@oracle/oraclejet-core-pack 20.0.4 → 20.0.6

package/oj-c/selector-all/component.json

@@ -1,7 +1,7 @@
 {
   "name": "selector-all",
-  "version": "20.0.4",
-  "jetVersion": "^20.0.4",
+  "version": "20.0.6",
+  "jetVersion": "^20.0.6",
   "pack": "oj-c",
   "type": "composite",
   "dependencyScope": "runtime",
@@ -20,7 +20,7 @@
     },
     "webelement": {
       "package": "@oracle/oraclejet-core-pack",
-      "version": "20.0.4",
+      "version": "20.0.6",
       "docUrl": "https://www.oracle.com/webfolder/technetwork/jet/cpwdtsdoc/classes/SelectorAllWebElement.html",
       "export": "findSelectorAll",
       "main": "@oracle/oraclejet-core-pack/webdriver"

package/oj-c/skeleton/component.json

@@ -1,7 +1,7 @@
 {
   "name": "skeleton",
-  "version": "20.0.4",
-  "jetVersion": "^20.0.4",
+  "version": "20.0.6",
+  "jetVersion": "^20.0.6",
   "pack": "oj-c",
   "type": "composite",
   "dependencyScope": "runtime",
@@ -20,7 +20,7 @@
     },
     "webelement": {
       "package": "@oracle/oraclejet-core-pack",
-      "version": "20.0.4",
+      "version": "20.0.6",
       "docUrl": "https://www.oracle.com/webfolder/technetwork/jet/cpwdtsdoc/classes/SkeletonWebElement.html",
       "export": "findSkeleton",
       "main": "@oracle/oraclejet-core-pack/webdriver"

package/oj-c/split-menu-button/component.json

@@ -1,7 +1,7 @@
 {
   "name": "split-menu-button",
-  "version": "20.0.4",
-  "jetVersion": "^20.0.4",
+  "version": "20.0.6",
+  "jetVersion": "^20.0.6",
   "pack": "oj-c",
   "type": "composite",
   "dependencyScope": "runtime",
@@ -34,7 +34,7 @@
     },
     "webelement": {
       "package": "@oracle/oraclejet-core-pack",
-      "version": "20.0.4",
+      "version": "20.0.6",
       "docUrl": "https://www.oracle.com/webfolder/technetwork/jet/cpwdtsdoc/classes/SplitMenuButtonWebElement.html",
       "export": "findSplitMenuButton",
       "main": "@oracle/oraclejet-core-pack/webdriver"

package/oj-c/tab-bar/component.json

@@ -1,7 +1,7 @@
 {
   "name": "tab-bar",
-  "version": "20.0.4",
-  "jetVersion": "^20.0.4",
+  "version": "20.0.6",
+  "jetVersion": "^20.0.6",
   "pack": "oj-c",
   "type": "composite",
   "dependencyScope": "runtime",
@@ -255,7 +255,7 @@
   "extension": {
     "webelement": {
       "package": "@oracle/oraclejet-core-pack",
-      "version": "20.0.4",
+      "version": "20.0.6",
       "docUrl": "https://www.oracle.com/webfolder/technetwork/jet/cpwdtsdoc/classes/TabBarWebElement.html",
       "export": "findTabBar",
       "main": "@oracle/oraclejet-core-pack/webdriver"

package/oj-c/tab-bar-mixed/component.json

@@ -1,7 +1,7 @@
 {
   "name": "tab-bar-mixed",
-  "version": "20.0.4",
-  "jetVersion": "^20.0.4",
+  "version": "20.0.6",
+  "jetVersion": "^20.0.6",
   "pack": "oj-c",
   "type": "composite",
   "dependencyScope": "runtime",
@@ -28,7 +28,7 @@
     },
     "webelement": {
       "package": "@oracle/oraclejet-core-pack",
-      "version": "20.0.4",
+      "version": "20.0.6",
       "docUrl": "https://www.oracle.com/webfolder/technetwork/jet/cpwdtsdoc/classes/TabBarMixedWebElement.html",
       "export": "findTabBarMixed",
       "main": "@oracle/oraclejet-core-pack/webdriver"

package/oj-c/table/component.json

@@ -1,7 +1,7 @@
 {
   "name": "table",
-  "version": "20.0.4",
-  "jetVersion": "^20.0.4",
+  "version": "20.0.6",
+  "jetVersion": "^20.0.6",
   "pack": "oj-c",
   "type": "composite",
   "dependencyScope": "runtime",
@@ -46,7 +46,7 @@
     },
     "webelement": {
       "package": "@oracle/oraclejet-core-pack",
-      "version": "20.0.4",
+      "version": "20.0.6",
       "docUrl": "https://www.oracle.com/webfolder/technetwork/jet/cpwdtsdoc/classes/TableWebElement.html",
       "export": "findTable",
       "main": "@oracle/oraclejet-core-pack/webdriver"

package/oj-c/tag-cloud/component.json

@@ -1,7 +1,7 @@
 {
   "name": "tag-cloud",
-  "version": "20.0.4",
-  "jetVersion": "^20.0.4",
+  "version": "20.0.6",
+  "jetVersion": "^20.0.6",
   "pack": "oj-c",
   "type": "composite",
   "dependencyScope": "runtime",
@@ -36,7 +36,7 @@
     },
     "webelement": {
       "package": "@oracle/oraclejet-core-pack",
-      "version": "20.0.4",
+      "version": "20.0.6",
       "docUrl": "https://www.oracle.com/webfolder/technetwork/jet/cpwdtsdoc/classes/TagCloudWebElement.html",
       "export": "findTagCloud",
       "main": "@oracle/oraclejet-core-pack/webdriver"

package/oj-c/tag-cloud/utils.js

@@ -27,11 +27,28 @@ define(["require", "exports", "../tag-cloud-item/tag-cloud-item"], function (req
             role: (item.url ? 'link' : undefined)
         };
     }
+    /**
+     * Validates link URL protocol before browser navigation.
+     * Copied from DomUtils.validateURL, but simplified because oj-c-tag-cloud only needs the default
+     * http/https protocol allowlist and does not need legacy IE relative URL handling.
+     * @param href URL to validate.
+     * @throws Error if the URL uses an invalid protocol.
+     */
+    function validateURL(href) {
+        const allowed = ['http:', 'https:'];
+        const link = document.createElement('a');
+        link.href = href;
+        const protocol = link.protocol.toLowerCase();
+        if (allowed.indexOf(protocol) < 0) {
+            throw new Error(protocol + ' is not a valid URL protocol');
+        }
+    }
     /**
      * Get a pseudo link callback that loads a document into the existing or a new window.
      * @param {string} dest a URL to be loaded for the link
      */
     function executeLink(dest) {
+        validateURL(dest);
         const newWindow = window.open(dest, '_blank');
         if (newWindow)
             newWindow.focus();

package/oj-c/tag-cloud-item/component.json

@@ -1,7 +1,7 @@
 {
   "name": "tag-cloud-item",
-  "version": "20.0.4",
-  "jetVersion": "^20.0.4",
+  "version": "20.0.6",
+  "jetVersion": "^20.0.6",
   "pack": "oj-c",
   "type": "composite",
   "dependencyScope": "runtime",

package/oj-c/text-area/component.json

@@ -1,7 +1,7 @@
 {
   "name": "text-area",
-  "version": "20.0.4",
-  "jetVersion": "^20.0.4",
+  "version": "20.0.6",
+  "jetVersion": "^20.0.6",
   "pack": "oj-c",
   "type": "composite",
   "dependencyScope": "runtime",
@@ -27,7 +27,7 @@
     },
     "webelement": {
       "package": "@oracle/oraclejet-core-pack",
-      "version": "20.0.4",
+      "version": "20.0.6",
       "docUrl": "https://www.oracle.com/webfolder/technetwork/jet/cpwdtsdoc/classes/TextAreaWebElement.html",
       "export": "findTextArea",
       "main": "@oracle/oraclejet-core-pack/webdriver"

package/oj-c/toggle-button/component.json

@@ -1,7 +1,7 @@
 {
   "name": "toggle-button",
-  "version": "20.0.4",
-  "jetVersion": "^20.0.4",
+  "version": "20.0.6",
+  "jetVersion": "^20.0.6",
   "pack": "oj-c",
   "type": "composite",
   "dependencyScope": "runtime",
@@ -28,7 +28,7 @@
     },
     "webelement": {
       "package": "@oracle/oraclejet-core-pack",
-      "version": "20.0.4",
+      "version": "20.0.6",
       "docUrl": "https://www.oracle.com/webfolder/technetwork/jet/cpwdtsdoc/classes/ToggleButtonWebElement.html",
       "export": "findToggleButton",
       "main": "@oracle/oraclejet-core-pack/webdriver"

package/oj-c/toolbar/component.json

@@ -1,7 +1,7 @@
 {
   "name": "toolbar",
-  "version": "20.0.4",
-  "jetVersion": "^20.0.4",
+  "version": "20.0.6",
+  "jetVersion": "^20.0.6",
   "pack": "oj-c",
   "type": "composite",
   "dependencyScope": "runtime",
@@ -38,7 +38,7 @@
     },
     "webelement": {
       "package": "@oracle/oraclejet-core-pack",
-      "version": "20.0.4",
+      "version": "20.0.6",
       "docUrl": "https://www.oracle.com/webfolder/technetwork/jet/cpwdtsdoc/classes/ToolbarWebElement.html",
       "export": "findToolbar",
       "main": "@oracle/oraclejet-core-pack/webdriver"

package/oj-c/truncating-badge/component.json

@@ -1,7 +1,7 @@
 {
   "name": "truncating-badge",
-  "version": "20.0.4",
-  "jetVersion": "^20.0.4",
+  "version": "20.0.6",
+  "jetVersion": "^20.0.6",
   "pack": "oj-c",
   "type": "composite",
   "dependencyScope": "runtime",
@@ -34,7 +34,7 @@
     },
     "webelement": {
       "package": "@oracle/oraclejet-core-pack",
-      "version": "20.0.4",
+      "version": "20.0.6",
       "docUrl": "https://www.oracle.com/webfolder/technetwork/jet/cpwdtsdoc/classes/TruncatingBadgeWebElement.html",
       "export": "findTruncatingBadge",
       "main": "@oracle/oraclejet-core-pack/webdriver"

package/oj-c/truncating-text/component.json

@@ -1,7 +1,7 @@
 {
   "name": "truncating-text",
-  "version": "20.0.4",
-  "jetVersion": "^20.0.4",
+  "version": "20.0.6",
+  "jetVersion": "^20.0.6",
   "pack": "oj-c",
   "type": "composite",
   "dependencyScope": "runtime",
@@ -34,7 +34,7 @@
     },
     "webelement": {
       "package": "@oracle/oraclejet-core-pack",
-      "version": "20.0.4",
+      "version": "20.0.6",
       "docUrl": "https://www.oracle.com/webfolder/technetwork/jet/cpwdtsdoc/classes/TruncatingTextWebElement.html",
       "export": "findTruncatingText",
       "main": "@oracle/oraclejet-core-pack/webdriver"

package/oj-c/types/labelled-link/labelled-link.d.ts

@@ -42,11 +42,16 @@ export type LabelledLinkProps = ObservedGlobalProps<'aria-describedby'> & {
     containerReadonly?: boolean;
     /**
      * @description
-     * Specifies the URL that the link points to. If the href is provided, clicking the link
+     * Specifies the URL that the link points to. If a safe href is provided, clicking the link
      * will trigger the default browser behavior and will open the link. The
      * <code class="prettyprint">ojAction</code> event will not be triggered. If the href property is
      * not provided, then the default browser behavior will be prevented and the
      * <code class="prettyprint">ojAction</code> event will be triggered.
+     * <p><b>Note:</b> This value is rendered as a link
+     * <code class="prettyprint">href</code>. Applications are responsible for providing trusted
+     * URLs, choosing protocols appropriate for their use case, and enforcing any required origin or
+     * host allowlist. Unsafe URL protocols are blocked by omitting the rendered navigable href;
+     * blocked href values do not trigger <code class="prettyprint">ojAction</code>.</p>
      * @ojmetadata description "Sets the URL that the link points to."
      * @ojmetadata displayName "Href"
      * @ojmetadata help "#href"
@@ -208,8 +213,9 @@ export type LabelledLinkProps = ObservedGlobalProps<'aria-describedby'> & {
     userAssistanceDensity?: PreactLabelledLinkProps['userAssistanceDensity'];
     /**
      * @ojmetadata description "Triggered when the link is clicked, whether by keyboard, mouse,
-     * or touch events. This event is triggered only when the href is not provided. If the href
-     * is provided, clicking the link will not trigger this event."
+     * or touch events. This event is triggered only when the href is not provided. If a safe href
+     * is provided, clicking the link will not trigger this event. If an unsafe href protocol is
+     * provided, the navigable href is omitted and this event is not triggered."
      * @ojmetadata eventGroup "common"
      * @ojmetadata displayName "onOjAction"
      * @ojmetadata help "#event:action"
@@ -417,11 +423,16 @@ export interface CLabelledLinkElementSettableProperties extends JetSettablePrope
      */
     containerReadonly?: LabelledLinkProps['containerReadonly'];
     /**
-     * Specifies the URL that the link points to. If the href is provided, clicking the link
+     * Specifies the URL that the link points to. If a safe href is provided, clicking the link
      * will trigger the default browser behavior and will open the link. The
      * <code class="prettyprint">ojAction</code> event will not be triggered. If the href property is
      * not provided, then the default browser behavior will be prevented and the
      * <code class="prettyprint">ojAction</code> event will be triggered.
+     * <p><b>Note:</b> This value is rendered as a link
+     * <code class="prettyprint">href</code>. Applications are responsible for providing trusted
+     * URLs, choosing protocols appropriate for their use case, and enforcing any required origin or
+     * host allowlist. Unsafe URL protocols are blocked by omitting the rendered navigable href;
+     * blocked href values do not trigger <code class="prettyprint">ojAction</code>.</p>
      */
     href?: LabelledLinkProps['href'];
     /**

package/oj-c/types/message-banner/message-banner.d.ts

@@ -224,9 +224,12 @@ type MessageBannerProps<K extends string | number, D extends MessageBannerItem>
  * <p>The <code class="prettyprint">MessageBannerItem["sound"]</code> property is an accessibility
  * feature for playing a sound when a message is opened. This property defaults to "none", and can
  * be enabled by setting it to "default" or by providing a URL to an audio file of a format that the
- * browser supports. An accessible application must provide a way for users to enable sound on a
- * settings or preferences page. Some browsers will have auto-play disabled by default, enabling
- * it may require adjusting the browser settings.</p>
+ * browser supports. Custom sound URLs are validated before playback. Relative URLs and URLs that
+ * resolve to <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+ * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+ * supported. An accessible application must provide a way for users to enable sound on a settings
+ * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+ * require adjusting the browser settings.</p>
  *
  * <h3 id="keyboard-section">
  *   Keyboard End User Information

package/oj-c/types/message-toast/message-toast.d.ts

@@ -242,9 +242,12 @@ type MessageToastProps<K extends string | number, D extends MessageToastItem> =
  * <p>The <code class="prettyprint">MessageToastItem["sound"]</code> property is an accessibility
  * feature for playing a sound when a message is opened. This property defaults to "none", and can
  * be enabled by setting it to "default" or by providing a URL to an audio file of a format that the
- * browser supports. An accessible application must provide a way for users to enable sound on a
- * settings or preferences page. Some browsers will have auto-play disabled by default, enabling
- * it may require adjusting the browser settings.</p>
+ * browser supports. Custom sound URLs are validated before playback. Relative URLs and URLs that
+ * resolve to <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+ * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+ * supported. An accessible application must provide a way for users to enable sound on a settings
+ * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+ * require adjusting the browser settings.</p>
  *
  * <h3 id="keyboard-section">
  *   Keyboard End User Information

package/oj-c/types/tab-bar/DataTabBar.types.d.ts

@@ -78,6 +78,9 @@ export type TabLinkItemData<K extends string | number> = {
     tabPanelId?: string;
     /**
      * Sets the URL that the hyperlink points to. If there is no valid URL use "#" for href value to navigate to the top of the page.
+     * <p><b>Note:</b> This value is rendered as a link <code class="prettyprint">href</code>.
+     * Applications are responsible for providing trusted URLs, choosing protocols appropriate for
+     * their use case, and enforcing any required origin or host allowlist.</p>
      */
     href: string;
 };

package/oj-c/types/tab-bar/tab-bar.d.ts

@@ -87,6 +87,9 @@ export type TabLinkItemData<K extends string | number> = {
     tabPanelId?: string;
     /**
      * Sets the URL that the hyperlink points to. If there is no valid URL use "#" for href value to navigate to the top of the page.
+     * <p><b>Note:</b> This value is rendered as a link <code class="prettyprint">href</code>.
+     * Applications are responsible for providing trusted URLs, choosing protocols appropriate for
+     * their use case, and enforcing any required origin or host allowlist.</p>
      */
     href: string;
 };

package/oj-c/types/tag-cloud-item/tag-cloud-item.d.ts

@@ -35,6 +35,11 @@ export type TagCloudItemProps = {
     /**
      * @description
      * The url this item references.
+     * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+     * currently supports <code class="prettyprint">http:</code> and
+     * <code class="prettyprint">https:</code> protocols. JET does not validate whether the
+     * URL is trusted for the application. Applications are responsible for providing
+     * sanitized URLs and enforcing any required origin or host allowlist.</p>
      * @ojmetadata description "The url this item references."
      * @ojmetadata displayName "Url"
      * @ojmetadata help "#url"
@@ -103,6 +108,11 @@ export interface CTagCloudItemElementSettableProperties extends JetSettablePrope
     shortDesc?: TagCloudItemProps['shortDesc'];
     /**
      * The url this item references.
+     * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+     * currently supports <code class="prettyprint">http:</code> and
+     * <code class="prettyprint">https:</code> protocols. JET does not validate whether the
+     * URL is trusted for the application. Applications are responsible for providing
+     * sanitized URLs and enforcing any required origin or host allowlist.</p>
      */
     url?: TagCloudItemProps['url'];
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oracle/oraclejet-core-pack",
-  "version": "20.0.4",
+  "version": "20.0.6",
   "description": "JET core components fully implemented in VDOM",
   "keywords": [
     "oraclejet"
@@ -9,11 +9,11 @@
   "oracle-exchange": "oj-c",
   "devDependencies": {},
   "dependencies": {
-    "@oracle/oraclejet": "20.0.4",
-    "@oracle/oraclejet-preact": "20.0.4",
-    "@oracle/oraclejet-selenium-driver": "20.0.4",
-    "@oracle/oraclejet-testing": "20.0.4",
-    "@oracle/oraclejet-webdriver": "20.0.4"
+    "@oracle/oraclejet": "20.0.6",
+    "@oracle/oraclejet-preact": "20.0.6",
+    "@oracle/oraclejet-selenium-driver": "20.0.6",
+    "@oracle/oraclejet-testing": "20.0.6",
+    "@oracle/oraclejet-webdriver": "20.0.6"
   },
   "peerDependencies": {
     "selenium-webdriver": ">=4.0.0"