fix(deps): Update dependency focus-trap to v7 #266

0a9b746: Prevent a previous focus trap that is manually paused from being automatically unpaused when the current trap is deactivated. Also prevent a paused trap that is not at the top of the stack from being unpaused.

`v7.6.2`

Compare Source

Patch Changes

d4a4c34: Replace findIndex with native implementation - [Closes #1305](#1305

`v7.6.1`

Compare Source

Patch Changes

fc5910d: Fix fallbackFocus not used when initialFocus is selector to non-existent node (#1218)

`v7.6.0`

Compare Source

Minor Changes

8aeacee: Move Escape key handler to target phase to allow more control in escapeDeactivates (#1247)

`v7.5.4`

Compare Source

Patch Changes

680f6e8: Fix issue with not being able to cycle back to the start from the last element if there is a focusable web component inside the focus-trap ((#1068)[#1068])

`v7.5.3`

Compare Source

Patch Changes

203b322: Fix missing typings for initialFocus option (#1060)

`v7.5.2`

Compare Source

Patch Changes

b73eb02: Remove references to Array.prototype.findLast() not well supported in Safari (#996)

`v7.5.1`

Compare Source

Patch Changes

d9e2546: Fix possible exception in new Tabbable.getTabIndex() when initializing trap

`v7.5.0`

Compare Source

Minor Changes

5e2f913: Adds support for nodes with a positive tabindex in single-container traps only (#375)

`v7.4.3`

Compare Source

Patch Changes

134678b: Ensure focus is kept inside the trap when focused element is removed from the DOM (focus-trap/focus-trap-react#962)

`v7.4.2`

Compare Source

Patch Changes

db62ce3: Clicking on open shadowDOM components within a focus trap's container when clickOutsideDeactivates=true should not deactivate the focus trap. (#959)

`v7.4.1`

Compare Source

Patch Changes

4f720ff: Bump tabbable to v6.1.2 for nwsapi patch

`v7.4.0`

Compare Source

Minor Changes

da97007: Added new onPost/Pause and onPost/Unpause hooks when un/pausing a trap (also called when auto-un/paused as a result of de/activating a second trap while another is currently active). (focus-trap-react#948)

`v7.3.1`

Compare Source

Patch Changes

a00cfa5: Bump tabbable to v6.1.1 for JSDom fixes

`v7.3.0`

Compare Source

Minor Changes

ae7129d: Bump tabbable to v6.1.0 adding support for the new HTML inert attribute in browsers that support it (NOTE: FireFox does not support it at this time). Also fixes a bug. See tabbable CHANGELOG for more info.

Patch Changes

a27ad58: Fix incorrect behavior of returnFocusOnDeactivate option when set to true (or defaulted to true) along with clickOutsideDeactivates=true and the outside click that deactivates is on a focusable node. Focus was remaining on that node instead of returning to the node focused just prior to activation. (#893)

`v7.2.0`

Compare Source

Minor Changes

b0482af: Add new isKeyForward() and isKeyBackward() options (#612)

`v7.1.0`

Compare Source

Minor Changes

88cc9bc: Provide new trapStack option to make it possible to coordinate auto-activation/pausing between multiple focus-trap instances on the same page.

Patch Changes

4f97b38: Bump tabbable to v6.0.1 for a bug fix. See tabbable's changelog for more details.
f13de76: Mention special Safari setting to enable normal DOM-based tab order in README. #783

`v7.0.0`

Compare Source

Major Changes

5b64423: Revised and clarified official browser support (still as broad and deep as reasonably possible).
47f62ac: 🚨 Breaking: Tabbable dependency has been updated to v6.0.0 and contains a breaking change related to detached nodes with its default displayCheck setting. See tabbable's changelog for more information.
5b64423: 🚨 Breaking: Dropped support of IE browsers, all versions.
- IE11 was officially retired on June 15, 2022 (6 weeks ago). There are no longer any versions of IE that are still maintained or even supported by Microsoft.

`v6.9.4`

Compare Source

Patch Changes

f68882e: Fix docs and typings to clarify that initialFocus, fallbackFocus, and setReturnFocus options can be functions that also return selector strings.

`v6.9.3`

Compare Source

Patch Changes

8a8b1f1: Bump tabbable to v5.3.3 to pick up a small bug fix to web component (shadow DOM) support.

`v6.9.2`

Compare Source

Patch Changes

ef0ce48: Handle unexpected param (true) passed as the value for the initialFocus, fallbackFocus, and setReturnFocus options: Ignore and perform default behavior.

`v6.9.1`

Compare Source

Patch Changes

83262a7: Bumps tabbable to v5.3.2 to pick-up a fix to displayCheck=full (default) option behavior that caused issues with detached nodes.

`v6.9.0`

Compare Source

Minor Changes

2a57e4b: Add new trap.active and trap.paused readonly state properties on the trap so that the trap's active/paused state can be queried.

Patch Changes

8fd49df: Fixed bug where clickOutsideDeactivate handler would get called on the 'click' event even if the node clicked was in the trap. As with 'mousedown' and 'touchstart' events where this option is also used, the handler should only get called if the target node is outside the trap.
c32c60a: Fixed: onDeactivate, onPostDeactivate, and checkCanReturnFocus options originally given to createFocusTrap() were not being used by default when calling trap.deactivate({...}) with an option set even if that option set didn't specify any overrides of these options.

`v6.8.1`

Compare Source

Patch Changes

7c86111:
- Bump tabbable to ^5.3.1 (fixing previous update which was incorrectly set to 5.3.0).
- Fix tabbableOptions not being used in all internal uses of tabbable APIs.
- Expose displayCheck option in tabbableOptions typings and pass it through to tabbable APIs.
- Add info to README about testing traps in JSDom (which is not officially supported).

`v6.8.0`

Compare Source

Minor Changes

21458c9: Bumps tabbable to v5.3.0 and includes all changes from the past v6.8.0 beta releases. The big new feature is opt-in Shadow DOM support in tabbable, and a new getShadowRoot tabbable option exposed in a new tabbableOptions focus-trap config option.
- ⚠️ This will likely break your tests if you're using JSDom (e.g. with Jest). See testing in JSDom for more info.

`v6.7.3`

Compare Source

Patch Changes

ab20d3d: Fix issue with focusing negative tabindex node and then tabbing away when this node is not the last node in the trap's container ((#611)[#611])

`v6.7.2`

Compare Source

Patch Changes

c932330: Fixed bug where tabbing forward from an element with negative tabindex that is last in the trap would result in focus remaining on that element (565)

Configuration

📅 Schedule: Branch creation - "before 3am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate using a curated preset maintained by . View repository job log here

socket-security · 2023-05-29T01:38:34Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		`[email protected]` has a Critical CVE. CVE: GHSA-h7cp-r72f-jxh6 pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos (CRITICAL) Affected versions: >= 3.0.10 < 3.1.3 Patched version: 3.1.3 From: package-lock.json → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`[email protected]` has a Critical CVE. CVE: GHSA-v62p-rq8g-8h59 pbkdf2 silently disregards Uint8Array input, returning static keys (CRITICAL) Affected versions: < 3.1.3 Patched version: 3.1.3 From: package-lock.json → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`[email protected]` has a Critical CVE. CVE: GHSA-95m3-7q98-8xr5 sha.js is missing type checks leading to hash rewind and passing on crafted data (CRITICAL) Affected versions: < 2.4.12 Patched version: 2.4.12 From: package-lock.json → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`[email protected]` has a Critical CVE. CVE: GHSA-g4rg-993r-mgx7 Improper Neutralization of Special Elements used in a Command in Shell-quote (CRITICAL) Affected versions: >= 1.6.3 < 1.7.3 Patched version: 1.7.3 From: package-lock.json → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`[email protected]` has Obfuscated code. Confidence: 0.94 Location: Package overview From: package-lock.json → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

vercel · 2025-05-14T10:34:40Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
react-spring-bottom-sheet	Error			Oct 30, 2025 0:42am

socket-security · 2025-05-14T10:35:31Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Quality
	pbkdf2@3.1.2
	sha.js@2.4.11
	shell-quote@1.7.2
	number-is-nan@1.0.1
	side-channel@1.0.4
	util.promisify@1.0.1
	sort-order@1.0.1
	safer-buffer@2.1.2
	object.hasown@1.1.0
	object.fromentries@2.0.5
	path-parse@1.0.7
	object-keys@1.1.1
	object-is@1.1.5
	object.getownpropertydescriptors@2.1.3
	unbox-primitive@1.0.1
	object.entries@1.1.5
	object.values@1.1.5
	regexp.prototype.flags@1.3.1
	string.prototype.matchall@4.0.6
	which-boxed-primitive@1.0.2
	tty-browserify@0.0.0 ⏵ 0.0.1
	string.prototype.trimend@1.0.4
	string.prototype.trimstart@1.0.4
	object.assign@4.1.2
	safe-buffer@5.1.2
	which-typed-array@1.1.7
	object-assign@4.1.1
	use-isomorphic-layout-effect@1.1.1
	os-browserify@0.3.0
	p-try@2.2.0 ⏵ 1.0.0	^-18
	setimmediate@1.0.5
	strip-final-newline@2.0.0
	restore-cursor@3.1.0
	stylis-rule-sheet@0.0.10
See 298 more rows in the dashboard

View full report

renovate · 2025-10-30T00:41:00Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

renovate bot added ⚠️ major 📦 deps 🤖 bot labels May 29, 2023

vercel bot had a problem deploying to Preview May 29, 2023 01:37 Failure

renovate bot changed the title ~~fix(deps): update dependency focus-trap to v7~~ fix(deps): Update dependency focus-trap to v7 Aug 4, 2023

renovate bot force-pushed the renovate/focus-trap-7.x branch from 969aa6c to 8905e0f Compare May 14, 2025 10:34

vercel bot had a problem deploying to Preview May 14, 2025 10:34 Failure

renovate bot force-pushed the renovate/focus-trap-7.x branch from 8905e0f to af6edc8 Compare May 27, 2025 21:45

vercel bot had a problem deploying to Preview May 27, 2025 21:45 Failure

renovate bot force-pushed the renovate/focus-trap-7.x branch from af6edc8 to 5113c06 Compare August 10, 2025 12:33

vercel bot had a problem deploying to Preview August 10, 2025 12:36 Failure

fix(deps): Update dependency focus-trap to v7

7665a5b

renovate bot force-pushed the renovate/focus-trap-7.x branch from 5113c06 to 7665a5b Compare October 30, 2025 00:40

vercel bot had a problem deploying to Preview October 30, 2025 00:42 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): Update dependency focus-trap to v7 #266

fix(deps): Update dependency focus-trap to v7 #266

Uh oh!

renovate bot commented May 29, 2023 •

edited

Loading

Uh oh!

socket-security bot commented May 29, 2023 •

edited

Loading

Uh oh!

vercel bot commented May 14, 2025 •

edited

Loading

Uh oh!

socket-security bot commented May 14, 2025 •

edited

Loading

Uh oh!

renovate bot commented Oct 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

fix(deps): Update dependency focus-trap to v7 #266

Are you sure you want to change the base?

fix(deps): Update dependency focus-trap to v7 #266

Uh oh!

Conversation

renovate bot commented May 29, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Minor Changes

Patch Changes

Major Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

socket-security bot commented May 29, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel bot commented May 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented May 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

renovate bot commented Oct 30, 2025

⚠️ Artifact update problem

File name: package-lock.json

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented May 29, 2023 •

edited

Loading

socket-security bot commented May 29, 2023 •

edited

Loading

vercel bot commented May 14, 2025 •

edited

Loading

socket-security bot commented May 14, 2025 •

edited

Loading