New Features

• Added LegacyDataMixin to optionally use Polymer v1's behavior in handling of undefined in data bindings.
  • Intended to help larger apps transition from Polymer v1 to v3.
• Implement opt-in strictTemplatePolicy to protect against XSS attacks with templating
  • Enabling strictTemplatePolicy by calling setStrictTemplatePolicy(true) setting causes the following changes in behavior:
    • All "self-stamping" templates including <dom-bind>, <dom-repeat>, and <dom-if> will throw errors and not stamp if not originating from inside the template of a trusted element registered via script.
    • Template retrieval from <dom-module> is disabled (since templates should be defined inline in JS via static get template() using the html tag function).
    • Legacy <dom-module> template lookup can be re-enabled via setAllowTemplateFromDomModule(true) setting; under that setting, the following additional behavior will apply:
      • Re-registration of <dom-module> will throw and cause template lookup for that element name to return null.
      • Elements that do not have templates by design must explicitly indicate a null template to prevent template retrieval from inject <dom-module>s, otherwise they will throw an error

Meaningful Changes

• A LOT of typing improvements for both Typescript and Closure compiler
• Add back ability to set window.Polymer.sanitizeDOMValue before Polymer loads
• Fix data-binding notification events when the bound element has children.
• Make sure static get properties() is only read once.

Raw Notes

• update dependencies (commit)

• Add beforeRegister callback to externs (commit)

• Make toggleAttribute match with native signature (#5372) (commit)

• Fixed typos on lines 133 and 157 (#5409) (commit)

• Fix signature of toggleAttribute to match native version (#5370) (commit)

• Update jsdoc for PropertyEffects.splice (#5367) (commit)

• Expand type of LegacyElementMixin#listen and unlisten to accept EventTargets. (commit)

• Update gen-closure-declarations to 0.5.0 (#5360) (commit)

• Add TypeScript types for observer parameters. (#5359) (commit)

• Add missing return type to attributeChanged (commit)

• Add specific type for behaviors (commit)

• Improve typings for legacy elements (commit)

• Add @export (commit)

• Improve types of flattened-nodes-observer further. (commit)

• Add cast for compilation (commit)

• Only generate types once on Travis (commit)

• Move type generation from prepack to prepare (commit)

• Collapse imports for file into one statement (commit)

• Cleanup modulizer conversion leftovers (#5347) (commit)

• Add comments re: need for mixing in before metaprogramming (commit)

• regen-package-lock (commit)

• Don't run Firefox in headless mode. (commit)

• Fix jsdoc syntax. (commit)

• Updates based on code review. Add computed tests. (commit)

• Use type generator binary instead of gulp script. (commit)

• Remove unnecessary @const. (commit)

• Add return description. (commit)

• Grandfather defaulting sanitizeDOMValue from legacy Polymer object. (commit)

• Minor changes to formatting and jsdoc (commit)

• Update paths in gulpfile (commit)

• Fix mixin jsdoc. (commit)

• Add legacy-data-mixin as 1.x->2.x/3.x migration aide. Fixes #5262. (commit)

• Fix jsdoc to pass lint (commit)

• Add documentation to boot.js (commit)

• The return type of mixinBehaviors is unknown (commit)

• Export EventApi, same as DomApi (commit)

• Remove undocumented logging feature (#5331) (commit)

• Cleanup element-mixin leftovers from modulizer (commit)

• Use case-map lib in a saner way. (commit)

• Fix a grab bag of closure compiler warnings. (commit)

• Protect DomModule.import against renaming (commit)

• Add @nocollapse for jscompiler (commit)

• Ensure boot.js can only be parsed as a module (commit)

• Use simpler class declaration and export form (#5325) (commit)

• Ensure unresolved.js is an es module (#5324) (commit)

• Move version to ElementMixin prototype (commit)

• Use relative path module specifier in gen-tsd autoImport setting. (commit)

• Update TemplateStamp event listen param types from Node to EventTarget. (#5320) (commit)

• Add test for direct assignment to template. (commit)

• Add a template setter to ElementMixin. (commit)

• Export the current Polymer version in polymer-element.js (commit)

• Make Polymer gestures library safe for Closure property renaming (take 2). (#5314) (commit)

• Make event notification handler read the value from currentTarget, (#5313) (commit)

• [ci skip] update changelog (commit)

• Upstream externs changes for DomRepeatEvent (commit)

• Back to single template getter. Add more comments. (commit)

• Revert to legacy template getter, update tests. (commit)

• More updates based on code review. (commit)

• Fix allowTemplateFromDomModule opt-in (commit)

• Fix lint warnings. (commit)

• Updates based on code review. (commit)

• npm upgrade dependencies (commit)

• Fix lint warnings. (commit)

• Catch errors on top window using uncaughtErrorFilter Works around safari quirk when running in iframe (commit)

• Fix latent (benign) error thrown when removing dom-if via innerHTML. (commit)

• Use setting via setStrictTemplatePolicy export. (commit)

• Add tests. (commit)

• Implement opt-in strictTemplatePolicy (flag TBD) - disable dom-bind - disable dom-module template lookup - disable templatizer of templates not stamped in trusted polymer template (commit)

• Ensure properties is only called once (commit)

• Remove dom-module in test (commit)