Blogs

What’s New

• PickList (jqxPickList)
  A new dual-list widget for moving items between an available and a selected list, with optional search boxes, checkbox selection and a reorderable selected list. Available for jQuery, Angular, React and Vue 3, with demos for each.
• All Vue demos migrated to Vue 3
  The Vue demo set now targets Vue 3 and builds with webpack 5. Every demo previously used Vue 2 with webpack 3; Vue 2 reached end of life in December 2023. Demo components now import the Vue 3 wrappers from jqwidgets-scripts/jqwidgets-vue3 and bootstrap with createApp. Vue 2 demos are no longer provided.
• Server-side rendering support for React and Vue 3
  jQWidgets components can now be imported in Next.js and Nuxt applications without the build failing. Previously every React wrapper accessed window at module scope and every Vue 3 wrapper called JQXLite in setup(), so importing a component threw “ReferenceError: window is not defined” during a server build.
• Component teardown in all framework wrappers
  React, Angular and Vue 3 components now unbind their event handlers and destroy the underlying widget when unmounted. Previously each mount/unmount cycle leaked a widget instance, which surfaced under React StrictMode, hot reload and route changes.
• Model Context Protocol server (jqwidgets-mcp-server)
  Lets AI coding assistants generate correct jQWidgets code for jQuery, Angular, React and Vue 3 from the same API definitions that drive the documentation.
• Documentation
  A full README covering installation, framework quick-starts, the widget and theme inventory, and the server-side rendering constraint. Release notes for v11 through v24 have also been restored; this file previously ended at v10.1.0.

Accessibility

• ARIA grid semantics in jqxGrid, jqxTreeGrid and jqxDataTable
  Row and column counts and 1-based row and column indices are now published. This matters most for virtualised data: previously a screen reader announced “row 3 of 30” while the user was on record 4,312 of 50,000, because only the rendered window existed in the DOM.
• Accessible names now reach the element that carries the grid role
  Setting aria-label or aria-labelledby on a grid, tree grid or data table had no effect, because the role sits on an inner element. Several grids on one page were all announced simply as “grid”.
• Hierarchy in jqxTreeGrid
  Rows publish their level, expanded state and selected state, under a treegrid role.
• Dialog support in jqxWindow
  Modal windows are labelled from their header, described by their content, marked aria-modal while open, contain keyboard focus, and restore focus to the element that opened them.
• Keyboard access to Scheduler appointments
  Appointments are now focusable, reachable by Tab, announced with subject, location and time range, and activatable with Enter. Previously they were plain positioned elements that assistive technology did not report at all.
• Status message announcements
  Grid filtering, sorting and paging, and validation messages, are announced through shared ARIA live regions. New localizable strings filterresultsstring, sortappliedstring and pagechangedstring were added to the grid localization object.
• Visible keyboard focus indicator in the base theme
  The base stylesheet suppressed focus outlines in 92 places and defined no replacement, so keyboard users had no visible indication of focus. A focus-visible indicator is now applied, without showing an outline on mouse interaction.
• Colour contrast in the base theme
  Text and placeholder colours that fell below the WCAG AA 4.5:1 threshold were corrected, and low-opacity label and disabled-state text was raised.
• Tab order no longer hijacked
  Positive tabindex values were removed from jqxGrid and its filter and pager rows, and from jqxExpander, jqxNavigationBar, jqxListBox and jqxTree. Positive values pull elements to the front of the page tab sequence; tab order now follows document order.
• Correct roles and states across the suite
  Includes tab semantics in jqxTabs, accordion semantics in jqxNavigationBar, range semantics in jqxSlider, jqxProgressBar and jqxGauge, group labelling in jqxRadioButtonGroup, and decorative images correctly hidden in jqxRating.
• Verified with the NVDA screen reader
  Grid, tree grid, tabs, scheduler and dialog were tested with NVDA on Windows. A draft conformance report and the reproducible test suite are included under accessibility/.

Security

• CVE-2026-78178: prototype pollution in the deep-merge helper (JQXLite.extend / jqxBaseFramework.extend)
  CVSS 3.1 7.3 (High). Affects every version before 27.0.0. The public CVE record lists 24.0.1 as the last affected version because that is what the reporter tested; the vulnerable path was unchanged through 26.0.0, so customers on 25.x and 26.x are affected and should upgrade. An object carrying an own “__proto__” key – which is what JSON.parse produces for {“__proto__”: …} – could write properties onto Object.prototype when deep merged. Every widget applies its options through a deep merge, so any application that built widget options from untrusted input reached the vulnerable path without calling extend itself. The key is now rejected before the destination object is read. Reported as jqwidgets/jQWidgets#764 and assigned CVE-2026-78178; the same class of defect as CVE-2019-11358 in jQuery before 3.4.0.

What’s Fixed

• jqxScheduler getJQXAppointmentByElement returned the wrong appointment. The lookup mixed an appointment’s id with its internal key, so it returned a neighbouring appointment.
• jqxScheduler appointment text colour used an approximation to decide between light and dark text; it now uses the WCAG relative luminance formula, so text on custom appointment colours stays readable.
• jqxScheduler could trap keyboard focus: Tab cycled between appointments and never left the widget.
• Seven framework wrappers did not compile or parse and could not be used at all: jqxLinkButton for React, and jqxBarcode, jqxQRCode, jqxDragDrop, jqxLinkButton, jqxForm and jqxGantt for Vue 3.
• The React package declared “sideEffects”: false while its only link to the runtime is a side-effect import. Aggressive bundlers dropped it, so production builds failed at runtime with “JQXLite is not defined” while development builds worked.
• The Vue tree navigation demo contained two unclosed list items. Vue 2 tolerated the markup; the stricter Vue 3 template compiler rejected the file outright.
• jqxDataTable rendered a plain table inside a grid role, which is not a valid structure for assistive technology.
• jqxLinkButton forced a button role onto an anchor, hiding it from users navigating by link.
• The MCP server generated import paths that do not resolve, so AI-assisted React and Vue users received code that failed on the import line. It also targeted Vue 2, which reached end of life in December 2023, and now targets Vue 3.

Breaking Changes

• The vendored jquery.js (jQuery 1.8.3) is no longer included in the SDK download. It was a 2012 release subject to four upstream XSS advisories (CVE-2012-6708, CVE-2015-9251, CVE-2020-7656, CVE-2020-11023) that could not be patched locally, and nothing in the product or its documentation referenced it. jQWidgets does not require it: load the jQuery of your choice (3.5.0 or later is advised) or use the bundled JQXLite runtime. Applications whose script tags pointed at jqwidgets/jquery.js need to point at a current jQuery instead.
• Angular 12 through 18 are no longer supported. The minimum supported version is Angular 19, which is required for the standalone component output. Customers on Angular 18 or earlier should remain on v26.
• jqxTabs publishes the tablist role on its list element rather than the container. Stylesheets or scripts that select the container by that role need updating.
• jqxNavigationBar is exposed as an accordion rather than a tab set, which changes the roles and states published to assistive technology. Its API and visual appearance are unchanged.
• jqxLinkButton no longer overrides the anchor role.
• The base theme now draws a visible focus ring on keyboard focus. Applications that supply their own focus styling may want to override it.
• Two visually hidden live-region elements are appended to document.body on page load, to carry status announcements.
• The Vue demos target Vue 3 and webpack 5. Anyone building the demo projects needs to reinstall dependencies; the Vue 2 demo sources are replaced, not kept alongside.
• Tab order in jqxGrid follows document order rather than the previous positive tabindex values. Pages that relied on the grid appearing early in the tab sequence will see a different order.