@postalsys/email-text-tools 2.4.18 → 2.4.19

package/.github/VULNERABILITY_REPORT.yml

@@ -0,0 +1,75 @@
+name: '@postalsys/email-text-tools security vulnerability report'
+description: 'Report an exploitable security vulnerability in @postalsys/email-text-tools'
+
+body:
+    - type: markdown
+      attributes:
+          value: |
+              Before reporting, read our
+              [Security Policy](https://github.com/postalsys/email-text-tools/security/policy).
+
+              Reports must demonstrate a credible security impact.
+              Technically valid bugs without a realistic attack
+              scenario belong in the regular issue tracker.
+
+    - type: textarea
+      id: summary
+      attributes:
+          label: Vulnerability summary
+          description: Describe the vulnerability and affected versions.
+      validations:
+          required: true
+
+    - type: textarea
+      id: attacker
+      attributes:
+          label: Attacker capabilities
+          description: |
+              What can an attacker control without already having
+              privileged access to the application or its configuration?
+      validations:
+          required: true
+          min_length: 100
+
+    - type: textarea
+      id: exploit
+      attributes:
+          label: Realistic exploitation scenario
+          description: |
+              Describe how this can be exploited in a real application.
+              Explain the prerequisites and security boundary crossed.
+      validations:
+          required: true
+          min_length: 150
+
+    - type: textarea
+      id: poc
+      attributes:
+          label: Proof of concept
+          description: Provide reproducible steps or working code.
+      validations:
+          required: true
+
+    - type: textarea
+      id: impact
+      attributes:
+          label: Security impact
+          description: |
+              What can the attacker achieve? Who is affected?
+              Explain why this is a security vulnerability rather
+              than an ordinary bug.
+      validations:
+          required: true
+          min_length: 100
+
+    - type: checkboxes
+      id: confirmation
+      attributes:
+          label: Reporting requirements
+          options:
+              - label: I have read the Security Policy.
+                required: true
+              - label: I have verified the finding against a supported version.
+                required: true
+              - label: I have described a credible attacker-controlled scenario.
+                required: true

package/.ncurc.js

@@ -13,6 +13,10 @@ module.exports = {
         // 6.0.0 changed the CommonJS export shape (named bindings instead of the constructor) and,
         // more importantly, stopped linkifying bare domains such as 'example.com' or 'www.example.org'
         // by default, which silently breaks autolinking in plain text emails. Stay on 5.x.
-        'linkify-it'
+        'linkify-it',
+        // 2.0.0 is ESM-only (exports only src/he.mjs) and requires Node >=22, so require('he') throws
+        // and pkg cannot bundle it. 1.2.0 is the last CommonJS release; EmailEngine and mailparser
+        // hold it there too, and a different copy here would be a second he in their trees
+        'he'
     ]
 };

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "2.4.18"
+    ".": "2.4.19"
 }

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [2.4.19](https://github.com/postalsys/email-text-tools/compare/v2.4.18...v2.4.19) (2026-10-14)
+
+
+### Bug Fixes
+
+* **deps:** update dompurify to 3.4.17 and hold he on 1.x ([7a900b0](https://github.com/postalsys/email-text-tools/commit/7a900b03f4fbf4001bb21dffa62c659a89917e74))
+
 ## [2.4.18](https://github.com/postalsys/email-text-tools/compare/v2.4.17...v2.4.18) (2026-09-28)
 
 

package/SECURITY.md

@@ -1,81 +1,156 @@
 # Security Policy
 
-`@postalsys/email-text-tools` converts and sanitizes email content for display -
-turning plain text into HTML, HTML into plain text, and sanitizing/CSS-inlining
-arbitrary (and often untrusted) email HTML into markup that is safe to render.
-Because it processes attacker-controlled input and its output is shown to end
-users, we take security reports seriously and aim to respond quickly.
+`@postalsys/email-text-tools` converts and sanitizes email content for display:
+it turns plain text into HTML, HTML into plain text, and sanitizes and
+CSS-inlines arbitrary (often untrusted) email HTML into markup that is safe to
+render. We welcome responsible reports of vulnerabilities that present a
+credible security risk to users. Please distinguish security vulnerabilities
+from ordinary bugs, unusual edge cases, and hardening suggestions.
 
 ## Supported Versions
 
-Security fixes are released only against the latest version. We do not backport
-patches to older releases - upgrading to the current release line is the
-supported way to receive security updates.
+Security fixes are released only against the latest major version. We do not
+backport patches to older majors, so upgrading to the current release line is
+the supported way to receive security updates.
 
 | Version | Supported          |
 | ------- | ------------------ |
 | 2.x     | :white_check_mark: |
 | < 2.0   | :x:                |
 
-If you are on an older version, please upgrade. See the release notes at
+If you are on an older major, please upgrade. See the release notes at
 <https://github.com/postalsys/email-text-tools/releases> before updating.
 
-## Reporting a Vulnerability
+## What Qualifies as a Security Vulnerability
 
-**Please do not report security vulnerabilities through public GitHub issues,
-pull requests, or discussions.**
+A security report should identify a realistic way for an attacker to cross a
+security boundary in a supported version of `@postalsys/email-text-tools`.
+Unexpected behavior, a failing test, or a technically correct proof of concept
+is not sufficient on its own to establish security impact.
 
-Report privately through one of the following channels:
+In particular, explain:
 
-1. **GitHub Security Advisories (preferred).** Open a private report at
-   <https://github.com/postalsys/email-text-tools/security/advisories/new>. This
-   keeps the discussion private until a fix is published and lets us credit you.
-2. **Email.** Send details to **andris@postalsys.com**. Encrypt sensitive details
-   if possible.
+- **Attacker capabilities:** Who is the attacker, and what inputs, systems, or
+  responses can they control _without_ already having the privileges or secrets
+  they are trying to gain?
+- **Attack path:** How does attacker-controlled input reach the affected code
+  through a supported public API or a realistic application integration?
+- **Prerequisites:** What configuration and user actions are required? If the
+  attack depends on unusual options or deliberately malformed input, explain why
+  those conditions could arise in a real application.
+- **Impact:** What confidentiality, integrity, or availability boundary is
+  crossed, and what can the attacker achieve as a result?
 
-When reporting, please include as much of the following as you can:
+A vulnerability involving an optional or less common feature can still qualify
+if these conditions are met. Conversely, the existence of a defensive check in
+the code does not, by itself, establish that every bypass of that check has a
+realistic security impact.
 
-- The affected version(s) and environment (package version, Node.js version, OS).
-- The function involved (`mimeHtml`, `textToHtml`, `htmlToText`, `inlineHtml`,
-  `inlineText`).
-- A clear description of the issue and its impact (e.g. XSS / sanitizer bypass,
-  denial of service via catastrophic regex backtracking or CSS that hangs
-  processing, prototype pollution, content or information disclosure).
-- A minimal proof of concept: the input that triggers it and the unsafe output
-  or behavior it produces.
-- Any suggested remediation, if you have one.
+## Reporting a Vulnerability
 
-We are a small team, so there is no guaranteed response time - sometimes reports
-are handled within hours, sometimes they take longer. Accepted issues are fixed
-in a new release and coordinated through a GitHub Security Advisory, and
-reporters who wish to be named are credited.
+**Do not disclose suspected exploitable vulnerabilities through public GitHub
+issues, pull requests, or discussions before coordinating with the
+maintainers.**
 
-## CVEs
+Report privately through one of the following channels:
 
-We track and disclose vulnerabilities through GitHub Security Advisories. We do
-not request or manage CVE identifiers ourselves. If you need a CVE assigned for a
-reported issue, please request one yourself - for example, through GitHub's own
-CVE request flow on the published advisory, or another CNA.
+1. **GitHub Security Advisories (preferred):**
+   <https://github.com/postalsys/email-text-tools/security/advisories/new>.
+2. **Email:** **andris@postalsys.com**. Encrypt sensitive details if possible
+   (PGP key fingerprint `5D952A46E1D8C931F6364E01DC6C83F4D584D364`).
+
+### Required Information
+
+Please provide enough information to evaluate both the defect and its security
+impact. Reports should include:
+
+1. The affected `@postalsys/email-text-tools` version or commit, Node.js
+   version, and relevant configuration.
+2. A concise description of the issue and the affected public API or code path
+   (for example `mimeHtml`, `textToHtml`, `htmlToText`, `inlineHtml`, or
+   `inlineText`, with the input that triggers the issue and the unsafe output or
+   behavior it produces).
+3. A minimal, tested reproduction, including steps to run it, expected behavior,
+   and observed behavior.
+4. A concrete threat model: attacker control, prerequisites, trust boundary, and
+   resulting impact. Clearly distinguish what your reproduction proves from what
+   you believe might be possible.
+5. An explanation of why the issue affects real deployments beyond a
+   deliberately constructed test setup, where this is not obvious.
+
+A suggested fix is welcome but does not replace an explanation of
+exploitability. A complete real-world exploit is not always necessary, but the
+report must make a credible security impact clear.
+
+### Reports That May Be Treated as Ordinary Bugs
+
+The following generally do **not** qualify for private security handling unless
+you can demonstrate an additional, meaningful security boundary crossing:
+
+- Issues that require the attacker to control trusted application code,
+  administrator-only configuration, or the secret they supposedly extract.
+- Problems caused solely by application-level misuse, exposed credentials, or
+  insecure deployment choices outside `@postalsys/email-text-tools`'s control.
+- Contrived proof-of-concept setups where the tester controls both sides of a
+  request, without explaining how a separate attacker could trigger the issue.
+- Parser quirks, unexpected behavior, and bypasses of internal checks with no
+  demonstrated security impact.
+- Speculative findings based only on static analysis or an automated tool's
+  assessment, without a verified reproduction and credible attack scenario.
+
+These may still be valid bugs and may be considered through the normal issue
+tracker. Please coordinate before making any potentially exploitable details
+public. Classification as a bug does not guarantee a fix or a particular
+priority.
+
+### Automated and AI-Assisted Reports
+
+Automated analysis and AI tools are welcome as research aids, but the person
+submitting a report is responsible for verifying its claims. **Do not submit
+bulk, unverified, or speculative AI-generated findings.** Test each finding
+against a supported release and establish the actual security impact. Reports
+that do not meet the requirements above may be closed without further
+investigation or individual feedback; they can be resubmitted with stronger
+evidence.
+
+## Triage and Disclosure
+
+`@postalsys/email-text-tools` is maintained by a small team, and there is **no
+guaranteed response or resolution time**. Reports are prioritized based on
+demonstrated impact, exploitability, affected usage, and available maintenance
+resources.
+
+A private report does not automatically become a security advisory. Confirmed
+vulnerabilities may be fixed and disclosed through GitHub Security Advisories;
+other findings may be closed, deferred, or handled as ordinary bugs. Please do
+not disclose details of an unresolved, potentially exploitable issue publicly
+without coordinating with the maintainers.
+
+## CVEs and Credit
+
+We do not request or manage CVE identifiers. A report being acknowledged, a bug
+being fixed, or a pull request being merged does **not** mean that
+`@postalsys/email-text-tools` has confirmed a security vulnerability or endorsed
+a CVE assignment. We do not guarantee advisories, CVE identifiers, or public
+credit for reports. For confirmed vulnerabilities disclosed through an advisory,
+substantive reporters may be credited if they wish.
 
 ## Scope
 
-In scope: the library source in this repository - in particular:
-
-- Sanitizer bypasses in `mimeHtml` that let active content (scripts, event
-  handler attributes, dangerous URL schemes, or other executable markup) survive
-  into the sanitized output.
-- Denial of service in any conversion path - input that causes catastrophic
-  regex backtracking or makes CSS inlining hang or exhaust resources.
-- Prototype pollution or similar object-integrity issues reachable through the
-  public API.
+In scope: the library source in this repository, in particular sanitizer
+bypasses in `mimeHtml` that let active content (scripts, event handler
+attributes, dangerous URL schemes, or other executable markup) survive into the
+sanitized output, denial of service in any conversion path from catastrophic
+regex backtracking or CSS inlining that hangs or exhausts resources, and
+prototype pollution reachable through the public API.
 
 Out of scope:
 
-- Vulnerabilities in your own application that consumes this library - for
-  example, rendering the output without a Content Security Policy, or trusting
+- Vulnerabilities in your own application that consumes this library, for
+  example rendering the output without a Content Security Policy, or trusting
   the output in a non-HTML context.
 - Issues in third-party dependencies that are already publicly known; report
   those upstream (we will still pick up the dependency fix in a release).
-- Missing security hardening without a demonstrated, concrete impact.
+- Social-engineering reports.
 
-Thank you for helping keep email-text-tools and its users safe.
+Thank you for helping keep `@postalsys/email-text-tools` and its users safe.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@postalsys/email-text-tools",
-    "version": "2.4.18",
+    "version": "2.4.19",
     "description": "Email text tools",
     "main": "index.js",
     "scripts": {
@@ -29,12 +29,12 @@
     "homepage": "https://github.com/postalsys/email-text-tools#readme",
     "devDependencies": {
         "@eslint/js": "10.0.1",
-        "eslint": "10.11.0",
+        "eslint": "10.12.0",
         "eslint-config-prettier": "10.1.8",
-        "prettier": "3.9.9"
+        "prettier": "3.9.10"
     },
     "dependencies": {
-        "dompurify": "3.4.16",
+        "dompurify": "3.4.17",
         "he": "1.2.0",
         "html-to-text": "10.0.1",
         "jsdom": "27.0.0",