Skip to content

Conversation

vleague2
Copy link
Contributor

@vleague2 vleague2 commented Oct 3, 2025

🎟️ Tracking

📔 Objective

📸 Screenshots

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

Copy link
Contributor

github-actions bot commented Oct 3, 2025

Logo
Checkmarx One – Scan Summary & Details65e8c9cd-3b59-4346-b12a-676c4b8ceb95

New Issues (17)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
CRITICAL CVE-2025-10585 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: gtRqOtOj1vjQwLw%2FEAB5uadIGfyYBIZVjOWIPoNzkSA%3D
Vulnerable Package
HIGH CVE-2025-10200 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Use After Free in 'ServiceWorker' in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corrupt...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: NCtm9jfxUeaMiZDaLuvA6p25TWII7uI%2BHSf%2FGnCJG%2FY%3D
Vulnerable Package
HIGH CVE-2025-10201 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: zJVBlY1PJW4Qegom%2FhVz37zqVH8Qql5OuAqZkAgch44%3D
Vulnerable Package
HIGH CVE-2025-10500 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Use After Free in Dawn in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Sk3Ti4RofQpemFDaEXFTnVofj0eP2mYnhYoHk8GVtd8%3D
Vulnerable Package
HIGH CVE-2025-10891 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: ISE%2FVR4bVEA8LokmXXWmUL9Lq8AezsEZZDijBBPAb5Y%3D
Vulnerable Package
HIGH CVE-2025-10892 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Integer Overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: iXoSR5Qkjo%2BPFB56Bc9xP7Xuv%2FOfq7yNQ6ZdMuq7KTM%3D
Vulnerable Package
HIGH CVE-2025-8880 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Race in V8 in Google Chrome through 139.0.7258.126 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Attack Vector: NETWORK
Attack Complexity: LOW

ID: y3B8fpeK8mCyIx4zTX%2FZgncdOgOHsYuKBIPc4cRwyzc%3D
Vulnerable Package
HIGH CVE-2025-8882 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: zkq90IgwZgXwyY%2BXi0Xw83mQz4g6eNc526MSHmj%2Bjis%3D
Vulnerable Package
HIGH CVE-2025-8901 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Out-of-bounds Write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out-of-bounds memory access via a crafte...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: JBjMp0esZp1xvrtJHdpRuHZFwjDuOiMbOv%2BM9xVkFac%3D
Vulnerable Package
HIGH CVE-2025-9132 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Out-of-bounds Write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crafted H...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Eagvr7Ul6idRFhqez4sXRQBdx87tjCU3Gp9mBMEV2gM%3D
Vulnerable Package
HIGH CVE-2025-9478 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: fKJtCrKjNWwnHqPNPiCOYrwLtphTMqQhkX%2Fy1Wyk7x4%3D
Vulnerable Package
HIGH CVE-2025-9864 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Use After Free in V8 in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 48gBOqymol65M%2BHuvKRaR6yiJKCTES%2BqQnKkGn%2FWLqM%3D
Vulnerable Package
HIGH CVE-2025-9866 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 45VYdF9fNQ4Gq9rvbiQyx1x%2FTOarZ0ymr9iaTnf8QuQ%3D
Vulnerable Package
MEDIUM CVE-2025-8583 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Inappropriate implementation in Permissions in Google Chrome through 139.0.7258.65 allowed a remote attacker to perform UI spoofing via a crafted H...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: oHXOI%2Ff40cuEK%2F1cUQJFaZ%2BqUQSfZVjffL1Iu7s0os8%3D
Vulnerable Package
MEDIUM CVE-2025-8881 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in sp...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: KwMUKQZD2ywp77mhChn6Yec%2BBA558oU8hLp%2FEoX8gE0%3D
Vulnerable Package
MEDIUM CVE-2025-9865 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Inappropriate implementation in the Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to en...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: vYxZ%2FaN6mCvkwFvmsteVaxjEHKB%2F%2ByWT71tF%2FLcAvU8%3D
Vulnerable Package
MEDIUM CVE-2025-9867 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 8D65RTqknXq2tEU2g5mTnemS%2FwdVzwBqnQ2zMh4wzJc%3D
Vulnerable Package

Copy link

codecov bot commented Oct 3, 2025

Codecov Report

❌ Patch coverage is 26.41509% with 39 lines in your changes missing coverage. Please review.
✅ Project coverage is 38.79%. Comparing base (f7a3ad8) to head (3559835).
⚠️ Report is 40 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
.../components/src/skeleton/skeleton-group.stories.ts 0.00% 14 Missing ⚠️
libs/components/src/skeleton/skeleton.stories.ts 0.00% 12 Missing ⚠️
...s/components/src/skeleton/skeleton-text.stories.ts 0.00% 8 Missing ⚠️
.../src/platform/popup/layout/popup-layout.stories.ts 0.00% 2 Missing ⚠️
...components/src/skeleton/skeleton-text.component.ts 66.66% 2 Missing ⚠️
libs/components/src/skeleton/skeleton.component.ts 75.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #16728      +/-   ##
==========================================
- Coverage   38.81%   38.79%   -0.02%     
==========================================
  Files        3406     3418      +12     
  Lines       96640    96963     +323     
  Branches    14510    14561      +51     
==========================================
+ Hits        37509    37617     +108     
- Misses      57493    57694     +201     
- Partials     1638     1652      +14     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link

sonarqubecloud bot commented Oct 7, 2025

/**
* The shape of the corners of the skeleton element
*/
readonly edgeShape = input<"box" | "circle">("box");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does it make more sense for this to just be 'shape'?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe! I felt like shape="circle" would imply it's always a circle versus just the corners, but I could be overthinking it

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I guess the consumer could pass circle and then give it differing width and heights. Might be confusing. Unless if we added width and height inputs. Then, if `shape='circle' we only take one of those values... 🤔 Do we think consumers will want full control to set styles with tailwind? Or are the width/height inputs a less complex DX?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought about doing width/height inputs but it felt kind of silly when it's super simple with tailwind already, like I'd just be re-implementing classes. The designs have non-circle shapes with rounded corners so that is why I didn't want to imply the object itself being a circle

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, got ya. In that case, I suppose we can't assume everything will be circular.

re width/height inputs: I'm not sure the assumption that it's easy to do with tailwind is necessarily true for everyone. We find it easy because we use tailwind every day but, some folks may not be as familiar. Explicit inputs might feel easier for them. IDK which is 'better' per se though

/**
* Array-transformed version of the `lines` to loop over
*/
protected linesArray = computed(() => Array.from(Array(this.lines()).keys()));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we could simplify this a little bit if we want

[...Array(this.lines()).keys()]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants