Bump penpal from 6.2.1 to 7.0.4

[dependabot]

Bumps penpal from 6.2.1 to 7.0.4.

Release notes

Sourced from penpal's releases.

v7.0.4

• Fixes #104 where running Penpal within node would result in the error ReferenceError: exports is not defined.

v7.0.3

• Avoids a warning being logged by the browser when (1) allowedOrigins is configured with a single string origin and (2) the child iframe has been recently added to the DOM but the browser has not yet started to load the iframe document.

v7.0.2

• Fixes an issue where bundling Penpal into applications using specific older versions of Webpack would cause an error because Webpack had very specific requirements about the order of certain keys in package.json.

v7.0.1

• Fixes an issue when importing Penpal with Webpack (and potentially some other bundlers) because import statements within Penpal didn't include the file extension, which didn't follow esm strictly.

v7.0.0

Version 7 is here! It contains quite a few new features and breaking changes, so let's get into it.

Migration

To ease the pain of migration, running Penpal v7 in a parent window is compatible with running Penpal v6 in a child iframe. Therefore, if it's difficult to upgrade Penpal in the parent window and iframe at the same time, update code in the parent window first and then update code in the child iframe. Compatibility with v6 will be removed in the next major version of Penpal (v8). Note that running Penpal v6 in the parent window is not compatible with running Penpal v7 in the child iframe.

Breaking changes

A WindowMessenger is now required

What

Message transmission details between a parent window and a child iframe have been moved to a new WindowMessenger class. You'll now pass an instance of WindowMessenger as the messenger option when calling connect. See Usage with an Iframe in the README.

Why

Separating message transmission into a dedicated class allows Penpal to support additional contexts—such as communication between a window and a worker—while keeping the shared, high-level logic inside connect.

connectToChild and connectToParent have been renamed

What

connectToChild and connectToParent are now unified into a single connect function.

Why

With WindowMessenger receiving a reference to the iframe window instead of connectToChild, the connectToChild and connectToParent functions essentially became identical and no longer needed to be separate functions.

Origin defaults have changed

What

When calling connectToChild, the default value for the childOrigin option was previously derived from the iframe’s src attribute. This is no longer the case. Penpal now defaults to restricting communication to the origin of the parent window’s HTML document. If you'd like to derive the origin from the iframe’s src when specifying the child origin, you can use new URL(iframe.src).origin. See Usage with an Iframe in the README.

When calling connectToParent, the default value for the parentOrigin option was *. This has been changed as well. Penpal now defaults to restricting communication to the origin of the child iframe’s HTML document.

Why

In this version, Penpal only receives a reference to the iframe’s content window (iframe.contentWindow) rather than the iframe itself, so it no longer attempts to derive the child’s origin when connecting.

When connecting to the parent window from the child iframe, I wasn’t comfortable with Penpal using * as the default parentOrigin. Even though the README recommended against using the default, developers might easily overlook it. As this library is security-conscious, it seems more appropriate to encourage developers to manually specify * when necessary, rather than rely on the default.

Debugging has changed

... (truncated)

Commits

• b1b12f3 7.0.4
• dfe5dc5 7.0.4-beta.1
• e25f8e0 Fixes commonjs build artifacts by properly using the .cjs extension. Uses tsu...
• 9b487d7 7.0.3
• 8422453 Fixes #103. Avoids a warning being logged by the browser when (1) allowedOrig...
• fd8b584 7.0.2
• c015a0f Reordered default to be after types for better compatibility.
• fdacf1c 7.0.1
• cde656a 7.0.1-beta.1
• 4e41338 Follow es module spec more strictly.
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.