
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@20i/use-roving-tabindex-a11y
Advanced tools
https://github.com/twentyideas/use-roving-tabindex-a11y/blob/main/README.md
This library provides a simple hook that enables keyboard navigation on any list, table body, or table header.
Usage Instructions:
Create a roving tab index ref in your component
const listRef = useRovingTabIndex()
Place returned ref on any ul, tableBody, or tableHeader
<ul ref={listRef}>...</ul>
Give all focusable elements a tabindex of -1
<button tabIndex={-1}>...</button>
Give the one element you want to have the first default focus a tabindex of 0
<ul ref={listRef}>
<li><a tabIndex={0}>first link</a></li>
...
</ul> )
export const SimpleList: React.FC = () => {
const listRef = useRovingTabIndex()
return (
<div>
<h3>Simple List</h3>
<ul ref={listRef}>
<ListItem
tabindex={0}
title="Item 1"
description="All the things you could ever want to know"
/>
...
</ul>
</div>
)
}
const ComplexListItem: React.FC<{
title: string
description: string
tabindex?: 0 | -1
}> = ({ title, description, tabindex }) => {
return (
<li>
{/* Initial focus */}
<a href="#" tabIndex={tabindex ?? -1}>
<h4>{title}</h4>
</a>
<p>{description}</p>
{/* Focusable element with tabindex of 0 */}
<button tabIndex={-1} onClick={() => console.log('subscribe')}>
Subscribe
</button>
</li>
)
}
export const Table: React.FC = () => {
const bodyRef = useRovingTabIndex()
const headerRef = useRovingTabIndex()
return (
<table style={{ borderCollapse: 'collapse', borderSpacing: 0 }}>
<thead ref={headerRef}>
<tr>
<Header tabIndex={0} name="Selected" />
{/* This custom <Header /> tabIndex defaults to -1 */}
<Header name="Name" />
<Header name="Age" />
<Header name="Favorite Color" />
<Header name="Link" />
</tr>
</thead>
<tbody ref={bodyRef}>
<Row tabIndex={0} name="Janet" age={10} color="red" />
{/* This custom <Row /> tabIndex defaults to -1 */}
<Row name="Paul" age={15} color="green" />
<Row name="Judy" age={18} color="blue" />
<Row name="Peter" age={30} color="pink" />
</tbody>
</table>
)
}
useFocusOnFirstFocusable(): Auto focus on the first focusable element in an HTMLElementuseFocusOnMount(): Auto focus on the HTMLElement that the returned ref is attached to
...
const focusRef = useFocusOnMount()
...
return <button ref={focusRef}>Focus on Me First!</button>
tabindex attributeCongrats! You just saved yourself hours of work by bootstrapping this project with TSDX. Let’s get you oriented with what’s here and how to use it.
This TSDX setup is meant for developing React component libraries (not apps!) that can be published to NPM. If you’re looking to build a React-based app, you should use
create-react-app,razzle,nextjs,gatsby, orreact-static.
If you’re new to TypeScript and React, checkout this handy cheatsheet
TSDX scaffolds your new library inside /src, and also sets up a Parcel-based playground for it inside /example.
The recommended workflow is to run TSDX in one terminal:
npm start # or yarn start
This builds to /dist and runs the project in watch mode so any edits you save inside src causes a rebuild to /dist.
Then run either Storybook or the example playground:
Run inside another terminal:
yarn storybook
This loads the stories from ./stories.
NOTE: Stories should reference the components as if using the library, similar to the example playground. This means importing from the root project directory. This has been aliased in the tsconfig and the storybook webpack config as a helper.
Then run the example inside another:
cd example
npm i # or yarn to install dependencies
npm start # or yarn start
The default example imports and live reloads whatever is in /dist, so if you are seeing an out of date component, make sure TSDX is running in watch mode like we recommend above. No symlinking required, we use Parcel's aliasing.
To do a one-off build, use npm run build or yarn build.
To run tests, use npm test or yarn test.
Code quality is set up for you with prettier, husky, and lint-staged. Adjust the respective fields in package.json accordingly.
Jest tests are set up to run with npm test or yarn test.
Calculates the real cost of your library using size-limit with npm run size and visulize it with npm run analyze.
This is the folder structure we set up for you:
/example
index.html
index.tsx # test your component here in a demo app
package.json
tsconfig.json
/src
index.tsx # EDIT THIS
/test
blah.test.tsx # EDIT THIS
/stories
Thing.stories.tsx # EDIT THIS
/.storybook
main.js
preview.js
.gitignore
package.json
README.md # EDIT THIS
tsconfig.json
We do not set up react-testing-library for you yet, we welcome contributions and documentation on this.
TSDX uses Rollup as a bundler and generates multiple rollup configs for various module formats and build settings. See Optimizations for details.
tsconfig.json is set up to interpret dom and esnext types, as well as react for jsx. Adjust according to your needs.
Two actions are added by default:
main which installs deps w/ cache, lints, tests, and builds on all pushes against a Node and OS matrixsize which comments cost comparison of your library on every pull request using size-limitPlease see the main tsdx optimizations docs. In particular, know that you can take advantage of development-only optimizations:
// ./types/index.d.ts
declare var __DEV__: boolean
// inside your code...
if (__DEV__) {
console.log('foo')
}
You can also choose to install and use invariant and warning functions.
CJS, ESModules, and UMD module formats are supported.
The appropriate paths are configured in package.json and dist/index.js accordingly. Please report if any issues are found.
The Playground is just a simple Parcel app, you can deploy it anywhere you would normally deploy that. Here are some guidelines for manually deploying with the Netlify CLI (npm i -g netlify-cli):
cd example # if not already in the example folder
npm run build # builds to dist
netlify deploy # deploy the dist folder
Alternatively, if you already have a git repo connected, you can set up continuous deployment with Netlify:
netlify init
# build command: yarn build && cd example && yarn && yarn build
# directory to deploy: example/dist
# pick yes for netlify.toml
Per Palmer Group guidelines, always use named exports. Code split inside your React app instead of your React library.
There are many ways to ship styles, including with CSS-in-JS. TSDX has no opinion on this, configure how you like.
For vanilla CSS, you can include it at the root directory and add it to the files section in your package.json, so that it can be imported separately by your users and run through their bundler's loader.
We recommend using np.
When creating a new package with TSDX within a project set up with Lerna, you might encounter a Cannot resolve dependency error when trying to run the example project. To fix that you will need to make changes to the package.json file inside the example directory.
The problem is that due to the nature of how dependencies are installed in Lerna projects, the aliases in the example project's package.json might not point to the right place, as those dependencies might have been installed in the root of your Lerna project.
Change the alias to point to where those packages are actually installed. This depends on the directory structure of your Lerna project, so the actual path might be different from the diff below.
"alias": {
- "react": "../node_modules/react",
- "react-dom": "../node_modules/react-dom"
+ "react": "../../../node_modules/react",
+ "react-dom": "../../../node_modules/react-dom"
},
An alternative to fixing this problem would be to remove aliases altogether and define the dependencies referenced as aliases as dev dependencies instead. However, that might cause other problems.
FAQs
https://github.com/twentyideas/use-roving-tabindex-a11y/blob/main/README.md
We found that @20i/use-roving-tabindex-a11y demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.