CoreUI PRO for Vue v5.20.0 - Accessibility, Security & Picker Improvements

We are excited to announce the release of CoreUI PRO for Vue v5.20.0. This release brings extensive accessibility improvements across the CAutocomplete, CCalendar, CMultiSelect, CRangeSlider, and CRating components, security hardening, and a range of picker and stability fixes.

---

Speed up your responsive apps and websites with fully-featured, ready-to-use open-source admin panel templates—free to use and built for efficiency.

---

How to Update

To update your project to CoreUI PRO for Vue v5.20.0, follow these steps:

1. Open your project’s package.json.
2. Locate the @coreui/vue-pro entry under dependencies and update the version number to 5.20.0.
3. Find the @coreui/coreui-pro entry under dependencies and update the version number to ^5.27.0.
4. Save your changes to the package.json file.
5. In your project’s root directory, run the update command appropriate for your package manager:
   • For npm users, execute npm install.
   • For yarn users, execute yarn install.
   • For pnpm users, execute pnpm install.

What’s New

Features

• CButton - Toggle: Synced the upstream toggle-button support from CoreUI for Vue.
• CMultiSelect: Hides the select-all control when a search yields no results.

Accessibility

• CAutocomplete: Exposes options as ARIA options with aria-controls wiring, announces no-results via a role="status" live region, adds accessible names to the cleaner and indicator buttons, and supports Home/End keys to focus the first/last option.
• CCalendar: Day cells now carry a full-date aria-label and today’s date is marked, and it emits select-end-change so range pickers stay in sync.
• CRangeSlider, CRating, CPasswordInput: Improved accessibility labeling of form controls.
• CAlert: Exposes role="alert" for assistive technology.
• Tooltip & Popover: Dismiss on the Escape key, in line with WCAG 1.4.13.
• COneTimePasswordInput: Sets autocomplete=one-time-code for SMS autofill.

Security

• CAutocomplete: Option labels are now escaped in highlighting to prevent XSS.
• Directives: Tooltip and popover content is now rendered as text to prevent XSS.

Bug Fixes

• CTimePicker: Honours the picker hour cycle regardless of locale default and pins the hour cycle so midnight labels as 00 on all engines.
• CDatePicker: Disables the Today button when today’s date is disabled.
• CAutocomplete: Selects the clicked option with allowOnlyDefinedOptions.
• CRating & CRangeSlider: Fixed API-parity bugs.
• useDebouncedCallback & useColorModes: Clean up pending timers and the matchMedia listener.
• useUniqueId, CCalendar, CRating: Fixed id and escaping bugs.
• CTimePicker, CDateRangePicker, Picker: Stop leaking submit and window listeners.

Documentation & Tooling

• Migrated the documentation to the shared @coreui/astro-docs engine and upgraded to Astro 7.
• Migrated the test runner from Jest to Vitest and the package manager from Yarn Classic to npm.
• Added an AI Tools section (MCP Server and LLMs.txt), a SECURITY.md, and Dependabot config.
• Synced the upstream CoreUI for Vue v5.10.0 changes.

Migration Notes

This is a feature release with no breaking changes announced in the published release notes. After upgrading:

1. Install updated dependencies.
2. Run your test suite and verify the build.
3. Review picker, Autocomplete, and Multi Select interactions after upgrading.

---

For the latest package files and update access, visit CoreUI Downloads.