@particle-academy/react-fancy 5.71.3 → 6.0.0

package/CHANGELOG.md

@@ -11,6 +11,122 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.0.0] - 2026-11-01
+
+### Changed
+
+- **BREAKING: `Button` defaults to `type="button"`.** A `<Button>` with no
+  `type` used to render a bare `<button>`, and the HTML default for a bare
+  `<button>` is `submit`. Every Button inside a `<form>` therefore submitted it
+  on click, including a Cancel, a toolbar toggle, and the kit's own internal
+  buttons (listed below). An explicit `type` still wins: `type="submit"`,
+  `type="reset"` and `type="button"` render exactly as written.
+  (`type={undefined}`, which a wrapper forwarding an optional prop passes, gets
+  the default too.)
+
+  **What a consumer must DO:** add `type="submit"` to every `<Button>` (or the
+  deprecated `<Action>`) that is meant to submit a form. To find candidates,
+  list the Buttons in every file that renders a form:
+
+  ```bash
+  grep -rlE '<(form|Form)\b' --include='*.tsx' --include='*.jsx' src resources/js \
+    | xargs grep -nE '<(Button|Action)\b'
+  ```
+
+  Any hit without a `type` that is the form's Save / Submit / Send / Sign in is
+  one to change. Also check Buttons that submit a form from OUTSIDE it with the
+  `form="<id>"` attribute (`grep -rnE '\bform="' --include='*.tsx' --include='*.jsx' .`):
+  those need `type="submit"` as well. One more effect of the same cause: per the
+  HTML spec, pressing Enter in a field submits through the form's first submit
+  button, so a form with several fields whose only submit was an untyped Button
+  also stops submitting on Enter. Adding `type="submit"` restores both.
+
+  **What needs no action:**
+  - Buttons outside any `<form>` (the large majority). `button` and `submit`
+    behave identically there.
+  - Buttons that already pass a `type`.
+  - Anchor-mode Buttons (`href`, not disabled): they render an `<a>`, which has
+    no submit behaviour, and still get no `type` attribute. A disabled Button
+    with an `href` falls back to a `<button>` and gets the default like any
+    other.
+  - Forms submitted from code (`form.requestSubmit()`, a fetch in `onClick`).
+
+  **Internal components whose effective button type changed** (`submit` to
+  `button`; none of them was meant to submit a host's form, and each one now
+  stops doing so):
+  - **`PromptInput`**: the attach button, the send button (both
+    `sendButton="label"` and `"icon"`), and the attachment chip's remove button
+    (a native `<button>` with no type; fixed directly). Sending still calls
+    `onSubmit` exactly as before. **If you wrapped `PromptInput` in your own
+    `<form>` and relied on clicking send to ALSO submit that form natively**
+    (for its `name` / `pasteFilesName` fields), call `form.requestSubmit()` from
+    your `onSubmit`. ⌘/Ctrl+Enter never submitted the enclosing form, so until
+    now the click did and the keyboard did not.
+  - **`JsonEditor`**: the pending-strip accept / reject, the add (`+`) button,
+    and every row button: expand toggle, add, move up / move down, remove,
+    pending accept / reject, and the add form's Add / Cancel.
+  - **`MagicWand`**: every action in the floating / pill toolbar.
+  - **`ReasonTag`**: the "ask follow-up" button in its popover.
+
+  Already explicit, so unchanged: `ChatThread` (load earlier, jump to latest),
+  `ChatMessage` proposal accept / reject, and the `ContentRenderer` copy button.
+  Components that render their own native `<button>` (Dropdown triggers, Modal
+  close, Tabs, Accordion, Pagination, Calendar navigation, ColorPicker,
+  Sidebar, FullScreen toggle and the rest) do not go through `Button` and
+  already set `type="button"`; nothing about them changed. The one exception
+  was the `PromptInput` attachment chip above.
+
+  Raised with the Change Council as a MAJOR change: **CC-fancy-0003**, approved
+  by the owner on 2026-11-01 ("consumers need to adopt and adapt").
+  **A `^5` range will not receive this release**, by design: npm will not cross
+  a major on its own. Upgrading is a deliberate `npm install
+  @particle-academy/react-fancy@^6`. Sibling packages that declare a peer range
+  capped at `<6` must widen it before a consumer can install them alongside 6.
+
+- `docs/Button.md` documents the `type` prop and its default, with a form
+  example.
+- The `PromptInput` markup snapshots (`tests/__snapshots__/prompt-input-draft.test.tsx.snap`)
+  gained `type="button"` on the attach and send buttons, and nothing else.
+
+## [5.72.0] - 2026-11-01
+
+### Added
+
+- **`blob:` hrefs are accepted** (reported by Genie). A `URL.createObjectURL`
+  URL for an in-memory file was refused by `sanitizeHref` without a word, so
+  `<Button href="blob:...">` rendered a plain `<button>` and the link was
+  dead. `blob:` is accepted in the form a browser mints it,
+  `blob:<origin>/<id>` with an `http(s)://`, `null` or `file://` origin;
+  `blob:javascript:...`, `blob:data:...` and other wrappers stay refused. The
+  allow-list is shared, so this reaches every caller of it:
+  - `Button` (`href`, anchor mode)
+  - `ChatThread` / `ChatMessage` attachment links (`attachment.url`)
+  - `ContentRenderer` extension-tag attributes (`href`, `src`, `action`,
+    `formaction`, `xlink:href`)
+  - `sanitizeHtml` in its default (blocklist) mode, and so `ContentRenderer`,
+    `Editor` and `renderMarkdown` without `sanitize` options. Allowlist mode
+    (`sanitizeHtml(html, options)`) is unchanged: it keeps only the schemes
+    you list.
+  - the exported `sanitizeHref` itself
+- **A development warning when a component drops an href.** `Button` and
+  `ChatMessage` now `console.warn` once per distinct href when a non-empty
+  href is refused, naming the component and the scheme and showing only a
+  short prefix of the URL. Nothing is logged in production
+  (`NODE_ENV === "production"`), for an empty or missing href, or when
+  sanitising content (markdown, HTML, extension tags), where refusing hostile
+  markup is the job rather than a mistake.
+
+### Security
+
+- **`data:` remains refused, by decision**, for every media type and with or
+  without `download`: a navigable `data:text/html` is the risky case. Now
+  pinned by tests, together with `javascript:`, `vbscript:`, `file:` and the
+  obfuscated spellings (leading control characters, mixed case, whitespace
+  inside the scheme, entity and percent-encoded colons).
+
+**Consumer action: none.** An href that was silently dropped now works if it
+is `blob:`, and otherwise warns in development.
+
 ## [5.71.3] - 2026-11-01
 
 ### Fixed

package/dist/button.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
 require('./chunk-M5MUGSON.cjs');
-var chunk2KQVBD7K_cjs = require('./chunk-2KQVBD7K.cjs');
+var chunkBX6ZVWTO_cjs = require('./chunk-BX6ZVWTO.cjs');
 require('./chunk-XCZZVRBY.cjs');
 require('./chunk-MXWR3T3N.cjs');
 require('./chunk-ZU5Q77OT.cjs');
@@ -10,11 +10,11 @@ require('./chunk-ZU5Q77OT.cjs');
 
 Object.defineProperty(exports, "Action", {
   enumerable: true,
-  get: function () { return chunk2KQVBD7K_cjs.Action; }
+  get: function () { return chunkBX6ZVWTO_cjs.Action; }
 });
 Object.defineProperty(exports, "Button", {
   enumerable: true,
-  get: function () { return chunk2KQVBD7K_cjs.Button; }
+  get: function () { return chunkBX6ZVWTO_cjs.Button; }
 });
 //# sourceMappingURL=button.cjs.map
 //# sourceMappingURL=button.cjs.map

package/dist/button.js

@@ -1,5 +1,5 @@
 import './chunk-LQ4ICCN2.js';
-export { Action, Button } from './chunk-VV5435PS.js';
+export { Action, Button } from './chunk-WLDDGIGC.js';
 import './chunk-45BBNJQD.js';
 import './chunk-J3A4Z2P7.js';
 import './chunk-MMW2JGKZ.js';

package/dist/chat-thread.cjs

@@ -1,14 +1,14 @@
 'use strict';
 
-var chunk7PUTP2N7_cjs = require('./chunk-7PUTP2N7.cjs');
+var chunkIA6JKI4P_cjs = require('./chunk-IA6JKI4P.cjs');
 require('./chunk-S3TRSECD.cjs');
-require('./chunk-JGEFIWDA.cjs');
+require('./chunk-JKH5ODNG.cjs');
 require('./chunk-2C64OVOZ.cjs');
 require('./chunk-BJL3VDRK.cjs');
 require('./chunk-VBWRH4UW.cjs');
 require('./chunk-MOU6O324.cjs');
 require('./chunk-M5MUGSON.cjs');
-require('./chunk-2KQVBD7K.cjs');
+require('./chunk-BX6ZVWTO.cjs');
 require('./chunk-XCZZVRBY.cjs');
 require('./chunk-MXWR3T3N.cjs');
 require('./chunk-ZU5Q77OT.cjs');
@@ -17,11 +17,11 @@ require('./chunk-ZU5Q77OT.cjs');
 
 Object.defineProperty(exports, "ChatMessage", {
   enumerable: true,
-  get: function () { return chunk7PUTP2N7_cjs.ChatMessage; }
+  get: function () { return chunkIA6JKI4P_cjs.ChatMessage; }
 });
 Object.defineProperty(exports, "ChatThread", {
   enumerable: true,
-  get: function () { return chunk7PUTP2N7_cjs.ChatThread; }
+  get: function () { return chunkIA6JKI4P_cjs.ChatThread; }
 });
 //# sourceMappingURL=chat-thread.cjs.map
 //# sourceMappingURL=chat-thread.cjs.map

package/dist/chat-thread.js

@@ -1,12 +1,12 @@
-export { ChatMessage, ChatThread } from './chunk-WFEX7DAR.js';
+export { ChatMessage, ChatThread } from './chunk-PACFMPSX.js';
 import './chunk-AUTW5O4W.js';
-import './chunk-FJJ3GMXI.js';
+import './chunk-GBR4Q6CP.js';
 import './chunk-I3LAFKJU.js';
 import './chunk-UZCR7DK5.js';
 import './chunk-IQ4KQJAO.js';
 import './chunk-6FCQD2KQ.js';
 import './chunk-LQ4ICCN2.js';
-import './chunk-VV5435PS.js';
+import './chunk-WLDDGIGC.js';
 import './chunk-45BBNJQD.js';
 import './chunk-J3A4Z2P7.js';
 import './chunk-MMW2JGKZ.js';

package/dist/{chunk-R2MFCR7H.js → chunk-3RIBZZLT.js}

@@ -10,7 +10,7 @@ import { ColorPicker } from './chunk-SVSQXKFL.js';
 import { useInlineEdit } from './chunk-OL53XYHF.js';
 import { isImeComposing } from './chunk-S42OGG43.js';
 import { Badge } from './chunk-6FCQD2KQ.js';
-import { Button } from './chunk-VV5435PS.js';
+import { Button } from './chunk-WLDDGIGC.js';
 import { Callout } from './chunk-ZXZJYVWP.js';
 import { cn } from './chunk-MMW2JGKZ.js';
 import { createContext, forwardRef, useId, useRef, useMemo, useState, useEffect, useCallback, useContext } from 'react';
@@ -1338,5 +1338,5 @@ function buildItems({
 }
 
 export { JSON_FIELD_TYPES, JsonEditor, applyJsonEdit, describeEdit, findJsonConflicts, getAtPath, inferType, parseKeyMap, parsePath, pathToString, resolveKeyRule, typeMatches };
-//# sourceMappingURL=chunk-R2MFCR7H.js.map
-//# sourceMappingURL=chunk-R2MFCR7H.js.map
+//# sourceMappingURL=chunk-3RIBZZLT.js.map
+//# sourceMappingURL=chunk-3RIBZZLT.js.map