aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Core: Don't rely on splice being present on inputBruno PIERRE2022-01-243-6/+12
| | | | | | | | | | Without this fix calling `jQuery.uniqueSort` on an array-like can result in: TypeError: results.splice is not a function at Function.jQuery.uniqueSort (https://code.jquery.com/jquery-git.js:664:12) at jQuery.fn.init.find (https://code.jquery.com/jquery-git.js:2394:27) at gocusihafe.js:3:4 Closes gh-4986
* Docs: Fix incorrect `trac-NUMBER` referencesMichał Gołębiowski-Owczarek2022-01-127-8/+8
| | | | | | | | PR gh-4993 changed a few too many issue references to `trac-NUMBER` ones. This change fixes them. It also fixes a typo in one Trac issue number in selector tests. Ref gh-4993 Closes gh-4995
* Tests: lock colors version to 1.4.0Timmy Willison2022-01-101-0/+1
|
* Docs: remove expired links from old jquery source (#4997)Timmy Willison2022-01-071-2/+0
| | | | Ref gh-4981 Ref gh-4991
* Docs: Remove links to Web Archive from sourceMichał Gołębiowski-Owczarek2022-01-042-2/+0
| | | | | | | | Neither of the removed links is crucial; one of them refers to a site that has since started being malicious; while the Web Archive links remain safe, some scanners warn about such links. Removing them is the safest thing to do. Fixes gh-4981 Closes gh-4991
* Build: Separate the install step from running tests in GitHub ActionsMichał Gołębiowski-Owczarek2022-01-041-2/+5
| | | | | Also, update the "Run test" label to "Run tests". Closes gh-4992
* Docs: Replace `#NUMBER` Trac issue references with `trac-NUMBER`Michał Gołębiowski-Owczarek2022-01-0450-390/+400
| | | | | | | | | | | | | The GitHub UI treats `#NUMBER` as referring to its own issues which is confusing when in jQuery source it's usually referring to the old deprecated Trac instance at https://bugs.jquery.com. This change replaces all such Trac references with `trac-NUMBER`. A few of the references came with the Sizzle integration and referred to the Sizzle GitHub bug tracker. Those have been replaced with full links instead. A new entry describing issue reference conventions has been added to README. Closes gh-4993
* CSS: Justify use of rtrim on CSS property valuesRichard Gibson2022-01-031-0/+6
| | | | | | | CSS does not acknowledge carriage return or form feed characters as whitespace but it does replace them with whitespace, making it acceptable to use `rtrim`. Closes gh-4956
* Build: remove travis.yml and travis mentions from core (#4983)Timmy Willison2021-12-133-58/+1
| | | | We've migrated to GH actions on jQuery core and have already disabled travis builds for core.
* Tests: Skip ETag AJAX tests on TestSwarmMichał Gołębiowski-Owczarek2021-12-011-5/+18
| | | | | | | TestSwarm is now proxied via Cloudflare which cuts out headers relevant for ETag tests, failing them. We're still running those tests in Karma on Chrome & Firefox (including Firefox ESR). Closes gh-4974
* Tests: Allow statusText to be "success" in AJAX testsMichał Gołębiowski-Owczarek2021-12-011-1/+2
| | | | | | | | | | | | In HTTP/2, status message is not supported and whatever is reported as statusText differs between browsers. In Chrome & Safari it's "success", in Firefox & IE it's "OK". So far "success" wasn't allowed. This made the tests pass locally if you're running an HTTP/1.1 server but on TestSwarm which is now proxied via an HTTP/2-equipped Cloudflare, the relevant test started failing in Chrome & Safari. Allow "success" to resolve the issue. Closes gh-4973
* Build: Migrate CI to GitHub Actionsygj62021-11-302-5/+73
| | | Closes gh-4800
* Docs: Update the URL to the latest jQuery build in CONTRIBUTING.mdMichał Gołębiowski-Owczarek2021-11-181-1/+1
| | | | | | | It used to say https://code.jquery.com/jquery.js but that's a frozen URL to jQuery 1.11.1. Let's switch that to the URL to the Git build, i.e. https://releases.jquery.com/git/jquery-git.js. Closes gh-4972
* Attributes: Don't stringify attributes in the setterMichał Gołębiowski-Owczarek2021-11-016-1/+97
| | | | | | | | | | | | | Stringifying attributes in the setter was needed for IE <=9 but it breaks trusted types enforcement when setting a script `src` attribute. Note that this doesn't mean script execution works. Since jQuery disables all scripts by changing their type and then executes them by creating fresh script tags with proper `src` & possibly other attributes, this unwraps any trusted `src` wrappers, making the script not execute under strict CSP settings. We might try to fix it in the future in a separate change. Fixes gh-4948 Closes gh-4949
* Tests: Make Karma browser timeout larger than the QUnit oneMichał Gołębiowski-Owczarek2021-10-301-0/+4
| | | | | | | | | Since the default Karma browser no activity timeout was lower than the QUnit timeout, a single timing out test was interrupting the whole test run of a browser. The QUnit timeout is set to 1 minute so I set the Karma one to 2 minutes. Closes gh-4943
* Build: Update ESLint & eslint-plugin-import, fixing the buildMichał Gołębiowski-Owczarek2021-10-292-15/+34
| | | | | | | | | | Latest `main` started failing the build after some transitive dependencies got updated, incorrectly recognizing some files with default exports as unused. Since the new ESLint no longer supports Node 10 which we have to build on due to use in our CI, skip ESLint in Node 10. Ref gh-3225 Closes gh-4961
* Docs: Remove the CLA checkbox in the pull request templateMichał Gołębiowski-Owczarek2021-10-181-1/+0
| | | | | | | | | The EasyCLA status check is required so this won't get missed. The old JSF CLA is dead, the provided link doesn't return meaningful information. There's no good replacement link for the old CLA; PR authors are just supposed to sign the new CLA by clicking on a link posted by the EasyCLA bot when they submit their first PR since EasyCLA was enabled for the repo. Closes gh-4937
* Core:Manipulation: Add basic TrustedHTML supportMichał Gołębiowski-Owczarek2021-09-3012-46/+170
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This ensures HTML wrapped in TrustedHTML can be used as an input to jQuery manipulation methods in a way that doesn't violate the `require-trusted-types-for` Content Security Policy directive. This commit builds on previous work needed for trusted types support, including gh-4642 and gh-4724. One restriction is that while any TrustedHTML wrapper should work as input for jQuery methods like `.html()` or `.append()`, for passing directly to the `jQuery` factory the string must start with `<` and end with `>`; no trailing or leading whitespaces are allowed. This is necessary as we cannot parse out a part of the input for further construction; that would violate the CSP rule - and that's what's done to HTML input not matching these constraints. No trusted types API is used explicitly in source; the majority of the work is ensuring we don't pass the input converted to string to APIs that would eventually assign it to `innerHTML`. This extra cautiousness is caused by the API being Blink-only, at least for now. The ban on passing strings to `innerHTML` means support tests relying on such assignments are impossible. We don't currently have such tests on the `main` branch but we used to have many of them in the 3.x & older lines. If there's a need to re-add such a test, we'll need an escape hatch to skip them for apps needing CSP-enforced TrustedHTML. See https://web.dev/trusted-types/ for more information about TrustedHTML. Fixes gh-4409 Closes gh-4927 Ref gh-4642 Ref gh-4724
* Tests: Don't remove csp.log in the cspClean action of mock.phpMichał Gołębiowski-Owczarek2021-09-301-1/+0
| | | | | | For some reason the current setup worked fine with Apache but broke for me when I migrated to nginx. Closes gh-4936
* Tests: Load the TestSwarm listener via HTTPSMichał Gołębiowski-Owczarek2021-09-291-1/+1
|
* CSS: Trim whitespace surrounding CSS Custom Properties valuesfecore12021-09-238-13/+43
| | | | | | | | The spec has recently changed and CSS Custom Properties values are trimmed now. This change makes jQuery polyfill that new behavior for all browsers. Ref w3c/csswg-drafts#774 Fixes gh-4926 Closes gh-4930
* Docs: update irc to Libera and fix LAMP dead linkfecore12021-09-051-2/+2
|
* Manipulation: Don't remove HTML comments from scriptsMichał Gołębiowski-Owczarek2021-07-193-12/+22
| | | | | | | | | | | | | | | | | | | When evaluating scripts, jQuery strips out the possible wrapping HTML comment and a CDATA section. However, all supported browsers are already doing that when loading JS via appending a script tag to the DOM which is how we've been doing `jQuery.globalEval` since jQuery 3.0.0. jQuery logic was imperfect, e.g. it just stripped the `<!--` and `-->` markers, respectively at the beginning or the end of the script contents. However, browsers are also stripping everything following those markers in the same line, treating them as single-line comments delimiters; this is now also mandated by ECMAScript 2015 in Annex B. Instead of fixing the jQuery logic, just let the browser do its thing. We also used to strip CDATA sections. However, this shouldn't be needed as in XML documents they're already not visible when inspecting element contents and in HTML documents they have no meaning. We've preserved that behavior for backwards compatibility in 3.x but we're removing it for 4.0. Fixes gh-4904 Closes gh-4906
* Build: Test on Node.js 16 instead of 15Michał Gołębiowski-Owczarek2021-07-121-2/+2
| | | | | | Node.js 10 is kept for now despite being EOL'd as that's what our current infrastructure relies on. Closes gh-4902
* Tests: Switch background image from online file to local 1x1.jpgTimo Tijhof2021-05-242-19/+9
| | | | | Also, remove unused `expected` property in `css` test cases. Closes gh-4866
* Event: Don't break focus triggering after `.on(focus).off(focus)`Michał Gołębiowski-Owczarek2021-05-102-4/+20
| | | | | | | | | | | | | | | | | | | The `_default` function in the special event settings for focus/blur has always returned `true` since gh-4813 as the event was already being fired from `leverageNative`. However, that only works if there's an active handler on that element; this made a quick consecutive call: ```js elem.on( "focus", function() {} ).off( "focus" ); ``` make subsequent `.trigger( "focus" )` calls to not do any triggering. The solution, already used in a similar `_default` method for the `click` event, is to check for the `dataPriv` entry on the element for the focus event (similarly for blur). Fixes gh-4867 Closes gh-4885
* Tests: Strip untypical callback parameter characters from mock.phpMichał Gołębiowski-Owczarek2021-04-132-13/+24
| | | | | | | | | | | Only allow alphanumeric characters & underscores for callback parameters. The change is done both for the PHP server as well as the Node.js-based version. This is only test code so we're not fixing any security issue but it happens often enough that the whole jQuery repository directory structure is deployed onto the server with PHP enabled that it makes is easy to introduce security issues if this cleanup is not done. Ref gh-4764 Closes gh-4871
* Tests: Make more tests run natively in Chrome & FirefoxMichał Gołębiowski-Owczarek2021-04-131-9/+9
| | | | | | | Chrome & Firefox now support complex `:not()` selectors so those test can run in them even without custom jQuery selector code. In the past, it was only possible in Safari, now we only need to exclude IE. Closes gh-4864
* Build: Take core-js-bundle from the external directory as wellMichał Gołębiowski-Owczarek2021-04-132-1/+4
| | | | | | | That package was missed in gh-4865 as it only broke browsers needing the polyfill which is just IE at the moment. Thus, it broke Core tests in IE only. Ref gh-4865 Closes gh-4870
* Build: Restore the external directoryMichał Gołębiowski-Owczarek2021-03-247-11/+34
| | | | | | | | | | | | In gh-4466, we removed the `external` directory in favor of loading some files directly from `node_modules`. This works fine locally but when deploying code for tests, this makes it impossible to not deploy `node_modules` as well. To avoid the issue, this change restores usage of the `external` directory. One change is that we no longer commit this directory to the repository, its only purpose is to have clear isolation from `node_modules`. Ref gh-4466 Closess gh-4865
* Release: remove the need to install grunt globallyTimmy Willison2021-03-011-3/+3
|
* Release: upgrade release dependenciesTimmy Willison2021-03-011-4/+3
| | | | - Remove unused npm dependency
* Support: ensure display is set to block for the support divTimmy Willison2021-02-171-0/+9
| | | | | | | | | | * Support: ensure display is set to block for the support div - Fixes an issue with the support test in iframes in Android 8 Chrome 86+, where display: inline resulted in unexpected height values. Close gh-4845 Fixes gh-4832
* Build: Rename master to main across the repositoryMichał Gołębiowski-Owczarek2021-02-055-13/+13
| | | | | | The default branch was updated, this updates the remaining occurrences in code & comments. Closes gh-4838
* Ajax: Don't auto-execute scripts unless dataType providedMichał Gołębiowski-Owczarek2021-01-262-59/+25
| | | | | | | | | | | | | | PR gh-2588 made jQuery stop auto-execute cross-domain scripts unless `dataType: "script"` was explicitly provided; this change landed in jQuery 3.0.0. This change extends that logic same-domain scripts as well. After this change, to request a script under a provided URL to be evaluated, you need to provide `dataType: "script` in `jQuery.ajax` options or to use `jQuery.getScript`. Fixes gh-4822 Closes gh-4825 Ref gh-2432 Ref gh-2588
* Deferred: Rename master to primaryMichał Gołębiowski-Owczarek2021-01-121-8/+8
| | | Closes gh-4828
* Tests: Fix tests for not auto-executing scripts without dataTypeMichał Gołębiowski-Owczarek2021-01-112-2/+2
| | | | | | | | | | | | | Two issues are fixed in testing for responses with a script Content-Type not getting auto-executed unless an explicit `dataType: "script"` is provided: * the test is now using a correct "text/javascript" Content-Type; it was using "text/html" until now which doesn't really check if the fix works * the Node.js based version of the tests didn't account for an empty `header` query string parameter Closes gh-4824 Ref gh-2432 Ref gh-2588 Ref 39cdb8c9aa0fde68f733553ba050a2ba9d86474c
* Dimensions: Add offset prop fallback to FF for unreliable TR dimensionsTimmy Willison2021-01-114-26/+84
| | | | | | | | Firefox incorrectly (or perhaps correctly) includes table borders in computed dimensions, but they are the only one. Workaround this by testing for it and falling back to offset properties Fixes gh-4529 Closes gh-4808
* Core: Report browser errors in parseXMLMichał Gołębiowski-Owczarek2020-12-082-8/+36
| | | | Fixes gh-4784 Closes gh-4816
* Core: Make jQuery.isXMLDoc accept falsy inputMichał Gołębiowski-Owczarek2020-12-072-2/+12
| | | | Fixes gh-4782 Closes gh-4814
* Event: Make focus re-triggering not focus the original element backMichał Gołębiowski-Owczarek2020-12-072-0/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | If during a focus handler another focus event is triggered: ```js elem1.on( "focus", function() { elem2.trigger( "focus" ); } ); ``` due to their synchronous nature everywhere outside of IE the hack added in gh-4279 to leverage native events causes the native `.focus()` method to be called last for the initial element, making it steal the focus back. Since the native method is already being called in `leverageNative`, we can skip that final call. This aligns with changes to the `_default` method for the `click` event that were added when `leverageNative` was introduced there. A side effect of this change is that now `focusin` will only propagate to the document for the last focused element. This is a change in behavior but it also aligns us better with how this works with native methods. Fixes gh-4382 Closes gh-4813 Ref gh-4279
* Build: Test on Node.js 15Michał Gołębiowski-Owczarek2020-11-111-6/+7
| | | | | Also, run browser tests on Node 14 instead of 12. Closes gh-4802
* Event: Don't crash if an element is removed on blurMichał Gołębiowski-Owczarek2020-10-192-1/+34
| | | | | | | | | | In Chrome, if an element having a `focusout` handler is blurred by clicking outside of it, it invokes the handler synchronously. If that handler calls `.remove()` on the element, the data is cleared, leaving private data undefined. We're reading a property from that data so we need to guard against this. Fixes gh-4417 Closes gh-4799
* Build: Explicitly exclude the queue module from the slim buildMichał Gołębiowski-Owczarek2020-09-281-1/+1
| | | | | | | | | | The queue module is not present in the slim build as it depends on deferred and our Gruntfile specifies excluding deferred should also exclude queue: https://github.com/jquery/jquery/blob/3.5.1/Gruntfile.js#L66 This commit makes this exclusion explicit so that the queue module never accidentally gets re-included in the slim build if it stopped importing from the deferred module directly. Closes gh-4793
* Core: Drop support for Edge Legacy (i.e. non-Chromium Microsoft Edge)Michał Gołębiowski-Owczarek2020-09-2224-244/+105
| | | | | | | | | | | | Drop support for Edge Legacy: the non-Chromium, EdgeHTML-based Microsoft Edge version. Also, restrict some workarounds that were applied unconditionally in all browsers to run only in IE now. This slightly increases the size but reduces the performance burden on modern browsers that don't need the workarounds. Also, clean up some comments & remove some obsolete workarounds. Fixes gh-4568 Closes gh-4792
* Manipulation: Respect script crossorigin attribute in DOM manipulation高灰2020-09-225-3/+63
| | | | | | Fixes gh-4542 Closes gh-4563 Co-authored-by: Michał Gołębiowski-Owczarek <m.goleb@gmail.com>
* Tests: Recognize callbacks with dots in the Node.js mock serverMichał Gołębiowski-Owczarek2020-09-021-1/+1
| | | | | | | | | | | | This aligns the Node.js server with the previous PHP one in sending `mock.php` as a callback if there's no `callback` parameter in the query string which is triggered by a recently added test. This prevents the request crashing on that Node.js server and printing a JS error: ``` TypeError: Cannot read property '1' of null ``` Closes gh-4764 Ref gh-4754
* Tests: Skip the "jQuery.ajax() on unload" test in SafariMichał Gołębiowski-Owczarek2020-09-021-1/+4
| | | | | | | | The test has been already skipped in Chrome as it dropped support for such requests and now Safari has joined the squad. This will resolve AJAX test errors we've had for a while in Safari 13 & iOS 13. Closes gh-4779
* Build: Make the import/no-unused-modules ESLint rule work in WebStormMichał Gołębiowski-Owczarek2020-09-021-1/+10
| | | | | | | | | | | | | | | | When run via WebStorm, the root path against which paths in the config of the `import/no-unused-modules` ESLint rule are resolved is the path where the ESLint config file that defines the rule lies, i.e. `src`. When run via the command line, it's usually the root folder of the jQuery repository. This pattern intends to catch both. Note that we cannot specify two patterns here: ```js [ "src/*.js", "*.js" ] ``` as they're analyzed individually and the rule crashes if a pattern cannot be matched. Closes gh-4777
* Attributes: Drop the `toggleClass(boolean|undefined)` signatureMichał Gołębiowski-Owczarek2020-09-012-62/+15
| | | | | | | The behavior of this signature is not intuitive, especially if classes are manipulated via other ways between `toggleClass` calls. Fixes gh-3388 Closes gh-4766
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-24 17:30:12 +0000