Skip to content

Release 2.12.2#4377

Merged
thisisdano merged 75 commits into
mainfrom
release-2.12.2
Nov 1, 2021
Merged

Release 2.12.2#4377
thisisdano merged 75 commits into
mainfrom
release-2.12.2

Conversation

@thisisdano

@thisisdano thisisdano commented Oct 29, 2021

Copy link
Copy Markdown
Contributor

What's new in USWDS 2.12.2

Improvements and bug fixes

Security and dependencies

  • Added automatic sanitizing. The design system now automatically sanitizes content in elements we compose with JavaScript. This means that components like Combobox, Tooltip, File Input, and Date Picker will sanitize any content passed to them. This helps protect any design system implementation against malicious XSS attacks through these components. (USWDS | xss audit, standardization #4329)

Dependencies

Package Old New
@babel/preset-env 7.15.0 7.15.8
@types/node 16.6.1 16.11.6
autoprefixer 10.3.1 10.3.7
axe-core 4.3.2 4.3.4
chrome-launcher 0.14.0 0.14.1
eslint-plugin-import 2.24.0 2.25.2
eslint-plugin-no-unsanitized 3.1.5 3.2.0
gulp-postcss 9.0.0 9.0.1
mocha 9.0.3 9.1.3
postcss 8.3.6 8.3.11
prettier 2.3.2 2.4.1
sass 1.38.0 1.43.4
snyk 1.683.0 1.746.0
stylelint-scss 3.20.1 3.21.0
typescript 4.3.5 4.4.4
yargs 17.1.1 17.2.1

0 vulnerabilities in regular dependencies (dependencies for USWDS projects installed with npm install uswds)

Internal only: 2 low, 12 moderate, 14 high, 1 critical vulnerabilities in devDependencies (development dependencies)

Release ZIP SHA-256 hash: 2c4a794c11dca65db04d6552312241ae6c397b7fd4ea5c8094698461d8d3f687

hilvitzs and others added 30 commits December 10, 2020 15:00
…m data attribute called 'errormessage' for a custom file type error message or to use the default value if one is not present
Use `textContent` instead of `innerHTML`.

Co-authored-by: Andrew Duthie <andrew@andrewduthie.com>
Update WHO_IS_USING_USWDS.md
USWDS - Collection: Removed href from fancy-date divs. Resolves #4285
Clarify intention of argument as defining anticipated background against which to constrast
USWDS - File Input - Add ability to use custom error message when wrong file type is used for file-input.js
James Mejia and others added 22 commits October 4, 2021 09:45
in alphabetic order 👍
Because it's only used for build
Dependencies: Move del to devDependencies
USWDS | xss audit, standardization
Date Input: Remove reference to deprecated `usa-input--inline`
USWDS - File Input: Creates unique ID per upload. Fixes #4144
USWDS - Dependencies: Update peer dependencies.
Add notification about tooltip content
@thisisdano thisisdano marked this pull request as ready for review October 29, 2021 19:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants