A fast, feature rich and simple framework for building dynamic browser applications.

Last update: Nov 11, 2022

Overview

hyperdom

A simple, fast, feature rich framework for building dynamic browser applications.

Hyperdom supports a simple event-update-render cycle, promises for asynchronous operations, JSX, non-JSX, typescript, client-side routing, SVG, two-way data binding, server-side rendering, and optimises for performance, developer usability and simplicity of application architecture.

Hyperdom is influenced by react and uses virtual-dom for the DOM patching. Unlike react though, there is no need for state management libraries (this problem simply does not exist in hyperdom), the API is compact and the routing is built in.

Documentation - https://hyperdom.org

We're Hiring!

Join our remote team and help us build amazing software. Check out our career opportunities.

Comments

refresh the ui from outside dom event handlers?
Not sure this is a good idea, perhaps I am missing a trick. I was trying to render a loading screen until an async operation completes:

function render(model) { if (model.stuff) return h('div.stuff', model.stuff); else return h('div.loading', 'Loading...'); } var model = { stuff: null }; loadSomeStuff(function(error, stuff) { model.stuff = stuff; // tell plastiq the model has changed... });

I also tried attaching an onload handler in render, which seems more consistent but didn't work and I'm not sure that's a good idea either. Am I missing an alternative?
opened by joshski 13
Routing
Run the example:

watchify examples/routing.js -v -o examples/public/app.js node examples/server.js

Then hit http://localhost:4000/

You'll notice that there is a 300ms delay when loading the /objects and /objects/:id pages. This is to simulate an AJAX load time. However, when navigating forward and back we use history.state so there is no delay. When we refresh the page (F5, ⌘-R), we fetch new state instead of using history.state.
opened by refractalize 9
Allow event handlers to return arrays of components to refresh them

Allow event handlers to return arrays of components to refresh them, not the entire view. There might be much better ways to do it, I'm not well versed in JS by any means.

opened by Anchakor 8
router history parameter?
master mocha tests are failing because there is no window in the new history abstraction.

A router is currently defined like this:

h('div', router( router.page('/', function () {}) ) )

So I was wondering, since both router and router.page need access to the history abstraction, do you see it as a global thing?

This might be better:

var router = plastiq.router({ history: myHistoryApi }); ... h('div', router( router.page('/', function () {}) ) )

wdyt?
opened by joshski 6
ViewModel string binding syntax?
Not ready to merge, posting this for feedback.

Since we are deprecating render functions, we should mostly be able to lose the weird [model, 'property'] binding syntax in favour of just 'property', because ViewModels are usually binding to this, e.g:

// instead of: class ViewModel { render() { return h('input', { type: 'text', binding: [this, 'text'] }) } } // ...can we do this now? class ViewModel { render() { return h('input', { type: 'text', binding: 'text' }) } }

Wrote a failing test but got a bit lost trying to make it pass :) -- what do you think of this idea?
opened by joshski 5
custom data html attributes
Hi! and thank you all for working on this great framework.

I'm trying it out to set a custom data and contenteditable attribute but not sure if i'm doing something wrong. This is not working for me:

h('span', { 'data-type':'somethingHere', 'contenteditable': true }, 'name: ', model.name);

Anyhow, I'll check the source code to check what's going on.

Thank you very much!
opened by tsur 5

HTML class attribute accepts an array with a mix of strings and objects

e.g.

return h('div.one', {class: ['two', 'three', {four: true, five: false, six: true}]});

produces:

<div class="one two three four six"></div>

opened by adiel 3

gh-pages: easier to read colours and style

The colourful documentation page looks nice but it's really quite hard to read compared to the same README.md on Github.

This PR calms the crazy down a bit, so we can read the text and code.

I'm not sure how to preview gh-pages without merging (any idea?) so here's a screenshot:

opened by joshski 3
there is no "component model"

...still appears near the end of README and seems odd after the explanation about components.

Plastiq does have a "component model" now, right?

opened by joshski 3
fix component update bug

Issue: virtual-dom doesn't seem to compare two widgets for equality based on key - or at least, if one key is undefined and the other isn't they're compared as equal and the component is updated, not calling the onadd event.

Secondly, if two components have different constructors but undefined keys, then they're considered equal. This is more of a hyperdom issue.

In any case, in this patch we compare the keys and constructors before deciding whether to update or create a component.

opened by refractalize 2
Vdom outside render loop

This fixed an issue that has been with hyperdom/plastiq since the beginning. DOM event handlers have always needed to refresh the view after they run, and to do this they needed to have been recognised during the render loop. A consequence of this was that defining VDOM with event handlers outside of the render loop meant that those event handlers didn't refresh the view, which is annoying and a bit confusing.

This PR fixes that issue. Now, VDOM with event handlers can be prepared beforehand, outside the render loop, statically, and be used in various places in the VDOM. This allows VDOM to be defined once and reused - which can dramatically improve performance.

CC @dereke

opened by refractalize 2
Bump decode-uri-component from 0.2.0 to 0.2.2
Bumps decode-uri-component from 0.2.0 to 0.2.2.

Release notes

Sourced from decode-uri-component's releases.

v0.2.2

Prevent overwriting previously decoded tokens 980e0bf

https://github.com/SamVerschueren/decode-uri-component/compare/v0.2.1...v0.2.2

v0.2.1

Switch to GitHub workflows 76abc93

Fix issue where decode throws - fixes #6 746ca5d

Update license (#1) 486d7e2

Tidelift tasks a650457

Meta tweaks 66e1c28

https://github.com/SamVerschueren/decode-uri-component/compare/v0.2.0...v0.2.1

Commits

a0eea46 0.2.2

980e0bf Prevent overwriting previously decoded tokens

3c8a373 0.2.1

76abc93 Switch to GitHub workflows

746ca5d Fix issue where decode throws - fixes #6

486d7e2 Update license (#1)

a650457 Tidelift tasks

66e1c28 Meta tweaks

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
Bump terser from 4.0.0 to 4.8.1
Bumps terser from 4.0.0 to 4.8.1.

Changelog

Sourced from terser's changelog.

v4.8.1 (backport)

Security fix for RegExps that should not be evaluated (regexp DDOS)

v4.8.0

Support for numeric separators (million = 1_000_000) was added.

Assigning properties to a class is now assumed to be pure.

Fixed bug where yield wasn't considered a valid property key in generators.

v4.7.0

A bug was fixed where an arrow function would have the wrong size

arguments object is now considered safe to retrieve properties from (useful for length, or 0) even when pure_getters is not set.

Fixed erroneous const declarations without value (which is invalid) in some corner cases when using collapse_vars.

v4.6.13

Fixed issue where ES5 object properties were being turned into ES6 object properties due to more lax unicode rules.

Fixed parsing of BigInt with lowercase e in them.

v4.6.12

Fixed subtree comparison code, making it see that [1,[2, 3]] is different from [1, 2, [3]]

Printing of unicode identifiers has been improved

v4.6.11

Read unused classes' properties and method keys, to figure out if they use other variables.

Prevent inlining into block scopes when there are name collisions

Functions are no longer inlined into parameter defaults, because they live in their own special scope.

When inlining identity functions, take into account the fact they may be used to drop this in function calls.

Nullish coalescing operator (x ?? y), plus basic optimization for it.

Template literals in binary expressions such as + have been further optimized

v4.6.10

Do not use reduce_vars when classes are present

v4.6.9

Check if block scopes actually exist in blocks

v4.6.8

Take into account "executed bits" of classes like static properties or computed keys, when checking if a class evaluation might throw or have side effects.

v4.6.7

Some new performance gains through a AST_Node.size() method which measures a node's source code length without printing it to a string first.

... (truncated)

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
Bump jsdom from 12.1.0 to 16.5.0
Bumps jsdom from 12.1.0 to 16.5.0.

Release notes

Sourced from jsdom's releases.

Version 16.5.0

Added window.queueMicrotask().

Added window.event.

Added inputEvent.inputType. (diegohaz)

Removed ondragexit from Window and friends, per a spec update.

Fixed the URL of about:blank iframes. Previously it was getting set to the parent's URL. (SimonMueller)

Fixed the loading of subresources from the filesystem when they had non-ASCII filenames.

Fixed the hidden="" attribute to cause display: none per the user-agent stylesheet. (ph-fritsche)

Fixed the new File() constructor to no longer convert / to :, per a pending spec update.

Fixed mutation observer callbacks to be called with the MutationObserver instance as their this value.

Fixed <input type=checkbox> and <input type=radio> to be mutable even when disabled, per a spec update.

Fixed XMLHttpRequest to not fire a redundant final progress event if a progress event was previously fired with the same loaded value. This would usually occur with small files.

Fixed XMLHttpRequest to expose the Content-Length header on cross-origin responses.

Fixed xhr.response to return null for failures that occur during the middle of the download.

Fixed edge cases around passing callback functions or event handlers. (ExE-Boss)

Fixed edge cases around the properties of proxy-like objects such as localStorage or dataset. (ExE-Boss)

Fixed a potential memory leak with custom elements (although we could not figure out how to trigger it). (soncodi)

Version 16.4.0

Added a not-implemented warning if you try to use the second pseudo-element argument to getComputedStyle(), unless you pass a ::part or ::slotted pseudo-element, in which case we throw an error per the spec. (ExE-Boss)

Improved the performance of repeated access to el.tagName, which also indirectly improves performance of selector matching and style computation. (eps1lon)

Fixed form.elements to respect the form="" attribute, so that it can contain non-descendant form controls. (ccwebdesign)

Fixed el.focus() to do nothing on disconnected elements. (eps1lon)

Fixed el.focus() to work on SVG elements. (zjffun)

Fixed removing the currently-focused element to move focus to the <body> element. (eps1lon)

Fixed imgEl.complete to return true for <img> elements with empty or unset src="" attributes. (strager)

Fixed imgEl.complete to return true if an error occurs loading the <img>, when canvas is enabled. (strager)

Fixed imgEl.complete to return false if the <img> element's src="" attribute is reset. (strager)

Fixed the valueMissing validation check for <input type="radio">. (zjffun)

Fixed translate="" and draggable="" attribute processing to use ASCII case-insensitivity, instead of Unicode case-insensitivity. (zjffun)

Version 16.3.0

Added firing of focusin and focusout when using el.focus() and el.blur(). (trueadm)

Fixed elements with the contenteditable="" attribute to be considered as focusable. (jamieliu386)

Fixed window.NodeFilter to be per-Window, instead of shared across all Windows. (ExE-Boss)

Fixed edge-case behavior involving use of objects with handleEvent properties as event listeners. (ExE-Boss)

Fixed a second failing image load sometimes firing a load event instead of an error event, when the canvas package is installed. (strager)

Fixed drawing an empty canvas into another canvas. (zjffun)

Version 16.2.2

Updated StyleSheetList for better spec compliance; notably it no longer inherits from Array.prototype. (ExE-Boss)

Fixed requestAnimationFrame() from preventing process exit. This likely regressed in v16.1.0.

Fixed setTimeout() to no longer leak the closures passed in to it. This likely regressed in v16.1.0. (AviVahl)

Fixed infinite recursion that could occur when calling click() on a <label> element, or one of its descendants.

Fixed getComputedStyle() to consider inline style="" attributes. (eps1lon)

Fixed several issues with <input type="number">'s stepUp() and stepDown() functions to be properly decimal-based, instead of floating point-based.

Fixed various issues where updating selectEl.value would not invalidate properties such as selectEl.selectedOptions. (ExE-Boss)

Fixed <input>'s src property, and <ins>/<del>'s cite property, to properly reflect as URLs.

Fixed window.addEventLister, window.removeEventListener, and window.dispatchEvent to properly be inherited from EventTarget, instead of being distinct functions. (ExE-Boss)

Fixed errors that would occur if attempting to use a DOM object, such as a custom element, as an argument to addEventListener.

... (truncated)

Changelog

Sourced from jsdom's changelog.

16.5.0

Added window.queueMicrotask().

Added window.event.

Added inputEvent.inputType. (diegohaz)

Removed ondragexit from Window and friends, per a spec update.

Fixed the URL of about:blank iframes. Previously it was getting set to the parent's URL. (SimonMueller)

Fixed the loading of subresources from the filesystem when they had non-ASCII filenames.

Fixed the hidden="" attribute to cause display: none per the user-agent stylesheet. (ph-fritsche)

Fixed the new File() constructor to no longer convert / to :, per a pending spec update.

Fixed mutation observer callbacks to be called with the MutationObserver instance as their this value.

Fixed <input type=checkbox> and <input type=radio> to be mutable even when disabled, per a spec update.

Fixed XMLHttpRequest to not fire a redundant final progress event if a progress event was previously fired with the same loaded value. This would usually occur with small files.

Fixed XMLHttpRequest to expose the Content-Length header on cross-origin responses.

Fixed xhr.response to return null for failures that occur during the middle of the download.

Fixed edge cases around passing callback functions or event handlers. (ExE-Boss)

Fixed edge cases around the properties of proxy-like objects such as localStorage or dataset. (ExE-Boss)

Fixed a potential memory leak with custom elements (although we could not figure out how to trigger it). (soncodi)

16.4.0

Added a not-implemented warning if you try to use the second pseudo-element argument to getComputedStyle(), unless you pass a ::part or ::slotted pseudo-element, in which case we throw an error per the spec. (ExE-Boss)

Improved the performance of repeated access to el.tagName, which also indirectly improves performance of selector matching and style computation. (eps1lon)

Fixed form.elements to respect the form="" attribute, so that it can contain non-descendant form controls. (ccwebdesign)

Fixed el.focus() to do nothing on disconnected elements. (eps1lon)

Fixed el.focus() to work on SVG elements. (zjffun)

Fixed removing the currently-focused element to move focus to the <body> element. (eps1lon)

Fixed imgEl.complete to return true for <img> elements with empty or unset src="" attributes. (strager)

Fixed imgEl.complete to return true if an error occurs loading the <img>, when canvas is enabled. (strager)

Fixed imgEl.complete to return false if the <img> element's src="" attribute is reset. (strager)

Fixed the valueMissing validation check for <input type="radio">. (zjffun)

Fixed translate="" and draggable="" attribute processing to use ASCII case-insensitivity, instead of Unicode case-insensitivity. (zjffun)

16.3.0

Added firing of focusin and focusout when using el.focus() and el.blur(). (trueadm)

Fixed elements with the contenteditable="" attribute to be considered as focusable. (jamieliu386)

Fixed window.NodeFilter to be per-Window, instead of shared across all Windows. (ExE-Boss)

Fixed edge-case behavior involving use of objects with handleEvent properties as event listeners. (ExE-Boss)

Fixed a second failing image load sometimes firing a load event instead of an error event, when the canvas package is installed. (strager)

Fixed drawing an empty canvas into another canvas. (zjffun)

16.2.2

Updated StyleSheetList for better spec compliance; notably it no longer inherits from Array.prototype. (ExE-Boss)

Fixed requestAnimationFrame() from preventing process exit. This likely regressed in v16.1.0.

Fixed setTimeout() to no longer leak the closures passed in to it. This likely regressed in v16.1.0. (AviVahl)

Fixed infinite recursion that could occur when calling click() on a <label> element, or one of its descendants.

Fixed getComputedStyle() to consider inline style="" attributes. (eps1lon)

Fixed several issues with <input type="number">'s stepUp() and stepDown() functions to be properly decimal-based, instead of floating point-based.

... (truncated)

Commits

2d82763 Version 16.5.0

9741311 Fix loading of subresources with Unicode filenames

5e46553 Use domenic's ESLint config as the base

19b35da Fix the URL of about:blank iframes

017568e Support inputType on InputEvent

29f4fdf Upgrade dependencies

e2f7639 Refactor create‑event‑accessor.js to remove code duplication

ff69a75 Convert JSDOM to use callback functions

19df6bc Update links in contributing guidelines

1e34ff5 Test triage

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
Bump shell-quote from 1.6.1 to 1.7.3
Bumps shell-quote from 1.6.1 to 1.7.3.

Release notes

Sourced from shell-quote's releases.

v1.7.2

Fix a regression introduced in 1.6.3. This reverts the Windows path quoting fix. (144e1c2)

v1.7.1

Fix $ being removed when not part of an environment variable name. (@Adman in #32)

v1.7.0

Add support for parsing >> and >& redirection operators. (@forivall in #16)

Add support for parsing <( process substitution operator. (@cuonglm in #15)

v1.6.3

Fix Windows path quoting problems. (@dy in #34)

v1.6.2

Remove dependencies in favour of native methods. (@zertosh in #21)

Changelog

Sourced from shell-quote's changelog.

1.7.3

Fix a security issue where the regex for windows drive letters allowed some shell meta-characters to escape the quoting rules. (CVE-2021-42740)

1.7.2

Fix a regression introduced in 1.6.3. This reverts the Windows path quoting fix. (144e1c2)

1.7.1

Fix $ being removed when not part of an environment variable name. (@Adman in #32)

1.7.0

Add support for parsing >> and >& redirection operators. (@forivall in #16)

Add support for parsing <( process substitution operator. (@cuonglm in #15)

1.6.3

Fix Windows path quoting problems. (@dy in #34)

1.6.2

Remove dependencies in favour of native methods. (@zertosh in #21)

Commits

6a8a899 1.7.3

5799416 fix for security issue with windows drive letter regex

c7de931 Add security.md

414853f Update readme.markdown (#43)

0fc4a97 use Github Actions (#42)

89a1993 1.7.2

df7e4c7 add test for #37

144e1c2 revert windows path unescaping, fixes #37

c24f3aa ci: nvs does not have iojs

c2950fb 1.7.1

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
Bump electron from 1.8.2 to 15.5.5
Bumps electron from 1.8.2 to 15.5.5.

Release notes

Sourced from electron's releases.

electron v15.5.5

Release Notes for v15.5.5

Other Changes

Backported fix for CVE-2022-1482. #34040

Backported fix for CVE-2022-1483. #34009

Backported fix for CVE-2022-1497. #34075

electron v15.5.4

Release Notes for v15.5.4

Other Changes

Backported fix for CVE-2022-1138. #33682

Backported fix for CVE-2022-1478. #34045

Backported fix for CVE-2022-1479. #34037

Backported fix for CVE-2022-1480. #34019

Backported fix for CVE-2022-1492. #34051

electron v15.5.3

Release Notes for v15.5.3

Fixes

Fixed a network service crash that could occur when using setCertificateVerifyProc. #33256 (Also in 16, 17, 18)

shell.openExternal() now reports more detailed errors on Windows. #33656 (Also in 16, 17, 18, 19)

Other Changes

Backported fix for CVE-2022-1134. #33763

Backported fix for CVE-2022-1305. #33860

Backported fix for CVE-2022-1310. #33831

Backported fix for CVE-2022-1314. #33884

Backported fix for CVE-2022-1364. #33836

Backported fix for chromium:1286816. #33679

Backported fix for chromium:1291482. #33676

Backported fix for chromium:1310761. #33856

Security: backported fix for CVE-2022-0116 and CVE-2022-1306. #33852

Security: backported fix for CVE-2022-23308. #33670

Security: backported fix for chromium:1280743. #33715

Security: backported fix for chromium:1280852. #33673

electron v15.5.2

Release Notes for v15.5.2

Fixes

Fixed behavior of BrowserWindow.maximize on macOS for not shown windows. #33523 (Also in 16, 18)

Other Changes

... (truncated)

Commits

f988853 Bump v15.5.5

8bc25e8 build: change upload-to-s3 vars to upload-to-storage (#34142)

a8f8b50 build: use azure function to hash assets instead of lambda (#34119)

eb320cb build: stop uploading assets to S3 (#34112)

37eab5c chore: cherry-pick 5be8e065f43e from chromium (#34040)

fc91202 chore: cherry-pick 5361d836ae from chromium (#34009)

6aa0609 chore: cherry-pick 6b66a45021 from chromium (#34075)

620d615 test: fix nativeModulesEnabled in spec/webview-spec.js (#34063)

ec7baba Bump v15.5.4

f8ba4d6 chore: cherry-pick d27d9d059b51 from angle (#34045)

Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by electron-nightly, a new releaser for electron since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
Bump karma from 3.0.0 to 6.3.16
Bumps karma from 3.0.0 to 6.3.16.

Release notes

Sourced from karma's releases.

v6.3.16

6.3.16 (2022-02-10)

Bug Fixes

security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

v6.3.15

6.3.15 (2022-02-05)

Bug Fixes

helper: make mkdirIfNotExists helper resilient to concurrent calls (d9dade2), closes karma-runner/karma-coverage#434

v6.3.14

6.3.14 (2022-02-05)

Bug Fixes

remove string template from client code (91d5acd)

warn when singleRun and autoWatch are false (69cfc76)

security: remove XSS vulnerability in returnUrl query param (839578c)

v6.3.13

6.3.13 (2022-01-31)

Bug Fixes

deps: bump log4js to resolve security issue (5bf2df3), closes #3751

v6.3.12

6.3.12 (2022-01-24)

Bug Fixes

remove depreciation warning from log4js (41bed33)

v6.3.11

6.3.11 (2022-01-13)

Bug Fixes

deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

... (truncated)

Changelog

Sourced from karma's changelog.

6.3.16 (2022-02-10)

Bug Fixes

security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

6.3.15 (2022-02-05)

Bug Fixes

helper: make mkdirIfNotExists helper resilient to concurrent calls (d9dade2), closes karma-runner/karma-coverage#434

6.3.14 (2022-02-05)

Bug Fixes

remove string template from client code (91d5acd)

warn when singleRun and autoWatch are false (69cfc76)

security: remove XSS vulnerability in returnUrl query param (839578c)

6.3.13 (2022-01-31)

Bug Fixes

deps: bump log4js to resolve security issue (5bf2df3), closes #3751

6.3.12 (2022-01-24)

Bug Fixes

remove depreciation warning from log4js (41bed33)

6.3.11 (2022-01-13)

Bug Fixes

deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

6.3.10 (2022-01-08)

Bug Fixes

logger: create parent folders if they are missing (0d24bd9), closes #3734

... (truncated)

Commits

ab4b328 chore(release): 6.3.16 [skip ci]

ff7edbb fix(security): mitigate the "Open Redirect Vulnerability"

c1befa0 chore(release): 6.3.15 [skip ci]

d9dade2 fix(helper): make mkdirIfNotExists helper resilient to concurrent calls

653c762 ci: prevent duplicate CI tasks on creating a PR

c97e562 chore(release): 6.3.14 [skip ci]

91d5acd fix: remove string template from client code

69cfc76 fix: warn when singleRun and autoWatch are false

839578c fix(security): remove XSS vulnerability in returnUrl query param

db53785 chore(release): 6.3.13 [skip ci]

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0

Releases(v2.1.0)

v2.1.0(Oct 11, 2019)
router calls decodeURIComponent on each path param #125

https://github.com/featurist/hyperdom/compare/v2.0.0...v2.1.0
Source code(tar.gz)
Source code(zip)