fix(sdk): BREAKING - Fix Row component markup structure for full-width backgrounds

[fmontes]

fix-html-sdk.mp4

Description

Fixes the HTML markup structure for the Row component in both React and Angular SDKs. Previously, custom classes from the Layout Editor were being applied to an inner wrapper div instead of the outer container, preventing proper full-width background implementations.

Current (Incorrect) Markup:

<div class="dot-row-container">
  <div class="CUSTOM_CLASSES">
    <columns />
  </div>
</div>

Fixed Markup:

<div class="dot-row-container CUSTOM_CLASSES">
  <div class="dot-row">
    <columns />
  </div>
</div>

Changes

• Move custom classes and Layout Editor styleClass to outer container
• Add dot-row-container class to outer div for semantic clarity
• Inner div now has dot-row class with grid layout styles
• Maintains data-dot-object attribute on inner grid container

Breaking Change ⚠️

This is a BREAKING CHANGE as customers may have CSS targeting the previous markup structure (.dot-row-container > [custom-classes]). Any custom This is a BREAKING CHANGE as customers may have CSS targeting the previous markup structure (.dot-row-container > [custom-classes]). Any custom This is a BREAKING CHANGE as customers may have CSS targeting the previous markup structure (.dot-row-cotom-class > .dot-row

Fixes #34431

Co-Authored-By: Warp [email protected]

[semgrep-code-dotcms-test]

Semgrep found 1 ssc-4fd3a3fc-acff-4277-9d88-60469f5a4fa5 finding:

• core-web/libs/sdk/angular/src/lib/components/dotcms-layout-body/components/row/row.component.ts
  • L16-30 - Triage

Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the href and xlink:href attributes on SVG <script> elements as Resource URL contexts. This allows an attacker to bind a malicious data: URI or external script via [attr.href] or [attr.xlink:href], resulting in arbitrary JavaScript execution (XSS) in the victim's browser.

Fix: Upgrade this library to at least version 20.3.16 at core/core-web/yarn.lock:512.

Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610

If this is a critical or high severity finding, please also link this issue in the #security channel in Slack.