@conduction/nextcloud-vue 2.56.0-beta.4 → 2.56.0-beta.5

package/dist/nextcloud-vue.cjs.js

@@ -5757,13 +5757,17 @@ async function runSelfImportRequest({ register, schema, file }) {
  * also fire `auxclick` for the right button, so a row that listens to it must
  * filter both out itself.
  *
- * Whoever opens a row in a new tab calls `preventDefault()` on the event, so a
- * second listener for the same click (a host behind a library default) can
+ * Whoever opens a row in a new tab marks the event with `markNewTabHandled`, so
+ * a second listener for the same click (a host behind a library default) can
  * check `isNewTabHandled` and not open a second tab.
  *
  * @module utils/rowAuxClick
  */
 
+// Events that opened a new tab. Not `defaultPrevented`, which any unrelated
+// handler can set on a modified or middle click.
+const newTabHandled = new WeakSet();
+
 const NESTED_CONTROL = 'a, button, input, select, textarea, label, summary, [role="button"], [role="checkbox"], [role="link"], [contenteditable="true"]';
 
 /**
@@ -5797,6 +5801,21 @@ function isRowMiddleClick(event) {
 	return Boolean(event && event.button === 1 && !isFromNestedControl(event))
 }
 
+/**
+ * Cancel a middle-button press on a clickable row or card body, so the
+ * browser does not start autoscroll (Chrome/Edge on Windows) instead of the
+ * middle click opening the row. A press on a nested control, a link
+ * included, keeps its default.
+ *
+ * @param {MouseEvent} event The mousedown event.
+ * @return {void}
+ */
+function preventMiddleClickAutoscroll(event) {
+	if (event && event.button === 1 && !isFromNestedControl(event) && typeof event.preventDefault === 'function') {
+		event.preventDefault();
+	}
+}
+
 /**
  * Whether `openRowTarget` would open this click in a new tab.
  *
@@ -5814,18 +5833,24 @@ function isNewTabClick(event) {
  * @return {boolean}
  */
 function isNewTabHandled(event) {
-	return Boolean(isNewTabClick(event) && event.defaultPrevented)
+	return Boolean(isNewTabClick(event) && newTabHandled.has(event))
 }
 
 /**
  * Mark a new-tab click as handled after opening it, see `isNewTabHandled`.
+ * Also prevents the event's default, so the browser does not act on the
+ * click as well.
  *
  * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.
  * @param {boolean} opened Whether the target was opened.
  * @return {void}
  */
 function markNewTabHandled(event, opened) {
-	if (opened && isNewTabClick(event) && typeof event.preventDefault === 'function') {
+	if (!opened || !isNewTabClick(event)) {
+		return
+	}
+	newTabHandled.add(event);
+	if (typeof event.preventDefault === 'function') {
 		event.preventDefault();
 	}
 }
@@ -5900,8 +5925,11 @@ function resolveHref(target, router) {
  * click is routed through the router; a modified click, or one a handler
  * already prevented, is left to the browser.
  *
+ * Unlike `resolveHref`, a string target is a router path, so pair the two
+ * with a location object (or `{ path }`) for the href and click to agree.
+ *
  * @param {MouseEvent} event The click event.
- * @param {string|object} target The router location the link points at.
+ * @param {string|object} target The router location the link points at; a string is a router path.
  * @param {object} [router] The app's router.
  * @return {boolean} True when the app navigated.
  */
@@ -5927,8 +5955,8 @@ function followLinkClick(event, target, router) {
  *
  * A click that came from a control inside the surface (a button, a link, a
  * checkbox) is left to that control. Opening a new tab marks the event with
- * `preventDefault()`, and an event already marked that way is skipped, so
- * two listeners on the same click never open two tabs.
+ * `markNewTabHandled`, and an event already marked is skipped, so two
+ * listeners on the same click never open two tabs.
  *
  * @param {MouseEvent|KeyboardEvent|null|undefined} event The click event.
  * @param {string|object} target A URL, or a vue-router location.
@@ -6026,6 +6054,11 @@ function resolveItemActionLink(action, item, router) {
  * on an in-app link that opens in place goes through the router; a URL, a
  * new-tab target or a modified click is left to the browser.
  *
+ * Hand-rolled rather than `NcActionRouter` / `NcButton :to`: the menus and
+ * bars using it must still emit their own events on click, and without an
+ * installed router `NcButton :to` falls back to a button that goes nowhere,
+ * while an `<a href>` still navigates.
+ *
  * @param {MouseEvent} event The click event.
  * @param {{to: (string|object|null), target: (string|undefined)}} link The resolved link.
  * @param {object} [router] The app's router.
@@ -6447,6 +6480,21 @@ function interpolateActionTarget(target, ctx) {
 	return interpolateActionString(target || '', ctx || {})
 }
 
+// The tokens interpolateActionString resolves; a bare `@` or `{` is not one.
+const ACTION_TARGET_TOKEN = /@(?:objectId|object\.|page\.|workspace\.|config\.|range\.)|\{objectId\}/;
+
+/**
+ * Whether an action target carries a token that interpolation would resolve,
+ * so it can only be known once the page context is. A `mailto:` address or a
+ * URL with an `@handle` in it has none.
+ *
+ * @param {string} target The action's raw `target`.
+ * @return {boolean}
+ */
+function hasActionTargetTokens(target) {
+	return typeof target === 'string' && ACTION_TARGET_TOKEN.test(target)
+}
+
 /**
  * The link an action renders as when its only job is to navigate to a target
  * known at render time: `navigate` (token-interpolated like the dispatcher)
@@ -15200,6 +15248,20 @@ const __sfc_main$5Y = script$62;
  * @module utils/safeHref
  */
 
+/**
+ * Whether a URL is protocol-relative the way a browser reads it: leading
+ * control characters and spaces are dropped, tabs and newlines are ignored
+ * anywhere, and a backslash counts as `/`.
+ *
+ * @param {string} url The URL.
+ * @return {boolean}
+ */
+function isProtocolRelative(url) {
+	// eslint-disable-next-line no-control-regex
+	const normalized = url.replace(/[\t\n\r]/g, '').replace(/^[\u0000-\u0020]+/, '');
+	return /^[/\\]{2}/.test(normalized)
+}
+
 /**
  * Validate a URL and return it only if the scheme is safe for `:href`.
  *
@@ -15212,7 +15274,8 @@ const __sfc_main$5Y = script$62;
  *   - `javascript:...`
  *   - `data:...`
  *   - `vbscript:...`
- *   - Protocol-relative `//attacker.com/...` (ambiguous origin)
+ *   - Protocol-relative `//attacker.com/...` (ambiguous origin), also as
+ *     `/\attacker.com` or with leading whitespace
  *   - Any other unrecognised scheme
  *   - `null`, `undefined`, empty string
  *
@@ -15234,7 +15297,7 @@ function safeHref(url) {
 	}
 	// Reject protocol-relative URLs — `//attacker.com/x` looks like a relative
 	// path but resolves to an arbitrary origin, bypassing same-origin intent.
-	if (url.startsWith('//')) {
+	if (isProtocolRelative(url)) {
 		return '#'
 	}
 	// Allow root-relative paths (same-origin navigation)
@@ -15279,7 +15342,7 @@ function safeImageSrc(url) {
 		return url
 	}
 	// Reject protocol-relative
-	if (url.startsWith('//')) {
+	if (isProtocolRelative(url)) {
 		return ''
 	}
 	try {
@@ -16929,9 +16992,11 @@ var script$5_ = {
 
 		/**
 		 * Convenience navigation (folded from CnTableWidget): a function that
-		 * receives the clicked row and returns a vue-router route to push. When
-		 * set, a row click navigates there (the `row-click` event still fires);
-		 * a ctrl/cmd/shift or middle click opens it in a new tab.
+		 * receives a row and returns the vue-router route it opens. When set,
+		 * each row renders as a real link to that route, stretched over the
+		 * row: a click navigates there (the `row-click` event still fires), and
+		 * a ctrl/cmd/shift or middle click opens it in a new tab. A table whose
+		 * row click selects (`selectable` without `rowClickToView`) gets no link.
 		 *
 		 * @type {((row: object) => object)|null}
 		 */
@@ -16954,7 +17019,7 @@ var script$5_ = {
 		},
 	},
 
-	emits: ['row-click', 'row-context-menu', 'select', 'select-all', 'sort', 'view-all'],
+	emits: ['row-click', 'row-aux-click', 'row-context-menu', 'select', 'select-all', 'sort', 'view-all'],
 
 	setup() {
 		// Tell a deliberate row click apart from a text-selection drag.
@@ -17104,6 +17169,32 @@ var script$5_ = {
 		 *
 		 * @return {Array<{key: string, order: 'asc'|'desc'}>}
 		 */
+		/**
+		 * The link each row opens, keyed by row key: the `rowClickRoute`
+		 * location and its href. Empty when rows have no route, or when a row
+		 * click selects instead of navigating.
+		 *
+		 * @return {{[key: string]: {target: object, href: string}}}
+		 */
+		rowLinks() {
+			const links = {};
+			if (!this.rowClickRoute || !this.$router || (this.selectable && !this.rowClickToView)) {
+				return links
+			}
+			for (const row of this.effectiveRows) {
+				const route = this.rowClickRoute(row);
+				if (!route) {
+					continue
+				}
+				const target = typeof route === 'string' ? { path: route } : route;
+				const href = resolveHref(target, this.$router);
+				if (href) {
+					links[String(row[this.rowKey])] = { target, href };
+				}
+			}
+			return links
+		},
+
 		effectiveSortKeys() {
 			if (this.sortKeys && this.sortKeys.length > 0) {
 				return this.sortKeys
@@ -17580,9 +17671,23 @@ var script$5_ = {
 		},
 
 		/**
-		 * Row-body middle click: emits `row-click` like a click, so the host
-		 * (or `rowClickRoute`) can open the row in a new tab. Ignored for other
-		 * buttons, nested controls, drags and select-on-click tables.
+		 * Row mousedown: record the press for the drag guard, and on a row a
+		 * middle click opens, keep the browser from starting autoscroll.
+		 *
+		 * @param {MouseEvent} event The mousedown event.
+		 */
+		onRowMouseDown(event) {
+			this.onPointerDown(event);
+			if (!this.selectable || this.rowClickToView) {
+				preventMiddleClickAutoscroll(event);
+			}
+		},
+
+		/**
+		 * Row-body middle click: emits `row-aux-click`, not `row-click`, so an
+		 * existing `row-click` listener that navigates never moves the current
+		 * tab away; `rowClickRoute` still opens the row in a new tab. Ignored
+		 * for other buttons, nested controls, drags and select-on-click tables.
 		 *
 		 * @param {object} row The clicked row object
 		 * @param {MouseEvent} event The originating auxclick event.
@@ -17594,23 +17699,39 @@ var script$5_ = {
 			if (this.selectable && !this.rowClickToView) {
 				return
 			}
-			this.emitRowClick(row, event);
+			/**
+			 * @event row-aux-click Emitted on a row-body middle click, under the same conditions as `row-click`, so a host can open the row in a new tab (see `openRowTarget`). Payload: `(row, event)` — the clicked row object and the native auxclick event.
+			 * @type {object} The clicked row object.
+			 */
+			this.$emit('row-aux-click', row, event);
+			this.followRowClickRoute(row, event);
 		},
 
 		/**
 		 * Emit `row-click` and follow `rowClickRoute` when set.
 		 *
 		 * @param {object} row The clicked row object
-		 * @param {MouseEvent} [event] The originating click or auxclick event.
+		 * @param {MouseEvent} [event] The originating click event.
 		 */
 		emitRowClick(row, event) {
 			/**
-			 * @event row-click Emitted on a row-body click for navigation, and on a middle click (auxclick). Fires when `selectable` is false, OR when `rowClickToView` is set (selection then happens via the checkbox column). Payload: `(row, event)` — the clicked row object and the native click/auxclick event, so a host can open the row in a new tab on a ctrl/cmd/shift or middle click (see `openRowTarget`).
+			 * @event row-click Emitted on a row-body click for navigation. Fires when `selectable` is false, OR when `rowClickToView` is set (selection then happens via the checkbox column). Payload: `(row, event)` — the clicked row object and the native click event, so a host can open the row in a new tab on a ctrl/cmd/shift click (see `openRowTarget`). A middle click emits `row-aux-click` instead.
 			 * @type {object} The clicked row object.
 			 */
 			this.$emit('row-click', row, event);
-			// A ctrl/cmd/shift or middle click opens the route in a new tab,
-			// unless a row-click listener already did.
+			this.followRowClickRoute(row, event);
+		},
+
+		/**
+		 * Follow `rowClickRoute` for a row click: in place, or in a new tab on
+		 * a ctrl/cmd/shift or middle click.
+		 *
+		 * @param {object} row The clicked row object
+		 * @param {MouseEvent} [event] The originating click or auxclick event.
+		 */
+		followRowClickRoute(row, event) {
+			// A new-tab click opens the route in a new tab, unless a listener
+			// already did.
 			if (this.rowClickRoute && this.$router && !isNewTabHandled(event)) {
 				const route = this.rowClickRoute(row);
 				if (route) {
@@ -17619,14 +17740,57 @@ var script$5_ = {
 			}
 		},
 
+		/**
+		 * A plain or alt click on a row link routes in place; a new-tab click
+		 * is left to the browser, which opens the href itself.
+		 *
+		 * @param {object} row The row the link belongs to.
+		 * @param {MouseEvent} event The click event.
+		 */
+		onRowLinkClick(row, event) {
+			const link = this.rowLinks[String(row[this.rowKey])];
+			if (!link) {
+				return
+			}
+			// Alt-click on a link downloads it; a row opens like a plain click.
+			if (event.altKey && !isNewTabClick(event) && !event.defaultPrevented) {
+				event.preventDefault();
+				this.$router.push(link.target).catch(() => {});
+				return
+			}
+			followLinkClick(event, link.target, this.$router);
+		},
+
+		/**
+		 * The row link's accessible name: the row's first cell when it holds
+		 * plain text, else a generic name.
+		 *
+		 * @param {object} row The row.
+		 * @param {object} col The first data column.
+		 * @return {string}
+		 */
+		rowLinkLabel(row, col) {
+			const value = this.cellValue(row, col);
+			if (['string', 'number'].includes(typeof value) && String(value).trim() !== '') {
+				return String(value)
+			}
+			return l10n.translate('nextcloud-vue', 'Open row')
+		},
+
 		/**
 		 * Row right-click: forward the row + originating event so a host can
-		 * open a context menu (the browser default is prevented).
+		 * open a context menu. The browser menu is prevented, except on a row
+		 * link when no host listens, so its link actions stay available.
 		 *
 		 * @param {object} row The right-clicked row object.
 		 * @param {MouseEvent} event The originating contextmenu event.
 		 */
 		onRowContextMenu(row, event) {
+			const fromRowLink = event.target?.closest?.('.cn-table-row__link');
+			// `$.vnode.props`, not `$attrs`: a declared emit is stripped from `$attrs`.
+			if (!fromRowLink || this.$.vnode.props?.onRowContextMenu) {
+				event.preventDefault();
+			}
 			/**
 			 * @event row-context-menu Emitted on a row right-click (contextmenu) for hosts that render a context menu.
 			 * @type {{ row: object, event: MouseEvent }}
@@ -17788,18 +17952,19 @@ const _hoisted_16$1b = {
   key: 1,
   class: "cn-table-col--icon"
 };
-const _hoisted_17$12 = {
-  key: 1,
+const _hoisted_17$12 = ["href", "aria-label", "onClick"];
+const _hoisted_18$T = {
+  key: 2,
   class: "cn-table-row-indicators",
   "data-testid": "cn-row-indicators"
 };
-const _hoisted_18$T = ["title", "data-testid"];
-const _hoisted_19$L = { class: "hidden-visually" };
-const _hoisted_20$E = {
+const _hoisted_19$L = ["title", "data-testid"];
+const _hoisted_20$E = { class: "hidden-visually" };
+const _hoisted_21$C = {
   key: 3,
   class: "cn-data-table__footer"
 };
-const _hoisted_21$C = ["href"];
+const _hoisted_22$z = ["href"];
 
 function render$5_(_ctx, _cache, $props, $setup, $data, $options) {
   const _component_NcLoadingIcon = vue$1.resolveComponent("NcLoadingIcon");
@@ -17907,14 +18072,15 @@ function render$5_(_ctx, _cache, $props, $setup, $data, $options) {
                       key: row[$props.rowKey],
                       class: vue$1.normalizeClass(["cn-table-row", [
 							$options.isSelected(row) ? 'cn-table-row--selected' : '',
+							$options.rowLinks[String(row[$props.rowKey])] ? 'cn-table-row--linked' : '',
 							$props.rowClass ? $props.rowClass(row) : '',
 						]]),
                       "data-testid": "cn-object-row",
                       "data-testid-row-id": row[$props.rowKey],
-                      onMousedown: _cache[5] || (_cache[5] = (...args) => (_ctx.onPointerDown && _ctx.onPointerDown(...args))),
+                      onMousedown: _cache[5] || (_cache[5] = (...args) => ($options.onRowMouseDown && $options.onRowMouseDown(...args))),
                       onClick: $event => ($options.onRowClick(row, $event)),
                       onAuxclick: $event => ($options.onRowAuxClick(row, $event)),
-                      onContextmenu: vue$1.withModifiers($event => ($options.onRowContextMenu(row, $event)), ["prevent"])
+                      onContextmenu: $event => ($options.onRowContextMenu(row, $event))
                     }, [
                       ($props.selectable)
                         ? (vue$1.openBlock(), vue$1.createElementBlock("td", {
@@ -17945,15 +18111,26 @@ function render$5_(_ctx, _cache, $props, $setup, $data, $options) {
                           style: vue$1.normalizeStyle(col.width ? { maxWidth: col.width } : {}),
                           onMouseenter: _cache[2] || (_cache[2] = (...args) => ($options.titleWhenClipped && $options.titleWhenClipped(...args)))
                         }, [
+                          (colIndex === 0 && $options.rowLinks[String(row[$props.rowKey])])
+                            ? (vue$1.openBlock(), vue$1.createElementBlock("a", {
+                                key: 0,
+                                class: "cn-table-row__link",
+                                href: $options.rowLinks[String(row[$props.rowKey])].href,
+                                "aria-label": $options.rowLinkLabel(row, col),
+                                draggable: "false",
+                                "data-testid": "cn-row-link",
+                                onClick: $event => ($options.onRowLinkClick(row, $event))
+                              }, null, 8 /* PROPS */, _hoisted_17$12))
+                            : vue$1.createCommentVNode("v-if", true),
                           (colIndex === 0)
                             ? (vue$1.openBlock(), vue$1.createBlock(_component_CnLockIndicator, {
-                                key: 0,
+                                key: 1,
                                 object: row,
                                 size: 16
                               }, null, 8 /* PROPS */, ["object"]))
                             : vue$1.createCommentVNode("v-if", true),
                           (colIndex === 0 && $options.indicatorsFor(row).shown.length > 0)
-                            ? (vue$1.openBlock(), vue$1.createElementBlock("span", _hoisted_17$12, [
+                            ? (vue$1.openBlock(), vue$1.createElementBlock("span", _hoisted_18$T, [
                                 (vue$1.openBlock(true), vue$1.createElementBlock(vue$1.Fragment, null, vue$1.renderList($options.indicatorsFor(row).shown, (indicator) => {
                                   return (vue$1.openBlock(), vue$1.createElementBlock("span", {
                                     key: indicator.id || indicator.field,
@@ -17965,8 +18142,8 @@ function render$5_(_ctx, _cache, $props, $setup, $data, $options) {
                                       name: indicator.icon || 'InformationOutline',
                                       size: 16
                                     }, null, 8 /* PROPS */, ["name"]),
-                                    vue$1.createElementVNode("span", _hoisted_19$L, vue$1.toDisplayString(indicator.text), 1 /* TEXT */)
-                                  ], 8 /* PROPS */, _hoisted_18$T))
+                                    vue$1.createElementVNode("span", _hoisted_20$E, vue$1.toDisplayString(indicator.text), 1 /* TEXT */)
+                                  ], 8 /* PROPS */, _hoisted_19$L))
                                 }), 128 /* KEYED_FRAGMENT */))
                               ]))
                             : vue$1.createCommentVNode("v-if", true),
@@ -18004,7 +18181,7 @@ function render$5_(_ctx, _cache, $props, $setup, $data, $options) {
           ], 2 /* CLASS */)
         ], 8 /* PROPS */, _hoisted_5$3W)),
     (_ctx.$slots.footer || ($props.viewAllRoute && $options.totalRowCount > $options.effectiveRows.length))
-      ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_20$E, [
+      ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_21$C, [
           vue$1.renderSlot(_ctx.$slots, "footer", {
             total: $options.totalRowCount,
             shown: $options.effectiveRows.length
@@ -18015,7 +18192,7 @@ function render$5_(_ctx, _cache, $props, $setup, $data, $options) {
                   class: "cn-data-table__view-all",
                   href: $options.viewAllHref,
                   onClick: _cache[6] || (_cache[6] = (...args) => ($options.onViewAll && $options.onViewAll(...args)))
-                }, vue$1.toDisplayString($props.viewAllLabel), 9 /* TEXT, PROPS */, _hoisted_21$C))
+                }, vue$1.toDisplayString($props.viewAllLabel), 9 /* TEXT, PROPS */, _hoisted_22$z))
               : (vue$1.openBlock(), vue$1.createElementBlock("button", {
                   key: 1,
                   type: "button",
@@ -51199,12 +51376,12 @@ const _hoisted_22$y = {
   class: "cn-icon-browser-panel__error",
   role: "alert"
 };
-const _hoisted_23$o = ["placeholder", "aria-label"];
-const _hoisted_24$m = {
+const _hoisted_23$p = ["placeholder", "aria-label"];
+const _hoisted_24$n = {
   key: 3,
   class: "cn-icon-browser-panel__grid"
 };
-const _hoisted_25$i = ["title", "aria-label", "onClick"];
+const _hoisted_25$j = ["title", "aria-label", "onClick"];
 const _hoisted_26$f = ["src", "alt"];
 const _hoisted_27$b = {
   key: 0,
@@ -51395,12 +51572,12 @@ function render$5X(_ctx, _cache, $props, $setup, $data, $options) {
                     class: "cn-icon-browser-panel__search",
                     placeholder: $options.t('nextcloud-vue', 'Search icons…'),
                     "aria-label": $options.t('nextcloud-vue', 'Search icons')
-                  }, null, 8 /* PROPS */, _hoisted_23$o)), [
+                  }, null, 8 /* PROPS */, _hoisted_23$p)), [
                     [vue$1.vModelText, $data.customQuery]
                   ])
                 : vue$1.createCommentVNode("v-if", true),
               ($options.customVisibleIcons.length > 0)
-                ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_24$m, [
+                ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_24$n, [
                     (vue$1.openBlock(true), vue$1.createElementBlock(vue$1.Fragment, null, vue$1.renderList($options.customVisibleIcons, (icon) => {
                       return (vue$1.openBlock(), vue$1.createElementBlock("button", {
                         key: icon.id || icon.url,
@@ -51419,7 +51596,7 @@ function render$5X(_ctx, _cache, $props, $setup, $data, $options) {
                         ($props.showLabels)
                           ? (vue$1.openBlock(), vue$1.createElementBlock("span", _hoisted_27$b, vue$1.toDisplayString(icon.label), 1 /* TEXT */))
                           : vue$1.createCommentVNode("v-if", true)
-                      ], 10 /* CLASS, PROPS */, _hoisted_25$i))
+                      ], 10 /* CLASS, PROPS */, _hoisted_25$j))
                     }), 128 /* KEYED_FRAGMENT */))
                   ]))
                 : vue$1.createCommentVNode("v-if", true),
@@ -61199,9 +61376,9 @@ const _hoisted_19$I = { class: "cn-activity-tab__day-label" };
 const _hoisted_20$B = { class: "cn-activity-tab__day-count" };
 const _hoisted_21$z = { class: "cn-activity-tab__list" };
 const _hoisted_22$w = { class: "cn-activity-tab__subject" };
-const _hoisted_23$n = { class: "cn-activity-tab__avatar-wrap" };
-const _hoisted_24$l = { class: "cn-activity-tab__subname" };
-const _hoisted_25$h = { class: "cn-activity-tab__actor" };
+const _hoisted_23$o = { class: "cn-activity-tab__avatar-wrap" };
+const _hoisted_24$m = { class: "cn-activity-tab__subname" };
+const _hoisted_25$i = { class: "cn-activity-tab__actor" };
 const _hoisted_26$e = { class: "cn-activity-tab__time" };
 const _hoisted_27$a = {
   key: 0,
@@ -61318,7 +61495,7 @@ function render$5S(_ctx, _cache, $props, $setup, $data, $options) {
                           vue$1.createElementVNode("span", _hoisted_22$w, vue$1.toDisplayString($options.subjectFor(entry)), 1 /* TEXT */)
                         ]),
                         icon: vue$1.withCtx(() => [
-                          vue$1.createElementVNode("span", _hoisted_23$n, [
+                          vue$1.createElementVNode("span", _hoisted_23$o, [
                             vue$1.createVNode(_component_NcAvatar, {
                               user: $options.avatarUser(entry),
                               displayName: $options.actorFor(entry),
@@ -61335,8 +61512,8 @@ function render$5S(_ctx, _cache, $props, $setup, $data, $options) {
                           ])
                         ]),
                         subname: vue$1.withCtx(() => [
-                          vue$1.createElementVNode("span", _hoisted_24$l, [
-                            vue$1.createElementVNode("span", _hoisted_25$h, vue$1.toDisplayString($options.actorFor(entry)), 1 /* TEXT */)
+                          vue$1.createElementVNode("span", _hoisted_24$m, [
+                            vue$1.createElementVNode("span", _hoisted_25$i, vue$1.toDisplayString($options.actorFor(entry)), 1 /* TEXT */)
                           ])
                         ]),
                         _: 2 /* DYNAMIC */
@@ -61615,8 +61792,9 @@ var script$5R = {
 			return `cn-analytics-card__badge--type-${type ?? 'unknown'}`
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		reportUrl(report) {
-			if (report && report.url) {
+			if (report && report.url && safeHref(report.url) !== '#') {
 				return report.url
 			}
 			const id = this.reportKey(report);
@@ -62507,8 +62685,9 @@ var script$5O = {
 			return l10n.translate('nextcloud-vue', 'Latest value')
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		reportUrl(report) {
-			if (report && report.url) {
+			if (report && report.url && safeHref(report.url) !== '#') {
 				return report.url
 			}
 			const id = this.reportKey(report);
@@ -62740,8 +62919,7 @@ function render$5O(_ctx, _cache, $props, $setup, $data, $options) {
               vue$1.createVNode(_component_NcButton, {
                 variant: "primary",
                 href: $props.analyticsAppUrl,
-                target: "_blank",
-                rel: "noopener noreferrer"
+                target: "_blank"
               }, {
                 icon: vue$1.withCtx(() => [
                   vue$1.createVNode(_component_ChartBar, { size: 20 })
@@ -62788,8 +62966,7 @@ function render$5O(_ctx, _cache, $props, $setup, $data, $options) {
                     vue$1.createVNode(_component_NcActionLink, {
                       closeAfterClick: true,
                       href: $options.reportUrl(report),
-                      target: "_blank",
-                      rel: "noopener noreferrer"
+                      target: "_blank"
                     }, {
                       icon: vue$1.withCtx(() => [
                         vue$1.createVNode(_component_OpenInNew, { size: 20 })
@@ -63673,6 +63850,11 @@ var script$5L = {
 			return bookmark.title || bookmark.url || ''
 		},
 
+		// Bookmark URLs are user-entered (bookmarklets are `javascript:`), so only a safe one is a link.
+		hasSafeUrl(bookmark) {
+			return safeHref(bookmark.url) !== '#'
+		},
+
 		chipSubtitle(bookmark) {
 			return bookmark.description || bookmark.url || this.bookmarkTitle(bookmark)
 		},
@@ -63758,55 +63940,61 @@ var script$5L = {
 const _hoisted_1$5w = ["title"];
 const _hoisted_2$5h = ["src"];
 const _hoisted_3$4J = ["href"];
-const _hoisted_4$4h = {
+const _hoisted_4$4h = { key: 3 };
+const _hoisted_5$3L = {
   key: 1,
   class: "cn-bookmarks-card__empty"
 };
-const _hoisted_5$3L = {
+const _hoisted_6$3t = {
   key: 0,
   class: "cn-bookmarks-card__empty"
 };
-const _hoisted_6$3t = {
+const _hoisted_7$34 = {
   key: 1,
   class: "cn-bookmarks-card__empty"
 };
-const _hoisted_7$34 = {
+const _hoisted_8$2J = {
   key: 2,
   class: "cn-bookmarks-card__headline"
 };
-const _hoisted_8$2J = { class: "cn-bookmarks-card__headline-line" };
-const _hoisted_9$2v = {
+const _hoisted_9$2v = { class: "cn-bookmarks-card__headline-line" };
+const _hoisted_10$2c = {
   key: 0,
   class: "cn-bookmarks-card__headline-recent"
 };
-const _hoisted_10$2c = ["src"];
-const _hoisted_11$1T = ["href"];
-const _hoisted_12$1I = {
+const _hoisted_11$1T = ["src"];
+const _hoisted_12$1I = ["href"];
+const _hoisted_13$1A = { key: 3 };
+const _hoisted_14$1r = {
   key: 1,
   class: "cn-bookmarks-card__view-all"
 };
-const _hoisted_13$1A = ["href"];
-const _hoisted_14$1r = {
+const _hoisted_15$1g = ["href"];
+const _hoisted_16$15 = {
   key: 0,
   class: "cn-bookmarks-card__empty"
 };
-const _hoisted_15$1g = {
+const _hoisted_17$Y = {
   key: 1,
   class: "cn-bookmarks-card__empty"
 };
-const _hoisted_16$15 = {
+const _hoisted_18$N = {
   key: 2,
   class: "cn-bookmarks-card__list"
 };
-const _hoisted_17$Y = { class: "cn-bookmarks-card__row-icon" };
-const _hoisted_18$N = ["src", "onError"];
-const _hoisted_19$F = { class: "cn-bookmarks-card__row-main" };
-const _hoisted_20$z = ["href"];
-const _hoisted_21$x = {
+const _hoisted_19$F = { class: "cn-bookmarks-card__row-icon" };
+const _hoisted_20$z = ["src", "onError"];
+const _hoisted_21$x = { class: "cn-bookmarks-card__row-main" };
+const _hoisted_22$v = ["href"];
+const _hoisted_23$n = {
+  key: 1,
+  class: "cn-bookmarks-card__title"
+};
+const _hoisted_24$l = {
   key: 3,
   class: "cn-bookmarks-card__view-all"
 };
-const _hoisted_22$v = ["href"];
+const _hoisted_25$h = ["href"];
 
 function render$5L(_ctx, _cache, $props, $setup, $data, $options) {
   const _component_NcLoadingIcon = vue$1.resolveComponent("NcLoadingIcon");
@@ -63841,26 +64029,29 @@ function render$5L(_ctx, _cache, $props, $setup, $data, $options) {
                           key: 1,
                           size: 14
                         })),
-                    vue$1.createElementVNode("a", {
-                      href: $data.entity.url,
-                      target: "_blank",
-                      rel: "noopener noreferrer"
-                    }, vue$1.toDisplayString($options.bookmarkTitle($data.entity)), 9 /* TEXT, PROPS */, _hoisted_3$4J)
+                    ($options.hasSafeUrl($data.entity))
+                      ? (vue$1.openBlock(), vue$1.createElementBlock("a", {
+                          key: 2,
+                          href: $data.entity.url,
+                          target: "_blank",
+                          rel: "noopener noreferrer"
+                        }, vue$1.toDisplayString($options.bookmarkTitle($data.entity)), 9 /* TEXT, PROPS */, _hoisted_3$4J))
+                      : (vue$1.openBlock(), vue$1.createElementBlock("span", _hoisted_4$4h, vue$1.toDisplayString($options.bookmarkTitle($data.entity)), 1 /* TEXT */))
                   ], 8 /* PROPS */, _hoisted_1$5w))
-                : (vue$1.openBlock(), vue$1.createElementBlock("span", _hoisted_4$4h, vue$1.toDisplayString($props.emptyLabel), 1 /* TEXT */))
+                : (vue$1.openBlock(), vue$1.createElementBlock("span", _hoisted_5$3L, vue$1.toDisplayString($props.emptyLabel), 1 /* TEXT */))
             ], 64 /* STABLE_FRAGMENT */))
           : ($props.surface === 'user-dashboard' || $props.surface === 'app-dashboard')
             ? (vue$1.openBlock(), vue$1.createElementBlock(vue$1.Fragment, { key: 2 }, [
                 ($data.degraded)
-                  ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_5$3L, vue$1.toDisplayString($data.degraded), 1 /* TEXT */))
+                  ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_6$3t, vue$1.toDisplayString($data.degraded), 1 /* TEXT */))
                   : ($data.bookmarks.length === 0)
-                    ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_6$3t, vue$1.toDisplayString($props.emptyLabel), 1 /* TEXT */))
-                    : (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_7$34, [
-                        vue$1.createElementVNode("div", _hoisted_8$2J, [
+                    ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_7$34, vue$1.toDisplayString($props.emptyLabel), 1 /* TEXT */))
+                    : (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_8$2J, [
+                        vue$1.createElementVNode("div", _hoisted_9$2v, [
                           vue$1.createElementVNode("strong", null, vue$1.toDisplayString($options.countHeadline), 1 /* TEXT */)
                         ]),
                         ($options.mostRecent)
-                          ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_9$2v, [
+                          ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_10$2c, [
                               ($options.faviconUrl($options.mostRecent))
                                 ? (vue$1.openBlock(), vue$1.createElementBlock("img", {
                                     key: 0,
@@ -63868,41 +64059,44 @@ function render$5L(_ctx, _cache, $props, $setup, $data, $options) {
                                     alt: "",
                                     class: "cn-bookmarks-card__favicon",
                                     onError: _cache[1] || (_cache[1] = $event => ($options.onFaviconError($options.mostRecent)))
-                                  }, null, 40 /* PROPS, NEED_HYDRATION */, _hoisted_10$2c))
+                                  }, null, 40 /* PROPS, NEED_HYDRATION */, _hoisted_11$1T))
                                 : (vue$1.openBlock(), vue$1.createBlock(_component_Bookmark, {
                                     key: 1,
                                     size: 14
                                   })),
-                              vue$1.createElementVNode("a", {
-                                href: $options.mostRecent.url,
-                                target: "_blank",
-                                rel: "noopener noreferrer"
-                              }, vue$1.toDisplayString($options.bookmarkTitle($options.mostRecent)), 9 /* TEXT, PROPS */, _hoisted_11$1T)
+                              ($options.hasSafeUrl($options.mostRecent))
+                                ? (vue$1.openBlock(), vue$1.createElementBlock("a", {
+                                    key: 2,
+                                    href: $options.mostRecent.url,
+                                    target: "_blank",
+                                    rel: "noopener noreferrer"
+                                  }, vue$1.toDisplayString($options.bookmarkTitle($options.mostRecent)), 9 /* TEXT, PROPS */, _hoisted_12$1I))
+                                : (vue$1.openBlock(), vue$1.createElementBlock("span", _hoisted_13$1A, vue$1.toDisplayString($options.bookmarkTitle($options.mostRecent)), 1 /* TEXT */))
                             ]))
                           : vue$1.createCommentVNode("v-if", true),
                         ($data.bookmarks.length > 1)
-                          ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_12$1I, [
+                          ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_14$1r, [
                               vue$1.createElementVNode("a", {
                                 href: $props.bookmarksAppUrl,
                                 target: "_blank",
                                 rel: "noopener noreferrer"
-                              }, vue$1.toDisplayString($props.viewAllLabel), 9 /* TEXT, PROPS */, _hoisted_13$1A)
+                              }, vue$1.toDisplayString($props.viewAllLabel), 9 /* TEXT, PROPS */, _hoisted_15$1g)
                             ]))
                           : vue$1.createCommentVNode("v-if", true)
                       ]))
               ], 64 /* STABLE_FRAGMENT */))
             : (vue$1.openBlock(), vue$1.createElementBlock(vue$1.Fragment, { key: 3 }, [
                 ($data.degraded)
-                  ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_14$1r, vue$1.toDisplayString($data.degraded), 1 /* TEXT */))
+                  ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_16$15, vue$1.toDisplayString($data.degraded), 1 /* TEXT */))
                   : ($data.bookmarks.length === 0)
-                    ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_15$1g, vue$1.toDisplayString($props.emptyLabel), 1 /* TEXT */))
-                    : (vue$1.openBlock(), vue$1.createElementBlock("ul", _hoisted_16$15, [
+                    ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_17$Y, vue$1.toDisplayString($props.emptyLabel), 1 /* TEXT */))
+                    : (vue$1.openBlock(), vue$1.createElementBlock("ul", _hoisted_18$N, [
                         (vue$1.openBlock(true), vue$1.createElementBlock(vue$1.Fragment, null, vue$1.renderList($options.displayedBookmarks, (bookmark) => {
                           return (vue$1.openBlock(), vue$1.createElementBlock("li", {
                             key: $options.bookmarkKey(bookmark),
                             class: "cn-bookmarks-card__row"
                           }, [
-                            vue$1.createElementVNode("div", _hoisted_17$Y, [
+                            vue$1.createElementVNode("div", _hoisted_19$F, [
                               ($options.faviconUrl(bookmark))
                                 ? (vue$1.openBlock(), vue$1.createElementBlock("img", {
                                     key: 0,
@@ -63910,30 +64104,33 @@ function render$5L(_ctx, _cache, $props, $setup, $data, $options) {
                                     alt: "",
                                     class: "cn-bookmarks-card__favicon",
                                     onError: $event => ($options.onFaviconError(bookmark))
-                                  }, null, 40 /* PROPS, NEED_HYDRATION */, _hoisted_18$N))
+                                  }, null, 40 /* PROPS, NEED_HYDRATION */, _hoisted_20$z))
                                 : (vue$1.openBlock(), vue$1.createBlock(_component_Bookmark, {
                                     key: 1,
                                     size: 14
                                   }))
                             ]),
-                            vue$1.createElementVNode("div", _hoisted_19$F, [
-                              vue$1.createElementVNode("a", {
-                                href: bookmark.url,
-                                target: "_blank",
-                                rel: "noopener noreferrer",
-                                class: "cn-bookmarks-card__title"
-                              }, vue$1.toDisplayString($options.bookmarkTitle(bookmark)), 9 /* TEXT, PROPS */, _hoisted_20$z)
+                            vue$1.createElementVNode("div", _hoisted_21$x, [
+                              ($options.hasSafeUrl(bookmark))
+                                ? (vue$1.openBlock(), vue$1.createElementBlock("a", {
+                                    key: 0,
+                                    href: bookmark.url,
+                                    target: "_blank",
+                                    rel: "noopener noreferrer",
+                                    class: "cn-bookmarks-card__title"
+                                  }, vue$1.toDisplayString($options.bookmarkTitle(bookmark)), 9 /* TEXT, PROPS */, _hoisted_22$v))
+                                : (vue$1.openBlock(), vue$1.createElementBlock("span", _hoisted_23$n, vue$1.toDisplayString($options.bookmarkTitle(bookmark)), 1 /* TEXT */))
                             ])
                           ]))
                         }), 128 /* KEYED_FRAGMENT */))
                       ])),
                 ($data.bookmarks.length > $data.COMPACT_LIMIT)
-                  ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_21$x, [
+                  ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_24$l, [
                       vue$1.createElementVNode("a", {
                         href: $props.bookmarksAppUrl,
                         target: "_blank",
                         rel: "noopener noreferrer"
-                      }, vue$1.toDisplayString($props.viewAllLabel), 9 /* TEXT, PROPS */, _hoisted_22$v)
+                      }, vue$1.toDisplayString($props.viewAllLabel), 9 /* TEXT, PROPS */, _hoisted_25$h)
                     ]))
                   : vue$1.createCommentVNode("v-if", true)
               ], 64 /* STABLE_FRAGMENT */))
@@ -64643,6 +64840,23 @@ var script$5I = {
 			return safeHref(bookmark.url)
 		},
 
+		/**
+		 * Whether the bookmark's URL passed `safeHref`, so its row is a link.
+		 *
+		 * @param {object} bookmark The bookmark row.
+		 * @return {boolean}
+		 */
+		hasSafeUrl(bookmark) {
+			return this.bookmarkHref(bookmark) !== '#'
+		},
+
+		// NcListItem always renders an anchor; one without a safe URL must not follow `#`.
+		onBookmarkClick(bookmark, event) {
+			if (!this.hasSafeUrl(bookmark)) {
+				event?.preventDefault?.();
+			}
+		},
+
 		bookmarkTags(bookmark) {
 			const tags = bookmark.tags;
 			if (!Array.isArray(tags)) {
@@ -64785,8 +64999,7 @@ function render$5I(_ctx, _cache, $props, $setup, $data, $options) {
               vue$1.createVNode(_component_NcButton, {
                 variant: "primary",
                 href: $props.bookmarksAppUrl,
-                target: "_blank",
-                rel: "noopener noreferrer"
+                target: "_blank"
               }, {
                 icon: vue$1.withCtx(() => [
                   vue$1.createVNode(_component_Bookmark, { size: 20 })
@@ -64826,8 +65039,9 @@ function render$5I(_ctx, _cache, $props, $setup, $data, $options) {
                     name: $options.bookmarkTitle(bookmark),
                     bold: true,
                     href: $options.bookmarkHref(bookmark),
-                    target: "_blank",
-                    forceDisplayActions: true
+                    target: $options.hasSafeUrl(bookmark) ? '_blank' : undefined,
+                    forceDisplayActions: true,
+                    onClick: $event => ($options.onBookmarkClick(bookmark, $event))
                   }, {
                     icon: vue$1.withCtx(() => [
                       vue$1.createElementVNode("span", _hoisted_10$2a, [
@@ -64865,20 +65079,22 @@ function render$5I(_ctx, _cache, $props, $setup, $data, $options) {
                         : vue$1.createCommentVNode("v-if", true)
                     ]),
                     actions: vue$1.withCtx(() => [
-                      vue$1.createVNode(_component_NcActionLink, {
-                        closeAfterClick: true,
-                        href: $options.bookmarkHref(bookmark),
-                        target: "_blank",
-                        rel: "noopener noreferrer"
-                      }, {
-                        icon: vue$1.withCtx(() => [
-                          vue$1.createVNode(_component_OpenInNew, { size: 20 })
-                        ]),
-                        default: vue$1.withCtx(() => [
-                          vue$1.createTextVNode(" " + vue$1.toDisplayString($options.t('nextcloud-vue', 'Open bookmark')), 1 /* TEXT */)
-                        ]),
-                        _: 1 /* STABLE */
-                      }, 8 /* PROPS */, ["href"]),
+                      ($options.hasSafeUrl(bookmark))
+                        ? (vue$1.openBlock(), vue$1.createBlock(_component_NcActionLink, {
+                            key: 0,
+                            closeAfterClick: true,
+                            href: $options.bookmarkHref(bookmark),
+                            target: "_blank"
+                          }, {
+                            icon: vue$1.withCtx(() => [
+                              vue$1.createVNode(_component_OpenInNew, { size: 20 })
+                            ]),
+                            default: vue$1.withCtx(() => [
+                              vue$1.createTextVNode(" " + vue$1.toDisplayString($options.t('nextcloud-vue', 'Open bookmark')), 1 /* TEXT */)
+                            ]),
+                            _: 1 /* STABLE */
+                          }, 8 /* PROPS */, ["href"]))
+                        : vue$1.createCommentVNode("v-if", true),
                       vue$1.createVNode(_component_NcActionButton, {
                         closeAfterClick: true,
                         onClick: $event => ($options.unlinkBookmark(bookmark))
@@ -64893,7 +65109,7 @@ function render$5I(_ctx, _cache, $props, $setup, $data, $options) {
                       }, 8 /* PROPS */, ["onClick"])
                     ]),
                     _: 2 /* DYNAMIC */
-                  }, 1032 /* PROPS, DYNAMIC_SLOTS */, ["name", "href"]))
+                  }, 1032 /* PROPS, DYNAMIC_SLOTS */, ["name", "href", "target", "onClick"]))
                 }), 128 /* KEYED_FRAGMENT */))
               ])
             ])),
@@ -66968,8 +67184,9 @@ var script$5D = {
 			return typeof emoji === 'string' ? emoji.trim() : ''
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		pageUrl(page) {
-			if (typeof page.url === 'string' && page.url !== '') {
+			if (typeof page.url === 'string' && page.url !== '' && safeHref(page.url) !== '#') {
 				return page.url
 			}
 			const d = this.dataOf(page);
@@ -67922,8 +68139,9 @@ var script$5A = {
 			return text
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		pageUrl(page) {
-			if (typeof page.url === 'string' && page.url !== '') {
+			if (typeof page.url === 'string' && page.url !== '' && safeHref(page.url) !== '#') {
 				return page.url
 			}
 			const d = this.dataOf(page);
@@ -68205,8 +68423,7 @@ function render$5A(_ctx, _cache, $props, $setup, $data, $options) {
               vue$1.createVNode(_component_NcButton, {
                 variant: "primary",
                 href: $props.collectivesAppUrl,
-                target: "_blank",
-                rel: "noopener noreferrer"
+                target: "_blank"
               }, {
                 icon: vue$1.withCtx(() => [
                   vue$1.createVNode(_component_BookOpenPageVariant, { size: 20 })
@@ -68267,8 +68484,7 @@ function render$5A(_ctx, _cache, $props, $setup, $data, $options) {
                             vue$1.createVNode(_component_NcActionLink, {
                               closeAfterClick: true,
                               href: $options.pageUrl(page),
-                              target: "_blank",
-                              rel: "noopener noreferrer"
+                              target: "_blank"
                             }, {
                               icon: vue$1.withCtx(() => [
                                 vue$1.createVNode(_component_OpenInNew, { size: 20 })
@@ -70733,7 +70949,7 @@ var script$5t = {
 		},
 
 		rowUrl(row) {
-			if (row.url) {
+			if (row.url && safeHref(row.url) !== '#') {
 				return row.url
 			}
 			const projectId = row.projectId ?? row.project_id ?? row.data?.projectid ?? row.data?.project_id ?? null;
@@ -71606,7 +71822,7 @@ var script$5q = {
 		},
 
 		rowUrl(row) {
-			if (row.url) {
+			if (row.url && safeHref(row.url) !== '#') {
 				return row.url
 			}
 			const projectId = row.projectId ?? row.project_id ?? row.data?.projectid ?? row.data?.project_id ?? null;
@@ -71880,8 +72096,7 @@ function render$5q(_ctx, _cache, $props, $setup, $data, $options) {
               vue$1.createVNode(_component_NcButton, {
                 variant: "primary",
                 href: $props.cospendAppUrl,
-                target: "_blank",
-                rel: "noopener noreferrer"
+                target: "_blank"
               }, {
                 icon: vue$1.withCtx(() => [
                   vue$1.createVNode(_component_CurrencyEur, { size: 20 })
@@ -72219,7 +72434,7 @@ var script$5p = {
 		},
 
 		cardUrl(card) {
-			if (card.url) {
+			if (card.url && safeHref(card.url) !== '#') {
 				return card.url
 			}
 			const boardId = card.boardId ?? card.board?.id ?? '';
@@ -73282,7 +73497,7 @@ var script$5m = {
 		},
 
 		cardUrl(card) {
-			if (card.url) {
+			if (card.url && safeHref(card.url) !== '#') {
 				return card.url
 			}
 			const boardId = card.boardId ?? card.board?.id ?? '';
@@ -73601,8 +73816,7 @@ function render$5m(_ctx, _cache, $props, $setup, $data, $options) {
               vue$1.createVNode(_component_NcButton, {
                 variant: "primary",
                 href: $props.deckAppUrl,
-                target: "_blank",
-                rel: "noopener noreferrer"
+                target: "_blank"
               }, {
                 icon: vue$1.withCtx(() => [
                   vue$1.createVNode(_component_ViewColumnOutline, { size: 20 })
@@ -74988,8 +75202,7 @@ function render$5j(_ctx, _cache, $props, $setup, $data, $options) {
       vue$1.createVNode(_component_NcButton, {
         variant: "primary",
         href: $options.composeUrl,
-        target: "_blank",
-        rel: "noopener noreferrer"
+        target: "_blank"
       }, {
         icon: vue$1.withCtx(() => [
           vue$1.createVNode(_component_EmailEditOutline, { size: 18 })
@@ -79140,6 +79353,8 @@ var script$5e = {
 	methods: {
 		t: l10n.translate,
 
+		preventMiddleClickAutoscroll,
+
 		/**
 		 * Hold the file input element from its function ref.
 		 *
@@ -79984,10 +80199,10 @@ function render$5e(_ctx, _cache, $props, $setup, $data, $options) {
   return (vue$1.openBlock(), vue$1.createElementBlock("div", {
     class: vue$1.normalizeClass(["cn-files-browser", { 'cn-files-browser--dragging': $data.dragging }]),
     "data-testid": "cn-files-browser",
-    onDragenter: _cache[14] || (_cache[14] = vue$1.withModifiers($event => ($data.dragging = true), ["prevent"])),
-    onDragover: _cache[15] || (_cache[15] = vue$1.withModifiers($event => ($data.dragging = true), ["prevent"])),
-    onDragleave: _cache[16] || (_cache[16] = vue$1.withModifiers($event => ($data.dragging = false), ["prevent"])),
-    onDrop: _cache[17] || (_cache[17] = vue$1.withModifiers((...args) => ($options.onDrop && $options.onDrop(...args)), ["prevent"]))
+    onDragenter: _cache[16] || (_cache[16] = vue$1.withModifiers($event => ($data.dragging = true), ["prevent"])),
+    onDragover: _cache[17] || (_cache[17] = vue$1.withModifiers($event => ($data.dragging = true), ["prevent"])),
+    onDragleave: _cache[18] || (_cache[18] = vue$1.withModifiers($event => ($data.dragging = false), ["prevent"])),
+    onDrop: _cache[19] || (_cache[19] = vue$1.withModifiers((...args) => ($options.onDrop && $options.onDrop(...args)), ["prevent"]))
   }, [
     vue$1.createElementVNode("div", _hoisted_1$53, [
       vue$1.createVNode(_component_NcBreadcrumbs, { class: "cn-files-browser__crumbs" }, {
@@ -80221,6 +80436,7 @@ function render$5e(_ctx, _cache, $props, $setup, $data, $options) {
                     "data-testid": "cn-files-browser-row",
                     "data-name": node.basename,
                     onClick: $event => ($options.onRowClick(node, $event)),
+                    onMousedown: _cache[3] || (_cache[3] = (...args) => ($options.preventMiddleClickAutoscroll && $options.preventMiddleClickAutoscroll(...args))),
                     onAuxclick: $event => ($options.onRowAuxClick(node, $event))
                   }, [
                     vue$1.createElementVNode("td", _hoisted_14$1b, [
@@ -80348,7 +80564,6 @@ function render$5e(_ctx, _cache, $props, $setup, $data, $options) {
                                 key: 2,
                                 href: $options.permalink(node),
                                 target: "_blank",
-                                rel: "noopener noreferrer",
                                 closeAfterClick: true
                               }, {
                                 icon: vue$1.withCtx(() => [
@@ -80373,6 +80588,7 @@ function render$5e(_ctx, _cache, $props, $setup, $data, $options) {
                     "data-testid": "cn-files-browser-linked-row",
                     "data-name": item.name,
                     onClick: $event => ($options.openLinked(item)),
+                    onMousedown: _cache[7] || (_cache[7] = (...args) => ($options.preventMiddleClickAutoscroll && $options.preventMiddleClickAutoscroll(...args))),
                     onAuxclick: $event => ($options.onLinkedAuxClick(item, $event))
                   }, [
                     vue$1.createElementVNode("td", _hoisted_20$t, [
@@ -80403,7 +80619,7 @@ function render$5e(_ctx, _cache, $props, $setup, $data, $options) {
                                           key: 0,
                                           href: item.noteHref,
                                           class: "cn-files-browser__note-link",
-                                          onClick: _cache[3] || (_cache[3] = vue$1.withModifiers(() => {}, ["stop"]))
+                                          onClick: _cache[4] || (_cache[4] = vue$1.withModifiers(() => {}, ["stop"]))
                                         }, vue$1.toDisplayString(item.note), 9 /* TEXT, PROPS */, _hoisted_24$i))
                                       : (vue$1.openBlock(), vue$1.createElementBlock(vue$1.Fragment, { key: 1 }, [
                                           vue$1.createTextVNode(vue$1.toDisplayString(item.note), 1 /* TEXT */)
@@ -80426,8 +80642,8 @@ function render$5e(_ctx, _cache, $props, $setup, $data, $options) {
                     }), 128 /* KEYED_FRAGMENT */)),
                     vue$1.createElementVNode("td", {
                       class: "cn-files-browser__col-actions",
-                      onClick: _cache[4] || (_cache[4] = vue$1.withModifiers(() => {}, ["stop"])),
-                      onAuxclick: _cache[5] || (_cache[5] = vue$1.withModifiers(() => {}, ["stop"]))
+                      onClick: _cache[5] || (_cache[5] = vue$1.withModifiers(() => {}, ["stop"])),
+                      onAuxclick: _cache[6] || (_cache[6] = vue$1.withModifiers(() => {}, ["stop"]))
                     }, [
                       vue$1.createVNode(_component_NcActions, {
                         forceMenu: true,
@@ -80439,7 +80655,6 @@ function render$5e(_ctx, _cache, $props, $setup, $data, $options) {
                                 key: 0,
                                 href: item.href,
                                 target: "_blank",
-                                rel: "noopener noreferrer",
                                 closeAfterClick: true,
                                 "data-testid": "cn-files-browser-linked-open"
                               }, {
@@ -80483,11 +80698,11 @@ function render$5e(_ctx, _cache, $props, $setup, $data, $options) {
           name: $props.renameLabel,
           size: "small",
           "data-testid": "cn-files-browser-rename",
-          onClosing: _cache[9] || (_cache[9] = $event => ($data.renaming = null))
+          onClosing: _cache[11] || (_cache[11] = $event => ($data.renaming = null))
         }, {
           actions: vue$1.withCtx(() => [
             vue$1.createVNode(_component_NcButton, {
-              onClick: _cache[8] || (_cache[8] = $event => ($data.renaming = null))
+              onClick: _cache[10] || (_cache[10] = $event => ($data.renaming = null))
             }, {
               default: vue$1.withCtx(() => [
                 vue$1.createTextVNode(vue$1.toDisplayString($options.t('nextcloud-vue', 'Cancel')), 1 /* TEXT */)
@@ -80509,11 +80724,11 @@ function render$5e(_ctx, _cache, $props, $setup, $data, $options) {
           default: vue$1.withCtx(() => [
             vue$1.createElementVNode("form", {
               class: "cn-files-browser__new-folder",
-              onSubmit: _cache[7] || (_cache[7] = vue$1.withModifiers((...args) => ($options.rename && $options.rename(...args)), ["prevent"]))
+              onSubmit: _cache[9] || (_cache[9] = vue$1.withModifiers((...args) => ($options.rename && $options.rename(...args)), ["prevent"]))
             }, [
               vue$1.createVNode(_component_NcTextField, {
                 modelValue: $data.renameName,
-                "onUpdate:modelValue": _cache[6] || (_cache[6] = $event => (($data.renameName) = $event)),
+                "onUpdate:modelValue": _cache[8] || (_cache[8] = $event => (($data.renameName) = $event)),
                 label: $options.t('nextcloud-vue', 'New name'),
                 error: $data.renameError !== '',
                 helperText: $data.renameError,
@@ -80530,11 +80745,11 @@ function render$5e(_ctx, _cache, $props, $setup, $data, $options) {
           name: $props.newFolderLabel,
           size: "small",
           "data-testid": "cn-files-browser-new-folder",
-          onClosing: _cache[13] || (_cache[13] = $event => ($data.newFolderOpen = false))
+          onClosing: _cache[15] || (_cache[15] = $event => ($data.newFolderOpen = false))
         }, {
           actions: vue$1.withCtx(() => [
             vue$1.createVNode(_component_NcButton, {
-              onClick: _cache[12] || (_cache[12] = $event => ($data.newFolderOpen = false))
+              onClick: _cache[14] || (_cache[14] = $event => ($data.newFolderOpen = false))
             }, {
               default: vue$1.withCtx(() => [
                 vue$1.createTextVNode(vue$1.toDisplayString($options.t('nextcloud-vue', 'Cancel')), 1 /* TEXT */)
@@ -80556,11 +80771,11 @@ function render$5e(_ctx, _cache, $props, $setup, $data, $options) {
           default: vue$1.withCtx(() => [
             vue$1.createElementVNode("form", {
               class: "cn-files-browser__new-folder",
-              onSubmit: _cache[11] || (_cache[11] = vue$1.withModifiers((...args) => ($options.createFolder && $options.createFolder(...args)), ["prevent"]))
+              onSubmit: _cache[13] || (_cache[13] = vue$1.withModifiers((...args) => ($options.createFolder && $options.createFolder(...args)), ["prevent"]))
             }, [
               vue$1.createVNode(_component_NcTextField, {
                 modelValue: $data.newFolderName,
-                "onUpdate:modelValue": _cache[10] || (_cache[10] = $event => (($data.newFolderName) = $event)),
+                "onUpdate:modelValue": _cache[12] || (_cache[12] = $event => (($data.newFolderName) = $event)),
                 label: $options.t('nextcloud-vue', 'Folder name'),
                 error: $data.newFolderError !== '',
                 helperText: $data.newFolderError,
@@ -81378,7 +81593,6 @@ function render$5d(_ctx, _cache, $props, $setup, $data, $options) {
                               key: 2,
                               href: $options.showInFilesUrl(file),
                               target: "_blank",
-                              rel: "noopener noreferrer",
                               closeAfterClick: true
                             }, {
                               icon: vue$1.withCtx(() => [
@@ -81623,7 +81837,7 @@ var script$5c = {
 		},
 
 		opUrl(op) {
-			return op.url || this.flowSettingsUrl
+			return op.url && safeHref(op.url) !== '#' ? op.url : this.flowSettingsUrl
 		},
 
 		shortClass(className) {
@@ -82290,7 +82504,7 @@ var script$5a = {
 		},
 
 		opUrl(op) {
-			return op.url || this.flowSettingsUrl
+			return op.url && safeHref(op.url) !== '#' ? op.url : this.flowSettingsUrl
 		},
 
 		shortClass(className) {
@@ -82576,8 +82790,7 @@ function render$5a(_ctx, _cache, $props, $setup, $data, $options) {
               vue$1.createVNode(_component_NcButton, {
                 variant: "primary",
                 href: $props.flowSettingsUrl,
-                target: "_blank",
-                rel: "noopener noreferrer"
+                target: "_blank"
               }, {
                 icon: vue$1.withCtx(() => [
                   vue$1.createVNode(_component_SitemapOutline, { size: 20 })
@@ -82929,8 +83142,9 @@ var script$59 = {
 			return form.title || form.id || l10n.translate('nextcloud-vue', 'Untitled form')
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		formUrl(form) {
-			if (form.url) {
+			if (form.url && safeHref(form.url) !== '#') {
 				return form.url
 			}
 			if (form.hash) {
@@ -83970,8 +84184,9 @@ var script$56 = {
 			return form.description || ''
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		formUrl(form) {
-			if (form.url) {
+			if (form.url && safeHref(form.url) !== '#') {
 				return form.url
 			}
 			if (form.hash) {
@@ -84280,8 +84495,7 @@ function render$56(_ctx, _cache, $props, $setup, $data, $options) {
               vue$1.createVNode(_component_NcButton, {
                 variant: "primary",
                 href: $props.formsAppUrl,
-                target: "_blank",
-                rel: "noopener noreferrer"
+                target: "_blank"
               }, {
                 icon: vue$1.withCtx(() => [
                   vue$1.createVNode(_component_ClipboardText, { size: 20 })
@@ -84331,8 +84545,7 @@ function render$56(_ctx, _cache, $props, $setup, $data, $options) {
                     vue$1.createVNode(_component_NcActionLink, {
                       closeAfterClick: true,
                       href: $options.formUrl(form),
-                      target: "_blank",
-                      rel: "noopener noreferrer"
+                      target: "_blank"
                     }, {
                       icon: vue$1.withCtx(() => [
                         vue$1.createVNode(_component_OpenInNew, { size: 20 })
@@ -84632,8 +84845,9 @@ var script$55 = {
 			return `${lat.toFixed(5)}, ${lng.toFixed(5)}`
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		pointUrl(point) {
-			if (typeof point.url === 'string' && point.url !== '') {
+			if (typeof point.url === 'string' && point.url !== '' && safeHref(point.url) !== '#') {
 				return point.url
 			}
 			const lat = this.pointLat(point);
@@ -85549,8 +85763,9 @@ var script$52 = {
 			return `${lat.toFixed(5)}, ${lng.toFixed(5)}`
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		pointUrl(point) {
-			if (typeof point.url === 'string' && point.url !== '') {
+			if (typeof point.url === 'string' && point.url !== '' && safeHref(point.url) !== '#') {
 				return point.url
 			}
 			if (this.pointHasCoords(point)) {
@@ -85781,8 +85996,7 @@ function render$52(_ctx, _cache, $props, $setup, $data, $options) {
               vue$1.createVNode(_component_NcButton, {
                 variant: "primary",
                 href: $props.mapsAppUrl,
-                target: "_blank",
-                rel: "noopener noreferrer"
+                target: "_blank"
               }, {
                 icon: vue$1.withCtx(() => [
                   vue$1.createVNode(_component_MapMarker, { size: 20 })
@@ -85851,8 +86065,7 @@ function render$52(_ctx, _cache, $props, $setup, $data, $options) {
                       vue$1.createVNode(_component_NcActionLink, {
                         closeAfterClick: true,
                         href: $options.pointUrl(point),
-                        target: "_blank",
-                        rel: "noopener noreferrer"
+                        target: "_blank"
                       }, {
                         icon: vue$1.withCtx(() => [
                           vue$1.createVNode(_component_OpenInNew, { size: 20 })
@@ -88020,7 +88233,8 @@ var script$4Z = {
 		},
 
 		wpUrl(wp) {
-			return wp.url ?? wp._links?.self?.href ?? this.openprojectAppUrl
+			const url = wp.url ?? wp._links?.self?.href;
+			return url && safeHref(url) !== '#' ? url : this.openprojectAppUrl
 		},
 
 		wpStatus(wp) {
@@ -89250,7 +89464,8 @@ var script$4W = {
 		},
 
 		wpUrl(wp) {
-			return wp.url ?? wp._links?.self?.href ?? this.openprojectAppUrl
+			const url = wp.url ?? wp._links?.self?.href;
+			return url && safeHref(url) !== '#' ? url : this.openprojectAppUrl
 		},
 
 		wpStatus(wp) {
@@ -89516,8 +89731,7 @@ function render$4W(_ctx, _cache, $props, $setup, $data, $options) {
             vue$1.createVNode(_component_NcButton, {
               variant: "primary",
               href: $props.openconnectorUrl,
-              target: "_blank",
-              rel: "noopener noreferrer"
+              target: "_blank"
             }, {
               icon: vue$1.withCtx(() => [
                 vue$1.createVNode(_component_CogOutline, { size: 20 })
@@ -89540,8 +89754,7 @@ function render$4W(_ctx, _cache, $props, $setup, $data, $options) {
                 vue$1.createVNode(_component_NcButton, {
                   variant: "secondary",
                   href: $props.openprojectAppUrl,
-                  target: "_blank",
-                  rel: "noopener noreferrer"
+                  target: "_blank"
                 }, {
                   icon: vue$1.withCtx(() => [
                     vue$1.createVNode(_component_OpenInNew, { size: 20 })
@@ -89897,7 +90110,7 @@ var script$4V = {
 		},
 
 		albumUrl(album) {
-			if (album && album.url) {
+			if (album && album.url && safeHref(album.url) !== '#') {
 				return album.url
 			}
 			const name = this.albumName(album);
@@ -90680,7 +90893,7 @@ var script$4S = {
 		},
 
 		albumUrl(album) {
-			if (album && album.url) {
+			if (album && album.url && safeHref(album.url) !== '#') {
 				return album.url
 			}
 			const id = this.albumKey(album);
@@ -90943,8 +91156,7 @@ function render$4S(_ctx, _cache, $props, $setup, $data, $options) {
               vue$1.createVNode(_component_NcButton, {
                 variant: "primary",
                 href: $props.photosAppUrl,
-                target: "_blank",
-                rel: "noopener noreferrer"
+                target: "_blank"
               }, {
                 icon: vue$1.withCtx(() => [
                   vue$1.createVNode(_component_ImageIcon, { size: 20 })
@@ -91213,7 +91425,7 @@ var script$4R = {
 		},
 
 		pollUrl(poll) {
-			if (poll.url) {
+			if (poll.url && safeHref(poll.url) !== '#') {
 				return poll.url
 			}
 			const id = poll.id ?? '';
@@ -92289,7 +92501,7 @@ var script$4O = {
 		},
 
 		pollUrl(poll) {
-			if (poll.url) {
+			if (poll.url && safeHref(poll.url) !== '#') {
 				return poll.url
 			}
 			const id = this.pollKey(poll);
@@ -92535,8 +92747,7 @@ function render$4O(_ctx, _cache, $props, $setup, $data, $options) {
               vue$1.createVNode(_component_NcButton, {
                 variant: "primary",
                 href: $props.pollsAppUrl,
-                target: "_blank",
-                rel: "noopener noreferrer"
+                target: "_blank"
               }, {
                 icon: vue$1.withCtx(() => [
                   vue$1.createVNode(_component_Poll, { size: 20 })
@@ -93979,8 +94190,7 @@ function render$4L(_ctx, _cache, $props, $setup, $data, $options) {
               vue$1.createVNode(_component_NcButton, {
                 variant: "primary",
                 href: $props.filesAppUrl,
-                target: "_blank",
-                rel: "noopener noreferrer"
+                target: "_blank"
               }, {
                 icon: vue$1.withCtx(() => [
                   vue$1.createVNode(_component_FolderOutline, { size: 20 })
@@ -94066,8 +94276,7 @@ function render$4L(_ctx, _cache, $props, $setup, $data, $options) {
                           vue$1.createVNode(_component_NcActionLink, {
                             closeAfterClick: true,
                             href: $props.filesAppUrl,
-                            target: "_blank",
-                            rel: "noopener noreferrer"
+                            target: "_blank"
                           }, {
                             icon: vue$1.withCtx(() => [
                               vue$1.createVNode(_component_FolderOutline, { size: 20 })
@@ -94107,8 +94316,7 @@ function render$4L(_ctx, _cache, $props, $setup, $data, $options) {
                 vue$1.createVNode(_component_NcButton, {
                   variant: "tertiary",
                   href: $props.filesAppUrl,
-                  target: "_blank",
-                  rel: "noopener noreferrer"
+                  target: "_blank"
                 }, {
                   icon: vue$1.withCtx(() => [
                     vue$1.createVNode(_component_FolderOutline, { size: 18 })
@@ -94745,8 +94953,9 @@ var script$4I = {
 			return stripMarker(raw) || String(this.roomKey(room))
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		roomUrl(room) {
-			if (room.url) {
+			if (room.url && safeHref(room.url) !== '#') {
 				return room.url
 			}
 			const token = room.token ?? room.id ?? '';
@@ -95478,8 +95687,9 @@ var script$4F = {
 			return stripMarker(raw) || String(this.roomKey(room))
 		},
 
+		// A provider URL is used only when it is a safe scheme; else the app link.
 		roomUrl(room) {
-			if (room.url) {
+			if (room.url && safeHref(room.url) !== '#') {
 				return room.url
 			}
 			const token = room.roomToken ?? room.token ?? room.id ?? '';
@@ -95816,8 +96026,7 @@ function render$4F(_ctx, _cache, $props, $setup, $data, $options) {
               vue$1.createVNode(_component_NcButton, {
                 variant: "primary",
                 href: $props.talkAppUrl,
-                target: "_blank",
-                rel: "noopener noreferrer"
+                target: "_blank"
               }, {
                 icon: vue$1.withCtx(() => [
                   vue$1.createVNode(_component_ChatOutline, { size: 20 })
@@ -95854,8 +96063,7 @@ function render$4F(_ctx, _cache, $props, $setup, $data, $options) {
                     vue$1.createVNode(_component_NcActionLink, {
                       closeAfterClick: true,
                       href: $options.roomUrl(room),
-                      target: "_blank",
-                      rel: "noopener noreferrer"
+                      target: "_blank"
                     }, {
                       icon: vue$1.withCtx(() => [
                         vue$1.createVNode(_component_OpenInNew, { size: 20 })
@@ -97099,7 +97307,7 @@ var script$4C = {
 		},
 
 		rowUrl(row) {
-			if (row.url) {
+			if (row.url && safeHref(row.url) !== '#') {
 				return row.url
 			}
 			const kind = this.rowKind(row);
@@ -97967,7 +98175,7 @@ var script$4z = {
 		},
 
 		rowUrl(row) {
-			if (row.url) {
+			if (row.url && safeHref(row.url) !== '#') {
 				return row.url
 			}
 			const kind = this.rowKind(row);
@@ -98285,8 +98493,7 @@ function render$4z(_ctx, _cache, $props, $setup, $data, $options) {
               vue$1.createVNode(_component_NcButton, {
                 variant: "primary",
                 href: $props.timeTrackerAppUrl,
-                target: "_blank",
-                rel: "noopener noreferrer"
+                target: "_blank"
               }, {
                 icon: vue$1.withCtx(() => [
                   vue$1.createVNode(_component_Clock, { size: 20 })
@@ -99214,8 +99421,10 @@ var script$4x = {
 			return String(page.title ?? page.page ?? page.reference ?? this.pageKey(page))
 		},
 
+		// An unsafe scheme is treated like a missing URL.
 		pageUrl(page) {
-			return page.url ?? ''
+			const url = page.url ?? '';
+			return url && safeHref(url) !== '#' ? url : ''
 		},
 
 		breadcrumbLabel(page) {
@@ -100290,15 +100499,17 @@ var script$4u = {
 
 		/**
 		 * External XWiki deep-link for the page. Empty string when the
-		 * provider didn't surface a `url`, so the row renders as a plain
-		 * (non-anchored) NcListItem rather than a dead link.
+		 * provider didn't surface a `url`, or surfaced an unsafe scheme, so
+		 * the row renders as a plain (non-anchored) NcListItem rather than a
+		 * dead link.
 		 *
 		 * @param {object} page Provider row.
 		 *
 		 * @return {string} Absolute XWiki URL or ''.
 		 */
 		pageHref(page) {
-			return String(page.url ?? '')
+			const url = String(page.url ?? '');
+			return url && safeHref(url) !== '#' ? url : ''
 		},
 
 		breadcrumbLabel(page) {
@@ -100481,14 +100692,13 @@ function render$4u(_ctx, _cache, $props, $setup, $data, $options) {
                 class: "cn-xwiki-tab__banner-cta",
                 href: $options.banner.ctaHref || undefined,
                 target: $options.banner.ctaHref ? '_blank' : undefined,
-                rel: $options.banner.ctaHref ? 'noopener noreferrer' : undefined,
                 onClick: $options.banner.ctaHandler
               }, {
                 default: vue$1.withCtx(() => [
                   vue$1.createTextVNode(vue$1.toDisplayString($options.banner.ctaLabel), 1 /* TEXT */)
                 ]),
                 _: 1 /* STABLE */
-              }, 8 /* PROPS */, ["href", "target", "rel", "onClick"]))
+              }, 8 /* PROPS */, ["href", "target", "onClick"]))
             : vue$1.createCommentVNode("v-if", true)
         ], 2 /* CLASS */))
       : vue$1.createCommentVNode("v-if", true),
@@ -100571,8 +100781,7 @@ function render$4u(_ctx, _cache, $props, $setup, $data, $options) {
                           class: "cn-xwiki-tab__open",
                           closeAfterClick: true,
                           href: $options.pageHref(page),
-                          target: "_blank",
-                          rel: "noopener noreferrer"
+                          target: "_blank"
                         }, {
                           icon: vue$1.withCtx(() => [
                             vue$1.createVNode(_component_OpenInNew, { size: 20 })
@@ -105493,16 +105702,20 @@ var script$4q = {
 		/**
 		 * A link entry was clicked: route a plain in-app click, leave the rest to
 		 * the browser, and emit `action` as a button would. The `handler` is not
-		 * called, since navigating is what the link already does.
+		 * called, since navigating is what the link already does. A modified
+		 * click opens a new tab, so nothing is emitted in this one.
 		 *
 		 * @param {object} action The action definition.
 		 * @param {object} link The resolved link.
 		 * @param {MouseEvent} event The click event.
 		 */
 		onLinkAction(action, link, event) {
+			if (isModifiedClick(event)) {
+				return
+			}
 			followItemActionLink(event, link, this.$router);
 			/**
-			 * @event action User picked an entry. Payload: the action's label and the row. A button entry has already run its `handler`; a link entry navigates instead.
+			 * @event action User picked an entry. Payload: the action's label and the row. A button entry has already run its `handler`; a link entry navigates instead, and a modified (new-tab) click on a link emits nothing.
 			 * @type {{ action: string, row: object|null }}
 			 */
 			this.$emit('action', { action: action.label, row: this.row });
@@ -105751,7 +105964,7 @@ var script$4p = {
 		},
 	},
 
-	emits: ['created', 'row-click', 'view-all', 'files-dropped'],
+	emits: ['created', 'row-click', 'row-aux-click', 'view-all', 'files-dropped'],
 
 	data() {
 		return {
@@ -106744,29 +106957,60 @@ var script$4p = {
 
 		/**
 		 * Navigate to a configured detail route on row click (when `rowRoute`
-		 * is set and a router is available); a ctrl/cmd/shift or middle click
-		 * opens it in a new tab.
+		 * is set and a router is available); a ctrl/cmd/shift click opens it
+		 * in a new tab.
 		 *
 		 * @param {object} row The clicked object row.
-		 * @param {MouseEvent} [event] The originating click/auxclick event.
+		 * @param {MouseEvent} [event] The originating click event.
 		 * @return {void}
 		 */
 		onRowClick(row, event) {
-			const route = this.content.rowRoute;
-			const id = row && (row.id || (row['@self'] && row['@self'].id));
-			if (route && id && this.$router) {
-				markNewTabHandled(event, openRowTarget(event, { name: route, params: { id } }, this.$router));
-			}
+			this.openRowRoute(row, event);
 			/**
 			 * @event row-click Emitted with the clicked object (for hosts that
-			 * want to handle navigation themselves), on a click or middle click.
-			 * Payload: `(row, event)`, the second being the native click/auxclick
-			 * event.
+			 * want to handle navigation themselves). Payload: `(row, event)`, the
+			 * second being the native click event. A middle click emits
+			 * `row-aux-click` instead.
 			 * @type {object}
 			 */
 			this.$emit('row-click', row, event);
 		},
 
+		/**
+		 * A row middle click: opens the configured detail route in a new tab
+		 * and emits `row-aux-click`, not `row-click`.
+		 *
+		 * @param {object} row The clicked object row.
+		 * @param {MouseEvent} event The originating auxclick event.
+		 * @return {void}
+		 */
+		onRowAuxClick(row, event) {
+			this.openRowRoute(row, event);
+			/**
+			 * @event row-aux-click Emitted with the middle-clicked object, for
+			 * opening it in a new tab. Payload: `(row, event)`, the second being
+			 * the native auxclick event.
+			 * @type {object}
+			 */
+			this.$emit('row-aux-click', row, event);
+		},
+
+		/**
+		 * Open `content.rowRoute` for a row: in place, or in a new tab on a
+		 * ctrl/cmd/shift or middle click.
+		 *
+		 * @param {object} row The clicked object row.
+		 * @param {MouseEvent} [event] The originating event.
+		 * @return {void}
+		 */
+		openRowRoute(row, event) {
+			const route = this.content.rowRoute;
+			const id = row && (row.id || (row['@self'] && row['@self'].id));
+			if (route && id && this.$router) {
+				markNewTabHandled(event, openRowTarget(event, { name: route, params: { id } }, this.$router));
+			}
+		},
+
 		/**
 		 * Dispatch one declared row action. A `handler` action gets the row
 		 * appended as its last argument, the same convention CnWidgetObjectTable
@@ -106795,8 +107039,7 @@ var script$4p = {
 		 * @return {object} `{ href, linkTarget }`, `{ to }`, or `{}`.
 		 */
 		rowActionLink(action) {
-			const target = typeof action.target === 'string' ? action.target : '';
-			if (/[@{]/.test(target)) {
+			if (hasActionTargetTokens(action.target)) {
 				return {}
 			}
 			const link = actionLink(action, { router: this.$router || null });
@@ -107219,6 +107462,7 @@ function render$4p(_ctx, _cache, $props, $setup, $data, $options) {
                             sortOrder: $data.localSort.dir || 'asc',
                             borderless: "",
                             onRowClick: $options.onRowClick,
+                            onRowAuxClick: $options.onRowAuxClick,
                             onSelect: $options.onSelect,
                             onSort: $options.onSort
                           }, vue$1.createSlots({ _: 2 /* DYNAMIC */ }, [
@@ -107234,7 +107478,7 @@ function render$4p(_ctx, _cache, $props, $setup, $data, $options) {
                                   key: "0"
                                 }
                               : undefined
-                          ]), 1032 /* PROPS, DYNAMIC_SLOTS */, ["columns", "rows", "loading", "emptyText", "selectable", "selectedIds", "sortKey", "sortOrder", "onRowClick", "onSelect", "onSort"])
+                          ]), 1032 /* PROPS, DYNAMIC_SLOTS */, ["columns", "rows", "loading", "emptyText", "selectable", "selectedIds", "sortKey", "sortOrder", "onRowClick", "onRowAuxClick", "onSelect", "onSort"])
                         ]))
                       }), 128 /* KEYED_FRAGMENT */))
                     ]))
@@ -107250,6 +107494,7 @@ function render$4p(_ctx, _cache, $props, $setup, $data, $options) {
                         sortOrder: $data.localSort.dir || 'asc',
                         borderless: "",
                         onRowClick: $options.onRowClick,
+                        onRowAuxClick: $options.onRowAuxClick,
                         onSelect: $options.onSelect,
                         onSort: $options.onSort
                       }, vue$1.createSlots({ _: 2 /* DYNAMIC */ }, [
@@ -107265,7 +107510,7 @@ function render$4p(_ctx, _cache, $props, $setup, $data, $options) {
                               key: "0"
                             }
                           : undefined
-                      ]), 1032 /* PROPS, DYNAMIC_SLOTS */, ["columns", "rows", "loading", "emptyText", "selectable", "selectedIds", "sortKey", "sortOrder", "onRowClick", "onSelect", "onSort"])
+                      ]), 1032 /* PROPS, DYNAMIC_SLOTS */, ["columns", "rows", "loading", "emptyText", "selectable", "selectedIds", "sortKey", "sortOrder", "onRowClick", "onRowAuxClick", "onSelect", "onSort"])
                     ])),
                 ($options.showPager)
                   ? (vue$1.openBlock(), vue$1.createBlock(_component_CnPagination, {
@@ -108772,7 +109017,6 @@ function render$4n(_ctx, _cache, $props, $setup, $data, $options) {
                 key: 1,
                 href: $options.resolvedRequestFeatureUrl,
                 target: "_blank",
-                rel: "noopener noreferrer",
                 "data-testid": `${$props.testidBase}-action-request-feature`,
                 closeAfterClick: true,
                 onClick: $options.onRequestFeatureClick
@@ -108806,7 +109050,6 @@ function render$4n(_ctx, _cache, $props, $setup, $data, $options) {
                 key: 3,
                 href: $options.resolvedReportBugUrl,
                 target: "_blank",
-                rel: "noopener noreferrer",
                 "data-testid": `${$props.testidBase}-action-report-bug`,
                 closeAfterClick: true
               }, {
@@ -108824,7 +109067,6 @@ function render$4n(_ctx, _cache, $props, $setup, $data, $options) {
                 key: 4,
                 href: $options.resolvedDocumentationUrl,
                 target: "_blank",
-                rel: "noopener noreferrer",
                 "data-testid": `${$props.testidBase}-action-documentation`,
                 closeAfterClick: true
               }, {
@@ -121958,8 +122200,7 @@ function render$41(_ctx, _cache, $props, $setup, $data, $options) {
       vue$1.createVNode(_component_NcButton, {
         variant: "primary",
         href: $options.docsUrl,
-        target: "_blank",
-        rel: "noopener"
+        target: "_blank"
       }, {
         icon: vue$1.withCtx(() => [
           vue$1.createVNode(_component_OpenInNew, { size: 18 })
@@ -123842,7 +124083,7 @@ var script$3Z = {
 		},
 	},
 
-	emits: ['click', 'select'],
+	emits: ['click', 'select', 'aux-click'],
 
 	setup() {
 		// Tell a deliberate card click apart from a text-selection drag.
@@ -123968,14 +124209,28 @@ var script$3Z = {
 				return
 			}
 			/**
-			 * @event click Emitted when a non-selectable (or `clickToView`) card is clicked or middle-clicked. Payload: `(object, event)` — the card's object and the native click/auxclick event, for opening it in a new tab on a ctrl/cmd/shift or middle click. Selectable cards emit `select`; they also emit `click` (deprecated) when a `click` listener is present, so migrate selectable consumers to `@select`.
+			 * @event click Emitted when a non-selectable (or `clickToView`) card is clicked. Payload: `(object, event)` — the card's object and the native click event, for opening it in a new tab on a ctrl/cmd/shift click. A middle click emits `aux-click` instead. Selectable cards emit `select`; they also emit `click` (deprecated) when a `click` listener is present, so migrate selectable consumers to `@select`.
 			 * @type {object} The card's object.
 			 */
 			this.$emit('click', this.object, event);
 		},
 
 		/**
-		 * Card-body middle click: emits `click` like a navigating click.
+		 * Card mousedown: record the press for the drag guard, and on a card a
+		 * middle click opens, keep the browser from starting autoscroll.
+		 *
+		 * @param {MouseEvent} event The mousedown event.
+		 */
+		onCardMouseDown(event) {
+			this.onPointerDown(event);
+			if (!this.selectable || this.clickToView) {
+				preventMiddleClickAutoscroll(event);
+			}
+		},
+
+		/**
+		 * Card-body middle click: emits `aux-click`, not `click`, so an existing
+		 * `click` listener that navigates never moves the current tab away.
 		 * Ignored on a select-on-click card, on nested controls and on drags.
 		 *
 		 * @param {MouseEvent} event The auxclick event.
@@ -123987,7 +124242,11 @@ var script$3Z = {
 			if (this.selectable && !this.clickToView) {
 				return
 			}
-			this.$emit('click', this.object, event);
+			/**
+			 * @event aux-click Emitted when a non-selectable (or `clickToView`) card is middle-clicked, for opening it in a new tab (see `openRowTarget`). Payload: `(object, event)` — the card's object and the native auxclick event.
+			 * @type {object} The card's object.
+			 */
+			this.$emit('aux-click', this.object, event);
 		},
 	},
 };
@@ -124018,7 +124277,7 @@ function render$3Z(_ctx, _cache, $props, $setup, $data, $options) {
 
   return (vue$1.openBlock(), vue$1.createElementBlock("div", {
     class: vue$1.normalizeClass(["cn-object-card", { 'cn-object-card--selected': $props.selected }]),
-    onMousedown: _cache[5] || (_cache[5] = (...args) => (_ctx.onPointerDown && _ctx.onPointerDown(...args))),
+    onMousedown: _cache[5] || (_cache[5] = (...args) => ($options.onCardMouseDown && $options.onCardMouseDown(...args))),
     onClick: _cache[6] || (_cache[6] = $event => ($options.onCardClick($event))),
     onAuxclick: _cache[7] || (_cache[7] = $event => ($options.onCardAuxClick($event)))
   }, [
@@ -136734,10 +136993,9 @@ var script$3w = {
 		 * @return {void}
 		 */
 		dispatchAction({ actionType, url, value }) {
+			// An `external` entry with a URL is a real link (see linkAttrsFor);
+			// one without a URL has nothing to open.
 			switch (actionType) {
-				case ACTION_TYPES$1.EXTERNAL:
-					this.handleExternal(url);
-					break
 				case ACTION_TYPES$1.INTERNAL:
 					this.$emit('internal-action', url);
 					break
@@ -136748,20 +137006,6 @@ var script$3w = {
 					break
 			}
 		},
-
-		/**
-		 * Open an external URL in a new tab; `noopener,noreferrer` prevents
-		 * the opened page reaching back via `window.opener`.
-		 *
-		 * @param {string} url the URL to open.
-		 * @return {void}
-		 */
-		handleExternal(url) {
-			if (typeof url !== 'string' || url === '') {
-				return
-			}
-			window.open(url, '_blank', 'noopener,noreferrer');
-		},
 	},
 };
 
@@ -146317,18 +146561,14 @@ var script$3b = {
 		},
 
 		/**
-		 * Handle a row click — descend into folders, open files in the Files app.
+		 * Handle a folder row click by descending into it. A file row is a
+		 * real link to the Files app and never reaches this.
 		 *
-		 * @param {object} item the clicked item.
+		 * @param {object} item the clicked folder item.
 		 * @return {void}
 		 */
 		onItemClick(item) {
-			if (item.isFolder) {
-				const next = this.joinPath(this.currentSubPath, item.name);
-				this.navigateTo(next);
-			} else {
-				this.openFileInFilesApp(item.fileId);
-			}
+			this.navigateTo(this.joinPath(this.currentSubPath, item.name));
 		},
 
 		/**
@@ -146371,19 +146611,6 @@ var script$3b = {
 			return `${trimmedBase}/${trimmedName}`
 		},
 
-		/**
-		 * Deep-link a file into the Nextcloud Files app in a new tab.
-		 *
-		 * @param {number|string} fileId the Nextcloud file id.
-		 * @return {void}
-		 */
-		openFileInFilesApp(fileId) {
-			const url = this.fileUrl(fileId);
-			if (url) {
-				window.open(url, '_blank', 'noopener,noreferrer');
-			}
-		},
-
 		/**
 		 * The Files-app permalink for a file.
 		 *
@@ -148470,7 +148697,8 @@ const DEBOUNCE_MS = 200;
  * Data origin (decoupling seam): all data flows through a consumer-supplied
  * `dataSource` prop OR the `cnSpendAnalyticsSource` injection — an object
  * exposing `fetchSummary(args)`, `fetchVendorCommitments(args)`,
- * `fetchNarrative(args)`, and optionally `resolveDeepLink(app, kind, id)`. The
+ * `fetchNarrative(args)`, and optionally `resolveDeepLink(app, kind, id)`
+ * (pure and synchronous: it runs for every row on every render). The
  * renderer imports NO financeq / procest / launchpad service module and never
  * calls axios itself; the consuming app (typically over GraphQL) owns the
  * transport. The `requires.graphql` hint lives only in the registry entry, not
@@ -148507,8 +148735,9 @@ var script$37 = {
 		 * Consumer-supplied data source overriding the
 		 * `cnSpendAnalyticsSource` injection. Must expose `fetchSummary`,
 		 * `fetchVendorCommitments`, and `fetchNarrative`; may expose
-		 * `resolveDeepLink`. When `null` the injection (then the empty state)
-		 * is used.
+		 * `resolveDeepLink`, which must be pure and synchronous, since it is
+		 * called for every row on every render. When `null` the injection
+		 * (then the empty state) is used.
 		 *
 		 * @type {object|null}
 		 */
@@ -154248,19 +154477,6 @@ var script$2$ = {
 	},
 
 	computed: {
-		/**
-		 * Each run's link href by uuid, resolved once per render.
-		 *
-		 * @return {{[uuid: string]: string}}
-		 */
-		runHrefs() {
-			const out = {};
-			for (const run of [...this.rows, ...this.completedRows]) {
-				out[run.uuid] = this.runHref(run);
-			}
-			return out
-		},
-
 		/**
 		 * Effective translate function: the explicit prop, then the injected
 		 * host one, then `@nextcloud/l10n` under the library's own app id.
@@ -154720,15 +154936,15 @@ function render$2$(_ctx, _cache, $props, $setup, $data, $options) {
                 ($options.rows.length === 0)
                   ? (vue$1.openBlock(), vue$1.createElementBlock("p", _hoisted_6$1L, vue$1.toDisplayString($options.emptyLabel), 1 /* TEXT */))
                   : (vue$1.openBlock(), vue$1.createElementBlock("ul", _hoisted_7$1x, [
-                      (vue$1.openBlock(true), vue$1.createElementBlock(vue$1.Fragment, null, vue$1.renderList($options.rows, (run) => {
+                      (vue$1.openBlock(true), vue$1.createElementBlock(vue$1.Fragment, null, vue$1.renderList($options.rows, (run, index) => {
                         return (vue$1.openBlock(), vue$1.createElementBlock("li", {
-                          key: run.uuid,
+                          key: run.uuid || `row-${index}`,
                           class: vue$1.normalizeClass(["cn-flow-runs-widget__row", { 'cn-flow-runs-widget__row--linked': $options.isLinked }]),
                           "data-status": run.status
                         }, [
-                          (vue$1.openBlock(), vue$1.createBlock(vue$1.resolveDynamicComponent($options.runHrefs[run.uuid] ? 'a' : 'div'), {
+                          (vue$1.openBlock(), vue$1.createBlock(vue$1.resolveDynamicComponent($options.runHref(run) ? 'a' : 'div'), {
                             class: "cn-flow-runs-widget__row-content",
-                            href: $options.runHrefs[run.uuid] || undefined,
+                            href: $options.runHref(run) || undefined,
                             onClick: $event => ($options.onRowClick($event, run))
                           }, {
                             default: vue$1.withCtx(() => [
@@ -154756,15 +154972,15 @@ function render$2$(_ctx, _cache, $props, $setup, $data, $options) {
                       ($setup.completedError)
                         ? (vue$1.openBlock(), vue$1.createElementBlock("p", _hoisted_16$u, vue$1.toDisplayString($options.tr('Could not load the run history')), 1 /* TEXT */))
                         : (vue$1.openBlock(), vue$1.createElementBlock("ul", _hoisted_17$s, [
-                            (vue$1.openBlock(true), vue$1.createElementBlock(vue$1.Fragment, null, vue$1.renderList($options.completedRows, (run) => {
+                            (vue$1.openBlock(true), vue$1.createElementBlock(vue$1.Fragment, null, vue$1.renderList($options.completedRows, (run, index) => {
                               return (vue$1.openBlock(), vue$1.createElementBlock("li", {
-                                key: run.uuid,
+                                key: run.uuid || `completed-${index}`,
                                 class: vue$1.normalizeClass(["cn-flow-runs-widget__row cn-flow-runs-widget__row--terminal", { 'cn-flow-runs-widget__row--linked': $options.isLinked }]),
                                 "data-status": run.status
                               }, [
-                                (vue$1.openBlock(), vue$1.createBlock(vue$1.resolveDynamicComponent($options.runHrefs[run.uuid] ? 'a' : 'div'), {
+                                (vue$1.openBlock(), vue$1.createBlock(vue$1.resolveDynamicComponent($options.runHref(run) ? 'a' : 'div'), {
                                   class: "cn-flow-runs-widget__row-content",
-                                  href: $options.runHrefs[run.uuid] || undefined,
+                                  href: $options.runHref(run) || undefined,
                                   onClick: $event => ($options.onRowClick($event, run))
                                 }, {
                                   default: vue$1.withCtx(() => [
@@ -158749,6 +158965,8 @@ var script$2Z = {
 	},
 
 	methods: {
+		preventMiddleClickAutoscroll,
+
 		/**
 		 * Start (or restart) the refetch interval, unless polling is off.
 		 *
@@ -159057,6 +159275,7 @@ function render$2Z(_ctx, _cache, $props, $setup, $data, $options) {
                     class: "cn-tasks-widget__row",
                     "data-state": task.state,
                     onClick: $event => ($options.onRowClick(task, $event)),
+                    onMousedown: _cache[1] || (_cache[1] = (...args) => ($options.preventMiddleClickAutoscroll && $options.preventMiddleClickAutoscroll(...args))),
                     onAuxclick: $event => ($options.onRowAuxClick(task, $event))
                   }, [
                     vue$1.createElementVNode("span", _hoisted_8$1l, [
@@ -161549,7 +161768,6 @@ function render$2T(_ctx, _cache, $props, $setup, $data, $options) {
             variant: "tertiary",
             href: $options.savedHref,
             target: "_blank",
-            rel: "noopener noreferrer",
             "data-testid": "cn-interaction-form-open"
           }, {
             icon: vue$1.withCtx(() => [
@@ -169718,8 +169936,7 @@ function render$2C(_ctx, _cache, $props, $setup, $data, $options) {
               ? (vue$1.openBlock(), vue$1.createBlock(_component_NcButton, {
                   key: 2,
                   href: $options.helpUrl,
-                  target: "_blank",
-                  rel: "noopener noreferrer"
+                  target: "_blank"
                 }, {
                   icon: vue$1.withCtx(() => [
                     vue$1.createVNode(_component_HelpCircleOutline, { size: 20 })
@@ -170216,7 +170433,7 @@ var script$2B = {
 		},
 	},
 
-	emits: ['card-click', 'moved', 'refused', 'stale'],
+	emits: ['card-click', 'card-aux-click', 'moved', 'refused', 'stale'],
 
 	data() {
 		return {
@@ -170296,6 +170513,8 @@ var script$2B = {
 	methods: {
 		t: l10n.translate,
 
+		preventMiddleClickAutoscroll,
+
 		/**
 		 * Open one card. The pointer and the keyboard both come through here,
 		 * so a reader on Enter reaches the same record as a reader on click.
@@ -170306,13 +170525,15 @@ var script$2B = {
 		 */
 		openCard(card, event) {
 			/**
-			 * @event card-click Emitted when a reader opens a card, by click, Enter or middle click. Payload: `(card, event)` — the card row and the native event, so the host can open it in a new tab on a ctrl/cmd/shift or middle click.
+			 * @event card-click Emitted when a reader opens a card, by click or Enter. Payload: `(card, event)` — the card row and the native event, so the host can open it in a new tab on a ctrl/cmd/shift click. A middle click emits `card-aux-click` instead.
 			 */
 			this.$emit('card-click', card, event);
 		},
 
 		/**
-		 * Middle click on a card's open button: open it like a click would.
+		 * Middle click on a card's open button: emits `card-aux-click`, not
+		 * `card-click`, so an existing listener that navigates never moves the
+		 * current tab away.
 		 *
 		 * @param {object} card The card the reader picked.
 		 * @param {MouseEvent} event The auxclick event.
@@ -170320,7 +170541,10 @@ var script$2B = {
 		 */
 		onCardAuxClick(card, event) {
 			if (isRowMiddleClick(event)) {
-				this.openCard(card, event);
+				/**
+				 * @event card-aux-click Emitted when a reader middle-clicks a card, for opening it in a new tab (see `openRowTarget`). Payload: `(card, event)` — the card row and the native auxclick event.
+				 */
+				this.$emit('card-aux-click', card, event);
 			}
 		},
 
@@ -170545,7 +170769,7 @@ function render$2B(_ctx, _cache, $props, $setup, $data, $options) {
                   role: "listitem",
                   "data-testid": "cn-board-column",
                   "data-column": column.key,
-                  onDragover: _cache[0] || (_cache[0] = vue$1.withModifiers(() => {}, ["prevent"])),
+                  onDragover: _cache[1] || (_cache[1] = vue$1.withModifiers(() => {}, ["prevent"])),
                   onDrop: $event => ($options.onDrop(column, $event))
                 }, [
                   vue$1.createElementVNode("h3", _hoisted_7$1j, [
@@ -170582,6 +170806,7 @@ function render$2B(_ctx, _cache, $props, $setup, $data, $options) {
                               "data-card-id": $options.cardKey(card),
                               "aria-label": $options.cardLabel(card, column),
                               onClick: $event => ($options.openCard(card, $event)),
+                              onMousedown: _cache[0] || (_cache[0] = (...args) => ($options.preventMiddleClickAutoscroll && $options.preventMiddleClickAutoscroll(...args))),
                               onAuxclick: $event => ($options.onCardAuxClick(card, $event))
                             }, vue$1.toDisplayString($options.openLabel), 41 /* TEXT, PROPS, NEED_HYDRATION */, _hoisted_11$J),
                             ($options.canMove)
@@ -170720,7 +170945,7 @@ var script$2A = {
 		},
 	},
 
-	emits: ['click', 'select'],
+	emits: ['click', 'select', 'aux-click'],
 
 	computed: {
 		/**
@@ -170755,6 +170980,14 @@ var script$2A = {
 			const listeners = { select: () => this.toggleSelect(object) };
 			if (!this.selectable || this.clickToView) {
 				listeners.click = (_card, event) => this.$emit('click', object, event);
+				// A middle click, kept off `click` so a navigating listener stays put.
+				listeners['aux-click'] = (_card, event) => {
+					/**
+					 * @event aux-click Emitted when a navigating card is middle-clicked, for opening it in a new tab (see `openRowTarget`). Payload: `(object, event)` — the card's object and the native auxclick event.
+					 * @type {object} The card's object.
+					 */
+					this.$emit('aux-click', object, event);
+				};
 			}
 			return listeners
 		},
@@ -171060,7 +171293,7 @@ var script$2z = {
 		},
 	},
 
-	emits: ['row-click'],
+	emits: ['row-click', 'row-aux-click'],
 
 	computed: {
 		/** @return {object} The layout. */
@@ -171103,23 +171336,27 @@ var script$2z = {
 	methods: {
 		t: l10n.translate,
 
+		preventMiddleClickAutoscroll,
+
 		/**
 		 * Open one record. Both the bar on the axis and the label of an
 		 * undated row come through here, so the two paths cannot drift.
 		 *
 		 * @param {object} row The record the reader picked.
-		 * @param {MouseEvent} [event] The click or middle-click event.
+		 * @param {MouseEvent} [event] The click event.
 		 * @return {void} Nothing.
 		 */
 		openRow(row, event) {
 			/**
-			 * @event row-click Emitted when a reader opens a record, from its bar on the axis or from the label of an undated row, on a click or a middle click. Payload: `(row, event)` — the row and the native click/auxclick event, so the host can open it in a new tab on a ctrl/cmd/shift or middle click.
+			 * @event row-click Emitted when a reader opens a record, from its bar on the axis or from the label of an undated row. Payload: `(row, event)` — the row and the native click event, so the host can open it in a new tab on a ctrl/cmd/shift click. A middle click emits `row-aux-click` instead.
 			 */
 			this.$emit('row-click', row, event);
 		},
 
 		/**
-		 * Middle click on a bar: open the record like a click would.
+		 * Middle click on a bar or an undated row's label: emits
+		 * `row-aux-click`, not `row-click`, so an existing listener that
+		 * navigates never moves the current tab away.
 		 *
 		 * @param {object} row The record the reader picked.
 		 * @param {MouseEvent} event The auxclick event.
@@ -171127,7 +171364,10 @@ var script$2z = {
 		 */
 		onAuxClick(row, event) {
 			if (isRowMiddleClick(event)) {
-				this.openRow(row, event);
+				/**
+				 * @event row-aux-click Emitted when a reader middle-clicks a record's bar or undated-row label, for opening it in a new tab (see `openRowTarget`). Payload: `(row, event)` — the row and the native auxclick event.
+				 */
+				this.$emit('row-aux-click', row, event);
 			}
 		},
 
@@ -171292,6 +171532,7 @@ function render$2z(_ctx, _cache, $props, $setup, $data, $options) {
                       style: vue$1.normalizeStyle($options.barStyle(bar)),
                       "aria-label": $options.barLabel(bar),
                       onClick: $event => ($options.openRow(bar.row, $event)),
+                      onMousedown: _cache[0] || (_cache[0] = (...args) => ($options.preventMiddleClickAutoscroll && $options.preventMiddleClickAutoscroll(...args))),
                       onAuxclick: $event => ($options.onAuxClick(bar.row, $event))
                     }, vue$1.toDisplayString($options.barText(bar)), 45 /* TEXT, STYLE, PROPS, NEED_HYDRATION */, _hoisted_5$1D))
                   }), 128 /* KEYED_FRAGMENT */))
@@ -171310,6 +171551,7 @@ function render$2z(_ctx, _cache, $props, $setup, $data, $options) {
                     "data-row-id": $options.rowKeyOf(row),
                     "aria-label": $options.unplannedLabelFor(row),
                     onClick: $event => ($options.openRow(row, $event)),
+                    onMousedown: _cache[1] || (_cache[1] = (...args) => ($options.preventMiddleClickAutoscroll && $options.preventMiddleClickAutoscroll(...args))),
                     onAuxclick: $event => ($options.onAuxClick(row, $event))
                   }, vue$1.toDisplayString($options.nameOf(row)), 41 /* TEXT, PROPS, NEED_HYDRATION */, _hoisted_8$18))
                 }), 128 /* KEYED_FRAGMENT */))
@@ -171398,7 +171640,7 @@ var script$2y = {
 	// again from `$emit('click', object)` — twice per click, with different
 	// payloads. Declaring the names here removes them from `$attrs`, which is
 	// also what stops VTU v2 recording the native DOM event into `emitted()`.
-	emits: ['select', 'click'],
+	emits: ['select', 'click', 'aux-click'],
 
 	setup() {
 		// Tell a deliberate row click apart from a text-selection drag.
@@ -171489,15 +171731,29 @@ var script$2y = {
 				return
 			}
 			/**
-			 * @event click Emitted when a non-selectable row is clicked or middle-clicked (navigation). Payload: `(object, event)` — the row's object and the native click/auxclick event, for opening it in a new tab on a ctrl/cmd/shift or middle click.
+			 * @event click Emitted when a non-selectable row is clicked (navigation). Payload: `(object, event)` — the row's object and the native click event, for opening it in a new tab on a ctrl/cmd/shift click. A middle click emits `aux-click` instead.
 			 * @type {object} The row's object.
 			 */
 			this.$emit('click', this.object, event);
 		},
 
 		/**
-		 * Row-body middle click: emits `click` like a click on a
-		 * non-selectable row.
+		 * Row mousedown: record the press for the drag guard, and on a
+		 * non-selectable row keep a middle press from starting autoscroll.
+		 *
+		 * @param {MouseEvent} event The mousedown event.
+		 */
+		onRowMouseDown(event) {
+			this.onPointerDown(event);
+			if (!this.selectable) {
+				preventMiddleClickAutoscroll(event);
+			}
+		},
+
+		/**
+		 * Row-body middle click on a non-selectable row: emits `aux-click`, not
+		 * `click`, so an existing `click` listener that navigates never moves
+		 * the current tab away.
 		 *
 		 * @param {MouseEvent} event The auxclick event.
 		 */
@@ -171505,7 +171761,11 @@ var script$2y = {
 			if (this.selectable || !isRowMiddleClick(event)) {
 				return
 			}
-			this.$emit('click', this.object, event);
+			/**
+			 * @event aux-click Emitted when a non-selectable row is middle-clicked, for opening it in a new tab (see `openRowTarget`). Payload: `(object, event)` — the row's object and the native auxclick event.
+			 * @type {object} The row's object.
+			 */
+			this.$emit('aux-click', this.object, event);
 		},
 	},
 };
@@ -171533,7 +171793,7 @@ function render$2y(_ctx, _cache, $props, $setup, $data, $options) {
 
   return (vue$1.openBlock(), vue$1.createElementBlock("div", {
     class: vue$1.normalizeClass(["cn-object-row", { 'cn-object-row--selected': $props.selected }]),
-    onMousedown: _cache[5] || (_cache[5] = (...args) => (_ctx.onPointerDown && _ctx.onPointerDown(...args))),
+    onMousedown: _cache[5] || (_cache[5] = (...args) => ($options.onRowMouseDown && $options.onRowMouseDown(...args))),
     onClick: _cache[6] || (_cache[6] = $event => ($options.onRowClick($event))),
     onAuxclick: _cache[7] || (_cache[7] = $event => ($options.onRowAuxClick($event)))
   }, [
@@ -171705,7 +171965,7 @@ var script$2x = {
 		},
 	},
 
-	emits: ['click', 'select'],
+	emits: ['click', 'select', 'aux-click'],
 
 	computed: {
 		/**
@@ -171736,6 +171996,7 @@ var script$2x = {
 			const listeners = { select: () => this.toggleSelect(object) };
 			if (!this.selectable) {
 				listeners.click = (_row, event) => this.emitClick(object, event);
+				listeners['aux-click'] = (_row, event) => this.emitAuxClick(object, event);
 			}
 			return listeners
 		},
@@ -171744,16 +172005,31 @@ var script$2x = {
 		 * Emit `click` for a non-selectable row (navigation).
 		 *
 		 * @param {object} object The clicked row's object.
-		 * @param {MouseEvent} [event] The native click/auxclick event.
+		 * @param {MouseEvent} [event] The native click event.
 		 */
 		emitClick(object, event) {
 			/**
-			 * @event click Emitted when a non-selectable row is clicked or middle-clicked (navigation). Payload: `(object, event)` — the row's object and the native click/auxclick event, for opening it in a new tab on a ctrl/cmd/shift or middle click.
+			 * @event click Emitted when a non-selectable row is clicked (navigation). Payload: `(object, event)` — the row's object and the native click event, for opening it in a new tab on a ctrl/cmd/shift click. A middle click emits `aux-click` instead.
 			 * @type {object} The clicked row's object.
 			 */
 			this.$emit('click', object, event);
 		},
 
+		/**
+		 * Emit `aux-click` for a middle click on a non-selectable row, kept off
+		 * `click` so a navigating listener never moves the current tab away.
+		 *
+		 * @param {object} object The clicked row's object.
+		 * @param {MouseEvent} event The native auxclick event.
+		 */
+		emitAuxClick(object, event) {
+			/**
+			 * @event aux-click Emitted when a non-selectable row is middle-clicked, for opening it in a new tab (see `openRowTarget`). Payload: `(object, event)` — the row's object and the native auxclick event.
+			 * @type {object} The clicked row's object.
+			 */
+			this.$emit('aux-click', object, event);
+		},
+
 		toggleSelect(object) {
 			const id = object[this.rowKey];
 			const newIds = this.isSelected(object)
@@ -183711,13 +183987,17 @@ var script$2q = {
 		/**
 		 * A link entry was clicked: route a plain in-app click, leave the rest to
 		 * the browser, and emit `action` as a button would. The `handler` is not
-		 * called, since navigating is what the link already does.
+		 * called, since navigating is what the link already does. A modified
+		 * click opens a new tab, so nothing is emitted in this one.
 		 *
 		 * @param {object} action The action descriptor.
 		 * @param {object} link The resolved link.
 		 * @param {MouseEvent} event The click event.
 		 */
 		onLinkAction(action, link, event) {
+			if (isModifiedClick(event)) {
+				return
+			}
 			followItemActionLink(event, link, this.$router);
 			this.$emit('action', { action: action.label, row: this.targetItem });
 		},
@@ -226880,12 +227160,17 @@ var script$1P = {
 
 		/**
 		 * Add button click: a plain click on an in-app link routes in place,
-		 * anything else on a link is the browser's. Emits `add` either way.
+		 * anything else on a link is the browser's. Emits `add`, except for a
+		 * modified click on a link, which opens in a new tab: a host `@add`
+		 * would otherwise run in the tab the user is leaving.
 		 *
 		 * @param {MouseEvent} event The click event.
 		 */
 		onAddClick(event) {
 			if (this.addLink) {
+				if (isModifiedClick(event)) {
+					return
+				}
 				followItemActionLink(event, this.addLink, this.$router);
 			}
 			this.$emit('add');
@@ -226893,13 +227178,17 @@ var script$1P = {
 
 		/**
 		 * A header link entry was clicked: route a plain in-app click and emit
-		 * `header-action` as the button would.
+		 * `header-action` as the button would. A modified click is the
+		 * browser's alone (a new tab), so nothing is emitted for it.
 		 *
 		 * @param {object} entry The header action.
 		 * @param {object} link The resolved link.
 		 * @param {MouseEvent} event The click event.
 		 */
 		onHeaderLinkClick(entry, link, event) {
+			if (isModifiedClick(event)) {
+				return
+			}
 			followItemActionLink(event, link, this.$router);
 			this.$emit('header-action', { action: entry.id, id: entry.id });
 		},
@@ -227192,8 +227481,7 @@ function render$1P(_ctx, _cache, $props, $setup, $data, $options) {
             ? (vue$1.openBlock(), vue$1.createBlock(_component_NcActionLink, {
                 key: 0,
                 href: $props.documentationUrl,
-                target: "_blank",
-                rel: "noopener noreferrer"
+                target: "_blank"
               }, {
                 icon: vue$1.withCtx(() => [
                   vue$1.createVNode(_component_BookOpenVariantOutline, { size: 20 })
@@ -235256,19 +235544,39 @@ function resolveRowToken(value, row) {
 }
 
 /**
- * The route params a `handler: "navigate"` action pushes for a row: the row id,
- * overridden by the declared `params` after the `{field}` token grammar. A
- * token naming a field the row lacks is dropped.
+ * The implicit `{ id }` param for a row, only when the named route declares
+ * `:id`: vue-router warns about (and drops) a param its path does not take.
+ * Without a router to ask, or for a route it does not know, the id is kept.
  *
- * @param {object} action Manifest action descriptor.
+ * @param {object} [router] The app's router.
+ * @param {string} name The route name.
  * @param {object} row The row.
  * @param {string} rowKey The row's id field.
+ * @return {object} `{ id }`, or an empty object.
+ */
+function rowIdParam(router, name, row, rowKey) {
+	const routes = typeof router?.getRoutes === 'function' ? router.getRoutes() : null;
+	const route = routes ? routes.find((r) => r.name === name) : null;
+	if (route && !/:id\b/.test(route.path)) {
+		return {}
+	}
+	return { id: row?.[rowKey] }
+}
+
+/**
+ * The route params a `handler: "navigate"` action pushes for a row: the row id
+ * (when the route takes one), overridden by the declared `params` after the
+ * `{field}` token grammar. A token naming a field the row lacks is dropped.
+ *
+ * @param {object} action Manifest action descriptor.
+ * @param {object} row The row.
+ * @param {object} ctx Dispatch context (`rowKey`, `router`).
  * @param {boolean} warn Whether to warn about a dropped param.
  * @return {object} The params.
  */
-function navigateParams(action, row, rowKey, warn) {
+function navigateParams(action, row, ctx, warn) {
 	const declaredParams = (action.params && typeof action.params === 'object') ? action.params : null;
-	const params = { id: row?.[rowKey] };
+	const params = rowIdParam(ctx.router, action.route, row, ctx.rowKey);
 	for (const [key, declared] of Object.entries(declaredParams || {})) {
 		const { resolved, value } = resolveRowToken(declared, row);
 		if (resolved) {
@@ -235307,7 +235615,7 @@ function resolveActionTarget(action, row, ctx, warn = false) {
 			return null
 		}
 		if (type === 'open-page') {
-			return { target: { name: target, params: { id: row?.[ctx.rowKey] } }, external: false }
+			return { target: { name: target, params: rowIdParam(ctx.router, target, row, ctx.rowKey) }, external: false }
 		}
 		return { target, external: isExternalActionTarget(target) }
 	}
@@ -235315,7 +235623,7 @@ function resolveActionTarget(action, row, ctx, warn = false) {
 		if (typeof action.route !== 'string' || action.route.length === 0) {
 			return null
 		}
-		return { target: { name: action.route, params: navigateParams(action, row, ctx.rowKey, warn) }, external: false }
+		return { target: { name: action.route, params: navigateParams(action, row, ctx, warn) }, external: false }
 	}
 	return null
 }
@@ -235334,8 +235642,8 @@ function resolveActionTarget(action, row, ctx, warn = false) {
  *   - `open-modal` → not wired for index actions; falls back to `@action`.
  *
  * Handler dispatch (`type: 'handler'`, the default) reads `action.handler`:
- *   - `navigate` → $router.push to `action.route` with `{ id: row[rowKey] }`,
- *     merged with the `action.params` map (declared params win — so a
+ *   - `navigate` → $router.push to `action.route` with `{ id: row[rowKey] }`
+ *     (when the route declares `:id`), merged with the `action.params` map (declared params win — so a
  *     "New X" action can navigate to a detail route with `{ id: "new" }`).
  *     Param strings run the `{field}` row-token grammar: `"{id}"` resolves to
  *     `row.id` (type preserved), `"item-{id}"` interpolates, and a brace-less
@@ -235406,7 +235714,7 @@ function resolveActionHandler(action, ctx) {
 		// `{field}` row-token grammar first — an unresolved token is dropped
 		// rather than pushed as a literal `%7Bid%7D` path segment.
 		return (row) => {
-			ctx.router.push({ name: route, params: navigateParams(action, row, ctx.rowKey, true) });
+			ctx.router.push({ name: route, params: navigateParams(action, row, ctx, true) });
 		}
 	}
 
@@ -236619,7 +236927,8 @@ function namedFilterToQuery(values) {
  * @event {object} mass-export — Mass export confirmed. Payload: { ids, format }
  * @event {object} mass-import — Mass import confirmed. Payload: import data
  * @event {void} refresh — Refresh button clicked
- * @event {object} row-click — Table row or card clicked or middle-clicked. Payload: (row, event) — the row object and the native click/auxclick event
+ * @event {object} row-click — Table row or card clicked. Payload: (row, event) — the row object and the native click event
+ * @event {object} row-aux-click — Table row or card middle-clicked. Payload: (row, event) — the row object and the native auxclick event
  * @event {{ key: string, order: string }} sort — Column sort changed
  * @event {number} page-changed — Pagination page changed
  * @event {number} page-size-changed — Pagination page size changed
@@ -238192,6 +238501,7 @@ var script$1y = {
 		'quick-filter-change',
 		'refresh',
 		'row-click',
+		'row-aux-click',
 		'search',
 		'select',
 		'sort',
@@ -238434,6 +238744,9 @@ var script$1y = {
 		 * that is what Add does (no host `@add` listener) and the router can
 		 * resolve it. The bar then renders Add as a real link; null otherwise.
 		 *
+		 * `$.vnode.props` is not reactive, so an `add` listener attached or
+		 * removed after mount does not re-evaluate this.
+		 *
 		 * @return {string|object|null}
 		 */
 		addLinkTo() {
@@ -241189,21 +241502,60 @@ var script$1y = {
 		/**
 		 * Row/card click: toggles selection when `selectable` (covers the custom
 		 * `cardComponent` path), otherwise emits `row-click` for navigation. A
-		 * ctrl/cmd/shift or middle click opens a named source's row in a new tab.
+		 * ctrl/cmd/shift click opens a named source's row in a new tab.
 		 *
 		 * The `@event` block below sits directly against its `$emit`, and must
 		 * stay there. vue-docgen binds an event's description to the emit it
 		 * IMMEDIATELY precedes.
 		 *
 		 * @param {object} row The clicked row object
-		 * @param {MouseEvent|KeyboardEvent} [event] The originating click/auxclick event.
+		 * @param {MouseEvent|KeyboardEvent} [event] The originating click event.
 		 */
 		onRowClick(row, event) {
+			if (!this.routeClickedRow(row, event)) {
+				return
+			}
+			/**
+			 * @event row-click Emitted on a row/card click for navigation. Fires when `selectable` is false, OR when `rowClickToView` is set and something can open the row (selection then happens via the checkbox). Payload: `(row, event)` — the clicked row and the native click event (absent for a keyboard shortcut or map marker), so a host can open the row in a new tab on a ctrl/cmd/shift click with `openRowTarget`. A middle click emits `row-aux-click` instead.
+			 * @type {object} The clicked row object.
+			 */
+			this.$emit('row-click', ...(event ? [row, event] : [row]));
+		},
+
+		/**
+		 * Row/card middle click: opens a named source's row in a new tab and
+		 * emits `row-aux-click`, not `row-click`, so a host whose `row-click`
+		 * listener navigates never moves the current tab away.
+		 *
+		 * @param {object} row The clicked row object
+		 * @param {MouseEvent} event The originating auxclick event.
+		 */
+		onRowAuxClick(row, event) {
+			if (!this.routeClickedRow(row, event)) {
+				return
+			}
+			/**
+			 * @event row-aux-click Emitted on a row/card middle click, under the same conditions as `row-click`, so a host can open the row in a new tab with `openRowTarget`. Payload: `(row, event)` — the clicked row and the native auxclick event.
+			 * @type {object} The clicked row object.
+			 */
+			this.$emit('row-aux-click', row, event);
+		},
+
+		/**
+		 * The shared part of a row click and a middle click: on a selectable
+		 * page a plain click toggles selection instead, and a named source opens
+		 * its own row.
+		 *
+		 * @param {object} row The clicked row object
+		 * @param {MouseEvent|KeyboardEvent} [event] The originating event.
+		 * @return {boolean} Whether the click navigates, so the caller emits.
+		 */
+		routeClickedRow(row, event) {
 			if (this.selectable && !this.rowClickOpens) {
 				if (!event || event.button === undefined || event.button === 0) {
 					this.onSelect(this.toggleIdInArray(this.internalSelectedIds, row[this.rowKey]));
 				}
-				return
+				return false
 			}
 			// A named source knows where its rows live. Emitting only would leave
 			// the click inert on a manifest page, which has no listener to bind —
@@ -241250,11 +241602,7 @@ var script$1y = {
 					}
 				}
 			}
-			/**
-			 * @event row-click Emitted on a row/card click (or middle click) for navigation. Fires when `selectable` is false, OR when `rowClickToView` is set and something can open the row (selection then happens via the checkbox). Payload: `(row, event)` — the clicked row and the native click/auxclick event (absent for a keyboard shortcut or map marker), so a host can open the row in a new tab on a ctrl/cmd/shift or middle click with `openRowTarget`.
-			 * @type {object} The clicked row object.
-			 */
-			this.$emit('row-click', ...(event ? [row, event] : [row]));
+			return true
 		},
 
 		/**
@@ -241268,17 +241616,31 @@ var script$1y = {
 			return typeof Event !== 'undefined' && value instanceof Event
 		},
 
+		/**
+		 * Mousedown on a custom list/card component's root: when a middle click
+		 * opens the row, keep the browser from starting autoscroll.
+		 *
+		 * @param {MouseEvent} event The mousedown event.
+		 * @return {void}
+		 */
+		onCustomItemMouseDown(event) {
+			if (!this.selectable || this.rowClickOpens) {
+				preventMiddleClickAutoscroll(event);
+			}
+		},
+
 		/**
 		 * Middle click on a custom list/card component's root: open the row
-		 * like a click would.
+		 * like a middle click on a built-in card would. Skipped when something
+		 * inside the component already opened it in a new tab.
 		 *
 		 * @param {object} row The component's row.
 		 * @param {MouseEvent} event The auxclick event.
 		 * @return {void}
 		 */
 		onCustomItemAuxClick(row, event) {
-			if (isRowMiddleClick(event)) {
-				this.onRowClick(row, event);
+			if (isRowMiddleClick(event) && !isNewTabHandled(event)) {
+				this.onRowAuxClick(row, event);
 			}
 		},
 
@@ -242685,6 +243047,7 @@ function render$1y(_ctx, _cache, $props, $setup, $data, $options) {
                   onSort: $options.onSortEvent,
                   onSelect: $options.onSelect,
                   onRowClick: $options.onRowClick,
+                  onRowAuxClick: $options.onRowAuxClick,
                   onRowContextMenu: $options.onRowContextMenu
                 }, vue$1.createSlots({ _: 2 /* DYNAMIC */ }, [
                   vue$1.renderList($options.slotColumns, (col) => {
@@ -242785,7 +243148,7 @@ function render$1y(_ctx, _cache, $props, $setup, $data, $options) {
                         key: "1"
                       }
                     : undefined
-                ]), 1032 /* PROPS, DYNAMIC_SLOTS */, ["schema", "columns", "rowIcon", "rowIndicators", "rowIndicatorCap", "rows", "sortKey", "sortOrder", "sortKeys", "selectable", "rowClickToView", "selectedIds", "rowKey", "emptyText", "excludeColumns", "includeColumns", "columnOverrides", "rowClass", "onSort", "onSelect", "onRowClick", "onRowContextMenu"]))
+                ]), 1032 /* PROPS, DYNAMIC_SLOTS */, ["schema", "columns", "rowIcon", "rowIndicators", "rowIndicatorCap", "rows", "sortKey", "sortOrder", "sortKeys", "selectable", "rowClickToView", "selectedIds", "rowKey", "emptyText", "excludeColumns", "includeColumns", "columnOverrides", "rowClass", "onSort", "onSelect", "onRowClick", "onRowAuxClick", "onRowContextMenu"]))
               : ($data.currentViewMode === 'map')
                 ? (vue$1.openBlock(), vue$1.createBlock(_component_CnMapWidget, {
                     key: 3,
@@ -242811,8 +243174,9 @@ function render$1y(_ctx, _cache, $props, $setup, $data, $options) {
                       runTransition: $props.runTransition,
                       paged: $options.isPaged,
                       onCardClick: $options.onRowClick,
+                      onCardAuxClick: $options.onRowAuxClick,
                       onMoved: $options.onBoardMoved
-                    }, null, 8 /* PROPS */, ["rows", "statusFieldSchema", "statusField", "cardFields", "swimlaneField", "rowKey", "runTransition", "paged", "onCardClick", "onMoved"]))
+                    }, null, 8 /* PROPS */, ["rows", "statusFieldSchema", "statusField", "cardFields", "swimlaneField", "rowKey", "runTransition", "paged", "onCardClick", "onCardAuxClick", "onMoved"]))
                   : ($data.currentViewMode === 'dateAxis')
                     ? (vue$1.openBlock(), vue$1.createBlock(_component_CnDateAxisView, {
                         key: 5,
@@ -242822,8 +243186,9 @@ function render$1y(_ctx, _cache, $props, $setup, $data, $options) {
                         laneField: $props.dateAxis.laneField || '',
                         labelField: $props.dateAxis.labelField || '',
                         rowKey: $props.rowKey,
-                        onRowClick: $options.onRowClick
-                      }, null, 8 /* PROPS */, ["rows", "startField", "endField", "laneField", "labelField", "rowKey", "onRowClick"]))
+                        onRowClick: $options.onRowClick,
+                        onRowAuxClick: $options.onRowAuxClick
+                      }, null, 8 /* PROPS */, ["rows", "startField", "endField", "laneField", "labelField", "rowKey", "onRowClick", "onRowAuxClick"]))
                     : ($data.currentViewMode === 'list')
                       ? (vue$1.openBlock(), vue$1.createBlock(_component_CnObjectList, {
                           key: 6,
@@ -242835,6 +243200,7 @@ function render$1y(_ctx, _cache, $props, $setup, $data, $options) {
                           rowKey: $props.rowKey,
                           emptyText: $props.emptyText,
                           onClick: $options.onRowClick,
+                          onAuxClick: $options.onRowAuxClick,
                           onSelect: $options.onSelect
                         }, vue$1.createSlots({ _: 2 /* DYNAMIC */ }, [
                           (_ctx.$slots['list-item'])
@@ -242859,9 +243225,10 @@ function render$1y(_ctx, _cache, $props, $setup, $data, $options) {
                                       register: $props.register,
                                       selected: selected,
                                       onClick: (...args) => $options.onRowClick(object, args.find($options.isDomEvent)),
+                                      onMousedown: $options.onCustomItemMouseDown,
                                       onAuxclick: $event => ($options.onCustomItemAuxClick(object, $event)),
                                       onSelect: $event => ($options.onSelect($options.toggleIdInArray($data.internalSelectedIds, object[$props.rowKey])))
-                                    }, null, 40 /* PROPS, NEED_HYDRATION */, ["item", "object", "schema", "register", "selected", "onClick", "onAuxclick", "onSelect"]))
+                                    }, null, 40 /* PROPS, NEED_HYDRATION */, ["item", "object", "schema", "register", "selected", "onClick", "onMousedown", "onAuxclick", "onSelect"]))
                                   ]),
                                   key: "1"
                                 }
@@ -242899,7 +243266,7 @@ function render$1y(_ctx, _cache, $props, $setup, $data, $options) {
                                 key: "4"
                               }
                             : undefined
-                        ]), 1032 /* PROPS, DYNAMIC_SLOTS */, ["objects", "schema", "config", "selectable", "selectedIds", "rowKey", "emptyText", "onClick", "onSelect"]))
+                        ]), 1032 /* PROPS, DYNAMIC_SLOTS */, ["objects", "schema", "config", "selectable", "selectedIds", "rowKey", "emptyText", "onClick", "onAuxClick", "onSelect"]))
                       : (vue$1.openBlock(), vue$1.createBlock(_component_CnCardGrid, {
                           key: 7,
                           objects: $options.displayObjects,
@@ -242910,6 +243277,7 @@ function render$1y(_ctx, _cache, $props, $setup, $data, $options) {
                           rowKey: $props.rowKey,
                           emptyText: $props.emptyText,
                           onClick: $options.onRowClick,
+                          onAuxClick: $options.onRowAuxClick,
                           onSelect: $options.onSelect
                         }, vue$1.createSlots({ _: 2 /* DYNAMIC */ }, [
                           (_ctx.$slots.card)
@@ -242934,9 +243302,10 @@ function render$1y(_ctx, _cache, $props, $setup, $data, $options) {
                                       register: $props.register,
                                       selected: selected,
                                       onClick: (...args) => $options.onRowClick(object, args.find($options.isDomEvent)),
+                                      onMousedown: $options.onCustomItemMouseDown,
                                       onAuxclick: $event => ($options.onCustomItemAuxClick(object, $event)),
                                       onSelect: $event => ($options.onSelect($options.toggleIdInArray($data.internalSelectedIds, object[$props.rowKey])))
-                                    }, null, 40 /* PROPS, NEED_HYDRATION */, ["item", "object", "schema", "register", "selected", "onClick", "onAuxclick", "onSelect"]))
+                                    }, null, 40 /* PROPS, NEED_HYDRATION */, ["item", "object", "schema", "register", "selected", "onClick", "onMousedown", "onAuxclick", "onSelect"]))
                                   ]),
                                   key: "1"
                                 }
@@ -242956,7 +243325,7 @@ function render$1y(_ctx, _cache, $props, $setup, $data, $options) {
                                 key: "2"
                               }
                             : undefined
-                        ]), 1032 /* PROPS, DYNAMIC_SLOTS */, ["objects", "schema", "selectable", "clickToView", "selectedIds", "rowKey", "emptyText", "onClick", "onSelect"])),
+                        ]), 1032 /* PROPS, DYNAMIC_SLOTS */, ["objects", "schema", "selectable", "clickToView", "selectedIds", "rowKey", "emptyText", "onClick", "onAuxClick", "onSelect"])),
         vue$1.createVNode(_component_CnContextMenu, {
           open: $setup.contextMenuOpen,
           "onUpdate:open": _cache[21] || (_cache[21] = $event => (($setup.contextMenuOpen) = $event)),
@@ -256271,8 +256640,9 @@ var script$1a = {
 		 * (`@objectId` / `@object.<field>` / `@workspace.<key>`) AND provided on
 		 * `cnSectionContext` for host section components that inject. Mirrors the
 		 * `cnObjectContext` ref the abstract list/stat widgets already read.
+		 * `setObject(object)` shows an object a section saved without a re-fetch.
 		 *
-		 * @return {{objectId: (string|null), object: (object|null), register: string, schema: string}}
+		 * @return {{objectId: (string|null), object: (object|null), register: string, schema: string, setObject: function(object): void}}
 		 */
 		sectionContext() {
 			const resolved = this.resolvedSidebar || {};
@@ -256282,6 +256652,7 @@ var script$1a = {
 				register: resolved.register || this.register || this.sidebarProps?.register || '',
 				schema: resolved.schema || this.schema || this.resolvedObjectType || this.sidebarProps?.schema || '',
 				config: this.cnAppConfigRef,
+				setObject: (object) => this.setCurrentObject(object),
 			}
 		},
 	},
@@ -256778,6 +257149,32 @@ var script$1a = {
 			this.$emit('related-row-click', payload);
 		},
 
+		/**
+		 * Replace the page's object in the store cache, for a section that saved
+		 * it and holds the saved version. An object with another id is ignored.
+		 *
+		 * @param {object} object The saved object.
+		 */
+		setCurrentObject(object) {
+			const store = this.effectiveObjectStore;
+			const type = this.resolvedObjectType;
+			if (!store || !type || !this.objectId || !object) {
+				// eslint-disable-next-line no-console -- tells the integrating section its save is not shown
+				console.warn('[CnDetailPage] setObject ignored: the page has no object store, type or id');
+				return
+			}
+			const id = object.id ?? object['@self']?.id;
+			if (id !== undefined && id !== null && String(id) !== String(this.objectId)) {
+				// eslint-disable-next-line no-console -- tells the integrating section its save is not shown
+				console.warn(`[CnDetailPage] setObject ignored: object ${id} is not the page's object ${this.objectId}`);
+				return
+			}
+			store.objects = {
+				...store.objects,
+				[type]: { ...(store.objects?.[type] || {}), [this.objectId]: object },
+			};
+		},
+
 		/**
 		 * Schema-driven fetch entry point — no-op outside the
 		 * `register`+`schema`+`objectId` mode. Registers the type on
@@ -273549,14 +273946,21 @@ var script$F = {
 		 */
 		'action',
 		/**
-		 * @event row-click Emitted when a log row's body is clicked or
-		 * middle-clicked, whether or not `rowDetail` opened the detail dialog —
-		 * so a host can navigate instead of (or as well as) showing the dialog.
-		 * Payload: `(row, event)`, the second being the native click/auxclick
-		 * event.
+		 * @event row-click Emitted when a log row's body is clicked, whether or
+		 * not `rowDetail` opened the detail dialog — so a host can navigate
+		 * instead of (or as well as) showing the dialog. Payload: `(row, event)`,
+		 * the second being the native click event. A middle click emits
+		 * `row-aux-click` instead.
 		 * @type {object}
 		 */
 		'row-click',
+		/**
+		 * @event row-aux-click Emitted when a log row's body is middle-clicked,
+		 * for opening it in a new tab. Payload: `(row, event)`, the second being
+		 * the native auxclick event.
+		 * @type {object}
+		 */
+		'row-aux-click',
 	],
 
 	setup(props) {
@@ -274059,26 +274463,43 @@ var script$F = {
 		/**
 		 * Handle a row-body click: navigate to `rowRoute` when one is declared,
 		 * else open the detail dialog when `rowDetail` is set. Always re-emits
-		 * so a host can do its own thing regardless. A ctrl/cmd/shift or middle
-		 * click opens `rowRoute` in a new tab; a middle click never opens the
-		 * dialog.
+		 * so a host can do its own thing regardless. A ctrl/cmd/shift click
+		 * opens `rowRoute` in a new tab.
 		 *
 		 * @param {object} row The clicked log entry.
-		 * @param {MouseEvent} [event] The originating click/auxclick event.
+		 * @param {MouseEvent} [event] The originating click event.
 		 */
 		onRowClick(row, event) {
 			if (this.rowRoute) {
 				markNewTabHandled(event, openRowTarget(event, { name: this.rowRoute, params: { id: row?.[this.rowKey] } }, this.$router));
-			} else if (this.rowDetail && !(event && event.button === 1)) {
+			} else if (this.rowDetail) {
 				this.detailRow = row;
 			}
 			/**
-			 * @event row-click Emitted when a log row's body is clicked or middle-clicked. Payload: `(row, event)` — the log entry and the native click/auxclick event.
+			 * @event row-click Emitted when a log row's body is clicked. Payload: `(row, event)` — the log entry and the native click event.
 			 * @type {object}
 			 */
 			this.$emit('row-click', row, event);
 		},
 
+		/**
+		 * Handle a row-body middle click: open `rowRoute` in a new tab, never
+		 * the detail dialog, and emit `row-aux-click` rather than `row-click`.
+		 *
+		 * @param {object} row The clicked log entry.
+		 * @param {MouseEvent} event The originating auxclick event.
+		 */
+		onRowAuxClick(row, event) {
+			if (this.rowRoute) {
+				markNewTabHandled(event, openRowTarget(event, { name: this.rowRoute, params: { id: row?.[this.rowKey] } }, this.$router));
+			}
+			/**
+			 * @event row-aux-click Emitted when a log row's body is middle-clicked. Payload: `(row, event)` — the log entry and the native auxclick event.
+			 * @type {object}
+			 */
+			this.$emit('row-aux-click', row, event);
+		},
+
 		/** Close the row-detail dialog. */
 		closeDetail() {
 			this.detailRow = null;
@@ -274190,7 +274611,8 @@ function render$F(_ctx, _cache, $props, $setup, $data, $options) {
                   sortKeys: $options.effectiveSortKeys,
                   emptyText: $props.emptyText,
                   onSort: $options.onSort,
-                  onRowClick: $options.onRowClick
+                  onRowClick: $options.onRowClick,
+                  onRowAuxClick: $options.onRowAuxClick
                 }, vue$1.createSlots({ _: 2 /* DYNAMIC */ }, [
                   vue$1.renderList($options.slotColumns, (col) => {
                     return {
@@ -274212,7 +274634,7 @@ function render$F(_ctx, _cache, $props, $setup, $data, $options) {
                         key: "0"
                       }
                     : undefined
-                ]), 1032 /* PROPS, DYNAMIC_SLOTS */, ["schema", "columns", "rows", "rowKey", "fixedLayout", "sortKey", "sortOrder", "sortKeys", "emptyText", "onSort", "onRowClick"]),
+                ]), 1032 /* PROPS, DYNAMIC_SLOTS */, ["schema", "columns", "rows", "rowKey", "fixedLayout", "sortKey", "sortOrder", "sortKeys", "emptyText", "onSort", "onRowClick", "onRowAuxClick"]),
                 ($options.paginationState && $options.paginationState.pages > 1)
                   ? (vue$1.openBlock(), vue$1.createBlock(_component_CnPagination, {
                       key: 0,
@@ -276900,7 +277322,8 @@ function render$y(_ctx, _cache, $props, $setup, $data, $options) {
     showEditAction: false,
     actions: $options.rowActions,
     rowClickToView: "",
-    onRowClick: $options.openFlow
+    onRowClick: $options.openFlow,
+    onRowAuxClick: $options.openFlow
   }, {
     "header-actions": vue$1.withCtx(() => [
       vue$1.createVNode(_component_NcButton, {
@@ -276917,7 +277340,7 @@ function render$y(_ctx, _cache, $props, $setup, $data, $options) {
       }, 8 /* PROPS */, ["to"])
     ]),
     _: 1 /* STABLE */
-  }, 8 /* PROPS */, ["title", "description", "columns", "objects", "loading", "actions", "onRowClick"]))
+  }, 8 /* PROPS */, ["title", "description", "columns", "objects", "loading", "actions", "onRowClick", "onRowAuxClick"]))
 }
 
 script$y.render = render$y;
@@ -283168,6 +283591,7 @@ function render$q(_ctx, _cache, $props, $setup, $data, $options) {
                       ? (vue$1.openBlock(), vue$1.createBlock(vue$1.resolveDynamicComponent($options.resolvedComponent), vue$1.mergeProps({ key: $options.pageRenderKey }, { ..._ctx.$attrs, ...$options.resolvedProps }, {
                           onView: $options.onRowOpen,
                           onRowClick: $options.onRowOpen,
+                          onRowAuxClick: $options.onRowOpen,
                           onEditOpen: $options.onRowOpen,
                           onConfigure: _cache[0] || (_cache[0] = $event => ($data.showConfigModal = true))
                         }), vue$1.createSlots({ _: 2 /* DYNAMIC */ }, [
@@ -283204,7 +283628,7 @@ function render$q(_ctx, _cache, $props, $setup, $data, $options) {
                                 key: "0"
                               }
                             : undefined
-                        ]), 1040 /* FULL_PROPS, DYNAMIC_SLOTS */, ["onView", "onRowClick", "onEditOpen"]))
+                        ]), 1040 /* FULL_PROPS, DYNAMIC_SLOTS */, ["onView", "onRowClick", "onRowAuxClick", "onEditOpen"]))
                       : vue$1.createCommentVNode("v-if", true),
                   ($options.widgetsBySlot.has('header-actions'))
                     ? (vue$1.openBlock(), vue$1.createBlock(_component_CnWidgetGrid, {
@@ -283246,6 +283670,7 @@ function render$q(_ctx, _cache, $props, $setup, $data, $options) {
                 ? (vue$1.openBlock(), vue$1.createBlock(vue$1.resolveDynamicComponent($options.resolvedComponent), vue$1.mergeProps({ key: $options.pageRenderKey }, { ..._ctx.$attrs, ...$options.resolvedProps }, {
                     onView: $options.onRowOpen,
                     onRowClick: $options.onRowOpen,
+                    onRowAuxClick: $options.onRowOpen,
                     onEditOpen: $options.onRowOpen,
                     onConfigure: _cache[1] || (_cache[1] = $event => ($data.showConfigModal = true))
                   }), vue$1.createSlots({ _: 2 /* DYNAMIC */ }, [
@@ -283282,7 +283707,7 @@ function render$q(_ctx, _cache, $props, $setup, $data, $options) {
                           key: "0"
                         }
                       : undefined
-                  ]), 1040 /* FULL_PROPS, DYNAMIC_SLOTS */, ["onView", "onRowClick", "onEditOpen"]))
+                  ]), 1040 /* FULL_PROPS, DYNAMIC_SLOTS */, ["onView", "onRowClick", "onRowAuxClick", "onEditOpen"]))
                 : vue$1.createCommentVNode("v-if", true),
         (!$options.hasRenderableBody)
           ? (vue$1.openBlock(), vue$1.createElementBlock("div", _hoisted_2$A, [
@@ -296211,8 +296636,7 @@ function render$7(_ctx, _cache, $props, $setup, $data, $options) {
                     key: 0,
                     variant: "primary",
                     href: $options.resolvedSuggestUrl,
-                    target: "_blank",
-                    rel: "noopener noreferrer"
+                    target: "_blank"
                   }, {
                     icon: vue$1.withCtx(() => [
                       vue$1.createVNode(_component_Plus, { size: 20 })
@@ -300263,6 +300687,7 @@ var translations$s = {
 	"One of": "One of",
 	Open: "Open",
 	"Open access:": "Open access:",
+	"Open row": "Open row",
 	Operator: "Operator",
 	Order: "Order",
 	"Owner:": "Owner:",
@@ -301468,6 +301893,7 @@ var translations$c = {
 	"One of": "Één van",
 	Open: "Openen",
 	"Open access:": "Openbare toegang:",
+	"Open row": "Rij openen",
 	Operator: "Operator",
 	Order: "Volgorde",
 	"Owner:": "Eigenaar:",