[Snyk] Upgrade @uswds/uswds from 3.8.0 to 3.13.0#330
Open
sfrederick-gsa-gov wants to merge 1 commit intomainfrom
Open
[Snyk] Upgrade @uswds/uswds from 3.8.0 to 3.13.0#330sfrederick-gsa-gov wants to merge 1 commit intomainfrom
sfrederick-gsa-gov wants to merge 1 commit intomainfrom
Conversation
Snyk has created this PR to upgrade @uswds/uswds from 3.8.0 to 3.13.0. See this package in npm: @uswds/uswds See this project in Snyk: https://app.snyk.io/org/gsa-pages/project/3f1ed618-0f12-4948-866b-e07354fe94c4?utm_source=github&utm_medium=referral&page=upgrade-pr
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade @uswds/uswds from 3.8.0 to 3.13.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 7 versions ahead of your current version.
The recommended version was released 9 months ago.
Release notes
Package name: @uswds/uswds
What's new in USWDS 3.13.0
Features
usa-bannerusa-bannertag will make it easier for many teams to get up and running with USWDS, and we plan to add more Web Components in the future. Huge thanks to @ mejiaj who did much of the work on this component in the USWDS Elements repository (#6460)usa-rangeuswds-coreDependency updates
Note: While Lit is a new dependency, it's only necessary for the new Web Component banner variant. If you're using the compiled version of that component from
dist, Lit's already included.Dev Dependency updates
eslint-plugin-airbnb-base0vulnerabilities in regular dependencies (dependencies for USWDS projects installed with npm install @ uswds/uswds)55vulnerabilities (29moderate,26high) in devDependencies (development dependencies)Release TGZ SHA-256 hash:
6eac004fb7785490eb640f388c6949c57951501876acb109ecdd4c8ead7518b6What's new in USWDS 3.12.0
Features
usa-date-picker,usa-date-range-pickerDate.toLocaleStringAPI to automatically build translated labels based on the document'slangattribute. Thanks @ deebloo! (#5679)usa-in-page-navigationdata-minimum-heading-countproperty to the in-page navigation component. This property hides the component when the content region does not contain the minimum number of headings. By default, this attribute hides the in-page navigation component when there are fewer than two headings in the content region.✏️ Teams should customize the value of this property based on their content needs. (#6205)
usa-tooltipBug fixes
usa-checkbox,usa-radiousa-in-page-navigation✏ Teams that use
data-scroll-offsetshould check to make sure this change does not cause regressions in scroll behaviors. Thanks @ jhancock532! (#5878)uswds-coreuswds-coreresolve-id-refsdependency with custom JavaScript. (#6308)Dependencies and security
Dependency updates
Dev dependency updates
Additional updates
Important
USWDS now requires a verified signature on all commits to this repository. Learn more about how to set up signature verification in our CONTRIBUTING.md file.
Additional contributions
0vulnerabilities in regular dependencies (dependencies for USWDS projects installed withnpm install @ uswds/uswds)30moderate,26high vulnerabilities in devDependencies (development dependencies).Release TGZ SHA-256 hash:
8a562ec0c24d93b7eeaeaa9056f54050054344331dd34ca96d5be161442f09cdWhat's new in USWDS 3.11.0
Features
usa-elementsusa-form,usa-input-prefix-suffix,usa-input,uswds-core.usa-input--[width]and.usa-input-group--[width]classes out of theusa-formpackage. These classes are now generated in theusa-inputandusa-input-prefix-suffixpackages and can be used without the.usa-formparent element. Thanks @ aduth! (#6232)usa-tablethead th,tbody th, andtfoot thcells will all have the same visual styles. Thanks @ ajanickiv!✏️ Teams should confirm that their tables display as expected. (#5986)
Bug fixes
usa-button,usa-collection,usa-file-input,usa-icon-list,usa-icon,usa-input-prefix-suffix,usa-modal,usa-paginationxlink:hrefreferences withhref.✏ Teams should update their markup to replace
xlink:hrefreferences withhrefand pull in the updatedloader.svgfile. (#6165)usa-file-input✏ Teams who support additional languages should update the error message string to match the new copy.
usa-footeroverflow: hiddenfromusa-footerto allow the full focus outline to show. This fix also improves horizontal alignment in the slim footer variant. Thanks @ 6TELOIV! (#6237)Markup changes
MDN warns that the deprecated
xlink:hrefattribute can stop working at any time. When referencing SVG icon sprites, teams should usehrefinstead of the deprecatedxlink:hrefattribute.Dependencies and security
0vulnerabilities in regular dependencies (dependencies for USWDS projects installed withnpm install @ uswds/uswds)29moderate,26high vulnerabilities in devDependencies (development dependencies).Release TGZ SHA-256 hash:
1c10cd70a3c627fd14d9ee74a4071e67c4e5ba4bf14ca1c50c19c2fe5885e70aWhat's new in USWDS 3.10.0
Features
usa-combo-boxBug fixes
usa-checkbox✏️ Teams should update the
checkbox-indeterminate.svgandcheckbox-indeterminate-alt.svgfiles in their projects.usa-file-inputusa-modelusa-step-indicatoraria-labelfrom the wrapper of the step indicator component. This resolves an automated testing error related to having an invalid attribute on adivelement. (#6146)✏️ Teams should remove the the
aria-labelfrom the.usa-step-indicatorelement in their step indicator markup.usa-time-picker✏️ Teams should replace the words "hh:mm" in the time picker hint text with "Select a time from the dropdown. Type into the input to filter options."
Markup changes
Step indicator
To remove automated testing errors, teams should update the step indicator markup to remove the
aria-labelon theusa-step-indicatorelement:Time picker
If teams are using "hh:mm" in their time picker hint text, they should update the text to "Select a time from the dropdown. Type into the input to filter options.":
Dependencies and security
Dependency updates
Dev Dependency updates
Thanks @ aduth and @ anselmbradford for contributing to our dependency updates!
0vulnerabilities in regular dependencies (dependencies for USWDS projects installed withnpm install @ uswds/uswds)29moderate,26high vulnerabilities in devDependencies (development dependencies).Release TGZ SHA-256 hash:
fdd1f9fc4cbfeb0fca7feeba1c94b205ba4ee22d03f63bb916c8750982715fb7What's new in USWDS 3.9.0
Features
usa-character-countmaxlengthis exceeded in the character count component. Now, the component uses standard USWDS error styles to visually enhance the error state. (#5908)usa-date-picker,usa-date-range-pickeraria-disabledto the list of expected attributes in the date picker and date range picker components. Now, the component will disable toggle when thearia-disabledattribute is present. (#6013)uswds-core,usa-layout-grid$theme-utility-breakpoints-customsetting. This setting generates responsive variants of USWDS utilities at custom breakpoints. Values must be set withpxvalues inside a Sass map. Thanks @ jamigibbs! (#6048)Bug fixes
usa-alert,usa-site-alert$theme-site-margins-widthto unexpectedly adjust the alignment inside the alert and site alert components. Alignment on the alert and site alert components will likely shift from this change. Confirm that your implementation of the component aligns as expected. (#5636)usa-buttonautoto better match USWDS link styles. Users should confirm that the variant visually displays as expected in their projects. Thanks @ aduth! (#5631)@ include button-unstyledin your custom styles. These items may be affected by this change.usa-card$theme-card-font-familysetting. Confirm that your implementation of the card component displays with the expected font family. (#5974)$theme-card-font-family.usa-combo-boxusa-date-picker,usa-date-range-pickermouseoverevents to prevent keyboard navigation. Now when you hover your mouse over the date picker buttons, only the hover state will be triggered. (#5774)usa-headerusa-footer,templatesautocomplete="email"attribute to the big footer variant and the "Create an account" template. This attribute allows the components to meet the standards outlined in WCAG 1.3.5. (#6002)✏️ Teams should update their markup if they use an email field in their big footer.
usa-identifier✏️ Teams should update this text if they use the Spanish-language identifier.
usa-memorable-date✏️ Teams should update their memorable date component to remove the leading numbers.
usa-paginationDependencies and security
Thanks @ aduth for contributing to our dependency updates and @ skyf0l for fixing a typo in our package.json!
0vulnerabilities in regular dependencies (dependencies for USWDS projects installed withnpm install @ uswds/uswds)29moderate,26high vulnerabilities in devDependencies (development dependencies).Release TGZ SHA-256 hash:
140cb2162e6c60a6a6ecbc71d8d047819d4ec26f9dd6c7056bd4bd8a266af2abWhat's new in USWDS 3.8.2
Dependencies and security
Removed the
classlist-polyfilldependency. This update resolves a Denial of Service (DoS) vulnerability related to theclasslist-polyfilldependency that we do not consider exploitable on the front end of applications. (#6012)Important
This release may affect some functionality in Internet Explorer 11 (IE11). This update removes the polyfill that added full
classListsupport to IE11. USWDS no longer supports IE11, but if your project does, test if this update negatively affects your users and add additional support forclassListif it does.Thanks @ aduth for the initial work on removing this dependency.
0vulnerabilities in regular dependencies (dependencies for USWDS projects installed withnpm install @ uswds/uswds)5low,11moderate,44high vulnerabilities in devDependencies (development dependencies).Release TGZ SHA-256 hash:
94049e150c2a67dfdb75f140fc664d2e936ef652480a2f88dfdd96922e0a940cWhat's new in USWDS 3.8.1
Bug fixes
usa-button-groupusa-footerusa-layout-griddependency in the footer package and removed layout grid styles from the footer stylesheet. This update prevents visual regressions in footer and other components with layout grid utility classes in their markup. (#5930)usa-identifierusa-in-page-navigationdata-header-selectorattribute in an in-page navigation JavaScript error message. The error message now correctly references thedata-heading-elementsattribute. (#5856)usa-input-maskusa-tooltipusa-tooltipusa-validationuswds-utilitiesDependencies and security
Thanks @ anselmbradford for the dependency updates!
0vulnerabilities in regular dependencies (dependencies for USWDS projects installed withnpm install @ uswds/uswds)13moderate,28high vulnerabilities in devDependencies (development dependencies).Release TGZ SHA-256 hash:
a86fa133b842ce28d1eed2226216c478debf31bf6c16ffcd96fecf061fdf4583