This is an edge case and it only affects code accepting untrusted input as
a widget name, but it's still technically correct to filter these out.
Closes gh-2310
The test server has a rule for `/tests/unit/*/*.html` paths that serves
a proper local file. However, the parameters after `/unit/` so far accepted
many characters that have special meaning, leading to possibly reading a file
from outside of the Git repository. Fix that by only accepting alphanumeric
characters, `-` or `_`.
This should resolve one CodeQL alert.
Closes gh-2309
The previous private `_sanitizeSelector` API was not correctly escaping
backslashes and is now removed. The native API should always be correct.
Closes gh-2307
The ESLint config for `demos` extends the one for the `ui` directory. However,
the `ui` one used to not be a root one, making the `demos` one effectively not
depend on the `jquery` preset. Fix that and fix lots of lint violations in
`demos/search.js`.
Closes gh-2303
The transfer effect is deprecated and not present unless `$.uiBackCompat` is set
to `true`. In previous UI versions, the default was including the backwards
compat layer so these demos & tests worked; now they do not by default. Just
remove them.
Fixes gh-2278
Closes gh-2291
Implement a new option: `uiDialogTitleHeadingLevel`, allowing to change
the `span` wrapping the dialog title into a heading element (`h1`-`h6`).
Value `0` represents the `span`, values 1-6 - a heading at the specified
level.
Fixes gh-2271
Closes gh-2275
The "common widget" tests, checking if a widget doesn't overwrite some
core widget APIs wasn't running as it was incorrectly checking for
`$.uiBackCompat === false` instead of `$.uiBackCompat !== true` after the
default changed in gh-2250.
Fixing the check uncovered that the draggable & sortable modules do
overwrite the `_trigger` method. Add an exception in the test for that;
at this stage of the project we don't plan to change the implementation.
Closes gh-2286
Ref gh-2250
When the datepicker UI is shown and then destroyed programmatically:
```js
$( "#datepicker" ).datepicker( "destroy" );
```
hide the datepicker UI without the need for an explicit user action.
Previously, in 1.12 the UI would not disappear immediately but only after the
first `mousedown`. In later 1.13 versions, the UI would not disappear at all.
Fixes gh-2178
Closes gh-2268
Apart from updating jQuery Migrate, the setup is now changed so that exact
Migrate versions are only references when fetching npm packages; other than
that, they're represented as `jquery-migrate-1.x` & `jquery-migrate-3.x`. This
will allow smaller changes when updating jQuery Migrate in the future.
Closes gh-2273
The `jqueryui.com` demos build process deAMDifies HTML files, replacing required
JS files with direct script tags. On the other hand, when running demos locally
from the jQuery UI repository, RequireJS is used.
This used to work fine until we got a new `search.js` file introduced in
gh-2187. The deAMDifying process doesn't touch non-HTML files which made loading
autocomplete demos crash on "require is not a function"
To resolve the issues without a major rearchitecture of the build process,
the `search.js` file now detects AMD and uses `require`, falling back to relying
on the `jQuery` global in the other case.
Closes gh-2274
Ref gh-2187
Ref jquery/jqueryui.com#216
We have monthly automatic dependabot PRs for GitHub Actions. Unfortunately,
as of now we get a separate PR for every dependency which is a bit spammy
compared to regular commits updating source.
Thankfully, there's now a way to tell dependabot to submit a single PR per
a defined group. This change defines a single group to have a single dependabot
PR for all action updates.
Closes gh-2267
Ref jquery/jquery#5503
Reflect the `modal` dialog option into the `aria-modal` attribute -
when `modal` is `true`, set `aria-modal` to `"true"`.
This helps some accessibility tools like VoiceOver with their rotor
functionality as it reduces the number of elements presented.
Fixes gh-2246
Closes gh-2257
Co-authored-by: Michał Gołębiowski-Owczarek <m.goleb@gmail.com>
The initial 1.14.0 announcement only promised support for the latest version
of jQuery Core within each major. The main goal was to avoid testing on too many
old versions. However, just testing on the latest one seems too drastic. For
now, add `3.6.4` to the mix; we'll work on a more detailed policy soon.
Closes gh-2258
Just like it has always worked in Core. This will help with size comparisons
between 1.13 & 1.14.
After this PR:
```
$ grunt sizer
Running "requirejs:js" (requirejs) task
Running "uglify:main" (uglify) task
>> 1 file created 549 kB → 267 kB
Running "compare_size:all" (compare_size) task
raw gz Sizes
549319 128757 dist/jquery-ui.js
266710 69612 dist/jquery-ui.min.js
Done.
```
Before, only the less interesting `raw` sizes were reported.
Closes gh-2254
Ref gh-2248
Avoid relying on jQuery patches. Instead:
* use `CSS.escape` instead of `jQuery.escapeSelector`
* use `.filter()` with a proper handler instead of `.even()`
Keep `jquery-patch.js` for backwards compatibility, though.
Also, add tests for jquery-patch.
Ref gh-2249
