@instructure/platform-widget-dashboard 12.1.5 → 13.0.0

package/dist/index.js

@@ -14937,11 +14937,10 @@ const rt = {
   // maction…none are the remaining MathML presentation/layout containers from
   // DOMPurify's mathMlDisallowed set (RCX-5259). They are re-added as tags only:
   // unlike annotation-xml they are NOT HTML integration points, so they carry no
-  // namespace-confusion (mXSS) risk. Because they go in ADD_TAGS and not ADD_ATTR,
-  // DOMPurify keeps filtering their attributes — an event handler like onclick on
-  // <maction> is still stripped. maction is the one exception to "tags only": it
-  // needs to survive DOMPurify's element filter so the hook below can collapse it
-  // to its first child, rather than KEEP_CONTENT hoisting every child at once.
+  // namespace-confusion (mXSS) risk. Event handlers like onclick on <maction> are
+  // still stripped; actiontype is in ADD_ATTR but is inert (no URL/handler). maction
+  // is kept whole with every child, so the alternatives a toggle switches between
+  // aren't lost.
   ADD_TAGS: [
     "iframe",
     "semantics",
@@ -15038,10 +15037,12 @@ const rt = {
     "mslinethickness",
     "edge",
     "alttext",
+    "actiontype",
+    // MathML toggle/highlight mode; inert elsewhere (no URL/handler/clobberable name).
+    "contenteditable",
     // Editor surfaces rely on it; boolean UI attribute, no URL/handler/clobberable name.
     // Deliberately wider than the Canvas backend allowlist, which drops it — stored content
     // is stripped server-side regardless, so this only reaches client-rendered surfaces.
-    "contenteditable",
     // Screen-reader abbreviated header text. Global like the other entries here
     // (DOMPurify has no per-tag attr scoping), so it's permitted on every allowed
     // element, wider than the Canvas backend allowlist, which scopes it to td/th.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instructure/platform-widget-dashboard",
-  "version": "12.1.5",
+  "version": "13.0.0",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -64,13 +64,13 @@
     "react-dom": "^18.0.0",
     "@instructure/platform-canvas-fetch": "0.1.3",
     "@instructure/platform-color-picker": "0.2.2",
-    "@instructure/platform-grades": "0.2.9",
     "@instructure/platform-get-cookie": "0.2.1",
+    "@instructure/platform-grades": "0.2.10",
+    "@instructure/platform-image-utils": "0.2.0",
+    "@instructure/platform-instui-bindings": "0.7.0",
     "@instructure/platform-message-students-modal": "0.2.9",
     "@instructure/platform-provider": "0.5.2",
-    "@instructure/platform-rce-adapter": "0.3.1",
-    "@instructure/platform-instui-bindings": "0.7.0",
-    "@instructure/platform-image-utils": "0.2.0"
+    "@instructure/platform-rce-adapter": "0.4.0"
   },
   "dependencies": {
     "@dnd-kit/core": "^6.3.1",
@@ -79,12 +79,12 @@
     "sanitize-html": "^2.0.0",
     "zod": "^3.23.8",
     "@instructure/platform-alerts": "1.0.1",
-    "@instructure/platform-canvas-fetch": "0.1.3",
+    "@instructure/platform-grades": "0.2.10",
     "@instructure/platform-datetime": "0.2.0",
-    "@instructure/platform-grades": "0.2.9",
-    "@instructure/platform-graphql-types": "0.2.3",
-    "@instructure/platform-query": "0.2.2",
-    "@instructure/platform-sanitize": "^0.7.1"
+    "@instructure/platform-canvas-fetch": "0.1.3",
+    "@instructure/platform-graphql-types": "0.2.4",
+    "@instructure/platform-sanitize": "^0.7.2",
+    "@instructure/platform-query": "0.2.2"
   },
   "devDependencies": {
     "@storybook/react": "^10.0.8",