#3987bb2560f1 - Change the h field of CompiledTemplates to a TemplateStringsArray preventing the spoofing of CompiledTemplates by JSON injection attacks. This should not be a breaking change for most users unless you're using CompiledTemplates. This is a necessary security fix, similar to #2307.
lit@2.7.5
Patch Changes
#3917f6387e35 - Allow decorators to accept ReactiveElement class from a different source.
lit-html@2.7.5
Patch Changes
#39685bb40831 - Allow undefined to be passed to the ref() directive
#3987bb2560f1 - Change the h field of CompiledTemplates to a TemplateStringsArray preventing the spoofing of CompiledTemplates by JSON injection attacks. This should not be a breaking change for most users unless you're using CompiledTemplates. This is a necessary security fix, similar to #2307.
lit@2.7.4
Patch Changes
#3871308280eb - remove test directory from npm publication
lit-html@2.7.4
Patch Changes
#38880f30e6fb - Fix a memory leak cause by lit-html's shared TreeWalker holding a reference to the last tree it walked.
lit-html@2.7.3
Patch Changes
#3825343187b1 - static-html no longer adds an item to TemplateResult's value array for the last consumed static value. This fixes an error with server-side rendering of static html.
#37664431cbb8 - Fix styleMap initial render of mixed-case custom props
lit@2.7.3
Patch Changes
#3825343187b1 - static-html no longer adds an item to TemplateResult's value array for the last consumed static value. This fixes an error with server-side rendering of static html.
#37664431cbb8 - Fix styleMap initial render of mixed-case custom props
#3987bb2560f1 - Change the h field of CompiledTemplates to a TemplateStringsArray preventing the spoofing of CompiledTemplates by JSON injection attacks. This should not be a breaking change for most users unless you're using CompiledTemplates. This is a necessary security fix, similar to #2307.
2.7.5
Patch Changes
#3917f6387e35 - Allow decorators to accept ReactiveElement class from a different source.
2.7.4
Patch Changes
#3871308280eb - remove test directory from npm publication
2.7.3
Patch Changes
#3825343187b1 - static-html no longer adds an item to TemplateResult's value array for the last consumed static value. This fixes an error with server-side rendering of static html.
#37664431cbb8 - Fix styleMap initial render of mixed-case custom props
2.7.2
Patch Changes
#378888fe0390 - Allow numbers to be used as values in styleMap()
2.7.1
Patch Changes
#37687c1191da - Fix styleMap's handling of important flags
#3720575fb578 - lit-html/experimental-hydrate.js and lit-element/experimental-hydrate-support.js have been moved to @lit-labs/ssr-client.
The modules in the original location have been marked deprecated and will be removed in a future version.
This version was pushed to npm by lit-robot, a new releaser for lit since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot]
commented
1 year ago
Bumps lit from 2.0.2 to 2.7.6.
Release notes
Sourced from lit's releases.
... (truncated)
Changelog
Sourced from lit's changelog.
... (truncated)
Commits
84df6efVersion Packages (#3990)06288adVersion Packages (#3932)a42e005Version Packages (#3878)308280e[lit] remove test directory from npm publication (#3871)36544f5Version Packages (#3841)21e22ccVersion Packages (#3791)c3b7123Version Packages (#3778)b877318Version Packages (#3717)7754407Version Packages (#3563)65e5665[lit-html] disabled shadydom nopatch in node dev build (#3526)Maintainer changes
This version was pushed to npm by lit-robot, a new releaser for lit since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)