This release contains a security fix. You must upgrade to this version if you use <RichTextField> with rich text data that isn't sanitized server-side.
[Security] Fix XSS vulnerability in <RichTextField> (#8645) (fzaninotto)
Fix <Pagination> cannot be used outside a ListContext (#7957) (schirrel)
Fix <ArrayField fullWidth> throws DOM error (#7549) (WiXSL)
Fix useSimpleFormIterator is not exported (#7515) (WiXSL)
[TypeScript] Fix useRecordContext may return undefined (#7495) (KoltesDigital)
[Doc] Fix Fields doc reference to getMany usage (#7773) (mfaywu)
This release contains a security fix. You must upgrade to this version if you use <RichTextField> with rich text data that isn't sanitized server-side.
[Security] Fix XSS vulnerability in <RichTextField> (#8645) (fzaninotto)
Fix <Pagination> cannot be used outside a ListContext (#7957) (schirrel)
Fix <ArrayField fullWidth> throws DOM error (#7549) (WiXSL)
Fix useSimpleFormIterator is not exported (#7515) (WiXSL)
[TypeScript] Fix useRecordContext may return undefined (#7495) (KoltesDigital)
[Doc] Fix Fields doc reference to getMany usage (#7773) (mfaywu)
React-admin v4 has upgraded all its dependencies to their latest major version. Some major dependencies were swapped (react-query instead of redux, react-hook-form instead of react-final-form). In addition, the lower layers of the react-admin code have been rewritten for better extensibility.
We've done our best to keep the general API of react-admin v4 similar with the v3 API. But the changes mentioned above result in many small compatibility breaks. An application built with react-admin v3 will need some work to run with react-admin v4.
Depending on the size of your v3 application, the upgrade will take between a few hours to a few days. If you use TypeScript, the migration will be much faster.
MUI v5
React-admin v4 uses MUI (Material-UI) v5. The MUI team has written an upgrade guide, which you should read to upgrade your material-ui code.
React-admin no longer relies on Redux. Instead, it relies on React context and third-party libraries (e.g. react-query).
You will need to update your code if it contains any of the following keywords:
createAdminStore
customReducers
customSagas
initialState
useSelector
useDispatch
Running Inside A Redux App
You could run a react-admin app inside an existing Redux app, provided that you initialized the react-admin reducers. This is no longer necessary, so you can directly put your custom reducers in your Redux store:
-import { createAdminStore, Admin } from 'react-admin';
+import { Admin } from 'react-admin';
+import { createStore, combineReducers } from 'redux';
import { Provider } from 'react-redux';
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/MaayanLab/signature-commons-ui/network/alerts).
Bumps react-admin from 2.9.9 to 3.19.12.
Release notes
Sourced from react-admin's releases.
... (truncated)
Changelog
Sourced from react-admin's changelog.
... (truncated)
Upgrade guide
Sourced from react-admin's upgrade guide.
... (truncated)
Commits
d295fc9v3.19.12d438070Prepare changelog for v3.19.12a4619a8Merge pull request #8645 from marmelab/fix-RichTextField-XSS-v31226a15Rollback510845fFix security warningfcc5f9eTry again2c88069Upgrade CodeQLc2113b8Fix\<RichTextField>XSS vulnerability663435cChange links to CodeSandbox in readme to point to 3.x32af622Merge pull request #7957 from schirrel/fix/pagination-propsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/MaayanLab/signature-commons-ui/network/alerts).