auto-generated route when switching an element's source away from a local file (#6204 by @evnchn, @falkoschindler)
• Fix ui.upload (nicegui.io) unregistering the application's route instead of its own auto-generated route on delete (#6236, [#6256] by @evnchn, @SaadZahem, @falkoschindler)
• Support URL-encoded data-URL favicons (#6191 by @evnchn, @falkoschindler)
• Fix ui.color_input crashing when the value is None with preview enabled (#6201 by @evnchn, @falkoschindler)
• Fix ui.number (nicegui.io)'s out_of_limits raising a TypeError when the value is None (#6179 by @evnchn, @falkoschindler)
• Fix ui.line_plot's push crashing on empty data with automatic limits (#6183 by @evnchn, @falkoschindler)
• Fix lost "done" decoration when navigating a ui.stepper (nicegui.io) by Step object (#6200 by @evnchn, @falkoschindler)
• Fix Event.emitted() (nicegui.io) timeout handling on Python 3.10 (#6197 by @evnchn, @falkoschindler)

Documentation

• Document Socket.IO client_id forging as a commonly misreported security pattern and explain which random IDs are secrets (#6239, [#6268] by @falkoschindler, @evnchn)
• Never show a fabricated GitHub star count on the website by baking it in at deploy time (#6211, [#6218], [#6240] by @evnchn, @falkoschindler)
• Fix ChromeDriver install instructions for Linux in tests/README.md (#6266, [#6267], [#6274] by @evnchn, @SaadZahem, @falkoschindler)
• Prefer behavior tests over tests coupled to implementation details in CONTRIBUTING.md (#6219 by @falkoschindler, @evnchn)
• Fix broken DiscoLike sponsor logo on the website (#6253 by @evnchn, @falkoschindler)
• Add pointer cursor to the ui.popup (nicegui.io) demo's anchor label (#6207 by @evnchn, @falkoschindler)
• Fix ui.pagination (nicegui.io)'s direction_links docstring (#6203 by @evnchn, @falkoschindler)

Testing

• Add scoped User lookups and a pytest example (#6015 by @ZhuGC-Centogene, @evnchn, @falkoschindler)

Dependencies

• Update echarts-gl to 2.1.0 (#6216 by @falkoschindler, @evnchn)
• Move the lxml security pins to the website dependency group (#6208 by @evnchn, @falkoschindler)

Infrastructure

• Keep JavaScript source maps out of the wheel (#6209 by @evnchn, @falkoschindler)
• Add a Windows CI leg for the storage file-lock tests (#6160 by @evnchn, @Jepson2k, @falkoschindler)

Special thanks to our top sponsors DiscoLike Inc., TestMu AI and Lechler GmbH ✨

and all our other sponsors and contributors for supporting this project!

🙏 Want to support this project? Check out our GitHub Sponsors page to help us keep building amazing features!