CodeByZach/pace v1.3.0

Version 1.3.0

on GitHub

Security

• Fixes GHSA-5fmc-v4p3-pqpg: on pages that show user-supplied HTML, a data-pace-options attribute in that HTML could pollute Object.prototype or inject HTML through the className option. Thanks to @jackfromeast for the report and proof of concept, @glunn for the proposed fix, and @Maxim-Malevich for flagging the code.

Changes

• data-pace-options is now read only from a <script> tag, as the README has always shown. If you put it on another element, move it to pace's <script> tag or use window.paceOptions.
• pace now works on pages that enforce Trusted Types.
• package.json names the default theme in a style field, so CDNs like jsDelivr find the CSS file.

Documentation

• The README's option examples now work (window.paceOptions or data-pace-options, set before pace.js loads), and it explains tracking POST requests, ignoreURLs, Pace.track and Pace.ignore, and restart rules.
• CDN links use pace-js@1, which stays on 1.x.

Upgrading

Nothing to change unless you put data-pace-options on an element other than pace's <script> tag.