• This week saw the release of Pure v0.2.0, an update that includes improvements to Forms, Grids, and Menus. In addition, there were accessibility tweaks and the introduction of grunt test. You can find all the details on this release at purecss.io/updates/, the changelog, and the v0.1.0…v0.2.0 diff. Thanks to the 8 contributors for their 90 commits that make up v0.2.0!

• In other Pure news, generator-pure is a Yeoman generator for Yo. So if you are a Yeoman/Yo user, including Pure in your application is now as simple as $ npm install -g generator-pure then $ yo pure.

• At this week’s Open Roundtable (video, notes), discussion topics included the recent YUI releases, Pure 0.2.0, a Datatable update and roadmap review, a Responsive grids demo, and of the usual Up for Grabs and Stale pull requests review.

• 7 new pull requests this week, including some updates to Y.Tree, a cleanup of /build/, a DOMReady bug fix, and more. Thanks contributors!

• Shifter recieved a version bump this week from v0.4.0 to v0.4.1 this week to add support for assets on CSS modules.

• New and updated modules in this week’s Gallery build include: itsadialog, itsadialogbox, itsaerrorreporter, itsamodulesloadedpromise, itsaselectlist, itsaviewmodelpanel, itsawidgetrenderpromise, layout, layout-cols, layout-rows, and scrollintoview.

• Links of the Week (thanks to JavaScript Weekly)

  • The Extensible Web Manifesto
  • s/Future/Promise/g
  • Node Modules to Rule Them All
  • Fun with JavaScript Arrays
  • Uncovering the Native DOM API
  • Refactoring DOM Heavy JS
  • … and more

Two weeks after its initial launch, we’re releasing the next version of Pure! With Pure 0.2.0, we set out to fix some low-level :focus issues across the library, along with improving the developer workflow. Most of the components within Pure also received some love. Start using the latest version from the CDN by dropping this link tag on your page:

<link rel="stylesheet" href="http://yui.yahooapis.com/pure/0.2.0/pure-min.css">

Check out the Updates page on the Pure website for more information on this release. You can also check out the HISTORY.md on GitHub.

We’d also like to thank the community for their help in filing bugs, issuing pull requests, and referring Pure. I’d like to give a shout-out to @dannytatom, @rcbdev, @codepb, and @mseri, whose pull requests were merged and included in this release. We’re super excited to see you guys using Pure in your projects, and are looking forward to building it out with you.

• This week saw the introduction of two patch releases to YUI 3.10. First up was YUI 3.10.2, a scheduled release to mark the conclusion of Sprint 7, which includes a variety of bug fixes and stability enhancements for over a dozen components, including Attribute, Charts, Widget, and more. The second release this week was YUI 3.10.3, an unscheduled patch release to resolve a security vulnerability that was previously addressed, but snuck itself back into the source tree. While all distributions of 3.10.2 are now patched, we encourage everyone to upgrade straight to 3.10.3.

• Moving forward, today the team announced the Sprint 8 development schedule. A few important deadlines to note are the pull request deadlines. The first being on June 30th for any new feature additions and the second being on July 9th for any final contributions to the release. The next release is scheduled to occur on July 16th.

• At this week’s Open Roundtable, discussion topics included the deprecation of SimpleYUI, Bower, Square’s es6-module-transpiler, blue sky discussions about YUI components, and more. It was a fruitful, forward-looking discussion, but unfortunately due to an unexpected problem with Hangouts On Air, it was not recorded. In the future, we’ll have a backup plan in place to at minimum record audio of the Hangout.

• In “Testing JavaScript with Yeti and Sauce Labs WebDriver“, YUI contributor Ryuichi Okumura (@okuryup) demonstrates how simple it is to use Yeti and Sauce Labs to conduct automated cross-browser unit testing. Thanks to Sauce Labs for the crosspost!

• New and updated modules in this week’s Gallery build include: cssmatrix2d, itsadatetimepicker, itsaformelement, itsaviewmodelpanel, and itsawidgetrenderpromise.

• Links of the Week (thanks to JavaScript Weekly)

  • How JavaScript compilers work
  • React – A JavaScript library for building user interfaces
  • Understanding Express.js
  • How To Shoot Yourself In the Foot With Prototypes
  • Quantum JavaScript?
  • TXJS 2013 videos
  • Deep dive into the murky waters of script loading
  • JavaScript Performance Tips & Tricks
  • … and more

We are releasing YUI 3.10.3 today to fix a .swf vulnerability that was inadvertantly reintroduced in YUI 3.10.2. Any project which is self-hosting the YUI 3.10.2 io.swf file should upgrade to YUI 3.10.3 to resolve the vulnerability. Any project which is not self-hosting the YUI 3.10.2 io.swf file is not affected by the vulnerability.

You can find YUI 3.10.3 on CDN, as a download, and on npm.

Details

We released YUI 3.10.1 last month to correct a .swf vulnerability. Unfortunately within the 3.10.2 release cycle, one of the older vulnerable .swf files (io.swf) was inadvertently reintroduced to the source tree and distributed in our latest 3.10.2 release in the npm and downloadable .zip packages.

YUI 3.10.3 replaces the vulnerable .swf with the correct patched file, and no other code changes have been included with this release. Note: This is not a new vulnerability, just a reintroduction of an older .swf file that contained the original vulnerability.

Full details of the original vulnerability are available in the security bulletin.

Resolution

Delete the File

If you are hosting io.swf but not using it in your application, simply delete the file to resolve the vulnerability.

Replace the Vulnerable Files

If you host and use this functionality, replace io.swf with the patched file provided below.

Plan To Remove All Flash-Based Features

In the future, we plan to remove all Flash-based features from the yui3 repo and instead host the source code in a separate yui3-swfs repo. This will allow projects continued access to the functionality via a compile-yourself and host-yourself model, while removing these problematic features from the core project. We are requesting community feedback on this topic on the mailing list.

Since we’ve had a number of larger releases lately, this release represents an effort to do some “spring cleaning” on the codebase. Behind the scenes we’ve also been working hard on our CI system. We’ve been digging deep into flaky browser tests to ensure that we have the highest confidence in future releases across our supported YUI Target Environments.

Given the “cleanup” nature of this release, there are updates and fixes across the board.

Anim Fix

YUI contributor Zeno Rocha (from Liferay) removed an unnecessary code tag in the Anim Utility.

App Framework Fix

In the App Framework, Router now properly dispatches when using hash-based URLS and calling replace() without arguments. Before this would throw an error.

Attribute Fix

In YUI 3.8.1 there was a fix to ensure options were sent to the setter correctly in Attribute, but this didn’t work using AttributeObservable and is now fixed in this version.

Charts Fixes

Two issues were fixed in Charts. In the first, styles didn’t map correctly to a legend when series were styled using a global object. In the second, the legend would not honor the specified series marker style for shape.

Color Changes

This is a relatively larger change that you may want to take note of. Y.Color was moved out of DOM. You may observe some minor differences in the output of Y.Color methods. So if you were depending on a specific type of response, for instance toHex(), you may want to check your own implementations. See pull request 822 for more details.

Dial Fixes

There was a minor bug fix in Dial where it may stick at min if you dragged it below min, then back above min – but only if the min/max position was North of the dial.

Event and Custom Event Fixes

One area that received a lot of attention this time around were the Event and Custom Event modules. The nodelist.on() method had a rare issue with custom module loading. There was a fix for DOM event facade when the Y instance was set to emitFacade:true (see release notes for details). In Custom Event there was an issue fixed regarding the facade carrying stale data for the “no subscriber” case. A Custom Event regression was fixed where once() and onceAfter() subscriptions using the * prefix threw a TypeError. Finally, there was an exception fixed with fire(type,null) with emitFacade:true.

JSON Fix

YUI Reviewer Luke Smith fixed an issue in the JSON utility that would effect YUICompressor and code minification. There are efforts (see issues 4 and 5) underway to guarantee CDN files are tested.

Graphics Fix

There was a rounding issue fixed in the SVG implementation that had surfaced in certain edge cases of the PieChart in the Charts module.

Handlebars Update

Handlebars within YUI was updated to v1.0.11. For more details, see the Handlebar’s release notes.

Node Accessibility Improvements

YUI contributor Gerard Cohen contributed a change where show() and hide() now set and remove a node’s hidden attribute, providing a semantic indication of hidden content and improving accessibility.

Scrollview Update

The Paginator API methods now respect the widget’s disabled ATTR.

Deprecations and Removals

SimpleYUI has been deprecated in this release. This module will be removed from the library in a future version. Profiler has been on the deprecation track as well and has now been removed from the library in this release.

Widget Fixes

In Widget, contentBox would remain in the Y.Node_instances cache when the widget hadn’t been rendered and widget.destroy(true) was used.

Throttle Change

Throttle no longer changes the value of this inside the throttled function.

And More!

There were a total of 226 commits by 21 authors between YUI 3.10.1 and this release. We have spent quite a bit of time making our unit and functional tests more robust. We encourage you to consider not only contributing code fixes and feature improvements, but additional unit tests as well. We run approximately 20,000 tests for every build! And through the course of a single day that that adds up to almost 100K tests across our Target Environments. We believe that strong CI with robust tests is essential to maintaining the high standard of quality we hold for our codebase. If you would like to learn more about this release, please check out the Change History Rollup.

• This week at CSSConf the YUI team released Pure, a set of small, responsive CSS modules that you can use in every web project. You can find more details in the release announcement and on GitHub. Thanks to all those involved in the development of the project and to the community for such positive feedback! If you’d like to get started using Pure, there are a few ways to include it in your project; you can fetch pure-min.css from Yahoo’s CDN (via link tag), install via Bower ($ bower install --save pure), or even build it from source. If you have any ideas, bugs, or feedback, please file an issue.

• This week we’re putting finishing touches and polish on the next release of YUI which is currently slated for release next week. In accordance with SemVer, this release will get a minor version bump and be tagged as v3.10.2, meaning there are no introductions of code that provide new features or may break backwards compatibility. For a running list of everything included, take a look at the v3.10.1…dev-master diff. We’ll include a more detailed breakdown of changes in the release announcement.

• In this week’s Open Roundtable (video) we introduced another one of our summer interns. Welcome Rashad Russell (@rashadrussell)! Core team member Tilo Mitra (@tilomitra) reprised his CSSConf presentation of Pure, and we discussed why there are many new GitHub issues being filed for failing tests (answer: inclusion of new CI environments, not regressions).

• New and updated modules in this week’s Gallery build include: apa, bulkedit, composite-image, composite-image-canvas, delay, io-utils itsamodellistsyncpromise, itsamodelsyncpromise, itsaviewmodel, layout-datatable, multivalue-input, querybuilder, and querybuilder-multiselect-input.

• Watches of the Week, thanks to FluentConf 2013:

  • Brenden Eich’s “JavaScript at 18: Legal to Gamble”
  • Paul Irish’s “JavaScript Authoring Tooling”
  • Ben Galbraith and Dion Almaer’s “Serving the World with the Web”
  • Lea Verou’s “Everything You Always Wanted to Know About Web Standards”
  • … and more on O’Reilly Media’s YouTube channel

Yesterday at CSSConf, we launched Pure – a new CSS library. Phew! Here are the slides from the presentation:

Although it looks pretty minimalist, we’ve been working on Pure for several months. After many iterations, we have released Pure as a set of small, responsive, CSS modules that you can use in every web project.

You can learn more about Pure on its homepage, or through the GitHub repo.

Pure is 100% CSS, but as front-end engineers, we don’t only deal with CSS. Much of our time is spent writing JavaScript as well. One of the advantages of Pure is that it doesn’t force you to use a particular JavaScript library. However, we have thought quite a bit about how Pure and YUI can work together now and in the future. Let’s dig into that.

How It Started

To really understand why we made Pure, let’s talk a bit about how the project was conceived. Looking at YUI, we felt that there was a lot of really useful CSS in our library, but it was tightly coupled with our JavaScript. YUI has historically had CSS modules such as Grids, Fonts, and Reset, but they aren’t exposed well enough to non-YUI users, making them hard to find unless you explore all of YUI’s components. In addition, we had some really useful CSS for styling widgets such as table CSS for DataTable, and menu CSS for node-menunav (and now SmugMug’s Y.Menu). It didn’t make sense to keep this tight coupling between CSS and JavaScript, so we decided to break the CSS components out into their own YUI modules. In fact, we had already set a precedent for this with CSSButton.

Once we started upon this path, we realized that instead of just creating new CSS modules, it would be better to split out the CSS entirely into a new project, independent of YUI. There’s no reason why someone couldn’t use that CSS with jQuery, vanilla JavaScript, Bootstrap, or some other library. That’s how Pure came about.

Fitting In With YUI

Not only is Pure compatible with jQuery or Bootstrap, but you can also use it with YUI. In the near future, YUI will be depending on Pure. To make this easy to understand, let’s take an example such as DataTable:

Currently, DataTable has its CSS stored in its assets/ directory. This includes base DataTable styles, along with styles for DataTable plugins. In the future, the core DataTable styles will be pulled in from Pure (Pure Tables, to be specific). We envision doing this in the following way:

1. Creating a CSSTable module that pulls in Pure Table CSS via Bower.
2. Renaming of prefixes (.pure-table changes to .yui3-table)
3. Letting DataTable depend on CSSTable

You could imagine this working for all current YUI widgets that have a CSS dependency in Pure.

Benefits

There are a few benefits in having YUI depend on Pure in this way. First, it allows Pure to stay independent of YUI. We believe it’s important for Pure to have its own identity, and we are accomplishing this by letting Pure have its own release schedule and not be bound by a dependency on YUI.

In contrast, it gives YUI the flexibility to pull in specific parts of Pure that are useful for the library and then tweak them as necessary. By creating YUI CSS modules we’re able to loosen the coupling between a JavaScript widget, and the CSS required to render it. This also makes a great progressive enhancement story: You could imagine having a regular <table> element styled through Pure, until JavaScript is loaded. From a style perspective, the way the table looks will not change since the same CSS rules are being leveraged by YUI.

Thoughts

We’re really excited to see what happens with Pure over the coming weeks and months. As it matures, we’re looking forward to building it out through a thriving open-source community. Although Pure is independent of YUI, our improvements to it will be fed back into YUI through the steps mentioned above. We think this is the best way forward when it comes to YUI and CSS.

We want to continue this discussion with you on the YUI Contrib mailing list to figure out the best way to integrate Pure into YUI. Let us know what you think!

• Today we reach the Sprint 7 Feature Complete milestone, which is just fancy terminology for the last day that new feature pull requests can be merged into the next release of YUI. The next milestone on the current development cycle is the Commit Freeze Pull Request Deadline next Tuesday PM. So if you have anything for inclusion into the June 4th release of YUI, you only have a few days left!

• Yeti v0.2.23 was released this week to increases stability in IE and fix a few bugs. Check out the release announcement for more details. Also, Yogi saw a version bump this week (diff) to lock in version dependencies. Upgrade with npm install -g yeti yogi.

• YUI core team members Reid (@reid), Eric (@ericf), Caridy (@caridy), and Tilo (@tilomitra) will be attending JSConf.us and CSSConf next week. So say hi if you are in the area!

• In this week’s Open Roundtable (notes, YouTube) we introduced one of our new summer interns, Patrick Jameson (@patjameson). Welcome Pat! We discussed Contributing.md, SWF deprecation, speaker deadlines for upcoming conferences (JSconf.eu and HTML5DevConf), stale pull requests, and tickets that are up for grabs.

• Discussions this week on the contributor mailing list included a proposal to deprecate SWFs, a clarification on Feature Complete, a proposal for migration of the forums to Google Groups, and more.

• Recent additions to the Gallery include:

  • Affix – Inspired by Bootstrap Affix.
  • ScrollSpy – Inspired by Bootstrap ScrollSpy.
  • Task – A utility for simplifying the use of promises by making them behave as synchronous code.

• Updated modules in this week’s Gallery build include: affix, dd-momentum-plugin, debounce, io-utils, scrollspy, and task.

• Links of the Week (thanks to JavaScript Weekly)

  • GIF.js
  • Writing Testable JavaScript
  • Chrome’s requestAutocomplete()
  • Fluent APIs and Method Chaining
  • … and more

Our focus is on stabilizing IE 6+ with Yeti in CI, so this small release addresses a bug that occurs on IE 9 when Yeti is served from port 80 or 443.

Changes

• “Ignoring –server option” no longer appears when glob config is used with -s. Fix GH-35.
• Fix thrown SyntaxError on IE for every test when Yeti is used on port 80 or 443. Fix GH-46.
• Avoid using devDependencies during postinstall. Workaround for npm bugs. Fix GH-42.
• Update onyx dependency.

Get Yeti

You can upgrade now by running npm install -g yeti. Learn more about Yeti at yeti.cx.

• Compare v0.2.22 source code to v0.2.23
• v0.2.23 documentation
• Unit code coverage
• Functional code coverage

• This week saw two new releases for YUI projects. First up was YUI 3.10.1, a patch release to resolve a vulnerability detected in the .swf files used in the IO utility and Uploader components. Please see this security bulletin for more details on the issue and steps to ensure your applications are secure. Also released this week was YUICompressor 2.4.8, which includes improved compression results as well as general fixes.

• At this week’s Open Roundtable (YouTube) we invited our friends at Wells Fargo to join us. After some quick intros, we began a discussion about their products and interest in YUI, then dove a bit deeper into some talking points regarding DataTable, Skinning, and Tooling. If DataTable development is something interesting to you, you’ll find quite a bit of discussion in the video about details of the component and its upcoming roadmap.

• YUI’s Shifter build tool got a version bump to v0.4.0 this week and you can upgrade via npm -g install shifter. This update fixes an issue that was discovered after our migration to Grunt for building releases. The version bump is a minor version (as opposed to a patch version, e.g. v0.3.9) because this does introduce a backwards incompatibility. If you are using a copy directive in any of your component build.json files, the 2nd parameter is now relative to your component’s build path as opposed to the source path, so you’ll need to make the appropriate update when you upgrade your copy of Shifter. An example of this change can be seen in commit 609f7d, which includes updates to /src/io/build.json and /src/uploader/build.json.

• Thanks to the AlloyUI crew for our awesome new t-shirts! If you are unfamiliar with AlloyUI, it’s a self-described “UI framework built on top of YUI3 that provides a simple API for building high scalable applications.” Their website is full of goodies, such as examples, Tutorials, and API docs. Check it out!

• Do you have experience with JavaScript, Java, Internationalization, and love solving complex problems at massive scale? Yahoo’s internationalization team is hiring!

• New and updated Gallery modules include: debounce, dd-momentum-plugin, task, scrollspy, io-utils, and affix.

• Links of the Week (thanks to JavaScript Weekly )

  • Draft Specification for ES.next (Ecma-262 Edition 6)
  • Introducing Augmented JavaScript
  • Introduction to Map and Reduce in Javascript
  • JavaScript Regular Expression Enlightenment
  • … and more