@knime/kds-table 0.8.1 → 3.0.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @knime/kds-table
 
+## 3.0.0
+
+### Patch Changes
+
+- 2037f86: KDS-962: Remove table border-top
+- Updated dependencies [13cbb42]
+- Updated dependencies [356af93]
+- Updated dependencies [356af93]
+- Updated dependencies [e366f77]
+- Updated dependencies [e26e15d]
+  - @knime/kds-styles@3.0.0
+  - @knime/kds-components@3.0.0
+
+## 2.9.0
+
+### Patch Changes
+
+- f1a63fb: `@knime/kds-table` now versions in lockstep with the other `@knime/kds-*` packages (fixed version group): its version jumps from 0.x to match theirs, and every release of the design system ships a matching `@knime/kds-table` release. Update your dependency range (e.g. `^0.8.1` → `^2.8.2`) to keep receiving releases.
+- Updated dependencies [216447a]
+  - @knime/kds-components@2.9.0
+  - @knime/kds-styles@2.9.0
+
 ## 0.8.1
 
 ### Patch Changes

package/dist/index.css

@@ -186,33 +186,33 @@ tr {
 }
 
 .kds-table-action-bar {
-&[data-v-a70d7b02] {
+&[data-v-6538127c] {
   display: flex;
   align-items: center;
   justify-content: space-between;
   min-height: var(--kds-dimension-component-height-2-5x);
   padding-right: var(--kds-spacing-container-0-25x);
   padding-left: var(--kds-spacing-container-0-5x);
-  border-top: var(--kds-border-base-subtle);
+  border-bottom: var(--kds-border-base-subtle);
 }
-&.temporary-view[data-v-a70d7b02] {
+&.temporary-view[data-v-6538127c] {
     background-color: var(--kds-color-background-static-info-muted);
 }
 & .left {
-&[data-v-a70d7b02] {
+&[data-v-6538127c] {
     display: flex;
     flex: 1 0 0;
     gap: var(--kds-spacing-container-0-5x);
     align-items: center;
     padding: var(--kds-spacing-container-0-12x) 0;
 }
-& .dimension[data-v-a70d7b02] {
+& .dimension[data-v-6538127c] {
       font: var(--kds-font-base-title-small);
       color: var(--kds-color-text-and-icon-muted);
       white-space: pre;
 }
 }
-& .right[data-v-a70d7b02] {
+& .right[data-v-6538127c] {
     display: flex;
     gap: var(--kds-spacing-container-0-25x);
     align-items: center;
@@ -332,15 +332,14 @@ tr {
 }
 
 thead {
-&[data-v-a97dc625] {
+&[data-v-5ec89e0d] {
   /* TODO SLEEK-376 handle background color */
   /* stylelint-disable-next-line no-unknown-custom-properties */
   background-color: var(--knime-white);
-  border-top: var(--kds-border-base-subtle);
   border-bottom: var(--kds-border-base-subtle);
 }
 & tr {
-&[data-v-a97dc625] {
+&[data-v-5ec89e0d] {
     display: flex;
     height: 100%;
     transition:
@@ -348,51 +347,51 @@ thead {
       box-shadow 0.15s;
 }
 & th {
-&[data-v-a97dc625] {
+&[data-v-5ec89e0d] {
       min-height: var(--kds-dimension-component-height-2-5x);
       max-height: var(--kds-dimension-component-height-5x);
       text-align: left;
       white-space: nowrap;
 }
-&.deletion-cell-spacer[data-v-a97dc625] {
+&.deletion-cell-spacer[data-v-5ec89e0d] {
         width: var(--kds-dimension-component-width-2x);
 }
 &.select-cell {
-&[data-v-a97dc625] {
+&[data-v-5ec89e0d] {
         display: flex;
         justify-content: center;
         width: var(--kds-dimension-component-width-2x);
         padding: var(--kds-spacing-container-0-75x);
 }
-& .select-checkbox[data-v-a97dc625] {
+& .select-checkbox[data-v-5ec89e0d] {
           /* With this added padding the checkbox appears centered initially */
           padding: var(--kds-spacing-container-0-10x);
 }
 }
-&.new-column-head[data-v-a97dc625] {
+&.new-column-head[data-v-5ec89e0d] {
         display: flex;
         flex-direction: column;
         justify-content: center;
         padding: var(--kds-spacing-container-0-5x);
 }
 }
-&[data-v-a97dc625]:hover {
+&[data-v-5ec89e0d]:hover {
       outline: none;
 }
 }
-&.sub-menu-active tr[data-v-a97dc625] {
+&.sub-menu-active tr[data-v-5ec89e0d] {
     padding-right: var(--kds-dimension-component-width-2x);
 }
 }
 .header-selection-overlay {
-&[data-v-a97dc625] {
+&[data-v-5ec89e0d] {
   position: absolute;
   top: 0;
   height: 100%;
   pointer-events: none;
   border: var(--kds-border-action-selected-accent);
 }
-&.header-focused[data-v-a97dc625] {
+&.header-focused[data-v-5ec89e0d] {
     border: var(--kds-border-action-focused);
 }
 }

package/dist/index.js

@@ -1121,14 +1121,32 @@ var dimension = {
 */
 var spacing = {
 	container: {
-		negative: { "0.25x": {
-			value: -4,
-			unit: "px",
-			css: {
-				value: "-4px",
-				variable: "var(--kds-spacing-container-negative-0-25x)"
+		negative: {
+			"0.25x": {
+				value: -4,
+				unit: "px",
+				css: {
+					value: "-4px",
+					variable: "var(--kds-spacing-container-negative-0-25x)"
+				}
+			},
+			"0.375x": {
+				value: -6,
+				unit: "px",
+				css: {
+					value: "-6px",
+					variable: "var(--kds-spacing-container-negative-0-375x)"
+				}
+			},
+			"0.5x": {
+				value: -8,
+				unit: "px",
+				css: {
+					value: "-8px",
+					variable: "var(--kds-spacing-container-negative-0-5x)"
+				}
 			}
-		} },
+		},
 		none: {
 			value: 0,
 			unit: "px",
@@ -1566,8 +1584,8 @@ var oe = class extends b {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/dompurify@3.4.11/node_modules/dompurify/dist/purify.es.mjs
-/*! @license DOMPurify 3.4.11 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.11/LICENSE */
+//#region ../../node_modules/.pnpm/dompurify@3.4.12/node_modules/dompurify/dist/purify.es.mjs
+/*! @license DOMPurify 3.4.12 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.12/LICENSE */
 function _arrayLikeToArray(r, a) {
 	(null == a || a > r.length) && (a = r.length);
 	for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e];
@@ -2206,6 +2224,7 @@ var svg = freeze([
 	"direction",
 	"display",
 	"divisor",
+	"dominant-baseline",
 	"dur",
 	"edgemode",
 	"elevation",
@@ -2333,6 +2352,7 @@ var svg = freeze([
 	"transform-origin",
 	"text-anchor",
 	"text-decoration",
+	"text-orientation",
 	"text-rendering",
 	"textlength",
 	"type",
@@ -2515,7 +2535,7 @@ var _resolveSetOption = function _resolveSetOption(cfg, key, fallback, options)
 function createDOMPurify() {
 	let window = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal();
 	const DOMPurify = (root) => createDOMPurify(root);
-	DOMPurify.version = "3.4.11";
+	DOMPurify.version = "3.4.12";
 	DOMPurify.removed = [];
 	if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
 		DOMPurify.isSupported = false;
@@ -2982,6 +3002,7 @@ function createDOMPurify() {
 	* @param root the in-place root to empty
 	*/
 	const _neutralizeRoot = function _neutralizeRoot(root) {
+		_neutralizeSubtree(root);
 		const childNodes = getChildNodes(root);
 		if (childNodes) {
 			const snapshot = [];
@@ -3083,6 +3104,65 @@ function createDOMPurify() {
 		}
 	};
 	/**
+	* _neutralizePatchLinkage
+	*
+	* IN_PLACE entry pre-pass (declarative-partial-updates / streaming
+	* hardening, https://github.com/WICG/declarative-partial-updates).
+	*
+	* The main walk strips patch linkage (`for`/`patchsrc`) and removes range
+	* markers (PIs / markup comments) node-by-node, in document order, AS it
+	* reaches each node. On a live in-place root that leaves a window: from the
+	* moment the root is connected until the walk arrives at a given node, that
+	* node's linkage is live. A patch applied on connection/stream can fire as
+	* a microtask during the walk and inject or teleport an unsanitized DOM
+	* range into a region the iterator has already passed and will not revisit,
+	* so the post-return "tree is sanitized" contract is violated. Sweep the
+	* whole tree once up front and sever every linkage before the walk begins,
+	* closing that window.
+	*
+	* This CANNOT undo a patch that already fired before sanitize ran — that is
+	* the irreducible "do not IN_PLACE a live-connected attacker tree" caveat —
+	* but it closes everything from sanitize-start onward. Gated on SAFE_FOR_XML
+	* to group with the rest of the declarative-partial-updates handling and
+	* stay overridable, consistent with the codebase.
+	*
+	* Clobber-safe traversal (cached childNodes getter); per-node try/catch so a
+	* clobbered root cannot defeat the sweep of its non-clobbered descendants.
+	*
+	* NOTE (pending real-Chrome confirmation, see test/declarative-patch-probe
+	* .html Q1): this mirrors the existing policy of keeping `for` on
+	* <label>/<output>. If the shipping feature can drive a patch through a
+	* surviving `for`-on-label/output + `id` pair, this pre-pass and the
+	* attribute check at _isBasicCustomElement's caller must additionally drop
+	* that pair on the IN_PLACE path. Left as-is until the taxonomy is verified.
+	*
+	* @param root the in-place root to sweep
+	*/
+	const _neutralizePatchLinkage = function _neutralizePatchLinkage(root) {
+		if (!SAFE_FOR_XML) return;
+		const stack = [root];
+		while (stack.length > 0) {
+			const node = stack.pop();
+			const nodeType = getNodeType ? getNodeType(node) : node.nodeType;
+			if (nodeType === NODE_TYPE.processingInstruction || nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, node.data)) {
+				try {
+					remove(node);
+				} catch (_) {}
+				continue;
+			}
+			if (nodeType === NODE_TYPE.element) {
+				const element = node;
+				const lcTag = transformCaseFunc(getNodeName ? getNodeName(node) : node.nodeName);
+				try {
+					if (element.hasAttribute && element.hasAttribute("patchsrc")) element.removeAttribute("patchsrc");
+					if (element.hasAttribute && element.hasAttribute("for") && lcTag !== "label" && lcTag !== "output") element.removeAttribute("for");
+				} catch (_) {}
+			}
+			const childNodes = getChildNodes(node);
+			if (childNodes) for (let i = childNodes.length - 1; i >= 0; --i) stack.push(childNodes[i]);
+		}
+	};
+	/**
 	* _initDocument
 	*
 	* @param dirty - a string of dirty markup
@@ -3250,9 +3330,15 @@ function createDOMPurify() {
 	/**
 	* Handle a node whose tag is forbidden or not allowlisted: keep
 	* allowed custom elements (false return exits _sanitizeElements
-	* early - namespace/fallback checks and the afterSanitizeElements
-	* hook are intentionally skipped for kept custom elements), else
-	* hoist content per KEEP_CONTENT and remove.
+	* early - the namespace and fallback-tag removal checks are
+	* intentionally skipped for kept custom elements), else hoist
+	* content per KEEP_CONTENT and remove.
+	*
+	* A kept custom element is the ONLY case in which this function
+	* returns false, so the caller uses that return value to run the
+	* afterSanitizeElements hook on the kept element and keep the
+	* element-hook lifecycle consistent with normal allowlisted
+	* elements (GHSA-c2j3-45gr-mqc4).
 	*
 	* @param currentNode the disallowed node
 	* @param tagName the node's transformCaseFunc'd tag name
@@ -3286,8 +3372,9 @@ function createDOMPurify() {
 	* @param currentNode to check for permission to exist
 	* @return true if node was killed, false if left alive
 	*/
-	const _sanitizeElements = function _sanitizeElements(currentNode) {
+	const _sanitizeElements = function _sanitizeElements(currentNode, root) {
 		_executeHooks(hooks.beforeSanitizeElements, currentNode, null);
+		if (currentNode !== root && getParentNode(currentNode) === null) return true;
 		if (_isClobbered(currentNode)) {
 			_forceRemove(currentNode);
 			return true;
@@ -3297,11 +3384,16 @@ function createDOMPurify() {
 			tagName,
 			allowedTags: ALLOWED_TAGS
 		});
+		if (currentNode !== root && getParentNode(currentNode) === null) return true;
 		if (_isUnsafeNode(currentNode, tagName)) {
 			_forceRemove(currentNode);
 			return true;
 		}
-		if (FORBID_TAGS[tagName] || !(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && !ALLOWED_TAGS[tagName]) return _sanitizeDisallowedNode(currentNode, tagName);
+		if (FORBID_TAGS[tagName] || !(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && !ALLOWED_TAGS[tagName]) {
+			const removed = _sanitizeDisallowedNode(currentNode, tagName);
+			if (removed === false) _executeHooks(hooks.afterSanitizeElements, currentNode, null);
+			return removed;
+		}
 		if ((getNodeType ? getNodeType(currentNode) : currentNode.nodeType) === NODE_TYPE.element && !_checkValidNamespace(currentNode)) {
 			_forceRemove(currentNode);
 			return true;
@@ -3330,6 +3422,8 @@ function createDOMPurify() {
 	*/
 	const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
 		if (FORBID_ATTR[lcName]) return false;
+		if (SAFE_FOR_XML && lcName === "patchsrc") return false;
+		if (SAFE_FOR_XML && lcName === "for" && lcTag !== "label" && lcTag !== "output") return false;
 		if (SANITIZE_DOM && (lcName === "id" || lcName === "name") && (value in document || value in formElement)) return false;
 		const nameIsPermitted = ALLOWED_ATTR[lcName] || EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function && EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag);
 		if (ALLOW_DATA_ATTR && regExpTest(DATA_ATTR$1, lcName));
@@ -3483,7 +3577,7 @@ function createDOMPurify() {
 		_executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null);
 		while (shadowNode = shadowIterator.nextNode()) {
 			_executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
-			_sanitizeElements(shadowNode);
+			_sanitizeElements(shadowNode, fragment);
 			_sanitizeAttributes(shadowNode);
 			if (_isDocumentFragment(shadowNode.content)) _sanitizeShadowDOM2(shadowNode.content);
 			if ((getNodeType ? getNodeType(shadowNode) : shadowNode.nodeType) === NODE_TYPE.element) {
@@ -3577,12 +3671,19 @@ function createDOMPurify() {
 		DOMPurify.removed = [];
 		const inPlace = IN_PLACE && typeof dirty !== "string" && _isNode(dirty);
 		if (inPlace) {
+			_neutralizePatchLinkage(dirty);
 			const nn = getNodeName ? getNodeName(dirty) : dirty.nodeName;
 			if (typeof nn === "string") {
 				const tagName = transformCaseFunc(nn);
-				if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place");
+				if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
+					_neutralizeRoot(dirty);
+					throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place");
+				}
+			}
+			if (_isClobbered(dirty)) {
+				_neutralizeRoot(dirty);
+				throw typeErrorCreate("root node is clobbered and cannot be sanitized in-place");
 			}
-			if (_isClobbered(dirty)) throw typeErrorCreate("root node is clobbered and cannot be sanitized in-place");
 			try {
 				_sanitizeAttachedShadowRoots(dirty);
 			} catch (error) {
@@ -3602,15 +3703,21 @@ function createDOMPurify() {
 			if (!body) return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : "";
 		}
 		if (body && FORCE_BODY) _forceRemove(body.firstChild);
-		const nodeIterator = _createNodeIterator(inPlace ? dirty : body);
+		const walkRoot = inPlace ? dirty : body;
+		const nodeIterator = _createNodeIterator(walkRoot);
 		try {
 			while (currentNode = nodeIterator.nextNode()) {
-				_sanitizeElements(currentNode);
+				_sanitizeElements(currentNode, walkRoot);
 				_sanitizeAttributes(currentNode);
 				if (_isDocumentFragment(currentNode.content)) _sanitizeShadowDOM2(currentNode.content);
 			}
 		} catch (error) {
-			if (inPlace) _neutralizeRoot(dirty);
+			if (inPlace) {
+				_neutralizeRoot(dirty);
+				arrayForEach(DOMPurify.removed, (entry) => {
+					if (entry.element) _neutralizeSubtree(entry.element);
+				});
+			}
 			throw error;
 		}
 		if (inPlace) {
@@ -5359,7 +5466,7 @@ var TableActionBar_default = /*#__PURE__*/ _plugin_vue_export_helper_default(/*
 			])], 2)) : createCommentVNode("", true);
 		};
 	}
-}), [["__scopeId", "data-v-a70d7b02"]]);
+}), [["__scopeId", "data-v-6538127c"]]);
 //#endregion
 //#region src/components/composables/useHeaderMenuItems.ts
 var useHeaderMenuItems = ({ enableSorting, sortDirection, sortTexts, additionalMenuItems, onColumnSort }) => {
@@ -6102,7 +6209,7 @@ function _sfc_render$2(_ctx, _cache, $props, $setup, $data, $options) {
 		style: normalizeStyle($options.headerSelectionOverlayStyle)
 	}, null, 6)) : createCommentVNode("", true)]);
 }
-var Header_default = /*#__PURE__*/ _plugin_vue_export_helper_default(Header_vue_vue_type_script_lang_default, [["render", _sfc_render$2], ["__scopeId", "data-v-a97dc625"]]);
+var Header_default = /*#__PURE__*/ _plugin_vue_export_helper_default(Header_vue_vue_type_script_lang_default, [["render", _sfc_render$2], ["__scopeId", "data-v-5ec89e0d"]]);
 //#endregion
 //#region src/components/layout/NewRowButton.vue?vue&type=script&setup=true&lang.ts
 var _hoisted_1$3 = { class: "sticky-container" };