NiceGUI Files

Security

• ⚠️ Strip Windows drive prefixes like C: from the names of files uploaded via ui.upload (nicegui.io), which could escape the upload directory (GHSA-75w7-4mx9-8qqc by @iaohkut, @evnchn, @falkoschindler)
• ⚠️ Stop evaluating :-prefixed keys inside the data of ui.aggrid (nicegui.io) and ui.echart (nicegui.io) as JavaScript, e.g. DataFrame column names (GHSA-m47w-xwfc-82pf by @iaohkut, @unbengable12, @SaaSforUS, @evnchn, @falkoschindler)

• ⚠️ Sanitize the HTML value of ui.editor (nicegui.io) in the browser by default, preventing stored XSS when the value is shared across clients (GHSA-9g7v-h3pr-4qm8 by @evnchn, @falkoschindler)

  Breaking change: ui.editor no longer displays markup that DOMPurify removes, like <iframe> embeds, and drops it from the value once the user edits the content; pass sanitize=False for trusted content.

New features and enhancements

• Introduce ui.uplot (nicegui.io) for fast canvas charts of large or high-frequency datasets (#2669, [#3340], [#5917] by @CSharpDummy, @tungchentsai, @NvNielen, @Noghpu, @evnchn, @falkoschindler)
• Add Plane, Cone, Torus, Capsule, Lathe and Polyline objects, a polar_grid parameter and rotate(order=...) to ui.scene (nicegui.io) (#5989 by @Jepson2k, @evnchn, @falkoschindler)
• Add nicegui.json.register_type() to serialize custom types (#6406 by @KotzaBoss, @falkoschindler)
• Speed up element construction by skipping signature checks for the internal update handlers of classes, style and props (#6098, [#6388], [#6403] by @maybites, @DiebBlue, @falkoschindler)

Bugfixes

• Fix ui.sub_pages with root_path not leaving the page on links outside its root (#6385, [#6400] by @techmatik, @inchang-ing, @evnchn, @falkoschindler)
• Fix ui.sub_pages not converting parameters annotated as int | None or in modules with from __future__ import annotations (#6452, [#6454] by @Dengzi555, @evnchn, @falkoschindler)

• Fix Client.page_routes, ui.link (nicegui.io) and ui.navigate.to (nicegui.io) ignoring the prefixes of included routers (#6418, [#6423] by @falkoschindler, @shi-felix, @evnchn)

  Breaking change: For pages on included routers, app.clients(path) now expects the full path including the include prefix, e.g. app.clients('/v2/p/x') instead of app.clients('/p/x').

• Fix ui.scene (nicegui.io) and ui.leaflet (nicegui.io) never initializing when created hidden (#6414, [#6424] by @falkoschindler, @shi-felix, @evnchn)

• Fix ui.leaflet (nicegui.io) going blank after its classes change, e.g. when hiding and showing the map (#6428, [#6433] by @evnchn, @falkoschindler)
• Raise a RuntimeError from initialized() of ui.scene (nicegui.io) when WebGL is unavailable instead of waiting forever (#6405 by @evnchn, @falkoschindler)
• Fix slow style recalculation on pages with many sibling elements, a regression in 3.10 (#6411, [#6426] by @phreakocious, @Ayush-kukrety, @evnchn, @falkoschindler)
• Fix template slots being remounted on every render, which swallowed the first click on removable chips of a ui.select (nicegui.io) (#6284, [#6287] by @samuller, @SaadZahem, @evnchn, @falkoschindler)
• Fix ui.highchart (nicegui.io) failing when the first chart is created in an event handler (#6290, [#6391] by @evnchn, @SaadZahem, @falkoschindler)
• Fix an outdated async validation result overwriting the error state of the current input (#6453, [#6455] by @Wang-MuFF, @falkoschindler)
• Fix deep-copied observable collections notifying their original parent (#6448, [#6449] by @Yzzz88, @falkoschindler)
• Fix ElementFilter.exclude() (nicegui.io) ignoring markers with multiple names (#6456 by @Dengzi555, @falkoschindler)
• Fix the typing of bindable_dataclass when called with arguments like bindable_fields (#6251, [#6252] by @FranzForstmayr, @evnchn, @falkoschindler)
• Fix ui.timer (nicegui.io) cancelling @await_on_shutdown callbacks on shutdown (#6331, [#6372] by @evnchn, @Kshot3000, @falkoschindler)
• Fix shutdown waiting for a ui.timer (nicegui.io) whose callback swallows the cancellation (#6436, [#6442] by @phreakocious, @evnchn, @falkoschindler)
• Fix the native window closing during hot reload on Windows (#6381, [#6407] by @abi55, @evnchn, @falkoschindler)
• Fix the process never exiting after closing the native window in a console-less build (#6392, [#6396] by @SHDocter, @Boulea7, @evnchn, @falkoschindler)
• Fix ui.mermaid (nicegui.io) delivering wrong node IDs to on_node_click (#6220 by @evnchn, @falkoschindler)
• Fix ui.code (nicegui.io) breaking on content with its own code fences (#6404 by @zurrll, @falkoschindler)
• Fix the focus outline of ui.codemirror (nicegui.io) (#6429 by @falkoschindler, @evnchn)
• Fix deleted ui.upload (nicegui.io) elements being kept alive by their upload routes (#6384 by @Melvin0hd, @falkoschindler)
• Fix the ES module fallback message blaming the browser when scripts are blocked (#6436, [#6439] by @phreakocious, @falkoschindler)

Documentation

• Document that path and remaining_path of PageArguments add up to the full path (#6422, [#6430] by @falkoschindler, @evnchn, @shi-felix)
• Document how to run the testing fixtures without a main file (#6436, [#6438] by @phreakocious, @falkoschindler)
• Fix the on_point_click parameter name in the ui.echart.from_pyecharts docstring (#6431 by @mmporong, @falkoschindler)
• Harden the "Image Mask Overlay" and "Local File Picker" examples (#6389 by @falkoschindler, @evnchn)

Testing

• Fix the User simulation routing ui.navigate, ui.notify and ui.download to the last User touched (#6413, [#6415] by @falkoschindler, @evnchn)
• Fix the User simulation not triggering kebab-case events (#6436, [#6437] by @phreakocious, @falkoschindler)
• Fix the user fixture keeping earlier runs of the main file and the elements of earlier tests alive (#6425, [#6427] by @rodja, @JamesSmaldon, @evnchn, @falkoschindler)

Special thanks to our top sponsors DiscoLike Inc., TestMu AI and Lechler GmbH ✨

and all our other sponsors and contributors for supporting this project!

🙏 Want to support this project? Check out our GitHub Sponsors page to help us keep building amazing features!