v3.16.0

Security

• ⚠️ Prevent unauthenticated memory exhaustion via clients leaked on socket disconnect (GHSA-46f2-xhpw-8vh3 by @evnchn, @falkoschindler)
• ⚠️ Prevent XSS via prop injection in ColorPicker.set_color() and ui.color_input (GHSA-955g-h32v-mvrr by @mingijunggrape, @evnchn, @falkoschindler)

New features and enhancements

• Refactor ui.scene to a modular object system, supporting custom three.js objects and fixing the white axes_helper regression (#4120, #6085, #6246 by @HosseyNJF, @phenolophthaleinum, @evnchn, @SaadZahem, @python-and-novella, @falkoschindler)

  Breaking change: The following patterns are deprecated and will be removed in NiceGUI 4.0 (they still work but emit a one-time warning): importing from nicegui.elements.scene.scene_objects (use nicegui.elements.scene.objects instead), subclassing Object3D without a component= argument, instantiating objects with a leading type string like Object3D('group'), and the Object3D.data and Object3D.type properties.

• Add line-anchor tracking to ui.codemirror, giving you stable references to specific lines that survive edits (#5988, #6282 by @Jepson2k, @evnchn, @falkoschindler)

• Add h2, h3, h4, h5 and h6 HTML elements (#6238 by @SaadZahem, @evnchn, @falkoschindler)

• Sync ui.table's fullscreen state back to the server when toggled from the client (#6181 by @evnchn, @falkoschindler)

• Avoid downloading an unused font subset for the connection-lost popup's warning glyph (#6210 by @evnchn, @falkoschindler)

• Remove dead props from ui.chip, ui.carousel_slide and the ui.date input (#6177, #6184, #6185 by @evnchn, @falkoschindler)

Bugfixes

• Fix error when a repeating ui.timer's client is deleted while waiting for the connection (#6226, #6228, #6229 by @benvc, @AJ-ing, @evnchn, @falkoschindler)
• Fix task leak by resolving awaited ui.dialogs when they are deleted (#6250 by @denniswittich, @evnchn, @falkoschindler)
• Fix On Air reconnect when the relay silently drops the connection while Socket.IO's connected flag is stale (#6212, #6213 by @dennis-agentic, @evnchn, @denniswittich, @falkoschindler)
• Route mouse-button and exact modifiers of generic events correctly and preserve hyphenated key modifiers (#6199, #6206 by @evnchn, @falkoschindler)
• Disconnect resize observers of ui.header and ui.echart and document key listeners of ui.keyboard when the element is unmounted (#6189, #6190, #6196 by @evnchn, @falkoschindler)
• Remove bindings when a ui.scene Object3D is deleted and guard "dragend" events against deleted objects (#6192, #6195 by @evnchn, @falkoschindler)
• Fix Redis storage so key deletions propagate across instances (#6194 by @evnchn, @falkoschindler)
• Fix element.move() orphaning an element when the target slot is invalid and guard against moving an element into its own descendant (#6176, #6180 by @evnchn, @falkoschindler)
• Handle parameter coercion errors in ui.sub_pages builders like builder errors (#6186 by @evnchn, @falkoschindler)
• Fix error reporting when an async ui.sub_pages builder raises after its client has been deleted (#6231, #6270 by @evnchn, @SaadZahem, @falkoschindler)
• Clean up the spilled temporary file when a ui.upload fails mid-transfer (#6187 by @evnchn, @falkoschindler)
• Remove leaked auto-generated route when switching an element's source away from a local file (#6204 by @evnchn, @falkoschindler)
• Fix ui.upload unregistering the application's route instead of its own auto-generated route on delete (#6236, #6256 by @evnchn, @SaadZahem, @falkoschindler)
• Support URL-encoded data-URL favicons (#6191 by @evnchn, @falkoschindler)
• Fix ui.color_input crashing when the value is None with preview enabled (#6201 by @evnchn, @falkoschindler)
• Fix ui.number's out_of_limits raising a TypeError when the value is None (#6179 by @evnchn, @falkoschindler)
• Fix ui.line_plot's push crashing on empty data with automatic limits (#6183 by @evnchn, @falkoschindler)
• Fix lost "done" decoration when navigating a ui.stepper by Step object (#6200 by @evnchn, @falkoschindler)
• Fix Event.emitted() timeout handling on Python 3.10 (#6197 by @evnchn, @falkoschindler)

Documentation

• Document Socket.IO client_id forging as a commonly misreported security pattern and explain which random IDs are secrets (#6239, #6268 by @falkoschindler, @evnchn)
• Never show a fabricated GitHub star count on the website by baking it in at deploy time (#6211, #6218, #6240 by @evnchn, @falkoschindler)
• Fix ChromeDriver install instructions for Linux in tests/README.md (#6266, #6267, #6274 by @evnchn, @SaadZahem, @falkoschindler)
• Prefer behavior tests over tests coupled to implementation details in CONTRIBUTING.md (#6219 by @falkoschindler, @evnchn)
• Fix broken DiscoLike sponsor logo on the website (#6253 by @evnchn, @falkoschindler)
• Add pointer cursor to the ui.popup demo's anchor label (#6207 by @evnchn, @falkoschindler)
• Fix ui.pagination's direction_links docstring (#6203 by @evnchn, @falkoschindler)

Testing

• Add scoped User lookups and a pytest example (#6015 by @ZhuGC-Centogene, @evnchn, @falkoschindler)

Dependencies

• Update echarts-gl to 2.1.0 (#6216 by @falkoschindler, @evnchn)
• Move the lxml security pins to the website dependency group (#6208 by @evnchn, @falkoschindler)

Infrastructure

• Keep JavaScript source maps out of the wheel (#6209 by @evnchn, @falkoschindler)
• Add a Windows CI leg for the storage file-lock tests (#6160 by @evnchn, @Jepson2k, @falkoschindler)

---

Special thanks to our top sponsors DiscoLike Inc., TestMu AI and Lechler GmbH ✨

and all our other sponsors and contributors for supporting this project!

🙏 Want to support this project? Check out our GitHub Sponsors page to help us keep building amazing features!