This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+13 more
Affected surfaces
ReleasePort's take
Light signalReleasePort Layer 1 version 4.2.0 introduces new UI component features and fixes a form‑field accessibility bug.
Why it matters: Adds modeless dialogs, onCancel ESC handling, onToggle for accordions/drawers, password visibility toggle, and corrects aria-describedby references affecting screen‑reader users; severity flagged at 40 across all changes.
Summary
AI summaryUpdates Dialog, Drawer & Accordion, Sample Apps & Documentation, and Meter across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Added support for modeless dialogs and drawers. Added support for modeless dialogs and drawers. Source: llm_adapter@2026-05-29 Confidence: high |
— |
| Feature | Medium |
Added `onCancel` callback to intercept ESC key in dialogs and drawers. Added `onCancel` callback to intercept ESC key in dialogs and drawers. Source: llm_adapter@2026-05-29 Confidence: high |
— |
| Feature | Medium |
Added `onToggle` support to accordion and drawer. Added `onToggle` support to accordion and drawer. Source: llm_adapter@2026-05-29 Confidence: high |
— |
| Feature | Medium |
Added password input visibility toggle. Added password input visibility toggle. Source: llm_adapter@2026-05-29 Confidence: high |
— |
| Feature | Low |
Added variants for form fields. Added variants for form fields. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Feature | Low |
Added CSV export sample for `KolTableStateful`. Added CSV export sample for `KolTableStateful`. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Feature | Low |
Added table variant prop and KERN styles. Added table variant prop and KERN styles. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Feature | Low |
Added cross-shadow `aria-labelledby` support via `ARIAMixin`. Added cross-shadow `aria-labelledby` support via `ARIAMixin`. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Feature | Low |
Added Codicon icon support. Added Codicon icon support. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Feature | Low |
Icons now render with theme-specific fonts. Icons now render with theme-specific fonts. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Dependency | Low |
Updated dependencies and lock files. Updated dependencies and lock files. Source: llm_adapter@2026-05-29 Confidence: low |
— |
| Dependency | Low |
Upgraded dependencies to reduce CVE risks. Upgraded dependencies to reduce CVE risks. Source: llm_adapter@2026-05-29 Confidence: low |
— |
| Dependency | Low |
Bumped npm and yarn dependency groups across two directories. Bumped npm and yarn dependency groups across two directories. Source: llm_adapter@2026-05-29 Confidence: low |
— |
| Dependency | Low |
Pinned adapter peer dependencies to major ranges. Pinned adapter peer dependencies to major ranges. Source: llm_adapter@2026-05-29 Confidence: low |
— |
| Dependency | Low |
Skipped pnpm `workspace:` protocol versions in `ncu`. Skipped pnpm `workspace:` protocol versions in `ncu`. Source: llm_adapter@2026-05-29 Confidence: low |
— |
| Performance | Low |
Stored bound drawer event handler references to fix a memory leak. Stored bound drawer event handler references to fix a memory leak. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Performance | Low |
Optimized overlay z-index management logic. Optimized overlay z-index management logic. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Medium |
Fixed `aria-describedby` references for message and counter IDs used together in form fields. Fixed `aria-describedby` references for message and counter IDs used together in form fields. Source: llm_adapter@2026-05-29 Confidence: high |
— |
| Bugfix | Low |
Fixed accordion headline rendering issue. Fixed accordion headline rendering issue. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Low |
Fixed duplicate label in drawer and dialog components. Fixed duplicate label in drawer and dialog components. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Low |
Prevented `KolAlert` close event from bubbling to `KolDialog` `onClose`. Prevented `KolAlert` close event from bubbling to `KolDialog` `onClose`. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Low |
Prevented spurious blur when clicking a focused checkbox label. Prevented spurious blur when clicking a focused checkbox label. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Low |
Corrected boolean option value handling in `KolSingleSelect`. Corrected boolean option value handling in `KolSingleSelect`. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Low |
Fixed combobox / single select `aria-controls` attribute. Fixed combobox / single select `aria-controls` attribute. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Low |
Fixed Enter key behavior in single select and combobox. Fixed Enter key behavior in single select and combobox. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Low |
Fixed Space key handling for clear button in single select. Fixed Space key handling for clear button in single select. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Low |
Fixed action column gap in tables. Fixed action column gap in tables. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Low |
Corrected colspan for empty tables when columns are hidden. Corrected colspan for empty tables when columns are hidden. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Low |
Fixed pagination visible-range text and handling of negative values for empty datasets. Fixed pagination visible-range text and handling of negative values for empty datasets. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Low |
Removed duplicate fallback in table pagination max value calculation. Removed duplicate fallback in table pagination max value calculation. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Low |
Fixed disabled state of current pagination item. Fixed disabled state of current pagination item. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Low |
Removed redundant filter logic in theme rendering. Removed redundant filter logic in theme rendering. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Refactor | Low |
Converted drawer event handlers to arrow functions. Converted drawer event handlers to arrow functions. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Refactor | Low |
Refactored pagination array generation for better readability. Refactored pagination array generation for better readability. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Refactor | Low |
Aligned icon font route in visual tests. Aligned icon font route in visual tests. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
Full changelog
Dialog, Drawer & Accordion
- Added support for modeless dialogs and drawers — #10089 by @deleonio
- Added
onCancelcallback and cancel DOM event to intercept ESC key — #10205 by @deleonio - Added
onTogglesupport to accordion and drawer — #10126 by @BF150 - Fixed accordion headline — #10273 by @BF150
- Fixed drawer and dialog double label — #10030 by @BF150
- Guarded drawer dialog methods in test environment — #10084 by @deleonio
- Converted drawer event handlers to arrow functions — #10086 by @deleonio
- Stored bound drawer event handler references to fix a memory leak — #10098 by @deleonio
- Prevented
KolAlertclose event from bubbling toKolDialogonClose— #10224 by @deleonio - Optimized overlay z-index management logic — #10189 by @deleonio
Form Fields, Inputs & Accessibility
- Added variants for form fields — #10221 by @BF150
- Added password input visibility toggle — #10209 by @BF150
- Updated password variant migration to use string values for visibility toggle — #10245 by @deleonio
- Added TODO comments for v5 backwards-compatibility cleanup in
input-password— #10248 by @deleonio - Fixed input label expert slot readonly and required marker — #10284 by @BF150
- Fixed
aria-describedbyreferences for message and counter IDs used together — #10233 by @deleonio - Prevented spurious blur when clicking a focused checkbox label — #10226 by @deleonio
- Corrected boolean option value handling in
KolSingleSelect— #10198 by @deleonio - Fixed combobox / single select
aria-controls— #10182 by @BF150 - Fixed single select / combobox Enter behavior — #10180 by @BF150
- Fixed single select clear button Space key handling — #10263 by @BF150
- Fixed
devHintplacement insearchFormElement— #10153 by @deleonio
Table & Pagination
- Added CSV export sample for
KolTableStateful— #10073 by @deleonio - Added table variant prop and KERN styles — #10168 by @BF150
- Added cross-shadow
aria-labelledbysupport viaARIAMixinariaLabelledByElements— #10258 by @deleonio - Fixed table action column gap — #10170 by @BF150
- Corrected colspan for empty tables when columns have
visible: false— #10207 by @deleonio - Fixed pagination visible-range text and negative values for empty datasets — #10077 by @deleonio
- Refactored pagination array generation for better readability — #10109 by @deleonio
- Removed duplicate fallback in table pagination max value — #10197 by @deleonio
- Fixed disabled state of current pagination item — #10225 by @BF150
Themes, Icons & Visuals
- Added Codicon support — #10092 by @BF150
- Icons now show theme-specific fonts — #10002 by @BF150
- Aligned icon font route in visual tests — #10142 by @deleonio
- Removed DESY badge text color overrides — #10103 by @deleonio
- Renamed DESY variant file to v11 — #10090 by @BF150
- Fixed sample app DESY theme — #10091 by @BF150
- Removed redundant filter logic in theme rendering — #10163 by @deleonio
- Streamlined theme package build scripts and dependent theme builds — #10174 by @deleonio
Meter
- Refactored meter to use the native meter component for display instead of SVG/divs — #10016 by @BF150
- Reduced meter samples — #10242 by @BF150
Linting, Architecture & Code Quality
- Added style lint rules for colors — #10088 by @BF150
- Reverted initial style lint rules for colors — #10100 by @deleonio
- Reintroduced style lint rules for colors — #10101 by @deleonio
- Added style lint rules for gap, margin and padding — #10013 by @BF150
- Enforced import boundaries for skeleton components with
eslint-plugin-boundaries— #10117 by @deleonio - Delegated click and focus methods with decorators for cleaner code — #10116 by @deleonio
- Extracted regex pattern to a constant in variant class name validation — #10171 by @deleonio
- Centralized readable nonce IDs — #10173 by @deleonio
- Decoupled KolIcons asset generation — #10172 by @deleonio
Sample Apps & Documentation
- Preloaded sample app data and used singleton for variant lookups — #10130 by @deleonio
- Documented
onInputandonChangeusage for all form field components — #10074 by @deleonio
CI, GitHub Actions & Release Automation
- Optimized GitHub workflows: consolidated workflows and added smart conditions — #9958 by @deleonio
- Fixed Netlify deployments — #10096 by @deleonio
- Moved
pnpm/action-setupbeforeactions/setup-node— #10104 by @deleonio - Replaced
lernaandnxwithpnpmversion management — #10115 by @deleonio - Ran pnpm commands recursively in auto-dependency-updater workflow — #10129 by @deleonio
- Ran dependency updater unit tests recursively — #10127 by @deleonio
- Skipped visual tests for draft pull requests — #10135 by @deleonio
- Created draft PRs for auto-update and CVE workflows — #10175 by @deleonio
- Removed optional snapshot deletion input from update workflow — #10111 by @deleonio
- Added
lefthookfor pre-commit code formatting — #10234 by @deleonio - Created annotated git tags with release messages — #10246 by @deleonio
- Proved npm publish error handling in GitHub Actions workflow — #10261 by @deleonio
- Added verification step for all packages published to npmjs — #10269 by @deleonio
- Fixed snapshots — #10199 by @deleonio
Dependencies, Security & Licenses
- Updated dependencies and lock files — #10080, #10108, #10121, #10133, #10187, #10193, #10203, #10249, #10267, #10282 by @github-actions[bot]
- Updated CVE overview — #10085, #10102, #10114, #10194, #10204 by @github-actions[bot]
- Upgraded dependencies to reduce CVE risks — #10141 by @deleonio
- Bumped npm and yarn dependency groups across two directories — #10235 by @dependabot[bot]
- Pinned adapter peer dependencies to major ranges — #10128 by @deleonio
- Skipped pnpm
workspace:protocol versions inncu— #10232 by @deleonio - Added automated license report generation and merging — #10274 by @deleonio
- Updated license reports — #10276 by @github-actions[bot]
Full Changelog: https://github.com/public-ui/kolibri/compare/4.1.4...4.2.0
Security Fixes
- OTP cooldowns now session‑scoped — closes abuse vector where users changed phone/email mid‑flow to reset OTP cooldowns
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Beta — feedback welcome: [email protected]