4.5.0

The plugin's source is now split into modules, and this release fixes a long list of bugs found while pinning down its behavior. No breaking changes are intended. Behavior changes only where the old behavior was a bug or differed from a native form submission, so read the lists below if your code relied on any of them. jQuery 1.7.2 or later is still supported. Every change is tested on jQuery 1.7.2, 3.7.1 and 4.0.0.

New

• delegation: "<selector>" limits ajaxForm delegation to forms that match a selector (#353). delegation: true is unchanged, but it now logs a warning on jQuery 3 and later, where it binds every form on the page.
• ajaxFormUnbind() also removes delegated bindings, and ajaxFormUnbind(selector) removes one of them.
• requestFormat: "json" sends the form as a JSON body (#545). The idea came from #557 by @zhangciwu.
• error and complete accept arrays of functions, as in $.ajax.
• ajaxSubmit on jQuery's slim build throws a clear error (#541) instead of failing later.

Deprecations

These log a warning once per page when $.fn.ajaxSubmit.debug is on, and 5.0 will remove them.

• clearInputs: use clearFields. $.fn.attr2: use .prop() or .attr().
• ajaxForm on an empty selection before the DOM is ready, which queues the binding: call it inside $(fn), or use delegation: "<selector>".
• The iframe transport chosen automatically when the browser has no FormData: set iframe: true.
• The closeKeepAlive option, a workaround for Safari 3 and 4.
• jQuery older than 3.5. 5.0 will need jQuery 3.5 or later.

enable and selected are kept.

Fixes: submission and transports

• Every transport uses the same request method. method wins over type, and it is read after beforeSubmit.
• A url of false or "" submits to the form's action.
• A string data option is treated as a query string.
• this in callbacks is the caller's context object, not a copy of it.
• success runs when target matches nothing.
• beforeSend returning false cancels a FormData upload, as it already did on the other transports.
• uploadProgress keeps a custom xhr factory, and reports position 0 and 0% for a progress event with nothing loaded.
• A multipart enctype is recognized regardless of case and surrounding spaces.
• File uploads with GET put file names in the URL, never [object File].

Fixes: iframe uploads

• Events fire in the same order as $.ajax, and a beforeSend veto ends the global events with ajaxStop.
• Every upload settles exactly once, including when an exception is thrown. abort() before the delayed post cancels it.
• Uploads started in the same millisecond use different frames, and an iframeTarget without a name receives the upload.
• dataType is read case-insensitively.
• A frame that is not in the document fails with an error instead of opening a new window.
• The form's attributes are restored exactly after the upload (#380).
• With closeKeepAlive, controls disabled in beforeSubmit are posted and re-enabled afterwards.

Fixes: serialization, fields and form members

• Controls named like form members (getAttribute, ownerDocument, tagName, reset, clk and others) no longer break the plugin. A control named parentNode throws a clear error.
• The contents of a disabled <fieldset> or <optgroup> are not sent. semantic: true sends only controls the form owns. Named fieldset, output and object elements are not sent. A lone CR in a value is sent as CRLF on every jQuery version.
• ajaxForm sends the browser's SubmitEvent.submitter when no click was captured, for example after pressing Enter or calling requestSubmit(button).
• resetForm matches a native reset. It keeps the values of checkboxes, radios, hidden inputs and buttons, empties file inputs instead of throwing, and selects the last default option of a single select.
• clearForm and clearFields clear datetime-local inputs.

Docs

• How to sanitize a response inserted by target, with dataFilter (jQuery 3.5 and later).
• The list of options that must come only from trusted code, not from user input.
• What an iframe upload response has to look like.

Build

• The classic build runs its whole factory in strict mode. The same three dist files are published.

Known, not changed in 4.5.0

• String values of target and iframeTarget are still passed to $(), so pass only selectors from your own code (see the trusted options list). 4.6.0 will look them up only as selectors.

Full changelog: v4.4.0...v4.5.0