Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
react-serialize-unsupported-attributes
Advanced tools
React does not support a bunch of deprecated HTML attributes that are still supported in the browser and are still widely used in HTML emails.
This list includes:
xmlns
align
valign
bgcolor
border
If you pass one of these to a JSX component. It will just drop them when it goes to render. This can be a pain. If you put your mind to it. You can inject these elements into React. Here is an example of what tha can look like. React will now include these properties when rendering to the DOM.
But guess what. If you want to any server-side rendering or just serialize your components to strings in the browser, ReactDOM will forget about these injected properties.
As a result, you end up with something like this:
import { renderToStaticMarkup } from 'react-dom/server';
renderToStaticMarkup(<div width="100%" border="0"></div>); // returns '<div width="100%"></div>';
Bummer. We silently lost the border
attribute.
But, if you use this wonderful library, everything is preserved.
render(<div width="100%" border="0"></div>); // returns '<div width="100%" border="0"></div>';
Well, we traverse down the component tree and rename every unsupport tag—prefixing it with data-unsupported-attr-
. Data attributes are kept in tact. We then render it usering ReactDOM and strip out all of the prefixes and we're good to go.
FAQs
Render markup with deprecated attributes.
The npm package react-serialize-unsupported-attributes receives a total of 1 weekly downloads. As such, react-serialize-unsupported-attributes popularity was classified as not popular.
We found that react-serialize-unsupported-attributes demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.