A timed continuous carousel that uses vanilla JavaScript & CSS animations.

Last update: Jan 3, 2023

Overview

Continuous Carousel ∞

Timed continuous carousel that uses vanilla JavaScript & CSS animations. It supports both horizontal and vertical scrolling.

Markup

Continuous Carousel works with a container element and a set of child elements.

Horizontal Carousel

<div
  id="carouselExampleHorizontal"
  <!-- css hooks begin with "c-carousel-..." -->
  class="c-carousel-container"
  <!-- direction must be "horizontal" or "vertical" -->
  data-direction="horizontal"
  <!-- specify how many elements should be visible at once -->
  data-num-visible="1" >
  <ul class="c-carousel-group">
    <li class="c-carousel-item">1</li>
    <li class="c-carousel-item">2</li>
    <li class="c-carousel-item">3</li>
    <li class="c-carousel-item">4</li>
    <li class="c-carousel-item">5</li>
    <li class="c-carousel-item">6</li>
  </ul>
</div>

<script>
  // the carousel id is a required argument for the script
  const horizCarousel = ContinuousCarousel('carouselExampleHorizontal');
</script>

Vertical Carousel

<div
  id="carouselExampleVertical"
  <!-- css hooks begin with "c-carousel-..." -->
  class="c-carousel-container"
  <!-- direction must be "horizontal" or "vertical" -->
  data-direction="vertical"
  <!-- specify how many elements should be visible at once -->
  data-num-visible="1" >
  <ul class="c-carousel-group">
    <li class="c-carousel-item">1</li>
    <li class="c-carousel-item">2</li>
    <li class="c-carousel-item">3</li>
    <li class="c-carousel-item">4</li>
    <li class="c-carousel-item">5</li>
    <li class="c-carousel-item">6</li>
  </ul>
</div>

<script>
  // the carousel id is a required argument for the script
  const vertCarousel = ContinuousCarousel('carouselExampleVertical');
</script>

Browser Support

As of 10/2020 ContinuousCarousel is supported in the latest versions of:

Edge
Firefox
Chrome
Safari
Opera

There's currently no support for Internet Explorer.

License

Continuous Carousel is released under the MIT license.

Comments

After the number 8 slide the previous slides not repeating

In the demo example when it reaching number 8 the second time, there's no repeating. Is it a normal behavior? This is the same in latest Firefox and Chrome.
bug

opened by DJviolin 3
Bump uglify-js from 2.4.24 to 3.9.4
Bumps uglify-js from 2.4.24 to 3.9.4.

Release notes

Sourced from uglify-js's releases.

v3.9.4

v3.9.3

v3.9.2

v3.9.1

v3.9.0

v3.8.1

v3.8.0

v3.7.7

v3.7.6

v3.7.5

v3.7.4

v3.7.3

v3.7.2

v3.7.1

v3.7.0

v3.6.9

v3.6.8

... (truncated)

Commits

49ea629 v3.9.4

13c72a9 fix corner case in infinite recursion detection (#3926)

08af3ea perform ufuzz on Pull Requests (#3925)

27bdcbb fix corner cases in infinite recursion detection (#3924)

2c4d7d6 fix corner case in reduce_vars (#3923)

d1cc527 fix corner case in evaluate (#3921)

75c5b60 fix corner case in ie8 & reduce_vars (#3919)

fa14a9c fix corner case in join_vars (#3917)

aeb9ea5 fix corner case in inline (#3915)

798841b improve job resilience (#3913)

Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by alexlamsl, a new releaser for uglify-js since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 1
chore(deps): bump minimatch from 3.0.4 to 3.1.2
Bumps minimatch from 3.0.4 to 3.1.2.

Commits

699c459 3.1.2

2f2b5ff fix: trim pattern

25d7c0d 3.1.1

55dda29 fix: treat nocase:true as always having magic

5e1fb8d 3.1.0

f8145c5 Add 'allowWindowsEscape' option

570e8b1 add publishConfig for v3 publishes

5b7cd33 3.0.6

20b4b56 [fix] revert all breaking syntax changes

2ff0388 document, expose, and test 'partial:true' option

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
chore(deps-dev): bump terser from 5.3.7 to 5.14.2
Bumps terser from 5.3.7 to 5.14.2.

Changelog

Sourced from terser's changelog.

v5.14.2

Security fix for RegExps that should not be evaluated (regexp DDOS)

Source maps improvements (#1211)

Performance improvements in long property access evaluation (#1213)

v5.14.1

keep_numbers option added to TypeScript defs (#1208)

Fixed parsing of nested template strings (#1204)

v5.14.0

Switched to @jridgewell/source-map for sourcemap generation (#1190, #1181)

Fixed source maps with non-terminated segments (#1106)

Enabled typescript types to be imported from the package (#1194)

Extra DOM props have been added (#1191)

Delete the AST while generating code, as a means to save RAM

v5.13.1

Removed self-assignments (varname=varname) (closes #1081)

Separated inlining code (for inlining things into references, or removing IIFEs)

Allow multiple identifiers with the same name in var destructuring (eg var { a, a } = x) (#1176)

v5.13.0

All calls to eval() were removed (#1171, #1184)

source-map was updated to 0.8.0-beta.0 (#1164)

NavigatorUAData was added to domprops to avoid property mangling (#1166)

v5.12.1

Fixed an issue with function definitions inside blocks (#1155)

Fixed parens of new in some situations (closes #1159)

v5.12.0

TERSER_DEBUG_DIR environment variable

@copyright comments are now preserved with the comments="some" option (#1153)

v5.11.0

Unicode code point escapes (\u{abcde}) are not emitted inside RegExp literals anymore (#1147)

acorn is now a regular dependency

v5.10.0

Massive optimization to max_line_len (#1109)

Basic support for import assertions

Marked ES2022 Object.hasOwn as a pure function

Fix delete optional?.property

New CI/CD pipeline with github actions (#1057)

... (truncated)

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
chore(deps): bump jsdom from 16.4.0 to 16.7.0
Bumps jsdom from 16.4.0 to 16.7.0.

Release notes

Sourced from jsdom's releases.

Version 16.7.0

Added AbortSignal.abort(). (ninevra)

Added dummy x and y properties to the return value of getBoundingClientRect(). (eiko)

Implemented wrapping for textareaEl.value if the wrap="" attribute is specified. (ninevra)

Changed newline normalization in <textarea>s according to recent HTML Standard updates. (ninevra)

Fixed some bad cascade computation in getComputedStyle(). (romain-trotard)

Version 16.6.0

Added parentNode.replaceChildren(). (@ninevra)

Fixed jsdom's handling of when code running inside the jsdom throws null or undefined as an exception. (@mbest)

Removed the dependency on the deprecated request package, in the process fixing several issues with the XMLHttpRequest implementation around header processing. Thanks go to @tobyhinloopen, @andrewaylett, and especially @vegardbb, for completing this months-long effort!

Version 16.5.3

Fixed infinite recursion when using MutationObservers to observe elements inside a MutationObserver callback.

Version 16.5.2

Fixed Access-Control-Allow-Headers: * to work with XMLHttpRequest. (silviot)

Fixed xhr.response to strip any leading BOM when xhr.responseType is "json".

Fixed new Text() and new Comment() constructors to properly set the resulting node's ownerDocument.

Fixed customElements.whenDefined() to resolve its returned promise with the custom element constructor, per recent spec updates. (ExE-Boss)

Fixed parsing to ensure that <svg>\<template></template></svg> does not throw an exception, but instead correctly produces a SVG-namespace \<template> element.

Fixed domParser.parseFromString() to treat <noscript> elements appropriately.

Fixed form control validity checking when the control was outside the <form> element and instead associated using the form="" attribute.

Fixed legendEl.form to return the correct result based on its parent <fieldset>.

Fixed optionEl.text to exclude <script> descendants.

Fixed radio buttons and checkboxes to not fire input and change events when disconnected.

Fixed inputEl.indeterminate to reset to its previous value when canceling a click event on a checkbox or radio button.

Fixed the behavior of event handler attributes (e.g. onclick="...code...") when there were global variables named element or formOwner. (ExE-Boss)

On Node.js v14.6.0+ where WeakRefs are available, fixed NodeIterator to no longer stop working when more than ten NodeIterator instances are created, and to use less memory due to inactive NodeIterators sticking around. (ExE-Boss)

Version 16.5.1

Fixed a regression that broke customElements.get() in v16.5.0. (fdesforges)

Fixed window.event to have a setter which overwrites the window.event property with the given value, per the specification. This fixes an issue where after upgrading to jsdom v16.5.0 you would no longer be able to set a global variable named event in the jsdom context.

Version 16.5.0

Added window.queueMicrotask().

Added window.event.

Added inputEvent.inputType. (diegohaz)

Removed ondragexit from Window and friends, per a spec update.

Fixed the URL of about:blank iframes. Previously it was getting set to the parent's URL. (SimonMueller)

Fixed the loading of subresources from the filesystem when they had non-ASCII filenames.

Fixed the hidden="" attribute to cause display: none per the user-agent stylesheet. (ph-fritsche)

Fixed the new File() constructor to no longer convert / to :, per a pending spec update.

Fixed mutation observer callbacks to be called with the MutationObserver instance as their this value.

Fixed <input type=checkbox> and <input type=radio> to be mutable even when disabled, per a spec update.

Fixed XMLHttpRequest to not fire a redundant final progress event if a progress event was previously fired with the same loaded value. This would usually occur with small files.

Fixed XMLHttpRequest to expose the Content-Length header on cross-origin responses.

Fixed xhr.response to return null for failures that occur during the middle of the download.

Fixed edge cases around passing callback functions or event handlers. (ExE-Boss)

Fixed edge cases around the properties of proxy-like objects such as localStorage or dataset. (ExE-Boss)

... (truncated)

Changelog

Sourced from jsdom's changelog.

16.7.0

Added AbortSignal.abort(). (ninevra)

Added dummy x and y properties to the return value of getBoundingClientRect(). (eiko)

Implemented wrapping for textareaEl.value if the wrap="" attribute is specified. (ninevra)

Changed newline normalization in <textarea>s according to recent HTML Standard updates. (ninevra)

Fixed some bad cascade computation in getComputedStyle(). (romain-trotard)

16.6.0

Added parentNode.replaceChildren(). (ninevra)

Fixed jsdom's handling of when code running inside the jsdom throws null or undefined as an exception. (mbest)

Removed the dependency on the deprecated request package, in the process fixing several issues with the XMLHttpRequest implementation around header processing. Special thanks to vegardbb for completing this months-long effort!

16.5.3

Fixed infinite recursion when using MutationObservers to observe elements inside a MutationObserver callback.

16.5.2

Fixed Access-Control-Allow-Headers: * to work with XMLHttpRequest. (silviot)

Fixed xhr.response to strip any leading BOM when xhr.responseType is "json".

Fixed new Text() and new Comment() constructors to properly set the resulting node's ownerDocument.

Fixed customElements.whenDefined() to resolve its returned promise with the custom element constructor, per recent spec updates. (ExE-Boss)

Fixed parsing to ensure that <svg>\<template></template></svg> does not throw an exception, but instead correctly produces a SVG-namespace \<template> element.

Fixed domParser.parseFromString() to treat <noscript> elements appropriately.

Fixed form control validity checking when the control was outside the <form> element and instead associated using the form="" attribute.

Fixed legendEl.form to return the correct result based on its parent <fieldset>.

Fixed optionEl.text to exclude <script> descendants.

Fixed radio buttons and checkboxes to not fire input and change events when disconnected.

Fixed inputEl.indeterminate to reset to its previous value when canceling a click event on a checkbox or radio button.

Fixed the behavior of event handler attributes (e.g. onclick="...code...") when there were global variables named element or formOwner. (ExE-Boss)

On Node.js v14.6.0+ where WeakRefs are available, fixed NodeIterator to no longer stop working when more than ten NodeIterator instances are created, and to use less memory due to inactive NodeIterators sticking around. (ExE-Boss)

16.5.1

Fixed a regression that broke customElements.get() in v16.5.0. (fdesforges)

Fixed window.event to have a setter which overwrites the window.event property with the given value, per the specification. This fixes an issue where after upgrading to jsdom v16.5.0 you would no longer be able to set a global variable named event in the jsdom context.

16.5.0

Added window.queueMicrotask().

Added window.event.

Added inputEvent.inputType. (diegohaz)

Removed ondragexit from Window and friends, per a spec update.

Fixed the URL of about:blank iframes. Previously it was getting set to the parent's URL. (SimonMueller)

Fixed the loading of subresources from the filesystem when they had non-ASCII filenames.

Fixed the hidden="" attribute to cause display: none per the user-agent stylesheet. (ph-fritsche)

Fixed the new File() constructor to no longer convert / to :, per a pending spec update.

Fixed mutation observer callbacks to be called with the MutationObserver instance as their this value.

... (truncated)

Commits

1aa3cbc Version 16.7.0

df1f551 Don't run WebSocketStream tests

eb105b2 Fix browser tests by enabling SharedArrayBuffer

0dedfc0 Fix some bad cascade computation in getComputedStyle()

8021a56 Fix "configuation" typo (#3213)

a7febe3 Fix typo in level2/html.js (#3222)

c9896c0 Return x, y properties from Element.getBoundingClientRect (#3187)

346ea98 Update web-platform tests (#3203)

364c77d Bump to ws 7.4.6

93ba6a0 We are now on Matrix (#3207)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
chore(deps): bump ansi-regex from 4.1.0 to 4.1.1
Bumps ansi-regex from 4.1.0 to 4.1.1.

Commits

64735d2 v4.1.1

75a657d Fix potential ReDoS (#37)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
chore(deps): bump minimist from 1.2.5 to 1.2.6
Bumps minimist from 1.2.5 to 1.2.6.

Commits

7efb22a 1.2.6

ef88b93 security notice for additional prototype pollution issue

c2b9819 isConstructorOrProto adapted from PR

bc8ecee test from prototype pollution PR

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
chore(deps): bump tmpl from 1.0.4 to 1.0.5
Bumps tmpl from 1.0.4 to 1.0.5.

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
chore(deps): bump color-string from 1.5.4 to 1.6.0
Bumps color-string from 1.5.4 to 1.6.0.

Release notes

Sourced from color-string's releases.

1.6.0

Minor release 1.6.0

#55 - Add support for space-separated HSL

Thanks @htunnicliff for the contribution :)

1.5.5 (Patch/Security Release) - hwb() ReDos patch (low-severity)

Release notes copied verbatim from the commit message, which can be found here: 0789e21284c33d89ebc4ab4ca6f759b9375ac9d3

Discovered by Yeting Li, c/o Colin Ife via Snyk.io. A ReDos (Regular Expression Denial of Service) vulnerability was responsibly disclosed to me via email by Colin on Mar 5 2021 regarding an exponential time complexity for linearly increasing input lengths for hwb() color strings. Strings reaching more than 5000 characters would see several milliseconds of processing time; strings reaching more than 50,000 characters began seeing 1500ms (1.5s) of processing time. The cause was due to a the regular expression that parses hwb() strings - specifically, the hue value - where the integer portion of the hue value used a 0-or-more quantifier shortly thereafter followed by a 1-or-more quantifier. This caused excessive backtracking and a cartesian scan, resulting in exponential time complexity given a linear increase in input length. Thank you Yeting Li and Colin Ife for bringing this to my attention in a secure, responsible and professional manner.
A CVE will not be assigned for this vulnerability.

Commits

1a68f9e 1.6.0

2b6f59c Add additional HSL examples to README

6f73e20 Update HSL regular expression

0264546 Add tests for space-separated HSL syntax

966ae4d 1.5.5

0789e21 fix ReDos in hwb() parser (low-severity)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
chore(deps): bump path-parse from 1.0.6 to 1.0.7
Bumps path-parse from 1.0.6 to 1.0.7.

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
chore(deps): bump postcss from 7.0.35 to 7.0.36
Bumps postcss from 7.0.35 to 7.0.36.

Release notes

Sourced from postcss's releases.

7.0.36

Backport ReDoS vulnerabilities from PostCSS 8.

Changelog

Sourced from postcss's changelog.

7.0.36

Backport ReDoS vulnerabilities from PostCSS 8.

Commits

67e3d7b Release 7.0.36 version

54cbf3c Backport ReDoS vulnerabilities from PostCSS 8

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
chore(deps): bump decode-uri-component from 0.2.0 to 0.2.2
Bumps decode-uri-component from 0.2.0 to 0.2.2.

Release notes

Sourced from decode-uri-component's releases.

v0.2.2

Prevent overwriting previously decoded tokens 980e0bf

https://github.com/SamVerschueren/decode-uri-component/compare/v0.2.1...v0.2.2

v0.2.1

Switch to GitHub workflows 76abc93

Fix issue where decode throws - fixes #6 746ca5d

Update license (#1) 486d7e2

Tidelift tasks a650457

Meta tweaks 66e1c28

https://github.com/SamVerschueren/decode-uri-component/compare/v0.2.0...v0.2.1

Commits

a0eea46 0.2.2

980e0bf Prevent overwriting previously decoded tokens

3c8a373 0.2.1

76abc93 Switch to GitHub workflows

746ca5d Fix issue where decode throws - fixes #6

486d7e2 Update license (#1)

a650457 Tidelift tasks

66e1c28 Meta tweaks

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
chore(deps): bump is-svg and postcss-svgo
Removes is-svg. It's no longer used after updating ancestor dependency postcss-svgo. These dependencies need to be updated together.

Removes is-svg

Updates postcss-svgo from 4.0.2 to 4.0.3

Release notes

Sourced from postcss-svgo's releases.

4.0.3

Bug Fixes

postcss-merge-longhand incorrect minification of border (border-*) declarations.

Commits

dd457b2 chore(release): 4.0.3

9a70605 fix(postcss-merge-longhand): not mangle border output (#555)

c4f2e59 fix: incorrect merging of border declarations (#551) (#552)

ed5c54e Remove v4 notice on homepage

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
chore(deps): bump nth-check and cssnano
Bumps nth-check to 2.1.1 and updates ancestor dependency cssnano. These dependencies need to be updated together.

Updates nth-check from 1.0.2 to 2.1.1

Release notes

Sourced from nth-check's releases.

v2.1.1

The ESM code had some issues that are now fixed aeeb067

https://github.com/fb55/nth-check/compare/v2.1.0...v2.1.1

v2.1.0

What's Changed

nth-check is now a dual CommonJS and ESM module fb55/nth-check#206

With the new sequence and generate methods, it is now possible to generate a sequence of indices for a given formula fb55/nth-check#207

Full Changelog: https://github.com/fb55/nth-check/compare/v2.0.1...v2.1.0

v2.0.1

Fixes:

Replace regex with hand-rolled parser for nth-expressions (#9) 9894c1d

Ensures parsing will always have linear time complexity.

Internal:

chore(ci): Use GitHub Actions, Dependabot (#10) e02b4dd

Bump dependencies

https://github.com/fb55/nth-check/compare/v2.0.0...v2.0.1

v2.0.0

Port module to TS, Jest, ESLint

Breaking:

The main export is now a default export.

The module now throws regular Errors on invalid selectors instead of SyntaxErrors.

Commits

639fd2a 2.1.1

0eec65b fix(test): Add moduleNameMapper

aeeb067 fix: Fix ESM

432ebc6 2.1.0

3e8cd1e feat: Add generate and sequence methods (#207)

57a5c62 feat: Add ESM (#206)

1ce0c7c chore(deps-dev): Bump @types/node from 17.0.34 to 17.0.35 (#205)

eebb040 chore(deps-dev): Bump @typescript-eslint/parser from 5.24.0 to 5.25.0 (#204)

a316aaa chore(deps-dev): Bump @typescript-eslint/eslint-plugin (#203)

454c0de chore(deps-dev): Bump @typescript-eslint/eslint-plugin (#202)

Additional commits viewable in compare view

Updates cssnano from 4.1.10 to 5.1.14

Release notes

Sourced from cssnano's releases.

v5.1.14

Bug Fixes

fix: update autoprefixer and browserslist

fix(postcss-reduce-initial): improve initial properties data

v5.1.13

Bug Fixes

fix TypeScript type of cssnano() return value (https://github.com/cssnano/cssnano/commit/b92dbe3ab1db16141dc6296cd350f3fdf5c2defe)

v5.1.12

Bug Fixes

fix: preserve hyphenated property case (https://github.com/cssnano/cssnano/commit/120a88899376a29c8756234fdc648c519921f515)

fix: ensure sorting properties does not break the output (https://github.com/cssnano/cssnano/commit/0a3a1331e29f3d1009d2a938181ffa4b34ab5b32)

fix: recognize 'constant' as a function (https://github.com/cssnano/cssnano/commit/858a8b77c951f3698b14e834f38128b176438edc)

v5.1.11

Bug Fixes

postcss-ordered-values: preserve constant values (32ab4d9b7d20d)

v5.1.10

Bug Fixes

postcss-minify-selectors: preserve similar nested selectors (f6c29fb3e75ac26a2635d)

v5.1.9

Bug Fixes

postcss-merge-longhand: preserve more color function fallbacks (712993cb4a4e0)

v5.1.8

Bug Fixes

postcss-convert-values: preserve percentage sign on IE 11 (57f060ad21734)

v5.1.6

Bug Fixes

preserve border color when merging border properties (5f5080a)

v5.1.4

Bug Fixes

postcss-merge-longhand: preserve custom property case (5428d5fc9)

v5.1.3

Bug Fixes

fix: do not merge declarations containing custom properties when it might create invalid declarations (2c699341)

v5.1.2

Bug fixes

preserve empty custom properties and ensure they work in Chrome (4ed39679)

v5.1.0

New Feature

... (truncated)

Commits

9edbfa0 Publish cssnano 5.1.14

b56d337 fix: update initial property values

2bc6580 chore: use native fetch in scripts

336304b chore: update browserslist, autoprefixer and css-declaration-sorter (#1444)

d0e3654 chore: update dev dependencies

14262f2 chore: fix script that regenerates CSS fixtures

393de13 chore: update GitHub actions

208e9e5 chore: update development dependencies

8cf3be3 chore: update eslint

7de4268 chore: update TypeScript

Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ludovicofischer, a new releaser for cssnano since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0