@lwc/shared - npm Package Compare versions

Comparing version 8.20.4 to 8.20.5

dist/index.cjs.js

@@ -774,3 +774,3 @@ /**
 // Increment whenever the LWC template compiler changes
-const LWC_VERSION = "8.20.4";
+const LWC_VERSION = "8.20.5";
 const LWC_VERSION_COMMENT = `LWC compiler v${LWC_VERSION}`;
@@ -906,2 +906,8 @@ const LWC_VERSION_COMMENT_REGEX = /\/\*LWC compiler v([\d.]+)\*\/\s*}/;
     trustedSignals = signals;
+    // Only used in LWC's Karma. Contained within the set function as there are multiple imports of
+    // this module. Placing it here ensures we reference the import where the trustedSignals set is maintained
+    if (process.env.NODE_ENV === 'test-karma-lwc') {
+        // Used to reset the global state between test runs
+        globalThis.__lwcResetTrustedSignalsSetForTest = () => (trustedSignals = undefined);
+    }
 }
@@ -912,3 +918,11 @@ function addTrustedSignal(signal) {
 }
-function isTrustedSignal(target) {
+/**
+ * The legacy validation behavior was that this check should only
+ * be performed for runtimes that have provided a trustedSignals set.
+ * However, this resulted in a bug as all object values were
+ * being considered signals in environments where the trustedSignals
+ * set had not been defined. The runtime flag has been added as a killswitch
+ * in case the fix needs to be reverted.
+ */
+function legacyIsTrustedSignal(target) {
     if (!trustedSignals) {
@@ -922,2 +936,8 @@ // The runtime didn't set a trustedSignals set
 }
+function isTrustedSignal(target) {
+    if (!trustedSignals) {
+        return false;
+    }
+    return trustedSignals.has(target);
+}
 
@@ -1086,2 +1106,3 @@ /*
 exports.keys = keys;
+exports.legacyIsTrustedSignal = legacyIsTrustedSignal;
 exports.noop = noop;
@@ -1100,3 +1121,3 @@ exports.normalizeClass = normalizeClass;
 exports.toString = toString;
-/** version: 8.20.4 */
+/** version: 8.20.5 */
 //# sourceMappingURL=index.cjs.js.map

dist/index.js

@@ -770,3 +770,3 @@ /**
 // Increment whenever the LWC template compiler changes
-const LWC_VERSION = "8.20.4";
+const LWC_VERSION = "8.20.5";
 const LWC_VERSION_COMMENT = `LWC compiler v${LWC_VERSION}`;
@@ -902,2 +902,8 @@ const LWC_VERSION_COMMENT_REGEX = /\/\*LWC compiler v([\d.]+)\*\/\s*}/;
     trustedSignals = signals;
+    // Only used in LWC's Karma. Contained within the set function as there are multiple imports of
+    // this module. Placing it here ensures we reference the import where the trustedSignals set is maintained
+    if (process.env.NODE_ENV === 'test-karma-lwc') {
+        // Used to reset the global state between test runs
+        globalThis.__lwcResetTrustedSignalsSetForTest = () => (trustedSignals = undefined);
+    }
 }
@@ -908,3 +914,11 @@ function addTrustedSignal(signal) {
 }
-function isTrustedSignal(target) {
+/**
+ * The legacy validation behavior was that this check should only
+ * be performed for runtimes that have provided a trustedSignals set.
+ * However, this resulted in a bug as all object values were
+ * being considered signals in environments where the trustedSignals
+ * set had not been defined. The runtime flag has been added as a killswitch
+ * in case the fix needs to be reverted.
+ */
+function legacyIsTrustedSignal(target) {
     if (!trustedSignals) {
@@ -918,2 +932,8 @@ // The runtime didn't set a trustedSignals set
 }
+function isTrustedSignal(target) {
+    if (!trustedSignals) {
+        return false;
+    }
+    return trustedSignals.has(target);
+}
 
@@ -974,4 +994,4 @@ /*
 
-export { AMBIGUOUS_PROP_SET, AriaAttrNameToPropNameMap, AriaPropNameToAttrNameMap, ArrayConcat, ArrayCopyWithin, ArrayEvery, ArrayFill, ArrayFilter, ArrayFind, ArrayFindIndex, ArrayFrom, ArrayIncludes, ArrayIndexOf, ArrayJoin, ArrayMap, ArrayPop, ArrayPush, ArrayReduce, ArrayReverse, ArrayShift, ArraySlice, ArraySome, ArraySort, ArraySplice, ArrayUnshift, ContextEventName, DEFAULT_SSR_MODE, DISALLOWED_PROP_SET, HIGHEST_API_VERSION, HTML_NAMESPACE, ID_REFERENCING_ATTRIBUTES_SET, IMPORTANT_FLAG, KEY__LEGACY_SHADOW_TOKEN, KEY__LEGACY_SHADOW_TOKEN_PRIVATE, KEY__NATIVE_GET_ELEMENT_BY_ID, KEY__NATIVE_ONLY_CSS, KEY__NATIVE_QUERY_SELECTOR_ALL, KEY__SCOPED_CSS, KEY__SHADOW_RESOLVER, KEY__SHADOW_RESOLVER_PRIVATE, KEY__SHADOW_STATIC, KEY__SHADOW_STATIC_PRIVATE, KEY__SHADOW_TOKEN, KEY__SHADOW_TOKEN_PRIVATE, KEY__SYNTHETIC_MODE, LOWEST_API_VERSION, LWC_VERSION, LWC_VERSION_COMMENT, LWC_VERSION_COMMENT_REGEX, MATHML_NAMESPACE, REFLECTIVE_GLOBAL_PROPERTY_SET, SPECIAL_PROPERTY_ATTRIBUTE_MAPPING, SVG_NAMESPACE, StringCharAt, StringCharCodeAt, StringFromCharCode, StringReplace, StringSlice, StringSplit, StringToLowerCase, StringTrim, XLINK_NAMESPACE, XML_NAMESPACE, addTrustedContext, addTrustedSignal, arrayEvery, assert, assign, create, defineProperties, defineProperty, entries, flattenStylesheets, forEach, freeze, fromEntries, generateCustomElementTagName, getAPIVersionFromNumber, getContextKeys, getOwnPropertyDescriptor, getOwnPropertyDescriptors, getOwnPropertyNames, getOwnPropertySymbols, getPropertyDescriptor, getPrototypeOf, hasOwnProperty, htmlEscape, htmlPropertyToAttribute, isAPIFeatureEnabled, isAriaAttribute, isArray, isBoolean, isBooleanAttribute, isFalse, isFrozen, isFunction, isGlobalHtmlAttribute, isNull, isNumber, isObject, isString, isTrue, isTrustedContext, isTrustedSignal, isUndefined, isVoidElement, kebabCaseToCamelCase, keys, noop, normalizeClass, normalizeStyleAttributeValue, normalizeTabIndex, parseStyleText, sanitizeHtmlContent, seal, setContextKeys, setHooks, setPrototypeOf, setTrustedContextSet, setTrustedSignalSet, toString };
-/** version: 8.20.4 */
+export { AMBIGUOUS_PROP_SET, AriaAttrNameToPropNameMap, AriaPropNameToAttrNameMap, ArrayConcat, ArrayCopyWithin, ArrayEvery, ArrayFill, ArrayFilter, ArrayFind, ArrayFindIndex, ArrayFrom, ArrayIncludes, ArrayIndexOf, ArrayJoin, ArrayMap, ArrayPop, ArrayPush, ArrayReduce, ArrayReverse, ArrayShift, ArraySlice, ArraySome, ArraySort, ArraySplice, ArrayUnshift, ContextEventName, DEFAULT_SSR_MODE, DISALLOWED_PROP_SET, HIGHEST_API_VERSION, HTML_NAMESPACE, ID_REFERENCING_ATTRIBUTES_SET, IMPORTANT_FLAG, KEY__LEGACY_SHADOW_TOKEN, KEY__LEGACY_SHADOW_TOKEN_PRIVATE, KEY__NATIVE_GET_ELEMENT_BY_ID, KEY__NATIVE_ONLY_CSS, KEY__NATIVE_QUERY_SELECTOR_ALL, KEY__SCOPED_CSS, KEY__SHADOW_RESOLVER, KEY__SHADOW_RESOLVER_PRIVATE, KEY__SHADOW_STATIC, KEY__SHADOW_STATIC_PRIVATE, KEY__SHADOW_TOKEN, KEY__SHADOW_TOKEN_PRIVATE, KEY__SYNTHETIC_MODE, LOWEST_API_VERSION, LWC_VERSION, LWC_VERSION_COMMENT, LWC_VERSION_COMMENT_REGEX, MATHML_NAMESPACE, REFLECTIVE_GLOBAL_PROPERTY_SET, SPECIAL_PROPERTY_ATTRIBUTE_MAPPING, SVG_NAMESPACE, StringCharAt, StringCharCodeAt, StringFromCharCode, StringReplace, StringSlice, StringSplit, StringToLowerCase, StringTrim, XLINK_NAMESPACE, XML_NAMESPACE, addTrustedContext, addTrustedSignal, arrayEvery, assert, assign, create, defineProperties, defineProperty, entries, flattenStylesheets, forEach, freeze, fromEntries, generateCustomElementTagName, getAPIVersionFromNumber, getContextKeys, getOwnPropertyDescriptor, getOwnPropertyDescriptors, getOwnPropertyNames, getOwnPropertySymbols, getPropertyDescriptor, getPrototypeOf, hasOwnProperty, htmlEscape, htmlPropertyToAttribute, isAPIFeatureEnabled, isAriaAttribute, isArray, isBoolean, isBooleanAttribute, isFalse, isFrozen, isFunction, isGlobalHtmlAttribute, isNull, isNumber, isObject, isString, isTrue, isTrustedContext, isTrustedSignal, isUndefined, isVoidElement, kebabCaseToCamelCase, keys, legacyIsTrustedSignal, noop, normalizeClass, normalizeStyleAttributeValue, normalizeTabIndex, parseStyleText, sanitizeHtmlContent, seal, setContextKeys, setHooks, setPrototypeOf, setTrustedContextSet, setTrustedSignalSet, toString };
+/** version: 8.20.5 */
 //# sourceMappingURL=index.js.map

dist/signals.d.ts

 export declare function setTrustedSignalSet(signals: WeakSet<object>): void;
 export declare function addTrustedSignal(signal: object): void;
+/**
+ * The legacy validation behavior was that this check should only
+ * be performed for runtimes that have provided a trustedSignals set.
+ * However, this resulted in a bug as all object values were
+ * being considered signals in environments where the trustedSignals
+ * set had not been defined. The runtime flag has been added as a killswitch
+ * in case the fix needs to be reverted.
+ */
+export declare function legacyIsTrustedSignal(target: object): boolean;
 export declare function isTrustedSignal(target: object): boolean;
 //# sourceMappingURL=signals.d.ts.map

package.json

@@ -7,3 +7,3 @@ {
     "name": "@lwc/shared",
-    "version": "8.20.4",
+    "version": "8.20.5",
     "description": "Utilities and methods that are shared across packages",
@@ -49,2 +49,2 @@ "keywords": [
     }
-}
+}

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Unidentified License

License

Something that seems like a license was found, but its contents could not be matched with a known license.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Unidentified License

License

Something that seems like a license was found, but its contents could not be matched with a known license.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

125511

1.99%

Lines of code

2714

1.88%

Worsened metrics

Number of low supply chain risk alerts

11

22.22%

No dependency changes