diff --git a/.changeset/adopt-inserted-subtrees.md b/.changeset/adopt-inserted-subtrees.md deleted file mode 100644 index b6342298..00000000 --- a/.changeset/adopt-inserted-subtrees.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Adopt complete subtrees, including initialized template content, during cross-document insertion so descendant and attribute mutations use the destination document. diff --git a/.changeset/bright-attrs-update.md b/.changeset/bright-attrs-update.md deleted file mode 100644 index 574b00c2..00000000 --- a/.changeset/bright-attrs-update.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Dispatch attribute hooks when mutating an attached attribute's value or nodeValue. diff --git a/.changeset/bright-selectors-match.md b/.changeset/bright-selectors-match.md deleted file mode 100644 index 36b7613e..00000000 --- a/.changeset/bright-selectors-match.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Correct chained combinators, whitespace, exact attribute equality, and scoped relative `:has()` selectors, including leading combinators, nested functional pseudo-classes, and ASCII-case-insensitive pseudo-class names. diff --git a/.changeset/calm-tools-initialize.md b/.changeset/calm-tools-initialize.md deleted file mode 100644 index ba8f6b38..00000000 --- a/.changeset/calm-tools-initialize.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Add the missing `CustomElementRegistry.initialize()` compatibility method so TypeScript 7 type checks cleanly. diff --git a/.changeset/calm-types-erase.md b/.changeset/calm-types-erase.md deleted file mode 100644 index dd377244..00000000 --- a/.changeset/calm-types-erase.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Make the Polyfill source compatible with type stripping by replacing TypeScript enums and a parameter property with erasable syntax. diff --git a/.changeset/clean-attribute-links.md b/.changeset/clean-attribute-links.md deleted file mode 100644 index bc7ad063..00000000 --- a/.changeset/clean-attribute-links.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Preserve attribute ownership and linked-list integrity when attributes are reinstalled, replaced, removed, or reused. diff --git a/.changeset/clear-documents-reject.md b/.changeset/clear-documents-reject.md deleted file mode 100644 index 1deaef16..00000000 --- a/.changeset/clear-documents-reject.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Throw a named `NotSupportedError` when cloning a document or importing one with `Document.importNode()`. diff --git a/.changeset/correct-child-replace-with.md b/.changeset/correct-child-replace-with.md deleted file mode 100644 index 377a186e..00000000 --- a/.changeset/correct-child-replace-with.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Make `ChildNode.replaceWith()`, `before()`, and `after()` validate all arguments before changing existing trees, preserve sibling argument order, and commit each operation before custom-element reactions run. diff --git a/.changeset/correct-event-dispatch-lifecycle.md b/.changeset/correct-event-dispatch-lifecycle.md deleted file mode 100644 index fe46be29..00000000 --- a/.changeset/correct-event-dispatch-lifecycle.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Correct event dispatch lifecycle state, isolate composed paths, and defer listener registrations added during dispatch. diff --git a/.changeset/distinguish-dom-errors.md b/.changeset/distinguish-dom-errors.md deleted file mode 100644 index 92723c65..00000000 --- a/.changeset/distinguish-dom-errors.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Throw named DOM errors for invalid tree mutations and selector syntax. diff --git a/.changeset/document-text-content-semantics.md b/.changeset/document-text-content-semantics.md deleted file mode 100644 index c21e9b34..00000000 --- a/.changeset/document-text-content-semantics.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Return `null` from `Document.textContent` and ignore assignments to preserve the initialized document structure. diff --git a/.changeset/element-query-methods.md b/.changeset/element-query-methods.md deleted file mode 100644 index 8826c5da..00000000 --- a/.changeset/element-query-methods.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@remote-dom/polyfill': minor ---- - -Add `getElementById()` to `Document` and `DocumentFragment`, with reflected `Element.id` properties. Add `getElementsByTagName()` to `Document` and `Element`, supporting HTML, non-HTML, and wildcard descendant searches. `querySelector` and `querySelectorAll` accept a pre-parsed `Matcher[]` in addition to string selectors, with `MatcherType`, `Combinator`, `Matcher`, and `Part` exported from `selectors.ts`; `getElementById` and `getElementsByTagName` delegate to this shared selector engine instead of independent tree-walk implementations. - -Fixed `insertBefore()` leaving the previous sibling pointing at the reference node when inserting before a middle child, causing `NEXT` traversals (including `getElementById`) to skip the inserted subtree even though `childNodes` contained it, and return the inserted child as required by the DOM specification. Fixed `appendChild()` to return the appended child and `NodeList.item()` to return `null` for out-of-range indexes. Fixed case-insensitive HTML tag-name matching in the selector engine so `querySelector('DIV')` now matches `
` per the CSS spec. Fixed CSS-escaping issues so `getElementById` matches ids containing special characters (`.`, `:`, `#`, etc.) literally instead of treating them as selector syntax. diff --git a/.changeset/empty-parent-text-content.md b/.changeset/empty-parent-text-content.md deleted file mode 100644 index 8c52eff6..00000000 --- a/.changeset/empty-parent-text-content.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Clear parent children without creating an empty text node when assigning an empty `textContent` value, and finish the complete replacement before running custom-element reactions. diff --git a/.changeset/fair-listeners-register.md b/.changeset/fair-listeners-register.md deleted file mode 100644 index 5e83889f..00000000 --- a/.changeset/fair-listeners-register.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Correct event listener identity and AbortSignal handling in the EventTarget polyfill. diff --git a/.changeset/fix-dom-receiver-cache.md b/.changeset/fix-dom-receiver-cache.md deleted file mode 100644 index 60000843..00000000 --- a/.changeset/fix-dom-receiver-cache.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/core': patch ---- - -Fix `DOMRemoteReceiver` cleanup for removed elements and per-element cache expiry. diff --git a/.changeset/fix-event-cancellation.md b/.changeset/fix-event-cancellation.md deleted file mode 100644 index 1a041ac8..00000000 --- a/.changeset/fix-event-cancellation.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Fix event cancellation semantics for `preventDefault()`, `returnValue`, and `dispatchEvent()`. diff --git a/.changeset/fresh-globals-install.md b/.changeset/fresh-globals-install.md deleted file mode 100644 index f3ef96bd..00000000 --- a/.changeset/fresh-globals-install.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Install missing event methods and error handlers consistently without replacing native global event delivery. diff --git a/.changeset/fresh-pandas-parse.md b/.changeset/fresh-pandas-parse.md deleted file mode 100644 index 3b236fb6..00000000 --- a/.changeset/fresh-pandas-parse.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Preserve character references and literal ampersands when parsing `innerHTML`, decode attribute references without double-escaping, handle nested `innerHTML` parsing from synchronous callbacks, and handle HTML void elements without nesting following content or serializing closing tags. diff --git a/.changeset/fresh-slots-remove.md b/.changeset/fresh-slots-remove.md deleted file mode 100644 index d4630b01..00000000 --- a/.changeset/fresh-slots-remove.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Remove `slot` attributes without recreating them as empty attributes, keeping local and host state synchronized. diff --git a/.changeset/fuzzy-classes-find.md b/.changeset/fuzzy-classes-find.md deleted file mode 100644 index ec18f83d..00000000 --- a/.changeset/fuzzy-classes-find.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': minor ---- - -Add `getElementsByClassName()` to polyfilled documents and elements. diff --git a/.changeset/grumpy-cycles-suffer.md b/.changeset/grumpy-cycles-suffer.md deleted file mode 100644 index 55d7cc7b..00000000 --- a/.changeset/grumpy-cycles-suffer.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Default omitted CustomEvent detail values to null. diff --git a/.changeset/include-comment-hook-nodes.md b/.changeset/include-comment-hook-nodes.md deleted file mode 100644 index 61992a7c..00000000 --- a/.changeset/include-comment-hook-nodes.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Include `Comment` nodes in the polyfill hook type contract. diff --git a/.changeset/neat-dom-names-normalize.md b/.changeset/neat-dom-names-normalize.md deleted file mode 100644 index 9672183f..00000000 --- a/.changeset/neat-dom-names-normalize.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Normalize and validate DOM element and attribute names across HTML and namespaced APIs, including `toggleAttribute()` and custom-element attribute reactions. diff --git a/.changeset/normalize-text-node-hooks.md b/.changeset/normalize-text-node-hooks.md deleted file mode 100644 index 60700988..00000000 --- a/.changeset/normalize-text-node-hooks.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Normalize `createTextNode()` hook data to match the created text node. diff --git a/.changeset/polished-template-content.md b/.changeset/polished-template-content.md deleted file mode 100644 index 8cdfb0ce..00000000 --- a/.changeset/polished-template-content.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Parse template descendants into template content and serialize that content with stack-safe HTML output. diff --git a/.changeset/polyfill-replace-with.md b/.changeset/polyfill-replace-with.md deleted file mode 100644 index 30c7f6db..00000000 --- a/.changeset/polyfill-replace-with.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Fix `ChildNode.replaceWith()` throwing instead of replacing the node - -`replaceWith()` passed its arguments to `replaceChild()` in the wrong order — `replaceChild(newChild, oldChild)` was called as `parent.replaceChild(this, node)`, naming the incoming node as the child to replace. Since that node is usually fresh and has no parent, the reference check rejected it and every call threw `reference node is not a child of this parent`. It also read the following sibling off the incoming node rather than off `this`, so the remaining arguments had no correct insertion point to anchor to. - -The method now removes `this` and inserts the given nodes at its position, in argument order, anchored on the first following sibling that is not itself being moved. Strings become text nodes, calling it with no arguments removes the node (matching `remove()`), and a node with no parent is still left alone. diff --git a/.changeset/quiet-observers-watch.md b/.changeset/quiet-observers-watch.md deleted file mode 100644 index d79664d5..00000000 --- a/.changeset/quiet-observers-watch.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': minor ---- - -Implement the standard `MutationObserver` methods for child, attribute, and character-data changes in the polyfilled DOM. diff --git a/.changeset/quiet-wpt-capability-ci.md b/.changeset/quiet-wpt-capability-ci.md deleted file mode 100644 index 1b37e125..00000000 --- a/.changeset/quiet-wpt-capability-ci.md +++ /dev/null @@ -1,4 +0,0 @@ ---- ---- - -Add private WPT capability enforcement and CI without releasing a public package. diff --git a/.changeset/quiet-wpt-inputs.md b/.changeset/quiet-wpt-inputs.md deleted file mode 100644 index c5bb0de6..00000000 --- a/.changeset/quiet-wpt-inputs.md +++ /dev/null @@ -1,4 +0,0 @@ ---- ---- - -Add a private interactive WPT runner without releasing a public package. diff --git a/.changeset/quiet-wpt-preparation.md b/.changeset/quiet-wpt-preparation.md deleted file mode 100644 index a45d1afd..00000000 --- a/.changeset/quiet-wpt-preparation.md +++ /dev/null @@ -1,4 +0,0 @@ ---- ---- - -Add private WPT source preparation without releasing a public package. diff --git a/.changeset/respect-default-namespace.md b/.changeset/respect-default-namespace.md deleted file mode 100644 index d922d3f2..00000000 --- a/.changeset/respect-default-namespace.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Resolve `Node.isDefaultNamespace()` with DOM locate-a-namespace semantics. diff --git a/.changeset/return-parent-mutation-nodes.md b/.changeset/return-parent-mutation-nodes.md deleted file mode 100644 index 6e486905..00000000 --- a/.changeset/return-parent-mutation-nodes.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Return removed and replaced nodes from `removeChild` and `replaceChild`. diff --git a/.changeset/return-query-selector-all-node-list.md b/.changeset/return-query-selector-all-node-list.md deleted file mode 100644 index 506b7f54..00000000 --- a/.changeset/return-query-selector-all-node-list.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Return a NodeList-compatible collection from `querySelectorAll()`. diff --git a/.changeset/safe-custom-element-reactions.md b/.changeset/safe-custom-element-reactions.md deleted file mode 100644 index 0a591ce4..00000000 --- a/.changeset/safe-custom-element-reactions.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Queue custom-element reactions so compound tree and attribute mutations commit their local state and Remote DOM hooks before callbacks run. Drain nested reactions in FIFO order, and finish the queue before rethrowing the first callback error. diff --git a/.changeset/sharp-pillows-talk.md b/.changeset/sharp-pillows-talk.md deleted file mode 100644 index 9a31752e..00000000 --- a/.changeset/sharp-pillows-talk.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': minor ---- - -Add composable `Window` extensions for installing DOM APIs and subscribing to DOM operations. diff --git a/.changeset/stack-safe-wide-traversal.md b/.changeset/stack-safe-wide-traversal.md deleted file mode 100644 index 831d9ab8..00000000 --- a/.changeset/stack-safe-wide-traversal.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Traverse wide and deep trees without overflowing the call stack during text collection, selector queries, and subtree connectivity updates. Prepare insertion snapshots transactionally before committing links, connectivity, hooks, and reactions so traversal failures preserve local and remote tree state. Capture lifecycle reactions in mutation order before emitting reentrant tree-mutation hook effects through a FIFO queue. diff --git a/.changeset/strict-dom-receiver-policy.md b/.changeset/strict-dom-receiver-policy.md deleted file mode 100644 index f4709374..00000000 --- a/.changeset/strict-dom-receiver-policy.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -'@remote-dom/core': minor ---- - -Add optional per-element member configuration and `blockedProperties` to `DOMRemoteReceiver`. - -This release also fixes security vulnerabilities. - -Use `elements` with an array of element names, or a map specifying each element's `properties`, `attributes`, `events`, and `methods`. Property keys map to objects with optional `type` and `attribute` fields. The `type` field validates non-nullish property-channel values (no coercion); `attribute` authorizes corresponding attributes (defaults `true` for kebab-case, string for named alias, `false` for none). Attribute values must be strings (or nullish for removal); they are not parsed according to property types. Events use raw DOM names (e.g., `click`, not `onClick`). - -### Default behavior - -- A supplied `elements` array or map restricts element names, including nested children. Omitting `elements` leaves names unrestricted; an empty array or map accepts only text and comments. -- Property and attribute names `innerHTML`, `outerHTML`, `srcdoc`, `__proto__`, `constructor`, `prototype`, `is`, and names beginning with `on` are excluded case-insensitively. Use the event-listener channel for event callbacks. -- Assignments to base DOM methods are excluded. Native `` and `` elements also exclude writes to the `protocol` property; update their complete `href` instead. -- URL checks apply to `href`, `xlink:href`, `src`, `action`, `formAction`, `codebase`, `background`, `poster`, and native `.data`. They reject `javascript:`, `vbscript:`, and `data:` URLs other than AVIF, BMP, GIF, JPEG, PNG, and WebP image media types. Native URL properties require strings or nullish values rather than object coercion. -- Default method dispatch supports custom-element methods and native `focus`/`blur`, but excludes other native or inherited DOM methods. Root calls require a host `call` callback. A `methods` list can narrow default dispatch, not override its exclusions. -- Text updates apply only to text and comment nodes. - -Explicit member definitions do not override these default checks. `blockedProperties` adds exclusions rather than replacing the defaults. - -Existing element-name arrays retain ordinary member handling; omitted member definitions use the defaults. Empty `properties` or `events` maps and empty `methods` lists deny those channels. The `attributes` list adds attribute-only names to those authorized by property definitions; without property definitions, an empty `attributes` list denies attributes. - -`RemoteReceiverElement` supports the same configuration through static properties on a host-side subclass. The existing `call` callback remains available for custom method dispatch. Data-only receivers are unchanged. diff --git a/.changeset/strict-elements-define.md b/.changeset/strict-elements-define.md deleted file mode 100644 index b0a6f9b9..00000000 --- a/.changeset/strict-elements-define.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Make `CustomElementRegistry.define()` reject invalid custom element names and duplicate name or constructor registrations, matching browser behavior. diff --git a/.changeset/tame-selectors-list.md b/.changeset/tame-selectors-list.md deleted file mode 100644 index 594ec0c0..00000000 --- a/.changeset/tame-selectors-list.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Correct class selector whitespace parsing and return polyfilled `NodeList` collections from selector queries. diff --git a/.changeset/tidy-clones-preserve.md b/.changeset/tidy-clones-preserve.md deleted file mode 100644 index f0c00387..00000000 --- a/.changeset/tidy-clones-preserve.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Preserve established element and attribute names, namespaces, and both direct and template-content trees when cloning or importing nodes without recursive traversal. diff --git a/.changeset/tidy-node-contains.md b/.changeset/tidy-node-contains.md deleted file mode 100644 index f5f0d512..00000000 --- a/.changeset/tidy-node-contains.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Fix `Node.contains()` for nested descendants and nodes outside the current subtree. diff --git a/.changeset/validate-tree-mutations.md b/.changeset/validate-tree-mutations.md deleted file mode 100644 index 408cb81e..00000000 --- a/.changeset/validate-tree-mutations.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Validate tree insertions and replacements before changing node links so invalid ancestor, template-content cycle, and reference-node mutations preserve the existing trees. Treat inserting a node before itself as a no-op and safely replace a child with its next sibling. diff --git a/.changeset/wise-parsers-nest.md b/.changeset/wise-parsers-nest.md deleted file mode 100644 index 9092d6a8..00000000 --- a/.changeset/wise-parsers-nest.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@remote-dom/polyfill': patch ---- - -Ignore unmatched closing tags, preserve SVG and HTML namespace boundaries, and retain literal parser names while parsing `innerHTML`. diff --git a/examples/custom-element/CHANGELOG.md b/examples/custom-element/CHANGELOG.md index 442372ac..b6941ca3 100644 --- a/examples/custom-element/CHANGELOG.md +++ b/examples/custom-element/CHANGELOG.md @@ -1,5 +1,12 @@ # example-custom-element +## 0.0.27 + +### Patch Changes + +- Updated dependencies [[`8d02d40`](https://github.com/Shopify/remote-dom/commit/8d02d40ac64e73c8c08be4dfb8e00812f3829b83), [`b8bed3d`](https://github.com/Shopify/remote-dom/commit/b8bed3df4242b26facdfb3c6c543ca493bde1ab3)]: + - @remote-dom/core@1.12.0 + ## 0.0.26 ### Patch Changes diff --git a/examples/custom-element/package.json b/examples/custom-element/package.json index e54c6196..21396cd3 100644 --- a/examples/custom-element/package.json +++ b/examples/custom-element/package.json @@ -1,6 +1,6 @@ { "name": "example-custom-element", - "version": "0.0.26", + "version": "0.0.27", "type": "module", "private": true, "scripts": { diff --git a/examples/getting-started/CHANGELOG.md b/examples/getting-started/CHANGELOG.md index 9c992025..910f3337 100644 --- a/examples/getting-started/CHANGELOG.md +++ b/examples/getting-started/CHANGELOG.md @@ -1,5 +1,12 @@ # example-getting-started +## 0.0.27 + +### Patch Changes + +- Updated dependencies [[`8d02d40`](https://github.com/Shopify/remote-dom/commit/8d02d40ac64e73c8c08be4dfb8e00812f3829b83), [`b8bed3d`](https://github.com/Shopify/remote-dom/commit/b8bed3df4242b26facdfb3c6c543ca493bde1ab3)]: + - @remote-dom/core@1.12.0 + ## 0.0.26 ### Patch Changes diff --git a/examples/getting-started/package.json b/examples/getting-started/package.json index e9c68f94..55342b95 100644 --- a/examples/getting-started/package.json +++ b/examples/getting-started/package.json @@ -1,6 +1,6 @@ { "name": "example-getting-started", - "version": "0.0.26", + "version": "0.0.27", "type": "module", "private": true, "scripts": { diff --git a/examples/kitchen-sink/CHANGELOG.md b/examples/kitchen-sink/CHANGELOG.md index 090cc808..e84ddea0 100644 --- a/examples/kitchen-sink/CHANGELOG.md +++ b/examples/kitchen-sink/CHANGELOG.md @@ -1,5 +1,12 @@ # example-kitchen-sink +## 0.0.34 + +### Patch Changes + +- Updated dependencies [[`8d02d40`](https://github.com/Shopify/remote-dom/commit/8d02d40ac64e73c8c08be4dfb8e00812f3829b83), [`b8bed3d`](https://github.com/Shopify/remote-dom/commit/b8bed3df4242b26facdfb3c6c543ca493bde1ab3)]: + - @remote-dom/core@1.12.0 + ## 0.0.33 ### Patch Changes diff --git a/examples/kitchen-sink/package.json b/examples/kitchen-sink/package.json index adf0dbf2..94598dc9 100644 --- a/examples/kitchen-sink/package.json +++ b/examples/kitchen-sink/package.json @@ -2,7 +2,7 @@ "name": "example-kitchen-sink", "type": "module", "private": true, - "version": "0.0.33", + "version": "0.0.34", "scripts": { "start": "vite" }, diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index a50f30f2..425a0a24 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,37 @@ # @remote-dom/core +## 1.12.0 + +### Minor Changes + +- [#713](https://github.com/Shopify/remote-dom/pull/713) [`b8bed3d`](https://github.com/Shopify/remote-dom/commit/b8bed3df4242b26facdfb3c6c543ca493bde1ab3) Thanks [@MitchLillie](https://github.com/MitchLillie)! - Add optional per-element member configuration and `blockedProperties` to `DOMRemoteReceiver`. + + This release also fixes security vulnerabilities. + + Use `elements` with an array of element names, or a map specifying each element's `properties`, `attributes`, `events`, and `methods`. Property keys map to objects with optional `type` and `attribute` fields. The `type` field validates non-nullish property-channel values (no coercion); `attribute` authorizes corresponding attributes (defaults `true` for kebab-case, string for named alias, `false` for none). Attribute values must be strings (or nullish for removal); they are not parsed according to property types. Events use raw DOM names (e.g., `click`, not `onClick`). + + ### Default behavior + + - A supplied `elements` array or map restricts element names, including nested children. Omitting `elements` leaves names unrestricted; an empty array or map accepts only text and comments. + - Property and attribute names `innerHTML`, `outerHTML`, `srcdoc`, `__proto__`, `constructor`, `prototype`, `is`, and names beginning with `on` are excluded case-insensitively. Use the event-listener channel for event callbacks. + - Assignments to base DOM methods are excluded. Native `` and `` elements also exclude writes to the `protocol` property; update their complete `href` instead. + - URL checks apply to `href`, `xlink:href`, `src`, `action`, `formAction`, `codebase`, `background`, `poster`, and native `.data`. They reject `javascript:`, `vbscript:`, and `data:` URLs other than AVIF, BMP, GIF, JPEG, PNG, and WebP image media types. Native URL properties require strings or nullish values rather than object coercion. + - Default method dispatch supports custom-element methods and native `focus`/`blur`, but excludes other native or inherited DOM methods. Root calls require a host `call` callback. A `methods` list can narrow default dispatch, not override its exclusions. + - Text updates apply only to text and comment nodes. + + Explicit member definitions do not override these default checks. `blockedProperties` adds exclusions rather than replacing the defaults. + + Existing element-name arrays retain ordinary member handling; omitted member definitions use the defaults. Empty `properties` or `events` maps and empty `methods` lists deny those channels. The `attributes` list adds attribute-only names to those authorized by property definitions; without property definitions, an empty `attributes` list denies attributes. + + `RemoteReceiverElement` supports the same configuration through static properties on a host-side subclass. The existing `call` callback remains available for custom method dispatch. Data-only receivers are unchanged. + +### Patch Changes + +- [#725](https://github.com/Shopify/remote-dom/pull/725) [`8d02d40`](https://github.com/Shopify/remote-dom/commit/8d02d40ac64e73c8c08be4dfb8e00812f3829b83) Thanks [@vividviolet](https://github.com/vividviolet)! - Fix `DOMRemoteReceiver` cleanup for removed elements and per-element cache expiry. + +- Updated dependencies [[`fc245ba`](https://github.com/Shopify/remote-dom/commit/fc245ba6edd7622c4cccbd98e744d6934f04ab46), [`dff700b`](https://github.com/Shopify/remote-dom/commit/dff700bcc9610903ad4f9e6d8b23e6017f113af8), [`da43e02`](https://github.com/Shopify/remote-dom/commit/da43e02ef1662763d242ed3b386b5b57130aaef3), [`85cefcd`](https://github.com/Shopify/remote-dom/commit/85cefcd63efe62de20aadb2fa75d08485b4f1d96), [`a9aee3e`](https://github.com/Shopify/remote-dom/commit/a9aee3e3834b621e0c9a4fd432a9eb674447403a), [`f4af17f`](https://github.com/Shopify/remote-dom/commit/f4af17fb2739cd6cbbf3adf52c1af1fb695c749b), [`c13d18b`](https://github.com/Shopify/remote-dom/commit/c13d18b5469de4e87900d7c8123ad18b653f6d4e), [`9904cdd`](https://github.com/Shopify/remote-dom/commit/9904cdd79af5589c3b43e884e27fa2ce10721b58), [`8de0600`](https://github.com/Shopify/remote-dom/commit/8de06005c7e4d843182fbd403699dc2df67bee33), [`ee48d52`](https://github.com/Shopify/remote-dom/commit/ee48d5290023a22de7632d7e652438514a1c1cfb), [`7eb8a18`](https://github.com/Shopify/remote-dom/commit/7eb8a18aa6753ac34e58d51cfda0533a99e88523), [`4be18ef`](https://github.com/Shopify/remote-dom/commit/4be18ef20017587835e7275e3901cd5fcdcdc50e), [`6ddc71f`](https://github.com/Shopify/remote-dom/commit/6ddc71f50e2c492d71c8b506eebc08cf40559199), [`e249e3e`](https://github.com/Shopify/remote-dom/commit/e249e3e8055b7878442ad72fdd2b151cdc3c0171), [`44e3b36`](https://github.com/Shopify/remote-dom/commit/44e3b3677920a43a98a92b8179470d7ede0dac96), [`072b7e8`](https://github.com/Shopify/remote-dom/commit/072b7e8a68855144cc359d11107874007c043f2b), [`fd4de61`](https://github.com/Shopify/remote-dom/commit/fd4de61b0be8eac8e056941f288f0592404b57dc), [`fd8e186`](https://github.com/Shopify/remote-dom/commit/fd8e186d49bc1b3fa68ec0a26eb1de1a59c218c5), [`ab6c549`](https://github.com/Shopify/remote-dom/commit/ab6c5494908a5efb53fc8e5534b2b2967b9cbe41), [`5f0b228`](https://github.com/Shopify/remote-dom/commit/5f0b2281bddfc7ac37c64503f40f38f4f9b98243), [`08e3223`](https://github.com/Shopify/remote-dom/commit/08e3223a5fb340e80693168e04ed03a01764ef2a), [`a629e25`](https://github.com/Shopify/remote-dom/commit/a629e25eb4eba6aae495257a40f30883b6dce53a), [`e1acf97`](https://github.com/Shopify/remote-dom/commit/e1acf97baa3786d3284b6a0164ccc7206e3ec956), [`0a39389`](https://github.com/Shopify/remote-dom/commit/0a3938987f46fd962ac84ed00808680852263df9), [`c3918c6`](https://github.com/Shopify/remote-dom/commit/c3918c61c3ee6b3aa6ec7fbf4d53aa76532ec29d), [`e2a9eef`](https://github.com/Shopify/remote-dom/commit/e2a9eef700edd7f46a0cafb3e3a63d757ccfbc2e), [`516fcfa`](https://github.com/Shopify/remote-dom/commit/516fcfa4c4a04e8ff5a0e7c6b7da0d38d2dd1f57), [`23ceb4d`](https://github.com/Shopify/remote-dom/commit/23ceb4d22c62096ffdb00d4d107ab2cacdc54935), [`5466415`](https://github.com/Shopify/remote-dom/commit/54664151820316d9f655e9964de232854fdec5c4), [`d916fab`](https://github.com/Shopify/remote-dom/commit/d916fabc327a9352c1f3e8b2d37f939527d2027a), [`0789d12`](https://github.com/Shopify/remote-dom/commit/0789d12f61ae3a93bd659543b4607eb496efa090), [`4b8bae9`](https://github.com/Shopify/remote-dom/commit/4b8bae9a507cf80492fb3b03975b90872b76465c), [`6b42b09`](https://github.com/Shopify/remote-dom/commit/6b42b0980b3d2b01a1029ae1cab52345e0fb021a), [`685dff1`](https://github.com/Shopify/remote-dom/commit/685dff1a617c97afc5079edb742940bb6ff92022), [`7181475`](https://github.com/Shopify/remote-dom/commit/71814754bcd9a06155e9a284867c93031c133007), [`3c57e5b`](https://github.com/Shopify/remote-dom/commit/3c57e5b6202f0779eb7ee99ad3298f6d17032c51), [`cdfd5dd`](https://github.com/Shopify/remote-dom/commit/cdfd5dd2bc3fecbea7799d3921bb8d93bd6103dd), [`db32f49`](https://github.com/Shopify/remote-dom/commit/db32f49fbbe0bdfd1e14450008b5b8634d2362d7)]: + - @remote-dom/polyfill@1.6.0 + ## 1.11.1 ### Patch Changes diff --git a/packages/core/package.json b/packages/core/package.json index 31add29e..9c99317d 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -7,7 +7,7 @@ "access": "public", "@remote-dom/registry": "https://registry.npmjs.org" }, - "version": "1.11.1", + "version": "1.12.0", "engines": { "node": ">=14.0.0" }, @@ -90,7 +90,7 @@ "build": "rollup --config ./rollup.config.js" }, "dependencies": { - "@remote-dom/polyfill": "workspace:^1.5.1", + "@remote-dom/polyfill": "workspace:^1.6.0", "htm": "catalog:" }, "peerDependencies": { diff --git a/packages/polyfill/CHANGELOG.md b/packages/polyfill/CHANGELOG.md index 7055cde0..982ac2f1 100644 --- a/packages/polyfill/CHANGELOG.md +++ b/packages/polyfill/CHANGELOG.md @@ -1,5 +1,93 @@ # @remote-dom/polyfill +## 1.6.0 + +### Minor Changes + +- [#620](https://github.com/Shopify/remote-dom/pull/620) [`4be18ef`](https://github.com/Shopify/remote-dom/commit/4be18ef20017587835e7275e3901cd5fcdcdc50e) Thanks [@andrewiggins](https://github.com/andrewiggins)! - Add `getElementById()` to `Document` and `DocumentFragment`, with reflected `Element.id` properties. Add `getElementsByTagName()` to `Document` and `Element`, supporting HTML, non-HTML, and wildcard descendant searches. `querySelector` and `querySelectorAll` accept a pre-parsed `Matcher[]` in addition to string selectors, with `MatcherType`, `Combinator`, `Matcher`, and `Part` exported from `selectors.ts`; `getElementById` and `getElementsByTagName` delegate to this shared selector engine instead of independent tree-walk implementations. + + Fixed `insertBefore()` leaving the previous sibling pointing at the reference node when inserting before a middle child, causing `NEXT` traversals (including `getElementById`) to skip the inserted subtree even though `childNodes` contained it, and return the inserted child as required by the DOM specification. Fixed `appendChild()` to return the appended child and `NodeList.item()` to return `null` for out-of-range indexes. Fixed case-insensitive HTML tag-name matching in the selector engine so `querySelector('DIV')` now matches `
` per the CSS spec. Fixed CSS-escaping issues so `getElementById` matches ids containing special characters (`.`, `:`, `#`, etc.) literally instead of treating them as selector syntax. + +- [#625](https://github.com/Shopify/remote-dom/pull/625) [`ab6c549`](https://github.com/Shopify/remote-dom/commit/ab6c5494908a5efb53fc8e5534b2b2967b9cbe41) Thanks [@airhorns](https://github.com/airhorns)! - Add `getElementsByClassName()` to polyfilled documents and elements. + +- [#624](https://github.com/Shopify/remote-dom/pull/624) [`e2a9eef`](https://github.com/Shopify/remote-dom/commit/e2a9eef700edd7f46a0cafb3e3a63d757ccfbc2e) Thanks [@airhorns](https://github.com/airhorns)! - Implement the standard `MutationObserver` methods for child, attribute, and character-data changes in the polyfilled DOM. + +- [#652](https://github.com/Shopify/remote-dom/pull/652) [`0789d12`](https://github.com/Shopify/remote-dom/commit/0789d12f61ae3a93bd659543b4607eb496efa090) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Add composable `Window` extensions for installing DOM APIs and subscribing to DOM operations. + +### Patch Changes + +- [#681](https://github.com/Shopify/remote-dom/pull/681) [`fc245ba`](https://github.com/Shopify/remote-dom/commit/fc245ba6edd7622c4cccbd98e744d6934f04ab46) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Adopt complete subtrees, including initialized template content, during cross-document insertion so descendant and attribute mutations use the destination document. + +- [#669](https://github.com/Shopify/remote-dom/pull/669) [`dff700b`](https://github.com/Shopify/remote-dom/commit/dff700bcc9610903ad4f9e6d8b23e6017f113af8) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Dispatch attribute hooks when mutating an attached attribute's value or nodeValue. + +- [#679](https://github.com/Shopify/remote-dom/pull/679) [`da43e02`](https://github.com/Shopify/remote-dom/commit/da43e02ef1662763d242ed3b386b5b57130aaef3) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Correct chained combinators, whitespace, exact attribute equality, and scoped relative `:has()` selectors, including leading combinators, nested functional pseudo-classes, and ASCII-case-insensitive pseudo-class names. + +- [#642](https://github.com/Shopify/remote-dom/pull/642) [`85cefcd`](https://github.com/Shopify/remote-dom/commit/85cefcd63efe62de20aadb2fa75d08485b4f1d96) Thanks [@andrewiggins](https://github.com/andrewiggins)! - Add the missing `CustomElementRegistry.initialize()` compatibility method so TypeScript 7 type checks cleanly. + +- [#653](https://github.com/Shopify/remote-dom/pull/653) [`a9aee3e`](https://github.com/Shopify/remote-dom/commit/a9aee3e3834b621e0c9a4fd432a9eb674447403a) Thanks [@andrewiggins](https://github.com/andrewiggins)! - Make the Polyfill source compatible with type stripping by replacing TypeScript enums and a parameter property with erasable syntax. + +- [#668](https://github.com/Shopify/remote-dom/pull/668) [`f4af17f`](https://github.com/Shopify/remote-dom/commit/f4af17fb2739cd6cbbf3adf52c1af1fb695c749b) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Preserve attribute ownership and linked-list integrity when attributes are reinstalled, replaced, removed, or reused. + +- [#683](https://github.com/Shopify/remote-dom/pull/683) [`c13d18b`](https://github.com/Shopify/remote-dom/commit/c13d18b5469de4e87900d7c8123ad18b653f6d4e) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Throw a named `NotSupportedError` when cloning a document or importing one with `Document.importNode()`. + +- [#681](https://github.com/Shopify/remote-dom/pull/681) [`9904cdd`](https://github.com/Shopify/remote-dom/commit/9904cdd79af5589c3b43e884e27fa2ce10721b58) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Make `ChildNode.replaceWith()`, `before()`, and `after()` validate all arguments before changing existing trees, preserve sibling argument order, and commit each operation before custom-element reactions run. + +- [#664](https://github.com/Shopify/remote-dom/pull/664) [`8de0600`](https://github.com/Shopify/remote-dom/commit/8de06005c7e4d843182fbd403699dc2df67bee33) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Correct event dispatch lifecycle state, isolate composed paths, and defer listener registrations added during dispatch. + +- [#692](https://github.com/Shopify/remote-dom/pull/692) [`ee48d52`](https://github.com/Shopify/remote-dom/commit/ee48d5290023a22de7632d7e652438514a1c1cfb) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Throw named DOM errors for invalid tree mutations and selector syntax. + +- [#669](https://github.com/Shopify/remote-dom/pull/669) [`7eb8a18`](https://github.com/Shopify/remote-dom/commit/7eb8a18aa6753ac34e58d51cfda0533a99e88523) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Return `null` from `Document.textContent` and ignore assignments to preserve the initialized document structure. + +- [#669](https://github.com/Shopify/remote-dom/pull/669) [`6ddc71f`](https://github.com/Shopify/remote-dom/commit/6ddc71f50e2c492d71c8b506eebc08cf40559199) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Clear parent children without creating an empty text node when assigning an empty `textContent` value, and finish the complete replacement before running custom-element reactions. + +- [#662](https://github.com/Shopify/remote-dom/pull/662) [`e249e3e`](https://github.com/Shopify/remote-dom/commit/e249e3e8055b7878442ad72fdd2b151cdc3c0171) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Correct event listener identity and AbortSignal handling in the EventTarget polyfill. + +- [#663](https://github.com/Shopify/remote-dom/pull/663) [`44e3b36`](https://github.com/Shopify/remote-dom/commit/44e3b3677920a43a98a92b8179470d7ede0dac96) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Fix event cancellation semantics for `preventDefault()`, `returnValue`, and `dispatchEvent()`. + +- [#666](https://github.com/Shopify/remote-dom/pull/666) [`072b7e8`](https://github.com/Shopify/remote-dom/commit/072b7e8a68855144cc359d11107874007c043f2b) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Install missing event methods and error handlers consistently without replacing native global event delivery. + +- [#685](https://github.com/Shopify/remote-dom/pull/685) [`fd4de61`](https://github.com/Shopify/remote-dom/commit/fd4de61b0be8eac8e056941f288f0592404b57dc) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Preserve character references and literal ampersands when parsing `innerHTML`, decode attribute references without double-escaping, handle nested `innerHTML` parsing from synchronous callbacks, and handle HTML void elements without nesting following content or serializing closing tags. + +- [#669](https://github.com/Shopify/remote-dom/pull/669) [`fd8e186`](https://github.com/Shopify/remote-dom/commit/fd8e186d49bc1b3fa68ec0a26eb1de1a59c218c5) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Remove `slot` attributes without recreating them as empty attributes, keeping local and host state synchronized. + +- [#688](https://github.com/Shopify/remote-dom/pull/688) [`5f0b228`](https://github.com/Shopify/remote-dom/commit/5f0b2281bddfc7ac37c64503f40f38f4f9b98243) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Default omitted CustomEvent detail values to null. + +- [#688](https://github.com/Shopify/remote-dom/pull/688) [`08e3223`](https://github.com/Shopify/remote-dom/commit/08e3223a5fb340e80693168e04ed03a01764ef2a) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Include `Comment` nodes in the polyfill hook type contract. + +- [#677](https://github.com/Shopify/remote-dom/pull/677) [`a629e25`](https://github.com/Shopify/remote-dom/commit/a629e25eb4eba6aae495257a40f30883b6dce53a) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Normalize and validate DOM element and attribute names across HTML and namespaced APIs, including `toggleAttribute()` and custom-element attribute reactions. + +- [#688](https://github.com/Shopify/remote-dom/pull/688) [`e1acf97`](https://github.com/Shopify/remote-dom/commit/e1acf97baa3786d3284b6a0164ccc7206e3ec956) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Normalize `createTextNode()` hook data to match the created text node. + +- [#685](https://github.com/Shopify/remote-dom/pull/685) [`0a39389`](https://github.com/Shopify/remote-dom/commit/0a3938987f46fd962ac84ed00808680852263df9) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Parse template descendants into template content and serialize that content with stack-safe HTML output. + +- [#623](https://github.com/Shopify/remote-dom/pull/623) [`c3918c6`](https://github.com/Shopify/remote-dom/commit/c3918c61c3ee6b3aa6ec7fbf4d53aa76532ec29d) Thanks [@airhorns](https://github.com/airhorns)! - Fix `ChildNode.replaceWith()` throwing instead of replacing the node + + `replaceWith()` passed its arguments to `replaceChild()` in the wrong order — `replaceChild(newChild, oldChild)` was called as `parent.replaceChild(this, node)`, naming the incoming node as the child to replace. Since that node is usually fresh and has no parent, the reference check rejected it and every call threw `reference node is not a child of this parent`. It also read the following sibling off the incoming node rather than off `this`, so the remaining arguments had no correct insertion point to anchor to. + + The method now removes `this` and inserts the given nodes at its position, in argument order, anchored on the first following sibling that is not itself being moved. Strings become text nodes, calling it with no arguments removes the node (matching `remove()`), and a node with no parent is still left alone. + +- [#714](https://github.com/Shopify/remote-dom/pull/714) [`516fcfa`](https://github.com/Shopify/remote-dom/commit/516fcfa4c4a04e8ff5a0e7c6b7da0d38d2dd1f57) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Resolve `Node.isDefaultNamespace()` with DOM locate-a-namespace semantics. + +- [#669](https://github.com/Shopify/remote-dom/pull/669) [`23ceb4d`](https://github.com/Shopify/remote-dom/commit/23ceb4d22c62096ffdb00d4d107ab2cacdc54935) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Return removed and replaced nodes from `removeChild` and `replaceChild`. + +- [#679](https://github.com/Shopify/remote-dom/pull/679) [`5466415`](https://github.com/Shopify/remote-dom/commit/54664151820316d9f655e9964de232854fdec5c4) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Return a NodeList-compatible collection from `querySelectorAll()`. + +- [#669](https://github.com/Shopify/remote-dom/pull/669) [`d916fab`](https://github.com/Shopify/remote-dom/commit/d916fabc327a9352c1f3e8b2d37f939527d2027a) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Queue custom-element reactions so compound tree and attribute mutations commit their local state and Remote DOM hooks before callbacks run. Drain nested reactions in FIFO order, and finish the queue before rethrowing the first callback error. + +- [#669](https://github.com/Shopify/remote-dom/pull/669) [`4b8bae9`](https://github.com/Shopify/remote-dom/commit/4b8bae9a507cf80492fb3b03975b90872b76465c) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Traverse wide and deep trees without overflowing the call stack during text collection, selector queries, and subtree connectivity updates. Prepare insertion snapshots transactionally before committing links, connectivity, hooks, and reactions so traversal failures preserve local and remote tree state. Capture lifecycle reactions in mutation order before emitting reentrant tree-mutation hook effects through a FIFO queue. + +- [#676](https://github.com/Shopify/remote-dom/pull/676) [`6b42b09`](https://github.com/Shopify/remote-dom/commit/6b42b0980b3d2b01a1029ae1cab52345e0fb021a) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Make `CustomElementRegistry.define()` reject invalid custom element names and duplicate name or constructor registrations, matching browser behavior. + +- [#660](https://github.com/Shopify/remote-dom/pull/660) [`685dff1`](https://github.com/Shopify/remote-dom/commit/685dff1a617c97afc5079edb742940bb6ff92022) Thanks [@andrewiggins](https://github.com/andrewiggins)! - Correct class selector whitespace parsing and return polyfilled `NodeList` collections from selector queries. + +- [#683](https://github.com/Shopify/remote-dom/pull/683) [`7181475`](https://github.com/Shopify/remote-dom/commit/71814754bcd9a06155e9a284867c93031c133007) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Preserve established element and attribute names, namespaces, and both direct and template-content trees when cloning or importing nodes without recursive traversal. + +- [#688](https://github.com/Shopify/remote-dom/pull/688) [`3c57e5b`](https://github.com/Shopify/remote-dom/commit/3c57e5b6202f0779eb7ee99ad3298f6d17032c51) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Fix `Node.contains()` for nested descendants and nodes outside the current subtree. + +- [#667](https://github.com/Shopify/remote-dom/pull/667) [`cdfd5dd`](https://github.com/Shopify/remote-dom/commit/cdfd5dd2bc3fecbea7799d3921bb8d93bd6103dd) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Validate tree insertions and replacements before changing node links so invalid ancestor, template-content cycle, and reference-node mutations preserve the existing trees. Treat inserting a node before itself as a no-op and safely replace a child with its next sibling. + +- [#687](https://github.com/Shopify/remote-dom/pull/687) [`db32f49`](https://github.com/Shopify/remote-dom/commit/db32f49fbbe0bdfd1e14450008b5b8634d2362d7) Thanks [@olavoasantos](https://github.com/olavoasantos)! - Ignore unmatched closing tags, preserve SVG and HTML namespace boundaries, and retain literal parser names while parsing `innerHTML`. + ## 1.5.1 ### Patch Changes diff --git a/packages/polyfill/package.json b/packages/polyfill/package.json index ac6dc6d2..3ebaf229 100644 --- a/packages/polyfill/package.json +++ b/packages/polyfill/package.json @@ -7,7 +7,7 @@ "access": "public", "@remote-dom/registry": "https://registry.npmjs.org" }, - "version": "1.5.1", + "version": "1.6.0", "engines": { "node": ">=14.0.0" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b3963f18..8966eddb 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -180,7 +180,7 @@ importers: packages/core: dependencies: '@remote-dom/polyfill': - specifier: workspace:^1.5.1 + specifier: workspace:^1.6.0 version: link:../polyfill htm: specifier: 'catalog:'