@autobusal/common 1.4.3 → 1.4.5

package/BlogItem/BlogItem.tsx

@@ -1,5 +1,6 @@
 import { TFunction } from 'i18next';
 import { FiCalendar } from 'react-icons/fi';
+import { sanitizeHtml } from '@autobusal/utilities';
 import Image from './Image';
 import { LinkTitle, Details, DisplayDate, TextPreview, TextView, ButtonLink } from './styles';
 import { ArticleData } from '@autobusal/providers/types/articles';
@@ -33,7 +34,7 @@ const BlogItem = ({ article, type, t }: Props): JSX.Element => (
       </TextPreview>
     ) }
 
-    { type === 'view' && <TextView dangerouslySetInnerHTML={{ __html: article.content }} /> }
+    { type === 'view' && <TextView dangerouslySetInnerHTML={{ __html: sanitizeHtml(article.content) }} /> }
   </div>
 );
 

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to `@autobusal/common` are documented here. This project follows
 [Keep a Changelog](https://keepachangelog.com/) and [Semantic Versioning](https://semver.org/).
 
+## [1.4.5] - 2026-07-28
+
+### Fixed
+
+- `File/File.tsx`: a `required` file-input field blocked saving ANY record that already had a file (image, document, etc.) unless the user re-uploaded it, since a file input can never carry over its previous value - the `required` rule now skips when a `value` (existing file URL) is already present. Found via a live sanity pass: this froze several existing records (e.g. a bus with a real image) out of being editable at all.
+
+## [1.4.4] - 2026-07-24
+
+### Fixed
+
+- `BlogItem.tsx` and `Policy.tsx`: article/policy content is now run through `@autobusal/utilities`'s `sanitizeHtml` before being rendered via `dangerouslySetInnerHTML`, closing an XSS gap where an already-compromised admin account could persist JS in blog articles or policy pages.
+
 ## [1.4.3] - 2026-07-19
 
 ### Changed

package/File/File.tsx

@@ -24,6 +24,13 @@ const File = ({ name, value, validation, multiple, t, refs }: Props): JSX.Elemen
 
   const rules = Validate(String(validation), t);
 
+  // a file input can never carry over its previous value (browsers won't let
+  // us set one), so `required` would otherwise force a re-upload just to save
+  // an unrelated field on a record that already has a file
+  if (value) {
+    delete rules.required;
+  }
+
   const onChange = (): void => {
     setUploaded(true);
   };

package/Policy/Policy.tsx

@@ -1,4 +1,5 @@
 import { TFunction } from 'i18next';
+import { sanitizeHtml } from '@autobusal/utilities';
 import Modal from '../Modal/Modal';
 import { useGetPolicy } from './services';
 
@@ -17,7 +18,7 @@ const Policy = ({ id, t, onClose }: Props): JSX.Element => {
       width={ 750 }
       title={ t('policy.title') }
       content={
-        <div dangerouslySetInnerHTML={{ __html: data?.policies ?? '' }} />
+        <div dangerouslySetInnerHTML={{ __html: sanitizeHtml(data?.policies) }} />
       }
       onClose={ onClose }
     />

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/common",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts"