@forwardreach/saas-ui 0.10.2 → 0.10.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +23 -2
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,10 +1,31 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.10.3
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- First release published with an npm provenance attestation. The package contents
|
|
8
|
+
are unchanged from `0.10.2`; what is new is that the registry now records where
|
|
9
|
+
this artifact came from — this repository, the commit it was built from, and the
|
|
10
|
+
workflow run that built it — signed by the CI identity and logged publicly, so a
|
|
11
|
+
consumer can check a version's origin rather than trust its number.
|
|
12
|
+
|
|
13
|
+
That check is what was missing when two vendored tarballs, `@forwardreach/saas-ui@0.9.1`
|
|
14
|
+
and `@forwardreach/saas-mcp@0.1.3`, turned out to carry versions no commit in this
|
|
15
|
+
repository ever produced. One left a consumer a month stale behind a _higher_
|
|
16
|
+
version number than the real thing. Nothing in the pipeline could have caught
|
|
17
|
+
either, because a locally packed tarball records no origin at all.
|
|
18
|
+
|
|
19
|
+
Verify an installed copy with `npm audit signatures`, or from a clone of this
|
|
20
|
+
repository with `node scripts/verify-provenance.mjs @forwardreach/saas-ui@<version>`.
|
|
21
|
+
Neither needs registry credentials. Versions published before this one cannot
|
|
22
|
+
gain an attestation retroactively.
|
|
23
|
+
|
|
3
24
|
## 0.10.2
|
|
4
25
|
|
|
5
26
|
### Patch Changes
|
|
6
27
|
|
|
7
|
-
- `Combobox` keyboard scrolling brings a group's heading into view
|
|
28
|
+
- `Combobox` keyboard scrolling brings a group's heading into view _alongside_
|
|
8
29
|
its first option rather than instead of it. `0.10.1` scrolled the heading and
|
|
9
30
|
not the option, which fixed entering a group from above and broke entering
|
|
10
31
|
one from below: `scrollIntoView({block: "nearest"})` on a heading below the
|
|
@@ -26,7 +47,7 @@
|
|
|
26
47
|
of the options. A roleless element is not in the content model of
|
|
27
48
|
`role="listbox"`, so the previous markup conveyed the grouping to sighted
|
|
28
49
|
users only — a regression against the native `<select>` with `<optgroup
|
|
29
|
-
|
|
50
|
+
label>` that consumers replace with this. The options array stays flat and
|
|
30
51
|
every index the keyboard model uses is unchanged; only the DOM the rows are
|
|
31
52
|
emitted into differs.
|
|
32
53
|
|
package/package.json
CHANGED