Merge branch 'main' into dependabot/npm_and_yarn/packages/benchmarks/…

…generator/babel/traverse-7.23.2

.changeset/brave-frogs-tan.md

@@ -0,0 +1,6 @@
+---
+'lit-html': patch
+'lit': patch
+---
+
+asyncReplace correctly re-renders when value is unchanged (#4408)

.changeset/bright-ways-rhyme.md

@@ -0,0 +1,5 @@
+---
+'@lit-labs/virtualizer': patch
+---
+
+Now correctly include `/support/method-interception.js` and `/support/resize-observer-errors.js` artifacts to the published package. Previously these were listed in the package exports but not actually included with the npm published package.

.changeset/fresh-gifts-love.md

@@ -0,0 +1,7 @@
+---
+'@lit/lit-starter-js': patch
+'@lit/lit-starter-ts': patch
+'@lit-internal/benchmarks': patch
+---
+
+Minor security fixes.

.changeset/lazy-beans-tap.md

@@ -0,0 +1,6 @@
+---
+'@lit-labs/ssr': patch
+---
+
+Fix server template throwing when encountering an attribute binding on the
+`html` tag. This is now handled correctly.

.changeset/lemon-lamps-shave.md → .changeset/odd-buckets-attend.md

@@ -4,4 +4,4 @@
 'lit': patch
 ---
 
-Allow `null` to be in the type of `@query()` decorated fields
+Remove unused internal parameters to `requestUpdate()`

.changeset/shaggy-phones-behave.md

@@ -0,0 +1,6 @@
+---
+'@lit-labs/gen-wrapper-angular': patch
+'@lit-labs/gen-wrapper-vue': patch
+---
+
+Generate valid wrappers for elements without reactive properties

.eslintignore

@@ -284,6 +284,7 @@ packages/labs/motion/animate.*
 packages/labs/motion/position.*
 packages/labs/motion/animate-controller.*
 packages/labs/nextjs/index.*
+packages/labs/nextjs/lib/
 
 packages/labs/observers/development/
 packages/labs/observers/test/

.eslintrc.json

@@ -35,18 +35,7 @@
     // Enforces that when a module is imported, that module is listed in the
     // package's immediate "dependencies". Note internal-only files are excluded
     // in an "overrides" configuration below.
-    "import/no-extraneous-dependencies": [
-      "error",
-      {
-        // These modules are also allowed to import from their immediate
-        // "devDependencies".
-        "devDependencies": [
-          // This package has a type-only import of "react", but it's not a
-          // dependency.
-          "packages/labs/react/**"
-        ]
-      }
-    ],
+    "import/no-extraneous-dependencies": ["error"],
     "@typescript-eslint/consistent-generic-constructors": "error"
   },
   "overrides": [
@@ -87,6 +76,7 @@
       "files": [
         "**/goldens/**",
         "**/rollup.config.js",
+        "**/rollup.config.*.js",
         "**/src/test-gen/**",
         "**/src/test/**",
         "**/src/tests/**",

.github/workflows/benchmarks-report.yaml

@@ -8,11 +8,17 @@ on:
       - completed
       - requested
 
+permissions:
+  contents: read
+
 jobs:
   # Optional job to update existing comments with a "benchmarks are running" text
   report_running:
     name: Report benchmarks are in-progress
     runs-on: ubuntu-latest
+    permissions:
+      issues: write # needed to write comments on PRs 
+      pull-requests: write # needed to write comments on PRs 
     # Only add the "benchmarks are running" text when the workflow_run starts
     if: ${{ github.event.action == 'requested' }}
     steps:
@@ -26,6 +32,9 @@ jobs:
   report_results:
     name: Report benchmark results
     runs-on: ubuntu-latest
+    permissions:
+      issues: write # needed to write comments on PRs 
+      pull-requests: write # needed to write comments on PRs 
     # Only run this job if the event action was "completed" and the triggering
     # workflow_run was successful
     if: ${{ github.event.action == 'completed' && github.event.workflow_run.conclusion == 'success' }}

.github/workflows/benchmarks.yml

@@ -2,6 +2,9 @@ name: Benchmarks
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   benchmarks:
     name: benchmarks
@@ -21,23 +24,6 @@ jobs:
       - name: NPM install
         run: npm ci
 
-      - name: Generate size report
-        run: npm run benchmark:size
-
-      - name: Comment on size report empty
-        if: ${{ !failure() }}
-        uses: thollander/actions-comment-pull-request@v2
-        with:
-          message: 'The size of lit-html.js and lit-core.min.js are as expected.'
-          comment_tag: check-size # ensures we delete the comment if present
-
-      - name: Comment about failing size report
-        if: ${{ failure() }}
-        uses: thollander/actions-comment-pull-request@v2
-        with:
-          filePath: scripts/check-size-out.md
-          comment_tag: check-size # ensures we create or update one size comment
-
       - name: Build
         run: |
           cd packages/benchmarks

.github/workflows/changeset-status.yaml

@@ -0,0 +1,34 @@
+name: Changeset Status
+
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  # Enforce that all PRs that change packages need changesets. Changes
+  # without changesets result in this job failing.
+  changeset:
+    runs-on: ubuntu-latest
+    # Skip if author is lit-robot which means it's a release PR that doesn't
+    # need this check.
+    if: ${{ github.event.pull_request.user.login != 'lit-robot' }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 20
+          cache: 'npm'
+          cache-dependency-path: package-lock.json
+
+      - name: Checkout and NPM install
+        run: |
+          git checkout main
+          git checkout ${{ github.sha }}
+          npm ci
+
+      - name: Changeset status
+        run: npm run changeset status -- --since=main

.github/workflows/release-image.yaml

@@ -8,6 +8,9 @@ on:
     paths:
       - '**/CHANGELOG.md'
 
+permissions:
+  contents: read
+
 jobs:
   release-image:
     if: github.repository == 'lit/lit'

.github/workflows/release.yaml

@@ -4,12 +4,16 @@ on:
   push:
     branches:
       - main
-      # Temporary for pre-release.
-      - '3.0'
+
+permissions:
+  contents: read
 
 jobs:
   release:
     # Don't run on forks. We can and should only release from the main repo.
+    permissions:
+      contents: write  # for Git to git push
+      pull-requests: write # to allow creating PR
     if: github.repository == 'lit/lit'
 
     name: Release

.github/workflows/sauce.yaml

@@ -8,6 +8,9 @@ on:
     # This is the default list, but I don't know how to YAML an empty pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   tests-sauce:
     # Sauce tests need access to secrets.

.github/workflows/sizecheck-report.yaml

@@ -0,0 +1,51 @@
+name: Report Sizecheck Results
+
+on:
+  workflow_run:
+    workflows: [Sizecheck]
+    branches: ['**']
+    types: [completed]
+
+permissions:
+  contents: read
+
+jobs:
+  report:
+    permissions:
+      actions: read  # for dawidd6/action-download-artifact to query and download artifacts
+      pull-requests: write  # for thollander/actions-comment-pull-request to write comment
+    name: Report sizecheck result
+    runs-on: ubuntu-latest
+    steps:
+      # Download the artifact from the triggering workflow that contains the
+      # size check results and PR number to report to
+      - name: Download artifact
+        uses: dawidd6/action-download-artifact@v2
+        with:
+          workflow: ${{ github.event.workflow.id }}
+          run_id: ${{ github.event.workflow_run.id }}
+          name: sizecheck
+          path: artifacts
+
+      # `workflow_run` triggered workflow don't always have access to PR number
+      # from event so it is pass via an artifact from the triggering workflow
+      - name: Get pull request number from artifact
+        id: pr_num
+        run: echo "PR_NUMBER=$(cat artifacts/pr_number.txt)" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: Comment on size report empty
+        if: ${{ github.event.workflow_run.conclusion == 'success' }}
+        uses: thollander/actions-comment-pull-request@v2
+        with:
+          message: 'The size of lit-html.js and lit-core.min.js are as expected.'
+          comment_tag: check-size # ensures we overwrite old failure comment if present
+          pr_number: ${{ steps.pr_num.outputs.PR_NUMBER }}
+
+      - name: Comment about failing size report
+        if: ${{ github.event.workflow_run.conclusion == 'failure' }}
+        uses: thollander/actions-comment-pull-request@v2
+        with:
+          filePath: artifacts/check-size-out.md
+          comment_tag: check-size # ensures we create or update one size comment
+          pr_number: ${{ steps.pr_num.outputs.PR_NUMBER }}