jQuery 3.4.0 Released（2019.4.10）

jQuery has a new release! It’s been a while since our last release, but we expect this to be the last minor release in the 3.x branch, and then we will move on to the overhaul that will be jQuery 4.0. But
before we get to 4.0, we’re excited to share the bug fixes and improvements included in jQuery 3.4.0. Here are some of the highlights:

Performance improvement in `.width`and `.height`

When getting and setting dimensions, there were certain cases where this could cause layout thrashing, which basically means that the browser calculated layout more times than necessary. We fixed this in all browsers except IE, where it can’t be avoided.

`nonce`and `nomodule`support

To support adding script elements through methods like .html and .append, jQuery separates them and appends new script tags to load and execute the remote content. During this process, attributes such as nonceand nomodulewere ignored, but jQuery 3.4.0 now hangs onto them.

Radio elements: expected state in event handlers

We had already fixed the same issue with checkboxes, but accidentally left out radio inputs. In the following example, truewas logged the first time the element was clicked. We fixed it so that the checkedproperty is updated before the event handler is executed.

Example

var $radios = jQuery(".example");
var $firstRadio = $radios.first();
var firstCheckedState = $firstRadio.prop("checked");
$radio.on("click", function() {// true in <3.4.0console.log($firstRadio.prop("checked") === firstCheckedState);
});
$radios.eq(1).click();

Minor vulnerability fix: Object.prototype pollution
jQuery 3.4.0 includes a fix for some unintended behavior when usingjQuery.extend(true, {}, ...). If an unsanitized source object contained an enumerable __proto__property, it could extend the native Object.prototype. This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous jQuery versions.

Example

jQuery.extend(true, {},JSON.parse('{"__proto__": {"test": true}}')
);
console.log( "test" in {} ); // true

Note that while jQuery does its best to protect users from security vulnerabilities, jQuery is a DOM manipulation library that will generally do what you tell it to do. In this case, the behavior was likely unexpected, so jQuery.extendwill no longer write any properties named __proto__. But guards such as this one are not replacements for good security practices such as user input sanitization.

Deprecating positional selectors and the sunset of Sizzle

The basic API of jQuery is to select something and then do something with what was selected. Sizzle, the selector engine in jQuery, handles the first half. It’s been a fast and efficient little engine that has paved the way for native selector APIs like querySelectorAlland additional native JavaScript and CSS selectors. Now that many of these selectors have made their way into modern browsers, it’s almost time to say goodbye to Sizzle. But in order to remove Sizzle in jQuery 4.0, we will also need to remove what we refer to as positional selectors, which are non-standard selectors.

Specifically, jQuery 3.4.0 is deprecating:first, :last, :eq, :even, :odd, :lt, :gt, and:nth. When we remove Sizzle, we’ll replace it with a small wrapper around querySelectorAll, and it would be almost impossible to reimplement these selectors without a larger selector engine.

We think this trade-off is worth it. Keep in mind we will still support the positional methods, such as .first, .last, and .eq. Anything you can do with positional selectors, you can do with positional methods instead. They perform better anyway.

Upgrading

There should be no compatibility issues if upgrading from jQuery 3.0+. If you haven’t yet upgraded to jQuery 3+, please have a look at the 3.0 Upgrade Guide. The jQuery Migrate 3.0 plugin will help you to identify compatibility issues in your code.

Please try out this new release and let us know about any issues you experienced.