jekyll-client-search 0.3.3 → 0.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 60acab6161a3d4eafb265742c337c86bbc26e444bc0ce202a02e5ce80049c3f0
-  data.tar.gz: bf05aa7d4945bb3e82acd8ab5127ab2e84bb457eb9868f79d235a8a5ce701a53
+  metadata.gz: 4bd0e3f73bbbf16d364c059483ad2ad40382232dda34ca1e8a0f83b0286fa605
+  data.tar.gz: 643dfe41f83ab07d100fa9f841e7b80f07ce1a8db5d5e3d2e5e43d4a29880a2e
 SHA512:
-  metadata.gz: cc8c5846be7c3a812a94c59aea41ecbb58c9672fa5948b4a306193e6d5914fc18f7104263f9a0ec84a1d405099dbc72dfc6c38c84cc3135133111b3f1c199ab8
-  data.tar.gz: e5eb813ed9b6dc1ba7abf34a96bbefa1c353453d8596d79dbf0f04290c7b502f18306419f4b5adc33712a8a18896def5fe0389293ffe43f7f7fbed2622083d6c
+  metadata.gz: 2e0e6fbfde2eaf9695f31bc4f79980f5a0d5e88b299253fde5523faa137be6606c60fecf25de2d2ed4b0e3e05d08d2afc5a9033346dd64b25c3dbde8156a44b4
+  data.tar.gz: b2cdf16bbca7714c81b6ce4a8054f94fa654a30d3e30f5c926fde2f0f3c312cc28ed66d249f3c9dcd38f03cbd9ccb40bf437ce6180c13f867928afa16c6a1f30

data/CHANGELOG.md

@@ -2,14 +2,68 @@
 
 ## Unreleased
 
+## 0.3.5 — 2026-10-06
+
+### Fixed
+
+- `LICENSE` now contains the verbatim AGPL-3.0 text (was a 22-line
+  stub that license scanners could not detect); README keeps the
+  copyright attribution.
+
+### Added
+
+- Codecov coverage reporting: CI uploads Cobertura XML (via `simplecov-cobertura`) from the Ruby 3.4 / Node 24 matrix job, with `codecov.yml` status checks (85% project/patch targets) and a README badge
+- `rake version:check_consistency` — two-axis drift check: doc floor
+  literals (`Ruby >= X.Y`, `TargetRubyVersion`) against the gemspec,
+  full `X.Y.Z` pins against `.ruby-version`. `rake version:pre_release`
+  runs it with `check_changelog`.
+
+### Changed
+
+- `release.yml` no longer hardcodes the Ruby pin — `setup-ruby` reads
+  `.ruby-version` (single source for dev/release; the 3.2 floor stays a
+  deliberate gemspec literal proven by the CI matrix).
+- `rbenv` instructions in README/README.developer.md now derive from
+  `.ruby-version` instead of restating the pin.
+- Git hooks moved to tracked `bin/hooks/` enabled via `core.hooksPath`
+  — `bin/install-hooks.sh` no longer generates copies into `.git/hooks`.
+- `spec/spec_helper.rb` autoloads `spec/support/**/*.rb`.
+- Removed stale literal counts from docs (test examples, Semgrep rule
+  counts) — numbers that change on their own aren't restated.
+
+### Security
+
+- Dev-tooling audit gate: `scripts/npm-audit.mjs` + `.audit-allow.json`
+  replace the bare `npm audit` CI step — patchable transitive deps are
+  forced to fixed versions via `overrides` (smol-toml, katex), and only
+  explicitly allowlisted unpatched advisories are tolerated (braces,
+  dev-only, no patched release).
+
+## 0.3.4 — 2026-09-11
+
+### Added
+
+- SonarQube Cloud badge in README.md (project key: `gundestrup_jekyll-client-search`)
+
+### Fixed
+
+- Verify `event.origin` in transformers-worker.js `message` listener to prevent cross-origin message injection (SonarQube: `javascript:S2819`, CRITICAL)
+- Add `--ignore-scripts` to `npm ci` in CI to prevent lifecycle script execution during dependency installation (SonarQube: `githubactions:S6505`)
+- Pin Semgrep to `1.176.0` with `--only-binary :all:` in CI to prevent setup script execution and lock resolved versions (SonarQube: `githubactions:S8541`, `githubactions:S8544`)
+- Wrap `normalize` and `resultElement` callbacks in anonymous functions in `.map()` calls to avoid passing unexpected iterator arguments (SonarQube: `javascript:S7727`)
+- Wrap `search` callback in anonymous function in `.forEach()` call in benchmark (SonarQube: `javascript:S7727`)
+- Replace `parseInt` with `Number.parseInt` in dropdown and related runtimes (SonarQube: `javascript:S7773`)
+
 ## 0.3.3 — 2026-09-11
 
 ### Refactored
+
 - Extract duplicated `normalize` function from `client-search-base.js` and `client-search-dropdown.js` into new shared module `assets/client-search-shared.js` (exposes `window.ClientSearchShared.normalize` and `window.ClientSearchShared.coreFields`) — eliminates CodeFactor duplicate-code finding and ensures consistent normalization across both runtimes
 
 ## 0.3.2 — 2026-09-10
 
 ### Added
+
 - Semgrep security scan in CI (`semgrep ci` job in `.github/workflows/ci.yml`) — runs on every push and pull request using the `SEMGREP_APP_TOKEN` secret and the Semgrep Pro engine with the organization's full policy (2,900+ rules)
 - `.semgrep.yml` with custom Ruby ReDoS detection rules and usage documentation
 - Semgrep step in pre-commit hook (`bin/install-hooks.sh`)
@@ -19,20 +73,24 @@
 - Semgrep usage guide in README.developer.md (local commands, nosemgrep annotations, SHA pinning)
 
 ### Fixed
+
 - Pin all GitHub Actions to full 40-character commit SHAs with version comments to prevent supply-chain attacks via mutable tag repointing (Semgrep: `github-actions-mutable-action-tag`)
 - Replace `Object.assign({}, entry, ...)` in benchmark with explicit field construction to avoid mass-assignment taint (Semgrep: `insecure-object-assign`)
 - Replace manual arXiv query string with `URI.encode_www_form` for correct URL encoding (Semgrep: `avoid-tainted-http-request`)
 
 ### Changed
+
 - Add `nosemgrep` annotations with justifications for false positives (static ERB template, array-form `Open3.capture2`, fixed-host arXiv request) and acceptable risks (local loopback Ollama HTTP in tests and benchmarks)
 
 ## 0.3.1 — 2026-09-09
 
 ### Fixed
+
 - Fix CodeQL `rb/bad-tag-filter` (high) in `DocumentBuilder#clean` — closing tag regex `</script\s*>` only matched whitespace before `>`, missing browser-accepted tags like `</script\t\n bar>`; changed to `</script[^>]*>` and `</style[^>]*>` to match any non-`>` content
 - Fix CodeQL `rb/polynomial-redos` (high) in `RelatedTag` — `\s*` patterns between optional groups in SYNTAX regex caused O(n²) backtracking on input with many spaces; replaced single regex with token-split parser that validates each token individually
 
 ### Changed
+
 - Update `simplecov` 1.1.1 → 1.2.0
 - Update `google-protobuf` 4.36.0 → 4.36.1 (transitive)
 - Update `sass-embedded` 1.103.1 → 1.104.0 (transitive)
@@ -42,6 +100,7 @@
 ## 0.3.0 — 2026-09-02
 
 ### Added
+
 - `{% search_dropdown %}` Liquid tag — compact live-search dropdown for navbars and headers with keyboard navigation (Arrow/Enter/Escape), lazy index loading, icon support, and framework-agnostic semantic HTML (no Bulma/Bootstrap/Tailwind classes)
 - `DropdownConfiguration` class with `enabled`, `max_items`, `min_chars`, `debounce_ms`, `redirect_url` options
 - `assets/client-search-dropdown.js` runtime (434 lines) — two-stage search (AND first, fuzzy OR fallback), shared index cache with the base runtime, multi-instance support via `[data-client-search-dropdown]` attributes, icon rendering from `icon_field`
@@ -56,6 +115,7 @@
 - System test assertions for embeddings/retrieval content matching and non-ASCII query robustness
 
 ### Changed
+
 - `related.max_items` default changed from `nil` (unlimited) to `5`
 - `Configuration#initialize` refactored — extracted `normalize_configured` helper for cleaner config validation
 - Runtime config page now merges `dropdown` config alongside `liveSearch`
@@ -67,6 +127,7 @@
 - README.md updated with dropdown section, related `max:N` docs, and CSS styling examples for dropdown
 
 ### Fixed
+
 - `SearchTag#render` no longer raises on nil site (now returns empty string)
 - `RelatedTag#render` no longer raises on nil site or `client_search: false` config
 - Meta test race condition — `forEach` callback couldn't `await settle()`, causing flaky cross-engine comparisons; fixed by switching to `for` loops
@@ -74,6 +135,7 @@
 ## 0.2.0 — 2026-08-27
 
 ### Added
+
 - Generic `passthrough_fields` config option: external plugins declare which document `data` fields to forward into the search index (e.g. `file_type`, `icon_url`, `icon_set` from jekyll-documents)
 - Field renaming in `passthrough_fields`: entries can be strings (same name) or hashes (`{source => target}`) for integration with other search conventions
 - `icon_field` config option (default: `"icon_url"`): tells the browser runtime which field to render as an `<img>` icon before the result title; set to `null` to disable
@@ -81,10 +143,12 @@
 - Result `<article>` elements carry `data-source`, `data-categories`, `data-tags`, plus `data-*` for all passthrough fields (snake_case → data-kebab-case) for CSS-based result customization
 
 ### Fixed
+
 - Allow whitespace in script/style end tags in `DocumentBuilder#clean` (`</script\s*>` instead of `</script>`) — CodeQL: bad HTML filtering regexp
 - Fix polynomial ReDoS in `SearchTag` and `RelatedTag` syntax regexes — strip markup before matching, remove leading/trailing `\s*` patterns that caused O(n²) backtracking (CodeQL: polynomial regex on uncontrolled data)
 
 ### Changed
+
 - Simplified release workflow to tag-push trigger (`push: tags: v*`) — no manual `gh release create` needed
 - Switched to RubyGems trusted publishing (`rubygems/release-gem@v1` with OIDC)
 - Centralized version in `version.rb` as single source of truth — removed `version` field from `package.json`