1.7.1

Full Changelog: 1.7.0...1.7.1

Evergreen: the modernization release (ES2022, native fetch, Vitest, Yarn 4)

Drops the dead IE6/IE7 code paths, modernizes prototype method syntax to
ES6 shorthand, ships a native fetch() fallback for Backbone.ajax,
and moves the project off npm onto Yarn 4.

Added

• Backbone.ajax falls back to native fetch() when Backbone.$
  is absent. Previously the library was unusable without jQuery (or a
  hand-rolled Backbone.ajax override). The fallback maps the subset
  of jQuery options that Backbone.sync emits — type, url, data,
  contentType, dataType, headers, beforeSend, success,
  error — onto fetch() + AbortController, and returns a thenable
  carrying .abort() so the var xhr = model.fetch(); xhr.abort();
  consumer pattern keeps working. The jQuery path is preserved verbatim
  whenever Backbone.$ is present.

Removed (breaking for IE6/IE7)

• The hidden iframe trick that simulated hashchange for IE7, plus
  the four call sites in History that special-cased this.iframe.
• The setInterval polling fallback for browsers without
  onhashchange, and the orphan History#interval knob that only
  existed to feed it.
• The attachEvent / detachEvent shims around
  addEventListener / removeEventListener.
• The document.documentMode > 7 gate that guarded against IE7's
  broken onhashchange.
• Zepto and Ender from the browser-global $ resolution chain in the
  UMD factory; only jQuery (or $) remains.
• The IE6 hash/search and Firefox location.hash-decoding workaround
  comments. History#getHash also loses its unused window argument.
• The attachEvent / detachEvent ESLint globals.

Changed

• Every prototype method literal on Model, Collection, View,
  Router, and History now uses ES6 method shorthand:
  methodName(args) { ... } instead of
  methodName: function(args) { ... }. Pure syntactic, no behavior
  change. The function-style constructor wrappers
  (var Model = Backbone.Model = function(...) {...}) are preserved
  on purpose: converting them to class would break the documented
  Backbone.Model.apply(this, arguments) pattern in user-provided
  constructor: overrides (exercised by test jashkenas#2612), since super()
  must come first in a derived class constructor.
• Backbone.VERSION, the source header, and package.json are all
  aligned at 1.7.0.

Tooling

• Package manager: npm → Yarn 4.14, pinned via Corepack and the
  packageManager field. node-modules linker for full compatibility
  with Karma/Rollup/Docco; no Zero-Install (cache stays out of git).
  package-lock.json is replaced by yarn.lock.
• CI Node 14 → 20, required by Yarn 4 (≥ 18.12). npm ci becomes
  yarn install --immutable.
• dependenciesMeta.puppeteer.built is set explicitly so Yarn 4's
  default postinstall block doesn't strand the Chromium download that
  karma.conf.js depends on.

Bug fixes, modern toolchain, 0 vulnerabilities

A maintenance pass that closes a backlog of bugs, modernizes the test/build
toolchain, and clears every known vulnerability without breaking drop-in
compatibility with upstream Backbone.

Fixed

• Memory leak when a non-Backbone listenee's on throws. Events.listenTo
  used to insert the new Listening bookkeeping before calling obj.on(...),
  so a throw left an orphaned reference in _listeningTo. The bookkeeping is
  now rolled back when obj.on throws.
• Memory leak when a callback re-enters stopListening during a global
  stop. Events.stopListening() (with no argument) snapshots all listenee
  ids; if an off handler removed a later id from the snapshot, the outer
  loop hit break and abandoned every remaining listenee. Changed to
  continue.
• Backbone.sync was mutating the caller's options. Repeated calls with
  the same options compounded the error / beforeSend wrappers, firing
  callbacks and triggers multiple times. sync now operates on a shallow
  clone of the caller's options while still publishing xhr and the
  jQuery textStatus / errorThrown fields on the caller object so the
  public contract is preserved.
• Collection.set/add silently corrupted state when options.at coerced
  to NaN. The model was registered in _byId but never spliced into
  this.models. A non-numeric at is now treated as if it were omitted
  (append at the end).
• Router.execute threw TypeError when this[name] resolved to a
  non-function (e.g. a string handler). It now silently no-ops and the
  route: (empty name) trigger is skipped so listeners no longer see a
  spurious event.
• View.undelegate threw if $el had been nulled out by a subclass
  _removeElement. Now mirrors undelegateEvents's if (this.$el) guard.
• History.start() produced a cryptic ReferenceError outside the
  browser despite the constructor specifically guarding for non-browser
  use. It now throws a clear Backbone.history.start() requires a browser window error instead.
• Backbone.sync was emitting the request event with the cloned options
  object (the internal clone introduced to stop error/beforeSend from
  compounding). Listeners that mutate opts for instrumentation
  (e.g. tagging a start timestamp on request, reading it on sync) saw
  their mutations land on the discarded clone. request now fires with the
  caller's own options, matching upstream behavior.
• Backbone.history.stop() threw ReferenceError outside a browser
  when called before any successful start() (typical in test cleanup).
  Now early-returns when History.started is false, mirroring the guard
  in start() and navigate().
• require('jquery') swallowed every error, not just MODULE_NOT_FOUND.
  ESM/CJS mismatches and corrupt installs now propagate instead of leaving
  Backbone half-initialized. jQuery 4's jQuery requires a window with a document is also tolerated (Node-only Backbone use without DOM is
  unaffected when jQuery 4 is present as a transitive dependency).
• debugInfo mis-identified bundled browser builds as Node when bundlers
  (Webpack, etc.) injected a polyfilled process. Detection now requires
  process.versions.node.
• Backbone.VERSION was out of sync with package.json after the 1.6.1
  / 1.6.2 fork bumps. All three (source header, Backbone.VERSION, and
  package.json) are aligned again.

Changed

• changeId guard expression simplified to
  !_.isEqual(prevId, this.id) && !(prevId == null && this.id == null).
  Behavior unchanged, readability improved.
• Collection.set(null) returns the collection instead of undefined,
  matching Model.set(null) and keeping add(null) chainable.
• extend() static-merge priority is now staticProps > child's own preexisting > parent. Previously parent statics could silently clobber
  statics the caller had already attached to a user-supplied constructor.
  The common cases (no preexisting constructor statics) are unchanged —
  parent statics still flow into the child to fill gaps.

Tooling

• Test runner: PhantomJS → puppeteer-bundled Chrome Headless.
  karma-phantomjs-launcher + phantomjs-prebuilt (archived since 2018,
  unreliable install on modern systems) replaced with karma-chrome-launcher
  • puppeteer, which ships its own Chromium binary. npm test no longer
    requires a system Chrome.
• .gitattributes added with * text=auto eol=lf to keep line endings
  consistent across OSes regardless of each developer's core.autocrlf
  setting. Fixes the cascade of linebreak-style errors on Windows
  checkouts.
• ESLint 8 → 10, including the migration from three nested .eslintrc
  files to one flat eslint.config.js. Stylistic rules (indent, quotes,
  semi, linebreak-style, …) moved to @stylistic/eslint-plugin. Deprecated
  rules (no-catch-shadow, no-native-reassign, no-negated-in-lhs,
  no-new-object, no-spaced-func) replaced or removed.
• All other devDependencies bumped: rollup 3→4, puppeteer 22→24
  (Chromium 127→148), cpy-cli 3→7, replace-in-file 7→8, plus every
  in-range patch/minor.
• .idea/ and .claude/ added to .gitignore.

Security

• underscore 1.13.2 → 1.13.8 patches the only CVE that reached
  consumers of this package
  (GHSA-qpx9-hpmf-5gmw:
  unbounded recursion DoS in _.flatten / _.isEqual).
• The dependency range is now ^1.8.3 instead of >=1.8.3, so a future
  underscore 2.x won't be pulled in untested.
• npm audit is clean: 0 vulnerabilities. Down from 29 (2 low, 10
  moderate, 16 high, 1 critical) at the start of this release cycle.

Compatibility

• Verified against jQuery 4.0 (stable since January 2026) in addition
  to the existing 1.8.x → 3.x range. Swapping jQuery 4 into the test
  vendor directory: 450 karma tests green, 4 Node CoffeeScript tests
  green. The only Backbone-side adjustment was widening the Node loader
  guard (see Fixed) to absorb jQuery 4's jQuery requires a window with a document error when loaded server-side without a DOM. None
  of the 8 jQuery APIs Backbone consumes ($(), $.ajax, .on/.off
  with namespaces, .find, .remove, .attr, [0]) was affected by
  the 4.0 upgrade.

Added (tests)

Regression coverage was added for every behavioral fix above:

• changeId only fires on real id changes (no spurious null/undefined
  transitions)
• listenTo cleans up _listeningTo when obj.on throws
• stopListening keeps cleaning remaining listenees after re-entrancy
• Backbone.sync does not mutate the caller-supplied options
• Backbone.sync emits request with the caller options (mutations from a
  request listener persist on the same object)
• Collection.add(model, {at: 'invalid'}) appends instead of corrupting
  the index
• Collection.set(null) and Collection.add(null) return the collection
• Router.execute ignores non-function callbacks instead of throwing
• extend() static merge priority is what the docstring claims

448 → 450 karma tests, all green.

1.6.2 - trigger changeId

Full Changelog: 1.6.1...1.6.2

1.6.1

Full Changelog: 1.6.0...1.6.1