trusty-cms 7.1.2 → 7.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8f28f9884a07d4a5b4c582c2e490af233fa40d9e275bf531c0e103f8a16fb1d2
-  data.tar.gz: 1296987f36ad6cdd537e654978fca42b74519b1c727474c3725d1e81afc6a662
+  metadata.gz: 9f50633a419203ee6b0b6e35814de7af711b70dd362d5fe0f712543d31f1fc75
+  data.tar.gz: f5ccf44bd927e9a392e9979388c9d6f65ace4c1f965516d64936ee1da5e50d53
 SHA512:
-  metadata.gz: 30e7296886c47d33276f7612b24c24a310a45c99c60c7907b52bdbf6b11c264c8ae4705ccfe4e187c7b0bd2d11cc6077d12ad7f54e9e9e3cf413a283bd7211a3
-  data.tar.gz: f41957d9f3c0e03e8e4af00eda15710e577350659aa7b41f6182c01b31d9e8db3d326c9fe791dd009b5cae6c92ef1bc564597bd5fc0815fb4c0b2c9f283e5d9a
+  metadata.gz: 8324822cde6d47651420dc28038f51e629e1b411c276a0ddded87dac9587a571de5218e36452f929d0e5c55c4106aa47a21cf72f14e06c78b545c849cfafed6a
+  data.tar.gz: 4e4dc362cd53e8124eaba08331db95eb085fe28b8778776ceef121a7e3b993f379b26d2c56c17538962adca2e2b47eb0e834c16d6f67f4a45b4a6cbab9a33cb3

data/Gemfile

@@ -16,18 +16,19 @@ group :development, :test do
   gem 'acts_as_list'
   gem 'database_cleaner'
   gem 'devise-two-factor'
-  gem 'factory_bot_rails', '6.4.4'
+  gem 'factory_bot_rails', '6.5.1'
   gem 'file_validators'
   gem 'jsbundling-rails', '~> 1.3'
   gem 'launchy', '~> 3.0.1'
   gem 'mysql2'
   gem 'paper_trail', '~> 16.0.0'
-  gem 'paper_trail-association_tracking', '~> 2.2.1'
+  gem 'paper_trail-association_tracking', '~> 2.3.0'
   gem 'poltergeist', '~> 1.18.1'
   gem 'pry-byebug'
-  gem 'psych', '5.2.2'
+  gem 'psych', '5.4.0'
   gem 'rails-observers'
   gem 'ransack'
+  gem 'rspec_junit_formatter'
   gem 'rspec-rails', '~> 7.1.1'
   gem 'simplecov'
   gem 'simplecov-lcov'

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    trusty-cms (7.1.2)
+    trusty-cms (7.1.3)
       RedCloth (= 4.3.4)
       activestorage-validator
       acts_as_list (>= 0.9.5, < 1.3.0)
@@ -24,15 +24,15 @@ PATH
       mutex_m
       mysql2
       paper_trail (~> 16.0.0)
-      paper_trail-association_tracking (~> 2.2.1)
-      psych (= 5.2.2)
+      paper_trail-association_tracking (>= 2.2.1, < 2.4.0)
+      psych (= 5.4.0)
       rack (>= 2.0.1, < 3.2.0)
       rack-cache (~> 1.7)
       radius (~> 0.8)
       rails (~> 7.2.2.1)
       rake (< 14.0)
       ransack (~> 4.2.1)
-      rdoc (>= 5.1, < 7.0)
+      rdoc (>= 5.1, < 9.0)
       roadie-rails
       rqrcode
       sass-rails
@@ -119,7 +119,7 @@ GEM
       minitest (>= 5.1)
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
-    acts_as_list (1.2.4)
+    acts_as_list (1.2.6)
       activerecord (>= 6.1)
       activesupport (>= 6.1)
     acts_as_tree (2.9.1)
@@ -131,7 +131,8 @@ GEM
     benchmark (0.5.0)
     bigdecimal (4.1.2)
     builder (3.3.0)
-    byebug (11.1.3)
+    byebug (13.0.0)
+      reline (>= 0.6.0)
     capybara (3.40.0)
       addressable
       matrix
@@ -146,11 +147,12 @@ GEM
     chunky_png (1.4.0)
     cliver (0.3.2)
     coderay (1.1.3)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.7)
     connection_pool (3.0.2)
-    crass (1.0.6)
-    css_parser (1.22.0)
+    crass (1.0.7)
+    css_parser (3.0.0)
       addressable
+      ssrf_filter (~> 1.5)
     csso-rails (0.9.0)
       execjs (>= 1)
     csv (3.3.0)
@@ -181,11 +183,11 @@ GEM
     erb (6.0.4)
     erubi (1.13.1)
     execjs (2.10.0)
-    factory_bot (6.5.0)
-      activesupport (>= 5.0.0)
-    factory_bot_rails (6.4.4)
+    factory_bot (6.6.0)
+      activesupport (>= 6.1.0)
+    factory_bot_rails (6.5.1)
       factory_bot (~> 6.5)
-      railties (>= 5.0.0)
+      railties (>= 6.1.0)
     ffi (1.17.0-aarch64-linux-gnu)
     ffi (1.17.0-aarch64-linux-musl)
     ffi (1.17.0-arm-linux-gnu)
@@ -216,7 +218,7 @@ GEM
       csv
       mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
-    i18n (1.14.8)
+    i18n (1.15.2)
       concurrent-ruby (~> 1.0)
     image_processing (1.13.0)
       mini_magick (>= 4.9.5, < 5)
@@ -246,7 +248,7 @@ GEM
     libv8-node (18.19.0.0-x86_64-linux)
     libv8-node (18.19.0.0-x86_64-linux-musl)
     logger (1.7.0)
-    loofah (2.25.1)
+    loofah (2.25.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     mail (2.8.1)
@@ -284,46 +286,47 @@ GEM
     net-smtp (0.5.1)
       net-protocol
     nio4r (2.7.4)
-    nokogiri (1.19.3)
+    nokogiri (1.19.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.19.3-aarch64-linux-gnu)
+    nokogiri (1.19.4-aarch64-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.19.3-aarch64-linux-musl)
+    nokogiri (1.19.4-aarch64-linux-musl)
       racc (~> 1.4)
-    nokogiri (1.19.3-arm-linux-gnu)
+    nokogiri (1.19.4-arm-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.19.3-arm-linux-musl)
+    nokogiri (1.19.4-arm-linux-musl)
       racc (~> 1.4)
-    nokogiri (1.19.3-arm64-darwin)
+    nokogiri (1.19.4-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.3-x86_64-darwin)
+    nokogiri (1.19.4-x86_64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.3-x86_64-linux-gnu)
+    nokogiri (1.19.4-x86_64-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.19.3-x86_64-linux-musl)
+    nokogiri (1.19.4-x86_64-linux-musl)
       racc (~> 1.4)
     orm_adapter (0.5.0)
     paper_trail (16.0.0)
       activerecord (>= 6.1)
       request_store (~> 1.4)
-    paper_trail-association_tracking (2.2.1)
+    paper_trail-association_tracking (2.3.0)
       paper_trail (>= 12.0)
     poltergeist (1.18.1)
       capybara (>= 2.1, < 4)
       cliver (~> 0.3.1)
       websocket-driver (>= 0.2.0)
-    pp (0.6.3)
+    pp (0.6.4)
       prettyprint
     prettyprint (0.2.0)
     prism (1.9.0)
-    pry (0.14.2)
+    pry (0.16.0)
       coderay (~> 1.1)
       method_source (~> 1.0)
-    pry-byebug (3.10.1)
-      byebug (~> 11.0)
-      pry (>= 0.13, < 0.15)
-    psych (5.2.2)
+      reline (>= 0.6.0)
+    pry-byebug (3.12.0)
+      byebug (~> 13.0)
+      pry (>= 0.13, < 0.17)
+    psych (5.4.0)
       date
       stringio
     public_suffix (7.0.5)
@@ -357,8 +360,8 @@ GEM
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.7.0)
-      loofah (~> 2.25)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
     rails-observers (0.1.5)
       activemodel (>= 4.0)
@@ -375,9 +378,14 @@ GEM
       activerecord (>= 6.1.5)
       activesupport (>= 6.1.5)
       i18n
-    rdoc (6.17.0)
+    rbs (4.0.3)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rdoc (8.0.0)
       erb
-      psych (>= 4.0.0)
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
       tsort
     regexp_parser (2.9.2)
     reline (0.6.3)
@@ -387,17 +395,17 @@ GEM
     responders (3.2.0)
       actionpack (>= 7.0)
       railties (>= 7.0)
-    roadie (5.2.1)
-      css_parser (~> 1.4)
+    roadie (5.3.1)
+      css_parser (>= 1.4, < 4.0)
       nokogiri (~> 1.15)
-    roadie-rails (3.3.0)
-      railties (>= 5.1, < 8.1)
+    roadie-rails (3.4.0)
+      railties (>= 5.1, < 8.2)
       roadie (~> 5.0)
     rotp (6.3.0)
-    rqrcode (3.1.0)
+    rqrcode (3.2.0)
       chunky_png (~> 1.0)
       rqrcode_core (~> 2.0)
-    rqrcode_core (2.0.0)
+    rqrcode_core (2.1.0)
     rspec-core (3.13.4)
       rspec-support (~> 3.13.0)
     rspec-expectations (3.13.5)
@@ -415,6 +423,8 @@ GEM
       rspec-mocks (~> 3.13)
       rspec-support (~> 3.13)
     rspec-support (3.13.4)
+    rspec_junit_formatter (0.6.0)
+      rspec-core (>= 2, < 4, != 2.12.0)
     ruby-vips (2.2.2)
       ffi (~> 1.12)
       logger
@@ -443,6 +453,7 @@ GEM
       actionpack (>= 6.1)
       activesupport (>= 6.1)
       sprockets (>= 3.0.0)
+    ssrf_filter (1.5.0)
     stringex (2.8.6)
     stringio (3.2.0)
     temple (0.10.3)
@@ -456,11 +467,11 @@ GEM
       concurrent-ruby (~> 1.0)
     uglifier (4.2.1)
       execjs (>= 0.3.0, < 3)
-    uri (1.0.2)
+    uri (1.0.4)
     useragent (0.16.11)
     warden (1.2.9)
       rack (>= 2.0.9)
-    websocket-driver (0.8.0)
+    websocket-driver (0.8.2)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
@@ -486,19 +497,20 @@ DEPENDENCIES
   acts_as_list
   database_cleaner
   devise-two-factor
-  factory_bot_rails (= 6.4.4)
+  factory_bot_rails (= 6.5.1)
   file_validators
   jsbundling-rails (~> 1.3)
   launchy (~> 3.0.1)
   mysql2
   paper_trail (~> 16.0.0)
-  paper_trail-association_tracking (~> 2.2.1)
+  paper_trail-association_tracking (~> 2.3.0)
   poltergeist (~> 1.18.1)
   pry-byebug
-  psych (= 5.2.2)
+  psych (= 5.4.0)
   rails-observers
   ransack
   rspec-rails (~> 7.1.1)
+  rspec_junit_formatter
   simplecov
   simplecov-lcov
   trusty-cms!

data/README.md

@@ -12,6 +12,8 @@ Rails engine and is built to be installed into an existing Rails 7 application a
 
 CircleCI: [![CircleCI](https://circleci.com/gh/pgharts/trusty-cms/tree/master.svg?style=shield)](https://circleci.com/gh/pgharts/trusty-cms/tree/master)
 
+Coverage: [![Coverage](https://qlty.sh/badges/4cf4f7cc-d0e8-4559-93ec-685866f5645b/test_coverage.svg)](https://qlty.sh/gh/pgharts/projects/trusty-cms) 
+
 Qlty: [![Maintainability](https://qlty.sh/gh/pgharts/projects/trusty-cms/maintainability.svg)](https://qlty.sh/gh/pgharts/projects/trusty-cms)
 
 TrustyCMS features:

data/app/controllers/admin/resource_controller.rb

@@ -42,7 +42,7 @@ class Admin::ResourceController < ApplicationController
     r.update.publish(:xml, :json) { head :ok }
     r.update.default { redirect_to redirect_url }
 
-    r.destroy.publish(:xml, :json) { head :deleted }
+    r.destroy.publish(:xml, :json) { head :ok }
     r.destroy.default { redirect_to redirect_url }
   end
 

data/app/controllers/application_controller.rb

@@ -5,6 +5,14 @@ class ApplicationController < ActionController::Base
   prepend_view_path("#{TRUSTY_CMS_ROOT}/app/views")
 
   protect_from_forgery with: :exception
+  # Capture the request host before authentication runs so the site-scope logout
+  # telemetry (issue #1040) can compare the host's site to the (global) current
+  # site. Thread.current is per-thread and safe across concurrent requests —
+  # unlike the class-level Page.current_site the telemetry is investigating.
+  # An around_action (prepended so it wraps authenticate_user!) guarantees the
+  # value is cleared even if the request raises, so it can't leak into the next
+  # request handled by the same thread.
+  prepend_around_action :with_request_host_for_telemetry
   before_action :authenticate_user!
   before_action :configure_permitted_parameters, if: :devise_controller?
   before_action :set_timezone
@@ -53,6 +61,13 @@ class ApplicationController < ActionController::Base
 
   private
 
+  def with_request_host_for_telemetry
+    Thread.current[:trusty_request_host] = request.host
+    yield
+  ensure
+    Thread.current[:trusty_request_host] = nil
+  end
+
   def set_mailer
     ActionMailer::Base.default_url_options[:host] = request.host_with_port
   end

data/app/models/asset.rb

@@ -83,8 +83,17 @@ class Asset < ActiveRecord::Base
     self[:asset_file_size]
   end
 
-  delegate :active_storage_styles, :style_dimensions, :style_format,
-           to: :asset_type
+  def active_storage_styles
+    asset_type&.active_storage_styles || {}
+  end
+
+  def style_dimensions(style_name)
+    asset_type&.style_dimensions(style_name)
+  end
+
+  def style_format(style_name)
+    asset_type&.style_format(style_name)
+  end
 
   def pdf?
     content_type == 'application/pdf'
@@ -340,13 +349,28 @@ class Asset < ActiveRecord::Base
 
   # this is a convenience for image-pickers
   def self.thumbnail_options
-    asset_sizes = thumbnail_sizes.map do |k, v|
+    # The :original style is represented by the explicit entry prepended below,
+    # so skip it here to avoid a duplicate (and blank) "original" option.
+    asset_sizes = thumbnail_sizes.reject { |k, _| k.to_sym == :original }.map do |k, v|
       size_id = k
-      size_description = "#{k}: "
-      size_description << (v.is_a?(Array) ? v.join(' as ') : v)
+      size_description = "#{k}: #{describe_style(v)}"
       [size_description, size_id]
     end.sort_by { |pair| pair.last.to_s }
     asset_sizes.unshift ['Original (as uploaded)', 'original']
     asset_sizes
   end
+
+  # Renders a style definition into a short human-readable description for a
+  # picker. ActiveStorage styles are hashes (e.g. {geometry: '100x100#',
+  # format: :png}); older definitions may be arrays or plain strings.
+  def self.describe_style(style)
+    case style
+    when Hash
+      [style[:geometry], style[:format]].compact.join(' as ')
+    when Array
+      style.join(' as ')
+    else
+      style.to_s
+    end
+  end
 end

data/app/models/standard_tags.rb

@@ -52,8 +52,7 @@ module StandardTags
   }
   tag 'children:count' do |tag|
     options = children_find_options(tag)
-    options.delete(:order) # Order is irrelevant
-    tag.locals.children.count(options)
+    tag.locals.children.where(options[:conditions]).count
   end
 
   desc %{
@@ -66,7 +65,7 @@ module StandardTags
   }
   tag 'children:first' do |tag|
     options = children_find_options(tag)
-    children = tag.locals.children.where(options)
+    children = tag.locals.children.where(options[:conditions]).order(options[:order])
     if first = children.first
       tag.locals.page = first
       tag.expand
@@ -83,7 +82,7 @@ module StandardTags
   }
   tag 'children:last' do |tag|
     options = children_find_options(tag)
-    children = tag.locals.children.where(options)
+    children = tag.locals.children.where(options[:conditions]).order(options[:order])
     if last = children.last
       tag.locals.page = last
       tag.expand
@@ -942,7 +941,14 @@ module StandardTags
     paging = pagination_find_options(tag)
     result = []
     tag.locals.previous_headers = {}
-    displayed_children = paging ? findable.paginate(options.merge(paging)) : findable.all.where(options[:conditions]).order(options[:order])
+    scoped = findable.where(options[:conditions]).order(options[:order])
+    if paging
+      displayed_children = scoped.paginate(paging)
+    else
+      scoped = scoped.limit(options[:limit]) if options[:limit]
+      scoped = scoped.offset(options[:offset]) if options[:offset]
+      displayed_children = scoped
+    end
     displayed_children.each_with_index do |item, i|
       tag.locals.child = item
       tag.locals.page = item
@@ -989,13 +995,13 @@ module StandardTags
 
     status = attr[:status]
     if status == 'all'
-      options[:conditions] = ['virtual = ?', false]
+      options[:conditions] = ['`virtual` = ?', false]
     else
       stat = Status[status]
       if stat.nil?
         raise TagError.new(%{`status' attribute of `each' tag must be set to a valid status})
       else
-        options[:conditions] = ['(virtual = ?) and (status_id = ?)', false, stat.id]
+        options[:conditions] = ['(`virtual` = ?) and (status_id = ?)', false, stat.id]
       end
     end
     options

data/app/models/user.rb

@@ -1,3 +1,5 @@
+require 'trusty_cms/site_scope_auth_reporter'
+
 class User < ActiveRecord::Base
   has_many :pages, foreign_key: :created_by_id
   self.table_name = 'admins'
@@ -78,4 +80,15 @@ class User < ActiveRecord::Base
     errors.add :password, 'Complexity requirement not met. Length should be 12 characters and include: 1 uppercase, 1 lowercase, 1 digit and 1 special character.'
   end
 
+  # Observe-only instrument for the intermittent logout bug (issue #1040). This
+  # keeps Devise's exact (site-scoped) behavior — it returns the scoped lookup
+  # unchanged, so a mismatch still logs the user out exactly as before — and only
+  # reports when a valid user was excluded by the site scope. See
+  # TrustyCms::SiteScopeAuthReporter. The behavior-change fix is separate (PR #1041).
+  def self.serialize_from_session(key, salt)
+    record = to_adapter.get(key)
+    TrustyCms::SiteScopeAuthReporter.report_miss(key) if record.nil?
+    record if record && record.authenticatable_salt == salt
+  end
+
 end

data/lib/trusty_cms/site_scope_auth_reporter.rb

@@ -0,0 +1,108 @@
+module TrustyCms
+  # Observe-only telemetry for the intermittent CMS logout bug (diagnostic for
+  # issue #1040). It changes NO behavior.
+  #
+  # When the multi_site extension is active, `User` carries a site-scoped
+  # default_scope (an INNER JOIN on admins_sites for `Page.current_site`).
+  # Devise deserializes the session user every request through that scope, so if
+  # `current_site` points at a site the user is not assigned to, the lookup
+  # returns nil and the user is logged out. Because `current_site` is
+  # process-global mutable state shared across Puma threads, we suspect this is
+  # usually a race (the user IS on a site they belong to, but the global was
+  # clobbered by a concurrent request for another host).
+  #
+  # This reporter fires only when a session lookup misses BUT the user actually
+  # exists (unscoped) — i.e. a valid user was excluded by the site scope — and
+  # records enough context to tell a race from a genuine cross-site access or an
+  # unmatched-host fallback. It never raises into the auth path.
+  module SiteScopeAuthReporter
+    MESSAGE = 'CMS site-scope logout (possible current_site race)'.freeze
+
+    module_function
+
+    def report_miss(key)
+      return unless multi_site_scoped?
+
+      excluded = User.unscoped { User.to_adapter.get(key) }
+      return if excluded.nil? # ordinary unknown/expired session — not our bug
+
+      context = build_context(excluded)
+      Rails.logger.warn("[multi_site] #{MESSAGE} #{context.to_json}")
+      Honeybadger.notify(MESSAGE, context: context) if defined?(Honeybadger)
+      nil
+    rescue StandardError => e
+      # Telemetry must never break authentication.
+      Rails.logger.error("[multi_site] SiteScopeAuthReporter error: #{e.class}: #{e.message}")
+      nil
+    end
+
+    # Only meaningful when User is actually site-scoped by the multi_site
+    # extension; otherwise the scoped and unscoped lookups are identical.
+    def multi_site_scoped?
+      User.respond_to?(:is_site_scoped?) && User.is_site_scoped?
+    end
+
+    def build_context(user)
+      current = current_site
+      host = Thread.current[:trusty_request_host]
+      expected = expected_site_for(host)
+      site_ids = user.site_ids
+
+      {
+        user_id: user.id,
+        user_admin: user.admin?,
+        user_site_ids: site_ids,
+        current_site_id: current&.id,
+        current_site_name: current&.name,
+        current_site_domain_blank: current.present? && current.domain.blank?,
+        request_host: host,
+        expected_site_id: expected&.id,
+        expected_site_name: expected&.name,
+        classification: classify(site_ids, current, expected, host),
+        thread: Thread.current.object_id,
+        at: Time.now.utc.iso8601,
+      }
+    end
+
+    # race               -> user belongs to the host's site, but current_site is
+    #                       something else (the global was clobbered)
+    # genuine_cross_site -> user hit a host whose site they are not assigned to
+    # host_unmatched     -> request host matched no site (asset/unknown host);
+    #                       current_site falls back to the default site
+    # no_host_captured   -> ran outside a captured request (e.g. rake/console)
+    def classify(site_ids, current, expected, host)
+      return 'no_host_captured' if host.blank?
+      return 'host_unmatched' if expected.nil?
+      return 'race' if site_ids.include?(expected.id) && (current.nil? || site_ids.exclude?(current.id))
+      return 'genuine_cross_site' if site_ids.exclude?(expected.id)
+
+      'unknown'
+    end
+
+    def current_site
+      Page.current_site if Page.respond_to?(:current_site)
+    end
+
+    # Mirrors Site.find_for_host's matching but WITHOUT the Site.default /
+    # catchall fallback, so telemetry never creates a record and returns nil when
+    # the host matches no site (which is what drives the host_unmatched
+    # classification). A blank domain compiles to a regexp that matches every
+    # host, so blank domains are matched only by exact base_domain, never by the
+    # regexp.
+    def expected_site_for(host)
+      return nil if host.blank?
+
+      Site.all.detect do |site|
+        host == site.base_domain || domain_regexp_match?(site, host)
+      end
+    end
+
+    def domain_regexp_match?(site, host)
+      return false if site.domain.blank?
+
+      !(host =~ Regexp.compile(site.domain)).nil?
+    rescue RegexpError
+      false
+    end
+  end
+end

data/lib/trusty_cms/version.rb

@@ -1,3 +1,3 @@
 module TrustyCms
-  VERSION = '7.1.2'.freeze
+  VERSION = '7.1.3'.freeze
 end

data/package.json

@@ -22,7 +22,7 @@
     "tablesaw": "^3.1.2"
   },
   "devDependencies": {
-    "esbuild": "^0.25.0",
+    "esbuild": "^0.28.1",
     "stylelint": "^13.3.2",
     "stylelint-config-recommended": "^3.0.0",
     "stylelint-order": "^4.0.0",