Security

• ⚠️ Prevent memory exhaustion via media streaming routes (GHSA-w5g8-5849-vj76 by @aest3ra, @Khaliun-sw1, @evnchn, @falkoschindler)

New features and enhancements

• Add ui.parallax element based on Quasar Parallax (#4817 by @evnchn, @falkoschindler)
• Add camera controls "trackball" and "map" for ui.scene (#3710, #4820 by @javierlopezrodriguez, @evnchn, @falkoschindler)
• Add native window events like shown, resized and file drop to app.native (#3378, #5866 by @EmberLightVFX, @falkoschindler, @evnchn)
• Allow app.clients() to return all clients when path is None (#5853 by @AlePiccin, @evnchn, @falkoschindler)
• Remove KWONLY_SLOTS constant and inline @dataclass arguments (#5856 by @falkoschindler, @evnchn)

Bugfixes

• Fix broken session storage when attaching to a FastAPI app that already has SessionMiddleware (#2578, #5857 by @denniswittich, @falkoschindler, @evnchn)
• Fix ui.log scroll to bottom on Firefox (#5788, #5842 by @platinops, @falkoschindler, @evnchn)
• Fix sort arrow animation in custom table header cells (#5870, #5871 by @JuliusKoenig, @falkoschindler, @evnchn)
• Fix navigation from root page sub-pages to other @ui.page routes (#5705, #5777, #5886 by @CatamountJack, @falkoschindler, @evnchn)
• Fix syntax highlighting in ui.code by always using DOMPurify (#5877 by @falkoschindler, @evnchn)
• Fix find_spec crashes in compiled environments like PyInstaller (#5747, #5836 by @evnchn, @falkoschindler)
• Fix @ui.refreshable_method refresh only updating last instance (#5888, #5890 by @rodja, @evnchn)

Documentation

• Use IntersectionObserver for the navigation tree to reduce render time on small screens (#5832 by @evnchn, @falkoschindler)
• Add "Client-Side Secrets" section to security documentation (#5838 by @oxqnd, @evnchn, @falkoschindler)
• Improve the SVG clock example (#5854 by @rolfn, @falkoschindler, @evnchn)
• Replace the outdated app.storage.individual API with app.storage.user (#5874 by @KrilleGH)
• Fix invalid Python code shown in SPA demo (#5881 by @jmerle, @evnchn, @falkoschindler)
• Use public API imports in examples, tests, and website (#5884 by @falkoschindler)

Testing

• Fix User.should_see for child elements inside hidden containers (#5873 by @paco-sevilla, @falkoschindler)
• Fix User test simulation for select options with None as value (#5880, #5883 by @atollk, @falkoschindler, @evnchn)
• Support clicking ui.tab in user simulation (#5885, #5887 by @atollk, @falkoschindler, @evnchn)

Dependencies

• Fix Dependabot alerts by upgrading rollup, rimraf and Svelte (#5844 by @falkoschindler, @evnchn)
• Fix Dependabot alerts by upgrading vulnerable npm and pip dependencies (#5850 by @falkoschindler, @evnchn)
• Bump actions/upload-artifact from 6 to 7 (#5846 by @dependabot)
• Bump docker/build-push-action from 6 to 7 (#5861 by @dependabot)
• Bump docker/setup-qemu-action from 3 to 4 (#5862 by @dependabot)
• Bump docker/setup-buildx-action from 3 to 4 (#5863 by @dependabot)
• Bump docker/login-action from 3 to 4 (#5864 by @dependabot)

Special thanks to our top sponsors Lechler GmbH and TestMu AI ✨

and all our other sponsors and contributors for supporting this project!

🙏 Want to support this project? Check out our GitHub Sponsors page to help us keep building amazing features!