build(deps): bump add-to-calendar-button from 2.15.0 to 3.0.2

[dependabot]

Bumps add-to-calendar-button from 2.15.0 to 3.0.2.

Release notes

Sourced from add-to-calendar-button's releases.

v3.0.2

Fixing jsDelivr lazy load

v3.0.1

• Fixing new security findings
• Consolidating sanitizer functions

v3.0.0

Add to Calendar Button v3.0.0

The same button. A fraction of the weight. Ready for everything.

v3 is a full rewrite of the internals with one hard rule: a working v2 integration keeps working. Same tag, same attributes, same atcb_action. If you never read past this line, you can update anyway.

"lighter, faster, everywhere" full rewrite of the internals - same button, same attributes

• smaller: styles beyond the default and languages beyond English are now separate tiny assets, loaded on demand by browser-script/CDN integrations and explicitly imported by npm users. Smaller bundle size despite having added ons of new features.
• new: server-side rendering via the add-to-calendar-button/ssr entry - style- and size-correct shells through declarative shadow DOM, hydrated without layout shift
• new: DOM-free add-to-calendar-button/utils entry exporting atcb_generate_timestring and atcb_decorate_data_dates for Cloudflare Workers, Node, and other runtimes without browser globals
• new: per-style and per-locale npm modules (add-to-calendar-button/styles/3d, add-to-calendar-button/i18n/de) for fetch-free bundling
• new: style-source and load-all-styles options for asset loading control and runtime style switching
• new: event list rendering option for PRO users
• new: full-locale support - language="en_GB" picks regional translations where available and formats dates in the regional convention
• new: 19 languages added: Albanian, Armenian, Azerbaijani, Belarusian, Bosnian, Bulgarian, Croatian, Danish, Georgian, Greek, Lithuanian, Latvian, Macedonian, Maltese, Russian, Serbian, Slovak, Slovenian, and Ukrainian; RSVP strings now part of the core language packs
• new: extended ics options for the Apple/iCal cases (icsReminder, icsUrl, icsCategories, icsClass, icsPriority, icsGeo incl. Apple map preview, icsAttach, icsExdate) - second-level options that only shape the generated ics file; all other calendar types simply ignore them
• modernized internals: Lit-based web component, strict TypeScript, per-instance state, generated flat type declarations that work with every moduleResolution
• accessibility: WAI-ARIA menu pattern for the dropdown, real dialog semantics with a focus trap for modals, working focus delegation, complete date-button labels for screen readers
• security: escape translated HTML attributes, block raw HTML attributes in custom labels while preserving pseudo-HTML and plain breaks, and avoid quadratic modal label parsing
• security: url scheme allowlisting, escaped description links, prototype-pollution-safe input parsing, valid schema.org JSON for any content
• recurring events with old start dates now resolve instantly and correctly (the old day-by-day iteration silently capped out about 27 years in)
• honest clipboard fallback: when automatic copying fails, a manual-copy field appears instead of a false success message
• ⚠️ Breaking: the ics timestamp options were renamed to their ics-only scope: created is now ics-created (icsCreated) and updated is now ics-updated (icsUpdated) - the old names are no longer read
• ⚠️ Breaking: npm package users must explicitly import every non-default style and non-English locale they use (for example, add-to-calendar-button/styles/3d and add-to-calendar-button/i18n/de); browser-script/CDN integrations continue to load them on demand
• ⚠️ Breaking: dedicated no-pro / unstyle / no-pro-unstyle builds are gone - the old entry points and CDN file names keep working as tiny shims that load the main package
• ⚠️ Breaking: for customLabels users overriding exactly these keys: date.status.cancelled.cta is now date.status.cancelled_cta, label.share.email.subject is now label.share.email_subject, and label.rsvp / form.status / form.success moved to label.rsvp.title / form.status.title / form.success.title
• ⚠️ Breaking: script-capable url schemes (like javascript:) are rejected wherever urls are consumed
• ⚠️ Breaking: browser floor is now Baseline 2023 for the full experience (bundles target ES2017; declarative shadow DOM is a progressive enhancement)
• all HTML attributes now have kebab-case official names, including the ics-* options (ics-reminder, ics-url, ...) and the former underscore options (recurrence-interval, recurrence-by-day, ...); migrating to the official spelling is strongly recommended because the camelCase/underscore aliases may be removed in a future major version; camelCase remains preferred for JavaScript configuration objects such as atcb_action input
• official lowercase config values: calendar types (apple, google, ical, ms365, msteams, outlookcom, yahoo) and status (tentative, confirmed, cancelled) - all v2 spellings keep working as aliases (typed via ATCBOptionNameLegacy / ATCBEventStatusLegacy)
• Yahoo got dropped for subscription cases as they no longer support it.
• fix: navigating from the options list (as modal) to a follow-up modal (e.g. the multi-date picker) no longer blinks the background - the shared overlay is kept alive and the new modal fades in while the previous view is dropped in place
• fix: the modal box and the modal option list are correctly sized again (max width on larger screens, no drop-shadow on fullscreen mobile) - regressions from the v3 style split
• fix: server-rendered PRO group overviews now show a simple list skeleton instead of a misleading calendar button and keep it painted until the event range is ready
• fix: non-breaking spaces in descriptions no longer disappear from plain-text calendar output
• see the migration guide for details - existing v2 integrations keep working

v3.0.0-next.11

formatting fix

... (truncated)

Changelog

Sourced from add-to-calendar-button's changelog.

⚡ Changelog (without patches)

Version 3

• v3.0 : "lighter, faster, everywhere" full rewrite of the internals - same button, same attributes
  • smaller: styles beyond the default and languages beyond English are now separate tiny assets, loaded on demand by browser-script/CDN integrations and explicitly imported by npm users. Smaller bundle size despite having added ons of new features.
  • new: server-side rendering via the add-to-calendar-button/ssr entry - style- and size-correct shells through declarative shadow DOM, hydrated without layout shift
  • new: DOM-free add-to-calendar-button/utils entry exporting atcb_generate_timestring and atcb_decorate_data_dates for Cloudflare Workers, Node, and other runtimes without browser globals
  • new: per-style and per-locale npm modules (add-to-calendar-button/styles/3d, add-to-calendar-button/i18n/de) for fetch-free bundling
  • new: style-source and load-all-styles options for asset loading control and runtime style switching
  • new: event list rendering option for PRO users
  • new: full-locale support - language="en_GB" picks regional translations where available and formats dates in the regional convention
  • new: 19 languages added: Albanian, Armenian, Azerbaijani, Belarusian, Bosnian, Bulgarian, Croatian, Danish, Georgian, Greek, Lithuanian, Latvian, Macedonian, Maltese, Russian, Serbian, Slovak, Slovenian, and Ukrainian; RSVP strings now part of the core language packs
  • new: extended ics options for the Apple/iCal cases (icsReminder, icsUrl, icsCategories, icsClass, icsPriority, icsGeo incl. Apple map preview, icsAttach, icsExdate) - second-level options that only shape the generated ics file; all other calendar types simply ignore them
  • modernized internals: Lit-based web component, strict TypeScript, per-instance state, generated flat type declarations that work with every moduleResolution
  • accessibility: WAI-ARIA menu pattern for the dropdown, real dialog semantics with a focus trap for modals, working focus delegation, complete date-button labels for screen readers
  • security: escape PRO thank-you and RSVP form values, restrict thank-you links to safe HTTP(S) URLs, and render raw HTML in PRO copy safely while retaining pseudo-HTML formatting
  • security: escape translated HTML attributes, block raw HTML attributes in custom labels while preserving pseudo-HTML and plain breaks, and avoid quadratic modal label parsing
  • security: url scheme allowlisting, escaped description links, prototype-pollution-safe input parsing, valid schema.org JSON for any content
  • recurring events with old start dates now resolve instantly and correctly (the old day-by-day iteration silently capped out about 27 years in)
  • honest clipboard fallback: when automatic copying fails, a manual-copy field appears instead of a false success message
  • ⚠️ Breaking: the ics timestamp options were renamed to their ics-only scope: created is now ics-created (icsCreated) and updated is now ics-updated (icsUpdated) - the old names are no longer read
  • ⚠️ Breaking: npm package users must explicitly import every non-default style and non-English locale they use (for example, add-to-calendar-button/styles/3d and add-to-calendar-button/i18n/de); browser-script/CDN integrations continue to load them on demand
  • ⚠️ Breaking: dedicated no-pro / unstyle / no-pro-unstyle builds are gone - the old entry points and CDN file names keep working as tiny shims that load the main package
  • ⚠️ Breaking: for customLabels users overriding exactly these keys: date.status.cancelled.cta is now date.status.cancelled_cta, label.share.email.subject is now label.share.email_subject, and label.rsvp / form.status / form.success moved to label.rsvp.title / form.status.title / form.success.title
  • ⚠️ Breaking: script-capable url schemes (like javascript:) are rejected wherever urls are consumed
  • ⚠️ Breaking: browser floor is now Baseline 2023 for the full experience (bundles target ES2017; declarative shadow DOM is a progressive enhancement)
  • all HTML attributes now have kebab-case official names, including the ics-* options (ics-reminder, ics-url, ...) and the former underscore options (recurrence-interval, recurrence-by-day, ...); migrating to the official spelling is strongly recommended because the camelCase/underscore aliases may be removed in a future major version; camelCase remains preferred for JavaScript configuration objects such as atcb_action input
  • official lowercase config values: calendar types (apple, google, ical, ms365, msteams, outlookcom, yahoo) and status (tentative, confirmed, cancelled) - all v2 spellings keep working as aliases (typed via ATCBOptionNameLegacy / ATCBEventStatusLegacy)
  • Yahoo got dropped for subscription cases as they no longer support it.
  • fix: navigating from the options list (as modal) to a follow-up modal (e.g. the multi-date picker) no longer blinks the background - the shared overlay is kept alive and the new modal fades in while the previous view is dropped in place
  • fix: the modal box and the modal option list are correctly sized again (max width on larger screens, no drop-shadow on fullscreen mobile) - regressions from the v3 style split
  • fix: server-rendered PRO group overviews now show a simple list skeleton instead of a misleading calendar button and keep it painted until the event range is ready
  • fix: non-breaking spaces in descriptions no longer disappear from plain-text calendar output
  • see the migration guide for details - existing v2 integrations keep working

Version 2

• v2.15 : Better responsive versions on very small screens for modals and date buttons
• v2.14 : Dropping atcb_decorate_data_recurrence export; various bug fixes
• v2.13 : Hebrew language
• v2.12 : ⚠️ Breaking: Date buttons now show the next possible date in multi-date and recurrence cases. Recurrence UNTIL support. Mitigating edge cases where ics files with unsupported time zones loaded into Google calendar. Always block background scroll on modals open
• v2.11 : ⚠️ Breaking: When setting the dates objects and respective attributes on the root level, root values always override the dates object (except for name in the multi-date case)
• v2.10 : Hungarian language, no more X cursor, no different button icons for oneOption cases, create 1 ics file if organizer is the same, subtle style updates, allow to override automatic option-cleanup on mobile via mobile Options
• v2.9 : New style "simple", better ical generation
• v2.8 : Ukranian language
• v2.7 : Showing open seats on RSVP, better subscription handling
• v2.6 : useUserTZ, css ::part, formatting of urls in description
• v2.5 : PRO option and more
  • ✨ introducing PRO offering

... (truncated)

Commits

• 31ff333 Merge pull request #832 from add2cal/dev
• f597f33 Fixing jsdelivr lazy routing
• 0c5c8d6 adding version to meta on build
• df67ffc Merge pull request #831 from add2cal/dev
• 1cf5e95 next demo example ts fix
• a5fcbbb Merge pull request #830 from add2cal/dev
• a003a3f sharpening things
• 67637d0 cleaning up sanitizers and securing new findings
• fab3770 Merge pull request #828 from add2cal/dev
• e87ea10 Fixing GH security findings
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for add-to-calendar-button since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)