newspack-components 4.6.0 → 4.7.0-hotfix-content-gate-force-public-fallback.1

package/CHANGELOG.md

@@ -1,3 +1,24 @@
+# newspack-components [4.7.0-hotfix-content-gate-force-public-fallback.1](https://github.com/Automattic/newspack-workspace/compare/newspack-components@4.6.0...newspack-components@4.7.0-hotfix-content-gate-force-public-fallback.1) (2026-08-12)
+
+
+### Bug Fixes
+
+* **content-gate:** surface the Institutions entry point when institutions exist (NPPD-1492, [#708](https://github.com/Automattic/newspack-workspace/issues/708)) ([6ebb8c4](https://github.com/Automattic/newspack-workspace/commit/6ebb8c40f43b3f6d890900b683514eb9e6d65f2f))
+
+
+### Features
+
+* **access-control:** make Audience Management an explicit prerequisite (NPPD-1846) ([#765](https://github.com/Automattic/newspack-workspace/issues/765)) ([b5efde2](https://github.com/Automattic/newspack-workspace/commit/b5efde2aa3d050bda9fc629f1ed91e4864a91d33))
+* **campaigns:** Contextual Prompts, AI-assisted story donation asks ([#686](https://github.com/Automattic/newspack-workspace/issues/686)) ([f896387](https://github.com/Automattic/newspack-workspace/commit/f896387b5c3c096b6ed0cacbf2fe89b3e7f6b703)), closes [#719](https://github.com/Automattic/newspack-workspace/issues/719)
+* **campaigns:** pick donor landing page via autocomplete search ([#761](https://github.com/Automattic/newspack-workspace/issues/761)) ([01fa615](https://github.com/Automattic/newspack-workspace/commit/01fa61514954742094dff2fd0e5a4ff3bb4c04b6))
+* **components:** add a drawer component with a compound slot api ([#810](https://github.com/Automattic/newspack-workspace/issues/810)) ([5134ae9](https://github.com/Automattic/newspack-workspace/commit/5134ae9cab353bc8e10e239f7d54f8e3abb24fae))
+
+
+### Dependencies
+
+* **newspack-icons:** upgraded to 1.1.1-hotfix-content-gate-force-public-fallback.1
+* **newspack-scripts:** upgraded to 5.11.0-hotfix-content-gate-force-public-fallback.1
+
 # newspack-components [4.6.0](https://github.com/Automattic/newspack-workspace/compare/newspack-components@4.5.0...newspack-components@4.6.0) (2026-08-03)
 
 

package/dist/cjs/button/index.js

@@ -29,6 +29,11 @@ function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t =
 function _regenerator() { /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE */ var e, t, r = "function" == typeof Symbol ? Symbol : {}, n = r.iterator || "@@iterator", o = r.toStringTag || "@@toStringTag"; function i(r, n, o, i) { var c = n && n.prototype instanceof Generator ? n : Generator, u = Object.create(c.prototype); return _regeneratorDefine2(u, "_invoke", function (r, n, o) { var i, c, u, f = 0, p = o || [], y = !1, G = { p: 0, n: 0, v: e, a: d, f: d.bind(e, 4), d: function d(t, r) { return i = t, c = 0, u = e, G.n = r, a; } }; function d(r, n) { for (c = r, u = n, t = 0; !y && f && !o && t < p.length; t++) { var o, i = p[t], d = G.p, l = i[2]; r > 3 ? (o = l === n) && (u = i[(c = i[4]) ? 5 : (c = 3, 3)], i[4] = i[5] = e) : i[0] <= d && ((o = r < 2 && d < i[1]) ? (c = 0, G.v = n, G.n = i[1]) : d < l && (o = r < 3 || i[0] > n || n > l) && (i[4] = r, i[5] = n, G.n = l, c = 0)); } if (o || r > 1) return a; throw y = !0, n; } return function (o, p, l) { if (f > 1) throw TypeError("Generator is already running"); for (y && 1 === p && d(p, l), c = p, u = l; (t = c < 2 ? e : u) || !y;) { i || (c ? c < 3 ? (c > 1 && (G.n = -1), d(c, u)) : G.n = u : G.v = u); try { if (f = 2, i) { if (c || (o = "next"), t = i[o]) { if (!(t = t.call(i, u))) throw TypeError("iterator result is not an object"); if (!t.done) return t; u = t.value, c < 2 && (c = 0); } else 1 === c && (t = i["return"]) && t.call(i), c < 2 && (u = TypeError("The iterator does not provide a '" + o + "' method"), c = 1); i = e; } else if ((t = (y = G.n < 0) ? u : r.call(n, G)) !== a) break; } catch (t) { i = e, c = 1, u = t; } finally { f = 1; } } return { value: t, done: y }; }; }(r, o, i), !0), u; } var a = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} t = Object.getPrototypeOf; var c = [][n] ? t(t([][n]())) : (_regeneratorDefine2(t = {}, n, function () { return this; }), t), u = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(c); function f(e) { return Object.setPrototypeOf ? Object.setPrototypeOf(e, GeneratorFunctionPrototype) : (e.__proto__ = GeneratorFunctionPrototype, _regeneratorDefine2(e, o, "GeneratorFunction")), e.prototype = Object.create(u), e; } return GeneratorFunction.prototype = GeneratorFunctionPrototype, _regeneratorDefine2(u, "constructor", GeneratorFunctionPrototype), _regeneratorDefine2(GeneratorFunctionPrototype, "constructor", GeneratorFunction), GeneratorFunction.displayName = "GeneratorFunction", _regeneratorDefine2(GeneratorFunctionPrototype, o, "GeneratorFunction"), _regeneratorDefine2(u), _regeneratorDefine2(u, o, "Generator"), _regeneratorDefine2(u, n, function () { return this; }), _regeneratorDefine2(u, "toString", function () { return "[object Generator]"; }), (_regenerator = function _regenerator() { return { w: i, m: f }; })(); }
 function _regeneratorDefine2(e, r, n, t) { var i = Object.defineProperty; try { i({}, "", {}); } catch (e) { i = 0; } _regeneratorDefine2 = function _regeneratorDefine(e, r, n, t) { function o(r, n) { _regeneratorDefine2(e, r, function (e) { return this._invoke(r, n, e); }); } r ? i ? i(e, r, { value: n, enumerable: !t, configurable: !t, writable: !t }) : e[r] = n : (o("next", 0), o("throw", 1), o("return", 2)); }, _regeneratorDefine2(e, r, n, t); }
 var useHistory = _router["default"].useHistory;
+// Control characters are stripped first, as browsers do, so `java\nscript:`
+// cannot slip past.
+var isJavascriptHref = function isJavascriptHref(href) {
+  return 'string' === typeof href && href.replace(/[\u0000-\u0020]/g, '').toLowerCase().startsWith('javascript:');
+};
 var Button = function Button(_ref) {
   var href = _ref.href,
     _ref$loading = _ref.loading,
@@ -40,26 +45,45 @@ var Button = function Button(_ref) {
     _useState2 = (0, _slicedToArray2["default"])(_useState, 2),
     isAwaitingOnClick = _useState2[0],
     setIsAwaitingOnClick = _useState2[1];
+  var isUnsafeHref = isJavascriptHref(href);
+  var safeHref = isUnsafeHref ? undefined : href;
+  (0, _element.useEffect)(function () {
+    if ('production' === process.env.NODE_ENV || !isUnsafeHref) {
+      return;
+    }
+    // eslint-disable-next-line no-console
+    console.warn('Button: a `javascript:` href is not a link and has been dropped.');
+  }, [isUnsafeHref]);
 
   // If both onClick and href are present, await the onClick action an then redirect.
-  if (href && onClick) {
-    otherProps.onClick = /*#__PURE__*/(0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator().m(function _callee() {
-      return _regenerator().w(function (_context) {
-        while (1) switch (_context.n) {
-          case 0:
-            setIsAwaitingOnClick(true);
-            _context.n = 1;
-            return onClick();
-          case 1:
-            setIsAwaitingOnClick(false);
-            history.push((href || '').replace('#', ''));
-          case 2:
-            return _context.a(2);
-        }
-      }, _callee);
-    }));
+  if (safeHref && onClick) {
+    otherProps.onClick = /*#__PURE__*/function () {
+      var _ref2 = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator().m(function _callee(event) {
+        return _regenerator().w(function (_context) {
+          while (1) switch (_context.n) {
+            case 0:
+              setIsAwaitingOnClick(true);
+              _context.n = 1;
+              return onClick(event);
+            case 1:
+              setIsAwaitingOnClick(false);
+              // Outside a Router the href can only mean a real URL.
+              if (history) {
+                history.push(safeHref.replace('#', ''));
+              } else {
+                window.location.href = safeHref;
+              }
+            case 2:
+              return _context.a(2);
+          }
+        }, _callee);
+      }));
+      return function (_x) {
+        return _ref2.apply(this, arguments);
+      };
+    }();
   } else {
-    otherProps.href = href;
+    otherProps.href = safeHref;
     otherProps.onClick = onClick;
   }
   if (isAwaitingOnClick) {

package/dist/cjs/button/index.test.js

@@ -0,0 +1,273 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+var _asyncToGenerator2 = _interopRequireDefault(require("@babel/runtime/helpers/asyncToGenerator"));
+var _react = require("@testing-library/react");
+var _reactRouterDom = require("react-router-dom");
+var _ = _interopRequireDefault(require("./"));
+var _jsxRuntime = require("react/jsx-runtime");
+function _regenerator() { /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE */ var e, t, r = "function" == typeof Symbol ? Symbol : {}, n = r.iterator || "@@iterator", o = r.toStringTag || "@@toStringTag"; function i(r, n, o, i) { var c = n && n.prototype instanceof Generator ? n : Generator, u = Object.create(c.prototype); return _regeneratorDefine2(u, "_invoke", function (r, n, o) { var i, c, u, f = 0, p = o || [], y = !1, G = { p: 0, n: 0, v: e, a: d, f: d.bind(e, 4), d: function d(t, r) { return i = t, c = 0, u = e, G.n = r, a; } }; function d(r, n) { for (c = r, u = n, t = 0; !y && f && !o && t < p.length; t++) { var o, i = p[t], d = G.p, l = i[2]; r > 3 ? (o = l === n) && (u = i[(c = i[4]) ? 5 : (c = 3, 3)], i[4] = i[5] = e) : i[0] <= d && ((o = r < 2 && d < i[1]) ? (c = 0, G.v = n, G.n = i[1]) : d < l && (o = r < 3 || i[0] > n || n > l) && (i[4] = r, i[5] = n, G.n = l, c = 0)); } if (o || r > 1) return a; throw y = !0, n; } return function (o, p, l) { if (f > 1) throw TypeError("Generator is already running"); for (y && 1 === p && d(p, l), c = p, u = l; (t = c < 2 ? e : u) || !y;) { i || (c ? c < 3 ? (c > 1 && (G.n = -1), d(c, u)) : G.n = u : G.v = u); try { if (f = 2, i) { if (c || (o = "next"), t = i[o]) { if (!(t = t.call(i, u))) throw TypeError("iterator result is not an object"); if (!t.done) return t; u = t.value, c < 2 && (c = 0); } else 1 === c && (t = i["return"]) && t.call(i), c < 2 && (u = TypeError("The iterator does not provide a '" + o + "' method"), c = 1); i = e; } else if ((t = (y = G.n < 0) ? u : r.call(n, G)) !== a) break; } catch (t) { i = e, c = 1, u = t; } finally { f = 1; } } return { value: t, done: y }; }; }(r, o, i), !0), u; } var a = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} t = Object.getPrototypeOf; var c = [][n] ? t(t([][n]())) : (_regeneratorDefine2(t = {}, n, function () { return this; }), t), u = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(c); function f(e) { return Object.setPrototypeOf ? Object.setPrototypeOf(e, GeneratorFunctionPrototype) : (e.__proto__ = GeneratorFunctionPrototype, _regeneratorDefine2(e, o, "GeneratorFunction")), e.prototype = Object.create(u), e; } return GeneratorFunction.prototype = GeneratorFunctionPrototype, _regeneratorDefine2(u, "constructor", GeneratorFunctionPrototype), _regeneratorDefine2(GeneratorFunctionPrototype, "constructor", GeneratorFunction), GeneratorFunction.displayName = "GeneratorFunction", _regeneratorDefine2(GeneratorFunctionPrototype, o, "GeneratorFunction"), _regeneratorDefine2(u), _regeneratorDefine2(u, o, "Generator"), _regeneratorDefine2(u, n, function () { return this; }), _regeneratorDefine2(u, "toString", function () { return "[object Generator]"; }), (_regenerator = function _regenerator() { return { w: i, m: f }; })(); }
+function _regeneratorDefine2(e, r, n, t) { var i = Object.defineProperty; try { i({}, "", {}); } catch (e) { i = 0; } _regeneratorDefine2 = function _regeneratorDefine(e, r, n, t) { function o(r, n) { _regeneratorDefine2(e, r, function (e) { return this._invoke(r, n, e); }); } r ? i ? i(e, r, { value: n, enumerable: !t, configurable: !t, writable: !t }) : e[r] = n : (o("next", 0), o("throw", 1), o("return", 2)); }, _regeneratorDefine2(e, r, n, t); } /**
+ * External dependencies.
+ */ /**
+ * Internal dependencies.
+ */
+var HistoryGrabber = function HistoryGrabber(_ref) {
+  var historyRef = _ref.historyRef;
+  historyRef.current = (0, _reactRouterDom.useHistory)();
+  return null;
+};
+var clickButton = /*#__PURE__*/function () {
+  var _ref2 = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator().m(function _callee2() {
+    return _regenerator().w(function (_context2) {
+      while (1) switch (_context2.n) {
+        case 0:
+          _context2.n = 1;
+          return (0, _react.act)(/*#__PURE__*/(0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator().m(function _callee() {
+            return _regenerator().w(function (_context) {
+              while (1) switch (_context.n) {
+                case 0:
+                  _react.screen.getByRole('button', {
+                    name: 'Save'
+                  }).click();
+                case 1:
+                  return _context.a(2);
+              }
+            }, _callee);
+          })));
+        case 1:
+          return _context2.a(2);
+      }
+    }, _callee2);
+  }));
+  return function clickButton() {
+    return _ref2.apply(this, arguments);
+  };
+}();
+describe('Button href with onClick', function () {
+  it('awaits the onClick, then pushes the route', /*#__PURE__*/(0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator().m(function _callee3() {
+    var historyRef, onClick;
+    return _regenerator().w(function (_context3) {
+      while (1) switch (_context3.n) {
+        case 0:
+          historyRef = {
+            current: null
+          };
+          onClick = jest.fn().mockResolvedValue(undefined);
+          (0, _react.render)(/*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactRouterDom.MemoryRouter, {
+            children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(HistoryGrabber, {
+              historyRef: historyRef
+            }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+              href: "#/next",
+              onClick: onClick,
+              children: "Save"
+            })]
+          }));
+          _context3.n = 1;
+          return clickButton();
+        case 1:
+          expect(onClick).toHaveBeenCalled();
+          // The leading '#' is stripped so the router sees a route, not a fragment.
+          expect(historyRef.current.location.pathname).toBe('/next');
+        case 2:
+          return _context3.a(2);
+      }
+    }, _callee3);
+  })));
+});
+
+// `useHistory` returns undefined outside a wizard, leaving no route table for the
+// href to name.
+describe('Button href with onClick outside a router', function () {
+  // jsdom's real location logs "Not implemented: navigation" rather than
+  // navigating, so swap in a plain object to assert against and put the
+  // original back afterwards.
+  var withStubbedLocation = /*#__PURE__*/function () {
+    var _ref5 = (0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator().m(function _callee4(fn) {
+      var original;
+      return _regenerator().w(function (_context4) {
+        while (1) switch (_context4.p = _context4.n) {
+          case 0:
+            original = window.location;
+            delete window.location;
+            window.location = {
+              href: ''
+            };
+            _context4.p = 1;
+            _context4.n = 2;
+            return fn();
+          case 2:
+            return _context4.a(2, _context4.v);
+          case 3:
+            _context4.p = 3;
+            window.location = original;
+            return _context4.f(3);
+          case 4:
+            return _context4.a(2);
+        }
+      }, _callee4, null, [[1,, 3, 4]]);
+    }));
+    return function withStubbedLocation(_x) {
+      return _ref5.apply(this, arguments);
+    };
+  }();
+  it('awaits the onClick, then navigates to the href', /*#__PURE__*/(0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator().m(function _callee6() {
+    var onClick;
+    return _regenerator().w(function (_context6) {
+      while (1) switch (_context6.n) {
+        case 0:
+          onClick = jest.fn().mockResolvedValue(undefined);
+          _context6.n = 1;
+          return withStubbedLocation(/*#__PURE__*/(0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator().m(function _callee5() {
+            return _regenerator().w(function (_context5) {
+              while (1) switch (_context5.n) {
+                case 0:
+                  (0, _react.render)(/*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+                    href: "/wp-admin/admin.php?page=next",
+                    onClick: onClick,
+                    children: "Save"
+                  }));
+                  _context5.n = 1;
+                  return clickButton();
+                case 1:
+                  expect(onClick).toHaveBeenCalled();
+                  expect(window.location.href).toBe('/wp-admin/admin.php?page=next');
+                case 2:
+                  return _context5.a(2);
+              }
+            }, _callee5);
+          })));
+        case 1:
+          return _context6.a(2);
+      }
+    }, _callee6);
+  })));
+  it('hands the click event to a combined href and onClick handler', /*#__PURE__*/(0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator().m(function _callee8() {
+    var onClick;
+    return _regenerator().w(function (_context8) {
+      while (1) switch (_context8.n) {
+        case 0:
+          onClick = jest.fn();
+          _context8.n = 1;
+          return withStubbedLocation(/*#__PURE__*/(0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator().m(function _callee7() {
+            return _regenerator().w(function (_context7) {
+              while (1) switch (_context7.n) {
+                case 0:
+                  (0, _react.render)(/*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+                    href: "/wp-admin/admin.php?page=next",
+                    onClick: onClick,
+                    children: "Save"
+                  }));
+                  _context7.n = 1;
+                  return clickButton();
+                case 1:
+                  expect(onClick).toHaveBeenCalledWith(expect.objectContaining({
+                    type: 'click'
+                  }));
+                case 2:
+                  return _context7.a(2);
+              }
+            }, _callee7);
+          })));
+        case 1:
+          return _context8.a(2);
+      }
+    }, _callee8);
+  })));
+  it('runs an onClick with no href without touching navigation', /*#__PURE__*/(0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator().m(function _callee0() {
+    var onClick;
+    return _regenerator().w(function (_context0) {
+      while (1) switch (_context0.n) {
+        case 0:
+          onClick = jest.fn();
+          _context0.n = 1;
+          return withStubbedLocation(/*#__PURE__*/(0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator().m(function _callee9() {
+            return _regenerator().w(function (_context9) {
+              while (1) switch (_context9.n) {
+                case 0:
+                  (0, _react.render)(/*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+                    onClick: onClick,
+                    children: "Save"
+                  }));
+                  _context9.n = 1;
+                  return clickButton();
+                case 1:
+                  expect(onClick).toHaveBeenCalled();
+                  expect(window.location.href).toBe('');
+                case 2:
+                  return _context9.a(2);
+              }
+            }, _callee9);
+          })));
+        case 1:
+          return _context0.a(2);
+      }
+    }, _callee0);
+  })));
+  it('drops a javascript: href and still runs the onClick', /*#__PURE__*/(0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator().m(function _callee10() {
+    var warn, onClick;
+    return _regenerator().w(function (_context10) {
+      while (1) switch (_context10.n) {
+        case 0:
+          warn = jest.spyOn(console, 'warn').mockImplementation(function () {});
+          onClick = jest.fn().mockResolvedValue(undefined);
+          _context10.n = 1;
+          return withStubbedLocation(/*#__PURE__*/(0, _asyncToGenerator2["default"])(/*#__PURE__*/_regenerator().m(function _callee1() {
+            return _regenerator().w(function (_context1) {
+              while (1) switch (_context1.n) {
+                case 0:
+                  // eslint-disable-next-line no-script-url
+                  (0, _react.render)(/*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+                    href: "javascript:alert(1)",
+                    onClick: onClick,
+                    children: "Save"
+                  }));
+                  _context1.n = 1;
+                  return clickButton();
+                case 1:
+                  expect(onClick).toHaveBeenCalled();
+                  expect(window.location.href).toBe('');
+                case 2:
+                  return _context1.a(2);
+              }
+            }, _callee1);
+          })));
+        case 1:
+          expect(warn).toHaveBeenCalledWith(expect.stringContaining('javascript:'));
+          warn.mockRestore();
+        case 2:
+          return _context10.a(2);
+      }
+    }, _callee10);
+  })));
+});
+describe('Button with a javascript: href alone', function () {
+  var link = function link() {
+    return _react.screen.getByText('Save').closest('a');
+  };
+  it('renders no link', function () {
+    var warn = jest.spyOn(console, 'warn').mockImplementation(function () {});
+    (0, _react.render)(/*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+      href: "JavaScript:alert(1)",
+      children: "Save"
+    }));
+    expect(link()).toBeNull();
+    warn.mockRestore();
+  });
+  it('sees through interleaved control characters', function () {
+    var warn = jest.spyOn(console, 'warn').mockImplementation(function () {});
+    (0, _react.render)(/*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+      href: 'java\nscript:alert(1)',
+      children: "Save"
+    }));
+    expect(link()).toBeNull();
+    warn.mockRestore();
+  });
+  it('leaves an ordinary href alone', function () {
+    (0, _react.render)(/*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+      href: "/wp-admin/admin.php?page=next",
+      children: "Save"
+    }));
+    expect(link()).toHaveAttribute('href', '/wp-admin/admin.php?page=next');
+  });
+});

package/dist/cjs/confirm-dialog/index.js

@@ -79,21 +79,26 @@ function ConfirmDialog(_ref, ref) {
   }, [onConfirm, pendingNavigation]);
   var handleOnCancel = (0, _element.useCallback)(function () {
     setShowDialog(false);
+    var hadPendingNavigation = !!pendingNavigation.current;
     pendingNavigation.current = null;
     // A POP may have moved the URL to the target before it was blocked; put
     // it back so the address bar matches the page the user chose to stay on.
-    bypassBlock.current = true;
-    try {
-      history.replace(history.location);
-    } finally {
-      bypassBlock.current = false;
+    // Only when this instance blocked it: v5 keeps one prompt slot, so an
+    // unprompted replace is caught by whichever dialog did install a blocker.
+    if (hadPendingNavigation && history) {
+      bypassBlock.current = true;
+      try {
+        history.replace(history.location);
+      } finally {
+        bypassBlock.current = false;
+      }
     }
     onCancel();
   }, [onCancel, history]);
 
   // Block navigation when there are unsaved changes.
   (0, _element.useEffect)(function () {
-    if (!when) {
+    if (!when || !history) {
       return;
     }
     var unblock = history.block(function (location, action) {
@@ -124,10 +129,22 @@ function ConfirmDialog(_ref, ref) {
     return unblock;
   }, [when, history]);
 
-  // Show the dialog imperatively without blocking navigation.
+  // During render: a commit later the dialog would still hold focus while the
+  // caller unmounted. The blocker above raises it without touching `isOpen`.
+  var _useState3 = (0, _element.useState)(isOpen),
+    _useState4 = (0, _slicedToArray2["default"])(_useState3, 2),
+    wasOpen = _useState4[0],
+    setWasOpen = _useState4[1];
+  if (wasOpen !== isOpen) {
+    setWasOpen(isOpen);
+    setShowDialog(isOpen);
+  }
+
+  // A withdrawn prompt releases what the blocker held, as confirm and cancel do.
+  // After the commit, so a discarded render cannot drop a live one.
   (0, _element.useEffect)(function () {
-    if (isOpen) {
-      setShowDialog(true);
+    if (!isOpen) {
+      pendingNavigation.current = null;
     }
   }, [isOpen]);
   if (!showDialog) {

package/dist/cjs/confirm-dialog/index.test.js

@@ -65,6 +65,34 @@ describe('ConfirmDialog navigation blocking', function () {
     expect(replaceSpy).toHaveBeenCalledTimes(1);
     expect(history.location.pathname).toBe('/');
   });
+
+  // v5 keeps a single prompt slot, so an unprompted re-sync would be caught by
+  // whichever dialog on the screen did install a blocker.
+  it('cancels an unprompted dialog without tripping another blocker', function () {
+    var historyRef = {
+      current: null
+    };
+    (0, _react.render)(/*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactRouterDom.MemoryRouter, {
+      children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(HistoryGrabber, {
+        historyRef: historyRef
+      }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+        when: true,
+        confirmButtonText: "Leave",
+        cancelButtonText: "Stay",
+        children: "Wizard guard"
+      }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+        isOpen: true,
+        confirmButtonText: "Discard changes",
+        cancelButtonText: "Keep editing",
+        children: "Unsaved changes"
+      })]
+    }));
+    var replaceSpy = jest.spyOn(historyRef.current, 'replace');
+    cancelNavigation();
+    expect(dialog()).not.toBeInTheDocument();
+    expect(_react.screen.queryByText('Wizard guard')).not.toBeInTheDocument();
+    expect(replaceSpy).not.toHaveBeenCalled();
+  });
   it('replays a blocked push on confirm: re-sync replace first, then push, and re-arms the blocker', function () {
     var history = renderWithHistory();
     var replaceSpy = jest.spyOn(history, 'replace');
@@ -170,4 +198,152 @@ describe('ConfirmDialog navigation blocking', function () {
     expect(history.location.pathname).toBe('/');
     expect(dialog()).toBeInTheDocument();
   });
+});
+
+// `useHistory` returns undefined outside a wizard, where `newspack-multibranded-site`
+// runs react-router v6 against this package's v5.
+describe('ConfirmDialog without a router', function () {
+  var renderUnrouted = function renderUnrouted() {
+    var props = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+    return (0, _react.render)(/*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], _objectSpread(_objectSpread({
+      isOpen: true,
+      confirmButtonText: "Discard changes",
+      cancelButtonText: "Keep editing"
+    }, props), {}, {
+      children: "Unsaved changes"
+    })));
+  };
+  it('cancels with no history to re-sync', function () {
+    var onCancel = jest.fn();
+    renderUnrouted({
+      onCancel: onCancel
+    });
+    expect(dialog()).toBeInTheDocument();
+    cancelNavigation();
+    expect(onCancel).toHaveBeenCalled();
+    expect(dialog()).not.toBeInTheDocument();
+  });
+  it('confirms with no history to re-sync', function () {
+    var onConfirm = jest.fn();
+    renderUnrouted({
+      onConfirm: onConfirm
+    });
+    confirmNavigation();
+    expect(onConfirm).toHaveBeenCalled();
+    expect(dialog()).not.toBeInTheDocument();
+  });
+  it('installs no blocker when asked to block without a router', function () {
+    expect(function () {
+      return renderUnrouted({
+        when: true
+      });
+    }).not.toThrow();
+    expect(dialog()).toBeInTheDocument();
+  });
+});
+describe('ConfirmDialog controlled by isOpen', function () {
+  var tree = function tree(isOpen) {
+    return /*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+      isOpen: isOpen,
+      confirmButtonText: "Discard changes",
+      cancelButtonText: "Keep editing",
+      children: "Unsaved changes"
+    });
+  };
+  it('closes when isOpen goes false', function () {
+    var _render = (0, _react.render)(tree(true)),
+      rerender = _render.rerender;
+    expect(dialog()).toBeInTheDocument();
+    rerender(tree(false));
+    expect(dialog()).not.toBeInTheDocument();
+  });
+  it('opens again afterwards', function () {
+    var _render2 = (0, _react.render)(tree(true)),
+      rerender = _render2.rerender;
+    rerender(tree(false));
+    rerender(tree(true));
+    expect(dialog()).toBeInTheDocument();
+  });
+  it('leaves a blocked navigation prompt up', function () {
+    var historyRef = {
+      current: null
+    };
+    (0, _react.render)(/*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactRouterDom.MemoryRouter, {
+      children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(HistoryGrabber, {
+        historyRef: historyRef
+      }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+        when: true,
+        isOpen: false,
+        confirmButtonText: "Discard changes",
+        cancelButtonText: "Keep editing",
+        children: "Unsaved changes"
+      })]
+    }));
+    (0, _react.act)(function () {
+      return historyRef.current.push('/next');
+    });
+    expect(dialog()).toBeInTheDocument();
+  });
+  it('withdraws a blocked navigation prompt when isOpen goes false', function () {
+    var historyRef = {
+      current: null
+    };
+    var withOpen = function withOpen(isOpen) {
+      return /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactRouterDom.MemoryRouter, {
+        children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(HistoryGrabber, {
+          historyRef: historyRef
+        }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+          when: true,
+          isOpen: isOpen,
+          confirmButtonText: "Discard changes",
+          cancelButtonText: "Keep editing",
+          children: "Unsaved changes"
+        })]
+      });
+    };
+    var _render3 = (0, _react.render)(withOpen(true)),
+      rerender = _render3.rerender;
+    (0, _react.act)(function () {
+      return historyRef.current.push('/next');
+    });
+    expect(dialog()).toBeInTheDocument();
+    rerender(withOpen(false));
+    expect(dialog()).not.toBeInTheDocument();
+    expect(historyRef.current.location.pathname).toBe('/');
+
+    // Confirming the next prompt must not replay the abandoned destination.
+    rerender(withOpen(true));
+    confirmNavigation();
+    expect(historyRef.current.location.pathname).toBe('/');
+  });
+});
+describe('ConfirmDialog named by a hidden title', function () {
+  it('takes its accessible name from the title while hiding the header', function () {
+    (0, _react.render)(/*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+      isOpen: true,
+      hideTitle: true,
+      title: "Unsaved changes",
+      confirmButtonText: "Discard changes",
+      children: "You have unsaved changes that will be lost. Discard changes?"
+    }));
+    var frame = _react.screen.getByRole('dialog', {
+      name: 'Unsaved changes'
+    });
+    expect(frame).toHaveClass('newspack-modal--hide-title');
+    expect(frame.querySelector('.components-modal__header')).toContainElement(_react.screen.getByRole('heading', {
+      name: 'Unsaved changes'
+    }));
+  });
+  it('has no accessible name without a title', function () {
+    (0, _react.render)(/*#__PURE__*/(0, _jsxRuntime.jsx)(_["default"], {
+      isOpen: true,
+      hideTitle: true,
+      confirmButtonText: "Discard changes",
+      children: "You have unsaved changes that will be lost. Discard changes?"
+    }));
+    expect(_react.screen.queryByRole('dialog', {
+      name: 'Unsaved changes'
+    })).not.toBeInTheDocument();
+    expect(_react.screen.getByRole('dialog')).not.toHaveAttribute('aria-labelledby');
+  });
 });