Skip to content

v0.3.0 — Security, Accessibility & Export Sprint

Choose a tag to compare

View all tags
@zvndev zvndev released this 10 May 01:31
· 136 commits to main since this release
v0.3.0
6bc6046

v0.3.0 — Security, Accessibility & Export Sprint

Security

  • Prototype pollution guard on getDeepValue — blocks __proto__, constructor, prototype traversal
  • URL allowlist in CellLink — only http:, https:, mailto:, tel: protocols allowed
  • Formula length limit (10,000 chars) prevents DoS via parser
  • CSV formula injection mitigation — tab-prefixes values starting with =, +, -, @

Added

  • exportToCsv() and exportToJson() — full RFC 4180 CSV compliance, BOM support, custom delimiters, column filtering, value formatters
  • ariaLabel prop on React <Table> component
  • aria-live region for sort/filter/page change announcements
  • aria-selected on selected rows, aria-expanded on expandable rows
  • TanStack Table migration guide (docs/MIGRATION.md)

Changed

  • Table constructor is now fully typed — eliminated ~90 any casts, __commitCoordinator moved to WeakMap
  • ESLint no-explicit-any escalated from warn → error (remaining count: 22, down from 114)
  • 127 new tests (722 total) covering security, accessibility, export, virtualization, clipboard, and error boundaries

Packages

  • @zvndev/yable-core@0.3.0
  • @zvndev/yable-react@0.3.0
  • @zvndev/yable-vanilla@0.3.0
  • @zvndev/yable-themes@0.3.0

Install: npm install @zvndev/yable-core@0.3.0 @zvndev/yable-react@0.3.0

Assets 2
Loading