@postalsys/email-text-tools 2.4.6 → 2.4.7

package/.github/codeql/codeql-config.yml

@@ -0,0 +1,11 @@
+name: "email-text-tools CodeQL config"
+
+# Exclude code that is not part of the published runtime from analysis.
+# These paths generate only false-positive noise:
+#   - tests and fixtures intentionally feed malformed/hostile input
+#   - benchmarks and examples are developer-only helper scripts
+paths-ignore:
+    - test
+    - '**/test/**'
+    - benchmark
+    - examples

package/.github/workflows/codeql.yml

@@ -0,0 +1,47 @@
+name: "CodeQL Advanced"
+
+on:
+    push:
+        branches: ["main"]
+    pull_request:
+        branches: ["main"]
+    schedule:
+        - cron: "40 17 * * 6"
+
+jobs:
+    analyze:
+        name: Analyze (${{ matrix.language }})
+        runs-on: ubuntu-latest
+        permissions:
+            # required for all workflows
+            security-events: write
+            # required to fetch internal or private CodeQL packs
+            packages: read
+            # only required for workflows in private repositories
+            actions: read
+            contents: read
+
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - language: actions
+                      build-mode: none
+                    - language: javascript-typescript
+                      build-mode: none
+
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v6
+
+            - name: Initialize CodeQL
+              uses: github/codeql-action/init@v4
+              with:
+                  languages: ${{ matrix.language }}
+                  build-mode: ${{ matrix.build-mode }}
+                  config-file: ./.github/codeql/codeql-config.yml
+
+            - name: Perform CodeQL Analysis
+              uses: github/codeql-action/analyze@v4
+              with:
+                  category: "/language:${{ matrix.language }}"

package/.github/workflows/release.yaml

@@ -16,7 +16,7 @@ jobs:
         outputs:
             release_created: ${{ steps.release.outputs.release_created }}
         steps:
-            - uses: googleapis/release-please-action@v4
+            - uses: googleapis/release-please-action@v5
               id: release
 
     publish:
@@ -28,8 +28,8 @@ jobs:
             contents: read
             id-token: write
         steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-node@v4
+            - uses: actions/checkout@v6
+            - uses: actions/setup-node@v6
               with:
                   node-version: 24
                   registry-url: 'https://registry.npmjs.org'

package/.github/workflows/test.yaml

@@ -4,19 +4,28 @@ on:
     push:
     pull_request:
 
+permissions:
+    contents: read
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
 jobs:
     test:
         strategy:
             matrix:
-                node: [20.x, 22.x, 24.x]
+                node: [22.x, 24.x]
                 os: [ubuntu-latest]
         runs-on: ${{ matrix.os }}
+        timeout-minutes: 10
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v6
             - name: Use Node.js ${{ matrix.node }}
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v6
               with:
                   node-version: ${{ matrix.node }}
+                  cache: npm
             - run: npm install
             - run: npm run lint
             - run: npm test

package/.ncurc.js

@@ -3,6 +3,7 @@ module.exports = {
     reject: [
         // Block package upgrades that moved to ESM
         'nanoid',
-        'jsdom' // parse5 dependency in 27.0.1 is ESM only
+        'jsdom', // parse5 dependency in 27.0.1 is ESM only
+        'juice' // 12+ is pure ESM (requires Node >=22.12) and breaks pkg builds
     ]
 };

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "2.4.6"
+    ".": "2.4.7"
 }

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [2.4.7](https://github.com/postalsys/email-text-tools/compare/v2.4.6...v2.4.7) (2026-06-15)
+
+
+### Bug Fixes
+
+* pin juice to 11.x and bump remaining deps ([307a337](https://github.com/postalsys/email-text-tools/commit/307a3379713624a2eee5897ee7a4755232935792))
+
 ## [2.4.6](https://github.com/postalsys/email-text-tools/compare/v2.4.5...v2.4.6) (2026-05-29)
 
 

package/SECURITY.md

@@ -0,0 +1,81 @@
+# Security Policy
+
+`@postalsys/email-text-tools` converts and sanitizes email content for display -
+turning plain text into HTML, HTML into plain text, and sanitizing/CSS-inlining
+arbitrary (and often untrusted) email HTML into markup that is safe to render.
+Because it processes attacker-controlled input and its output is shown to end
+users, we take security reports seriously and aim to respond quickly.
+
+## Supported Versions
+
+Security fixes are released only against the latest version. We do not backport
+patches to older releases - upgrading to the current release line is the
+supported way to receive security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 2.x     | :white_check_mark: |
+| < 2.0   | :x:                |
+
+If you are on an older version, please upgrade. See the release notes at
+<https://github.com/postalsys/email-text-tools/releases> before updating.
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues,
+pull requests, or discussions.**
+
+Report privately through one of the following channels:
+
+1. **GitHub Security Advisories (preferred).** Open a private report at
+   <https://github.com/postalsys/email-text-tools/security/advisories/new>. This
+   keeps the discussion private until a fix is published and lets us credit you.
+2. **Email.** Send details to **andris@postalsys.com**. Encrypt sensitive details
+   if possible.
+
+When reporting, please include as much of the following as you can:
+
+- The affected version(s) and environment (package version, Node.js version, OS).
+- The function involved (`mimeHtml`, `textToHtml`, `htmlToText`, `inlineHtml`,
+  `inlineText`).
+- A clear description of the issue and its impact (e.g. XSS / sanitizer bypass,
+  denial of service via catastrophic regex backtracking or CSS that hangs
+  processing, prototype pollution, content or information disclosure).
+- A minimal proof of concept: the input that triggers it and the unsafe output
+  or behavior it produces.
+- Any suggested remediation, if you have one.
+
+We are a small team, so there is no guaranteed response time - sometimes reports
+are handled within hours, sometimes they take longer. Accepted issues are fixed
+in a new release and coordinated through a GitHub Security Advisory, and
+reporters who wish to be named are credited.
+
+## CVEs
+
+We track and disclose vulnerabilities through GitHub Security Advisories. We do
+not request or manage CVE identifiers ourselves. If you need a CVE assigned for a
+reported issue, please request one yourself - for example, through GitHub's own
+CVE request flow on the published advisory, or another CNA.
+
+## Scope
+
+In scope: the library source in this repository - in particular:
+
+- Sanitizer bypasses in `mimeHtml` that let active content (scripts, event
+  handler attributes, dangerous URL schemes, or other executable markup) survive
+  into the sanitized output.
+- Denial of service in any conversion path - input that causes catastrophic
+  regex backtracking or makes CSS inlining hang or exhaust resources.
+- Prototype pollution or similar object-integrity issues reachable through the
+  public API.
+
+Out of scope:
+
+- Vulnerabilities in your own application that consumes this library - for
+  example, rendering the output without a Content Security Policy, or trusting
+  the output in a non-HTML context.
+- Issues in third-party dependencies that are already publicly known; report
+  those upstream (we will still pick up the dependency fix in a release).
+- Missing security hardening without a demonstrated, concrete impact.
+
+Thank you for helping keep email-text-tools and its users safe.

package/lib/juice-worker.js

@@ -1,7 +1,9 @@
 'use strict';
 
 const { parentPort } = require('worker_threads');
-const juice = require('juice');
+// Pinned to juice 11.x: juice 12+ is pure ESM (requires Node >=22.12) and breaks pkg builds.
+// The `.default` fallback keeps this working if juice ever ships a CJS-compatible build again.
+const juice = require('juice').default || require('juice');
 
 parentPort.on('message', html => {
     try {

package/lib/mime-html.js

@@ -2,7 +2,9 @@
 
 const createDOMPurify = require('dompurify');
 const { JSDOM } = require('jsdom');
-const juice = require('juice');
+// Pinned to juice 11.x: juice 12+ is pure ESM (requires Node >=22.12) and breaks pkg builds.
+// The `.default` fallback keeps this working if juice ever ships a CJS-compatible build again.
+const juice = require('juice').default || require('juice');
 const he = require('he');
 const { Worker } = require('worker_threads');
 const path = require('path');

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@postalsys/email-text-tools",
-    "version": "2.4.6",
+    "version": "2.4.7",
     "description": "Email text tools",
     "main": "index.js",
     "scripts": {
@@ -26,12 +26,12 @@
     "homepage": "https://github.com/postalsys/email-text-tools#readme",
     "devDependencies": {
         "@eslint/js": "10.0.1",
-        "eslint": "10.4.0",
+        "eslint": "10.5.0",
         "eslint-config-prettier": "10.1.8",
-        "prettier": "3.8.3"
+        "prettier": "3.8.4"
     },
     "dependencies": {
-        "dompurify": "3.4.7",
+        "dompurify": "3.4.10",
         "he": "1.2.0",
         "html-to-text": "10.0.0",
         "jsdom": "27.0.0",