{ "$schema": "https://json-schema.org/draft/2020-12/schema", "name": "@undrr/undrr-mangrove", "version": "2.0.0", "description": "Machine-readable release history, tag diffs, and component changelogs for UNDRR Mangrove.", "_note": "100% automated by the build. Generated from CHANGELOG.md and component MDX documentation stories. Do not edit manually.", "_links": "Pull requests, issues, tags and GitHub Releases are on unisdr/undrr-mangrove, where changes are merged; it is not publicly readable, so they are given as plain-text references (prRef, such as unisdr/undrr-mangrove#1234, and tag) with no URL, in the text fields as well. Do not look these numbers up on the public fork, whose numbering is separate. Each release's changelogUrl points at its section of CHANGELOG.md on the public fork, https://github.com/PreventionWeb/undrr-mangrove.", "generatedAt": "2026-09-30T10:20:52.476Z", "urls": { "releases": "https://mangrove.undrr.org/releases.json", "changelog": "https://github.com/PreventionWeb/undrr-mangrove/blob/main/CHANGELOG.md", "repository": "https://github.com/unisdr/undrr-mangrove", "publicRepository": "https://github.com/PreventionWeb/undrr-mangrove", "releaseNotesV2": "https://mangrove.undrr.org/?path=/docs/getting-started-release-notes-v2-0--docs" }, "latest": { "version": "2.0.0", "date": "2026-09-24", "isPrerelease": false, "tag": "v2.0.0", "tagUrl": null, "changelogUrl": "https://github.com/PreventionWeb/undrr-mangrove/blob/main/CHANGELOG.md#200-2026-09-24", "releaseUrl": "https://github.com/PreventionWeb/undrr-mangrove/blob/main/CHANGELOG.md#200-2026-09-24", "summary": "The stable release of Mangrove 2.0, published on the npm `latest` tag. The [v2.0 release notes](https://mangrove.undrr.org/?path=/docs/getting-started-release-notes-v2-0--docs) (source: [`docs/RELEASE-2.0.md`](docs/RELEASE-2.0.md)) describe 2.0 as a whole, with an upgrade checklist, the numbered breaking changes and upgrade guidance from 1.x. 1.x is now in best-effort support, with no schedule for further releases. Earlier sections of this file record each prerelease. Prereleases: 2.0.0-alpha.1 (unisdr/undrr-mangrove#1061), 2.0.0-alpha.2, 2.0.0-alpha.3, 2.0.0-alpha.4, 2.0.0-beta.1, 2.0.0-beta.2 (tagged, not published to npm), 2.0.0-beta.3, 2.0.0-rc.1, 2.0.0-rc.2 and 2.0.0-rc.3.", "changesCount": 4, "changes": [ { "category": "Changes since 2.0.0-rc.3", "title": "HubHeader vanilla runtime:", "description": "New `js/hub-header.js` enhances static hub header markup without React, scrolling the current section into view on load and driving the edge fades; with `data-mg-hub-header-detect-current` it marks the current section from the URL. The React `HubHeader` runs the same script. (unisdr/undrr-mangrove#1292, unisdr/undrr-mangrove#1293)", "pr": 1292, "prRef": "unisdr/undrr-mangrove#1292", "prUrl": null, "raw": "**HubHeader vanilla runtime:** New `js/hub-header.js` enhances static hub header markup without React, scrolling the current section into view on load and driving the edge fades; with `data-mg-hub-header-detect-current` it marks the current section from the URL. The React `HubHeader` runs the same script. (unisdr/undrr-mangrove#1292, unisdr/undrr-mangrove#1293)" }, { "category": "Changes since 2.0.0-rc.3", "title": "PageHeader language links fall back to the dropdown:", "description": "`languageDisplay=\"links\"` renders the icon dropdown below the tablet breakpoint and when there are more languages than the new `maxLanguageLinks` prop (default 6), replacing the two-letter codes that wrapped under the logo. Default and example language lists follow United Nations order, alphabetical by English name. (unisdr/undrr-mangrove#1284)", "pr": 1284, "prRef": "unisdr/undrr-mangrove#1284", "prUrl": null, "raw": "**PageHeader language links fall back to the dropdown:** `languageDisplay=\"links\"` renders the icon dropdown below the tablet breakpoint and when there are more languages than the new `maxLanguageLinks` prop (default 6), replacing the two-letter codes that wrapped under the logo. Default and example language lists follow United Nations order, alphabetical by English name. (unisdr/undrr-mangrove#1284)" }, { "category": "Changes since 2.0.0-rc.3", "title": "Changelog entries use a comma between version and date:", "description": "Component MDX entries are now written `- **X.Y.Z**, YYYY-MM-DD ([#PR](url)): Description` and release headings here `## X.Y.Z, YYYY-MM-DD`; every existing entry was converted, and em dashes in changelog prose were replaced with commas, colons and parentheses. The changelog parser reads both the new and the old dash form. It also fixes a bug: 27 SyndicationSearchWidget entries that already used a comma were published in `releases.json` with no date. GitHub heading anchors for release headings in this file change as a result (for example `#200-rc3--2026-09-20` is now `#200-rc3-2026-09-20`). The [Editorial manual](https://mangrove.undrr.org/?path=/docs/contributing-editorial-manual--docs) now covers dash usage: en dashes where United Nations style uses them, no em dashes and no dashes as separators. (unisdr/undrr-mangrove#1289, unisdr/undrr-mangrove#1290)", "pr": 1289, "prRef": "unisdr/undrr-mangrove#1289", "prUrl": null, "raw": "**Changelog entries use a comma between version and date:** Component MDX entries are now written `- **X.Y.Z**, YYYY-MM-DD ([#PR](url)): Description` and release headings here `## X.Y.Z, YYYY-MM-DD`; every existing entry was converted, and em dashes in changelog prose were replaced with commas, colons and parentheses. The changelog parser reads both the new and the old dash form. It also fixes a bug: 27 SyndicationSearchWidget entries that already used a comma were published in `releases.json` with no date. GitHub heading anchors for release headings in this file change as a result (for example `#200-rc3--2026-09-20` is now `#200-rc3-2026-09-20`). The [Editorial manual](https://mangrove.undrr.org/?path=/docs/contributing-editorial-manual--docs) now covers dash usage: en dashes where United Nations style uses them, no em dashes and no dashes as separators. (unisdr/undrr-mangrove#1289, unisdr/undrr-mangrove#1290)" }, { "category": "Changes since 2.0.0-rc.3", "title": "New editorial style guide, and a topic-scoped AI manifest to go with it:", "description": "`docs/EDITORIAL-MANUAL.md` documents mechanical style rules: capitalization, punctuation, numbers and dates, abbreviations, italics, spelling, UNDRR-specific terminology (Sendai Framework target/priority/indicator naming, GAR and campaign naming, gender language), disability inclusive terminology (person-first language and a recommended-vs-avoid term table), and gender-bias review technique (avoiding gendered-default constructions, \"flip it to test it\"). Each rule is cited to its source: the internal UNDRR Publications SOP, the United Nations Disability-Inclusive Communications Guidelines, the DPI Gender Checklist for Content Creators, the UN Geneva Web Style Guide or the United Nations Editorial Manual, in that priority order where they conflict. Rendered in Storybook under **Contributing/Editorial manual**. The AI manifest pipeline gains a new, genuinely separate output, `llms-editorial-manual.txt`, so an agent generating UI copy can fetch just the writing/style rules instead of the full component manifest; linked from `llms.txt`, `llms.json` (`urls.editorialManual`) and `docs/AI-MCP-INTEGRATION.md`. (unisdr/undrr-mangrove#1286, unisdr/undrr-mangrove#1287, unisdr/undrr-mangrove#1288)", "pr": 1286, "prRef": "unisdr/undrr-mangrove#1286", "prUrl": null, "raw": "**New editorial style guide, and a topic-scoped AI manifest to go with it:** `docs/EDITORIAL-MANUAL.md` documents mechanical style rules: capitalization, punctuation, numbers and dates, abbreviations, italics, spelling, UNDRR-specific terminology (Sendai Framework target/priority/indicator naming, GAR and campaign naming, gender language), disability inclusive terminology (person-first language and a recommended-vs-avoid term table), and gender-bias review technique (avoiding gendered-default constructions, \"flip it to test it\"). Each rule is cited to its source: the internal UNDRR Publications SOP, the United Nations Disability-Inclusive Communications Guidelines, the DPI Gender Checklist for Content Creators, the UN Geneva Web Style Guide or the United Nations Editorial Manual, in that priority order where they conflict. Rendered in Storybook under **Contributing/Editorial manual**. The AI manifest pipeline gains a new, genuinely separate output, `llms-editorial-manual.txt`, so an agent generating UI copy can fetch just the writing/style rules instead of the full component manifest; linked from `llms.txt`, `llms.json` (`urls.editorialManual`) and `docs/AI-MCP-INTEGRATION.md`. (unisdr/undrr-mangrove#1286, unisdr/undrr-mangrove#1287, unisdr/undrr-mangrove#1288)" } ] }, "releases": [ { "version": "2.0.0", "date": "2026-09-24", "isPrerelease": false, "tag": "v2.0.0", "tagUrl": null, "changelogUrl": "https://github.com/PreventionWeb/undrr-mangrove/blob/main/CHANGELOG.md#200-2026-09-24", "summary": "The stable release of Mangrove 2.0, published on the npm `latest` tag. The [v2.0 release notes](https://mangrove.undrr.org/?path=/docs/getting-started-release-notes-v2-0--docs) (source: [`docs/RELEASE-2.0.md`](docs/RELEASE-2.0.md)) describe 2.0 as a whole, with an upgrade checklist, the numbered breaking changes and upgrade guidance from 1.x. 1.x is now in best-effort support, with no schedule for further releases. Earlier sections of this file record each prerelease. Prereleases: 2.0.0-alpha.1 (unisdr/undrr-mangrove#1061), 2.0.0-alpha.2, 2.0.0-alpha.3, 2.0.0-alpha.4, 2.0.0-beta.1, 2.0.0-beta.2 (tagged, not published to npm), 2.0.0-beta.3, 2.0.0-rc.1, 2.0.0-rc.2 and 2.0.0-rc.3.", "changes": [ { "category": "Changes since 2.0.0-rc.3", "title": "HubHeader vanilla runtime:", "description": "New `js/hub-header.js` enhances static hub header markup without React, scrolling the current section into view on load and driving the edge fades; with `data-mg-hub-header-detect-current` it marks the current section from the URL. The React `HubHeader` runs the same script. (unisdr/undrr-mangrove#1292, unisdr/undrr-mangrove#1293)", "pr": 1292, "prRef": "unisdr/undrr-mangrove#1292", "prUrl": null, "raw": "**HubHeader vanilla runtime:** New `js/hub-header.js` enhances static hub header markup without React, scrolling the current section into view on load and driving the edge fades; with `data-mg-hub-header-detect-current` it marks the current section from the URL. The React `HubHeader` runs the same script. (unisdr/undrr-mangrove#1292, unisdr/undrr-mangrove#1293)" }, { "category": "Changes since 2.0.0-rc.3", "title": "PageHeader language links fall back to the dropdown:", "description": "`languageDisplay=\"links\"` renders the icon dropdown below the tablet breakpoint and when there are more languages than the new `maxLanguageLinks` prop (default 6), replacing the two-letter codes that wrapped under the logo. Default and example language lists follow United Nations order, alphabetical by English name. (unisdr/undrr-mangrove#1284)", "pr": 1284, "prRef": "unisdr/undrr-mangrove#1284", "prUrl": null, "raw": "**PageHeader language links fall back to the dropdown:** `languageDisplay=\"links\"` renders the icon dropdown below the tablet breakpoint and when there are more languages than the new `maxLanguageLinks` prop (default 6), replacing the two-letter codes that wrapped under the logo. Default and example language lists follow United Nations order, alphabetical by English name. (unisdr/undrr-mangrove#1284)" }, { "category": "Changes since 2.0.0-rc.3", "title": "Changelog entries use a comma between version and date:", "description": "Component MDX entries are now written `- **X.Y.Z**, YYYY-MM-DD ([#PR](url)): Description` and release headings here `## X.Y.Z, YYYY-MM-DD`; every existing entry was converted, and em dashes in changelog prose were replaced with commas, colons and parentheses. The changelog parser reads both the new and the old dash form. It also fixes a bug: 27 SyndicationSearchWidget entries that already used a comma were published in `releases.json` with no date. GitHub heading anchors for release headings in this file change as a result (for example `#200-rc3--2026-09-20` is now `#200-rc3-2026-09-20`). The [Editorial manual](https://mangrove.undrr.org/?path=/docs/contributing-editorial-manual--docs) now covers dash usage: en dashes where United Nations style uses them, no em dashes and no dashes as separators. (unisdr/undrr-mangrove#1289, unisdr/undrr-mangrove#1290)", "pr": 1289, "prRef": "unisdr/undrr-mangrove#1289", "prUrl": null, "raw": "**Changelog entries use a comma between version and date:** Component MDX entries are now written `- **X.Y.Z**, YYYY-MM-DD ([#PR](url)): Description` and release headings here `## X.Y.Z, YYYY-MM-DD`; every existing entry was converted, and em dashes in changelog prose were replaced with commas, colons and parentheses. The changelog parser reads both the new and the old dash form. It also fixes a bug: 27 SyndicationSearchWidget entries that already used a comma were published in `releases.json` with no date. GitHub heading anchors for release headings in this file change as a result (for example `#200-rc3--2026-09-20` is now `#200-rc3-2026-09-20`). The [Editorial manual](https://mangrove.undrr.org/?path=/docs/contributing-editorial-manual--docs) now covers dash usage: en dashes where United Nations style uses them, no em dashes and no dashes as separators. (unisdr/undrr-mangrove#1289, unisdr/undrr-mangrove#1290)" }, { "category": "Changes since 2.0.0-rc.3", "title": "New editorial style guide, and a topic-scoped AI manifest to go with it:", "description": "`docs/EDITORIAL-MANUAL.md` documents mechanical style rules: capitalization, punctuation, numbers and dates, abbreviations, italics, spelling, UNDRR-specific terminology (Sendai Framework target/priority/indicator naming, GAR and campaign naming, gender language), disability inclusive terminology (person-first language and a recommended-vs-avoid term table), and gender-bias review technique (avoiding gendered-default constructions, \"flip it to test it\"). Each rule is cited to its source: the internal UNDRR Publications SOP, the United Nations Disability-Inclusive Communications Guidelines, the DPI Gender Checklist for Content Creators, the UN Geneva Web Style Guide or the United Nations Editorial Manual, in that priority order where they conflict. Rendered in Storybook under **Contributing/Editorial manual**. The AI manifest pipeline gains a new, genuinely separate output, `llms-editorial-manual.txt`, so an agent generating UI copy can fetch just the writing/style rules instead of the full component manifest; linked from `llms.txt`, `llms.json` (`urls.editorialManual`) and `docs/AI-MCP-INTEGRATION.md`. (unisdr/undrr-mangrove#1286, unisdr/undrr-mangrove#1287, unisdr/undrr-mangrove#1288)", "pr": 1286, "prRef": "unisdr/undrr-mangrove#1286", "prUrl": null, "raw": "**New editorial style guide, and a topic-scoped AI manifest to go with it:** `docs/EDITORIAL-MANUAL.md` documents mechanical style rules: capitalization, punctuation, numbers and dates, abbreviations, italics, spelling, UNDRR-specific terminology (Sendai Framework target/priority/indicator naming, GAR and campaign naming, gender language), disability inclusive terminology (person-first language and a recommended-vs-avoid term table), and gender-bias review technique (avoiding gendered-default constructions, \"flip it to test it\"). Each rule is cited to its source: the internal UNDRR Publications SOP, the United Nations Disability-Inclusive Communications Guidelines, the DPI Gender Checklist for Content Creators, the UN Geneva Web Style Guide or the United Nations Editorial Manual, in that priority order where they conflict. Rendered in Storybook under **Contributing/Editorial manual**. The AI manifest pipeline gains a new, genuinely separate output, `llms-editorial-manual.txt`, so an agent generating UI copy can fetch just the writing/style rules instead of the full component manifest; linked from `llms.txt`, `llms.json` (`urls.editorialManual`) and `docs/AI-MCP-INTEGRATION.md`. (unisdr/undrr-mangrove#1286, unisdr/undrr-mangrove#1287, unisdr/undrr-mangrove#1288)" } ] }, { "version": "2.0.0-rc.3", "date": "2026-09-20", "isPrerelease": true, "tag": "v2.0.0-rc.3", "tagUrl": null, "changelogUrl": "https://github.com/PreventionWeb/undrr-mangrove/blob/main/CHANGELOG.md#200-rc3-2026-09-20", "summary": "The final planned polishing release before stable 2.0, with accessibility, typography, responsive layout and integration fixes. Stable 2.0 is expected shortly, subject to final integration testing.", "changes": [ { "category": "General", "title": "Play-function assertions now run in CI, and a failing one fails the build.", "description": "Ten story files carried `play` functions and nothing executed them: there was no `@storybook/test-runner`, no `@storybook/addon-vitest` and no interactions addon in the tree, so a failing assertion appeared only as a console error in the browser of someone who happened to open that story. The issue as filed attributed this to `chromatic.yml` triggering on `pull_request: types: opened`; that is a second, unrelated gap rather than the cause: Chromatic snapshots pixels, runs with `exitZeroOnChanges: true`, and does not report a play-function failure as a failure, so even a run on every push would not have caught one. That trigger gap is real and is filed as unisdr/undrr-mangrove#1274 rather than fixed here, because widening the trigger on a workflow whose `paths:` filter includes `package.json` and `.storybook/**` would make TurboSnap fall back to a full rebuild of all 457 stories on exactly the pushes that change those files. `@storybook/test-runner` drives a headless Chromium over the built Storybook in the `Build and Deploy` workflow, which already runs on every push to a PR. **All 16 play functions across those ten files run, along with a render smoke test for every story: 458 tests over 84 story files.** jsdom was considered and rejected: these assertions read `getBoundingClientRect()`, `scrollWidth` and `getComputedStyle()`, and `Tag`'s \"Reflow and languages\" story says in its own comment that it exists to catch what jsdom cannot; running them under Jest would have produced a green suite that asserts nothing. Enabling the runner found two existing failures. `NewsletterPromotion`'s confirmation-focus assertion could never pass in a browser: the heading appears in one commit and is focused by a passive effect in the next, so a DOM query resolves on the first of those and the focus check ran a frame early; it now waits. `CookieConsentBanner`'s rendering check failed about two runs in three, and the cause was in the component rather than the story: its effect loads three CDN assets and waits 300ms, which outlives a story change, so the chain from a discarded mount still reached `run()` after cleanup had torn the banner down. That component fix shipped in unisdr/undrr-mangrove#1271 instead of here, and this branch carries none of it. That story's on-canvas status line also reported \"Bar rendered\" off a single height measurement while the assertions it appeared to summarise had already failed on an unstyled bar; it now reports every runtime condition the play function asserts but one, names the ones that failed, and in particular checks visibility rather than only the box: a `visibility: hidden` bar reports a box, which is precisely how the old line could read \"Bar rendered\" for a bar the play function fails on. The runner needs a Storybook already being served, so `scripts/serve-storybook.mjs` serves a built one in about a hundred dependency-free lines rather than adding `http-server`, `wait-on` and `concurrently` for three lines of CI; it answers 400 on a malformed URL instead of exiting, logs every 4xx and 5xx so a CI failure is diagnosable, reports `EADDRINUSE` rather than dying silently behind a `&`, and sends `Cache-Control: no-store`. That header addresses an observed problem: the responses carried no validator of any kind, so Chromium applied heuristic caching, and a rebuild into the same directory left the browser mixing fresh chunks with stale ones and running a story that matched no commit: an assertion failing against markup the source cannot produce. It serves on **6099**, not 6006, so it cannot collide with `yarn storybook`; sharing the port let the runner quietly test the dev server instead of the build under test. Run it locally with `yarn build && yarn serve-storybook & yarn test-storybook`; the test timeout is raised to 60s because the cookie banner check waits on the live CDN, which is the one story in the set whose reliability depends on a third party; `docs/TESTING.md` sets out what that dependency gates. Enabling the runner also made the a11y addon's output visible to contributors for the first time, so its scope is now stated. The addon was registered with no configuration at all, so it ran axe's default rule set (which includes `best-practice` rules that are not WCAG success criteria) over the whole story, third-party embed markup included, and reported one line per story. Its numbers were therefore not a count of accessibility failures in this library, though they read like one. The addon is now scoped to the WCAG tags it is assumed to be checking (`wcag2a`, `wcag2aa`, `wcag21a`, `wcag21aa`, `wcag22aa`), so its warnings are limited to rules tagged for WCAG A and AA. It still does not fail the build: `parameters.a11y.test` is left unset, which defaults to `'todo'`. A triaged inventory of what a full sweep actually finds is unisdr/undrr-mangrove#1273. (unisdr/undrr-mangrove#1244)", "pr": 1274, "prRef": "unisdr/undrr-mangrove#1274", "prUrl": null, "raw": "**Play-function assertions now run in CI, and a failing one fails the build.** Ten story files carried `play` functions and nothing executed them: there was no `@storybook/test-runner`, no `@storybook/addon-vitest` and no interactions addon in the tree, so a failing assertion appeared only as a console error in the browser of someone who happened to open that story. The issue as filed attributed this to `chromatic.yml` triggering on `pull_request: types: opened`; that is a second, unrelated gap rather than the cause: Chromatic snapshots pixels, runs with `exitZeroOnChanges: true`, and does not report a play-function failure as a failure, so even a run on every push would not have caught one. That trigger gap is real and is filed as unisdr/undrr-mangrove#1274 rather than fixed here, because widening the trigger on a workflow whose `paths:` filter includes `package.json` and `.storybook/**` would make TurboSnap fall back to a full rebuild of all 457 stories on exactly the pushes that change those files. `@storybook/test-runner` drives a headless Chromium over the built Storybook in the `Build and Deploy` workflow, which already runs on every push to a PR. **All 16 play functions across those ten files run, along with a render smoke test for every story: 458 tests over 84 story files.** jsdom was considered and rejected: these assertions read `getBoundingClientRect()`, `scrollWidth` and `getComputedStyle()`, and `Tag`'s \"Reflow and languages\" story says in its own comment that it exists to catch what jsdom cannot; running them under Jest would have produced a green suite that asserts nothing. Enabling the runner found two existing failures. `NewsletterPromotion`'s confirmation-focus assertion could never pass in a browser: the heading appears in one commit and is focused by a passive effect in the next, so a DOM query resolves on the first of those and the focus check ran a frame early; it now waits. `CookieConsentBanner`'s rendering check failed about two runs in three, and the cause was in the component rather than the story: its effect loads three CDN assets and waits 300ms, which outlives a story change, so the chain from a discarded mount still reached `run()` after cleanup had torn the banner down. That component fix shipped in unisdr/undrr-mangrove#1271 instead of here, and this branch carries none of it. That story's on-canvas status line also reported \"Bar rendered\" off a single height measurement while the assertions it appeared to summarise had already failed on an unstyled bar; it now reports every runtime condition the play function asserts but one, names the ones that failed, and in particular checks visibility rather than only the box: a `visibility: hidden` bar reports a box, which is precisely how the old line could read \"Bar rendered\" for a bar the play function fails on. The runner needs a Storybook already being served, so `scripts/serve-storybook.mjs` serves a built one in about a hundred dependency-free lines rather than adding `http-server`, `wait-on` and `concurrently` for three lines of CI; it answers 400 on a malformed URL instead of exiting, logs every 4xx and 5xx so a CI failure is diagnosable, reports `EADDRINUSE` rather than dying silently behind a `&`, and sends `Cache-Control: no-store`. That header addresses an observed problem: the responses carried no validator of any kind, so Chromium applied heuristic caching, and a rebuild into the same directory left the browser mixing fresh chunks with stale ones and running a story that matched no commit: an assertion failing against markup the source cannot produce. It serves on **6099**, not 6006, so it cannot collide with `yarn storybook`; sharing the port let the runner quietly test the dev server instead of the build under test. Run it locally with `yarn build && yarn serve-storybook & yarn test-storybook`; the test timeout is raised to 60s because the cookie banner check waits on the live CDN, which is the one story in the set whose reliability depends on a third party; `docs/TESTING.md` sets out what that dependency gates. Enabling the runner also made the a11y addon's output visible to contributors for the first time, so its scope is now stated. The addon was registered with no configuration at all, so it ran axe's default rule set (which includes `best-practice` rules that are not WCAG success criteria) over the whole story, third-party embed markup included, and reported one line per story. Its numbers were therefore not a count of accessibility failures in this library, though they read like one. The addon is now scoped to the WCAG tags it is assumed to be checking (`wcag2a`, `wcag2aa`, `wcag21a`, `wcag21aa`, `wcag22aa`), so its warnings are limited to rules tagged for WCAG A and AA. It still does not fail the build: `parameters.a11y.test` is left unset, which defaults to `'todo'`. A triaged inventory of what a full sweep actually finds is unisdr/undrr-mangrove#1273. (unisdr/undrr-mangrove#1244)" }, { "category": "General", "title": "Package paths named in the documentation are now checked by a test, and nine that did not resolve are fixed.", "description": "The same class of defect was reported four times: unisdr/undrr-mangrove#1252 (the package root), unisdr/undrr-mangrove#1253 (`dist/js/*.min.js`), unisdr/undrr-mangrove#1266 (the SCSS entry point under `stories/`) and unisdr/undrr-mangrove#1267 (extensionless vanilla JS specifiers), because docs are written against the repo tree while consumers install the tarball, and the two have never had the same shape. Rather than fix them one at a time, this pass swept all 166 Markdown and MDX files at once and resolved every specifier in them against a freshly packed `2.0.0-rc.2` (275 files; top level `components/ css/ error-pages/ fonts/ js/ scss/`, nothing else). The two filed issues account for four of the nine: the SCSS entry point is `@undrr/undrr-mangrove/scss/assets/scss/style`, not `…/stories/…` (no tarball has ever held a `stories/` directory, 1.4.1 included, so the 1.4 release notes carry a correction rather than a rewrite), and the vanilla modules need their `.js`, because Node ESM will not add one and the package deliberately ships no `exports` map that could (`import('@undrr/undrr-mangrove/js/preview-access')` throws `ERR_MODULE_NOT_FOUND`; the same line with `.js` resolves and binds `mgPreviewAccess`). The sweep found five more. The **Sass integration guide**, the main page for Sass consumers, taught fourteen imports under `stories/assets/scss/` and `stories/Components/`, every one of which fails against the tarball with the `includePaths` configuration the same page recommends, and claimed the package ships `tokens/`, which it does not; the guide now names the published `scss/…` paths and says plainly that the tarball's shape is not the repository's. The **Grid** page pointed at `assets/css/grid.min.css`, a file the CDN has never served on any version (there is no standalone grid stylesheet, the `assets/` segment was doubled, and nothing under Mangrove is minified), and now names the theme stylesheet the grid rules compile into. The **CDN reference** listed `BarChart`, `MapComponent` and `Fetcher`, removed in 1.8.0 and in no bundle since; its legacy CSS table advertised files 2.0 deleted without saying so; and its JavaScript table, which calls itself \"the complete list\", was missing `js/drawer.js`. Two new tests keep it this way: `scripts/published-paths.cjs` models the tarball from the sources in milliseconds, `published-paths.test.js` holds that model against `assemble-npm-package.mjs` and against a real `dist/` when one exists, and `docs-package-paths.test.js` resolves every package specifier, package-root Sass import, CDN URL and CDN-reference table path in the documentation against it. What it does not cover is written at the top of that file, and the boundary is narrower than \"every path is checked\": the model is built from the working tree, not from a registry tarball or a CDN listing, so resolving against it is a necessary condition and never a sufficient one: a path added on a branch resolves in the test and 404s for consumers until a release ships it, which is the state `js/drawer.js` is in and which `docs/RELEASES.md` now carries a release step for. The sweep reads all 166 tracked `.md` and `.mdx` files; 1287 of their 27661 lines, across 78 files, are exempt as changelog prose or as rows of a release note's before/after tables, where naming a dead path is the point. CDN URLs are resolved only at the version in `package.json`; `latest/` is a moving pointer at the newest stable release, tracks neither this branch nor the `next` tag, and is left to the release procedure rather than guessed at.", "pr": 1252, "prRef": "unisdr/undrr-mangrove#1252", "prUrl": null, "raw": "**Package paths named in the documentation are now checked by a test, and nine that did not resolve are fixed.** The same class of defect was reported four times: unisdr/undrr-mangrove#1252 (the package root), unisdr/undrr-mangrove#1253 (`dist/js/*.min.js`), unisdr/undrr-mangrove#1266 (the SCSS entry point under `stories/`) and unisdr/undrr-mangrove#1267 (extensionless vanilla JS specifiers), because docs are written against the repo tree while consumers install the tarball, and the two have never had the same shape. Rather than fix them one at a time, this pass swept all 166 Markdown and MDX files at once and resolved every specifier in them against a freshly packed `2.0.0-rc.2` (275 files; top level `components/ css/ error-pages/ fonts/ js/ scss/`, nothing else). The two filed issues account for four of the nine: the SCSS entry point is `@undrr/undrr-mangrove/scss/assets/scss/style`, not `…/stories/…` (no tarball has ever held a `stories/` directory, 1.4.1 included, so the 1.4 release notes carry a correction rather than a rewrite), and the vanilla modules need their `.js`, because Node ESM will not add one and the package deliberately ships no `exports` map that could (`import('@undrr/undrr-mangrove/js/preview-access')` throws `ERR_MODULE_NOT_FOUND`; the same line with `.js` resolves and binds `mgPreviewAccess`). The sweep found five more. The **Sass integration guide**, the main page for Sass consumers, taught fourteen imports under `stories/assets/scss/` and `stories/Components/`, every one of which fails against the tarball with the `includePaths` configuration the same page recommends, and claimed the package ships `tokens/`, which it does not; the guide now names the published `scss/…` paths and says plainly that the tarball's shape is not the repository's. The **Grid** page pointed at `assets/css/grid.min.css`, a file the CDN has never served on any version (there is no standalone grid stylesheet, the `assets/` segment was doubled, and nothing under Mangrove is minified), and now names the theme stylesheet the grid rules compile into. The **CDN reference** listed `BarChart`, `MapComponent` and `Fetcher`, removed in 1.8.0 and in no bundle since; its legacy CSS table advertised files 2.0 deleted without saying so; and its JavaScript table, which calls itself \"the complete list\", was missing `js/drawer.js`. Two new tests keep it this way: `scripts/published-paths.cjs` models the tarball from the sources in milliseconds, `published-paths.test.js` holds that model against `assemble-npm-package.mjs` and against a real `dist/` when one exists, and `docs-package-paths.test.js` resolves every package specifier, package-root Sass import, CDN URL and CDN-reference table path in the documentation against it. What it does not cover is written at the top of that file, and the boundary is narrower than \"every path is checked\": the model is built from the working tree, not from a registry tarball or a CDN listing, so resolving against it is a necessary condition and never a sufficient one: a path added on a branch resolves in the test and 404s for consumers until a release ships it, which is the state `js/drawer.js` is in and which `docs/RELEASES.md` now carries a release step for. The sweep reads all 166 tracked `.md` and `.mdx` files; 1287 of their 27661 lines, across 78 files, are exempt as changelog prose or as rows of a release note's before/after tables, where naming a dead path is the point. CDN URLs are resolved only at the version in `package.json`; `latest/` is a moving pointer at the newest stable release, tracks neither this branch nor the `next` tag, and is left to the release procedure rather than guessed at." }, { "category": "General", "title": "The published package stops advertising a root entry point.", "description": "This is a **consumer-visible change to the shape of the npm package**, and nothing that works today breaks. `scripts/assemble-npm-package.mjs` wrote `main: \"dist/index.js\"` into the generated `package.json`, naming a file the tarball has never contained: `files` excludes `dist/`, and `npm pack` of `2.0.0-rc.2` (`next`) and `1.8.2` (`latest`) ships zero files under `dist/` or `src/`. So `import … from '@undrr/undrr-mangrove'` has failed with `ERR_MODULE_NOT_FOUND` on every version ever published, so the `main` field pointed consumers at a file no release contained. 2.0.0 removes it. **If a root import appeared to work in your project, it was resolving something other than the published package.** The working surface is unchanged and is what it always was, the per-directory subpaths: `@undrr/undrr-mangrove/components/IconCard.js`, `…/css/style.css`, `…/scss/…`, `…/js/…`, `…/fonts/…`, `…/error-pages/…`. Making the root work instead was considered and rejected: the only cheap way is a barrel over `components/`, and `components/ShowMore.js` and `components/Tab.js` read `document` at module scope, so the root would throw on import in Node and SSR while looking supported, which is harder to diagnose than a failure at import time. No `exports` map is added either; one with only a `\".\"` entry and no `\"./*\": \"./*\"` alongside would make every working subpath fail with `ERR_PACKAGE_PATH_NOT_EXPORTED`, which is the one change in this area that would genuinely break consumers. Shipping a root stub that throws a friendlier message was rejected too: it resolves, so a bundler would build clean and fail in the browser rather than at build time. `scripts/__tests__/assemble-npm-package.test.js` now fails if `main`, `module` or `exports` reappears, or if any root file reaches the tarball. Documentation caught up in the same pass: 14 MDX pages taught `import { X } from '@undrr/undrr-mangrove'` and now show the subpath with the binding the published bundle actually exports, which is not uniform, so `QuoteHighlight`, `UserFeedback`, `MegaMenu`, `ScrollContainer` and `ShareButtons` are default imports while most others are named. The React integration guide's component table is rebuilt from the built bundles and lists the exact import line per component, and `CookieConsentBanner`, `Snackbar` and `CodeBlock` are now stated to ship in no bundle at all rather than appearing importable. Checking the table against `dist/components/` also turned up the opposite error: `FullWidth.mdx` said its wrapper component \"is not exported from `@undrr/undrr-mangrove`, so it is only available inside this repository\", when it has had a webpack entry since unisdr/undrr-mangrove#847 and the package has been publishing `components/FullWidth.js` the whole time; that page now gives the working import line. `docs/RELEASES.md` and `docs/ARCHITECTURE.md` follow, and `docs/RELEASES.md` no longer tells a releaser not to \"fix\" the dangling `main`. (unisdr/undrr-mangrove#1252)", "pr": 847, "prRef": "unisdr/undrr-mangrove#847", "prUrl": null, "raw": "**The published package stops advertising a root entry point.** This is a **consumer-visible change to the shape of the npm package**, and nothing that works today breaks. `scripts/assemble-npm-package.mjs` wrote `main: \"dist/index.js\"` into the generated `package.json`, naming a file the tarball has never contained: `files` excludes `dist/`, and `npm pack` of `2.0.0-rc.2` (`next`) and `1.8.2` (`latest`) ships zero files under `dist/` or `src/`. So `import … from '@undrr/undrr-mangrove'` has failed with `ERR_MODULE_NOT_FOUND` on every version ever published, so the `main` field pointed consumers at a file no release contained. 2.0.0 removes it. **If a root import appeared to work in your project, it was resolving something other than the published package.** The working surface is unchanged and is what it always was, the per-directory subpaths: `@undrr/undrr-mangrove/components/IconCard.js`, `…/css/style.css`, `…/scss/…`, `…/js/…`, `…/fonts/…`, `…/error-pages/…`. Making the root work instead was considered and rejected: the only cheap way is a barrel over `components/`, and `components/ShowMore.js` and `components/Tab.js` read `document` at module scope, so the root would throw on import in Node and SSR while looking supported, which is harder to diagnose than a failure at import time. No `exports` map is added either; one with only a `\".\"` entry and no `\"./*\": \"./*\"` alongside would make every working subpath fail with `ERR_PACKAGE_PATH_NOT_EXPORTED`, which is the one change in this area that would genuinely break consumers. Shipping a root stub that throws a friendlier message was rejected too: it resolves, so a bundler would build clean and fail in the browser rather than at build time. `scripts/__tests__/assemble-npm-package.test.js` now fails if `main`, `module` or `exports` reappears, or if any root file reaches the tarball. Documentation caught up in the same pass: 14 MDX pages taught `import { X } from '@undrr/undrr-mangrove'` and now show the subpath with the binding the published bundle actually exports, which is not uniform, so `QuoteHighlight`, `UserFeedback`, `MegaMenu`, `ScrollContainer` and `ShareButtons` are default imports while most others are named. The React integration guide's component table is rebuilt from the built bundles and lists the exact import line per component, and `CookieConsentBanner`, `Snackbar` and `CodeBlock` are now stated to ship in no bundle at all rather than appearing importable. Checking the table against `dist/components/` also turned up the opposite error: `FullWidth.mdx` said its wrapper component \"is not exported from `@undrr/undrr-mangrove`, so it is only available inside this repository\", when it has had a webpack entry since unisdr/undrr-mangrove#847 and the package has been publishing `components/FullWidth.js` the whole time; that page now gives the working import line. `docs/RELEASES.md` and `docs/ARCHITECTURE.md` follow, and `docs/RELEASES.md` no longer tells a releaser not to \"fix\" the dangling `main`. (unisdr/undrr-mangrove#1252)" }, { "category": "General", "title": "The syndicated search widget's Drupal snippet hydrates:", "description": "its MDX told consumers to mark the container with `data-undrr-search-widget`, an attribute nothing in the library has ever queried, while the hydration selector is and always was `[data-mg-search-widget]`. Both the sentence and the copy-pasteable markup are corrected, along with the same spelling in the `CustomEndpoint` story's Drupal example, and no occurrence is left in the repo. Documentation only. (unisdr/undrr-mangrove#1255)", "pr": 1255, "prRef": "unisdr/undrr-mangrove#1255", "prUrl": null, "raw": "**The syndicated search widget's Drupal snippet hydrates:** its MDX told consumers to mark the container with `data-undrr-search-widget`, an attribute nothing in the library has ever queried, while the hydration selector is and always was `[data-mg-search-widget]`. Both the sentence and the copy-pasteable markup are corrected, along with the same spelling in the `CustomEndpoint` story's Drupal example, and no occurrence is left in the repo. Documentation only. (unisdr/undrr-mangrove#1255)" }, { "category": "General", "title": "`QuoteHighlight` now sanitises its three HTML props, closing the divergence from `TextCta`:", "description": "`quote`, `attribution` and `attributionTitle` go through DOMPurify's default allow-list before they are rendered, which is the call `TextCta` already makes on its `text` prop and the cards and `Drawer` make on theirs. The difference was not a documented decision (unisdr/undrr-mangrove#1258 looked for a stated reason and found none), and of the three components documented there, this is the one whose content matches what `TextCta` sanitises: three short authored strings, hydration-fed from `data-quote`, `data-attribution` and `data-attribution-title` on a CMS-rendered container, so the values travel through markup rather than staying inside a consumer's wrapper. `Tab` and `MegaMenu` are deliberately not changed: `Tab`'s `data` is a whole panel body and a default pass would strip the `