{"id":14848,"library":"quasar-cli","title":"Quasar CLI (Legacy)","description":"quasar-cli is the command-line interface tool for scaffolding, developing, and building applications with Quasar Framework versions 0.x. It enables developers to create Vue-based projects targeting various platforms, including Single Page Applications (SPAs), Progressive Web Apps (PWAs), Server-Side Rendered (SSR) applications, hybrid mobile apps via Cordova, and desktop apps with Electron. This package, at version 0.17.26, represents an older, now abandoned, iteration of the Quasar CLI. The Quasar ecosystem has since transitioned to `@quasar/cli` for Quasar Framework versions 1.x and newer, offering improved features and updated dependencies. Due to its age, `quasar-cli` (0.x) contains known security vulnerabilities that have been addressed in modern Quasar CLI versions.","status":"abandoned","version":"0.17.26","language":"javascript","source_language":"en","source_url":"https://github.com/quasarframework/quasar-cli","tags":["javascript","quasar","cli","web","spa","pwa","electron","vue","vuejs"],"install":[{"cmd":"npm install quasar-cli","lang":"bash","label":"npm"},{"cmd":"yarn add quasar-cli","lang":"bash","label":"yarn"},{"cmd":"pnpm add quasar-cli","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"The `quasar-cli` package is a CLI tool and does not export programmatic symbols for application code. Quasar Framework core functionalities are typically imported from `@quasar/app` (for modern Quasar) or `quasar-framework` (for Quasar v0.x).","wrong":"import { Quasar } from 'quasar-cli'","symbol":"Quasar","correct":"import { Quasar } from '@quasar/app'"},{"note":"quasar-cli is a command-line interface tool. It is not designed to be imported as a module in application code. Its functionalities are exposed through the `quasar` global command after global installation.","wrong":"import cli from 'quasar-cli'","symbol":"cli","correct":"N/A (CLI is run via global command)"},{"note":"CommonJS `require()` is also incorrect for `quasar-cli`. Commands like `dev` are executed directly from the terminal using the globally installed `quasar` executable, e.g., `quasar dev`, not imported programmatically.","wrong":"const { dev } = require('quasar-cli')","symbol":"dev","correct":"N/A (CLI command: `quasar dev`)"}],"quickstart":{"code":"npm install -g quasar-cli\n\n# Initialize a new Quasar v0.x project\nquasar init default my-quasar-app\n\n# Navigate into the new project directory\ncd my-quasar-app\n\n# Install project dependencies\nnpm install # or yarn install\n\n# Start the development server (SPA mode)\nquasar dev\n\n# Build for production (SPA mode)\nquasar build","lang":"javascript","description":"Demonstrates global installation of the legacy `quasar-cli`, project initialization, dependency installation, and running development/build commands for a Quasar v0.x application."},"warnings":[{"fix":"For new projects or existing projects using Quasar Framework v1+, install and use `@quasar/cli` via `npm install -g @quasar/cli`.","message":"This specific package (`quasar-cli@0.x`) is an older, abandoned CLI version. It is incompatible with Quasar Framework v1+ projects. Attempting to use it with newer Quasar versions will lead to build failures or unexpected behavior.","severity":"breaking","affected_versions":">=0.1.0"},{"fix":"Upgrade to the latest `@quasar/cli` and Quasar Framework v1+ to ensure you have the most up-to-date security patches and dependency updates.","message":"Versions of `quasar-cli` 0.17.x (including 0.17.26) contain transitive dependencies with known vulnerabilities, such as `webpack-dev-server` (Missing Origin Validation), `webpack-bundle-analyzer`, and `lodash.template`. These issues have been addressed in newer, actively maintained versions of the Quasar CLI (`@quasar/cli`).","severity":"security","affected_versions":">=0.1.0 <=0.17.26"},{"fix":"Refer to the specific release notes for each `0.x` version upgrade to understand required migration steps. For long-term stability and modern features, migrating to Quasar Framework v1+ with `@quasar/cli` is highly recommended.","message":"Minor versions of `quasar-cli@0.x` frequently introduced significant dependency updates (e.g., Webpack v4, Electron v3/v4, Quasar Framework v0.17.x, Workbox). These often included breaking changes, requiring manual adjustments to project configurations or code, particularly due to the 0.x semantic versioning where any minor version could introduce breaking changes.","severity":"breaking","affected_versions":">=0.1.0 <=0.17.26"},{"fix":"Consult the Quasar v0.x documentation or community forums for specific configuration issues. For modern, stable configuration, consider upgrading to Quasar Framework v1+ and its corresponding CLI.","message":"The `quasar.conf.js` build configuration options changed over time, for instance, `gzip: true` was known to break builds in some `0.17.x` versions, indicating potential configuration incompatibilities across minor updates.","severity":"gotcha","affected_versions":">=0.17.20"}],"env_vars":null,"last_verified":"2026-04-19T00:00:00.000Z","next_check":"2026-07-18T00:00:00.000Z","problems":[{"fix":"Upgrade to a newer version of Quasar CLI (`@quasar/cli`) which includes updated `webpack-dev-server` versions or other security patches. (e.g., `webpack-dev-server` v3.1.14+ was released to address this).","cause":"Outdated `webpack-dev-server` dependency used by `quasar-cli` versions.","error":"webpack-dev-server 'Missing Origin Validation' vulnerability"},{"fix":"Set `gzip: false` in `quasar.conf.js` under the `build` section, or upgrade `quasar-cli` if a patch was released, or migrate to `@quasar/cli`.","cause":"A bug in `quasar-cli@0.17.20` and possibly other `0.17.x` versions where enabling `gzip` in `quasar.conf.js` would cause the production build to fail.","error":"Error: quasar.conf > build > gzip: true breaks build"},{"fix":"Ensure all ESLint warnings and errors are resolved in your project before running `quasar dev` in SSR mode, or disable ESLint strict mode during development (though not recommended). Consider upgrading to a modern Quasar CLI where such issues are typically resolved.","cause":"During Server-Side Rendering (SSR) development, ESLint warnings or errors could halt the development server process in `quasar-cli@0.17.19`.","error":"Dev on SSR gets stuck if ESLint reports any warning/error"},{"fix":"Update `quasar-cli` to a version where this specific bug is fixed, or manually address the dependency installation for Electron if possible. The best long-term solution is to migrate to `@quasar/cli` for Electron app development.","cause":"A specific bug in `quasar-cli@0.17.19` related to the Electron mode where dependency installation would fail due to an undefined `log()` function.","error":"Installing electron bundle deps fails -- log() undefined"}],"ecosystem":"npm"}