@sankyu/react-circle-flags 1.4.0 → 1.4.2

package/README.md

@@ -12,22 +12,22 @@
 
 [![TypeScript Supported](https://img.shields.io/badge/TypeScript-Supported-blue?style=flat-square&logo=typescript)](https://www.typescriptlang.org/) [![React Ready](https://img.shields.io/badge/React-%3E%3D16.0.0-61dafb?style=flat-square&logo=react)](https://reactjs.org/) [![MIT License](https://img.shields.io/badge/License-MIT-green?style=flat-square&logo=opensourceinitiative)](./LICENSE)
 
+---
+
 :star: **Star us on [GitHub](https://github.com/Sankyu-Lab/react-circle-flags)** | :bug: **Report Issues [here](https://github.com/Sankyu-Lab/react-circle-flags/issues)**
 
+:rocket: **Explore the [Demo Gallery](https://sankyu-lab.github.io/react-circle-flags/browse)** | :book: **Read the [Documentation](https://sankyu-lab.github.io/react-circle-flags/docs/guides/getting-started/)**
+
 </div>
 
 ---
 
-Welcome to `@sankyu/react-circle-flags`, a modern React library for circular flag components.
-
 ## 📖 Overview
 
 This library provides **400+ circular SVG flag components** with **Full-TypeScript support** & **Tree-shaking Optimization**.
 
 Perfect for applications that need fast, crisp country flags without external image requests.
 
-:rocket: **Explore the [Demo Gallery](https://sankyu-lab.github.io/react-circle-flags/browse)** | :book: **Read the [Documentation](https://sankyu-lab.github.io/react-circle-flags/docs/guides/getting-started/)**
-
 ---
 
 ## ✨ Key Features

package/dist/index.cjs

@@ -13045,7 +13045,7 @@ var FLAG_REGISTRY = {
 
 // package.json
 var package_default = {
-  version: "1.4.0"};
+  version: "1.4.2"};
 
 // src/meta.ts
 var parseBuiltAt = (source) => {
@@ -13054,7 +13054,7 @@ var parseBuiltAt = (source) => {
 };
 var commit = "dev" ;
 var builtAt = parseBuiltAt(
-  "1767524281241" 
+  "1767709251902" 
 );
 var buildMeta = {
   version: package_default.version,
@@ -13068,6 +13068,28 @@ function codeToEmoji(code) {
   const aCode = "A".charCodeAt(0);
   return [...upperCode].map((char) => String.fromCodePoint(base + char.charCodeAt(0) - aCode)).join("");
 }
+function sanitizeSvg(raw) {
+  if (typeof DOMParser === "undefined") return raw;
+  const parser = new DOMParser();
+  const doc = parser.parseFromString(raw, "image/svg+xml");
+  const svg = doc.documentElement;
+  if (!svg || doc.querySelector("parsererror")) return raw;
+  svg.querySelectorAll("script,foreignObject").forEach((el) => el.remove());
+  svg.querySelectorAll("*").forEach((el) => {
+    Array.from(el.attributes).forEach((attr) => {
+      const name = attr.name.toLowerCase();
+      const value = attr.value.trim().toLowerCase();
+      if (name.startsWith("on")) {
+        el.removeAttribute(attr.name);
+        return;
+      }
+      if ((name === "href" || name === "xlink:href") && value.startsWith("javascript:")) {
+        el.removeAttribute(attr.name);
+      }
+    });
+  });
+  return svg.outerHTML;
+}
 var DEFAULT_CDN_ENDPOINT = "https://hatscripts.github.io/circle-flags/flags/";
 var FlagSizes = {
   xs: 16,
@@ -13138,7 +13160,8 @@ var CircleFlag = ({
           throw new Error(`Failed to load flag: ${response.statusText}`);
         }
         const svg = await response.text();
-        setSvgContent(svg);
+        const sanitizedSvg = sanitizeSvg(svg);
+        setSvgContent(sanitizedSvg);
         setError(false);
       } catch (err) {
         console.warn(`Failed to load flag for country code: ${finalCountryCode}`, err);

package/dist/index.mjs

@@ -13043,7 +13043,7 @@ var FLAG_REGISTRY = {
 
 // package.json
 var package_default = {
-  version: "1.4.0"};
+  version: "1.4.2"};
 
 // src/meta.ts
 var parseBuiltAt = (source) => {
@@ -13052,7 +13052,7 @@ var parseBuiltAt = (source) => {
 };
 var commit = "dev" ;
 var builtAt = parseBuiltAt(
-  "1767524281241" 
+  "1767709251902" 
 );
 var buildMeta = {
   version: package_default.version,
@@ -13066,6 +13066,28 @@ function codeToEmoji(code) {
   const aCode = "A".charCodeAt(0);
   return [...upperCode].map((char) => String.fromCodePoint(base + char.charCodeAt(0) - aCode)).join("");
 }
+function sanitizeSvg(raw) {
+  if (typeof DOMParser === "undefined") return raw;
+  const parser = new DOMParser();
+  const doc = parser.parseFromString(raw, "image/svg+xml");
+  const svg = doc.documentElement;
+  if (!svg || doc.querySelector("parsererror")) return raw;
+  svg.querySelectorAll("script,foreignObject").forEach((el) => el.remove());
+  svg.querySelectorAll("*").forEach((el) => {
+    Array.from(el.attributes).forEach((attr) => {
+      const name = attr.name.toLowerCase();
+      const value = attr.value.trim().toLowerCase();
+      if (name.startsWith("on")) {
+        el.removeAttribute(attr.name);
+        return;
+      }
+      if ((name === "href" || name === "xlink:href") && value.startsWith("javascript:")) {
+        el.removeAttribute(attr.name);
+      }
+    });
+  });
+  return svg.outerHTML;
+}
 var DEFAULT_CDN_ENDPOINT = "https://hatscripts.github.io/circle-flags/flags/";
 var FlagSizes = {
   xs: 16,
@@ -13136,7 +13158,8 @@ var CircleFlag = ({
           throw new Error(`Failed to load flag: ${response.statusText}`);
         }
         const svg = await response.text();
-        setSvgContent(svg);
+        const sanitizedSvg = sanitizeSvg(svg);
+        setSvgContent(sanitizedSvg);
         setError(false);
       } catch (err) {
         console.warn(`Failed to load flag for country code: ${finalCountryCode}`, err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sankyu/react-circle-flags",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "📦 400+ circular SVG React flags — tree-shakeable, TypeScript-ready, SSR-compatible, zero deps.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -91,7 +91,7 @@
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^14.3.1",
     "@types/jest": "^30.0.0",
-    "@types/node": "^22.19.3",
+    "@types/node": "^25.0.3",
     "@types/react": "^18.3.27",
     "@typescript-eslint/eslint-plugin": "^8.51.0",
     "@typescript-eslint/parser": "^8.51.0",
@@ -99,8 +99,8 @@
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.5.4",
     "eslint-plugin-react": "^7.37.5",
-    "eslint-plugin-react-hooks": "^5.2.0",
-    "globals": "^16.5.0",
+    "eslint-plugin-react-hooks": "^7.0.1",
+    "globals": "^17.0.0",
     "husky": "^9.1.7",
     "jest": "^30.2.0",
     "jest-environment-jsdom": "^30.2.0",