ep_headerauth 1.1.57 → 1.1.60

package/.github/workflows/automerge.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Automerge
         id: automerge

package/.github/workflows/backend-tests.yml

@@ -16,21 +16,21 @@ jobs:
     steps:
       -
         name: Install libreoffice
-        uses: awalsh128/cache-apt-pkgs-action@v1.6.0
+        uses: awalsh128/cache-apt-pkgs-action@v1.6.3
         with:
           packages: libreoffice libreoffice-pdfimport
           version: 1.0
       -
         name: Install etherpad core
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ether/etherpad-lite
           path: etherpad-lite
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         name: Install Node.js
         with:
-          node-version: 22
-      - uses: pnpm/action-setup@v6
+          node-version: 25
+      - uses: pnpm/action-setup@v6.1.0
         name: Install pnpm
         with:
           package_json_file: ./etherpad-lite/package.json
@@ -39,7 +39,7 @@ jobs:
         shell: bash
         run: |
           echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
-      - uses: actions/cache@v5
+      - uses: actions/cache@v6
         name: Setup pnpm cache
         with:
           path: ${{ env.STORE_PATH }}
@@ -48,7 +48,7 @@ jobs:
             ${{ runner.os }}-pnpm-store-
       -
         name: Checkout plugin repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: plugin
       - name: Remove tests

package/.github/workflows/frontend-tests.yml

@@ -12,15 +12,15 @@ jobs:
     steps:
       -
         name: Check out Etherpad core
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ether/etherpad-lite
           path: etherpad-lite
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         name: Install Node.js
         with:
-          node-version: 22
-      - uses: pnpm/action-setup@v6
+          node-version: 25
+      - uses: pnpm/action-setup@v6.1.0
         name: Install pnpm
         with:
           package_json_file: ./etherpad-lite/package.json
@@ -29,7 +29,7 @@ jobs:
         shell: bash
         run: |
           echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
-      - uses: actions/cache@v5
+      - uses: actions/cache@v6
         name: Setup pnpm cache
         with:
           path: ${{ env.STORE_PATH }}
@@ -38,7 +38,7 @@ jobs:
             ${{ runner.os }}-pnpm-store-
       -
         name: Checkout plugin repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: plugin
       -

package/.github/workflows/lint.yml

@@ -0,0 +1,39 @@
+name: Lint
+
+on:
+  workflow_call:
+
+jobs:
+  lint:
+    name: ESLint
+    runs-on: ubuntu-latest
+    # `eslint .` executes .eslintrc.cjs and every installed ESLint plugin, so
+    # don't hand it the caller's contents:write / id-token:write token.
+    permissions:
+      contents: read
+    steps:
+      - name: Check out plugin repository
+        uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        name: Install Node.js
+        with:
+          node-version: 25
+      - uses: pnpm/action-setup@v6.1.0
+        name: Install pnpm
+        with:
+          version: 10
+          run_install: false
+      - name: Get pnpm store directory
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+      - uses: actions/cache@v6
+        name: Setup pnpm cache
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+      - name: Install dependencies
+        run: pnpm install --ignore-scripts
+      - name: Run ESLint
+        run: pnpm run lint

package/.github/workflows/npmpublish.yml

@@ -18,20 +18,24 @@ jobs:
       contents: write   # for the atomic version-bump push (branch + tag)
       id-token: write   # for npm OIDC trusted publishing
     steps:
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
-          # OIDC trusted publishing needs npm >= 11.5.1, which requires
-          # Node >= 20.17.0. setup-node's `20` resolves to the latest
-          # 20.x, which satisfies that.
-          node-version: 20
+          # OIDC trusted publishing needs npm >= 11.5.1. Node 24 is an LTS
+          # line that every npm 11.x and 12.x supports; Node 25 is not —
+          # npm 12 requires ^22.22.2 || ^24.15.0 || >=26.0.0, so on Node 25
+          # the upgrade step below died with EBADENGINE and no plugin could
+          # publish.
+          node-version: 24
           registry-url: https://registry.npmjs.org/
+        # Pinned to a range rather than @latest: the next npm major dropping
+        # this Node line would silently break publishing fleet-wide again.
       - name: Upgrade npm to >=11.5.1 (required for trusted publishing)
-        run: npm install -g npm@latest
+        run: npm install -g npm@^11.5.1
       - name: Check out Etherpad core
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ether/etherpad-lite
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         name: Install pnpm
         with:
           run_install: false
@@ -39,7 +43,7 @@ jobs:
         shell: bash
         run: |
           echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
-      - uses: actions/cache@v5
+      - uses: actions/cache@v6
         name: Setup pnpm cache
         with:
           path: ${{ env.STORE_PATH }}
@@ -47,7 +51,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-pnpm-store-
       -
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       -
@@ -73,7 +77,7 @@ jobs:
           # `pnpm version patch` bumps package.json, makes a commit, and creates
           # a `v<new-version>` tag. Capture the new tag name from package.json
           # rather than parsing pnpm's output, which has historically varied.
-          # Bump the patch component directly with Node. pnpm/action-setup@v6
+          # Bump the patch component directly with Node. pnpm/action-setup@v6.0.10
           # sometimes installs pnpm 11 pre-releases even when version: 10.x is
           # requested (pnpm/action-setup#225); those pre-releases either skip
           # the git commit/tag or reject --no-git-tag-version as unknown.

package/.github/workflows/test-and-release.yml

@@ -14,6 +14,9 @@ permissions:
   id-token: write
 
 jobs:
+  lint:
+    uses: ./.github/workflows/lint.yml
+    secrets: inherit
   backend:
     uses: ./.github/workflows/backend-tests.yml
     secrets: inherit
@@ -23,6 +26,7 @@ jobs:
   release:
     if: ${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' }}
     needs:
+      - lint
       - backend
       - frontend
     permissions:

package/index.js

@@ -15,9 +15,9 @@
 // permissions and limitations under the License.
 
 const authorManager = require('ep_etherpad-lite/node/db/AuthorManager');
-const log4js = require('ep_etherpad-lite/node_modules/log4js');
+const {createLogger} = require('ep_plugin_helpers/logger');
 
-const logger = log4js.getLogger('ep_headerauth');
+const logger = createLogger('ep_headerauth');
 let settings;
 
 exports.authenticate = (hookName, {req}, cb) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ep_headerauth",
-  "version": "1.1.57",
+  "version": "1.1.60",
   "description": "Etherpad plugin to use a reverse proxy's HTTP headers for authentication.",
   "keywords": [
     "auth",
@@ -25,14 +25,17 @@
   },
   "devDependencies": {
     "eslint": "^8.57.1",
-    "eslint-config-etherpad": "^4.0.5",
-    "typescript": "^6.0.3"
+    "eslint-config-etherpad": "^5.0.0",
+    "typescript": "~6.0.3"
   },
   "scripts": {
     "lint": "eslint .",
     "lint:fix": "eslint --fix ."
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.0.0"
+  },
+  "dependencies": {
+    "ep_plugin_helpers": "^0.6.7"
   }
 }

package/pnpm-workspace.yaml

@@ -0,0 +1,10 @@
+# js-yaml and brace-expansion arrive only as transitive dev dependencies (via
+# eslint and minimatch@3), so `pnpm update` cannot move them. The selectors are
+# scoped to the affected major line: an unbounded range would drag minimatch@3
+# onto brace-expansion 5.x and eslint onto js-yaml 5.x.
+#
+# pnpm 11 no longer reads `pnpm.overrides` from package.json — these must live
+# here or the lockfile and the install disagree (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH).
+overrides:
+  js-yaml: '^4.3.2'
+  brace-expansion@1: '^1.1.16'

package/static/tests/backend/specs/handleMessage.js

@@ -13,7 +13,9 @@ describe(__filename, function () {
     await common.init();
     await new Promise((resolve, reject) => {
       plugin.loadSettings(
-          'loadSettings', {settings: {trustProxy: true, users: {}}}, (err) => err ? reject(err) : resolve());
+          'loadSettings',
+          {settings: {trustProxy: true, users: {}}},
+          (err) => (err ? reject(err) : resolve()));
     });
   });