@ui5/webcomponents-base 2.21.0-rc.1 → 2.21.0-rc.3

package/dist/prod/sap/base/Log.js

@@ -1,9 +1,8 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
-import BaseConfig from "./config.js";
 import now from "./util/now.js";
 /**
  * A Logging API for JavaScript.
@@ -202,8 +201,8 @@ function getLogEntryListenerInstance() {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -225,8 +224,8 @@ Log.fatal = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -248,8 +247,8 @@ Log.error = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -271,8 +270,8 @@ Log.warning = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -294,8 +293,8 @@ Log.info = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -317,8 +316,8 @@ Log.debug = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -418,8 +417,8 @@ Log.logSupportInfo = function (bEnabled) {
  * @param {string} [sComponent]
  *   The log component under which the message should be logged
  * @param {function} [fnSupportInfo] Callback that returns an additional support object to be
- *   logged in support mode. This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   logged in support mode. This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @returns {module:sap/base/Log.Entry}
@@ -734,17 +733,4 @@ Log.getLogger = function (sComponent, iDefaultLogLevel) {
   }
   return new Logger(sComponent);
 };
-
-// set LogLevel
-const sLogLevel = BaseConfig.get({
-  name: "sapUiLogLevel",
-  type: BaseConfig.Type.String,
-  defaultValue: undefined,
-  external: true
-});
-if (sLogLevel) {
-  Log.setLevel(Log.Level[sLogLevel.toUpperCase()] || parseInt(sLogLevel));
-} else if (!globalThis["sap-ui-optimized"]) {
-  Log.setLevel(Log.Level.DEBUG);
-}
 export default Log;

package/dist/prod/sap/base/assert.js

@@ -19,7 +19,7 @@
  *
  */ /*!
      * OpenUI5
-     * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
      * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
      */
 

package/dist/prod/sap/base/config/MemoryConfigurationProvider.js

@@ -1,6 +1,6 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 import uid from "../util/uid.js";

package/dist/prod/sap/base/security/URLListValidator.js

@@ -1,11 +1,11 @@
 // validation regexes
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 
-var rBasicUrl = /^(?:([^:\/?#]+):)?((?:[\/\\]{2,}((?:\[[^\]]+\]|[^\/?#:]+))(?::([0-9]+))?)?([^?#]*))(?:\?([^#]*))?(?:#(.*))?$/;
+var rBasicUrl = /^(?:([^:\/?#]+):)?((?:[\/\\]{2,}(?:(?:[^@\/?#]*@)?(\[[^\]]+\]|[^\/?#:]+)(?::([0-9]+))?)?)?([^?#]*))(?:\?([^#]*))?(?:#(.*))?$/;
 var rCheckPath = /^([a-z0-9-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*$/i;
 var rCheckQuery = /^([a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9a-f]{2})*$/i;
 var rCheckFragment = rCheckQuery;
@@ -104,7 +104,8 @@ oURLListValidator.clear = function () {
  * @param {string} [protocol] The protocol of the URL, can be falsy to allow all protocols for an entry e.g. "", "http", "mailto"
  * @param {string} [host] The host of the URL, can be falsy to allow all hosts. A wildcard asterisk can be set at the beginning, e.g. "examples.com", "*.example.com"
  * @param {string} [port] The port of the URL, can be falsy to allow all ports, e.g. "", "8080"
- * @param {string} [path] the path of the URL, path of the url, can be falsy to allow all paths. A wildcard asterisk can be set at the end, e.g. "/my-example*", "/my-news"
+ * @param {string} [path] the path of the URL, e.g. "/my-news". Can be falsy to allow all paths. A wildcard asterisk can be set at the end to ensure a path starts with the given string, e.g. "/my-example*".
+ * 	When using wildcards, make sure to only provide normalized URLs to the validate function in order to mitigate the risk of path traversal attacks.
  * @public
  */
 oURLListValidator.add = function (protocol, host, port, path) {
@@ -139,13 +140,16 @@ oURLListValidator.entries = function () {
  * Validates a URL. Check if it's not a script or other security issue.
  *
  * <b>Note</b>:
- * It is strongly recommended to validate only absolute URLs. There's almost no case
+ * It is strongly recommended to validate only absolute, normalized URLs. There's almost no case
  * where checking only the path of a URL would allow to ensure its validity.
- * For compatibility reasons, this API cannot automatically resolve URLs relative to
+ * For compatibility reasons, this API does not normalize URLs and cannot automatically resolve URLs relative to
  * <code>document.baseURI</code>, but callers should do so. In that case, and when the
  * allow list is not empty, an entry for the origin of <code>document.baseURI</code>
  * must be added to the allow list.
  *
+ * Any measures to mitigate path traversal or similar attack vectors must be taken by the caller, e.g. by using the
+ * {@link https://developer.mozilla.org/docs/Web/API/URL URL} API to normalize the URL beforehand.
+ *
  * <h3>Details</h3>
  * Splits the given URL into components and checks for allowed characters according to RFC 3986:
  *

package/dist/prod/sap/base/security/encodeCSS.js

@@ -1,6 +1,6 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 import toHex from "../strings/toHex.js";

package/dist/prod/sap/base/security/encodeXML.js

@@ -1,6 +1,6 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 import toHex from "../strings/toHex.js";

package/dist/prod/sap/base/security/sanitizeHTML.js

@@ -1,6 +1,6 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 /*

package/dist/prod/sap/base/strings/toHex.js

@@ -15,7 +15,7 @@
  * @returns {string} padded hex representation of the given character code
  */ /*!
      * OpenUI5
-     * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
      * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
      */
 /*

package/dist/prod/sap/base/util/now.js

@@ -1,9 +1,6 @@
-// @evo-todo window.performance does not exist on node.js, but there is a module performance-now. Maybe use it
-
 /**
- * Returns a high resolution timestamp in microseconds if supported by the environment, otherwise in milliseconds.
- * The timestamp is based on 01/01/1970 00:00:00 (UNIX epoch) as float with microsecond precision or
- * with millisecond precision, if high resolution timestamps are not available.
+ * Returns a high resolution timestamp in microseconds.
+ * The timestamp is based on 01/01/1970 00:00:00 (UNIX epoch) as float with microsecond precision.
  * The fractional part of the timestamp represents fractions of a millisecond.
  * Converting to a <code>Date</code> is possible by using <code>require(["sap/base/util/now"], function(now){new Date(now());}</code>
  *
@@ -11,18 +8,15 @@
  * @since 1.58
  * @public
  * @alias module:sap/base/util/now
- * @returns {float} timestamp in microseconds if supported by the environment otherwise in milliseconds
+ * @returns {float} timestamp in microseconds
  */ /*!
      * OpenUI5
-     * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
      * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
      */
 /*global performance */
 
-var fnNow = !(typeof window != "undefined" && window.performance && performance.now && performance.timing) ? Date.now : function () {
-  var iNavigationStart = performance.timing.navigationStart;
-  return function perfnow() {
-    return iNavigationStart + performance.now();
-  };
-}();
+var fnNow = function now() {
+  return performance.timeOrigin + performance.now();
+};
 export default fnNow;

package/dist/prod/sap/base/util/uid.js

@@ -4,7 +4,7 @@
  * @private
  */ /*!
      * OpenUI5
-     * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
      * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
      */
 

package/dist/prod/sap/ui/thirdparty/caja-html-sanitizer.js

@@ -118,7 +118,11 @@ var cssSchema = (function () {
         'inset' ], [ 'invert' ], [ 'justify' ], [ 'local' ], [ 'medium' ], [
         'mix' ], [ 'none' ], [ 'normal' ], [ 'once' ], [ 'repeat' ], [ 'scroll'
       ], [ 'separate' ], [ 'small-caps' ], [ 'spell-out' ], [ 'transparent' ],
-      [ 'visible' ] ];
+      [ 'visible' ],
+      // ##### BEGIN: MODIFIED BY SAP
+      [ 'flex', 'inline-flex', 'grid', 'inline-grid', 'flow-root', 'contents' ], [ 'initial', 'revert', 'revert-layer', 'unset' ]
+      // ##### END: MODIFIED BY SAP
+    ];
     return {
       '-moz-border-radius': {
         'cssExtra': c[ 0 ],
@@ -440,7 +444,9 @@ var cssSchema = (function () {
       },
       'display': {
         'cssPropBits': 32,
-        'cssLitGroup': [ L[ 2 ], L[ 47 ], L[ 54 ] ]
+        // ##### BEGIN: MODIFIED BY SAP
+        'cssLitGroup': [ L[ 2 ], L[ 47 ], L[ 54 ], L[ 64 ], L[ 65 ] ]
+        // ##### END: MODIFIED BY SAP
       },
       'elevation': {
         'cssPropBits': 5,
@@ -707,6 +713,12 @@ var cssSchema = (function () {
         'cssPropBits': 0,
         'cssLitGroup': [ L[ 18 ], L[ 47 ], L[ 54 ] ]
       },
+      // ##### BEGIN: MODIFIED BY SAP
+      'text-decoration-line': {
+        'cssPropBits': 0,
+        'cssLitGroup': [ L[ 18 ], L[ 47 ], L[ 54 ] ]
+      },
+      // ##### END: MODIFIED BY SAP
       'text-indent': {
         'cssPropBits': 5,
         'cssLitGroup': [ L[ 47 ] ]
@@ -2004,7 +2016,7 @@ if (typeof window !== 'undefined') {
 }
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 // Based on coding from the HTML4 Sanitizer by Google Inc.

package/dist/prod/util/generateHighlightedMarkupFirstMatch.js

@@ -0,0 +1,2 @@
+"use strict";import u from"./escapeRegex.js";import r from"../sap/base/security/encodeXML.js";function m(o,s){const e=o||"";if(!e||!s)return r(e);const i=s.toLowerCase(),n=e.toLowerCase(),a=s.length;let t=n.search(new RegExp(`(^|\\s)${u(i)}`));if(t!==-1&&n[t]===" "&&t++,t===-1)return r(e);const c=r(e.substring(0,t)),g=r(e.substring(t,t+a)),f=r(e.substring(t+a));return`${c}<b>${g}</b>${f}`}export default m;
+//# sourceMappingURL=generateHighlightedMarkupFirstMatch.js.map

package/dist/prod/util/generateHighlightedMarkupFirstMatch.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/util/generateHighlightedMarkupFirstMatch.ts"],
+  "sourcesContent": ["import escapeRegex from \"./escapeRegex.js\";\n// @ts-expect-error\nimport encodeXML from \"../sap/base/security/encodeXML.js\";\n\n/**\n * Generate markup for a raw string where the first match following StartsWithPerTerm pattern is wrapped with `<b>` tag.\n * StartsWithPerTerm pattern: finds the first word (at start or after whitespace) that starts with the search text.\n * All inputs to this function are considered literal text, and special characters will always be escaped.\n * @param {string} text The text to add highlighting to\n * @param {string} textToHighlight The text which should be highlighted (case-insensitive)\n * @return {string} the markup HTML which contains the first match surrounded with a `<b>` tag.\n */\nfunction generateHighlightedMarkupFirstMatch(text: string, textToHighlight: string): string {\n\tconst normalizedText = text || \"\";\n\n\tif (!normalizedText || !textToHighlight) {\n\t\treturn encodeXML(normalizedText) as string;\n\t}\n\n\tconst filterValue = textToHighlight.toLowerCase();\n\tconst lowerText = normalizedText.toLowerCase();\n\tconst matchLength = textToHighlight.length;\n\n\t// Find the first word that starts with textToHighlight (StartsWithPerTerm pattern)\n\tlet matchIndex = lowerText.search(new RegExp(`(^|\\\\s)${escapeRegex(filterValue)}`));\n\tif (matchIndex !== -1 && lowerText[matchIndex] === \" \") {\n\t\tmatchIndex++; // Skip the space\n\t}\n\n\t// If no match found, return encoded text\n\tif (matchIndex === -1) {\n\t\treturn encodeXML(normalizedText) as string;\n\t}\n\n\t// Build highlighted markup with only the first match\n\tconst beforeMatch = encodeXML(normalizedText.substring(0, matchIndex)) as string;\n\tconst match = encodeXML(normalizedText.substring(matchIndex, matchIndex + matchLength)) as string;\n\tconst afterMatch = encodeXML(normalizedText.substring(matchIndex + matchLength)) as string;\n\n\treturn `${beforeMatch}<b>${match}</b>${afterMatch}`;\n}\n\nexport default generateHighlightedMarkupFirstMatch;\n"],
+  "mappings": "aAAA,OAAOA,MAAiB,mBAExB,OAAOC,MAAe,oCAUtB,SAASC,EAAoCC,EAAcC,EAAiC,CAC3F,MAAMC,EAAiBF,GAAQ,GAE/B,GAAI,CAACE,GAAkB,CAACD,EACvB,OAAOH,EAAUI,CAAc,EAGhC,MAAMC,EAAcF,EAAgB,YAAY,EAC1CG,EAAYF,EAAe,YAAY,EACvCG,EAAcJ,EAAgB,OAGpC,IAAIK,EAAaF,EAAU,OAAO,IAAI,OAAO,UAAUP,EAAYM,CAAW,CAAC,EAAE,CAAC,EAMlF,GALIG,IAAe,IAAMF,EAAUE,CAAU,IAAM,KAClDA,IAIGA,IAAe,GAClB,OAAOR,EAAUI,CAAc,EAIhC,MAAMK,EAAcT,EAAUI,EAAe,UAAU,EAAGI,CAAU,CAAC,EAC/DE,EAAQV,EAAUI,EAAe,UAAUI,EAAYA,EAAaD,CAAW,CAAC,EAChFI,EAAaX,EAAUI,EAAe,UAAUI,EAAaD,CAAW,CAAC,EAE/E,MAAO,GAAGE,CAAW,MAAMC,CAAK,OAAOC,CAAU,EAClD,CAEA,eAAeV",
+  "names": ["escapeRegex", "encodeXML", "generateHighlightedMarkupFirstMatch", "text", "textToHighlight", "normalizedText", "filterValue", "lowerText", "matchLength", "matchIndex", "beforeMatch", "match", "afterMatch"]
+}

package/dist/sap/base/Log.js

@@ -1,9 +1,8 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
-import BaseConfig from "./config.js";
 import now from "./util/now.js";
 /**
  * A Logging API for JavaScript.
@@ -202,8 +201,8 @@ function getLogEntryListenerInstance() {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -225,8 +224,8 @@ Log.fatal = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -248,8 +247,8 @@ Log.error = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -271,8 +270,8 @@ Log.warning = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -294,8 +293,8 @@ Log.info = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -317,8 +316,8 @@ Log.debug = function (sMessage, vDetails, sComponent, fnSupportInfo) {
  *   Name of the component that produced the log entry
  * @param {function} [fnSupportInfo]
  *   Callback that returns an additional support object to be logged in support mode.
- *   This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @public
@@ -418,8 +417,8 @@ Log.logSupportInfo = function (bEnabled) {
  * @param {string} [sComponent]
  *   The log component under which the message should be logged
  * @param {function} [fnSupportInfo] Callback that returns an additional support object to be
- *   logged in support mode. This function is only called if support info mode is turned on with
- *   <code>logSupportInfo(true)</code>. To avoid negative effects regarding execution times and
+ *   logged in support mode. This function is only called if support info mode is turned on via
+ *   the Support Assistant. To avoid negative effects regarding execution times and
  *   memory consumption, the returned object should be a simple immutable JSON object with mostly
  *   static and stable content.
  * @returns {module:sap/base/Log.Entry}
@@ -734,17 +733,4 @@ Log.getLogger = function (sComponent, iDefaultLogLevel) {
   }
   return new Logger(sComponent);
 };
-
-// set LogLevel
-const sLogLevel = BaseConfig.get({
-  name: "sapUiLogLevel",
-  type: BaseConfig.Type.String,
-  defaultValue: undefined,
-  external: true
-});
-if (sLogLevel) {
-  Log.setLevel(Log.Level[sLogLevel.toUpperCase()] || parseInt(sLogLevel));
-} else if (!globalThis["sap-ui-optimized"]) {
-  Log.setLevel(Log.Level.DEBUG);
-}
 export default Log;

package/dist/sap/base/assert.js

@@ -19,7 +19,7 @@
  *
  */ /*!
      * OpenUI5
-     * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
      * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
      */
 

package/dist/sap/base/config/MemoryConfigurationProvider.js

@@ -1,6 +1,6 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 import uid from "../util/uid.js";

package/dist/sap/base/security/URLListValidator.js

@@ -1,11 +1,11 @@
 // validation regexes
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 
-var rBasicUrl = /^(?:([^:\/?#]+):)?((?:[\/\\]{2,}((?:\[[^\]]+\]|[^\/?#:]+))(?::([0-9]+))?)?([^?#]*))(?:\?([^#]*))?(?:#(.*))?$/;
+var rBasicUrl = /^(?:([^:\/?#]+):)?((?:[\/\\]{2,}(?:(?:[^@\/?#]*@)?(\[[^\]]+\]|[^\/?#:]+)(?::([0-9]+))?)?)?([^?#]*))(?:\?([^#]*))?(?:#(.*))?$/;
 var rCheckPath = /^([a-z0-9-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*$/i;
 var rCheckQuery = /^([a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9a-f]{2})*$/i;
 var rCheckFragment = rCheckQuery;
@@ -104,7 +104,8 @@ oURLListValidator.clear = function () {
  * @param {string} [protocol] The protocol of the URL, can be falsy to allow all protocols for an entry e.g. "", "http", "mailto"
  * @param {string} [host] The host of the URL, can be falsy to allow all hosts. A wildcard asterisk can be set at the beginning, e.g. "examples.com", "*.example.com"
  * @param {string} [port] The port of the URL, can be falsy to allow all ports, e.g. "", "8080"
- * @param {string} [path] the path of the URL, path of the url, can be falsy to allow all paths. A wildcard asterisk can be set at the end, e.g. "/my-example*", "/my-news"
+ * @param {string} [path] the path of the URL, e.g. "/my-news". Can be falsy to allow all paths. A wildcard asterisk can be set at the end to ensure a path starts with the given string, e.g. "/my-example*".
+ * 	When using wildcards, make sure to only provide normalized URLs to the validate function in order to mitigate the risk of path traversal attacks.
  * @public
  */
 oURLListValidator.add = function (protocol, host, port, path) {
@@ -139,13 +140,16 @@ oURLListValidator.entries = function () {
  * Validates a URL. Check if it's not a script or other security issue.
  *
  * <b>Note</b>:
- * It is strongly recommended to validate only absolute URLs. There's almost no case
+ * It is strongly recommended to validate only absolute, normalized URLs. There's almost no case
  * where checking only the path of a URL would allow to ensure its validity.
- * For compatibility reasons, this API cannot automatically resolve URLs relative to
+ * For compatibility reasons, this API does not normalize URLs and cannot automatically resolve URLs relative to
  * <code>document.baseURI</code>, but callers should do so. In that case, and when the
  * allow list is not empty, an entry for the origin of <code>document.baseURI</code>
  * must be added to the allow list.
  *
+ * Any measures to mitigate path traversal or similar attack vectors must be taken by the caller, e.g. by using the
+ * {@link https://developer.mozilla.org/docs/Web/API/URL URL} API to normalize the URL beforehand.
+ *
  * <h3>Details</h3>
  * Splits the given URL into components and checks for allowed characters according to RFC 3986:
  *

package/dist/sap/base/security/encodeCSS.js

@@ -1,6 +1,6 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 import toHex from "../strings/toHex.js";

package/dist/sap/base/security/encodeXML.js

@@ -1,6 +1,6 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 import toHex from "../strings/toHex.js";

package/dist/sap/base/security/sanitizeHTML.js

@@ -1,6 +1,6 @@
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 /*

package/dist/sap/base/strings/toHex.js

@@ -15,7 +15,7 @@
  * @returns {string} padded hex representation of the given character code
  */ /*!
      * OpenUI5
-     * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
      * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
      */
 /*

package/dist/sap/base/util/now.js

@@ -1,9 +1,6 @@
-// @evo-todo window.performance does not exist on node.js, but there is a module performance-now. Maybe use it
-
 /**
- * Returns a high resolution timestamp in microseconds if supported by the environment, otherwise in milliseconds.
- * The timestamp is based on 01/01/1970 00:00:00 (UNIX epoch) as float with microsecond precision or
- * with millisecond precision, if high resolution timestamps are not available.
+ * Returns a high resolution timestamp in microseconds.
+ * The timestamp is based on 01/01/1970 00:00:00 (UNIX epoch) as float with microsecond precision.
  * The fractional part of the timestamp represents fractions of a millisecond.
  * Converting to a <code>Date</code> is possible by using <code>require(["sap/base/util/now"], function(now){new Date(now());}</code>
  *
@@ -11,18 +8,15 @@
  * @since 1.58
  * @public
  * @alias module:sap/base/util/now
- * @returns {float} timestamp in microseconds if supported by the environment otherwise in milliseconds
+ * @returns {float} timestamp in microseconds
  */ /*!
      * OpenUI5
-     * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
      * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
      */
 /*global performance */
 
-var fnNow = !(typeof window != "undefined" && window.performance && performance.now && performance.timing) ? Date.now : function () {
-  var iNavigationStart = performance.timing.navigationStart;
-  return function perfnow() {
-    return iNavigationStart + performance.now();
-  };
-}();
+var fnNow = function now() {
+  return performance.timeOrigin + performance.now();
+};
 export default fnNow;

package/dist/sap/base/util/uid.js

@@ -4,7 +4,7 @@
  * @private
  */ /*!
      * OpenUI5
-     * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
      * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
      */
 

package/dist/sap/ui/thirdparty/caja-html-sanitizer.js

@@ -118,7 +118,11 @@ var cssSchema = (function () {
         'inset' ], [ 'invert' ], [ 'justify' ], [ 'local' ], [ 'medium' ], [
         'mix' ], [ 'none' ], [ 'normal' ], [ 'once' ], [ 'repeat' ], [ 'scroll'
       ], [ 'separate' ], [ 'small-caps' ], [ 'spell-out' ], [ 'transparent' ],
-      [ 'visible' ] ];
+      [ 'visible' ],
+      // ##### BEGIN: MODIFIED BY SAP
+      [ 'flex', 'inline-flex', 'grid', 'inline-grid', 'flow-root', 'contents' ], [ 'initial', 'revert', 'revert-layer', 'unset' ]
+      // ##### END: MODIFIED BY SAP
+    ];
     return {
       '-moz-border-radius': {
         'cssExtra': c[ 0 ],
@@ -440,7 +444,9 @@ var cssSchema = (function () {
       },
       'display': {
         'cssPropBits': 32,
-        'cssLitGroup': [ L[ 2 ], L[ 47 ], L[ 54 ] ]
+        // ##### BEGIN: MODIFIED BY SAP
+        'cssLitGroup': [ L[ 2 ], L[ 47 ], L[ 54 ], L[ 64 ], L[ 65 ] ]
+        // ##### END: MODIFIED BY SAP
       },
       'elevation': {
         'cssPropBits': 5,
@@ -707,6 +713,12 @@ var cssSchema = (function () {
         'cssPropBits': 0,
         'cssLitGroup': [ L[ 18 ], L[ 47 ], L[ 54 ] ]
       },
+      // ##### BEGIN: MODIFIED BY SAP
+      'text-decoration-line': {
+        'cssPropBits': 0,
+        'cssLitGroup': [ L[ 18 ], L[ 47 ], L[ 54 ] ]
+      },
+      // ##### END: MODIFIED BY SAP
       'text-indent': {
         'cssPropBits': 5,
         'cssLitGroup': [ L[ 47 ] ]
@@ -2004,7 +2016,7 @@ if (typeof window !== 'undefined') {
 }
 /*!
  * OpenUI5
- * (c) Copyright 2009-2024 SAP SE or an SAP affiliate company.
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
 // Based on coding from the HTML4 Sanitizer by Google Inc.

package/dist/util/generateHighlightedMarkupFirstMatch.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generate markup for a raw string where the first match following StartsWithPerTerm pattern is wrapped with `<b>` tag.
+ * StartsWithPerTerm pattern: finds the first word (at start or after whitespace) that starts with the search text.
+ * All inputs to this function are considered literal text, and special characters will always be escaped.
+ * @param {string} text The text to add highlighting to
+ * @param {string} textToHighlight The text which should be highlighted (case-insensitive)
+ * @return {string} the markup HTML which contains the first match surrounded with a `<b>` tag.
+ */
+declare function generateHighlightedMarkupFirstMatch(text: string, textToHighlight: string): string;
+export default generateHighlightedMarkupFirstMatch;