[Snyk] Upgrade @uswds/uswds from 3.9.0 to 3.13.0 #21
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade @uswds/uswds from 3.9.0 to 3.13.0. See this package in npm: @uswds/uswds See this project in Snyk: https://app.snyk.io/org/sherfeyinv/project/49009f97-a61c-4799-af28-8a061ae6b522?utm_source=github&utm_medium=referral&page=upgrade-pr
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade @uswds/uswds from 3.9.0 to 3.13.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 4 versions ahead of your current version.
The recommended version was released 7 months ago.
Release notes
Package name: @uswds/uswds
-
3.13.0 - 2025-05-23
Package
A11y
Breaking
Markup change
Description
-
-
-
Added a Web Component variant of banner. This release contains the first Web Component in USWDS. The addition of the
Yes
-
-
Currently, the range slider has audible cues that aren't available for sighted users. This update adds a value to the slider so the current value is visible. (#6302) Thank you, @ aduth!
Yes
-
-
Animated transitions now respect the system's reduced motion preference. A new transition utility handles default behavior for easing and disabling inessential animation. (#6268) Thank you, @ cathybaptista!
Dependency name
Previous version
New version
lit
--
3.2.1
Dependency name
Previous version
New version
@ rollup/plugin-commonjs
--
28.0.3
@ spiriit/vite-plugin-svg-spritemap
--
4.0.0
--
0.0.1-security
eslint-plugin-lit
--
2.0.0
lit
--
3.2.1
vite
--
6.3.5
vite-plugin-svg-sprite
--
0.6.2
undici
6.21.1
6.21.3
-
3.12.0 - 2025-03-07
Package
A11y
Breaking
Markup change
Description
-
-
-
Enabled native JavaScript translation for date picker calendar labels. The calendar now uses the
-
-
-
Added the
-
-
-
Enabled tooltip functionality on non-button elements. Thanks @ anmazz! (#6035)
Package
A11y
Breaking
Markup change
Description
-
-
-
Updated checkbox and radio styles so that the interactive area now matches the width of the content. Previously, the interactive area extended the full width of its container. (#6192)
-
-
-
Fixed a bug that prevented in-page navigation from scrolling to nested headings. Now, the component can smooth scroll to headings within components like card and summary box.
-
-
-
Resolved Sass deprecation warnings related to the color function. This change ensures compatibility with Dart Sass 2.0.0 and eliminates the use of deprecated color functions. (#6270)
-
-
-
Replaced
Dependency name
Previous version
New version
resolve-id-refs
0.1.0
--
Dependency name
Previous version
New version
@ babel/core
7.26.0
7.26.8
@ babel/preset-env
7.26.0
7.26.8
gulp-sass
5.1.0
6.0.0
postcss
8.4.49
8.5.2
sass
1.83.1
1.84.0
sass-embedded
1.83.1
1.83.4
sass-loader
13.3.2
16.0.4
snyk
1.1295.0
1.1295.3
stylelint
16.11.0
16.12.0
typescript
5.7.2
5.7.3
webpack
5.97.1
5.98.0
- Thanks to @ aduth for making our prettier configuration more explicit. (#6269)
- Thanks to @ szepeviktor for fixing typos. (#6251)
- Thanks to @ jcklpe for updating broken links in the USWDS README. (#6239)
- Thanks to @ aduth for improving the JavaScript examples in our README (#5928)
- Thanks to @ aduth for improving our automated unit test scans (#6171)
-
3.11.0 - 2024-12-18
Package
A11y
Breaking
Markup change
Description
-
-
-
Removed outdated browser normalization styles. This update drops normalize support for Internet Explorer. Thanks @ aduth! (#5555)
-
-
-
Moved
-
-
-
Updated table header styles to be consistent across all table elements. Now, all
Package
A11y
Breaking
Markup change
Description
-
-
Yes
Replaced deprecated
Yes
-
-
Fixed a bug that prevented screen readers from announcing the invalid file type error message. (#6168)
Yes
-
-
Removed
Dependency name
Previous version
New version
@ babel/core
7.25.7
7.26.0
@ babel/preset-env
7.25.7
7.26.0
axe-core
4.10.0
4.10.2
cross-spawn
7.0.3
7.0.6
html-webpack-plugin
5.6.0
5.6.3
mocha
10.7.3
10.8.2
nwsapi (added via npm overrides)
--
2.2.13
postcss
8.4.47
8.4.49
prettier
3.3.3
3.4.2
sass
1.79.4
1.83.0
sass-embedded
1.79.4
1.83.0
snyk
1.1293.1
1.1294.3
stylelint
16.9.0
16.11.0
typescript
5.6.2
5.7.2
webpack
5.95.0
5.97.1
-
3.10.0 - 2024-11-13
Package
A11y
Breaking
Markup change
Description
-
-
-
Updated the order of combo box search results. The component now displays options that start with the query at the top of the list, followed by options that contain the query. This behavior more closely aligns with user expectation. (#6122)
Package
A11y
Breaking
Markup change
Description
-
-
-
Removed inline style tags from indeterminate checkbox SVGs. These style tags were unnecessary and caused a conflict with Cypress automated testing. (#6162)
-
-
-
Fixed a bug that caused file input image previews to break when a Content Security Policy is enabled. The component now uses event listeners in place of inline JavaScript to handle error states. Thanks @ jeffpw-goog! (#5997)
-
-
-
Fixed a bug that prevented the modal package from bundling with a custom prefix. The component no longer uses hard-coded class names in its JavaScript. Thanks @ sanason! (#6026)
Yes
-
Yes
Removed the
Yes
-
Yes
Updated the time picker hint text to improve clarity. This update allows the component to meet the success criteria in WCAG 3.3.2. (#6147)
Dependency name
Previous version
Updated version
object-assign
4.1.1
--
Dependency name
Previous version
Updated version
@ babel/core
7.25.2
7.25.7
@ babel/preset-env
7.25.4
7.25.7
browserify
17.0.0
17.0.1
eslint-plugin-import
2.30.0
2.31.0
eslint-plugin-no-unsanitized
4.1.0
4.1.2
postcss
8.4.45
8.4.47
sass
1.78.0
1.79.4
sass-embedded
1.78.0
1.79.4
snyk
1.1293.0
1.1293.1
twig-html-loader
0.1.9
--
webpack
5.94.0
5.95.0
-
3.9.0 - 2024-10-04
Package
A11y
Breaking
Markup change
Description
-
-
-
Enhanced the visual cue when
Yes
-
-
Added
-
-
-
Added new
Package
A11y
Breaking
Markup change
Description
-
Yes
-
Fixed a bug that caused
⚠️ Considered breaking because the alignment and display of the alert may shift.
-
Yes
-
Updated the width of unstyled buttons at narrow screen widths. Now, unstyled buttons receive a width of
⚠️ Considered breaking because the display of unstyled buttons will change at narrow screen widths. Check your codebase for any instances of
-
Yes
-
Fixed a bug that caused the component to ignore the
⚠️ Considered breaking because fonts in cards may change if you've set
Yes
-
-
Removed custom screen reader instructions in the combo box component. Combo box now relies on the default instructions provided by screen readers. (#6022)
Yes
-
-
Fixed a bug that caused
Yes
Yes
-
Removed the CSS order property from the mobile view in standard variants of the header component. Now, the visual order of the component matches the tab order. If you would like to visually keep the search bar at the top of the menu, you will need to reorder your markup in the mobile view. (#6037)
⚠️ Considered breaking because the position of the search bar will change in the mobile menu.
Yes
-
Yes
Added the
-
-
Yes
Updated the USA.gov link in Spanish versions of the identifier. The link text now reads "Visite USAGov en Español" and the link url is now "https://www.usa.gov/es/". (#5892)
Yes
-
Yes
Removed numeric representation of months in the memorable date component. Recent usability testing indicated that having both numbers and names to represent months was confusing for screen reader users. (#6028)
Yes
-
-
Added text underline styles to pagination links. Pagination links are now visually consistent with other USWDS text links. (#5970)
Dependency name
Previous version
Updated version
@ 18f/identity-stylelint-config
4.0.0
4.1.0
@ babel/core
7.24.5
7.25.2
@ babel/preset-env
7.24.5
7.25.4
@ types/node
20.12.11
20.14.10
autoprefixer
10.4.19
10.4.20
axe-core
4.9.1
4.10.0
babel-loader
9.1.3
--
eslint-plugin-import
2.29.1
2.30.0
eslint-plugin-no-unsanitized
4.0.2
4.1.0
gulp-changed
4.0.3
--
gulp-clean
0.4.0
--
gulp-cli
2.3.0
--
mocha
10.4.0
10.7.3
normalize.css
8.0.1
--
path
0.12.7
--
postcss
8.4.38
8.4.45
postcss-preset-env
9.5.11
9.6.0
prettier
3.2.5
3.3.3
sass
1.77.0
1.78.0
sass-embedded
1.77.0
1.78.0
snyk
1.1291.0
1.1293.0
stylelint
16.5.0
16.9.0
typescript
5.4.5
5.6.2
webpack
5.91.0
5.94.0
from @uswds/uswds GitHub release notesWhat's new in USWDS 3.13.0
Features
usa-bannerusa-bannertag will make it easier for many teams to get up and running with USWDS, and we plan to add more Web Components in the future. Huge thanks to @ mejiaj who did much of the work on this component in the USWDS Elements repository (#6460)usa-rangeuswds-coreDependency updates
Note: While Lit is a new dependency, it's only necessary for the new Web Component banner variant. If you're using the compiled version of that component from
dist, Lit's already included.Dev Dependency updates
eslint-plugin-airbnb-base0vulnerabilities in regular dependencies (dependencies for USWDS projects installed with npm install @ uswds/uswds)55vulnerabilities (29moderate,26high) in devDependencies (development dependencies)Release TGZ SHA-256 hash:
6eac004fb7785490eb640f388c6949c57951501876acb109ecdd4c8ead7518b6What's new in USWDS 3.12.0
Features
usa-date-picker,usa-date-range-pickerDate.toLocaleStringAPI to automatically build translated labels based on the document'slangattribute. Thanks @ deebloo! (#5679)usa-in-page-navigationdata-minimum-heading-countproperty to the in-page navigation component. This property hides the component when the content region does not contain the minimum number of headings. By default, this attribute hides the in-page navigation component when there are fewer than two headings in the content region.✏️ Teams should customize the value of this property based on their content needs. (#6205)
usa-tooltipBug fixes
usa-checkbox,usa-radiousa-in-page-navigation✏ Teams that use
data-scroll-offsetshould check to make sure this change does not cause regressions in scroll behaviors. Thanks @ jhancock532! (#5878)uswds-coreuswds-coreresolve-id-refsdependency with custom JavaScript. (#6308)Dependencies and security
Dependency updates
Dev dependency updates
Additional updates
Important
USWDS now requires a verified signature on all commits to this repository. Learn more about how to set up signature verification in our CONTRIBUTING.md file.
Additional contributions
0vulnerabilities in regular dependencies (dependencies for USWDS projects installed withnpm install @ uswds/uswds)30moderate,26high vulnerabilities in devDependencies (development dependencies).Release TGZ SHA-256 hash:
8a562ec0c24d93b7eeaeaa9056f54050054344331dd34ca96d5be161442f09cdWhat's new in USWDS 3.11.0
Features
usa-elementsusa-form,usa-input-prefix-suffix,usa-input,uswds-core.usa-input--[width]and.usa-input-group--[width]classes out of theusa-formpackage. These classes are now generated in theusa-inputandusa-input-prefix-suffixpackages and can be used without the.usa-formparent element. Thanks @ aduth! (#6232)usa-tablethead th,tbody th, andtfoot thcells will all have the same visual styles. Thanks @ ajanickiv!✏️ Teams should confirm that their tables display as expected. (#5986)
Bug fixes
usa-button,usa-collection,usa-file-input,usa-icon-list,usa-icon,usa-input-prefix-suffix,usa-modal,usa-paginationxlink:hrefreferences withhref.✏ Teams should update their markup to replace
xlink:hrefreferences withhrefand pull in the updatedloader.svgfile. (#6165)usa-file-input✏ Teams who support additional languages should update the error message string to match the new copy.
usa-footeroverflow: hiddenfromusa-footerto allow the full focus outline to show. This fix also improves horizontal alignment in the slim footer variant. Thanks @ 6TELOIV! (#6237)Markup changes
MDN warns that the deprecated
xlink:hrefattribute can stop working at any time. When referencing SVG icon sprites, teams should usehrefinstead of the deprecatedxlink:hrefattribute.Dependencies and security
0vulnerabilities in regular dependencies (dependencies for USWDS projects installed withnpm install @ uswds/uswds)29moderate,26high vulnerabilities in devDependencies (development dependencies).Release TGZ SHA-256 hash:
1c10cd70a3c627fd14d9ee74a4071e67c4e5ba4bf14ca1c50c19c2fe5885e70aWhat's new in USWDS 3.10.0
Features
usa-combo-boxBug fixes
usa-checkbox✏️ Teams should update the
checkbox-indeterminate.svgandcheckbox-indeterminate-alt.svgfiles in their projects.usa-file-inputusa-modelusa-step-indicatoraria-labelfrom the wrapper of the step indicator component. This resolves an automated testing error related to having an invalid attribute on adivelement. (#6146)✏️ Teams should remove the the
aria-labelfrom the.usa-step-indicatorelement in their step indicator markup.usa-time-picker✏️ Teams should replace the words "hh:mm" in the time picker hint text with "Select a time from the dropdown. Type into the input to filter options."
Markup changes
Step indicator
To remove automated testing errors, teams should update the step indicator markup to remove the
aria-labelon theusa-step-indicatorelement:Time picker
If teams are using "hh:mm" in their time picker hint text, they should update the text to "Select a time from the dropdown. Type into the input to filter options.":
Dependencies and security
Dependency updates
Dev Dependency updates
Thanks @ aduth and @ anselmbradford for contributing to our dependency updates!
0vulnerabilities in regular dependencies (dependencies for USWDS projects installed withnpm install @ uswds/uswds)29moderate,26high vulnerabilities in devDependencies (development dependencies).Release TGZ SHA-256 hash:
fdd1f9fc4cbfeb0fca7feeba1c94b205ba4ee22d03f63bb916c8750982715fb7What's new in USWDS 3.9.0
Features
usa-character-countmaxlengthis exceeded in the character count component. Now, the component uses standard USWDS error styles to visually enhance the error state. (#5908)usa-date-picker,usa-date-range-pickeraria-disabledto the list of expected attributes in the date picker and date range picker components. Now, the component will disable toggle when thearia-disabledattribute is present. (#6013)uswds-core,usa-layout-grid$theme-utility-breakpoints-customsetting. This setting generates responsive variants of USWDS utilities at custom breakpoints. Values must be set withpxvalues inside a Sass map. Thanks @ jamigibbs! (#6048)Bug fixes
usa-alert,usa-site-alert$theme-site-margins-widthto unexpectedly adjust the alignment inside the alert and site alert components. Alignment on the alert and site alert components will likely shift from this change. Confirm that your implementation of the component aligns as expected. (#5636)usa-buttonautoto better match USWDS link styles. Users should confirm that the variant visually displays as expected in their projects. Thanks @ aduth! (#5631)@ include button-unstyledin your custom styles. These items may be affected by this change.usa-card$theme-card-font-familysetting. Confirm that your implementation of the card component displays with the expected font family. (#5974)$theme-card-font-family.usa-combo-boxusa-date-picker,usa-date-range-pickermouseoverevents to prevent keyboard navigation. Now when you hover your mouse over the date picker buttons, only the hover state will be triggered. (#5774)usa-headerusa-footer,templatesautocomplete="email"attribute to the big footer variant and the "Create an account" template. This attribute allows the components to meet the standards outlined in WCAG 1.3.5. (#6002)✏️ Teams should update their markup if they use an email field in their big footer.
usa-identifier✏️ Teams should update this text if they use the Spanish-language identifier.
usa-memorable-date✏️ Teams should update their memorable date component to remove the leading numbers.
usa-paginationDependencies and security
Thanks @ aduth for contributing to our dependency updates and @ skyf0l for fixing a typo in our package.json!
0vulnerabilities in regular dependencies (dependencies for USWDS projects installed withnpm install @ uswds/uswds)29moderate,26high vulnerabilities in devDependencies (development dependencies).Release TGZ SHA-256 hash:
140cb2162e6c60a6a6ecbc71d8d047819d4ec26f9dd6c7056bd4bd8a266af2abImportant
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: