@ui5/webcomponents-base 2.20.1 → 2.20.3

package/dist/prod/sap/base/util/now.js

@@ -1,9 +1,6 @@
-// @evo-todo window.performance does not exist on node.js, but there is a module performance-now. Maybe use it
-
 /**
- * Returns a high resolution timestamp in microseconds if supported by the environment, otherwise in milliseconds.
- * The timestamp is based on 01/01/1970 00:00:00 (UNIX epoch) as float with microsecond precision or
- * with millisecond precision, if high resolution timestamps are not available.
+ * Returns a high resolution timestamp in microseconds.
+ * The timestamp is based on 01/01/1970 00:00:00 (UNIX epoch) as float with microsecond precision.
  * The fractional part of the timestamp represents fractions of a millisecond.
  * Converting to a <code>Date</code> is possible by using <code>require(["sap/base/util/now"], function(now){new Date(now());}</code>
  *
@@ -11,18 +8,15 @@
  * @since 1.58
  * @public
  * @alias module:sap/base/util/now
- * @returns {float} timestamp in microseconds if supported by the environment otherwise in milliseconds
+ * @returns {float} timestamp in microseconds
  */ /*!
      * OpenUI5
-     * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
      * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
      */
 /*global performance */
 
-var fnNow = !(typeof window != "undefined" && window.performance && performance.now && performance.timing) ? Date.now : function () {
-  var iNavigationStart = performance.timing.navigationStart;
-  return function perfnow() {
-    return iNavigationStart + performance.now();
-  };
-}();
+var fnNow = function now() {
+  return performance.timeOrigin + performance.now();
+};
 export default fnNow;

package/dist/prod/sap/base/util/uid.js

@@ -4,7 +4,7 @@
  * @private
  */ /*!
      * OpenUI5
-     * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
      * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
      */
 

package/dist/prod/sap/ui/thirdparty/caja-html-sanitizer.js

@@ -118,7 +118,11 @@ var cssSchema = (function () {
         'inset' ], [ 'invert' ], [ 'justify' ], [ 'local' ], [ 'medium' ], [
         'mix' ], [ 'none' ], [ 'normal' ], [ 'once' ], [ 'repeat' ], [ 'scroll'
       ], [ 'separate' ], [ 'small-caps' ], [ 'spell-out' ], [ 'transparent' ],
-      [ 'visible' ] ];
+      [ 'visible' ],
+      // ##### BEGIN: MODIFIED BY SAP
+      [ 'flex', 'inline-flex', 'grid', 'inline-grid', 'flow-root', 'contents' ], [ 'initial', 'revert', 'revert-layer', 'unset' ]
+      // ##### END: MODIFIED BY SAP
+    ];
     return {
       '-moz-border-radius': {
         'cssExtra': c[ 0 ],
@@ -440,7 +444,9 @@ var cssSchema = (function () {
       },
       'display': {
         'cssPropBits': 32,
-        'cssLitGroup': [ L[ 2 ], L[ 47 ], L[ 54 ] ]
+        // ##### BEGIN: MODIFIED BY SAP
+        'cssLitGroup': [ L[ 2 ], L[ 47 ], L[ 54 ], L[ 64 ], L[ 65 ] ]
+        // ##### END: MODIFIED BY SAP
       },
       'elevation': {
         'cssPropBits': 5,
@@ -707,6 +713,12 @@ var cssSchema = (function () {
         'cssPropBits': 0,
         'cssLitGroup': [ L[ 18 ], L[ 47 ], L[ 54 ] ]
       },
+      // ##### BEGIN: MODIFIED BY SAP
+      'text-decoration-line': {
+        'cssPropBits': 0,
+        'cssLitGroup': [ L[ 18 ], L[ 47 ], L[ 54 ] ]
+      },
+      // ##### END: MODIFIED BY SAP
       'text-indent': {
         'cssPropBits': 5,
         'cssLitGroup': [ L[ 47 ] ]
@@ -2004,7 +2016,7 @@ if (typeof window !== 'undefined') {
 }
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 // Based on coding from the HTML4 Sanitizer by Google Inc.

package/dist/sap/base/Log.js

@@ -1,9 +1,8 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
-import BaseConfig from "./config.js";
 import now from "./util/now.js";
 /**
  * A Logging API for JavaScript.
@@ -202,8 +201,8 @@ function getLogEntryListenerInstance() {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -225,8 +224,8 @@ Log.fatal = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -248,8 +247,8 @@ Log.error = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -271,8 +270,8 @@ Log.warning = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -294,8 +293,8 @@ Log.info = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -317,8 +316,8 @@ Log.debug = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -418,8 +417,8 @@ Log.logSupportInfo = function (bEnabled) {
  * @param {string} [sComponent]
  *   The log component under which the message should be logged
  * @param {function} [fnSupportInfo] Callback that returns an additional support object to be
- *   logged in support mode. This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   logged in support mode. This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @returns {module:sap/base/Log.Entry}
@@ -734,17 +733,4 @@ Log.getLogger = function (sComponent, iDefaultLogLevel) {
   }
   return new Logger(sComponent);
 };
-
-// set LogLevel
-const sLogLevel = BaseConfig.get({
-  name: "sapUiLogLevel",
-  type: BaseConfig.Type.String,
-  defaultValue: undefined,
-  external: true
-});
-if (sLogLevel) {
-  Log.setLevel(Log.Level[sLogLevel.toUpperCase()] || parseInt(sLogLevel));
-} else if (!globalThis["sap-ui-optimized"]) {
-  Log.setLevel(Log.Level.DEBUG);
-}
 export default Log;

package/dist/sap/base/assert.js

@@ -19,7 +19,7 @@
  *
  */ /*!
      * OpenUI5
-     * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
      * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
      */
 

package/dist/sap/base/config/MemoryConfigurationProvider.js

@@ -1,6 +1,6 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 import uid from "../util/uid.js";

package/dist/sap/base/security/URLListValidator.js

@@ -1,11 +1,11 @@
 // validation regexes
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 
-var rBasicUrl = /^(?:([^:\/?#]+):)?((?:[\/\\]{2,}((?:\[[^\]]+\]|[^\/?#:]+))(?::([0-9]+))?)?([^?#]*))(?:\?([^#]*))?(?:#(.*))?$/;
+var rBasicUrl = /^(?:([^:\/?#]+):)?((?:[\/\\]{2,}(?:(?:[^@\/?#]*@)?(\[[^\]]+\]|[^\/?#:]+)(?::([0-9]+))?)?)?([^?#]*))(?:\?([^#]*))?(?:#(.*))?$/;
 var rCheckPath = /^([a-z0-9-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*$/i;
 var rCheckQuery = /^([a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9a-f]{2})*$/i;
 var rCheckFragment = rCheckQuery;
@@ -104,7 +104,8 @@ oURLListValidator.clear = function () {
  * @param {string} [protocol] The protocol of the URL, can be falsy to allow all protocols for an entry e.g. "", "http", "mailto"
  * @param {string} [host] The host of the URL, can be falsy to allow all hosts. A wildcard asterisk can be set at the beginning, e.g. "examples.com", "*.example.com"
  * @param {string} [port] The port of the URL, can be falsy to allow all ports, e.g. "", "8080"
- * @param {string} [path] the path of the URL, path of the url, can be falsy to allow all paths. A wildcard asterisk can be set at the end, e.g. "/my-example*", "/my-news"
+ * @param {string} [path] the path of the URL, e.g. "/my-news". Can be falsy to allow all paths. A wildcard asterisk can be set at the end to ensure a path starts with the given string, e.g. "/my-example*".
+ * 	When using wildcards, make sure to only provide normalized URLs to the validate function in order to mitigate the risk of path traversal attacks.
  * @public
  */
 oURLListValidator.add = function (protocol, host, port, path) {
@@ -139,13 +140,16 @@ oURLListValidator.entries = function () {
  * Validates a URL. Check if it's not a script or other security issue.
  *
  * <b>Note</b>:
- * It is strongly recommended to validate only absolute URLs. There's almost no case
+ * It is strongly recommended to validate only absolute, normalized URLs. There's almost no case
  * where checking only the path of a URL would allow to ensure its validity.
- * For compatibility reasons, this API cannot automatically resolve URLs relative to
+ * For compatibility reasons, this API does not normalize URLs and cannot automatically resolve URLs relative to
  * <code>document.baseURI</code>, but callers should do so. In that case, and when the
  * allow list is not empty, an entry for the origin of <code>document.baseURI</code>
  * must be added to the allow list.
  *
+ * Any measures to mitigate path traversal or similar attack vectors must be taken by the caller, e.g. by using the
+ * {@link https://developer.mozilla.org/docs/Web/API/URL URL} API to normalize the URL beforehand.
+ *
  * <h3>Details</h3>
  * Splits the given URL into components and checks for allowed characters according to RFC 3986:
  *

package/dist/sap/base/security/encodeCSS.js

@@ -1,6 +1,6 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 import toHex from "../strings/toHex.js";

package/dist/sap/base/security/encodeXML.js

@@ -1,6 +1,6 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 import toHex from "../strings/toHex.js";

package/dist/sap/base/security/sanitizeHTML.js

@@ -1,6 +1,6 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 /*

package/dist/sap/base/strings/toHex.js

@@ -15,7 +15,7 @@
  * @returns {string} padded hex representation of the given character code
  */ /*!
      * OpenUI5
-     * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
      * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
      */
 /*

package/dist/sap/base/util/now.js

@@ -1,9 +1,6 @@
-// @evo-todo window.performance does not exist on node.js, but there is a module performance-now. Maybe use it
-
 /**
- * Returns a high resolution timestamp in microseconds if supported by the environment, otherwise in milliseconds.
- * The timestamp is based on 01/01/1970 00:00:00 (UNIX epoch) as float with microsecond precision or
- * with millisecond precision, if high resolution timestamps are not available.
+ * Returns a high resolution timestamp in microseconds.
+ * The timestamp is based on 01/01/1970 00:00:00 (UNIX epoch) as float with microsecond precision.
  * The fractional part of the timestamp represents fractions of a millisecond.
  * Converting to a <code>Date</code> is possible by using <code>require(["sap/base/util/now"], function(now){new Date(now());}</code>
  *
@@ -11,18 +8,15 @@
  * @since 1.58
  * @public
  * @alias module:sap/base/util/now
- * @returns {float} timestamp in microseconds if supported by the environment otherwise in milliseconds
+ * @returns {float} timestamp in microseconds
  */ /*!
      * OpenUI5
-     * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
      * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
      */
 /*global performance */
 
-var fnNow = !(typeof window != "undefined" && window.performance && performance.now && performance.timing) ? Date.now : function () {
-  var iNavigationStart = performance.timing.navigationStart;
-  return function perfnow() {
-    return iNavigationStart + performance.now();
-  };
-}();
+var fnNow = function now() {
+  return performance.timeOrigin + performance.now();
+};
 export default fnNow;

package/dist/sap/base/util/uid.js

@@ -4,7 +4,7 @@
  * @private
  */ /*!
      * OpenUI5
-     * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
      * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
      */
 

package/dist/sap/ui/thirdparty/caja-html-sanitizer.js

@@ -118,7 +118,11 @@ var cssSchema = (function () {
         'inset' ], [ 'invert' ], [ 'justify' ], [ 'local' ], [ 'medium' ], [
         'mix' ], [ 'none' ], [ 'normal' ], [ 'once' ], [ 'repeat' ], [ 'scroll'
       ], [ 'separate' ], [ 'small-caps' ], [ 'spell-out' ], [ 'transparent' ],
-      [ 'visible' ] ];
+      [ 'visible' ],
+      // ##### BEGIN: MODIFIED BY SAP
+      [ 'flex', 'inline-flex', 'grid', 'inline-grid', 'flow-root', 'contents' ], [ 'initial', 'revert', 'revert-layer', 'unset' ]
+      // ##### END: MODIFIED BY SAP
+    ];
     return {
       '-moz-border-radius': {
         'cssExtra': c[ 0 ],
@@ -440,7 +444,9 @@ var cssSchema = (function () {
       },
       'display': {
         'cssPropBits': 32,
-        'cssLitGroup': [ L[ 2 ], L[ 47 ], L[ 54 ] ]
+        // ##### BEGIN: MODIFIED BY SAP
+        'cssLitGroup': [ L[ 2 ], L[ 47 ], L[ 54 ], L[ 64 ], L[ 65 ] ]
+        // ##### END: MODIFIED BY SAP
       },
       'elevation': {
         'cssPropBits': 5,
@@ -707,6 +713,12 @@ var cssSchema = (function () {
         'cssPropBits': 0,
         'cssLitGroup': [ L[ 18 ], L[ 47 ], L[ 54 ] ]
       },
+      // ##### BEGIN: MODIFIED BY SAP
+      'text-decoration-line': {
+        'cssPropBits': 0,
+        'cssLitGroup': [ L[ 18 ], L[ 47 ], L[ 54 ] ]
+      },
+      // ##### END: MODIFIED BY SAP
       'text-indent': {
         'cssPropBits': 5,
         'cssLitGroup': [ L[ 47 ] ]
@@ -2004,7 +2016,7 @@ if (typeof window !== 'undefined') {
 }
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 // Based on coding from the HTML4 Sanitizer by Google Inc.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ui5/webcomponents-base",
-  "version": "2.20.1",
+  "version": "2.20.3",
   "description": "UI5 Web Components: webcomponents.base",
   "author": "SAP SE (https://www.sap.com)",
   "license": "Apache-2.0",
@@ -63,10 +63,10 @@
   },
   "devDependencies": {
     "@custom-elements-manifest/analyzer": "^0.10.10",
-    "@openui5/sap.ui.core": "1.120.17",
+    "@openui5/sap.ui.core": "1.146.0",
     "@sap-theming/theming-base-content": "11.33.0",
     "@ui5/cypress-internal": "0.1.0",
-    "@ui5/webcomponents-tools": "2.20.1",
+    "@ui5/webcomponents-tools": "2.20.3",
     "clean-css": "^5.2.2",
     "cypress": "15.9.0",
     "mocha": "^11.7.2",
@@ -85,5 +85,5 @@
     }
   },
   "customElements": "dist/custom-elements.json",
-  "gitHead": "e99d0cc3b83e5320263a207f7ae3fcd159982e9f"
+  "gitHead": "3e3a7936aae93d114542b1b2a7ca1a1d26c63194"
 }