Repository navigation
release: beta → main (next stable) - #344
Draft
eFAILution wants to merge 10 commits into
Draft
eFAILution wants to merge 10 commits into
eFAILution wants to merge 10 commits into
Conversation
Move every webview document from template literals into TSX views rendered with preact-render-to-string. Escaping is now on by default, markup errors fail tsc, and lint bans inline styles, handlers and raw HTML outside Page.tsx.
…ith 10 updates (#343) Bumps the dev-dependencies group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.4` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.70.1` | `8.71.0` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.70.1` | `8.71.0` | | [dotenv](https://github.com/motdotla/dotenv) | `18.0.4` | `18.0.5` | | [eslint](https://github.com/eslint/eslint) | `10.11.0` | `10.12.0` | | [globals](https://github.com/sindresorhus/globals) | `17.12.0` | `17.13.0` | | [mocha](https://github.com/mochajs/mocha) | `12.0.2` | `12.0.3` | | [preact-render-to-string](https://github.com/preactjs/preact-render-to-string) | `6.7.0` | `6.8.0` | | [stylelint](https://github.com/stylelint/stylelint) | `17.15.0` | `17.16.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.70.1` | `8.71.0` | Updates `@types/node` from 26.6.2 to 26.6.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@typescript-eslint/eslint-plugin` from 8.70.1 to 8.71.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.0/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.70.1 to 8.71.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.0/packages/parser) Updates `dotenv` from 18.0.4 to 18.0.5 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v18.0.4...v18.0.5) Updates `eslint` from 10.11.0 to 10.12.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.11.0...v10.12.0) Updates `globals` from 17.12.0 to 17.13.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.12.0...v17.13.0) Updates `mocha` from 12.0.2 to 12.0.3 - [Release notes](https://github.com/mochajs/mocha/releases) - [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md) - [Commits](mochajs/mocha@v12.0.2...v12.0.3) Updates `preact-render-to-string` from 6.7.0 to 6.8.0 - [Release notes](https://github.com/preactjs/preact-render-to-string/releases) - [Changelog](https://github.com/preactjs/preact-render-to-string/blob/main/CHANGELOG.md) - [Commits](https://github.com/preactjs/preact-render-to-string/commits) Updates `stylelint` from 17.15.0 to 17.16.0 - [Release notes](https://github.com/stylelint/stylelint/releases) - [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md) - [Commits](stylelint/stylelint@17.15.0...17.16.0) Updates `typescript-eslint` from 8.70.1 to 8.71.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.71.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@typescript-eslint/parser" dependency-version: 8.71.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: dotenv dependency-version: 18.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: eslint dependency-version: 10.12.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: globals dependency-version: 17.13.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: mocha dependency-version: 12.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: preact-render-to-string dependency-version: 6.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: stylelint dependency-version: 17.16.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: typescript-eslint dependency-version: 8.71.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Contributor
🛡️ Security Hardening Pipeline ResultsBranch: Workflow Run: 556 Scan Status
Summaries Collected: 4 Scanner Results🔬 CodeQL SAST (Javascript)Status: Completed Findings Summary
No security findings detected for Javascript. Artifacts: CodeQL Reports (Javascript) 🔗 Dependency ReviewStatus: ✅ No issues found No vulnerable or license-violating dependencies detected in this PR. 🔑 Gitleaks (Secrets)No 🔑 Gitleaks (Secrets) findings summary was produced. 📦 OSV (Dependencies)No 📦 OSV (Dependencies) findings summary was produced. Generated by Argus Generated by Argus |
…ity-hardening.yml (#340) Bumps [huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml](https://github.com/huntridge-labs/argus) from 1.12.6 to 1.12.7. - [Release notes](https://github.com/huntridge-labs/argus/releases) - [Changelog](https://github.com/huntridge-labs/argus/blob/main/CHANGELOG.md) - [Commits](huntridge-labs/argus@3fb133a...309e971) --- updated-dependencies: - dependency-name: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml dependency-version: 1.12.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* feat(component-browser): insert components into the include list * Fix review comments --------- Co-authored-by: Simon Heather <simon.heather@yulife.com>
Co-authored-by: Simon Heather <simon.heather@yulife.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rolling integration PR for the next stable release. It stays open while
betais refined and picks up every new commit merged tobetaautomatically. Do not merge until the release is ready. Merging tomaincuts a stable GitHub Release straight away.What is on
betatodayrefactor(webview): render every webview document from type-checked TSX views, escaped by defaultPlus the
chore(release)bump to 0.19.0.Headline change
#325 moves the Component Browser, details panel, loading, no-sources and error views out of template literals into TSX views rendered with
preact-render-to-string. Markup errors now failtsc, every interpolation is escaped unless it goes through one of the two raw-HTML helpers inPage.tsx, and lint bans inline styles, inline handlers and raw HTML elsewhere. No user-facing change is intended. It was checked by hand in a real VS Code against the packaged build, with no CSP violations (see the comments on #325).Security
npm auditonbetareports 22 findings (21 high, 1 critical). All of them sit in dev tooling:release-it,stylelint,commitizenand their transitive deps (basic-ftp,braces,shell-quote). None are imported fromsrc/, so none ship in the VSIX. Open Dependabot PRs #340, #342 and #343 targetbetaand may clear some of these.Versioning
betasits at 0.19.0. Odd minor is the pre-release channel. On merge,.release-it.json'srequireEvenMinorrolls this forward to 0.20.0 for the stable channel.The VS Code Marketplace publish is still a separate manual
workflow_dispatch. A GitHub Release from this merge does not ship anything to users by itself.Verification on
betaBefore merging
betais feature-complete for this releasebeta(chore(ci): bump huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml from 1.12.6 to 1.12.7 #340, chore(deps-dev): bump @octokit/plugin-paginate-rest from 15.0.0 to 16.0.0 #342, chore(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates #343)betatip