list of PRs to merge

[DanielRuf]

Let's collect the open PRs that we have to merge. We already merged a few using the GitHub CLI.

For the needed steps see #2 (comment)

https://github.com/Dogfalo/materialize/pulls?q=is%3Apr+is%3Aopen+sort%3Aupdated-desc

Already merged:

Fix some typos (found by codespell)
datepicker: add yearRangeReverse property sort year in reverse order
fix dropdown position when coverTrigger is false
Typos in upgrade guide

Planned to merge:

passive event receivers
Add input suffix
Add new i18n option 'headerFormat' to datepicker

[DanielRuf]

@materializecss/members

[Smankusors]

oh man, thanks for continuing the development of materialize 😄

Ehm I have this 2 years old pull request

Should I rewrite this pull request for this fork? 🤔

[DanielRuf]

oh man, thanks for continuing the development of materialize 😄

Thanks, we all try our best to bring it a bit forward in our vailable free time.

Ehm I have this 2 years old pull request

I was not aware of this, good catch.

Should I rewrite this pull request for this fork? 🤔

Yes, this would be great and very helpful.

[Smankusors]

Yes, this would be great and very helpful.

alright #9 it is 🙌

[DanielRuf]

Dogfalo#5725 was mentioned in the community room.

[ChildishGiant]

It's probably worth taking a look at Dogfalo#4391 (Dogfalo#1892) for the next feature release.

[doughballs]

Where are we up to regarding the select issue? That's a biggie - has it been raised/solved for the fork?

(The issue is the wrong item being selected on iOS, the fix being to served an entire patched JS file after materialize.js)

[Smankusors]

Where are we up to regarding the select issue? That's a biggie - has it been raised/solved for the fork?

(The issue is the wrong item being selected on iOS, the fix being to served an entire patched JS file after materialize.js)

hmm I think this is issue #31. There's already a commit Dogfalo@c0da340, but it's not released officially yet.

[DanielRuf]

Correct, Dogfalo@c0da340 should be already in the current code.

[Pierstoval]

I haven't checked, but are the current CVEs resolved on the fork?

They are related to XSS flaws:

• CVE-2019-11002 (tooltip component)
• CVE-2019-11003 (autocomplete component)
• CVE-2019-11004 (toast component)

[DanielRuf]

are the current CVEs resolved on the fork

Probably not, as fixing these would break many things as I have outlined many times (see the linked GitHub issues in the original repo). Nothing what we will do in a 1.x.x release.

Also the people who reported these findings did not provide valid PoCs that could be used by attackers in valid scenarios.

[Pierstoval]

It's a bit sad that these warnings will continue to spawn on projects that are using Materialize 😕

I just saw the discussion in Dogfalo#6331 and Dogfalo#6286, this explains a lot, but is still a complex subject.

Since this repository is "new", and the package will be new on NPM, maybe the vulnerability won't be registered at all, let's see 🤔