LoginSign Up
← Back to all sparks
F

Fabric.js

DESIGN
Velocity0.0

JavaScript HTML canvas library for interactive object models

fabricjs.com ↗

Fabric.js is building direct-manipulation editing controls and hardening its supply chain

canvas-editingcropping-controlssupply-chain-hardeningrolldownextensions
◆Current state
Since Fabric 7.0 shipped in December 2025 the releases have followed two consistent threads. One is canvas editing capability: a cropping controls extension in 7.1, follow-ups in 7.2, then edge resize and flip support plus gradient controls in 7.3. The other is build and supply-chain work — the bundler moved from Rollup to Rolldown, workflow permissions and dependencies were pinned for OSSF scorecard hardening, the vulnerability reporting process was revised, and 7.4.0 fixes a CVE.
◆Where it's heading
Fabric is closing the gap between being a canvas rendering library and being the substrate for an image editor, and it is doing so through extensions rather than core API changes. The security posture work running alongside is unusually deliberate for a project this size, and reads as a response to being a widely embedded dependency: pinned CI, tightened permissions, a documented disclosure process, then a CVE fixed and announced at the top of a release.
◆Prediction
Expect the controls extensions to keep accumulating editor affordances in the same pattern, and the scorecard and dependency-pinning work to continue as background maintenance on every release.

◆Recent moves

  1. 2mo ago

    CVE-2026-44311 fixed alongside dependency updates

    A security release leading with a CVE fix, otherwise composed of dependency and tooling bumps. Placing the security notice above the changelog is consistent with the disclosure-process revision made two releases earlier.

    View source ↗
  2. 3mo ago

    Republish of 7.3.0 after a broken publish workflow

    Functionally identical to 7.3.0, cut because publishing failed. The surrounding commits are all supply-chain hardening — pinned workflow dependencies, tightened permissions, a revised vulnerability reporting process — which is the quieter half of this project's recent work.

    View source ↗
  3. 3mo ago

    Cropping gains edge resize and flip; gradient controls arrive

    The richest feature release since 7.0: cropping controls gain edge resize and flip support, gradient controls are added, and the bundler switches from Rollup to Rolldown. The notes explicitly ask users to report build regressions, which is the honest way to ship a minifier change.

    View source ↗
  4. 5mo ago

    Cropping follow-ups and test tooling upkeep

    Mostly repository hygiene — pre-commit hooks, Playwright and Vitest updates, test refactors — with cropping-control follow-ups as the only user-facing thread. It sits between the feature's introduction and its expansion in 7.3.

    View source ↗
  5. 7mo ago

    Cropping controls extension introduced

    Introduces the cropping controls extension that the next three releases build on, making this the start of Fabric's push toward direct-manipulation editing. A double-offset fix when exporting SVG after setting deltaY on Text is the other real repair.

    View source ↗
  6. 7mo ago

    Version 7.0 final, identical to its release candidate

    The 7.0 final release, explicitly carrying no code changes over its release candidate. It marks the baseline from which the cropping and hardening work in the 7.x line proceeds.

    View source ↗