domma-cms 1.8.36 → 1.8.37
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +4 -0
- package/package.json +12 -12
- package/server/server.js +4 -4
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,9 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [1.8.37] - 2026-10-22
|
|
4
|
+
|
|
5
|
+
- **Security updates to the libraries the CMS runs on.** Fastify 5.12 (form validation could be bypassed, and forwarded-address headers spoofed), sanitize-html 2.18 (ways past the HTML cleaner), the sign-in token library (a token signed the wrong way could be accepted), @fastify/static 10 (a protected file could be reached through an oddly written address), Nodemailer 10 (header injection in outgoing mail), sharp 0.35 (flaws in the image libraries an uploaded picture could reach), and fixes deeper down for denial-of-service bugs in upload, YAML and URL handling. Nothing changes in how the CMS looks or works.
|
|
6
|
+
|
|
3
7
|
## [1.8.36] - 2026-10-22
|
|
4
8
|
|
|
5
9
|
- **Pages load their scripts after the words, and DOMPurify ships with the CMS.** The scripts that can wait now carry `defer`, so the browser finishes reading the page first, and DOMPurify (the library that cleans HTML in the browser) comes from your own site at a fixed version instead of a CDN. A new **Documentation > Usage > Search Engines & AI** page explains what search engines and AI crawlers see and how to check a page yourself.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "domma-cms",
|
|
3
|
-
"version": "1.8.
|
|
3
|
+
"version": "1.8.37",
|
|
4
4
|
"description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "server/server.js",
|
|
@@ -77,23 +77,23 @@
|
|
|
77
77
|
},
|
|
78
78
|
"dependencies": {
|
|
79
79
|
"@fastify/compress": "^8.3.1",
|
|
80
|
-
"@fastify/cors": "^11.
|
|
81
|
-
"@fastify/helmet": "^13.0
|
|
82
|
-
"@fastify/jwt": "^10.
|
|
83
|
-
"@fastify/multipart": "^
|
|
80
|
+
"@fastify/cors": "^11.3.1",
|
|
81
|
+
"@fastify/helmet": "^13.2.0",
|
|
82
|
+
"@fastify/jwt": "^10.2.5",
|
|
83
|
+
"@fastify/multipart": "^10.1.5",
|
|
84
84
|
"@fastify/rate-limit": "^10.3.0",
|
|
85
|
-
"@fastify/static": "
|
|
85
|
+
"@fastify/static": "10.1.7",
|
|
86
86
|
"bcryptjs": "^3.0.3",
|
|
87
87
|
"domma-js": "0.53.3",
|
|
88
88
|
"dotenv": "^17.2.3",
|
|
89
|
-
"fastify": "5.
|
|
89
|
+
"fastify": "5.12.7",
|
|
90
90
|
"gray-matter": "^4.0.3",
|
|
91
|
-
"imapflow": "^2.0
|
|
92
|
-
"mailparser": "^3.
|
|
91
|
+
"imapflow": "^2.8.0",
|
|
92
|
+
"mailparser": "^3.12.2",
|
|
93
93
|
"marked": "^15.0.0",
|
|
94
|
-
"nodemailer": "
|
|
95
|
-
"sanitize-html": "^2.
|
|
96
|
-
"sharp": "^0.
|
|
94
|
+
"nodemailer": "10.2.0",
|
|
95
|
+
"sanitize-html": "^2.18.1",
|
|
96
|
+
"sharp": "^0.35.5",
|
|
97
97
|
"uuid": "13.0.1"
|
|
98
98
|
},
|
|
99
99
|
"optionalDependencies": {
|
package/server/server.js
CHANGED
|
@@ -212,9 +212,9 @@ await app.register(staticPlugin, {
|
|
|
212
212
|
prefix: '/admin/',
|
|
213
213
|
decorateReply: false,
|
|
214
214
|
cacheControl: false,
|
|
215
|
-
setHeaders: (
|
|
215
|
+
setHeaders: (reply, filePath) => {
|
|
216
216
|
const noStore = /\.(?:js|mjs|css)$/i.test(filePath);
|
|
217
|
-
|
|
217
|
+
reply.header('Cache-Control', noStore ? 'no-store' : 'no-cache');
|
|
218
218
|
}
|
|
219
219
|
});
|
|
220
220
|
|
|
@@ -418,8 +418,8 @@ await app.register(staticPlugin, {
|
|
|
418
418
|
root: mediaDir,
|
|
419
419
|
prefix: '/media/',
|
|
420
420
|
decorateReply: false,
|
|
421
|
-
setHeaders: (
|
|
422
|
-
|
|
421
|
+
setHeaders: (reply) => {
|
|
422
|
+
reply.header('X-Content-Type-Options', 'nosniff');
|
|
423
423
|
}
|
|
424
424
|
});
|
|
425
425
|
|