[pull] master from microsoft:master

change/@fluentui-react-card-c273bc2b-822e-4a34-bc44-57e000ac8bd5.json

@@ -0,0 +1,7 @@
+{
+  "type": "patch",
+  "comment": "fix: avoid pulling griffel in CardHeader and CardPreview base hooks",
+  "packageName": "@fluentui/react-card",
+  "email": "dmytrokirpa@microsoft.com",
+  "dependentChangeType": "patch"
+}

change/@fluentui-react-charting-355a59ec-794a-4da2-93a6-ea28e5c1c204.json

@@ -0,0 +1,7 @@
+{
+  "type": "patch",
+  "comment": "safeurl related bug fix",
+  "packageName": "@fluentui/react-charting",
+  "email": "132879294+v-baambati@users.noreply.github.com",
+  "dependentChangeType": "patch"
+}

change/@fluentui-react-charts-eede23c0-c45d-4f45-9a22-a7a9334860bb.json

@@ -0,0 +1,7 @@
+{
+  "type": "patch",
+  "comment": "safeurl related bug fix",
+  "packageName": "@fluentui/react-charts",
+  "email": "132879294+v-baambati@users.noreply.github.com",
+  "dependentChangeType": "patch"
+}

packages/charts/chart-web-components/CHANGELOG.json

@@ -1,6 +1,27 @@
 {
   "name": "@fluentui/chart-web-components",
   "entries": [
+    {
+      "date": "Wed, 13 May 2026 04:08:42 GMT",
+      "tag": "@fluentui/chart-web-components_v0.0.77",
+      "version": "0.0.77",
+      "comments": {
+        "patch": [
+          {
+            "author": "863023+radium-v@users.noreply.github.com",
+            "package": "@fluentui/chart-web-components",
+            "commit": "e5b0e2412175216210360fee356a404af60f38d5",
+            "comment": "fix: update fast-element dependency version"
+          },
+          {
+            "author": "beachball",
+            "package": "@fluentui/chart-web-components",
+            "comment": "Bump @fluentui/web-components to v3.0.0-rc.19",
+            "commit": "193b721bfced61e2faa1293118b8ff086634a317"
+          }
+        ]
+      }
+    },
     {
       "date": "Mon, 11 May 2026 04:09:08 GMT",
       "tag": "@fluentui/chart-web-components_v0.0.76",

packages/charts/chart-web-components/CHANGELOG.md

@@ -1,9 +1,19 @@
 # Change Log - @fluentui/chart-web-components
 
-This log was last generated on Mon, 11 May 2026 04:09:08 GMT and should not be manually modified.
+This log was last generated on Wed, 13 May 2026 04:08:42 GMT and should not be manually modified.
 
 <!-- Start content -->
 
+## [0.0.77](https://github.com/microsoft/fluentui/tree/@fluentui/chart-web-components_v0.0.77)
+
+Wed, 13 May 2026 04:08:42 GMT 
+[Compare changes](https://github.com/microsoft/fluentui/compare/@fluentui/chart-web-components_v0.0.76..@fluentui/chart-web-components_v0.0.77)
+
+### Patches
+
+- fix: update fast-element dependency version ([PR #36184](https://github.com/microsoft/fluentui/pull/36184) by 863023+radium-v@users.noreply.github.com)
+- Bump @fluentui/web-components to v3.0.0-rc.19 ([PR #36199](https://github.com/microsoft/fluentui/pull/36199) by beachball)
+
 ## [0.0.76](https://github.com/microsoft/fluentui/tree/@fluentui/chart-web-components_v0.0.76)
 
 Mon, 11 May 2026 04:09:08 GMT 

packages/charts/chart-web-components/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@fluentui/chart-web-components",
   "description": "A library of Fluent Chart Web Components",
-  "version": "0.0.76",
+  "version": "0.0.77",
   "author": {
     "name": "Microsoft"
   },
@@ -69,7 +69,7 @@
   "dependencies": {
     "@microsoft/fast-web-utilities": "^6.0.0",
     "@fluentui/tokens": "^1.0.0-alpha.23",
-    "@fluentui/web-components": "^3.0.0-rc.18",
+    "@fluentui/web-components": "^3.0.0-rc.19",
     "@types/d3-selection": "^3.0.0",
     "@types/d3-shape": "^3.0.0",
     "d3-selection": "^3.0.0",

packages/charts/react-charting/src/utilities/UtilityUnitTests.test.ts

@@ -1523,6 +1523,10 @@ describe('isSafeUrl', () => {
     expect(utils.isSafeUrl('https://example.com')).toBe(true);
   });
 
+  test('Should allow https URL with leading whitespace', () => {
+    expect(utils.isSafeUrl('  https://example.com')).toBe(true);
+  });
+
   test('Should allow https URL with path, query, and fragment', () => {
     expect(utils.isSafeUrl('https://example.com/path?q=1#section')).toBe(true);
   });
@@ -1552,6 +1556,26 @@ describe('isSafeUrl', () => {
     expect(utils.isSafeUrl('javascript:alert(1)')).toBe(false);
   });
 
+  test('Should block javascript: protocol with leading whitespace', () => {
+    // eslint-disable-next-line no-script-url
+    expect(utils.isSafeUrl(' javascript:alert(1)')).toBe(false);
+  });
+
+  test('Should block javascript: protocol with leading tabs/newlines', () => {
+    // eslint-disable-next-line no-script-url
+    expect(utils.isSafeUrl('\n\tjavascript:alert(1)')).toBe(false);
+  });
+
+  test('Should block javascript: protocol with embedded newline in scheme', () => {
+    // eslint-disable-next-line no-script-url
+    expect(utils.isSafeUrl('java\nscript:alert(1)')).toBe(false);
+  });
+
+  test('Should block javascript: protocol with embedded tab in scheme', () => {
+    // eslint-disable-next-line no-script-url
+    expect(utils.isSafeUrl('java\tscript:alert(1)')).toBe(false);
+  });
+
   test('Should block data: protocol', () => {
     expect(utils.isSafeUrl('data:text/html,<script>alert(1)</script>')).toBe(false);
   });
@@ -1560,6 +1584,25 @@ describe('isSafeUrl', () => {
     expect(utils.isSafeUrl('vbscript:msgbox("xss")')).toBe(false);
   });
 
+  test('Should block vbscript:alert(1)', () => {
+    expect(utils.isSafeUrl('vbscript:alert(1)')).toBe(false);
+  });
+
+  test('Should block javascript: protocol with null byte prefix', () => {
+    // eslint-disable-next-line no-script-url
+    expect(utils.isSafeUrl('\0javascript:alert(1)')).toBe(false);
+  });
+
+  test('Should block mixed-case javascript: protocol with embedded newline', () => {
+    // eslint-disable-next-line no-script-url
+    expect(utils.isSafeUrl('JaVa\nScRiPt:alert(1)')).toBe(false);
+  });
+
+  test('Should block javascript: protocol with CRLF prefix', () => {
+    // eslint-disable-next-line no-script-url
+    expect(utils.isSafeUrl('\r\njavascript:alert(1)')).toBe(false);
+  });
+
   test('Should block file: protocol', () => {
     expect(utils.isSafeUrl('file:///etc/passwd')).toBe(false);
   });
@@ -1580,6 +1623,10 @@ describe('isSafeUrl', () => {
     expect(utils.isSafeUrl('custom:payload')).toBe(false);
   });
 
+  test('Should block custom: protocol with leading whitespace', () => {
+    expect(utils.isSafeUrl(' custom:payload')).toBe(false);
+  });
+
   test('Should allow a path that contains a colon but is not a scheme', () => {
     expect(utils.isSafeUrl('/path/to:resource')).toBe(true);
   });

packages/charts/react-charting/src/utilities/utilities.ts

@@ -2556,9 +2556,9 @@ const truncateTextToFitWidth = (text: string, maxWidth: number, measure: (s: str
 };
 
 export function isSafeUrl(href: string): boolean {
-  if (/^[a-z][a-z0-9+.-]*:/i.test(href)) {
-    return /^(https?|mailto|tel|ftp):/i.test(href);
+  const normalized = href.replace(/[\u0000-\u001F\u007F\s]+/g, '');
+  if (/^[a-z][a-z0-9+.-]*:/i.test(normalized)) {
+    return /^(https?|mailto|tel|ftp):/i.test(normalized);
   }
-
   return true;
 }

packages/charts/react-charts/library/src/utilities/UtilityUnitTests.test.ts

@@ -1528,6 +1528,10 @@ describe('isSafeUrl', () => {
     expect(utils.isSafeUrl('https://example.com')).toBe(true);
   });
 
+  test('Should allow https URL with leading whitespace', () => {
+    expect(utils.isSafeUrl('  https://example.com')).toBe(true);
+  });
+
   test('Should allow https URL with path, query, and fragment', () => {
     expect(utils.isSafeUrl('https://example.com/path?q=1#section')).toBe(true);
   });
@@ -1557,6 +1561,26 @@ describe('isSafeUrl', () => {
     expect(utils.isSafeUrl('javascript:alert(1)')).toBe(false);
   });
 
+  test('Should block javascript: protocol with leading whitespace', () => {
+    // eslint-disable-next-line no-script-url
+    expect(utils.isSafeUrl(' javascript:alert(1)')).toBe(false);
+  });
+
+  test('Should block javascript: protocol with leading tabs/newlines', () => {
+    // eslint-disable-next-line no-script-url
+    expect(utils.isSafeUrl('\n\tjavascript:alert(1)')).toBe(false);
+  });
+
+  test('Should block javascript: protocol with embedded newline in scheme', () => {
+    // eslint-disable-next-line no-script-url
+    expect(utils.isSafeUrl('java\nscript:alert(1)')).toBe(false);
+  });
+
+  test('Should block javascript: protocol with embedded tab in scheme', () => {
+    // eslint-disable-next-line no-script-url
+    expect(utils.isSafeUrl('java\tscript:alert(1)')).toBe(false);
+  });
+
   test('Should block data: protocol', () => {
     expect(utils.isSafeUrl('data:text/html,<script>alert(1)</script>')).toBe(false);
   });
@@ -1565,6 +1589,25 @@ describe('isSafeUrl', () => {
     expect(utils.isSafeUrl('vbscript:msgbox("xss")')).toBe(false);
   });
 
+  test('Should block vbscript:alert(1)', () => {
+    expect(utils.isSafeUrl('vbscript:alert(1)')).toBe(false);
+  });
+
+  test('Should block javascript: protocol with null byte prefix', () => {
+    // eslint-disable-next-line no-script-url
+    expect(utils.isSafeUrl('\0javascript:alert(1)')).toBe(false);
+  });
+
+  test('Should block mixed-case javascript: protocol with embedded newline', () => {
+    // eslint-disable-next-line no-script-url
+    expect(utils.isSafeUrl('JaVa\nScRiPt:alert(1)')).toBe(false);
+  });
+
+  test('Should block javascript: protocol with CRLF prefix', () => {
+    // eslint-disable-next-line no-script-url
+    expect(utils.isSafeUrl('\r\njavascript:alert(1)')).toBe(false);
+  });
+
   test('Should block file: protocol', () => {
     expect(utils.isSafeUrl('file:///etc/passwd')).toBe(false);
   });
@@ -1585,6 +1628,10 @@ describe('isSafeUrl', () => {
     expect(utils.isSafeUrl('custom:payload')).toBe(false);
   });
 
+  test('Should block custom: protocol with leading whitespace', () => {
+    expect(utils.isSafeUrl(' custom:payload')).toBe(false);
+  });
+
   test('Should allow a path that contains a colon but is not a scheme', () => {
     expect(utils.isSafeUrl('/path/to:resource')).toBe(true);
   });

packages/charts/react-charts/library/src/utilities/utilities.ts

@@ -2716,8 +2716,9 @@ const truncateTextToFitWidth = (text: string, maxWidth: number, measure: (s: str
 };
 
 export function isSafeUrl(href: string): boolean {
-  if (/^[a-z][a-z0-9+.-]*:/i.test(href)) {
-    return /^(https?|mailto|tel|ftp):/i.test(href);
+  const normalized = href.replace(/[\u0000-\u001F\u007F\s]+/g, '');
+  if (/^[a-z][a-z0-9+.-]*:/i.test(normalized)) {
+    return /^(https?|mailto|tel|ftp):/i.test(normalized);
   }
   return true;
 }

packages/react-components/react-card/library/src/components/CardHeader/useCardHeader.ts

@@ -4,7 +4,6 @@ import * as React from 'react';
 import { getIntrinsicElementProps, useId, slot } from '@fluentui/react-utilities';
 import type { CardHeaderBaseProps, CardHeaderBaseState, CardHeaderProps, CardHeaderState } from './CardHeader.types';
 import { useCardContext_unstable } from '../Card/CardContext';
-import { cardHeaderClassNames } from './useCardHeaderStyles.styles';
 
 /**
  * Finds the first child of CardHeader with an id prop.
@@ -77,7 +76,7 @@ export const useCardHeaderBase_unstable = (
   const headerRef = React.useRef<HTMLDivElement>(null);
 
   const hasChildId = React.useRef(false);
-  const generatedId = useId(cardHeaderClassNames.header, referenceId);
+  const generatedId = useId('fui-CardHeader__header', referenceId);
 
   const headerSlot = slot.optional(header, {
     renderByDefault: true,

packages/react-components/react-card/library/src/components/CardPreview/useCardPreview.ts

@@ -9,7 +9,6 @@ import type {
   CardPreviewState,
 } from './CardPreview.types';
 import { useCardContext_unstable } from '../Card/CardContext';
-import { cardPreviewClassNames } from './useCardPreviewStyles.styles';
 
 /**
  * Create the state required to render CardPreview.
@@ -52,7 +51,7 @@ export const useCardPreviewBase_unstable = (
     }
 
     if (previewRef.current && previewRef.current.parentNode) {
-      const img = previewRef.current.parentNode.querySelector<HTMLImageElement>(`.${cardPreviewClassNames.root} > img`);
+      const img = previewRef.current.parentNode.querySelector<HTMLImageElement>(`.fui-CardPreview > img`);
 
       if (img) {
         const ariaLabel = img.getAttribute('aria-label');