Commit Graph

3250 Commits

Author SHA1 Message Date
David Mehren
efae24bfff Merge pull request #1408 from hedgedoc/renovate/master-mini-css-extract-plugin-1.x
chore(deps): update dependency mini-css-extract-plugin to v1.6.2 (master)
2021-07-03 10:26:51 +02:00
Renovate Bot
19c0125edf chore(deps): update dependency mini-css-extract-plugin to v1.6.2
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-07-03 08:16:02 +00:00
David Mehren
4263cbf5b0 Merge pull request #1395 from hedgedoc/renovate/master-test-packages
chore(deps): update dependency mocha to v9.0.1 (master)
2021-07-03 10:14:38 +02:00
Renovate Bot
cbf3c51edd chore(deps): update dependency mocha to v9.0.1
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-07-03 08:03:11 +00:00
David Mehren
53bfb8d149 Merge pull request #1415 from hedgedoc/renovate/master-turndown-7.x
chore(deps): update dependency turndown to v7.1.1 (master)
2021-07-03 09:59:22 +02:00
David Mehren
5d66755831 Merge pull request #1406 from hedgedoc/renovate/master-mkdocs-material-7.x
chore(deps): update dependency mkdocs-material to v7.1.9 (master)
2021-07-03 09:57:08 +02:00
Renovate Bot
c8472b5823 chore(deps): update dependency turndown to v7.1.1
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-29 16:57:05 +00:00
Renovate Bot
f0110eae23 chore(deps): update dependency mkdocs-material to v7.1.9
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-25 10:53:38 +00:00
David Mehren
3c504f2dc9 Merge pull request #1387 from hedgedoc/renovate/master-lock-file-maintenance 2021-06-21 14:00:13 +02:00
Renovate Bot
bfa2eac7f5 chore(deps): lock file maintenance
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-21 11:35:26 +00:00
David Mehren
bf0c348e74 Merge pull request #1400 from hedgedoc/renovate/master-linters
chore(deps): update dependency eslint to v7.29.0 (master)
2021-06-21 13:30:37 +02:00
David Mehren
8ab65869ff Merge pull request #1384 from hedgedoc/renovate/master-mkdocs-material-7.x
chore(deps): update dependency mkdocs-material to v7.1.8 (master)
2021-06-21 13:30:12 +02:00
Renovate Bot
26b8abe2a9 chore(deps): update dependency eslint to v7.29.0
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-18 20:29:58 +00:00
Renovate Bot
2125e9b98d chore(deps): update dependency mkdocs-material to v7.1.8
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-12 14:17:30 +00:00
David Mehren
66bdbc1f43 Merge pull request #1370 from hedgedoc/feature/lazy_load 2021-06-12 16:16:22 +02:00
David Mehren
7ff685933e Lazy-load highlight.js
This commit moves the import of highlight.js into a `require.ensure`
block, that is only executed when a code-block is actually present
in a note. Webpack automatically splits the library into a separate
chunk and loads that on demand.

The call to `hljs.listLanguages()` in `index.js` is also replaced
by a static list. This is important, as `index.js` would otherwise
need to import highlight.js, which would cause the quite big
library to be included into nearly every entrypoint, needlessly
increasing the transferred code size.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:29:27 +02:00
David Mehren
5b8b76135b Lazy-load viz.js
This commit moves the import of viz.js into a `require.ensure` block,
that is only executed when a graphviz diagram is actually present
in a note. Webpack automatically splits the library into a separate
chunk and loads that on demand.

To ensure that graphviz code-blocks are not treated as normal
code-blocks while the chunk is loading, a corresponding check is added
to `finishView`.

The library is also removed from the Webpack config file, as it only
is used at one place in extra.js, which is handled by Webpack
without any extra config.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:29:26 +02:00
David Mehren
1c023e7881 Lazy-load abcjs
This commit moves the import of abcjs into a `require.ensure` block,
that is only executed when a abc diagram is actually present
in a note. Webpack automatically splits the library into a separate
chunk and loads that on demand.

To ensure that abc code-blocks are not treated as normal
code-blocks while the chunk is loading, a corresponding check is added
to `finishView`.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:29:26 +02:00
David Mehren
938afbddc3 Replace handlebars with string.replace
The html.hbs template does not contain any logic,
so we can replace the lib with good old string.replace calls.
This significantly reduces the bundle size, as we don't have to ship
a full template engine to the client.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:29:26 +02:00
David Mehren
b45b8b9c0d Lazy-load mermaid
This commit moves the import of mermaid into a `require.ensure` block,
that is only executed when a mermaid diagram is actually present
in a note. Webpack automatically splits the library into a separate
chunk and loads that on demand.

To ensure that mermaid code-blocks are not treated as normal
code-blocks while the chunk is loading, a corresponding check is added
to `finishView`.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:26:03 +02:00
David Mehren
3f5755ed80 Merge pull request #1362 from hedgedoc/renovate/master-lock-file-maintenance
chore(deps): lock file maintenance (master)
2021-06-10 21:55:57 +02:00
Renovate Bot
33c1ce00e4 chore(deps): lock file maintenance
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-10 19:30:50 +00:00
David Mehren
3125217e17 Merge pull request #1381 from hedgedoc/renovate/master-mkdocs-1.x
chore(deps): update dependency mkdocs to v1.2.1 (master)
2021-06-10 21:27:35 +02:00
Renovate Bot
7dd0efa688 chore(deps): update dependency mkdocs to v1.2.1
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-09 17:35:54 +00:00
David Mehren
37605447e2 Merge pull request #1366 from hedgedoc/renovate/master-mkdocs-1.x
chore(deps): update dependency mkdocs to v1.2 (master)
2021-06-08 23:10:01 +02:00
Renovate Bot
0a7d0a74fa chore(deps): update dependency mkdocs to v1.2
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-08 20:35:36 +00:00
Yannick Bungers
1d082ae827 Merge pull request #1369 from hedgedoc/feature/remove_unsafe_eval 2021-06-08 22:16:07 +02:00
David Mehren
e7e1313691 Merge pull request #1371 from hedgedoc/feature/optimize_webpack 2021-06-08 21:09:44 +02:00
David Mehren
960f5c1b22 Merge pull request #1375 from hedgedoc/feature/yeet_google_analytics 2021-06-08 14:54:03 +02:00
David Mehren
f86fae3bd7 Don't use eval-based source maps
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 23:04:45 +02:00
David Mehren
3cd169a650 Remove unsafe-eval from default CSP
As script-loader was removed in the previous commits,
we can finally tighten up security.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 23:04:45 +02:00
David Mehren
2cecb9184b Merge pull request #1368 from hedgedoc/feature/remove_script_loader 2021-06-07 22:58:35 +02:00
David Mehren
5e771c2f65 Update Content Security Policy docs
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 22:57:12 +02:00
David Mehren
7283ccd5e8 Allow configuring Disqus & GA CSP with env vars
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 22:57:12 +02:00
David Mehren
0c6482abc5 Add release notes for CSP changes
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 22:57:12 +02:00
David Mehren
52231f688d Disable GA and Disqus in default CSP
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 22:57:12 +02:00
David Mehren
bf3b45bc11 Uninstall script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
fa1ed66088 Load abcjs from npm package
This also loads abcjs without script-loader.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
fddd97391b Load gist-embed without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
1150c72fa7 Load handlebars without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
a98d184f2c Load mermaid without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
bd62e79f7d Load ot without script-loader
The ot library is tricky to load with Webpack, as it writes
it's functions into a global `ot` object and does not export anything.
I got it working using `exports-loader` to put the `ot` object
into a CommonJS export and then forcing Webpack to only
load using CommonJS.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
4f4a4cb747 Load jquery-textcomplete without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
2515ad962b Load inline-attachment without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:35 +02:00
David Mehren
cf867daf99 Load Idle.js without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:23 +02:00
David Mehren
0e7a9df97d Load jquery-ui resizable from npm package
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:23 +02:00
David Mehren
e17cc6440f Load codemirror and codemirror-spell-checker without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:20 +02:00
David Mehren
5aeb7f4d0f Merge pull request #1372 from hedgedoc/renovate/master-major-test-packages
chore(deps): update dependency mocha to v9 (master)
2021-06-07 19:23:46 +02:00
David Mehren
0df100d740 Merge pull request #1373 from hedgedoc/renovate/master-webpack-cli-4.x
chore(deps): update dependency webpack-cli to v4.7.2 (master)
2021-06-07 19:22:32 +02:00
Renovate Bot
8136358f2f chore(deps): update dependency webpack-cli to v4.7.2
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-07 17:05:37 +00:00