chore: release v7.2.5

package.json

@@ -1,6 +1,6 @@
 {
     "name": "lwc-monorepo",
-    "version": "7.2.4",
+    "version": "7.2.5",
     "private": true,
     "description": "Lightning Web Components",
     "repository": {

packages/@lwc/aria-reflection/package.json

@@ -4,7 +4,7 @@
         "You can safely modify dependencies, devDependencies, keywords, etc., but other props will be overwritten."
     ],
     "name": "@lwc/aria-reflection",
-    "version": "7.2.4",
+    "version": "7.2.5",
     "description": "ARIA element reflection polyfill for strings",
     "keywords": [
         "aom",

packages/@lwc/babel-plugin-component/package.json

@@ -4,7 +4,7 @@
         "You can safely modify dependencies, devDependencies, keywords, etc., but other props will be overwritten."
     ],
     "name": "@lwc/babel-plugin-component",
-    "version": "7.2.4",
+    "version": "7.2.5",
     "description": "Babel plugin to transform a LWC module",
     "keywords": [
         "lwc"
@@ -45,8 +45,8 @@
         "@babel/helper-module-imports": "7.24.7",
         "@babel/traverse": "^7.25.6",
         "@babel/types": "^7.25.0",
-        "@lwc/errors": "7.2.4",
-        "@lwc/shared": "7.2.4",
+        "@lwc/errors": "7.2.5",
+        "@lwc/shared": "7.2.5",
         "line-column": "~1.0.2"
     },
     "devDependencies": {

packages/@lwc/compiler/package.json

@@ -4,7 +4,7 @@
         "You can safely modify dependencies, devDependencies, keywords, etc., but other props will be overwritten."
     ],
     "name": "@lwc/compiler",
-    "version": "7.2.4",
+    "version": "7.2.5",
     "description": "LWC compiler",
     "keywords": [
         "lwc"
@@ -48,11 +48,11 @@
         "@babel/plugin-transform-class-properties": "7.25.4",
         "@babel/plugin-transform-object-rest-spread": "7.24.7",
         "@locker/babel-plugin-transform-unforgeables": "0.22.0",
-        "@lwc/babel-plugin-component": "7.2.4",
-        "@lwc/errors": "7.2.4",
-        "@lwc/shared": "7.2.4",
-        "@lwc/ssr-compiler": "7.2.4",
-        "@lwc/style-compiler": "7.2.4",
-        "@lwc/template-compiler": "7.2.4"
+        "@lwc/babel-plugin-component": "7.2.5",
+        "@lwc/errors": "7.2.5",
+        "@lwc/shared": "7.2.5",
+        "@lwc/ssr-compiler": "7.2.5",
+        "@lwc/style-compiler": "7.2.5",
+        "@lwc/template-compiler": "7.2.5"
     }
 }

packages/@lwc/engine-core/package.json

@@ -4,7 +4,7 @@
         "You can safely modify dependencies, devDependencies, keywords, etc., but other props will be overwritten."
     ],
     "name": "@lwc/engine-core",
-    "version": "7.2.4",
+    "version": "7.2.5",
     "description": "Core LWC engine APIs.",
     "keywords": [
         "lwc"
@@ -42,9 +42,9 @@
         }
     },
     "dependencies": {
-        "@lwc/features": "7.2.4",
-        "@lwc/shared": "7.2.4",
-        "@lwc/signals": "7.2.4"
+        "@lwc/features": "7.2.5",
+        "@lwc/shared": "7.2.5",
+        "@lwc/signals": "7.2.5"
     },
     "devDependencies": {
         "observable-membrane": "2.0.0"

packages/@lwc/engine-core/src/framework/template.ts

@@ -76,6 +76,14 @@ export function setVMBeingRendered(vm: VM | null) {
     vmBeingRendered = vm;
 }
 
+const VALID_SCOPE_TOKEN_REGEX = /^[a-zA-Z0-9\-_.]+$/;
+
+// See W-16614556
+// TODO [#2826]: freeze the template object
+function isValidScopeToken(token: any) {
+    return isString(token) && VALID_SCOPE_TOKEN_REGEX.test(token);
+}
+
 function validateSlots(vm: VM) {
     assertNotProd(); // this method should never leak to prod
 
@@ -272,10 +280,10 @@ function buildParseFragmentFn(
 
             // See W-16614556
             if (
-                (hasStyleToken && !isString(stylesheetToken)) ||
-                (hasLegacyToken && !isString(legacyStylesheetToken))
+                (hasStyleToken && !isValidScopeToken(stylesheetToken)) ||
+                (hasLegacyToken && !isValidScopeToken(legacyStylesheetToken))
             ) {
-                throw new Error('stylesheet token must be a string');
+                throw new Error('stylesheet token must be a valid string');
             }
 
             // If legacy stylesheet tokens are required, then add them to the rendered string

packages/@lwc/engine-dom/package.json

@@ -4,7 +4,7 @@
         "You can safely modify dependencies, devDependencies, keywords, etc., but other props will be overwritten."
     ],
     "name": "@lwc/engine-dom",
-    "version": "7.2.4",
+    "version": "7.2.5",
     "description": "Renders LWC components in a DOM environment.",
     "keywords": [
         "lwc"
@@ -42,8 +42,8 @@
         }
     },
     "devDependencies": {
-        "@lwc/engine-core": "7.2.4",
-        "@lwc/shared": "7.2.4"
+        "@lwc/engine-core": "7.2.5",
+        "@lwc/shared": "7.2.5"
     },
     "lwc": {
         "modules": [

packages/@lwc/engine-server/package.json

@@ -4,7 +4,7 @@
         "You can safely modify dependencies, devDependencies, keywords, etc., but other props will be overwritten."
     ],
     "name": "@lwc/engine-server",
-    "version": "7.2.4",
+    "version": "7.2.5",
     "description": "Renders LWC components in a server environment.",
     "keywords": [
         "lwc"
@@ -42,9 +42,9 @@
         }
     },
     "devDependencies": {
-        "@lwc/engine-core": "7.2.4",
-        "@lwc/rollup-plugin": "7.2.4",
-        "@lwc/shared": "7.2.4",
+        "@lwc/engine-core": "7.2.5",
+        "@lwc/rollup-plugin": "7.2.5",
+        "@lwc/shared": "7.2.5",
         "@rollup/plugin-virtual": "^3.0.2",
         "parse5": "^7.1.2"
     }

packages/@lwc/errors/package.json

@@ -4,7 +4,7 @@
         "You can safely modify dependencies, devDependencies, keywords, etc., but other props will be overwritten."
     ],
     "name": "@lwc/errors",
-    "version": "7.2.4",
+    "version": "7.2.5",
     "description": "LWC Error Utilities",
     "keywords": [
         "lwc"

packages/@lwc/features/package.json

@@ -4,7 +4,7 @@
         "You can safely modify dependencies, devDependencies, keywords, etc., but other props will be overwritten."
     ],
     "name": "@lwc/features",
-    "version": "7.2.4",
+    "version": "7.2.5",
     "description": "LWC Features Flags",
     "keywords": [
         "lwc"
@@ -42,6 +42,6 @@
         }
     },
     "dependencies": {
-        "@lwc/shared": "7.2.4"
+        "@lwc/shared": "7.2.5"
     }
 }

packages/@lwc/integration-karma/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@lwc/integration-karma",
     "private": true,
-    "version": "7.2.4",
+    "version": "7.2.5",
     "scripts": {
         "start": "KARMA_MODE=watch karma start ./scripts/karma-configs/test/local.js",
         "test": "karma start ./scripts/karma-configs/test/local.js --single-run --browsers ChromeHeadless",
@@ -17,11 +17,11 @@
         "karma-sauce-launcher-fix-firefox": "using a fork to work around https://github.com/karma-runner/karma-sauce-launcher/issues/275"
     },
     "devDependencies": {
-        "@lwc/compiler": "7.2.4",
-        "@lwc/engine-dom": "7.2.4",
-        "@lwc/engine-server": "7.2.4",
-        "@lwc/rollup-plugin": "7.2.4",
-        "@lwc/synthetic-shadow": "7.2.4",
+        "@lwc/compiler": "7.2.5",
+        "@lwc/engine-dom": "7.2.5",
+        "@lwc/engine-server": "7.2.5",
+        "@lwc/rollup-plugin": "7.2.5",
+        "@lwc/synthetic-shadow": "7.2.5",
         "@types/jasmine": "^5.1.4",
         "chokidar": "^3.6.0",
         "istanbul-lib-coverage": "^3.2.2",

packages/@lwc/integration-karma/test/rendering/sanitize-stylesheet-token/index.spec.js

@@ -1,6 +1,7 @@
 import { createElement, setFeatureFlagForTest } from 'lwc';
 import { catchUnhandledRejectionsAndErrors } from 'test-utils';
 import Component from 'x/component';
+import Scoping from 'x/scoping';
 
 let caughtError;
 let logger;
@@ -19,58 +20,83 @@ afterEach(() => {
 
 const props = ['stylesheetToken', 'stylesheetTokens', 'legacyStylesheetToken'];
 
+const components = [
+    {
+        tagName: 'x-component',
+        Ctor: Component,
+        name: 'unscoped styles',
+    },
+    {
+        tagName: 'x-scoping',
+        Ctor: Scoping,
+        name: 'scoped styles',
+    },
+];
+
 props.forEach((prop) => {
     describe(prop, () => {
-        beforeEach(() => {
-            setFeatureFlagForTest('ENABLE_LEGACY_SCOPE_TOKENS', prop === 'legacyStylesheetToken');
-        });
+        components.forEach(({ tagName, Ctor, name }) => {
+            describe(name, () => {
+                beforeEach(() => {
+                    setFeatureFlagForTest(
+                        'ENABLE_LEGACY_SCOPE_TOKENS',
+                        prop === 'legacyStylesheetToken'
+                    );
+                });
 
-        afterEach(() => {
-            setFeatureFlagForTest('ENABLE_LEGACY_SCOPE_TOKENS', false);
-            // We keep a cache of parsed static fragments; these need to be reset
-            // since they can vary based on whether we use the legacy scope token or not.
-            window.__lwcResetFragmentCache();
-            // Reset template object for clean state between tests
-            Component.resetTemplate();
-        });
+                afterEach(() => {
+                    setFeatureFlagForTest('ENABLE_LEGACY_SCOPE_TOKENS', false);
+                    // We keep a cache of parsed static fragments; these need to be reset
+                    // since they can vary based on whether we use the legacy scope token or not.
+                    window.__lwcResetFragmentCache();
+                    // Reset template object for clean state between tests
+                    Ctor.resetTemplate();
+                });
 
-        it('W-16614556 should not render arbitrary content via stylesheet token', async () => {
-            const elm = createElement('x-component', { is: Component });
-            elm.propToUse = prop;
-            try {
-                document.body.appendChild(elm);
-            } catch (err) {
-                // In synthetic custom element lifecycle, the error is thrown synchronously on `appendChild`
-                caughtError = err;
-            }
+                it('W-16614556 should not render arbitrary content via stylesheet token', async () => {
+                    const elm = createElement(tagName, { is: Ctor });
+                    elm.propToUse = prop;
+                    try {
+                        document.body.appendChild(elm);
+                    } catch (err) {
+                        // In synthetic custom element lifecycle, the error is thrown synchronously on `appendChild`
+                        caughtError = err;
+                    }
 
-            await Promise.resolve();
+                    await Promise.resolve();
 
-            if (process.env.NATIVE_SHADOW && process.env.DISABLE_STATIC_CONTENT_OPTIMIZATION) {
-                // If we're rendering in native shadow and the static content optimization is disabled,
-                // then there's no problem with non-string stylesheet tokens because they are only rendered
-                // as class attribute values using either `classList` or `setAttribute` (and this only applies
-                // when `*.scoped.css` is being used).
-                expect(elm.shadowRoot.children.length).toBe(1);
-            } else {
-                expect(elm.shadowRoot.children.length).toBe(0); // does not render
+                    if (
+                        process.env.NATIVE_SHADOW &&
+                        process.env.DISABLE_STATIC_CONTENT_OPTIMIZATION
+                    ) {
+                        // If we're rendering in native shadow and the static content optimization is disabled,
+                        // then there's no problem with non-string stylesheet tokens because they are only rendered
+                        // as class attribute values using either `classList` or `setAttribute` (and this only applies
+                        // when `*.scoped.css` is being used).
+                        expect(elm.shadowRoot.children.length).toBe(1);
+                    } else {
+                        expect(elm.shadowRoot.children.length).toBe(0); // does not render
 
-                expect(caughtError).not.toBeUndefined();
-                expect(caughtError.message).toMatch(
-                    /stylesheet token must be a string|Failed to execute 'setAttribute'|Invalid qualified name|String contains an invalid character|The string contains invalid characters/
-                );
+                        expect(caughtError).not.toBeUndefined();
+                        expect(caughtError.message).toMatch(
+                            /stylesheet token must be a valid string|Failed to execute 'setAttribute'|Invalid qualified name|String contains an invalid character|The string contains invalid characters/
+                        );
 
-                if (process.env.NODE_ENV === 'production') {
-                    // no warnings in prod mode
-                    expect(logger).not.toHaveBeenCalled();
-                } else {
-                    // dev mode
-                    expect(logger).toHaveBeenCalledTimes(1);
-                    expect(logger.calls.allArgs()[0]).toMatch(
-                        new RegExp(`Mutating the "${prop}" property on a template is deprecated`)
-                    );
-                }
-            }
+                        if (process.env.NODE_ENV === 'production') {
+                            // no warnings in prod mode
+                            expect(logger).not.toHaveBeenCalled();
+                        } else {
+                            // dev mode
+                            expect(logger).toHaveBeenCalledTimes(1);
+                            expect(logger.calls.allArgs()[0]).toMatch(
+                                new RegExp(
+                                    `Mutating the "${prop}" property on a template is deprecated`
+                                )
+                            );
+                        }
+                    }
+                });
+            });
         });
     });
 });

packages/@lwc/integration-karma/test/rendering/sanitize-stylesheet-token/x/scoping/scoping.html

@@ -0,0 +1,3 @@
+<template>
+    <div></div>
+</template>

packages/@lwc/integration-karma/test/rendering/sanitize-stylesheet-token/x/scoping/scoping.js

@@ -0,0 +1,38 @@
+import { LightningElement, api } from 'lwc';
+import template from './scoping.html';
+
+export default class Component extends LightningElement {
+    @api propToUse;
+
+    count = 0;
+
+    render() {
+        const token = `foo"yolo="haha`;
+
+        const { propToUse } = this;
+        if (propToUse === 'stylesheetTokens') {
+            // this legacy format uses an object
+            template[propToUse] = {
+                hostAttribute: token,
+                shadowAttribute: token,
+            };
+        } else {
+            // stylesheetToken or legacyStylesheetToken
+            // this format uses a string
+            template[propToUse] = token;
+        }
+
+        return template;
+    }
+}
+
+// Reset template object for clean state between tests
+const { stylesheetToken, stylesheetTokens, legacyStylesheetToken } = template;
+
+Component.resetTemplate = () => {
+    Object.assign(template, {
+        stylesheetToken,
+        stylesheetTokens,
+        legacyStylesheetToken,
+    });
+};

packages/@lwc/integration-karma/test/rendering/sanitize-stylesheet-token/x/scoping/scoping.scoped.css

@@ -0,0 +1,3 @@
+div {
+    color: red;
+}