Prepare a 4.0 blog post & an upgrade guide

[mgol]

An incomplete list of items to cover:

Undocumented but still mention

The undocumented jQuery.fn.init API no longer accepts the third root parameter: #5096

[mgol]

Moving this to the jQuery repo for easier commit/PR/issue references.

[mgol]

Summary of the major 4.0.0 changes

Each list is sorted by modules alphabetically, with the exception of Core which always comes first.

Breaking changes

• Core: Move the factory to separate exports
  • 46f6e3d
  • This is about the Node.js behavior for windowless environments where require( "jquery" )( window ) is required
• Core: Remove deprecated jQuery APIs
  • 58f0c00
  • jQuery.isArray, jQuery.parseJSON, jQuery.nodeName, jQuery.isFunction, jQuery.isWindow, jQuery.camelCase, jQuery.type, jQuery.now, jQuery.isNumeric, jQuery.cssProps
  • Also:
    • jQuery.trim 0b676ae
    • jQuery.fx.interval 6c2c736
• Core: Drop support for IE <11, iOS <11, Firefox <65, Android Browser & PhantomJS
  • cf84696
  • Also:
    • Core: Drop support for Edge Legacy (i.e. non-Chromium Microsoft Edge)
      • e35fb62
• Core: Remove private copies of push, sort & splice from the jQuery prototype
  • b59107f
• Core: Exclude callbacks & deferred modules in the slim build as well
  • fbc44f5
  • Also:
    • Build: Reduce the slim build header comment & jQuery.fn.jquery
      • 812b4a1
    • Build: Explicitly exclude the queue module from the slim build
      • a503c69
• Core: Drop the root parameter of jQuery.fn.init (undocumented)
  • d2436df
• Ajax: Drop the json to jsonp auto-promotion logic
  • e7b3bc4
• Ajax: Avoid CSP errors in the script transport for async requests
  • 07a8e4a
  • Make more requests use the <script src> part of the script transport
• Ajax: Don't auto-execute scripts unless dataType provided
  • 025da4d
  • PR Ajax: Mitigate possible XSS vulnerability #2588 made jQuery stop auto-execute cross-domain scripts unless dataType: "script" was explicitly provided; this change landed in jQuery 3.0.0. This change extends that logic to same-domain scripts as well.
• Attributes: Drop the toggleClass(boolean|undefined) signature
  • a442110
• CSS: Don't automatically add "px" to properties with a few exceptions
  • 00a9c2e
• CSS: Remove the opacity CSS hook
  • 865469f
  • The consequence is .css( "opacity" ) will now return an empty string for detached elements in standard-compliant browsers and "1" in IE & the legacy Edge. That behavior is shared by most other CSS properties which we're not normalizing either.
• Data: Separate data & css/effects camelCase implementations
  • 8fae212
  • The data one no longer special-cases ms-
• Data:Event:Manipulation: Prevent collisions with Object.prototype
  • 9d76c0b
  • Breaks code using hasOwnProperty
• Deferred: Drop jQuery.Deferred.getStackHook (renamed since 3.7.0 to jQuery.Deferred.getErrorHook)
  • 258ca1e
  • Used to pass the original error to jQuery.Deferred.exceptionHook (previously we recommended passing stack but that breaks source maps)
• Event: Stop shimming focusin & focusout events
  • 8a74137
  • Affects event order
• Event: Avoid collisions between jQuery.event.special & Object.prototype
  • bcaeb00
  • Affects code calling hasOwnProperty on jQuery.event.special
• Manipulation: Avoid concatenating strings in buildFragment
  • 9c98e4e
  • Needed for Trusted Types support - the breaking aspect of it is likely minimal
• Manipulation: Don't remove CDATA sections from scripts
  • 2f8f39e
• Selector: Drop support for legacy pseudos
  • 8c7da22
  • References in Sizzle wiki: https://github.com/jquery/sizzle/wiki#-backwards-compatible-plugins-for-pseudos-with-arguments
• Selector: Backport jQuery selection context logic to selector-native
  • 2e644e8

Other notable changes

• Core: Remove IE-specific support tests, rely on document.documentMode
  • 3527a38
• Core: Migrate from AMD to ES modules 🎉
  • d0ce00c
  • Also:
    • Core: Use named exports in src/
      • f75daab
• Core: Add exports to package.json, export slim & esm builds
  • 8be4c0e
• Core:Manipulation: Add basic TrustedHTML support
  • de5398a
• Ajax: Support binary data (including FormData)
  • a7ed9a7
  • Possible minor breaking change: prefilters are now applied before data is converted to a string
• Deferred: Respect source maps in jQuery.Deferred.exceptionHook
  • 0b9c503
  • Affects errors in Promise callbacks for which jQuery print errors as they are typically human error rather than an exception to handle in code
• Selector: reduce size, simplify setDocument
  • 29a9544