Version 1.1.0 by JosunLP · Pull Request #1 · bQuery/bQuery

JosunLP · 2026-01-23T18:14:24Z

This pull request introduces a minor update to bQuery.js, adding new features, improving security, and updating documentation and workflows to reflect the expanded modular architecture. The most important changes include new core and reactive APIs, enhanced component lifecycle hooks, significant security improvements, and updates to documentation and build/deploy workflows.

Feature Additions and API Changes

Added new core DOM methods: delegate, wrap, unwrap, replaceWith, scrollTo, serialize, and serializeString for improved DOM manipulation and event handling.
Introduced new reactive primitives: watch, readonly, untrack, type guards isSignal/isComputed, and ReadonlySignal<T> type for more robust reactivity and immutability.
Enhanced component system with new lifecycle hooks (beforeMount, beforeUpdate, onError) and prop validation via the validator property.

Security Improvements

Extended HTML sanitizer to block new XSS vectors (SVG, MathML, template), added DOM clobbering protection, zero-width Unicode stripping in URLs, and fixed prototype pollution in utils.merge().
Updated documentation and examples to highlight these security features and usage patterns.

Documentation and Architecture Updates

Added .github/copilot-instructions.md with a comprehensive project overview, architecture, module structure, conventions, and common pitfalls.
Updated documentation files (README.md, docs/definition.md, docs/guide/agents.md) to reflect new APIs, security practices, and modular import paths (@bquery/bquery/...). [1] [2]

Build, Testing, and Deployment

Updated VitePress config to support dynamic base URLs and added new navigation links for modular docs. [1] [2]
Enhanced GitHub Actions workflow: added jobs for building docs and deploying to GitHub Pages, with artifact upload and environment configuration. [1] [2]

Changelog and Versioning

Updated CHANGELOG.md for version 1.1.0, detailing all new features, changes, and security fixes.

…notifications, and buckets support

- Added optional `validator` function to prop definitions for value validation. - Introduced lifecycle hooks: `beforeMount`, `beforeUpdate`, and `onError` for better component management. - Updated documentation to reflect new prop validation and lifecycle features. feat: extend reactive module with watch and readonly utilities - Implemented `watch` function to observe signal changes with access to old values. - Added `readonly` function to create read-only views of signals. - Enhanced utility functions with type guards for signals and computed values. fix: improve security measures in sanitize function - Added checks to remove dangerous tags even if explicitly allowed. - Implemented protections against DOM clobbering via reserved IDs and names. - Enhanced URL normalization to prevent bypass attempts using Unicode characters. feat: introduce new methods in BQueryElement for DOM manipulation - Added `wrap`, `unwrap`, `replaceWith`, and `scrollTo` methods for easier element manipulation. - Implemented `delegate` method for efficient event handling on child elements. test: add comprehensive tests for new features and security enhancements - Created tests for new methods in BQueryElement. - Added tests for `watch` and `readonly` functionalities in the reactive module. - Implemented tests for security improvements in the sanitize function and prototype pollution prevention in utils.

Copilot

Pull request overview

This pull request introduces version 1.1.0 of bQuery.js, a minor version update that adds new DOM manipulation methods, enhanced reactive primitives, extended component lifecycle hooks, and significant security improvements. The changes also include comprehensive documentation updates and GitHub Actions workflow enhancements for automated documentation deployment.

Changes:

Added 7 new DOM manipulation methods (delegate, wrap, unwrap, replaceWith, scrollTo, serialize, serializeString) to core API
Introduced 5 new reactive primitives (watch, readonly, untrack, isSignal, isComputed) with TypeScript type support
Extended component system with 3 new lifecycle hooks (beforeMount, beforeUpdate, onError) and prop validation
Enhanced HTML sanitizer with protection against SVG/MathML XSS, DOM clobbering, and Unicode bypass attacks
Updated documentation across all modules to reflect new APIs and modular import paths
Added GitHub Pages deployment workflow and VitePress configuration for dynamic base URLs

Reviewed changes

Copilot reviewed 29 out of 32 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
src/reactive/signal.ts	Implemented watch, readonly, untrack primitives; optimized observer stack to O(1) operations; added type guards
src/core/element.ts	Added wrap, unwrap, replaceWith, scrollTo, delegate, serialize, serializeString methods for enhanced DOM manipulation
src/core/collection.ts	Added delegate method for event delegation across element collections
src/component/index.ts	Added beforeMount, beforeUpdate, onError lifecycle hooks and validator property for prop validation
src/security/sanitize.ts	Extended dangerous tags list, added DOM clobbering protection, enhanced URL normalization with Unicode bypass prevention
src/core/utils.ts	Added prototype pollution protection to merge() with isPrototypePollutionKey check
tests/*.test.ts	Added comprehensive test suites for new security features, reactive primitives, and DOM methods
docs/guide/*.md	Updated all documentation to reflect new features, security enhancements, and corrected import paths
package.json	Version bump to 1.1.0 and dependency updates for 2026
.github/workflows/npm-publish.yml	Added docs build and GitHub Pages deployment jobs
CHANGELOG.md	Documented all new features, changes, and security fixes for 1.1.0

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/component/index.ts

src/core/element.ts

src/security/sanitize.ts

src/component/index.ts

src/core/collection.ts

CHANGELOG.md

This workflow automatically marks stale issues and pull requests based on inactivity, helping to manage repository maintenance.

Add stale.yml workflow for managing inactive issues and PRs

Add GitHub Actions workflow to summarize new issues

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Add CodeQL analysis workflow configuration

- Updated `beforeUpdate` to accept props for better control during updates. - Added support for `beforeMount` lifecycle hook. - Implemented prop validation in component definition. - Introduced delegated event handling in BQueryElement with `delegate` and `undelegate` methods. - Expanded security measures by adding more dangerous tags and reserved IDs in sanitizer. - Added tests for lifecycle hooks and prop validation to ensure correct behavior.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…yCollection

… development

Copilot

Pull request overview

Copilot reviewed 33 out of 37 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

README.md:194

This user-card example interpolates props.username directly into an html template that will end up in innerHTML, but html does not escape or sanitize its values. If username ever contains attacker-controlled HTML, following this example will render that payload verbatim in the DOM and allow XSS (e.g., <script> or event-handler attributes). Consider updating the docs to show the safeHtml/sanitizeHtml usage for untrusted props (or otherwise emphasize that html must not be used with raw user input) so component templates are safe-by-default.

import { component, html } from '@bquery/bquery/component';

component('user-card', {
  props: {
    username: { type: String, required: true },
    age: { type: Number, validator: (v) => v >= 0 && v <= 150 },
  },
  // Extended lifecycle hooks
  beforeMount() {
    console.log('About to mount');
  },
  connected() {
    console.log('Mounted');
  },
  beforeUpdate(props) {
    // Return false to prevent update
    return props.username !== '';
  },
  onError(error) {
    console.error('Component error:', error);
  },
  render({ props }) {
    return html`<div>Hello ${props.username}</div>`;
  },

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

docs/.vitepress/config.ts

.github/workflows/stale.yml

.github/workflows/npm-publish.yml

.github/copilot-instructions.md

…ckage.json

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

JosunLP added 3 commits January 23, 2026 18:07

✨ Enhance documentation and add platform module with storage, cache, …

6477c5c

…notifications, and buckets support

✨ Update logo SVG and bump version to 1.1.0 with dependency upgrades

6fd61c1

JosunLP added this to the 1.1.0 milestone Jan 23, 2026

JosunLP self-assigned this Jan 23, 2026

JosunLP added documentation labels Jan 23, 2026

Copilot AI review requested due to automatic review settings January 23, 2026 18:14

Copilot started reviewing on behalf of JosunLP January 23, 2026 18:14 View session

✨ Update README.md to improve header formatting and add logo

cb92696

Copilot AI reviewed Jan 23, 2026

View reviewed changes

JosunLP and others added 13 commits January 23, 2026 19:33

fix: enforce frozen lockfile during bun install in CI workflow

ecec684

Add CodeQL analysis workflow configuration

240a4de

Add stale.yml workflow for managing inactive issues and PRs

0a7f0f2

This workflow automatically marks stale issues and pull requests based on inactivity, helping to manage repository maintenance.

Add GitHub Actions workflow to summarize new issues

56c13a2

Merge pull request #3 from bQuery/JosunLP-patch-2

b448062

Add stale.yml workflow for managing inactive issues and PRs

Merge pull request #4 from bQuery/JosunLP-patch-2-1

21ed552

Add GitHub Actions workflow to summarize new issues

Update .github/workflows/codeql.yml

7491efc

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge pull request #2 from bQuery/JosunLP-patch-1

ffa3730

Add CodeQL analysis workflow configuration

Update src/security/sanitize.ts

af6e524

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Implement delegate and undelegate methods for event handling in BQuer…

112438d

…yCollection

Merge branch 'development' of https://github.com/JosunLP/-bQuery into…

cd475d8

… development

Add CodeFactor badge to README for code quality tracking

e075fbc

JosunLP requested a review from Copilot January 23, 2026 19:29

Copilot started reviewing on behalf of JosunLP January 23, 2026 19:30 View session

Füge bQuery-Logo zur Dokumentation hinzu und aktualisiere die Indexseite

5946139

Copilot AI reviewed Jan 23, 2026

View reviewed changes

docs/.vitepress/config.ts Show resolved Hide resolved

.github/workflows/stale.yml Outdated Show resolved Hide resolved

.github/workflows/npm-publish.yml Show resolved Hide resolved

.github/copilot-instructions.md Outdated Show resolved Hide resolved

JosunLP and others added 2 commits January 23, 2026 20:43

Korrigiere die Großschreibung der Repository-URLs in README.md und pa…

e35b49b

…ckage.json

Update .github/workflows/stale.yml

9755239

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update .github/copilot-instructions.md

5b8e83f

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

JosunLP merged commit b27dbaf into main Jan 23, 2026
8 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Version 1.1.0#1

Version 1.1.0#1
JosunLP merged 21 commits intomainfrom
development

JosunLP commented Jan 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

JosunLP commented Jan 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants