chore(deps): bump dropzone from 6.0.0-beta.2 to 6.3.4

[dependabot]

Bumps dropzone from 6.0.0-beta.2 to 6.3.4.

Release notes

Sourced from dropzone's releases.

dropzone@6.3.4

Patch Changes

• #2377 0b302ee - Stop destroy() removing a different instance. Dropzone.instances.splice(indexOf(this), 1) dropped the last entry whenever indexOf returned -1 — calling destroy() twice was enough — evicting an unrelated live Dropzone from the registry.

• #2377 dc5d7bf - Set enctype="multipart/form-data" on a form again. init() compared tagName against lower-case "form", which never matches, so the attribute was never set. Only affects forms that are also submitted natively; the XHR upload is unchanged.

dropzone@6.3.3

Patch Changes

• #2375 6a03691 - Fix the declared type of clickable and hiddenInputContainer.

  Both options are derived from their default values, so clickable: true was inferred as boolean and hiddenInputContainer: "body" as string. That contradicted what each one documents and what both have always accepted at runtime, and TypeScript rejected the documented forms.

  clickable is now boolean | string | HTMLElement | (string | HTMLElement)[] and hiddenInputContainer is string | HTMLElement. Nothing changes at runtime.

dropzone@6.3.2

Patch Changes

• #2371 536d94a - Fix cancelUpload leaving parallel chunks uploading.

  file.xhr only holds the request that started last, so cancelling a chunked upload running with parallelChunkUploads aborted that one request and left every other in-flight chunk streaming to the server — burning the user's bandwidth and writing orphaned chunks for a file the UI already showed as canceled.

  Every chunk keeps its own request, so cancelUpload now aborts all of the ones still running. Uploads that are not chunked are unaffected.

• #2372 a1a67df - Fix emit skipping a listener when another one removes itself.

  emit walked the live callback array, so a listener that called off for itself — the usual shape of a one-shot listener, and of teardown code — spliced the array out from under the loop and the listener registered right after it never ran. emit now iterates over a snapshot.

  One consequence worth knowing about: a listener registered from inside another listener no longer runs during that same emit, it runs from the next one. That is what Node's EventEmitter does, and it is the only way to keep the removal case correct.

• #2370 0e3625d - Fix the thumbnail queue deadlocking when a file cannot be read.

  createThumbnail only listened for FileReader's load event. A file that had been moved, locked by another process, or was otherwise unreadable since it was dropped fires error instead, so the callback was never invoked and _processThumbnailQueue kept its lock forever: no file added afterwards got a thumbnail, and with resizeWidth/resizeHeight or a transformFile that uses createThumbnail, the upload never started either.

  The read error now reaches the callback the same way an undecodable image already did, so the file gets dictThumbnailError and the queue moves on.

  DropzoneThumbnailCallback says what it has always done, too: its first argument is string | Event, the error event standing in for the data URL when no thumbnail could be produced. That also fixes displayExistingFile, which used to emit that event as a thumbnail when the image URL failed to load, leaving the preview with img.src set to "[object Event]".

dropzone@6.3.1

Patch Changes

• #2362 07d3876 - Drop the sass dependency. The stylesheets are plain CSS now, and dist/dropzone.css and dist/basic.css are unchanged in what they do: the output was compared declaration by declaration, and every difference is a value-level equivalence the minifier applies, such as padding: 20px 20px collapsing to padding: 20px.

  This only affects you if you were importing dropzone/src/dropzone.scss directly rather than the built CSS. Import dropzone/src/dropzone.css instead, or the compiled dropzone/dist/dropzone.css.

dropzone@6.3.0

Minor Changes

• #2361 4724f39 - Ship TypeScript types. The library is now written in TypeScript and the package carries its own declarations, so dropzone is typed from its own source.

... (truncated)

Changelog

Sourced from dropzone's changelog.

6.3.4

Patch Changes

• #2377 0b302ee - Stop destroy() removing a different instance. Dropzone.instances.splice(indexOf(this), 1) dropped the last entry whenever indexOf returned -1 — calling destroy() twice was enough — evicting an unrelated live Dropzone from the registry.

• #2377 dc5d7bf - Set enctype="multipart/form-data" on a form again. init() compared tagName against lower-case "form", which never matches, so the attribute was never set. Only affects forms that are also submitted natively; the XHR upload is unchanged.

6.3.3

Patch Changes

• #2375 6a03691 - Fix the declared type of clickable and hiddenInputContainer.

  Both options are derived from their default values, so clickable: true was inferred as boolean and hiddenInputContainer: "body" as string. That contradicted what each one documents and what both have always accepted at runtime, and TypeScript rejected the documented forms.

  clickable is now boolean | string | HTMLElement | (string | HTMLElement)[] and hiddenInputContainer is string | HTMLElement. Nothing changes at runtime.

6.3.2

Patch Changes

• #2371 536d94a - Fix cancelUpload leaving parallel chunks uploading.

  file.xhr only holds the request that started last, so cancelling a chunked upload running with parallelChunkUploads aborted that one request and left every other in-flight chunk streaming to the server — burning the user's bandwidth and writing orphaned chunks for a file the UI already showed as canceled.

  Every chunk keeps its own request, so cancelUpload now aborts all of the ones still running. Uploads that are not chunked are unaffected.

• #2372 a1a67df - Fix emit skipping a listener when another one removes itself.

  emit walked the live callback array, so a listener that called off for itself — the usual shape of a one-shot listener, and of teardown code — spliced the array out from under the loop and the listener registered right after it never ran. emit now iterates over a snapshot.

  One consequence worth knowing about: a listener registered from inside another listener no longer runs during that same emit, it runs from the next one. That is what Node's EventEmitter does, and it is the only way to keep the removal case correct.

• #2370 0e3625d - Fix the thumbnail queue deadlocking when a file cannot be read.

  createThumbnail only listened for FileReader's load event. A file that had been moved, locked by another process, or was otherwise unreadable since it was dropped fires error instead, so the callback was never invoked and _processThumbnailQueue kept its lock forever: no file added afterwards got a thumbnail, and with resizeWidth/resizeHeight or a transformFile that uses createThumbnail, the upload never started either.

  The read error now reaches the callback the same way an undecodable image already did, so the file gets dictThumbnailError and the queue moves on.

  DropzoneThumbnailCallback says what it has always done, too: its first argument is string | Event, the error event standing in for the data URL when no thumbnail could be produced. That also fixes displayExistingFile, which used to emit that event as a thumbnail when the image URL failed to load, leaving the preview with img.src set to "[object Event]".

6.3.1

Patch Changes

• #2362 07d3876 - Drop the sass dependency. The stylesheets are plain CSS now, and dist/dropzone.css and dist/basic.css are unchanged in what they do: the output was compared declaration by declaration, and every difference is a value-level equivalence the minifier applies, such as padding: 20px 20px collapsing to padding: 20px.

  This only affects you if you were importing dropzone/src/dropzone.scss directly rather than the built CSS. Import dropzone/src/dropzone.css instead, or the compiled dropzone/dist/dropzone.css.

... (truncated)

Commits

• 552cce2 Version packages
• dc5d7bf Compare tagName against FORM, not form
• 0b302ee Don't let a second destroy() evict another instance
• bb1235e Version packages
• c8da432 Check the public types as part of typecheck
• 6a03691 Type clickable and hiddenInputContainer as what they accept
• 092957b Version packages
• c998402 Merge pull request #2372 from enyo/emit-snapshot
• 053b259 Merge pull request #2371 from enyo/cancel-parallel-chunks
• 0e3625d Release the thumbnail queue when a file cannot be read
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for dropzone since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​dropzone@​6.0.0-beta.2 ⏵ 6.3.4	+1		-14	+13

View full report