
Research
/Security News
DuckDB npm Account Compromised in Continuing Supply Chain Attack
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
@spectrum-web-components/top-nav
Advanced tools
`<sp-top-nav>` delivers site navigation, particularly for when that navigation will change the majority of the page's content and/or the page's URL when selected. All primary elements of an `<sp-top-nav>` should be directly accessible in the tab order.
<sp-top-nav>
delivers site navigation, particularly for when that navigation will change the majority of the page's content and/or the page's URL when selected. All primary elements of an <sp-top-nav>
should be directly accessible in the tab order.
yarn add @spectrum-web-components/top-nav
Import the side effectful registration of <sp-top-nav>
and <sp-top-nav-item>
as follows:
import '@spectrum-web-components/top-nav/sp-top-nav.js';
import '@spectrum-web-components/top-nav/sp-top-nav-item.js';
When looking to leverage the TopNav
or TopNavItem
base classes as a type and/or for extension purposes, do so via:
import { TopNav, TopNavItem } from '@spectrum-web-components/top-nav';
<sp-top-nav>
<sp-top-nav-item href="#">Site Name</sp-top-nav-item>
<sp-top-nav-item href="#page-1" style="margin-inline-start: auto;">
Page 1
</sp-top-nav-item>
<sp-top-nav-item href="#page-2">Page 2</sp-top-nav-item>
<sp-top-nav-item href="#page-3">Page 3</sp-top-nav-item>
<sp-top-nav-item href="#page-4">Page with Really Long Name</sp-top-nav-item>
<sp-action-menu
label="Account"
placement="bottom-end"
style="margin-inline-start: auto;"
quiet
>
<sp-menu-item>Account Settings</sp-menu-item>
<sp-menu-item>My Profile</sp-menu-item>
<sp-menu-divider></sp-menu-divider>
<sp-menu-item>Share</sp-menu-item>
<sp-menu-divider></sp-menu-divider>
<sp-menu-item>Help</sp-menu-item>
<sp-menu-item>Sign Out</sp-menu-item>
</sp-action-menu>
</sp-top-nav>
1.7.0 (2025-06-11)
sp-overlay: Fixed : Overlays (like pickers and action menus) were incorrectly closing when scrolling occurred within components. The fix ensures the handleScroll
method in OverlayStack
only responds to document/body scrolling events and ignores component-level scrolling events, which was the original intention.
sp-card: Fixed: On mobile Chrome (both Android and iOS), scrolling on sp-card
components would inadvertently trigger click events. This was caused by the timing-based click detection (200ms threshold) in the pointer event handling, which could misinterpret quick scrolls as clicks. This issue did not affect Safari on mobile devices.
sp-action-button: - Fixed : Action buttons with href attributes now properly detects modifier keys and skips the proxy click, allowing only native browser behavior to proceed.
sp-styles: Remove unnecessary system theme references to reduce complexity for components that don't need the additional mapping layer.
sp-card: - Fixed: sp-card
component relies on sp-popover
for certain toggle interactive behaviors, but this dependency was missing from its dependency tree.
sp-menu: Fixes: Icons in menu stories weren't properly responding to theme changes when used in functional story components. Switching to class-based LitElement components ensures proper component lifecycle hooks and shadow DOM context for icon initialization and theme integration.
sp-tabs: Added @spectrum-web-components/action-button
as a dependency for Tabs as its used in the direction button.
sp-split-view: Added @spectrum-web-components/shared dependency in splitview since it uses ranDomId from the shared package
sp-textfield: Replace deprecated word-break: break-word
with overflow-wrap: break-word
to align with modern CSS standards and improve cross-browser compatibility. This property was deprecated in Chrome 44 (July 2015) in favor of the standardized overflow-wrap
property.
FAQs
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
Security News
The MCP Steering Committee has launched the official MCP Registry in preview, a central hub for discovering and publishing MCP servers.
Product
Socket’s new Pull Request Stories give security teams clear visibility into dependency risks and outcomes across scanned pull requests.