Publish packages 🚀

[shopify-github-actions-access]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@remote-dom/core@1.12.0

Minor Changes

• #713 b8bed3d Thanks @MitchLillie! - Add optional per-element member configuration and blockedProperties to DOMRemoteReceiver.

  This release also fixes security vulnerabilities.

  Use elements with an array of element names, or a map specifying each element's properties, attributes, events, and methods. Property keys map to objects with optional type and attribute fields. The type field validates non-nullish property-channel values (no coercion); attribute authorizes corresponding attributes (defaults true for kebab-case, string for named alias, false for none). Attribute values must be strings (or nullish for removal); they are not parsed according to property types. Events use raw DOM names (e.g., click, not onClick).

  Default behavior

  • A supplied elements array or map restricts element names, including nested children. Omitting elements leaves names unrestricted; an empty array or map accepts only text and comments.
  • Property and attribute names innerHTML, outerHTML, srcdoc, __proto__, constructor, prototype, is, and names beginning with on are excluded case-insensitively. Use the event-listener channel for event callbacks.
  • Assignments to base DOM methods are excluded. Native <a> and <area> elements also exclude writes to the protocol property; update their complete href instead.
  • URL checks apply to href, xlink:href, src, action, formAction, codebase, background, poster, and native <object>.data. They reject javascript:, vbscript:, and data: URLs other than AVIF, BMP, GIF, JPEG, PNG, and WebP image media types. Native URL properties require strings or nullish values rather than object coercion.
  • Default method dispatch supports custom-element methods and native focus/blur, but excludes other native or inherited DOM methods. Root calls require a host call callback. A methods list can narrow default dispatch, not override its exclusions.
  • Text updates apply only to text and comment nodes.

  Explicit member definitions do not override these default checks. blockedProperties adds exclusions rather than replacing the defaults.

  Existing element-name arrays retain ordinary member handling; omitted member definitions use the defaults. Empty properties or events maps and empty methods lists deny those channels. The attributes list adds attribute-only names to those authorized by property definitions; without property definitions, an empty attributes list denies attributes.

  RemoteReceiverElement supports the same configuration through static properties on a host-side subclass. The existing call callback remains available for custom method dispatch. Data-only receivers are unchanged.

Patch Changes

• #725 8d02d40 Thanks @vividviolet! - Fix DOMRemoteReceiver cleanup for removed elements and per-element cache expiry.

• Updated dependencies [fc245ba, dff700b, da43e02, 85cefcd, a9aee3e, f4af17f, c13d18b, 9904cdd, 8de0600, ee48d52, 7eb8a18, 4be18ef, 6ddc71f, e249e3e, 44e3b36, 072b7e8, fd4de61, fd8e186, ab6c549, 5f0b228, 08e3223, a629e25, e1acf97, 0a39389, c3918c6, e2a9eef, 516fcfa, 23ceb4d, 5466415, d916fab, 0789d12, 4b8bae9, 6b42b09, 685dff1, 7181475, 3c57e5b, cdfd5dd, db32f49]:

  • @remote-dom/polyfill@1.6.0

@remote-dom/polyfill@1.6.0

Minor Changes

• #620 4be18ef Thanks @andrewiggins! - Add getElementById() to Document and DocumentFragment, with reflected Element.id properties. Add getElementsByTagName() to Document and Element, supporting HTML, non-HTML, and wildcard descendant searches. querySelector and querySelectorAll accept a pre-parsed Matcher[] in addition to string selectors, with MatcherType, Combinator, Matcher, and Part exported from selectors.ts; getElementById and getElementsByTagName delegate to this shared selector engine instead of independent tree-walk implementations.

  Fixed insertBefore() leaving the previous sibling pointing at the reference node when inserting before a middle child, causing NEXT traversals (including getElementById) to skip the inserted subtree even though childNodes contained it, and return the inserted child as required by the DOM specification. Fixed appendChild() to return the appended child and NodeList.item() to return null for out-of-range indexes. Fixed case-insensitive HTML tag-name matching in the selector engine so querySelector('DIV') now matches <div> per the CSS spec. Fixed CSS-escaping issues so getElementById matches ids containing special characters (., :, #, etc.) literally instead of treating them as selector syntax.

• #625 ab6c549 Thanks @airhorns! - Add getElementsByClassName() to polyfilled documents and elements.

• #624 e2a9eef Thanks @airhorns! - Implement the standard MutationObserver methods for child, attribute, and character-data changes in the polyfilled DOM.

• #652 0789d12 Thanks @olavoasantos! - Add composable Window extensions for installing DOM APIs and subscribing to DOM operations.

Patch Changes

• #681 fc245ba Thanks @olavoasantos! - Adopt complete subtrees, including initialized template content, during cross-document insertion so descendant and attribute mutations use the destination document.

• #669 dff700b Thanks @olavoasantos! - Dispatch attribute hooks when mutating an attached attribute's value or nodeValue.

• #679 da43e02 Thanks @olavoasantos! - Correct chained combinators, whitespace, exact attribute equality, and scoped relative :has() selectors, including leading combinators, nested functional pseudo-classes, and ASCII-case-insensitive pseudo-class names.

• #642 85cefcd Thanks @andrewiggins! - Add the missing CustomElementRegistry.initialize() compatibility method so TypeScript 7 type checks cleanly.

• #653 a9aee3e Thanks @andrewiggins! - Make the Polyfill source compatible with type stripping by replacing TypeScript enums and a parameter property with erasable syntax.

• #668 f4af17f Thanks @olavoasantos! - Preserve attribute ownership and linked-list integrity when attributes are reinstalled, replaced, removed, or reused.

• #683 c13d18b Thanks @olavoasantos! - Throw a named NotSupportedError when cloning a document or importing one with Document.importNode().

• #681 9904cdd Thanks @olavoasantos! - Make ChildNode.replaceWith(), before(), and after() validate all arguments before changing existing trees, preserve sibling argument order, and commit each operation before custom-element reactions run.

• #664 8de0600 Thanks @olavoasantos! - Correct event dispatch lifecycle state, isolate composed paths, and defer listener registrations added during dispatch.

• #692 ee48d52 Thanks @olavoasantos! - Throw named DOM errors for invalid tree mutations and selector syntax.

• #669 7eb8a18 Thanks @olavoasantos! - Return null from Document.textContent and ignore assignments to preserve the initialized document structure.

• #669 6ddc71f Thanks @olavoasantos! - Clear parent children without creating an empty text node when assigning an empty textContent value, and finish the complete replacement before running custom-element reactions.

• #662 e249e3e Thanks @olavoasantos! - Correct event listener identity and AbortSignal handling in the EventTarget polyfill.

• #663 44e3b36 Thanks @olavoasantos! - Fix event cancellation semantics for preventDefault(), returnValue, and dispatchEvent().

• #666 072b7e8 Thanks @olavoasantos! - Install missing event methods and error handlers consistently without replacing native global event delivery.

• #685 fd4de61 Thanks @olavoasantos! - Preserve character references and literal ampersands when parsing innerHTML, decode attribute references without double-escaping, handle nested innerHTML parsing from synchronous callbacks, and handle HTML void elements without nesting following content or serializing closing tags.

• #669 fd8e186 Thanks @olavoasantos! - Remove slot attributes without recreating them as empty attributes, keeping local and host state synchronized.

• #688 5f0b228 Thanks @olavoasantos! - Default omitted CustomEvent detail values to null.

• #688 08e3223 Thanks @olavoasantos! - Include Comment nodes in the polyfill hook type contract.

• #677 a629e25 Thanks @olavoasantos! - Normalize and validate DOM element and attribute names across HTML and namespaced APIs, including toggleAttribute() and custom-element attribute reactions.

• #688 e1acf97 Thanks @olavoasantos! - Normalize createTextNode() hook data to match the created text node.

• #685 0a39389 Thanks @olavoasantos! - Parse template descendants into template content and serialize that content with stack-safe HTML output.

• #623 c3918c6 Thanks @airhorns! - Fix ChildNode.replaceWith() throwing instead of replacing the node

  replaceWith() passed its arguments to replaceChild() in the wrong order — replaceChild(newChild, oldChild) was called as parent.replaceChild(this, node), naming the incoming node as the child to replace. Since that node is usually fresh and has no parent, the reference check rejected it and every call threw reference node is not a child of this parent. It also read the following sibling off the incoming node rather than off this, so the remaining arguments had no correct insertion point to anchor to.

  The method now removes this and inserts the given nodes at its position, in argument order, anchored on the first following sibling that is not itself being moved. Strings become text nodes, calling it with no arguments removes the node (matching remove()), and a node with no parent is still left alone.

• #714 516fcfa Thanks @olavoasantos! - Resolve Node.isDefaultNamespace() with DOM locate-a-namespace semantics.

• #669 23ceb4d Thanks @olavoasantos! - Return removed and replaced nodes from removeChild and replaceChild.

• #679 5466415 Thanks @olavoasantos! - Return a NodeList-compatible collection from querySelectorAll().

• #669 d916fab Thanks @olavoasantos! - Queue custom-element reactions so compound tree and attribute mutations commit their local state and Remote DOM hooks before callbacks run. Drain nested reactions in FIFO order, and finish the queue before rethrowing the first callback error.

• #669 4b8bae9 Thanks @olavoasantos! - Traverse wide and deep trees without overflowing the call stack during text collection, selector queries, and subtree connectivity updates. Prepare insertion snapshots transactionally before committing links, connectivity, hooks, and reactions so traversal failures preserve local and remote tree state. Capture lifecycle reactions in mutation order before emitting reentrant tree-mutation hook effects through a FIFO queue.

• #676 6b42b09 Thanks @olavoasantos! - Make CustomElementRegistry.define() reject invalid custom element names and duplicate name or constructor registrations, matching browser behavior.

• #660 685dff1 Thanks @andrewiggins! - Correct class selector whitespace parsing and return polyfilled NodeList collections from selector queries.

• #683 7181475 Thanks @olavoasantos! - Preserve established element and attribute names, namespaces, and both direct and template-content trees when cloning or importing nodes without recursive traversal.

• #688 3c57e5b Thanks @olavoasantos! - Fix Node.contains() for nested descendants and nodes outside the current subtree.

• #667 cdfd5dd Thanks @olavoasantos! - Validate tree insertions and replacements before changing node links so invalid ancestor, template-content cycle, and reference-node mutations preserve the existing trees. Treat inserting a node before itself as a no-op and safely replace a child with its next sibling.

• #687 db32f49 Thanks @olavoasantos! - Ignore unmatched closing tags, preserve SVG and HTML namespace boundaries, and retain literal parser names while parsing innerHTML.

example-custom-element@0.0.27

Patch Changes

• Updated dependencies [8d02d40, b8bed3d]:
  • @remote-dom/core@1.12.0

example-getting-started@0.0.27

Patch Changes

• Updated dependencies [8d02d40, b8bed3d]:
  • @remote-dom/core@1.12.0

example-kitchen-sink@0.0.34

Patch Changes

• Updated dependencies [8d02d40, b8bed3d]:
  • @remote-dom/core@1.12.0