0189af9bb1
build(deps): bump clean-css from 5.2.3 to 5.2.4 in /src
...
Bumps [clean-css](https://github.com/clean-css/clean-css ) from 5.2.3 to 5.2.4.
- [Release notes](https://github.com/clean-css/clean-css/releases )
- [Changelog](https://github.com/clean-css/clean-css/blob/master/History.md )
- [Commits](https://github.com/clean-css/clean-css/compare/v5.2.3...v5.2.4 )
---
updated-dependencies:
- dependency-name: clean-css
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2022-01-28 20:46:01 +00:00
65de9eb733
build(deps): bump underscore from 1.13.1 to 1.13.2 in /src
...
Bumps [underscore](https://github.com/jashkenas/underscore ) from 1.13.1 to 1.13.2.
- [Release notes](https://github.com/jashkenas/underscore/releases )
- [Commits](https://github.com/jashkenas/underscore/compare/1.13.1...1.13.2 )
---
updated-dependencies:
- dependency-name: underscore
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2022-01-28 20:42:50 +00:00
d86e1e5249
build(deps): bump ueberdb2 from 2.0.1 to 2.0.2 in /src
...
Bumps [ueberdb2](https://github.com/ether/ueberDB ) from 2.0.1 to 2.0.2.
- [Release notes](https://github.com/ether/ueberDB/releases )
- [Changelog](https://github.com/ether/ueberDB/blob/master/CHANGELOG.md )
- [Commits](https://github.com/ether/ueberDB/compare/v2.0.1...v2.0.2 )
---
updated-dependencies:
- dependency-name: ueberdb2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2022-01-28 08:39:13 +00:00
c40544eade
lint: Bump ESLint dependencies
2022-01-28 03:24:14 -05:00
8791082077
build(deps): bump clean-css from 5.2.2 to 5.2.3 in /src
...
Bumps [clean-css](https://github.com/clean-css/clean-css ) from 5.2.2 to 5.2.3.
- [Release notes](https://github.com/clean-css/clean-css/releases )
- [Changelog](https://github.com/clean-css/clean-css/blob/master/History.md )
- [Commits](https://github.com/clean-css/clean-css/compare/v5.2.2...v5.2.3 )
---
updated-dependencies:
- dependency-name: clean-css
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2022-01-28 07:02:27 +00:00
c568bb1baa
ci: Skip frontend tests for Dependabot PRs
2022-01-28 01:51:15 -05:00
43aa1e4aeb
ci: Reformat `.yml` files for readability
2022-01-28 01:39:45 -05:00
84c7da82cf
build(deps): bump saucelabs/sauce-connect-action from 2.0.0 to 2.1.1
...
Bumps [saucelabs/sauce-connect-action](https://github.com/saucelabs/sauce-connect-action ) from 2.0.0 to 2.1.1.
- [Release notes](https://github.com/saucelabs/sauce-connect-action/releases )
- [Changelog](https://github.com/saucelabs/sauce-connect-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/saucelabs/sauce-connect-action/compare/v2.0.0...v2.1.1 )
---
updated-dependencies:
- dependency-name: saucelabs/sauce-connect-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2022-01-28 04:54:58 +00:00
35a182e053
ci: dependabot: Set `versioning-strategy` to `increase`
...
This keeps `package.json` in sync with `package-lock.json`.
2022-01-27 23:54:28 -05:00
63a02ec5fa
ci: Enable caching
2022-01-27 22:40:38 -05:00
3732565f83
ci: plugins: Bump saucelabs/sauce-connect-action
2022-01-27 22:40:38 -05:00
737464935e
ci: plugins: Enable dependabot
2022-01-27 22:05:47 -05:00
f02334e589
ci: plugins: Install plugin deps before core deps
2022-01-27 22:05:47 -05:00
e80e1c0221
ci: docker: Combine test and build+publish workflows
2022-01-27 22:05:47 -05:00
a6fcc92d2a
ci: docker: Set up Docker Buildx
...
This isn't required, but it's recommended everywhere I look.
2022-01-27 22:05:47 -05:00
3a31ebde4b
ci: docker: Style improvements
2022-01-27 22:05:47 -05:00
f334fb8280
ci: lockfile-lint: Whitelist specific sqlite version
2022-01-27 22:05:47 -05:00
f925b481c6
ci: lockfile-lint: Pass `--no-save` to npm
2022-01-27 22:05:47 -05:00
be36f764ad
deps: Update eslint-config-etherpad
2022-01-27 22:05:47 -05:00
47f5bbef1c
deps: Remove tiny-worker
...
It is not needed for modern versions of Node.js.
2022-01-27 02:15:47 -05:00
c586502e3c
deps: Bump marked to 4.0.12
2022-01-27 02:05:11 -05:00
9db3424403
deps: Bump rehype and rehype-minify-whitespace
2022-01-27 01:27:10 -05:00
1e604add99
deps: Require Node.js 12.17.0 or later
...
This makes it possible to use dynamic `import()`.
2022-01-27 01:27:10 -05:00
151f954fea
fix: upgrade rate-limiter-flexible from 2.3.5 to 2.3.6
...
Snyk has created this PR to upgrade rate-limiter-flexible from 2.3.5 to 2.3.6.
See this package in npm:
https://www.npmjs.com/package/rate-limiter-flexible
See this project in Snyk:
https://app.snyk.io/org/johnmclear/project/d9a12bfb-7ccd-443f-9e22-f30d339cc8c5?utm_source=github&utm_medium=referral&page=upgrade-pr
2022-01-26 20:05:06 -05:00
9b671efd5b
build(deps): bump node-fetch from 2.6.6 to 2.6.7 in /src
...
Bumps [node-fetch](https://github.com/node-fetch/node-fetch ) from 2.6.6 to 2.6.7.
- [Release notes](https://github.com/node-fetch/node-fetch/releases )
- [Commits](https://github.com/node-fetch/node-fetch/compare/v2.6.6...v2.6.7 )
---
updated-dependencies:
- dependency-name: node-fetch
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2022-01-26 20:03:19 -05:00
e44d1c4400
build(deps-dev): bump eslint-config-etherpad from 2.0.2 to 2.0.3 in /src
...
Bumps [eslint-config-etherpad](https://github.com/ether/eslint-config-etherpad ) from 2.0.2 to 2.0.3.
- [Release notes](https://github.com/ether/eslint-config-etherpad/releases )
- [Commits](https://github.com/ether/eslint-config-etherpad/compare/v2.0.2...v2.0.3 )
---
updated-dependencies:
- dependency-name: eslint-config-etherpad
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2022-01-26 20:02:42 -05:00
de66bd4799
build(deps): bump http-errors from 1.8.1 to 2.0.0 in /src
...
Bumps [http-errors](https://github.com/jshttp/http-errors ) from 1.8.1 to 2.0.0.
- [Release notes](https://github.com/jshttp/http-errors/releases )
- [Changelog](https://github.com/jshttp/http-errors/blob/master/HISTORY.md )
- [Commits](https://github.com/jshttp/http-errors/compare/1.8.1...v2.0.0 )
---
updated-dependencies:
- dependency-name: http-errors
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
2022-01-26 20:01:53 -05:00
abe8a98a4d
build(deps-dev): bump mocha from 9.1.3 to 9.2.0 in /src
...
Bumps [mocha](https://github.com/mochajs/mocha ) from 9.1.3 to 9.2.0.
- [Release notes](https://github.com/mochajs/mocha/releases )
- [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md )
- [Commits](https://github.com/mochajs/mocha/compare/v9.1.3...v9.2.0 )
---
updated-dependencies:
- dependency-name: mocha
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2022-01-27 00:58:49 +00:00
867922c8d8
build(deps): bump follow-redirects from 1.14.6 to 1.14.7 in /src
...
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects ) from 1.14.6 to 1.14.7.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases )
- [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.14.6...v1.14.7 )
---
updated-dependencies:
- dependency-name: follow-redirects
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2022-01-26 19:56:56 -05:00
ae9114f140
Edit settings.js
...
Added formal panics for invalid JSON.
2022-01-26 19:35:21 -05:00
578ae17aa8
Add docker & npm ecosystem to dependabot
2022-01-26 19:34:27 -05:00
315bcccc14
Localisation updates from https://translatewiki.net .
2022-01-24 13:03:53 +01:00
e4a336e875
plugins: Add npm packages to etherpad org
2022-01-20 20:33:24 -05:00
c7195b1133
docker: Add variables for cookie settings
2022-01-19 23:08:32 -05:00
861a929a43
docker: Sync `settings.json.docker` with `.template`
2022-01-19 23:06:56 -05:00
692749d1cf
express-session: Extend session lifetime if user is active
2022-01-17 21:45:56 -05:00
9c1f52f1b0
express-session: Install package from `@etherpad` scope
...
This allows us to use some in-progress features.
2022-01-17 21:45:56 -05:00
023e58cfe6
express-session: Set a finite cookie lifetime
2022-01-17 21:45:56 -05:00
ec10700dff
express-session: Don't save uninitialized sessions
...
This should avoid frivolous session records, such as when the user
gets a 404 (unless login was required to see the 404).
2022-01-17 21:45:56 -05:00
7255dd7ef0
express-session: Inherit proxy trust from Express
2022-01-17 21:45:56 -05:00
945e6848e2
SessionStore: Delete DB record when session expires
...
This only deletes records known to the current Etherpad instance --
old records from previous runs are not automatically cleaned up.
2022-01-17 21:45:56 -05:00
72cd983f0f
SessionStore: Option to update DB record on `touch()`
2022-01-17 21:45:52 -05:00
b991948e21
SessionStore: Don't write DB record if already expired
2022-01-17 21:33:58 -05:00
4d498725c7
SessionStore: Improve cookie expiration check
...
* Don't mutate `sess.cookie.expires`.
* Allow `sess.cookie` to be nullish.
* Always compare `Date` objects.
2022-01-17 18:17:40 -05:00
928c598ecf
tests: Add SessionStore backend tests
2022-01-17 17:51:08 -05:00
efab3aed0c
deps: Update ueberdb2 to 2.0.1 to get proper JSON support
2022-01-14 00:45:47 -05:00
d3984aa621
express: Move `preAuthorize` hook after `express-session`
...
The `ep_openid_connect` plugin needs access to session state before
authorization checks are made (to securely redirect the user back to
the start page when authentication completes). Now that the
`expressPreSession` hook exists, the rationale for moving
`preAuthorize` before the `express-session` middleware is gone.
This change undoes the following commits:
* bf35dcfc500b1ec20c5c30544b564e
2022-01-14 00:44:54 -05:00
75637708c0
express: Move up `cookie-parser` middleware
...
This makes it possible for the `preAuthorize` and `preExpressSession`
hooks to easily read or set cookies.
2022-01-14 00:44:54 -05:00
ab85db4426
webaccess: Silence prototype pollution warning
2022-01-14 00:44:54 -05:00
dcd43e9849
webaccess: Use `.startsWith()` instead of `.search()`
2022-01-14 00:44:54 -05:00
dependabot[bot]
Richard Hansen
snyk-bot
RichDavis1
Felix
translatewiki.net