Skip to content

public-ui/kolibri

v4.2.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

a11y accessibility angular barrierefreiheit client-side-rendering csr
+13 more
design-system react service-side service-side-generation service-side-rendering solid-js ssg ssr styleguide theming ui vuejs webcomponents

Affected surfaces

deps

ReleasePort's take

Light signal
editorial:auto 5d

ReleasePort Layer 1 version 4.2.0 introduces new UI component features and fixes a form‑field accessibility bug.

Why it matters: Adds modeless dialogs, onCancel ESC handling, onToggle for accordions/drawers, password visibility toggle, and corrects aria-describedby references affecting screen‑reader users; severity flagged at 40 across all changes.

Summary

AI summary

Updates Dialog, Drawer & Accordion, Sample Apps & Documentation, and Meter across a mixed release.

Changes in this release

Feature Medium

Added support for modeless dialogs and drawers.

Added support for modeless dialogs and drawers.

Source: llm_adapter@2026-05-29

Confidence: high

Feature Medium

Added `onCancel` callback to intercept ESC key in dialogs and drawers.

Added `onCancel` callback to intercept ESC key in dialogs and drawers.

Source: llm_adapter@2026-05-29

Confidence: high

Feature Medium

Added `onToggle` support to accordion and drawer.

Added `onToggle` support to accordion and drawer.

Source: llm_adapter@2026-05-29

Confidence: high

Feature Medium

Added password input visibility toggle.

Added password input visibility toggle.

Source: llm_adapter@2026-05-29

Confidence: high

Feature Low

Added variants for form fields.

Added variants for form fields.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Feature Low

Added CSV export sample for `KolTableStateful`.

Added CSV export sample for `KolTableStateful`.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Feature Low

Added table variant prop and KERN styles.

Added table variant prop and KERN styles.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Feature Low

Added cross-shadow `aria-labelledby` support via `ARIAMixin`.

Added cross-shadow `aria-labelledby` support via `ARIAMixin`.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Feature Low

Added Codicon icon support.

Added Codicon icon support.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Feature Low

Icons now render with theme-specific fonts.

Icons now render with theme-specific fonts.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Dependency Low

Updated dependencies and lock files.

Updated dependencies and lock files.

Source: llm_adapter@2026-05-29

Confidence: low

Dependency Low

Upgraded dependencies to reduce CVE risks.

Upgraded dependencies to reduce CVE risks.

Source: llm_adapter@2026-05-29

Confidence: low

Dependency Low

Bumped npm and yarn dependency groups across two directories.

Bumped npm and yarn dependency groups across two directories.

Source: llm_adapter@2026-05-29

Confidence: low

Dependency Low

Pinned adapter peer dependencies to major ranges.

Pinned adapter peer dependencies to major ranges.

Source: llm_adapter@2026-05-29

Confidence: low

Dependency Low

Skipped pnpm `workspace:` protocol versions in `ncu`.

Skipped pnpm `workspace:` protocol versions in `ncu`.

Source: llm_adapter@2026-05-29

Confidence: low

Performance Low

Stored bound drawer event handler references to fix a memory leak.

Stored bound drawer event handler references to fix a memory leak.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Performance Low

Optimized overlay z-index management logic.

Optimized overlay z-index management logic.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Bugfix Medium

Fixed `aria-describedby` references for message and counter IDs used together in form fields.

Fixed `aria-describedby` references for message and counter IDs used together in form fields.

Source: llm_adapter@2026-05-29

Confidence: high

Bugfix Low

Fixed accordion headline rendering issue.

Fixed accordion headline rendering issue.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Bugfix Low

Fixed duplicate label in drawer and dialog components.

Fixed duplicate label in drawer and dialog components.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Bugfix Low

Prevented `KolAlert` close event from bubbling to `KolDialog` `onClose`.

Prevented `KolAlert` close event from bubbling to `KolDialog` `onClose`.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Bugfix Low

Prevented spurious blur when clicking a focused checkbox label.

Prevented spurious blur when clicking a focused checkbox label.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Bugfix Low

Corrected boolean option value handling in `KolSingleSelect`.

Corrected boolean option value handling in `KolSingleSelect`.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Bugfix Low

Fixed combobox / single select `aria-controls` attribute.

Fixed combobox / single select `aria-controls` attribute.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Bugfix Low

Fixed Enter key behavior in single select and combobox.

Fixed Enter key behavior in single select and combobox.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Bugfix Low

Fixed Space key handling for clear button in single select.

Fixed Space key handling for clear button in single select.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Bugfix Low

Fixed action column gap in tables.

Fixed action column gap in tables.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Bugfix Low

Corrected colspan for empty tables when columns are hidden.

Corrected colspan for empty tables when columns are hidden.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Bugfix Low

Fixed pagination visible-range text and handling of negative values for empty datasets.

Fixed pagination visible-range text and handling of negative values for empty datasets.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Bugfix Low

Removed duplicate fallback in table pagination max value calculation.

Removed duplicate fallback in table pagination max value calculation.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Bugfix Low

Fixed disabled state of current pagination item.

Fixed disabled state of current pagination item.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Bugfix Low

Removed redundant filter logic in theme rendering.

Removed redundant filter logic in theme rendering.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Refactor Low

Converted drawer event handlers to arrow functions.

Converted drawer event handlers to arrow functions.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Refactor Low

Refactored pagination array generation for better readability.

Refactored pagination array generation for better readability.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Refactor Low

Aligned icon font route in visual tests.

Aligned icon font route in visual tests.

Source: granite4.1:30b@2026-05-29-audit

Confidence: low

Full changelog

Dialog, Drawer & Accordion

  • Added support for modeless dialogs and drawers — #10089 by @deleonio
  • Added onCancel callback and cancel DOM event to intercept ESC key — #10205 by @deleonio
  • Added onToggle support to accordion and drawer — #10126 by @BF150
  • Fixed accordion headline — #10273 by @BF150
  • Fixed drawer and dialog double label — #10030 by @BF150
  • Guarded drawer dialog methods in test environment — #10084 by @deleonio
  • Converted drawer event handlers to arrow functions — #10086 by @deleonio
  • Stored bound drawer event handler references to fix a memory leak — #10098 by @deleonio
  • Prevented KolAlert close event from bubbling to KolDialog onClose — #10224 by @deleonio
  • Optimized overlay z-index management logic — #10189 by @deleonio

Form Fields, Inputs & Accessibility

  • Added variants for form fields — #10221 by @BF150
  • Added password input visibility toggle — #10209 by @BF150
  • Updated password variant migration to use string values for visibility toggle — #10245 by @deleonio
  • Added TODO comments for v5 backwards-compatibility cleanup in input-password — #10248 by @deleonio
  • Fixed input label expert slot readonly and required marker — #10284 by @BF150
  • Fixed aria-describedby references for message and counter IDs used together — #10233 by @deleonio
  • Prevented spurious blur when clicking a focused checkbox label — #10226 by @deleonio
  • Corrected boolean option value handling in KolSingleSelect — #10198 by @deleonio
  • Fixed combobox / single select aria-controls — #10182 by @BF150
  • Fixed single select / combobox Enter behavior — #10180 by @BF150
  • Fixed single select clear button Space key handling — #10263 by @BF150
  • Fixed devHint placement in searchFormElement — #10153 by @deleonio

Table & Pagination

  • Added CSV export sample for KolTableStateful — #10073 by @deleonio
  • Added table variant prop and KERN styles — #10168 by @BF150
  • Added cross-shadow aria-labelledby support via ARIAMixin ariaLabelledByElements — #10258 by @deleonio
  • Fixed table action column gap — #10170 by @BF150
  • Corrected colspan for empty tables when columns have visible: false — #10207 by @deleonio
  • Fixed pagination visible-range text and negative values for empty datasets — #10077 by @deleonio
  • Refactored pagination array generation for better readability — #10109 by @deleonio
  • Removed duplicate fallback in table pagination max value — #10197 by @deleonio
  • Fixed disabled state of current pagination item — #10225 by @BF150

Themes, Icons & Visuals

  • Added Codicon support — #10092 by @BF150
  • Icons now show theme-specific fonts — #10002 by @BF150
  • Aligned icon font route in visual tests — #10142 by @deleonio
  • Removed DESY badge text color overrides — #10103 by @deleonio
  • Renamed DESY variant file to v11 — #10090 by @BF150
  • Fixed sample app DESY theme — #10091 by @BF150
  • Removed redundant filter logic in theme rendering — #10163 by @deleonio
  • Streamlined theme package build scripts and dependent theme builds — #10174 by @deleonio

Meter

  • Refactored meter to use the native meter component for display instead of SVG/divs — #10016 by @BF150
  • Reduced meter samples — #10242 by @BF150

Linting, Architecture & Code Quality

  • Added style lint rules for colors — #10088 by @BF150
  • Reverted initial style lint rules for colors — #10100 by @deleonio
  • Reintroduced style lint rules for colors — #10101 by @deleonio
  • Added style lint rules for gap, margin and padding — #10013 by @BF150
  • Enforced import boundaries for skeleton components with eslint-plugin-boundaries — #10117 by @deleonio
  • Delegated click and focus methods with decorators for cleaner code — #10116 by @deleonio
  • Extracted regex pattern to a constant in variant class name validation — #10171 by @deleonio
  • Centralized readable nonce IDs — #10173 by @deleonio
  • Decoupled KolIcons asset generation — #10172 by @deleonio

Sample Apps & Documentation

  • Preloaded sample app data and used singleton for variant lookups — #10130 by @deleonio
  • Documented onInput and onChange usage for all form field components — #10074 by @deleonio

CI, GitHub Actions & Release Automation

  • Optimized GitHub workflows: consolidated workflows and added smart conditions — #9958 by @deleonio
  • Fixed Netlify deployments — #10096 by @deleonio
  • Moved pnpm/action-setup before actions/setup-node — #10104 by @deleonio
  • Replaced lerna and nx with pnpm version management — #10115 by @deleonio
  • Ran pnpm commands recursively in auto-dependency-updater workflow — #10129 by @deleonio
  • Ran dependency updater unit tests recursively — #10127 by @deleonio
  • Skipped visual tests for draft pull requests — #10135 by @deleonio
  • Created draft PRs for auto-update and CVE workflows — #10175 by @deleonio
  • Removed optional snapshot deletion input from update workflow — #10111 by @deleonio
  • Added lefthook for pre-commit code formatting — #10234 by @deleonio
  • Created annotated git tags with release messages — #10246 by @deleonio
  • Proved npm publish error handling in GitHub Actions workflow — #10261 by @deleonio
  • Added verification step for all packages published to npmjs — #10269 by @deleonio
  • Fixed snapshots — #10199 by @deleonio

Dependencies, Security & Licenses

  • Updated dependencies and lock files — #10080, #10108, #10121, #10133, #10187, #10193, #10203, #10249, #10267, #10282 by @github-actions[bot]
  • Updated CVE overview — #10085, #10102, #10114, #10194, #10204 by @github-actions[bot]
  • Upgraded dependencies to reduce CVE risks — #10141 by @deleonio
  • Bumped npm and yarn dependency groups across two directories — #10235 by @dependabot[bot]
  • Pinned adapter peer dependencies to major ranges — #10128 by @deleonio
  • Skipped pnpm workspace: protocol versions in ncu — #10232 by @deleonio
  • Added automated license report generation and merging — #10274 by @deleonio
  • Updated license reports — #10276 by @github-actions[bot]

Full Changelog: https://github.com/public-ui/kolibri/compare/4.1.4...4.2.0

Security Fixes

  • OTP cooldowns now session‑scoped — closes abuse vector where users changed phone/email mid‑flow to reset OTP cooldowns

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track public-ui/kolibri

Get notified when new releases ship.

Sign up free

About public-ui/kolibri

Streaming KoliBri MCP server (NPM: `@public-ui/mcp`)

All releases →

Beta — feedback welcome: [email protected]