
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
svelte-floating-ui
Advanced tools
Floating UI for Svelte with actions. No wrapper components or component bindings required!
npm i svelte-floating-ui
This is not yet published on npm
Since Svelte automatically bundles all required dependencies, you only need to install this package as a dev dependency with the -D flag.
createFloatingActions
takes an optional options object for configuring the content placement. The content action also takes an optional options object for updating the options of the content placement.
createFloatingActions
also returns an update
method as it's third value which can be used to manually update the content position.
<script lang="ts">
import { offset, flip, shift } from "@floating-ui/dom";
import { createFloatingActions } from "svelte-floating-ui";
const [ floatingRef, floatingContent ] = createFloatingActions({
strategy: "absolute",
placement: "top",
middleware: [
offset(6),
flip(),
shift(),
]
});
let showTooltip: boolean = false;
</script>
<button
on:mouseenter={() => showTooltip = true}
on:mouseleave={() => showTooltip = false}
use:floatingRef
>Hover me</button>
{#if showTooltip}
<div style="position:absolute" use:floatingContent>
Tooltip
</div>
{/if}
Floating UI options can be set statically when creating the actions, or dynamically on the content action.
If both are set, then the dynamic options will be merged with the initial options.
<script>
// set once and no longer updated
const [ floatingRef, floatingContent ] = createFloatingActions(initOptions);
</script>
<!-- will be merged with initOptions -->
<div use:floatingContent={ dynamicOptions }/>
The content element's position can be manually updated by using the third value returned by createFloatingActions
. This method takes an optional options object which will be merged with the initial options.
<script>
// Get update method
const [ floatingRef, floatingContent, update] = createFloatingActions(initOptions);
update(updateOptions)
</script>
To apply styles manually, you can pass the onComputed
option to createFloatingActions
. This is a function that recieves a ComputePositionReturn
. This function is called every time the tooltip's position is computed.
See Arrow Middleware for an example on it's usage.
For convenience, a custom Arrow middleware is provided. Rather than accepting an HTMLElement
, this takes a Writable<HTMLElement>
. Otherwise, this middleware works exactly as the regular Floating UI one, including needing to manually set the arrow styles.
To set the styles, you can pass the onComputed
option. The below implementation is copied from the Floating UI Tutorial.
<script>
import { writable } from "svelte/store";
import { arrow } from "svelte-floating-ui";
const arrowRef = writable(null);
const [ floatingRef, floatingContent, update] = createFloatingActions({
strategy: "absolute",
placement: "bottom",
middleware: [
arrow({ element: arrowRef })
],
onComputed({ placement, middlewareData }) {
const { x, y } = middlewareData.arrow;
const staticSide = {
top: 'bottom',
right: 'left',
bottom: 'top',
left: 'right',
}[placement.split('-')[0]];
Object.assign($arrowRef.style, {
left: x != null ? `${x}px` : "",
top: y != null ? `${y}px` : "",
[staticSide]: "-4px"
});
}
});
</script>
<button
on:mouseenter={() => showTooltip = true}
on:mouseleave={() => showTooltip = false}
use:floatingRef
>Hover me</button>
{#if showTooltip}
<div class="tooltip" use:floatingContent>
Tooltip this is some longer text than the button
<div class="arrow" bind:this={$arrowRef} />
</div>
{/if}
FAQs
Svelte actions for working with floating ui
The npm package svelte-floating-ui receives a total of 27,700 weekly downloads. As such, svelte-floating-ui popularity was classified as popular.
We found that svelte-floating-ui demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.