
Security News
Deno 2.6 + Socket: Supply Chain Defense In Your CLI
Deno 2.6 introduces deno audit with a new --socket flag that plugs directly into Socket to bring supply chain security checks into the Deno CLI.
@getodk/web-forms
Advanced tools
This package is a Vue component library that uses @getodk/xforms-engine to render ODK XForms. These forms are generally authored by end users in Excel using the XLSForm standard. Learn more on the ODK website and the ODK Web Form project's main README.
To use this library in a Vue.js application:
@getodk/web-forms as a dependency in the applicationapp.use(WebFormsPlugin) in entry component (usually App.vue)<OdkWebForm
:form-xml="formXml"
:fetch-form-attachment="fetchAttachment"
:missing-resource-behavior="missingBehavior"
:submission-max-size="5242880" <!-- 5MB -->
:edit-instance="editOptions"
@submit="handleSubmit"
@submit-chunked="handleChunkedSubmit"
/>
The plugin is there to initialize PrimeVue, currently it exposes no options. In the future, configuration options may be added to the plugin.
import { WebFormsPlugin } from '@getodk/web-forms';
app.use(WebFormsPlugin);
OdkWebFormsProps)The <OdkWebForm> component accepts the following props:
formXml (string, required): The XML of the ODK XForm to be renderedfetchFormAttachment (FetchFormAttachment, required): Function to fetch form attachmentsmissingResourceBehavior (MissingResourceBehavior, optional): Defines behavior when resources are missingsubmissionMaxSize (number, optional): Maximum size for chunked submissions. Required when subscribing to submitChunked eventeditInstance (EditInstanceOptions, optional): Options to resolve and load instance and attachment resources for editingOdkWebFormEmits)The component emits the following events:
submit: Emitted when the user presses the "Send" button on a valid form
submitChunked: Emitted for chunked submissions when the form is valid
submissionMaxSize prop to be setWe will eventually publish a framework-agnostic custom element.
To run in development, run this command at the monorepo root:
yarn workspace @getodk/web-forms dev
Individual test environments, and their corresponding watch modes, also have separate commands which can be found in package.json.
Upload XLSForm and XForm functionality in demo app and in dev mode depends on XLSForm-online. Run the xlsform-online locally. By default it runs on port 8000, if you are running it on another port then you should update the config file.
web-forms/
βββ public/ # Static assets (e.g., favicon.ico)
βββ src/
β βββ assets/
β β βββ images/ # Web Forms and Demo page images
β β βββ styles/ # Web Forms and Demo page styles
β βββ components/ # UI components
β β βββ form-elements/ # Form elements or controllers (question types, hints, labels, inputs)
β β βββ form-layout/ # Form layout and rendering (e.g., form panel, groups, repeats, form error classes)
β β βββ common/ # Reusable smaller components (e.g., icon, image, checkbox components)
β βββ demo/ # Demo page
β βββ lib/ # Utilities
β βββ index.ts
β βββ web-forms-plugin.ts # Vue plugin
βββ tests/ # Unit tests
βββ e2e/ # E2e tests
βββ package.json
βββ vite.config.ts
βββ playwright.config.ts
This project uses a combination of PrimeFlex and PrimeVue for consistent styling, alongside specific font rules for the ODK Website's Web Forms Preview.
We use CSS variables for theming with two prefixes:
--p- Prefix: Variables prefixed with --p- (e.g., --p-primary-50) come from PrimeVue and control its component styles (e.g., colors, borders). These are part of PrimeVueβs theming system.--odk- Prefix: Variables prefixed with --odk- (e.g., --odk-font-family) are custom to this project and manage styles outside PrimeVue or PrimeFlex, such as application-specific typography.This package uses a centralized z-index layering system to manage UI stacking order, defined in src/assets/styles/style.scss. The ODK variables (e.g., --odk-z-index-error-banner) ensure elements like floating error messages, form controls, and overlays stack correctly without overlap.
Key layers:
--odk-z-index-base (background)--odk-z-index-form-content (inputs, buttons)--odk-z-index-form-floating (highlights, tooltips)--odk-z-index-error-banner (floating errors)--odk-z-index-overlay (modals)--odk-z-index-topmost (loaders, notifications)Usage: Apply with z-index: var(--odk-z-index-error-banner); on positioned elements (e.g., position: absolute).
Form elements use font-family: Roboto, sans-serif; for accessibility and a clean, readable appearance.
This package uses the Material Design system for the UI, though not strictly. The idea is to closely match the design to that of ODK Collect.
The IconSVG component renders Material Design Icons (MDI) with customizable size and style variants. It uses the @mdi/js library for icon data and supports a predefined set of icons.
<IconSVG name="mdiCamera" size="md" variant="primary" />
To add a new icon:
@mdi/js in the IconSVG component.iconMap object with its corresponding name.name prop.Material Icons are available under the Apache License Version 2.0. Copy of the license can be found at ./src/assets/fonts/LICENSE-2.0.txt
FAQs
ODK Web Forms
The npm package @getodk/web-forms receives a total of 509 weekly downloads. As such, @getodk/web-forms popularity was classified as not popular.
We found that @getodk/web-forms demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Deno 2.6 introduces deno audit with a new --socket flag that plugs directly into Socket to bring supply chain security checks into the Deno CLI.

Security News
New DoS and source code exposure bugs in React Server Components and Next.js: whatβs affected and how to update safely.

Security News
Socket CEO Feross Aboukhadijeh joins Software Engineering Daily to discuss modern software supply chain attacks and rising AI-driven security risks.