refactor: v2 release #6903

wmertens · 2024-09-22T19:36:11Z

This PR is for showing progress on v2, and having installable npm packages.

DO NOT MERGE

The changes are meant to be readable and maintainable, so if things are unclear please let us know.

changeset-bot · 2024-09-22T19:36:15Z

🦋 Changeset detected

Latest commit: 495e8d9

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

packages/qwik/src/core/v2/client/dom-container.ts

packages/qwik/src/core/v2/client/vnode.ts

pkg-pr-new · 2024-09-23T08:08:51Z

Open in StackBlitz

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/core@6903

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/router@6903

npm i https://pkg.pr.new/QwikDev/qwik/eslint-plugin-qwik@6903

npm i https://pkg.pr.new/QwikDev/qwik/create-qwik@6903

commit: 495e8d9

github-actions · 2024-09-23T08:09:11Z

built with Refined Cloudflare Pages Action

⚡ Cloudflare Pages Deployment

Name	Status	Preview	Last Commit
qwik-docs	✅ Ready (View Log)	Visit Preview	`495e8d9`

packages/qwik/src/core/client/dom-container.ts

packages/qwik/src/core/client/vnode.ts

+        const insertBefore = journal[idx++] as Element | Text | null;
+        let newChild: any;
+        while (idx < length && typeof (newChild = journal[idx]) !== 'number') {
+          insertParent.insertBefore(newChild, insertBefore);


packages/qwik-router/src/buildtime/runtime-generation/generate-entries.ts

+  c.push(`\n/** Qwik Router Entries (${entries.length}) */`);
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i];
+    c.push(`export const ${entry.id} = () => import(${JSON.stringify(entry.filePath)});`);


To fix the problem, we need to ensure that entry.filePath is properly sanitized before being used in the dynamically generated JavaScript code. We can achieve this by escaping potentially dangerous characters in the entry.filePath string. This can be done by implementing a function similar to escapeUnsafeChars from the example provided in the background section.

Implement a function escapeUnsafeChars to escape potentially dangerous characters.

Use this function to sanitize entry.filePath before including it in the generated code.

scripts/api-docs.ts

packages/qwik/src/core/client/vnode-diff.ts

+        }
+
+        if (key === dangerouslySetInnerHTML) {
+          element.innerHTML = value as string;


To fix the issue, we need to ensure that the value assigned to dangerouslySetInnerHTML is properly sanitized or escaped to prevent XSS vulnerabilities. The best approach is to use a utility function like escapeHTML to encode special HTML characters (<, >, &, etc.) in the value before assigning it to innerHTML. This ensures that any potentially malicious content is rendered as plain text rather than executable HTML.

Changes will be made in the vnode_diff function in packages/qwik/src/core/client/vnode-diff.ts to apply escapeHTML to value before assigning it to element.innerHTML.

fix(core): performance improvements

docs: updated changeset as per review

chore: merge main into v2

chore: update ComponentStylesPrefixContent change description

fix(core): non-wrapped expressions aren't const

Implement ViewTransition in v2

…PIs, show an explanation (#7571) * fix(repl): improve deepUpdate logic for array item matching * fix it * fix(core): prevent server-side usage of browser APIs Add error handling for browser API usage during server-side rendering. The changes include: - Adding a new error code `QError.notUsingBrowserAPiInserver` to handle cases where browser APIs are used on the server. - Updating the `use-task.spec.tsx` test to catch and verify the new error. - Modifying `qrl-class.ts` to throw the error when browser APIs are accessed during server-side rendering. This ensures that developers are aware of and avoid using browser-specific APIs in server-side contexts, preventing runtime errors. * add change * fix(qrl): improve error message for browser API usage in SSR * docs(changeset): update changeset from major to patch Update the changeset to correctly reflect the version bump as a patch instead of a major version change. This ensures accurate versioning and release notes. * feat(core): improve error message for SSR browser API usage When an error occurs during SSR due to using browser APIs, provide a clearer explanation to help developers understand the issue and how to fix it. This enhances debugging experience and reduces confusion. * test(use-task): update test case for error handling in useTask$ Ensure the test correctly verifies error messages thrown within useTask$ by adding a new component and refining assertions * test(use-task): update error handling test to use ErrorProvider Modify the test to wrap components with ErrorProvider and update the expected error message. This ensures consistent error handling and improves test reliability. * feat(eslint-plugin-qwik): add scope-use-task rule to enforce server guard in useTask$ The new rule `scope-use-task` ensures that Node.js APIs (e.g., `process.env`) are only used within `useTask$` when guarded by a server check (e.g., `isServer`). This prevents unsafe usage of Node.js APIs in client-side code. The rule also checks for indirect API usage via function calls and provides appropriate error messages to guide developers in adding the necessary guards. * test(scope-use-task): update test cases for unsafe API usage Refactor test files to include additional scenarios for unsafe API usage in Qwik components. This ensures comprehensive coverage for detecting unsafe API calls in various contexts. * fix(qrl): handle window reference errors in server mode Add try-catch block to handle ReferenceError for 'window' in server mode during development. Improve error message to guide developers to use 'if (isBrowser)' checks when needed. Remove duplicate error handling code that was previously in the invoke function since it's now handled at the qrl level. * ❤️

caused repl segments to no longer show

chore: merge main into v2

feat: implement useAsyncComputed$

chore: remove v1 changesets

also handle non-html containers

chore: merge main into v2: qwikloader in a separate bundle + fixups

this was hiding output when warnings

fix(repl): always update even when diagnostics

or you get some circular warnings

fix(core): import isDev from build directly

fix(manifest): order qwikloader key higher up in the json

wmertens added the VERSION: upcoming major label Sep 22, 2024

github-advanced-security bot found potential problems Sep 22, 2024

View reviewed changes

packages/qwik/src/core/v2/client/dom-container.ts Fixed Show fixed Hide fixed

packages/qwik/src/core/v2/client/vnode.ts Fixed Show fixed Hide fixed

packages/qwik/src/core/v2/client/vnode.ts Fixed Show fixed Hide fixed

github-advanced-security bot found potential problems Sep 26, 2024

View reviewed changes

wmertens changed the title ~~refactor: v2 framework rewrite~~ refactor: v2 release Oct 8, 2024

wmertens marked this pull request as ready for review October 17, 2024 21:25

wmertens requested review from a team as code owners October 17, 2024 21:25

This was referenced Oct 29, 2024

Why does this not publish PR packages? stackblitz-labs/pkg.pr.new#270

Closed

Support tag for release stackblitz-labs/pkg.pr.new#169

Closed

github-advanced-security bot found potential problems Nov 26, 2024

View reviewed changes

github-advanced-security bot found potential problems Dec 13, 2024

View reviewed changes

scripts/api-docs.ts Fixed Show fixed Hide fixed

github-advanced-security bot found potential problems Jan 25, 2025

View reviewed changes

Varixo and others added 14 commits February 16, 2025 10:56

fix(perf): change VNodes props structure

002407e

fix(perf): isForeignObject check

2adf3ad

fix(perf): use for of instead of foreach for signals

6c80550

fix(perf): cleaning up subscription

1e4411c

fix: invalid self-reference to inserted node as next sibling

d8740b6

Merge pull request #7346 from QwikDev/v2-perf-improv

f75c875

fix(core): performance improvements

Merge pull request #7332 from sreeisalso/qwik-prefix

630d35d

docs: updated changeset as per review

Merge remote-tracking branch 'origin/main' into v2-merge-main

c3ba77d

Merge pull request #7352 from QwikDev/v2-merge-main

f9a5268

chore: merge main into v2

chore: update ComponentStylesPrefixContent change description

51bdaa6

Merge pull request #7353 from QwikDev/update-desc

f1fef6f

chore: update ComponentStylesPrefixContent change description

fix(core): non-wrapped expressions aren't const

63a6512

Merge pull request #7355 from QwikDev/fix-wrap

ea02b0f

fix(core): non-wrapped expressions aren't const

fix: prevent reusing projection if is marked as deleted

7ef293a

wmertens and others added 30 commits May 30, 2025 16:28

Merge pull request #7391 from GrandSchtroumpf/v2-view-transition

f4effe4

Implement ViewTransition in v2

Merge remote-tracking branch 'origin/main' into v2-merge-main

d849447

fix(cjs build): correctly replace base url

966746c

fix(repl): correct base url

ff279bb

fix(core): circular import issue

4c81676

caused repl segments to no longer show

fix(renderToString): pass all options to renderToStream

6ab8be0

feat(repl): optionally enable preloader

e8e553f

Merge pull request #7651 from QwikDev/v2-merge-main

2a3febf

chore: merge main into v2

add changesets

aa45990

dont use async for processJSXNode

72ba9f9

Merge pull request #7589 from QwikDev/v2-use-async-computed

c918d2b

feat: implement useAsyncComputed$

chore: remove v1 changesets

130f65d

Merge pull request #7652 from QwikDev/v2-remove-v1-changesets

cf8d611

chore: remove v1 changesets

Merge remote-tracking branch 'origin/main' into v2-merge-main

da6e98f

fix(core): properly add qwik/preloader to the head

68774d1

also handle non-html containers

Merge pull request #7653 from QwikDev/v2-merge-main

0911981

chore: merge main into v2: qwikloader in a separate bundle + fixups

fix(repl): always update even when diagnostics

d54b2a5

this was hiding output when warnings

Merge pull request #7654 from QwikDev/fix-repl

d524520

fix(repl): always update even when diagnostics

fix(core): import isDev from build directly

f0700d0

or you get some circular warnings

fix(e2e): make auth test more robust

700c5e8

Merge pull request #7655 from QwikDev/fix-repl

cf30a10

fix(core): import isDev from build directly

fix(manifest): order qwikloader key higher up in the json

41a1d3f

Merge pull request #7656 from QwikDev/fix-repl

6fe4028

fix(manifest): order qwikloader key higher up in the json

updated changesets config to "beta" for 2.0

d8c12df

reverted back to alpha, will make a PR

5bb0f67

updated to 2.0 beta

2f57c47

Merge pull request #7659 from QwikDev/pr-2-beta

2fe21f5

Version Packages (beta)

43d1e4d

Merge pull request #7620 from QwikDev/changeset-release/build/v2

495e8d9

@@ -2,2 +2,20 @@
+            function escapeUnsafeChars(str: string): string {
+              const charMap: { [key: string]: string } = {
+                '<': '\\u003C',
+                '>': '\\u003E',
+                '/': '\\u002F',
+                '\\': '\\\\',
+                '\b': '\\b',
+               '\f': '\\f',
+               '\n': '\\n',
+               '\r': '\\r',
+               '\t': '\\t',
+               '\0': '\\0',
+               '\u2028': '\\u2028',
+               '\u2029': '\\u2029'
+             };
+             return str.replace(/[<>\b\f\n\r\t\0\u2028\u2029]/g, x => charMap[x]);
+            }
             export function createEntries(ctx: BuildContext, c: string[]) {
@@ -25,3 +43,3 @@
                 const entry = entries[i];
-                c.push(`export const ${entry.id} = () => import(${JSON.stringify(entry.filePath)});`);
+                c.push(`export const ${entry.id} = () => import(${escapeUnsafeChars(JSON.stringify(entry.filePath))});`);
               }

@@ -655,3 +655,3 @@
                     if (key === dangerouslySetInnerHTML) {
-                      element.innerHTML = value as string;
+                      element.innerHTML = escapeHTML(value as string);
                       element.setAttribute(QContainerAttr, QContainerValue.HTML);

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

refactor: v2 release #6903

refactor: v2 release #6903

Uh oh!

wmertens commented Sep 22, 2024 •

edited

Loading

Uh oh!

changeset-bot bot commented Sep 22, 2024 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pkg-pr-new bot commented Sep 23, 2024 •

edited

Loading

Uh oh!

github-actions bot commented Sep 23, 2024 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Check warning

Check warning

Copilot Autofix

Uh oh!

Check warning

Copilot Autofix

Uh oh!

refactor: v2 release #6903

Are you sure you want to change the base?

refactor: v2 release #6903

Uh oh!

Conversation

wmertens commented Sep 22, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Sep 22, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pkg-pr-new bot commented Sep 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Sep 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

built with Refined Cloudflare Pages Action

⚡ Cloudflare Pages Deployment

Uh oh!

Uh oh!

Uh oh!

Check warning

Uh oh!

Uh oh!

Check warning

Uh oh!

Copilot Autofix

Uh oh!

Check warning

Uh oh!

Copilot Autofix

Uh oh!

wmertens commented Sep 22, 2024 •

edited

Loading

changeset-bot bot commented Sep 22, 2024 •

edited

Loading

pkg-pr-new bot commented Sep 23, 2024 •

edited

Loading

github-actions bot commented Sep 23, 2024 •

edited

Loading