chore: sync upstream (coreui v5.9.0)#622
Merged
Merged
Conversation
* docs: add AI Tools (MCP) getting-started page * docs: clarify --base-url description
* docs: expand AI Tools (MCP) page with per-client setup and examples * docs: add LLMs.txt getting-started page * docs: group MCP + LLMs.txt under a dedicated AI Tools section
…rop stale v4 label) (#1114)
Add two reusable primitives next to sanitizeHtml/DefaultAllowlist so components stop defining their own copies: - escapeHtml(text) — HTML-escape a string (attributes and text content). - SVGAllowlist — DefaultAllowlist extended with SVG elements, consumed by Chip's icon sanitizer. Kept byte-identical to the Pro edition's util/sanitizer.js so the free -> pro sync stays conflict-free.
selectedIcon and removeIcon (settable via data-coreui-* attributes) were written to innerHTML with no sanitizer, unlike rating.js. Add sanitize / allowList / sanitizeFn options (SVG-aware allow list), route both icons through sanitizeHtml, and strip sanitize/allowList/sanitizeFn from data attributes so the sanitizer can't be disabled from markup.
… (#1121) Array.prototype.at() requires Chrome 92 / Safari 15.4 / iOS 15.4, but .browserslistrc declares Chrome >= 60 and Safari >= 12, and the build does not polyfill (no useBuiltIns). Replace .at(-1) with index access so ChipInput and ChipSet run on the supported browsers.
…rties (#1123) Guards against reintroducing .at(), which is unsupported in the browsers declared in .browserslistrc (Chrome < 92, Safari < 15.4) and is not polyfilled by the build.
Hover/focus-triggered tooltips (and popovers, which extend Tooltip) could not be dismissed by keyboard. Backport Bootstrap 6's pattern: on show, add a document keydown listener in the capture phase (_setEscapeListener); on Escape (while shown) preventDefault + stopPropagation and hide(); removed on hide/dispose. Capture phase dismisses the tooltip before an ancestor dialog's own Esc handler. Ported Bootstrap 6's three tests + documented the behavior in the tooltip/popover docs.
Pin every action to an immutable 40-char commit SHA (with a version comment), matching upstream Bootstrap. A mutable tag (`@v2`) lets the action's author — or an attacker who compromises it — repoint it to malicious code that runs in CI (cf. the tj-actions/changed-files attack); `coverallsapp` is highest-risk as it receives GITHUB_TOKEN + checks:write. Dependabot's existing weekly grouped github-actions updates maintain the SHAs going forward.
Follow-up to the SHA-pin sweep: upgrade the actions that were stale or split across majors. `actions/checkout` is unified to v7.0.0 (was inconsistently v4 in codeql.yml and v6 elsewhere; v7 matches upstream Bootstrap); `actions/stale` jumps v3 → v10.4.0 (7 majors); `linkinator-action` v1 → v2.4.2. Config inputs verified compatible for each. setup-node stays v6.5.0 (Bootstrap is also on v6).
Bump astro to ^7.1.1, @astrojs/mdx to ^7.0.3, and the docs engine @coreui/astro-docs to 0.1.0.
The Astro docs migration dropped the old `preview_component` flag, which the engine now exposes as `preRelease`. Re-add `preRelease: true` to Chip, Chip Set, Search Button and Chip Input so the 'Release candidate (RC)' banner shows again, matching the React and Vue editions.
astro ^7.1.2, autoprefixer ^10.5.4, eslint ^9.39.5, globby ^16.2.2, postcss ^8.5.20, terser 5.49.0.
Leftover from the Bootstrap fork; nothing reads it (no build script, docs config, or npm_package_config_* consumer) since the docs moved from Hugo to Astro.
# Conflicts: # .bundlewatch.config.json # .github/workflows/stale.yml # README.md # config.yml # dist/css/coreui-grid.css # dist/css/coreui-grid.css.map # dist/css/coreui-grid.min.css # dist/css/coreui-grid.min.css.map # dist/css/coreui-grid.rtl.css # dist/css/coreui-grid.rtl.css.map # dist/css/coreui-grid.rtl.min.css # dist/css/coreui-grid.rtl.min.css.map # dist/css/coreui-reboot.css # dist/css/coreui-reboot.css.map # dist/css/coreui-reboot.min.css # dist/css/coreui-reboot.min.css.map # dist/css/coreui-reboot.rtl.css # dist/css/coreui-reboot.rtl.css.map # dist/css/coreui-reboot.rtl.min.css # dist/css/coreui-reboot.rtl.min.css.map # dist/css/coreui-utilities.css # dist/css/coreui-utilities.css.map # dist/css/coreui-utilities.min.css # dist/css/coreui-utilities.min.css.map # dist/css/coreui-utilities.rtl.css # dist/css/coreui-utilities.rtl.css.map # dist/css/coreui-utilities.rtl.min.css # dist/css/coreui-utilities.rtl.min.css.map # dist/css/coreui.css # dist/css/coreui.css.map # dist/css/coreui.min.css # dist/css/coreui.min.css.map # dist/css/coreui.rtl.css # dist/css/coreui.rtl.css.map # dist/css/coreui.rtl.min.css # dist/css/coreui.rtl.min.css.map # dist/css/themes/bootstrap/bootstrap.css # dist/css/themes/bootstrap/bootstrap.css.map # dist/css/themes/bootstrap/bootstrap.min.css # dist/css/themes/bootstrap/bootstrap.min.css.map # dist/css/themes/bootstrap/bootstrap.rtl.css # dist/css/themes/bootstrap/bootstrap.rtl.css.map # dist/css/themes/bootstrap/bootstrap.rtl.min.css # dist/css/themes/bootstrap/bootstrap.rtl.min.css.map # dist/js/bootstrap.bundle.js # dist/js/bootstrap.bundle.js.map # dist/js/bootstrap.bundle.min.js # dist/js/bootstrap.bundle.min.js.map # dist/js/bootstrap.esm.js # dist/js/bootstrap.esm.js.map # dist/js/bootstrap.esm.min.js # dist/js/bootstrap.esm.min.js.map # dist/js/bootstrap.js # dist/js/bootstrap.js.map # dist/js/bootstrap.min.js # dist/js/bootstrap.min.js.map # dist/js/coreui.bundle.js # dist/js/coreui.bundle.js.map # dist/js/coreui.bundle.min.js # dist/js/coreui.bundle.min.js.map # dist/js/coreui.esm.js # dist/js/coreui.esm.js.map # dist/js/coreui.esm.min.js # dist/js/coreui.esm.min.js.map # dist/js/coreui.js # dist/js/coreui.js.map # dist/js/coreui.min.js # dist/js/coreui.min.js.map # js/dist/alert.js # js/dist/base-component.js # js/dist/base-component.js.map # js/dist/button.js # js/dist/carousel.js # js/dist/chip-input.js # js/dist/chip-set.js # js/dist/chip.js # js/dist/collapse.js # js/dist/dom/data.js # js/dist/dom/event-handler.js # js/dist/dom/manipulator.js # js/dist/dom/selector-engine.js # js/dist/dropdown.js # js/dist/modal.js # js/dist/navigation.js # js/dist/offcanvas.js # js/dist/popover.js # js/dist/scrollspy.js # js/dist/search-button.js # js/dist/sidebar.js # js/dist/tab.js # js/dist/toast.js # js/dist/tooltip.js # js/dist/util/backdrop.js # js/dist/util/component-functions.js # js/dist/util/config.js # js/dist/util/focustrap.js # js/dist/util/index.js # js/dist/util/sanitizer.js # js/dist/util/scrollbar.js # js/dist/util/swipe.js # js/dist/util/template-factory.js # js/src/base-component.js # package-lock.json # package.js # package.json # scss/_banner.scss
Coverage Report for CI Build 29747378497Warning Build has drifted: This PR's base is out of sync with its target branch, so coverage data may include unrelated changes. Coverage decreased (-0.02%) to 94.605%Details
Uncovered ChangesNo uncovered changes found. Coverage Regressions1 previously-covered line in 1 file lost coverage.
Coverage Stats
💛 - Coveralls |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Free → Pro sync: merges
upstream/main(coreui) up to the v5.9.0 release into coreui-pro to advance the merge-base.Most library fixes (Tooltip Escape/WCAG, Chip sanitize, sanitizer escapeHtml+SVGAllowlist) were already applied to pro in parallel, so the content diff is small. Genuine changes: free-base CDN references in
config.ymlbumped to 5.9.0 (new SRI), devDependency bumps (eslint 9.39.5, terser 5.49.0), rebuiltdist/. Pro-specific bits preserved: version 5.26.0,cdn_pro/cdn_pro_themes, bundlewatch thresholds, no stale.yml.Merge with a merge commit (
--merge), NOT squash — squashing would leave the merge-base behind and re-conflict every future sync.