shopify-github-actions-access · Oct 29, 2026
diff --git a/.changeset/adopt-attached-attributes.md b/.changeset/adopt-attached-attributes.md
diff --git a/.changeset/calm-dragons-listen.md b/.changeset/calm-dragons-listen.md
diff --git a/.changeset/deprecate-dom-receiver.md b/.changeset/deprecate-dom-receiver.md
diff --git a/.changeset/improve-class-list-and-dataset.md b/.changeset/improve-class-list-and-dataset.md
diff --git a/.changeset/named-node-map-properties.md b/.changeset/named-node-map-properties.md
diff --git a/.changeset/optimize-selector-matching.md b/.changeset/optimize-selector-matching.md
diff --git a/.changeset/reuse-tag-name-selector-traversal.md b/.changeset/reuse-tag-name-selector-traversal.md
diff --git a/.changeset/validate-untrusted-remote-values.md b/.changeset/validate-untrusted-remote-values.md
diff --git a/examples/custom-element/CHANGELOG.md b/examples/custom-element/CHANGELOG.md
@@ -1,5 +1,12 @@
 # example-custom-element
 
+## 0.0.28
+
+### Patch Changes
+
+- Updated dependencies [[`064847c`](https://github.com/Shopify/remote-dom/commit/064847cd32e4f1ff712661e4acd2cbb92904c2b5), [`0354436`](https://github.com/Shopify/remote-dom/commit/035443609f46fb69989f64019531c8be72496669)]:
+  - @remote-dom/core@1.12.1
+
 ## 0.0.27
 
 ### Patch Changes

diff --git a/examples/custom-element/package.json b/examples/custom-element/package.json
@@ -1,6 +1,6 @@
 {
   "name": "example-custom-element",
-  "version": "0.0.27",
+  "version": "0.0.28",
   "type": "module",
   "private": true,
   "scripts": {

diff --git a/examples/getting-started/CHANGELOG.md b/examples/getting-started/CHANGELOG.md
@@ -1,5 +1,12 @@
 # example-getting-started
 
+## 0.0.28
+
+### Patch Changes
+
+- Updated dependencies [[`064847c`](https://github.com/Shopify/remote-dom/commit/064847cd32e4f1ff712661e4acd2cbb92904c2b5), [`0354436`](https://github.com/Shopify/remote-dom/commit/035443609f46fb69989f64019531c8be72496669)]:
+  - @remote-dom/core@1.12.1
+
 ## 0.0.27
 
 ### Patch Changes

diff --git a/examples/getting-started/package.json b/examples/getting-started/package.json
@@ -1,6 +1,6 @@
 {
   "name": "example-getting-started",
-  "version": "0.0.27",
+  "version": "0.0.28",
   "type": "module",
   "private": true,
   "scripts": {

diff --git a/examples/kitchen-sink/CHANGELOG.md b/examples/kitchen-sink/CHANGELOG.md
@@ -1,5 +1,15 @@
 # example-kitchen-sink
 
+## 0.0.35
+
+### Patch Changes
+
+- Updated dependencies [[`064847c`](https://github.com/Shopify/remote-dom/commit/064847cd32e4f1ff712661e4acd2cbb92904c2b5), [`0354436`](https://github.com/Shopify/remote-dom/commit/035443609f46fb69989f64019531c8be72496669)]:
+  - @remote-dom/core@1.12.1
+  - @remote-dom/signals@2.1.2
+  - @remote-dom/preact@1.3.1
+  - @remote-dom/react@1.2.3
+
 ## 0.0.34
 
 ### Patch Changes

diff --git a/examples/kitchen-sink/package.json b/examples/kitchen-sink/package.json
@@ -2,7 +2,7 @@
   "name": "example-kitchen-sink",
   "type": "module",
   "private": true,
-  "version": "0.0.34",
+  "version": "0.0.35",
   "scripts": {
     "start": "vite"
   },

diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @remote-dom/core
 
+## 1.12.1
+
+### Patch Changes
+
+- [#726](https://github.com/Shopify/remote-dom/pull/726) [`064847c`](https://github.com/Shopify/remote-dom/commit/064847cd32e4f1ff712661e4acd2cbb92904c2b5) Thanks [@MitchLillie](https://github.com/MitchLillie)! - Deprecate `DOMRemoteReceiver` and `RemoteReceiverElement`. Use `RemoteReceiver` or a framework-specific receiver instead.
+
+- [#738](https://github.com/Shopify/remote-dom/pull/738) [`0354436`](https://github.com/Shopify/remote-dom/commit/035443609f46fb69989f64019531c8be72496669) Thanks [@greatscotty](https://github.com/greatscotty)! - Validate values received from the remote environment before storing or rendering them.
+
+  `RemoteReceiver` and `SignalRemoteReceiver` now normalize text node content and attribute values to strings (nullish attribute updates remove the attribute), reject property values containing objects that would be mistaken by a UI framework for one of its own virtual nodes (including inherited values and non-enumerable `Error.cause` values), require event listeners to be functions, and reject `__proto__` as a property name. The `@remote-dom/preact` and `@remote-dom/react` host renderers additionally ignore non-string attributes and never pass remote-controlled `children`, `ref`, `key`, `dangerouslySetInnerHTML`, `innerHTML`, or `outerHTML` props to host components. `RemoteElement.updateRemoteAttribute()` now sends the same string it stores locally.
+
+  The new validation helpers are exported from `@remote-dom/core/receivers` for use by custom receivers.
+
+- Updated dependencies [[`d4b35f6`](https://github.com/Shopify/remote-dom/commit/d4b35f66a49eaca27be2530a0d6b6f6f8a25f4d3), [`69b76a2`](https://github.com/Shopify/remote-dom/commit/69b76a28c79177f9b1654618a5979345b86fbf9a), [`dd02515`](https://github.com/Shopify/remote-dom/commit/dd02515a4324fc279e4d7c0b1fce827bd3a2ffad), [`3e4b3e7`](https://github.com/Shopify/remote-dom/commit/3e4b3e7e72aa69eaec8cce73149ba708aaf05fef), [`1f2468e`](https://github.com/Shopify/remote-dom/commit/1f2468ef2b0147e8edbeabc79d982f4e62ddcf67), [`1f7e35d`](https://github.com/Shopify/remote-dom/commit/1f7e35d9aa22a14afc01feab341ffa88686a1715)]:
+  - @remote-dom/polyfill@1.7.0
+
 ## 1.12.0
 
 ### Minor Changes

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -7,7 +7,7 @@
     "access": "public",
     "@remote-dom/registry": "https://registry.npmjs.org"
   },
-  "version": "1.12.0",
+  "version": "1.12.1",
   "engines": {
     "node": ">=14.0.0"
   },
@@ -90,7 +90,7 @@
     "build": "rollup --config ./rollup.config.js"
   },
   "dependencies": {
-    "@remote-dom/polyfill": "workspace:^1.6.0",
+    "@remote-dom/polyfill": "workspace:^1.7.0",
     "htm": "catalog:"
   },
   "peerDependencies": {

diff --git a/packages/polyfill/CHANGELOG.md b/packages/polyfill/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @remote-dom/polyfill
 
+## 1.7.0
+
+### Minor Changes
+
+- [#658](https://github.com/Shopify/remote-dom/pull/658) [`69b76a2`](https://github.com/Shopify/remote-dom/commit/69b76a28c79177f9b1654618a5979345b86fbf9a) Thanks [@airhorns](https://github.com/airhorns)! - Add `Element.closest()`, `Element.classList`, and `Element.dataset` convenience APIs.
+
+- [#723](https://github.com/Shopify/remote-dom/pull/723) [`3e4b3e7`](https://github.com/Shopify/remote-dom/commit/3e4b3e7e72aa69eaec8cce73149ba708aaf05fef) Thanks [@andrewiggins](https://github.com/andrewiggins)! - Add live indexed and named property access to `Element.attributes`.
+
+### Patch Changes
+
+- [#724](https://github.com/Shopify/remote-dom/pull/724) [`d4b35f6`](https://github.com/Shopify/remote-dom/commit/d4b35f66a49eaca27be2530a0d6b6f6f8a25f4d3) Thanks [@andrewiggins](https://github.com/andrewiggins)! - Detach attributes from their owner element when passed to `Document.adoptNode()`, including same-document adoption.
+
+- [#731](https://github.com/Shopify/remote-dom/pull/731) [`dd02515`](https://github.com/Shopify/remote-dom/commit/dd02515a4324fc279e4d7c0b1fce827bd3a2ffad) Thanks [@andrewiggins](https://github.com/andrewiggins)! - Improve `classList` token parsing, validation, and attribute normalization, and reduce repeated parsing and temporary allocations. Correct dataset property precedence and name conversion while preserving non-ASCII casing.
+
+- [#719](https://github.com/Shopify/remote-dom/pull/719) [`1f2468e`](https://github.com/Shopify/remote-dom/commit/1f2468ef2b0147e8edbeabc79d982f4e62ddcf67) Thanks [@andrewiggins](https://github.com/andrewiggins)! - Optimize selector matching by precomputing HTML element and attribute comparison names and avoiding redundant normalization and temporary selector-part arrays.
+
+- [#720](https://github.com/Shopify/remote-dom/pull/720) [`1f7e35d`](https://github.com/Shopify/remote-dom/commit/1f7e35d9aa22a14afc01feab341ffa88686a1715) Thanks [@andrewiggins](https://github.com/andrewiggins)! - Return a static `NodeList` with `item()` support from `getElementsByTagName()`, using shared selector traversal while preserving qualified-name and namespace-sensitive matching.
+
 ## 1.6.0
 
 ### Minor Changes

diff --git a/packages/polyfill/package.json b/packages/polyfill/package.json
@@ -7,7 +7,7 @@
     "access": "public",
     "@remote-dom/registry": "https://registry.npmjs.org"
   },
-  "version": "1.6.0",
+  "version": "1.7.0",
   "engines": {
     "node": ">=14.0.0"
   },

diff --git a/packages/preact/CHANGELOG.md b/packages/preact/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @remote-dom/preact
 
+## 1.3.1
+
+### Patch Changes
+
+- [#738](https://github.com/Shopify/remote-dom/pull/738) [`0354436`](https://github.com/Shopify/remote-dom/commit/035443609f46fb69989f64019531c8be72496669) Thanks [@greatscotty](https://github.com/greatscotty)! - Validate values received from the remote environment before storing or rendering them.
+
+  `RemoteReceiver` and `SignalRemoteReceiver` now normalize text node content and attribute values to strings (nullish attribute updates remove the attribute), reject property values containing objects that would be mistaken by a UI framework for one of its own virtual nodes (including inherited values and non-enumerable `Error.cause` values), require event listeners to be functions, and reject `__proto__` as a property name. The `@remote-dom/preact` and `@remote-dom/react` host renderers additionally ignore non-string attributes and never pass remote-controlled `children`, `ref`, `key`, `dangerouslySetInnerHTML`, `innerHTML`, or `outerHTML` props to host components. `RemoteElement.updateRemoteAttribute()` now sends the same string it stores locally.
+
+  The new validation helpers are exported from `@remote-dom/core/receivers` for use by custom receivers.
+
+- Updated dependencies [[`064847c`](https://github.com/Shopify/remote-dom/commit/064847cd32e4f1ff712661e4acd2cbb92904c2b5), [`0354436`](https://github.com/Shopify/remote-dom/commit/035443609f46fb69989f64019531c8be72496669)]:
+  - @remote-dom/core@1.12.1
+  - @remote-dom/signals@2.1.2
+
 ## 1.3.0
 
 ### Minor Changes

diff --git a/packages/preact/package.json b/packages/preact/package.json
@@ -7,7 +7,7 @@
     "access": "public",
     "@remote-dom/registry": "https://registry.npmjs.org"
   },
-  "version": "1.3.0",
+  "version": "1.3.1",
   "engines": {
     "node": ">=14.0.0"
   },
@@ -55,8 +55,8 @@
     "build": "rollup --config rollup.config.js"
   },
   "dependencies": {
-    "@remote-dom/core": "workspace:^1.7.0",
-    "@remote-dom/signals": "workspace:^2.1.0",
+    "@remote-dom/core": "workspace:^1.12.1",
+    "@remote-dom/signals": "workspace:^2.1.2",
     "htm": "catalog:"
   },
   "peerDependencies": {

diff --git a/packages/react/CHANGELOG.md b/packages/react/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @remote-dom/react
 
+## 1.2.3
+
+### Patch Changes
+
+- [#738](https://github.com/Shopify/remote-dom/pull/738) [`0354436`](https://github.com/Shopify/remote-dom/commit/035443609f46fb69989f64019531c8be72496669) Thanks [@greatscotty](https://github.com/greatscotty)! - Validate values received from the remote environment before storing or rendering them.
+
+  `RemoteReceiver` and `SignalRemoteReceiver` now normalize text node content and attribute values to strings (nullish attribute updates remove the attribute), reject property values containing objects that would be mistaken by a UI framework for one of its own virtual nodes (including inherited values and non-enumerable `Error.cause` values), require event listeners to be functions, and reject `__proto__` as a property name. The `@remote-dom/preact` and `@remote-dom/react` host renderers additionally ignore non-string attributes and never pass remote-controlled `children`, `ref`, `key`, `dangerouslySetInnerHTML`, `innerHTML`, or `outerHTML` props to host components. `RemoteElement.updateRemoteAttribute()` now sends the same string it stores locally.
+
+  The new validation helpers are exported from `@remote-dom/core/receivers` for use by custom receivers.
+
+- Updated dependencies [[`064847c`](https://github.com/Shopify/remote-dom/commit/064847cd32e4f1ff712661e4acd2cbb92904c2b5), [`0354436`](https://github.com/Shopify/remote-dom/commit/035443609f46fb69989f64019531c8be72496669)]:
+  - @remote-dom/core@1.12.1
+
 ## 1.2.2
 
 ### Patch Changes

diff --git a/packages/react/package.json b/packages/react/package.json
@@ -6,7 +6,7 @@
     "access": "public",
     "@remote-dom/registry": "https://registry.npmjs.org"
   },
-  "version": "1.2.2",
+  "version": "1.2.3",
   "engines": {
     "node": ">=18.0.0"
   },
@@ -68,7 +68,7 @@
     "build": "rollup --config rollup.config.js"
   },
   "dependencies": {
-    "@remote-dom/core": "workspace:^1.7.0",
+    "@remote-dom/core": "workspace:^1.12.1",
     "@types/react": "^18.0.0",
     "htm": "catalog:"
   },

diff --git a/packages/signals/CHANGELOG.md b/packages/signals/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @remote-dom/signals
 
+## 2.1.2
+
+### Patch Changes
+
+- [#738](https://github.com/Shopify/remote-dom/pull/738) [`0354436`](https://github.com/Shopify/remote-dom/commit/035443609f46fb69989f64019531c8be72496669) Thanks [@greatscotty](https://github.com/greatscotty)! - Validate values received from the remote environment before storing or rendering them.
+
+  `RemoteReceiver` and `SignalRemoteReceiver` now normalize text node content and attribute values to strings (nullish attribute updates remove the attribute), reject property values containing objects that would be mistaken by a UI framework for one of its own virtual nodes (including inherited values and non-enumerable `Error.cause` values), require event listeners to be functions, and reject `__proto__` as a property name. The `@remote-dom/preact` and `@remote-dom/react` host renderers additionally ignore non-string attributes and never pass remote-controlled `children`, `ref`, `key`, `dangerouslySetInnerHTML`, `innerHTML`, or `outerHTML` props to host components. `RemoteElement.updateRemoteAttribute()` now sends the same string it stores locally.
+
+  The new validation helpers are exported from `@remote-dom/core/receivers` for use by custom receivers.
+
+- Updated dependencies [[`064847c`](https://github.com/Shopify/remote-dom/commit/064847cd32e4f1ff712661e4acd2cbb92904c2b5), [`0354436`](https://github.com/Shopify/remote-dom/commit/035443609f46fb69989f64019531c8be72496669)]:
+  - @remote-dom/core@1.12.1
+
 ## 2.1.1
 
 ### Patch Changes

diff --git a/packages/signals/package.json b/packages/signals/package.json
@@ -6,7 +6,7 @@
     "access": "public",
     "@remote-dom/registry": "https://registry.npmjs.org"
   },
-  "version": "2.1.1",
+  "version": "2.1.2",
   "engines": {
     "node": ">=14.0.0"
   },
@@ -43,6 +43,6 @@
     "defaults and not dead"
   ],
   "dependencies": {
-    "@remote-dom/core": "workspace:^1.11.1"
+    "@remote-dom/core": "workspace:^1.12.1"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml