panel - npm Package Compare versions

Comparing version 1.6.6 to 1.7.0

build/router.js

@@ -19,2 +19,9 @@ "use strict";
 
+function decodedFragmentsEqual(currFragment, newFragment) {
+  // decodeURIComponent since hash fragments are encoded while being
+  // written to url, making `#bar baz` and `#bar%20baz` effectively the same.
+  // This can result in hash update loops if the client passes in decoded hash.
+  return decodeURIComponent(currFragment) === decodeURIComponent(newFragment);
+}
+
 // just the necessary bits of Backbone router+history
@@ -73,2 +80,3 @@
       this.origChangeStateMethod = this.window.history[this.historyMethod];
+
       this.window.history[this.historyMethod] = function () {
@@ -81,2 +89,5 @@ for (var _len = arguments.length, args = Array(_len), _key = 0; _key < _len; _key++) {
         _this.navigateToHash();
+        // fire "pushstate" or "replacestate" event so external action can be taken on url change
+        // these events are meant to be congruent with native "popstate" event
+        _this.app.dispatchEvent(new CustomEvent(_this.historyMethod.toLowerCase()));
       };
@@ -98,3 +109,3 @@ }
       fragment = stripHash(fragment);
-      if (fragment === this.app.state.$fragment && !Object.keys(stateUpdate).length) {
+      if (decodedFragmentsEqual(this.app.state.$fragment, fragment) && !Object.keys(stateUpdate).length) {
         return;
@@ -165,5 +176,10 @@ }
     value: function replaceHash(fragment) {
+      var _ref = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {},
+          _ref$historyMethod = _ref.historyMethod,
+          historyMethod = _ref$historyMethod === undefined ? null : _ref$historyMethod;
+
+      historyMethod = historyMethod || this.historyMethod;
       fragment = stripHash(fragment);
-      if (fragment !== stripHash(this.window.location.hash)) {
-        this.window.history[this.historyMethod](null, null, "#" + fragment);
+      if (!decodedFragmentsEqual(stripHash(this.window.location.hash), fragment)) {
+        this.window.history[historyMethod](null, null, "#" + fragment);
       }
@@ -170,0 +186,0 @@ }

lib/router.js

@@ -5,2 +5,9 @@ function stripHash(fragment) {
 
+function decodedFragmentsEqual(currFragment, newFragment) {
+  // decodeURIComponent since hash fragments are encoded while being
+  // written to url, making `#bar baz` and `#bar%20baz` effectively the same.
+  // This can result in hash update loops if the client passes in decoded hash.
+  return decodeURIComponent(currFragment) === decodeURIComponent(newFragment);
+}
+
 // just the necessary bits of Backbone router+history
@@ -50,5 +57,9 @@ export default class Router {
     this.origChangeStateMethod = this.window.history[this.historyMethod];
+
     this.window.history[this.historyMethod] = (...args) => {
       this.origChangeStateMethod.apply(this.window.history, args);
       this.navigateToHash();
+      // fire "pushstate" or "replacestate" event so external action can be taken on url change
+      // these events are meant to be congruent with native "popstate" event
+      this.app.dispatchEvent(new CustomEvent(this.historyMethod.toLowerCase()));
     };
@@ -64,3 +75,6 @@ }
     fragment = stripHash(fragment);
-    if (fragment === this.app.state.$fragment && !Object.keys(stateUpdate).length) {
+    if (
+      decodedFragmentsEqual(this.app.state.$fragment, fragment) &&
+      !Object.keys(stateUpdate).length
+    ) {
       return;
@@ -101,8 +115,9 @@ }
 
-  replaceHash(fragment) {
+  replaceHash(fragment, {historyMethod=null}={}) {
+    historyMethod = historyMethod || this.historyMethod;
     fragment = stripHash(fragment);
-    if (fragment !== stripHash(this.window.location.hash)) {
-      this.window.history[this.historyMethod](null, null, `#${fragment}`);
+    if (!decodedFragmentsEqual(stripHash(this.window.location.hash), fragment)) {
+      this.window.history[historyMethod](null, null, `#${fragment}`);
     }
   }
 }

package.json

 {
   "name": "panel",
-  "version": "1.6.6",
+  "version": "1.7.0",
   "description": "Web Components with Virtual DOM: lightweight composable web apps",
@@ -5,0 +5,0 @@ "main": "build/index.js",

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

Native code

Supply chain risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Found 1 instance in 1 package

Improved metrics

Lines of code

2752

increased by0.95%

Worsened metrics

Total package byte prevSize

124753

decreased by-3.43%

Number of package files

29

decreased by-3.33%

No dependency changes