This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+4 more
Affected surfaces
ReleasePort's take
Light signalRelease v0.52.39 introduces accessibility improvements and hardens XSS defenses by eliminating innerHTML assignments.
Why it matters: The update adds ARIA states, proper modal dialog semantics, and enforces DOM‑API rendering to block `innerHTML` usage across UI components, directly reducing injection risk.
Summary
AI summaryAccessibility enhancements add ARIA states, dialog semantics, and prevent XSS via innerHTML.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Navigation and global search overlays now behave as proper modal dialogs with inert closed state, focus management, Escape closure, and return focus. Navigation and global search overlays now behave as proper modal dialogs with inert closed state, focus management, Escape closure, and return focus. Source: llm_adapter@2026-05-24 Confidence: high |
— |
| Feature | Medium |
Shared sub‑tabs generate stable IDs, wire tabs to panels with ARIA attributes, and keep hidden panel state synchronized. Shared sub‑tabs generate stable IDs, wire tabs to panels with ARIA attributes, and keep hidden panel state synchronized. Source: llm_adapter@2026-05-24 Confidence: high |
— |
| Feature | Medium |
Settings theme buttons expose `aria-pressed` state reflecting the active theme. Settings theme buttons expose `aria-pressed` state reflecting the active theme. Source: llm_adapter@2026-05-24 Confidence: high |
— |
| Feature | Medium |
Shopping list creation button uses localized label instead of hardcoded German ARIA text. Shopping list creation button uses localized label instead of hardcoded German ARIA text. Source: llm_adapter@2026-05-24 Confidence: high |
— |
| Feature | Medium |
Frontend audit regression coverage now guards against re‑introducing `innerHTML` assignments and enforces accessibility rules for Meals, Budget, sub‑tabs, theme buttons, and router overlays. Frontend audit regression coverage now guards against re‑introducing `innerHTML` assignments and enforces accessibility rules for Meals, Budget, sub‑tabs, theme buttons, and router overlays. Source: llm_adapter@2026-05-24 Confidence: high |
— |
| Bugfix | Medium |
Prevent off-by-one calendar dates for Meals and Budget in UTC time zones. Prevent off-by-one calendar dates for Meals and Budget in UTC time zones. Source: llm_adapter@2026-05-24 Confidence: high |
— |
| Bugfix | Medium |
Render PWA install prompt using SVG DOM APIs instead of `innerHTML` to avoid blocked assignments. Render PWA install prompt using SVG DOM APIs instead of `innerHTML` to avoid blocked assignments. Source: llm_adapter@2026-05-24 Confidence: high |
— |
| Bugfix | Medium |
Hide keyboard focus on closed More and Search overlay controls. Hide keyboard focus on closed More and Search overlay controls. Source: llm_adapter@2026-05-24 Confidence: high |
— |
| Refactor | Medium |
Centralize YYYY‑MM‑DD date generation in shared local date helpers for API payloads, week starts, and day arithmetic. Centralize YYYY‑MM‑DD date generation in shared local date helpers for API payloads, week starts, and day arithmetic. Source: llm_adapter@2026-05-24 Confidence: high |
— |
| Refactor | Medium |
Notes, Meals, and install prompt render via `replaceChildren()`, `insertAdjacentHTML()`, or DOM APIs rather than assigning `innerHTML` to comply with XSS policy. Notes, Meals, and install prompt render via `replaceChildren()`, `insertAdjacentHTML()`, or DOM APIs rather than assigning `innerHTML` to comply with XSS policy. Source: llm_adapter@2026-05-24 Confidence: high |
— |
Full changelog
Added
- Frontend audit regression coverage now guards the accessibility and rendering fixes from this release: audited frontend files must not reintroduce
innerHTMLassignments, Meals and Budget must use local date keys, shared sub-tabs must wire tabs to panels, settings theme buttons must expose pressed state, and router overlays must stay hidden from keyboard focus when closed. - Shared local date helpers centralize YYYY-MM-DD generation for API payloads, week starts, and day arithmetic without relying on UTC ISO string slicing.
Changed
- More navigation and global search overlays now behave like proper dialogs: closed overlays are inert, open overlays declare modal semantics, focus moves into the active surface, Escape closes them, and focus returns to the launching control.
- Shared sub-tabs now generate stable tab ids, connect each tab to its matching panel with
aria-controlsandaria-labelledby, and keep hidden panel state synchronized with the active tab. - Settings theme buttons now expose
aria-pressedand update that pressed state whenever the active theme changes. - Shopping list creation now uses the existing localized label for its icon-only button instead of a hardcoded German ARIA label.
- Notes, Meals, and the install prompt now render through
replaceChildren(),insertAdjacentHTML(), or DOM APIs instead of assigninginnerHTML, aligning these frontend paths with the project XSS policy.
Fixed
- Meals and Budget no longer derive today, week starts, or payment dates through UTC ISO slicing, preventing off-by-one calendar dates for users west of UTC and around local midnight.
- The PWA install prompt now builds its dismiss icon with SVG DOM APIs and clears shadow content safely, avoiding blocked
innerHTMLassignments. - Hidden More and Search overlay controls are no longer reachable by keyboard or assistive technology while the overlays are closed.
Security Fixes
- Notes, Meals, install prompt, and other components now render via replaceChildren/insertAdjacentHTML/DOM APIs instead of innerHTML, eliminating blocked XSS assignments.
- PWA install prompt builds its dismiss icon with SVG DOM APIs and clears shadow content safely, avoiding blocked innerHTML assignments.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]