sa6anw/hedgedoc-hedgeagent
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
4,498 Commits 2 Branches 0 Tags
f910000d2be46426613edc8d6dcc28499ab2ef0e
Commit Graph

955 Commits

Author SHA1 Message Date
Erik Michelson
f910000d2b feat(security): sanitize SVG files on upload 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-02-04 20:27:41 +01:00
Erik Michelson
0e9e2177cf chore(deps): update dependencies 
renovate was tired, so I did it manually

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-02-03 20:44:27 +01:00
renovate[bot]
d2dd6762a7 chore(deps): update dependency jquery-ui to v1.14.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 20:16:19 +01:00
renovate[bot]
14edc1a7a5 fix(deps): update dependency connect-session-sequelize to v8.0.5 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 20:13:31 +01:00
renovate[bot]
58d436c924 fix(deps): update dependency mysql2 to v3.16.3 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 20:13:01 +01:00
renovate[bot]
a3b49a6e24 chore(deps): update dependency esbuild-loader to v4.4.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:56:20 +01:00
renovate[bot]
a96e9cbdf9 fix(deps): update dependency lodash to v4.17.23 [security] 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:55:09 +01:00
renovate[bot]
a2da69ede5 chore(deps): update dependency eslint-plugin-n to v17.23.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:53:31 +01:00
renovate[bot]
8725196df6 chore(deps): update dependency utf-8-validate to v6.0.6 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:51:43 +01:00
renovate[bot]
7c9d1ec712 fix(deps): update dependency body-parser to v2.2.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:51:12 +01:00
renovate[bot]
e77b9ced58 fix(deps): update dependency mysql2 to v3.16.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:17:17 +01:00
renovate[bot]
35f0b44906 chore(deps): update dependency less to v4.5.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:08:47 +01:00
renovate[bot]
92efa38948 chore(deps): update linters to v9.39.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:00:12 +01:00
renovate[bot]
4df25c436b fix(deps): update dependency aws-sdk to v2.1693.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-09 22:02:02 +01:00
renovate[bot]
b0911e4434 fix(deps): update dependency winston to v3.19.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-08 11:00:20 +01:00
Erik Michelson
7185a44448 docs: update for release 1.10.5 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-06 17:45:55 +01:00
Erik Michelson
0a5f4ccefd docs: update for release 1.10.4 
Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-05 23:36:12 +01:00
Erik Michelson
92522e3f33 fix(deps): downgrade formidable to v2 to fix uploads 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-05 23:36:12 +01:00
renovate[bot]
b6ab3e0c16 fix(deps): update dependency cookie to v1.1.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:59:07 +01:00
renovate[bot]
de2498e854 fix(deps): update dependency express to v4.22.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:56:29 +01:00
renovate[bot]
cca19aa159 fix(deps): update dependency connect-session-sequelize to v8.0.4 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:55:36 +01:00
renovate[bot]
89bbd7e302 chore(deps): update dependency @eslint/eslintrc to v3.3.3 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:52:56 +01:00
renovate[bot]
c6e2cefa8f chore(deps): update dependency js-yaml to v3.14.2 [security] 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-11-25 00:32:29 +01:00
renovate[bot]
b77044b591 fix(deps): update dependency body-parser to v2.2.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-11-25 00:20:16 +01:00
renovate[bot]
d533c3b3d3 fix(deps): update dependency morgan to v1.10.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-11-25 00:02:14 +01:00
renovate[bot]
f1c9f11d98 chore(deps): update yarn to v4.12.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-11-24 23:55:33 +01:00
Erik Michelson
ffc1e5f87d fix(deps): switch back to non-ESM packages 
Node 18 has not the ability yet to run the more modern
packages. Since we want to keep Node 18 compatability
around for some time, these packages can't be upgraded.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-11-24 14:32:24 +01:00
Erik Michelson
9a45d1e2a9 chore(deps): upgrade dependencies, remove some unnecessary ones 
This commit upgrades dependencies that are more or less trivial
to update, e.g. because they didn't have major version bumps or
simply didn't break anything. There are some dependencies which
have not been upgraded since this would have required larger
refactorings. This includes especially the markdown-it ecosystem
and the webpack ecosystem.
The largest refactorings in this commit come from the bump of
socket.io v2 to v4 which changed the handling of the connected
socket list for instance.

This commit further removes some outdated and/or unnecessary
dependencies. This includes the String.js library which is
unmaintained for 9 years and has some CVEs. We mainly used
this library for their escapeHTML and unescapeHTML methods.
This can be done using native DOM APIs nowadays, which is also
considered more safe since it is the same logic that the
browser itself uses.
Since we target Node 18 and above, we can also rely on the
built-in fetch function instead of the node-fetch package.
The current version of Chance.js includes a method for
generating a random color now too, so we don't need the
package randomcolor anymore.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-11-24 14:32:24 +01:00
Erik Michelson
637c451486 fix: use nanoid instead of shortid 
shortid is deprecated and they recommend nanoid instead.
We're not sure if this has to do with possible name
collisions or enumerability, but to be sure and on the
safe side, we're changing this. nanoid seems quite safe
since it uses node's crypto module underneath.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-11-22 01:05:50 +01:00
renovate[bot]
367626ab9c fix(deps): update dependency formidable to v2.1.3 (master) (#6072) 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-20 18:30:14 +00:00
renovate[bot]
c97c11df2c chore(deps): update yarn to v4.9.1 (master) (#6071) 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-20 18:02:42 +00:00
Erik Michelson
0636b5c20b refactor: use iframes for gist embedding instead of gist-embed 
The used library gist-embed relies on GitHub Gist's JSONP
endpoint which is a risk for XSS injection. By adding untrusted
content from GitHub into the DOM it also follows very bad
practises. Using the iframe embedding has the disadvantage of
not having the proper height for the frame auto-loaded, but
the security benefits are worth it.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-04-10 00:21:55 +02:00
Erik Michelson
f31e591c17 chore(release): bump version to 1.10.3 and add release notes 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-04-10 00:21:55 +02:00
renovate[bot]
312950aeeb fix(deps): update dependency body-parser to v2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:58:56 +02:00
renovate[bot]
e66f413507 fix(deps): update dependency prometheus-api-metrics to v4 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:56:58 +02:00
renovate[bot]
d09abac9c6 chore(deps): update dependency globals to v16 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:55:39 +02:00
renovate[bot]
a0c50164b6 chore(deps): update linters 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:49:35 +02:00
renovate[bot]
639eee078d chore(deps): update dependency globals to v15.15.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:48:01 +02:00
renovate[bot]
3b9a8297c2 fix(deps): update dependency validator to v13.15.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:47:49 +02:00
renovate[bot]
e38ba23bc9 fix(deps): update dependency file-type to v20.4.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:46:43 +02:00
renovate[bot]
49c6d7f75f fix(deps): update dependency mysql2 to v3.14.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:46:05 +02:00
renovate[bot]
5ec6487f17 fix(deps): update dependency pg to v8.14.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:45:45 +02:00
renovate[bot]
4c3ff41385 fix(deps): update dependency helmet to v8.1.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:44:29 +02:00
renovate[bot]
53076a665a fix(deps): update dependency uuid to v11.1.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:43:39 +02:00
renovate[bot]
894efa88d1 fix(deps): update dependency compression to v1.8.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:42:15 +02:00
renovate[bot]
c6df2629d3 chore(deps): update yarn to v4.9.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:41:47 +02:00
renovate[bot]
9ece354c70 chore(deps): update dependency less to v4.3.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:41:16 +02:00
renovate[bot]
543fb4feb4 chore(deps): update dependency prismjs to v1.30.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:39:45 +02:00
renovate[bot]
e08feadde7 fix(deps): update dependency mariadb to v3.4.1 (master) (#6043) 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 19:37:28 +00:00
renovate[bot]
7d38e100b8 chore(deps): update dependency jquery-mousewheel to v3.2.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-04-09 21:35:12 +02:00