@shopify/shop-minis-react 0.4.8 → 0.4.10

package/dist/_virtual/index4.js

@@ -1,5 +1,5 @@
-var e = { exports: {} };
+var r = {};
 export {
-  e as __module
+  r as __exports
 };
 //# sourceMappingURL=index4.js.map

package/dist/_virtual/index5.js

@@ -1,6 +1,5 @@
-import { __require as r } from "../shop-minis-react/node_modules/.pnpm/@xmldom_xmldom@0.8.10/node_modules/@xmldom/xmldom/lib/index.js";
-var i = r();
+var e = { exports: {} };
 export {
-  i as l
+  e as __module
 };
 //# sourceMappingURL=index5.js.map

package/dist/_virtual/index5.js.map

@@ -1 +1 @@
-{"version":3,"file":"index5.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;"}
+{"version":3,"file":"index5.js","sources":[],"sourcesContent":[],"names":[],"mappings":";"}

package/dist/_virtual/index6.js

@@ -1,5 +1,6 @@
-var r = {};
+import { __require as r } from "../shop-minis-react/node_modules/.pnpm/@xmldom_xmldom@0.8.10/node_modules/@xmldom/xmldom/lib/index.js";
+var i = r();
 export {
-  r as __exports
+  i as l
 };
 //# sourceMappingURL=index6.js.map

package/dist/_virtual/index6.js.map

@@ -1 +1 @@
-{"version":3,"file":"index6.js","sources":[],"sourcesContent":[],"names":[],"mappings":";"}
+{"version":3,"file":"index6.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;"}

package/dist/shop-minis-react/node_modules/.pnpm/@videojs_xhr@2.7.0/node_modules/@videojs/xhr/lib/index.js

@@ -1,4 +1,4 @@
-import { __module as q } from "../../../../../../../../_virtual/index4.js";
+import { __module as q } from "../../../../../../../../_virtual/index5.js";
 import { __require as F } from "../../../../../global@4.4.0/node_modules/global/window.js";
 import { __require as N } from "../../../../../@babel_runtime@7.27.6/node_modules/@babel/runtime/helpers/extends.js";
 import { __require as J } from "../../../../../is-function@1.0.2/node_modules/is-function/index.js";

package/dist/shop-minis-react/node_modules/.pnpm/mpd-parser@1.3.1/node_modules/mpd-parser/dist/mpd-parser.es.js

@@ -2,7 +2,7 @@ import L from "../../../../@videojs_vhs-utils@4.1.1/node_modules/@videojs/vhs-ut
 import T from "../../../../../../../_virtual/window.js";
 import { forEachMediaGroup as Z } from "../../../../@videojs_vhs-utils@4.1.1/node_modules/@videojs/vhs-utils/es/media-groups.js";
 import J from "../../../../@videojs_vhs-utils@4.1.1/node_modules/@videojs/vhs-utils/es/decode-b64-to-uint8-array.js";
-import { l as Q } from "../../../../../../../_virtual/index5.js";
+import { l as Q } from "../../../../../../../_virtual/index6.js";
 /*! @name mpd-parser @version 1.3.1 @license Apache-2.0 */
 const w = (e) => !!e && typeof e == "object", E = (...e) => e.reduce((n, t) => (typeof t != "object" || Object.keys(t).forEach((r) => {
   Array.isArray(n[r]) && Array.isArray(t[r]) ? n[r] = n[r].concat(t[r]) : w(n[r]) && w(t[r]) ? n[r] = E(n[r], t[r]) : n[r] = t[r];

package/dist/shop-minis-react/node_modules/.pnpm/querystringify@2.2.0/node_modules/querystringify/index.js

@@ -1,4 +1,4 @@
-import { __exports as i } from "../../../../../../_virtual/index6.js";
+import { __exports as i } from "../../../../../../_virtual/index4.js";
 var c;
 function d() {
   if (c) return i;

package/eslint/README.md

@@ -39,6 +39,9 @@ npx eslint . --fix
 ### Security Rules (Using Built-in ESLint Rules)
 - ✅ WebAssembly usage blocked - prevents WASM in Shop Minis environment
 - ✅ Unsafe code execution blocked - prevents `eval()`, Function constructor, and dynamic code execution
+- ✅ `dangerouslySetInnerHTML` blocked - prevents XSS vulnerabilities
+- ✅ `window.open` blocked - use SDK navigation instead
+- ✅ Navigator APIs blocked - `clipboard`, `credentials`, `geolocation`, `share` are not available
 
 ## Rules
 
@@ -234,6 +237,62 @@ window.location = 'https://example.com'
 - `no-implied-eval` - blocks `setTimeout()` / `setInterval()` with string arguments
 - `no-script-url` - blocks `javascript:` URLs
 
+### Dangerous HTML Injection
+
+**Rule:** `react/no-danger`
+
+```tsx
+// ❌ Error
+<div dangerouslySetInnerHTML={{__html: userInput}} />
+
+// ✅ Correct
+<div>{sanitizedContent}</div>
+```
+
+**Why:** Injecting raw HTML can lead to XSS (Cross-Site Scripting) attacks.
+
+### Window Open Restriction
+
+**Rule:** `no-restricted-syntax`
+
+```tsx
+// ❌ Error
+window.open('https://example.com', '_blank')
+
+// ✅ Correct
+// Use SDK navigation methods instead
+import {useNavigation} from '@shopify/shop-minis-react'
+const {navigate} = useNavigation()
+navigate('https://example.com')
+```
+
+**Why:** `window.open` is not allowed in the Shop Minis environment. Use SDK navigation methods instead.
+
+### Navigator API Restrictions
+
+**Rule:** `no-restricted-syntax`
+
+The following Navigator APIs are not available in the Shop Minis environment:
+
+```tsx
+// ❌ Error - Clipboard API
+navigator.clipboard.writeText('text')
+navigator.clipboard.readText()
+
+// ❌ Error - Credentials API
+navigator.credentials.get({password: true})
+navigator.credentials.store(credential)
+
+// ❌ Error - Geolocation API
+navigator.geolocation.getCurrentPosition(callback)
+navigator.geolocation.watchPosition(callback)
+
+// ❌ Error - Share API
+navigator.share({title: 'Title', url: 'https://...'})
+```
+
+**Why:** These browser APIs are not supported in the Shop Minis security sandbox. Use the appropriate SDK alternatives when available.
+
 ## Extending Rules
 
 To add more component mappings to `prefer-sdk-components`, edit `eslint/rules/prefer-sdk-components.cjs`:

package/eslint/config.cjs

@@ -62,6 +62,7 @@ module.exports = {
     ],
     'no-restricted-syntax': [
       'error',
+      // WebAssembly restrictions
       {
         selector: "MemberExpression[object.name='WebAssembly']",
         message:
@@ -72,6 +73,38 @@ module.exports = {
         message:
           'WebAssembly is not supported in the Shop Minis environment. Consider using alternative JavaScript implementations.',
       },
+      // window.open restriction
+      {
+        selector:
+          "CallExpression[callee.object.name='window'][callee.property.name='open']",
+        message:
+          'window.open is not allowed in the Shop Minis environment. Use the appropriate SDK navigation methods instead.',
+      },
+      // Navigator API restrictions
+      {
+        selector:
+          "MemberExpression[object.name='navigator'][property.name='clipboard']",
+        message:
+          'navigator.clipboard is not available in the Shop Minis environment.',
+      },
+      {
+        selector:
+          "MemberExpression[object.name='navigator'][property.name='credentials']",
+        message:
+          'navigator.credentials is not available in the Shop Minis environment.',
+      },
+      {
+        selector:
+          "MemberExpression[object.name='navigator'][property.name='geolocation']",
+        message:
+          'navigator.geolocation is not available in the Shop Minis environment.',
+      },
+      {
+        selector:
+          "MemberExpression[object.name='navigator'][property.name='share']",
+        message:
+          'navigator.share is not available in the Shop Minis environment. Use the SDK share functionality instead.',
+      },
     ],
     'compat/compat': 'error',
   },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shopify/shop-minis-react",
   "license": "SEE LICENSE IN LICENSE.txt",
-  "version": "0.4.8",
+  "version": "0.4.10",
   "sideEffects": false,
   "type": "module",
   "engines": {
@@ -76,7 +76,6 @@
     "react-window": "1.8.11",
     "sonner": "2.0.5",
     "stylelint": "^16.26.1",
-    "stylelint-config-standard": "^39.0.1",
     "tailwind-merge": "2.6.0",
     "tailwindcss": "4.1.8",
     "thumbhash": "0.1.1",

package/stylelint/config.mjs

@@ -5,35 +5,8 @@ const __dirname = dirname(fileURLToPath(import.meta.url))
 
 /** @type {import('stylelint').Config} */
 const config = {
-  extends: ['stylelint-config-standard'],
   plugins: [join(__dirname, 'plugin-no-font-imports.mjs')],
   rules: {
-    // Tailwind CSS v4 at-rules
-    'at-rule-no-unknown': [
-      true,
-      {
-        ignoreAtRules: [
-          'theme',
-          'source',
-          'custom-variant',
-          'apply',
-          'config',
-          'plugin',
-          'utility',
-          'variant',
-          'tailwind',
-          'reference',
-        ],
-      },
-    ],
-    // Tailwind theme() function
-    'function-no-unknown': [
-      true,
-      {
-        ignoreFunctions: ['theme'],
-      },
-    ],
-    'import-notation': 'string',
     'plugin/no-font-imports': true,
   },
 }