i-like-robots / hyperons Goto Github PK

The devDependency rollup was updated from 1.14.2 to 1.14.3.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

rollup is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Your Greenkeeper Bot 🌴

Preact and a few other libraries support functionality similar to the classnames module which can render or not render a list of class names depending on whether each key has a truthy or falsy value.

<div class={{ foo: true, bar: false }}></div> // => <div class="foo"></div>

Hey thanks for the package! Any chance of getting Suspense and async support? For reference, hono just added experimental support for that concept https://github.com/honojs/hono/blob/next/src/jsx/streaming.ts#L25

Text children with a value of 0 (the number) aren't rendered because they're falsy. Preact stringifies number children as soon as they're passed in.

• https://reactjs.org/docs/fragments.html#short-syntax
• https://github.com/babel/babel/blob/master/packages/babel-plugin-transform-react-jsx/README.md#fragments

<>
  <td>Hello</td>
  <td>World</td>
</>

Looks like the module needs to support rendering children of null elements.

The devDependency rollup was updated from 1.9.2 to 1.9.3.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

rollup is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Your Greenkeeper Bot 🌴

It should be possible to support simple class based components. It may also be worth investigating how lifecycle methods from the various frameworks may be invoked when rendering static markup.

class Foo extends Component {
  render () {
    return (
      <h1>Hello World</h1>
    )
  }
}

The current check to see if a string is "safe" is far from safe. If a user input is passed to Hyperons and rendered unsanitized then this could be exploited for a XSS attack.

React and React-like libraries do not have this issue as their DOM-builder methods return their internal representation of a Node rather than strings.

The string could be wrapped in simple class with toString() method - as Handlebars does which is easily checked, however this class instance would be returned to the user. new String() also returns an object so they cannot be compared to string literals.

Is this even a concern of this library?

https://twitter.com/simonleggsays/status/1089551242538426368