eb9d5ceb46
Bump the github-actions group across 1 directory with 4 updates
...
Bumps the github-actions group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout ), [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ), [actions/setup-node](https://github.com/actions/setup-node ) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby ).
Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10 )
Updates `zizmorcore/zizmor-action` from 0.5.3 to 0.5.6
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/b1d7e1fb5de872772f31590499237e7cce841e8e...5f14fd08f7cf1cb1609c1e344975f152c7ee938d )
Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e )
Updates `ruby/setup-ruby` from 1.302.0 to 1.310.0
- [Release notes](https://github.com/ruby/setup-ruby/releases )
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb )
- [Commits](https://github.com/ruby/setup-ruby/compare/7372622e62b60b3cb750dcd2b9e32c247ffec26a...afeafc3d1ab54a631816aba4c914a0081c12ff2f )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.5.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
- dependency-name: actions/setup-node
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: ruby/setup-ruby
dependency-version: 1.310.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-06-13 05:52:46 +00:00
23ab2f6504
v2.1.19
2026-05-09 12:48:30 -04:00
6ba31fea45
Bump js-yaml from 3.14.1 to 3.14.2 ( #1313 )
...
Bumps [js-yaml](https://github.com/nodeca/js-yaml ) from 3.14.1 to 3.14.2.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md )
- [Commits](https://github.com/nodeca/js-yaml/compare/3.14.1...3.14.2 )
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 3.14.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-09 12:40:59 -04:00
644a02c880
dep: upgrade rangy to 1.3.2 ( #1312 )
2026-05-09 12:23:31 -04:00
a7c0e0945e
Bump qs from 6.14.0 to 6.15.1 ( #1311 )
...
Bumps [qs](https://github.com/ljharb/qs ) from 6.14.0 to 6.15.1.
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md )
- [Commits](https://github.com/ljharb/qs/compare/v6.14.0...v6.15.1 )
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.15.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-09 12:21:07 -04:00
ce80a5ef31
dep: upgrade DOMPurify to 3.4.2 from 3.2.7 ( #1310 )
2026-05-09 12:15:56 -04:00
50c5d4fecd
Bump @babel/plugin-transform-modules-systemjs from 7.23.9 to 7.29.4 ( #1308 )
...
Bumps [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs ) from 7.23.9 to 7.29.4.
- [Release notes](https://github.com/babel/babel/releases )
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md )
- [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs )
---
updated-dependencies:
- dependency-name: "@babel/plugin-transform-modules-systemjs"
dependency-version: 7.29.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-09 11:47:07 -04:00
95addeb72a
Bump lodash from 4.17.21 to 4.18.1 ( #1295 )
...
Bumps [lodash](https://github.com/lodash/lodash ) from 4.17.21 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases )
- [Commits](https://github.com/lodash/lodash/compare/4.17.21...4.18.1 )
---
updated-dependencies:
- dependency-name: lodash
dependency-version: 4.18.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-09 11:44:51 -04:00
c76aeb707f
Bump immutable from 5.1.3 to 5.1.5 ( #1292 )
...
Bumps [immutable](https://github.com/immutable-js/immutable-js ) from 5.1.3 to 5.1.5.
- [Release notes](https://github.com/immutable-js/immutable-js/releases )
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md )
- [Commits](https://github.com/immutable-js/immutable-js/compare/v5.1.3...v5.1.5 )
---
updated-dependencies:
- dependency-name: immutable
dependency-version: 5.1.5
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-09 11:44:43 -04:00
f325978dc0
Bump ip-address from 10.1.0 to 10.2.0 ( #1307 )
...
Bumps [ip-address](https://github.com/beaugunderson/ip-address ) from 10.1.0 to 10.2.0.
- [Commits](https://github.com/beaugunderson/ip-address/commits )
---
updated-dependencies:
- dependency-name: ip-address
dependency-version: 10.2.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-09 11:43:09 -04:00
d014617094
Bump basic-ftp from 5.0.5 to 5.2.2 ( #1299 )
...
Bumps [basic-ftp](https://github.com/patrickjuchli/basic-ftp ) from 5.0.5 to 5.2.2.
- [Release notes](https://github.com/patrickjuchli/basic-ftp/releases )
- [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md )
- [Commits](https://github.com/patrickjuchli/basic-ftp/compare/v5.0.5...v5.2.2 )
---
updated-dependencies:
- dependency-name: basic-ftp
dependency-version: 5.2.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-09 11:41:12 -04:00
cef0e47e67
Bump the github-actions group across 1 directory with 5 updates ( #1306 )
...
Bumps the github-actions group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `4.3.1` | `6.0.2` |
| [rhysd/actionlint](https://github.com/rhysd/actionlint ) | `1.7.11` | `1.7.12` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) | `0.5.2` | `0.5.3` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `3.9.1` | `6.3.0` |
| [ruby/setup-ruby](https://github.com/ruby/setup-ruby ) | `1.295.0` | `1.302.0` |
Updates `actions/checkout` from 4.3.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v4.3.1...de0fac2e4500dabe0009e67214ff5f5447ce83dd )
Updates `rhysd/actionlint` from 1.7.11 to 1.7.12
- [Release notes](https://github.com/rhysd/actionlint/releases )
- [Changelog](https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md )
- [Commits](https://github.com/rhysd/actionlint/compare/393031adb9afb225ee52ae2ccd7a5af5525e03e8...914e7df21a07ef503a81201c76d2b11c789d3fca )
Updates `zizmorcore/zizmor-action` from 0.5.2 to 0.5.3
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/71321a20a9ded102f6e9ce5718a2fcec2c4f70d8...b1d7e1fb5de872772f31590499237e7cce841e8e )
Updates `actions/setup-node` from 3.9.1 to 6.3.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/3235b876344d2a9aa001b8d1453c930bba69e610...53b83947a5a98c8d113130e565377fae1a50d02f )
Updates `ruby/setup-ruby` from 1.295.0 to 1.302.0
- [Release notes](https://github.com/ruby/setup-ruby/releases )
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb )
- [Commits](https://github.com/ruby/setup-ruby/compare/319994f95fa847cf3fb3cd3dbe89f6dcde9f178f...7372622e62b60b3cb750dcd2b9e32c247ffec26a )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.2
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: rhysd/actionlint
dependency-version: 1.7.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.5.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
- dependency-name: actions/setup-node
dependency-version: 6.3.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: ruby/setup-ruby
dependency-version: 1.302.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-09 11:38:35 -04:00
e24703d02a
Bump svgo from 2.8.0 to 2.8.2 ( #1289 )
...
Bumps [svgo](https://github.com/svg/svgo ) from 2.8.0 to 2.8.2.
- [Release notes](https://github.com/svg/svgo/releases )
- [Commits](https://github.com/svg/svgo/compare/v2.8.0...v2.8.2 )
---
updated-dependencies:
- dependency-name: svgo
dependency-version: 2.8.2
dependency-type: direct:development
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-09 11:37:08 -04:00
8ebedf23e1
Bump flatted from 3.2.9 to 3.4.2 ( #1291 )
...
Bumps [flatted](https://github.com/WebReflection/flatted ) from 3.2.9 to 3.4.2.
- [Commits](https://github.com/WebReflection/flatted/compare/v3.2.9...v3.4.2 )
---
updated-dependencies:
- dependency-name: flatted
dependency-version: 3.4.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-09 11:37:00 -04:00
17df7ea504
dep: minitest 6 is now supported by rails ( #1309 )
...
supersedes #1285
2026-05-09 11:35:55 -04:00
1c6a6998b7
Bump rollup from 2.79.1 to 2.80.0 ( #1290 )
...
Bumps [rollup](https://github.com/rollup/rollup ) from 2.79.1 to 2.80.0.
- [Release notes](https://github.com/rollup/rollup/releases )
- [Changelog](https://github.com/rollup/rollup/blob/v2.80.0/CHANGELOG.md )
- [Commits](https://github.com/rollup/rollup/compare/v2.79.1...v2.80.0 )
---
updated-dependencies:
- dependency-name: rollup
dependency-version: 2.80.0
dependency-type: direct:development
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-09 11:34:40 -04:00
da8869922e
v2.1.18
2026-03-26 18:15:26 -04:00
9c0a993d9f
Fix XSS via javascript: URI in JSON drag-drop deserialization ( #1293 )
...
StringPiece.fromJSON trusted href attributes from application/x-trix-document
JSON payloads, allowing javascript: URIs to reach the DOM via drag-and-drop in
Level0InputController. Add DOMPurify.isValidAttribute check to strip invalid
hrefs at deserialization time.
2026-03-26 18:08:38 -04:00
e62fcc3b58
ci: harden GitHub Actions workflows ( #1284 )
...
* Add GitHub Actions audit job (actionlint + zizmor)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* Configure dependabot for github-actions, npm, and bundler with batching and cooldowns
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* Add local GitHub Actions linting (actionlint + zizmor) to bin/setup and bin/ci
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* Pin all GitHub Actions to SHA hashes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* Fix zizmor findings: add permissions and persist-credentials: false
Set workflow-level permissions: {} and add per-job contents: read.
Add persist-credentials: false to all checkout steps.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-03-20 19:34:00 -04:00
2e46d5128f
v2.1.17
2026-03-11 14:11:48 -04:00
53197ab5a1
Merge pull request #1282 from basecamp/h1-3581911-serialized-attr
...
Fix stored XSS via data-trix-serialized-attributes bypass
2026-03-11 14:04:14 -04:00
3229c29c77
Fix stored XSS via data-trix-serialized-attributes sanitizer bypass (H1 #3581911 )
...
Strip `data-trix-serialized-attributes` in the DOMPurify `uponSanitizeAttribute`
hook before the `data-trix-*` force-keep logic runs.
This attribute is unique among `data-trix-*` attributes: it is the only one whose
value is later treated as trusted instructions to create arbitrary DOM attributes
via `el.setAttribute(name, value)` in the serialization code. No other `data-trix-*`
attribute has this XSS-enabling property:
- `data-trix-attachment` content is re-sanitized when rendered in AttachmentView
- `data-trix-attributes` is reduced to caption/presentation for attachment pieces
- The remaining internal markers (data-trix-id, data-trix-store-key, etc.) are
stripped or regenerated during serialization and never reach an executable sink
The fix is therefore narrowly scoped to `data-trix-serialized-attributes`. The
legitimate producer (PreviewableAttachmentView) sets this attribute at runtime on
live DOM elements and never goes through DOMPurify, so it is unaffected.
2026-03-11 13:38:41 -04:00
7069343612
Merge pull request #1239 from Cromian/patch-1
...
Update README.md
2026-03-03 09:16:47 -05:00
d9dbf0a27e
Merge pull request #1280 from basecamp/fix-bullets-merging-with-prior-element
...
Fix bullets merging with prior elements on Firefox when the first node is removed
2026-03-03 09:11:14 -05:00
bef13e2787
Fix bullets merging with prior elements when the first node is removed
2026-02-27 20:58:20 +01:00
194a36c5e8
Merge pull request #1275 from basecamp/flavorjones/wtr-failure-messages
...
Report web-test-runner test failures
2026-01-09 13:06:29 -05:00
c94abe6005
Use source-map to get better test failure messages
2026-01-09 12:59:23 -05:00
6f6ab9ac83
Test runner reporter emits failure details
...
Neglected to include failure reporting in c20a85d3😅
2026-01-09 12:59:23 -05:00
1d2d1a3b1a
Merge pull request #1276 from basecamp/flavorjones/ci-green-20260109
...
ci: get green (2026-01-09 edition)
2026-01-09 12:58:53 -05:00
2a8dbccd5c
Update the copyright in trix.js
...
without which the regeneration check fails
2026-01-09 12:51:51 -05:00
e31aae79e7
Add Ruby 4 to the testing matrix
...
and remove Ruby 3.2 testing against Rails main
2026-01-09 12:51:40 -05:00
ca6601633e
Get downstream Rails tests passing again
...
The leak checker is causing issues unless we externally set RACK_ENV,
see https://github.com/rails/rails/issues/56563
2026-01-09 12:51:05 -05:00
36a2c894ae
ci: enable workflow dispatch via the UI
2026-01-09 12:34:35 -05:00
32b10829e4
Merge pull request #1272 from basecamp/flavorjones/replace-karma-with-wtr
...
Replace Karma with `@web/test-runner`
2026-01-03 12:59:26 -05:00
c20a85d369
Add test progress reporting in local dev
...
WTR doesn't support per-test progress reporting, so let's use a
middleware endpoint as a callback to emit minitest-style test status.
In CI, though, we'll continue to use the default reporter because we
want to see per-browser results (via Sauce Labs) and don't care about
realtime progress.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2025-12-31 12:06:16 -05:00
4df5db69a1
Restore Android browser testing to Sauce Labs configuration
...
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2025-12-31 12:06:16 -05:00
bf3890805a
Replace Karma with @web/test-runner
...
while keeping QUnit and SauceLabs.
- SAUCE_REGION support to configure region
- tunnelIdentifier in sauce:options - to connect through the tunnel
- Local QUnit/fixtures serving - to avoid CDN issues through tunnel
- hostname: '0.0.0.0' - to allow Sauce Connect to reach WTR
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2025-12-31 12:06:11 -05:00
5c8b688fa3
v2.1.16
2025-12-30 14:37:23 -05:00
73c20cf03a
Fix XSS vulnerability in attachment href rendering
...
Validate attachment href attributes using DOMPurify.isValidAttribute()
before rendering them as anchor tags.
ref: https://hackerone.com/reports/3455133
2025-12-30 14:36:53 -05:00
07a5e47f67
Make "yarn version" commit changes to the ruby gem, too
2025-12-30 14:36:53 -05:00
17715149d5
Merge pull request #1271 from basecamp/flavorjones/ci-sauce-labs
...
ci: stabilize Sauce Labs with SC5 tunnel
2025-12-19 15:52:16 -05:00
04f803ed4b
ci: stabilize Sauce Labs with SC5 tunnel
2025-12-19 15:47:33 -05:00
93f5270c39
Merge pull request #1270 from basecamp/flavorjones/fix-minitest-errors
...
action_text-trix: pin minitest to < 6
2025-12-19 13:27:03 -05:00
31045c96af
action_text-trix: pin minitest to < 6
2025-12-19 13:10:12 -05:00
13eebdad4a
yarn build
2025-12-19 10:20:26 -05:00
696643d7c2
Merge pull request #1269 from basecamp/flavorjones/revert-mousedown-click-change
...
Revert "Toolbar Button: Handle `click` instead of `mousedown`"
2025-12-19 10:18:43 -05:00
42f69dd4c2
Revert "Toolbar Button: Handle click instead of mousedown"
...
This reverts commit 1f5ee5e8dahttps://github.com/basecamp/trix/pull/1201#issuecomment-3658082539 for
more context.
2025-12-15 18:53:10 -05:00
64afb411c9
Merge pull request #1265 from basecamp/rails-8-1-ci-matrix
...
Add `8-1-stable` branch to CI matrix
2025-12-15 18:39:24 -05:00
6f4c3efe09
Add 8-1-stable branch to CI matrix
...
[Rails 8.1. has been released][], so update the
`.github/workflows/ci.yml` to include entries for the new release.
[rails@8.1]: https://rubyonrails.org/2025/10/22/rails-8-1
2025-12-11 13:41:37 -05:00
1aa6c54a6a
Merge pull request #1263 from seanpdoyle/fix-action_text-trix-assets
...
Fix stale `app/assets/javascripts/trix.js` file
2025-11-03 06:11:03 +01:00
dependabot[bot]
Mike Dalessio
Stanko K.R.
Sean Doyle
Jorge Manrubia