@coreui/coreui-pro - npm Package Compare versions

Comparing version 4.6.0-alpha.2 to 4.6.0-beta.0

js/dist/alert.js

 /*!
-  * CoreUI alert.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI alert.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/base-component.js

 /*!
-  * CoreUI base-component.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI base-component.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -27,3 +27,3 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)
 
-  const VERSION = '4.6.0-alpha.2';
+  const VERSION = '4.6.0-beta.0';
 
@@ -30,0 +30,0 @@ /**

js/dist/button.js

 /*!
-  * CoreUI button.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI button.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/calendar.js

 /*!
-  * CoreUI calendar.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI calendar.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/carousel.js

 /*!
-  * CoreUI carousel.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI carousel.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/collapse.js

 /*!
-  * CoreUI collapse.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI collapse.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/date-picker.js

 /*!
-  * CoreUI date-picker.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI date-picker.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/date-range-picker.js

 /*!
-  * CoreUI date-range-picker.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI date-range-picker.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/dom/data.js

 /*!
-  * CoreUI data.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI data.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/dom/event-handler.js

 /*!
-  * CoreUI event-handler.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI event-handler.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/dom/manipulator.js

 /*!
-  * CoreUI manipulator.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI manipulator.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/dom/selector-engine.js

 /*!
-  * CoreUI selector-engine.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI selector-engine.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/dropdown.js

 /*!
-  * CoreUI dropdown.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI dropdown.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/loading-button.js

 /*!
-  * CoreUI loading-button.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI loading-button.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/modal.js

 /*!
-  * CoreUI modal.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI modal.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/multi-select-new.js

 /*!
-  * CoreUI multi-select-new.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI multi-select-new.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -33,3 +33,3 @@ * Licensed under MIT (https://coreui.io)
    * --------------------------------------------------------------------------
-   * CoreUI PRO (v4.6.0-alpha.2): multi-select.js
+   * CoreUI PRO (v4.6.0-beta.0): multi-select.js
    * License (https://coreui.io/pro/license-new/)
@@ -36,0 +36,0 @@ * --------------------------------------------------------------------------

js/dist/multi-select-old.js

 /*!
-  * CoreUI multi-select-old.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI multi-select-old.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -14,3 +14,3 @@ * Licensed under MIT (https://coreui.io)
    * --------------------------------------------------------------------------
-   * CoreUI PRO (v4.6.0-alpha.2): multi-select.js
+   * CoreUI PRO (v4.6.0-beta.0): multi-select.js
    * License (https://coreui.io/pro/license-new/)
@@ -17,0 +17,0 @@ * --------------------------------------------------------------------------

js/dist/multi-select.js

 /*!
-  * CoreUI multi-select.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI multi-select.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/navigation.js

 /*!
-  * CoreUI navigation.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI navigation.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/offcanvas.js

 /*!
-  * CoreUI offcanvas.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI offcanvas.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/picker.js

 /*!
-  * CoreUI picker.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI picker.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -14,3 +14,3 @@ * Licensed under MIT (https://coreui.io)
    * --------------------------------------------------------------------------
-   * CoreUI PRO (v4.6.0-alpha.2): picker.js
+   * CoreUI PRO (v4.6.0-beta.0): picker.js
    * License (https://coreui.io/pro/license-new/)
@@ -17,0 +17,0 @@ * --------------------------------------------------------------------------

js/dist/popover.js

 /*!
-  * CoreUI popover.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI popover.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/scrollspy.js

 /*!
-  * CoreUI scrollspy.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI scrollspy.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -201,7 +201,7 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)
         }
-        const observableSection = SelectorEngine.findOne(anchor.hash, this._element);
+        const observableSection = SelectorEngine.findOne(decodeURI(anchor.hash), this._element);
 
         // ensure that the observableSection exists & is visible
         if (index_js.isVisible(observableSection)) {
-          this._targetLinks.set(anchor.hash, anchor);
+          this._targetLinks.set(decodeURI(anchor.hash), anchor);
           this._observableSections.set(anchor.hash, observableSection);
@@ -208,0 +208,0 @@ }

js/dist/sidebar.js

 /*!
-  * CoreUI sidebar.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI sidebar.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/tab.js

 /*!
-  * CoreUI tab.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI tab.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/time-picker.js

 /*!
-  * CoreUI time-picker.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI time-picker.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/toast.js

 /*!
-  * CoreUI toast.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI toast.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/tooltip.js

 /*!
-  * CoreUI tooltip.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI tooltip.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/util/backdrop.js

 /*!
-  * CoreUI backdrop.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI backdrop.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/util/calendar.js

 /*!
-  * CoreUI calendar.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI calendar.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/util/component-functions.js

 /*!
-  * CoreUI component-functions.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI component-functions.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/util/config.js

 /*!
-  * CoreUI config.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI config.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/util/focustrap.js

 /*!
-  * CoreUI focustrap.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI focustrap.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/util/index.js

 /*!
-  * CoreUI index.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI index.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/util/sanitizer.js

 /*!
-  * CoreUI sanitizer.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI sanitizer.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -22,30 +22,2 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)
 
-  const uriAttributes = new Set(['background', 'cite', 'href', 'itemtype', 'longdesc', 'poster', 'src', 'xlink:href']);
-
-  /**
-   * A pattern that recognizes a commonly useful subset of URLs that are safe.
-   *
-   * Shout-out to Angular https://github.com/angular/angular/blob/12.2.x/packages/core/src/sanitization/url_sanitizer.ts
-   */
-  const SAFE_URL_PATTERN = /^(?:(?:https?|mailto|ftp|tel|file|sms):|[^#&/:?]*(?:[#/?]|$))/i;
-
-  /**
-   * A pattern that matches safe data URLs. Only matches image, video and audio types.
-   *
-   * Shout-out to Angular https://github.com/angular/angular/blob/12.2.x/packages/core/src/sanitization/url_sanitizer.ts
-   */
-  const DATA_URL_PATTERN = /^data:(?:image\/(?:bmp|gif|jpeg|jpg|png|tiff|webp)|video\/(?:mpeg|mp4|ogg|webm)|audio\/(?:mp3|oga|ogg|opus));base64,[\d+/a-z]+=*$/i;
-  const allowedAttribute = (attribute, allowedAttributeList) => {
-    const attributeName = attribute.nodeName.toLowerCase();
-    if (allowedAttributeList.includes(attributeName)) {
-      if (uriAttributes.has(attributeName)) {
-        return Boolean(SAFE_URL_PATTERN.test(attribute.nodeValue) || DATA_URL_PATTERN.test(attribute.nodeValue));
-      }
-      return true;
-    }
-
-    // Check if a regular expression validates the attribute.
-    return allowedAttributeList.filter(attributeRegex => attributeRegex instanceof RegExp).some(regex => regex.test(attributeName));
-  };
-
   // js-docs-start allow-list
@@ -88,2 +60,24 @@ const ARIA_ATTRIBUTE_PATTERN = /^aria-[\w-]*$/i;
 
+  const uriAttributes = new Set(['background', 'cite', 'href', 'itemtype', 'longdesc', 'poster', 'src', 'xlink:href']);
+
+  /**
+   * A pattern that recognizes URLs that are safe wrt. XSS in URL navigation
+   * contexts.
+   *
+   * Shout-out to Angular https://github.com/angular/angular/blob/15.2.8/packages/core/src/sanitization/url_sanitizer.ts#L38
+   */
+  // eslint-disable-next-line unicorn/better-regex
+  const SAFE_URL_PATTERN = /^(?!javascript:)(?:[a-z0-9+.-]+:|[^&:/?#]*(?:[/?#]|$))/i;
+  const allowedAttribute = (attribute, allowedAttributeList) => {
+    const attributeName = attribute.nodeName.toLowerCase();
+    if (allowedAttributeList.includes(attributeName)) {
+      if (uriAttributes.has(attributeName)) {
+        return Boolean(SAFE_URL_PATTERN.test(attribute.nodeValue));
+      }
+      return true;
+    }
+
+    // Check if a regular expression validates the attribute.
+    return allowedAttributeList.filter(attributeRegex => attributeRegex instanceof RegExp).some(regex => regex.test(attributeName));
+  };
   function sanitizeHtml(unsafeHtml, allowList, sanitizeFunction) {
@@ -90,0 +84,0 @@ if (!unsafeHtml.length) {

js/dist/util/scrollbar.js

 /*!
-  * CoreUI scrollbar.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI scrollbar.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/util/swipe.js

 /*!
-  * CoreUI swipe.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI swipe.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/util/template-factory.js

 /*!
-  * CoreUI template-factory.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI template-factory.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/dist/util/time.js

 /*!
-  * CoreUI time.js v4.6.0-alpha.2 (https://coreui.io)
+  * CoreUI time.js v4.6.0-beta.0 (https://coreui.io)
   * Copyright 2023 The CoreUI Team (https://github.com/orgs/coreui/people)
@@ -4,0 +4,0 @@ * Licensed under MIT (https://github.com/coreui/coreui/blob/main/LICENSE)

js/src/base-component.js

@@ -20,3 +20,3 @@ /**
 
-const VERSION = '4.6.0-alpha.2'
+const VERSION = '4.6.0-beta.0'
 
@@ -23,0 +23,0 @@ /**

js/src/scrollspy.js

@@ -214,7 +214,7 @@ /**
 
-      const observableSection = SelectorEngine.findOne(anchor.hash, this._element)
+      const observableSection = SelectorEngine.findOne(decodeURI(anchor.hash), this._element)
 
       // ensure that the observableSection exists & is visible
       if (isVisible(observableSection)) {
-        this._targetLinks.set(anchor.hash, anchor)
+        this._targetLinks.set(decodeURI(anchor.hash), anchor)
         this._observableSections.set(anchor.hash, observableSection)
@@ -221,0 +221,0 @@ }

js/src/util/sanitizer.js

@@ -11,43 +11,2 @@ /**
 
-const uriAttributes = new Set([
-  'background',
-  'cite',
-  'href',
-  'itemtype',
-  'longdesc',
-  'poster',
-  'src',
-  'xlink:href'
-])
-
-/**
- * A pattern that recognizes a commonly useful subset of URLs that are safe.
- *
- * Shout-out to Angular https://github.com/angular/angular/blob/12.2.x/packages/core/src/sanitization/url_sanitizer.ts
- */
-const SAFE_URL_PATTERN = /^(?:(?:https?|mailto|ftp|tel|file|sms):|[^#&/:?]*(?:[#/?]|$))/i
-
-/**
- * A pattern that matches safe data URLs. Only matches image, video and audio types.
- *
- * Shout-out to Angular https://github.com/angular/angular/blob/12.2.x/packages/core/src/sanitization/url_sanitizer.ts
- */
-const DATA_URL_PATTERN = /^data:(?:image\/(?:bmp|gif|jpeg|jpg|png|tiff|webp)|video\/(?:mpeg|mp4|ogg|webm)|audio\/(?:mp3|oga|ogg|opus));base64,[\d+/a-z]+=*$/i
-
-const allowedAttribute = (attribute, allowedAttributeList) => {
-  const attributeName = attribute.nodeName.toLowerCase()
-
-  if (allowedAttributeList.includes(attributeName)) {
-    if (uriAttributes.has(attributeName)) {
-      return Boolean(SAFE_URL_PATTERN.test(attribute.nodeValue) || DATA_URL_PATTERN.test(attribute.nodeValue))
-    }
-
-    return true
-  }
-
-  // Check if a regular expression validates the attribute.
-  return allowedAttributeList.filter(attributeRegex => attributeRegex instanceof RegExp)
-    .some(regex => regex.test(attributeName))
-}
-
 // js-docs-start allow-list
@@ -91,2 +50,38 @@ const ARIA_ATTRIBUTE_PATTERN = /^aria-[\w-]*$/i
 
+const uriAttributes = new Set([
+  'background',
+  'cite',
+  'href',
+  'itemtype',
+  'longdesc',
+  'poster',
+  'src',
+  'xlink:href'
+])
+
+/**
+ * A pattern that recognizes URLs that are safe wrt. XSS in URL navigation
+ * contexts.
+ *
+ * Shout-out to Angular https://github.com/angular/angular/blob/15.2.8/packages/core/src/sanitization/url_sanitizer.ts#L38
+ */
+// eslint-disable-next-line unicorn/better-regex
+const SAFE_URL_PATTERN = /^(?!javascript:)(?:[a-z0-9+.-]+:|[^&:/?#]*(?:[/?#]|$))/i
+
+const allowedAttribute = (attribute, allowedAttributeList) => {
+  const attributeName = attribute.nodeName.toLowerCase()
+
+  if (allowedAttributeList.includes(attributeName)) {
+    if (uriAttributes.has(attributeName)) {
+      return Boolean(SAFE_URL_PATTERN.test(attribute.nodeValue))
+    }
+
+    return true
+  }
+
+  // Check if a regular expression validates the attribute.
+  return allowedAttributeList.filter(attributeRegex => attributeRegex instanceof RegExp)
+    .some(regex => regex.test(attributeName))
+}
+
 export function sanitizeHtml(unsafeHtml, allowList, sanitizeFunction) {
@@ -93,0 +88,0 @@ if (!unsafeHtml.length) {

package.json

 {
   "name": "@coreui/coreui-pro",
   "description": "The most popular front-end framework for developing responsive, mobile-first projects on the web rewritten by the CoreUI Team",
-  "version": "4.6.0-alpha.2",
+  "version": "4.6.0-beta.0",
   "config": {
@@ -61,3 +61,3 @@ "version_short": "4.6"
     "lockfile-lint": "lockfile-lint --allowed-hosts npm --allowed-schemes https: --empty-hostname false --type npm --path package-lock.json",
-    "update-deps": "ncu -u -x globby,karma-browserstack-launcher,karma-rollup-preprocessor,terser && echo Manually update docs/assets/js/vendor",
+    "update-deps": "ncu -u -x globby,jasmine,karma-browserstack-launcher,karma-rollup-preprocessor,terser && echo Manually update docs/assets/js/vendor",
     "release": "npm-run-all dist release-sri docs-build release-zip*",
@@ -94,8 +94,8 @@ "release-sri": "node build/generate-sri.js",
     "@babel/cli": "^7.21.5",
-    "@babel/core": "^7.21.8",
-    "@babel/preset-env": "^7.21.5",
-    "@popperjs/core": "^2.11.7",
+    "@babel/core": "^7.22.1",
+    "@babel/preset-env": "^7.22.4",
+    "@popperjs/core": "^2.11.8",
     "@rollup/plugin-babel": "^6.0.3",
-    "@rollup/plugin-commonjs": "^24.1.0",
-    "@rollup/plugin-node-resolve": "^15.0.2",
+    "@rollup/plugin-commonjs": "^25.0.0",
+    "@rollup/plugin-node-resolve": "^15.1.0",
     "@rollup/plugin-replace": "^5.0.2",
@@ -107,3 +107,3 @@ "autoprefixer": "^10.4.14",
     "date-fns": "^2.30.0",
-    "eslint": "^8.39.0",
+    "eslint": "^8.41.0",
     "eslint-config-xo": "^0.43.1",
@@ -113,10 +113,10 @@ "eslint-plugin-html": "^7.1.0",
     "eslint-plugin-markdown": "^3.0.0",
-    "eslint-plugin-unicorn": "^46.0.0",
+    "eslint-plugin-unicorn": "^47.0.0",
     "find-unused-sass-variables": "^5.0.0",
     "globby": "^11.1.0",
     "hammer-simulator": "0.0.1",
-    "hugo-bin": "^0.102.0",
+    "hugo-bin": "^0.104.0",
     "ip": "^2.0.0",
     "jasmine": "^4.6.0",
-    "jquery": "^3.6.4",
+    "jquery": "^3.7.0",
     "karma": "^6.4.2",
@@ -131,9 +131,9 @@ "karma-browserstack-launcher": "1.6.0",
     "karma-rollup-preprocessor": "7.0.8",
-    "lockfile-lint": "^4.10.1",
+    "lockfile-lint": "^4.10.5",
     "nodemon": "^2.0.22",
     "npm-run-all": "^4.1.5",
-    "postcss": "^8.4.23",
+    "postcss": "^8.4.24",
     "postcss-cli": "^10.1.0",
     "postcss-combine-duplicated-selectors": "^10.0.3",
-    "rollup": "^3.21.5",
+    "rollup": "^3.23.0",
     "rollup-plugin-istanbul": "^4.0.0",
@@ -144,5 +144,5 @@ "rtlcss": "^4.1.0",
     "shelljs": "^0.8.5",
-    "stylelint": "^15.6.1",
+    "stylelint": "^15.6.2",
     "stylelint-config-twbs-bootstrap": "^10.0.0",
-    "terser": "5.17.1",
+    "terser": "5.17.6",
     "vnu-jar": "23.4.11"
@@ -149,0 +149,0 @@ },

README.md

@@ -46,7 +46,7 @@ <p align="center">
 
-- [Download the latest release](https://github.com/coreui/coreui-pro/archive/v4.6.0-alpha.2.zip)
+- [Download the latest release](https://github.com/coreui/coreui-pro/archive/v4.6.0-beta.0.zip)
 - Clone the repo: `git clone https://github.com/coreui/coreui.git`
 - Install with [npm](https://www.npmjs.com/): `npm install @coreui/coreui`
 - Install with [yarn](https://yarnpkg.com/): `yarn add @coreui/coreui`
-- Install with [Composer](https://getcomposer.org/): `composer require coreui/coreui:4.6.0-alpha.2`
+- Install with [Composer](https://getcomposer.org/): `composer require coreui/coreui:4.6.0-beta.0`
 
@@ -53,0 +53,0 @@ Read the [Getting started page](https://coreui.io/docs/getting-started/introduction/) for information on the framework contents, templates and examples, and more.

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Worsened metrics

Total package byte prevSize

14675716

decreased by-0.1%

Lines of code

99248

decreased by-0.02%

No dependency changes