passbolt-browser-extension 5.13.0-alpha.1 → 5.14.2

package/.devcontainer/Dockerfile

@@ -10,6 +10,36 @@ RUN chmod 0644 /etc/profile.d/safe-chain-shims.sh \
     >> /etc/bash.bashrc
 ENV PATH="/home/node/.safe-chain/shims:${PATH}"
 
-RUN curl -fsSL https://claude.ai/install.sh | bash -s stable \
-    && cp /root/.local/bin/claude /usr/local/bin/claude
-
+# Install Claude Code CLI by downloading the release binary directly and verifying it
+# against Anthropic's GPG-signed manifest — no remote install script is ever executed.
+# Bump CLAUDE_VERSION to upgrade (>= 2.1.89 required for signed manifests).
+# Key fingerprint + manifest scheme: https://code.claude.com/docs/en/setup#binary-integrity-and-code-signing
+# The per-version binary URL ("$base/$CLAUDE_VERSION/$platform/claude") is the path the
+# official installer uses to fetch the binary (de-facto stable; not formally documented).
+ARG CLAUDE_VERSION=2.1.176
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates curl gnupg jq; \
+    rm -rf /var/lib/apt/lists/*; \
+    case "$(dpkg --print-architecture)" in \
+      amd64) platform=linux-x64 ;; \
+      arm64) platform=linux-arm64 ;; \
+      *) echo "Unsupported architecture" >&2; exit 1 ;; \
+    esac; \
+    export GNUPGHOME="$(mktemp -d)"; \
+    curl -fsSL https://downloads.claude.ai/keys/claude-code.asc | gpg --batch --import; \
+    gpg --batch --fingerprint security@anthropic.com \
+      | grep -q '31DD DE24 DDFA B679 F42D  7BD2 BAA9 29FF 1A7E CACE'; \
+    base=https://downloads.claude.ai/claude-code-releases; \
+    curl -fsSL "$base/$CLAUDE_VERSION/manifest.json"     -o /tmp/manifest.json; \
+    curl -fsSL "$base/$CLAUDE_VERSION/manifest.json.sig" -o /tmp/manifest.json.sig; \
+    gpg --batch --verify /tmp/manifest.json.sig /tmp/manifest.json; \
+    expected="$(jq -r ".platforms[\"$platform\"].checksum" /tmp/manifest.json)"; \
+    curl -fsSL "$base/$CLAUDE_VERSION/$platform/claude" -o /tmp/claude; \
+    echo "$expected  /tmp/claude" | sha256sum -c -; \
+    install -d -o node -g node /home/node/.local/bin; \
+    install -o node -g node -m 0755 /tmp/claude /home/node/.local/bin/claude; \
+    gpgconf --kill all; \
+    rm -rf "$GNUPGHOME" /tmp/manifest.json /tmp/manifest.json.sig /tmp/claude; \
+    /home/node/.local/bin/claude --version
+ENV PATH="/home/node/.local/bin:${PATH}"

package/.devcontainer/devcontainer-lock.json

@@ -0,0 +1,9 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/git:1": {
+      "version": "1.3.5",
+      "resolved": "ghcr.io/devcontainers/features/git@sha256:27905dc196c01f77d6ba8709cb82eeaf330b3b108772e2f02d1cd0d826de1251",
+      "integrity": "sha256:27905dc196c01f77d6ba8709cb82eeaf330b3b108772e2f02d1cd0d826de1251"
+    }
+  }
+}

package/.devcontainer/post-start.sh

@@ -15,6 +15,5 @@ if [ "$ERRORS" -gt 0 ]; then
   echo "WARNING: $ERRORS mount(s) missing. Claude Code may not work correctly."
 fi
 
-echo "==> Updating Claude Code..."
-curl -fsSL https://claude.ai/install.sh | bash -s stable
+echo "==> Claude Code version:"
 claude --version

package/.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,30 +1,38 @@
-##IMPORTANT: PLEASE READ
+---
+name: Report a bug
+about: Report a bug in the Passbolt browser extension.
+title: ""
+labels: bug
+assignees: ""
+---
 
-Only use github issues for bugs.
+<!--
+PLEASE READ
 
-We will be more than happy to help you on the community forum for:
-- feature requests: https://community.passbolt.com/c/backlog
-- issues related to an installation: https://community.passbolt.com/c/installation-issues
-- general questions: https://community.passbolt.com/c/uncategorized
+This tracker is only for browser extension bugs. For anything else:
 
-This is only a issue tracker for bugs related to the Passbolt Browser Extensions.
-For passbolt API, docker, command line interface, in short any other bugs 
-please use [the other relevant repositories](https://github.com/passbolt).
+- Security issues: https://www.passbolt.com/docs/contribute/security/vulnerability/
+- Feature requests: https://community.passbolt.com/c/backlog
+- Installation issues: https://community.passbolt.com/c/installation-issues
+- General questions: https://community.passbolt.com/c/uncategorized
 
-If you are certain this is a new Browser Extension bug please use the following format:
+If you are certain this is a browser extension bug, please fill in the format below.
+-->
 
-## ISSUE NAME
-* Passbolt Version: EXACT RELEASE VERSION OR COMMIT HASH, HERE.
-* Platform and Target:
--- Browser: NAME AND VERSION
--- Web server: NAME AND VERSION
--- etc.: OTHER RELEVANT PLATFORM INFO
+* Browser extension version: <!-- e.g. 5.13.0 -->
+* API edition & version: <!-- e.g. CE 5.12.0 -->
+* Environment
+  * Client: <!-- browser and OS, e.g. Chrome 148.1 on Ubuntu 26.04 -->
+  * Server: <!-- e.g. Debian 13, Docker latest-ce, or Passbolt Cloud -->
 
-### What you did
-EXPLAIN WHAT YOU DID, PREFERABLY WITH CODE EXAMPLES, HERE.
+### What you did?
 
-### What happened
-EXPLAIN WHAT IS ACTUALLY HAPPENING, HERE.
+<!-- Explain what you did, preferably with steps or code examples. -->
 
-### What you expected to happen
-EXPLAIN WHAT IS TO BE EXPECTED, HERE.
+### What happened?
+
+<!-- Explain what actually happened. -->
+
+### What you expected to happen?
+
+<!-- Explain what you expected instead. -->

package/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Request a feature or change
+    url: https://community.passbolt.com/c/backlog
+    about: Suggest and vote on features in the community forum.
+  - name: Get installation help
+    url: https://community.passbolt.com/c/installation-issues
+    about: Ask installation and configuration questions in the community forum.
+  - name: Ask a question
+    url: https://community.passbolt.com/c/uncategorized
+    about: Ask usage questions in the community forum.

package/.github/workflows/codeql-analysis.yml

@@ -16,8 +16,9 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
+        persist-credentials: false
         # We must fetch at least the immediate parents so that if this is
         # a pull request then we can checkout the head.
         fetch-depth: 2

package/.github/workflows/release_candidate.yaml

@@ -12,7 +12,9 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         name: Create Release candidate

package/.gitlab-ci.yml

@@ -0,0 +1 @@
+# Empty file to make NPMJS happy :D

package/CHANGELOG.md

@@ -4,6 +4,206 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased]
 
+## [5.14.2] - 2026-07-27
+### Fixed
+- PB-53322: throttle permissions confirmation dialog requests
+- PB-53211: fix an error when creating an account
+- PB-53316: fix edition name translation
+
+## [5.14.1] - 2026-07-23
+### Fixed
+- PB-53277: adapt findAllByIdsForShare to fetch the user profiles
+
+### Maintenance
+- PB-53277: update groupApiService to support 'contains' on 'get' method
+
+
+## [5.14.0] - 2026-07-09
+### Added
+- PB-45405 - Sort suggested resources by relevance instead of URI lengths
+- PB-51236 - OFM - WP2.3 Create SiteSettingsLocalStorage
+- PB-51476 - Add support for ADFS and OIDC on the account recovery with SSO workflow
+- PB-51810 - PCD 2.29 - Create GroupPermissionItem
+- PB-51811 - PCD 2.30 - Remove SharePermissionItem
+- PB-51813 - PCD 2.32 - Update CreateResource to call the workflow handler
+- PB-51814 - PCD 2.33 - Create PermissionServiceWorkerService
+- PB-51826 - PCD 3.01 - Update EditResource to call the workflow handler
+- PB-51828 - PCD 3.03 - Add edition handling in HandlePermissionWorkflow
+- PB-51829 - PCD 3.04 - Update resourceUpdateService to get permissions list from the styleguide
+- PB-51830 - PCD 3.05 - Update EditResource to display dialog
+- PB-51831 - PCD 3.06 - Update DisplayResourcesListContextualMenu to trigger HandlePermissionWorkflow
+- PB-51832 - PCD 3.07 - Update DisplayResourcesWorkspaceMenu to trigger HandlePermissionWorkflow
+- PB-51833 - PCD 3.08 - Handle read-only mode in permission dialog
+- PB-51835 - PCD 4.01 - Add share handling in HandlePermissionWorkflow
+- PB-51836 - PCD 4.02 - Adapt PermissionServiceWorkerService (savePermissions)
+- PB-51838 - PCD 4.04 - Update DisplayResourcesListContextualMenu to trigger HandlePermissionWorkflow from sharing
+- PB-51839 - PCD 4.05 - Update DisplayResourcesWorkspaceMenu to trigger HandlePermissionWorkflow from sharing
+- PB-52205 - OFM - WP1.4 Create SiteSettingsEntity
+- PB-52213 - OFM - WP3.4 Create SiteSettingsApiService
+- PB-52215 - OFM - WP4.18 Create GetOrFindSiteSettingsService
+- PB-52216 - OFM - WP4.19 Create FindSiteSettingsService
+- PB-52217 - OFM - WP4.20 findAndUpdateSiteSettingsLocalStorageService
+- PB-52350 - LS - WP1.1 Create local storage online session entity
+- PB-52352 - LS - WP1.2 Create local storage metadata entity
+- PB-52354 - LS - WP2.1 Create online session local storage
+- PB-52363 - LS - WP2.2 Create abstract local storage
+- PB-52374 - LS - WP2.3 Migrate Rbac local storage
+- PB-52375 - LS - WP2.4 Migrate Resource types local storage
+- PB-52411 - LS - WP2.5 Migrate UserMe local storage
+- PB-52412 - LS - WP2.6 Remove AuthStatus local storage to use ActiveSession local storage
+- PB-52447 - LS - WP3.1 Update GetOrFindRbacService
+- PB-52451 - LS - WP3.2 Create GetOrFindMeService and remove userModel getOrFindMe
+- PB-52460 - LS - WP 3.3 Create GetOrFindResourceTypes and remove resourceTypeModel getOrFindAll
+- PB-52713 - SORTURL - WP 1.1 - Implement url sorting algorithm in sortUtils
+- PB-52714 - SORTURL - WP 1.2 - Use sortUtils in HomePage
+- PB-52715 - SORTURL - WP 1.3 - Use sortUtils in InformMenuController
+- PB-52965 - HLL - WP 4.1 Hide the last logged in column for non admins
+- PB-52977 - PCD 6.26 - Fix group member count display on newly added group
+- PB-53028 - PCD 6.27 - Adapt Permission confirmation dialog title based on the ran process
+- PB-52536 - Display passbolt edition in right sidebar footer
+
+### Fixed
+- PB-50607 - Inject In-form menu CTA container inside Dialog element
+- PB-50876 - Secret history doesn't take in consideration RBAC cfg
+- PB-51920 - Multiple autofill issues
+- PB-52683 - Fix missing translation in healthcheck page
+- PB-52799 - In-Form menu CTA not visible anymore
+- PB-52357 - Mark "OpenId Configuration Path" as a required field in SSO
+- PB-52938 - Fix the subscriptionKey button not appearing when API is below than  5.13
+
+### Maintenance
+- PB-50075 - Remove DisplayUserDetailsActivity
+- PB-51917 - Remove getOrFindAll from UserModel
+- PB-52199 - Remove `formatOrderOptions` reference in API services as it is not in use
+- PB-52298 - Cover admin edition management journeys with end to end tests
+- PB-52467 - Pin js dependencies in lockfile
+- PB-52606 - Assert Subscription Details
+- PB-52607 - Assert Current Subscription Edition
+- PB-52609 - Upgrade to Pro
+- PB-52612 - Downgrade to CE
+- PB-52613 - Edit the organization subscription key in adminer
+- PB-52614 - Notify user of successful downgrade, Expire User's Session and Re-authenticate the user
+- PB-52615 - Assert Subscription Panel
+- PB-52691 - Retry In-form menu CTA injection when DOM changes are detected
+- PB-52711 - Create new subscription key using rsa public/private keys to avoid exposing production valid subscription key
+- PB-52542 - Update subscription page design
+- PB-52584 - Downgrade to CE design
+
+### Security
+- PB-49150 - Aikido#915877 Potential Cross Site Scripting (XSS) via window.location.href - passbolt-styleguide (info)
+- PB-51261 - Major upgrade for i18next (High)
+- PB-52333 - Improper Access Control in portManager (Info)
+- PB-52334 - Improper Input Validation in resourcesKdbxExporter (Medium)
+- PB-52485 - Fix esbuild GHSA-gv7w-rqvm-qjhr - HIGH CVSS3.1
+- PB-52538 - Major upgrade for js-yaml (Medium)
+- PB-52554 - Fix ws GHSA-96hv-2xvq-fx4p - HIGH CVSS 3.1
+- PB-52555 - Fix launch-editor GHSA-v6wh-96g9-6wx3 - MEDIUM CVSS4.0
+- PB-52556 - Fix tmp GHSA-7c78-jf6q-g5cm - HIGH CVSS3.1
+- PB-52557 - Fix form-data GHSA-hmw2-7cc7-3qxx - HIGH CVSS4.0
+- PB-52558 - Fix @babel/core GHSA-4x5r-pxfx-6jf8 - LOW CVSS3.1
+- PB-52601 - Fix undici GHSA-vmh5-mc38-953g - HIGH CVSS3.1
+- PB-52602 - Fix http-proxy-middleware GHSA-64mm-vxmg-q3vj - MEDIUM CVSS4.0
+- PB-52603 - Fix webpack-dev-server GHSA-mx8g-39q3-5c79 - MEDIUM CVSS3.1
+- PB-52611 - Small upgrade for serialize-javascript (High)
+- PB-52621 - Fix undici GHSA-g8m3-5g58-fq7m - HIGH CVSS 3.1
+- PB-52719 - Potential Cross Site Scripting (XSS) via window.location.href (Medium)
+
+
+## [5.13.4] - 2026-06-18
+### Fixed
+- PB-52569 Add user to group freezing the page
+
+## [5.13.3] - 2026-06-17
+### Fixed
+- Fix version mismatch between tag and package.json
+
+## [5.13.2] - 2026-06-17
+### Fixed
+- PB-51699 Fix adding a user to a large group
+
+## [5.13.1] - 2026-06-15
+### Fixed
+- PB-52478 Remove subscription CTA when edition plugin is not enabled
+
+### Maintenance
+- PB-52428 Update subscription links
+
+## [5.13.0] - 2026-06-11
+### Added
+- PB-51594 Move findAllForActionLogController and test to the correct location
+- PB-48516 Build process improvement - Webpack
+- PB-51534 Update group edit call in groupApiService to contain "my_group_user" as urlOptions
+- PB-51580 PCD 1.1 - Migrate SearchUsersAndGroupsController off ShareModel
+- PB-51585 PCD 1.2 - Migrate resourceCreateService ShareModel usage to ShareResourceService
+- PB-51586 PCD 1.3 - Move passbolt.share.get-folders to controller pattern
+- PB-51587 PCD 1.4 - Clear ShareModel
+- PB-51588 PCD 1.5 - Migrate MoveFolderController off FolderModel
+- PB-51589 PCD 1.6 - Migrate MoveOneFolderService off FolderModel
+- PB-51590 PCD 1.7 - Migrate MoveResourcesService off FolderModel + ResourceModel
+- PB-51782 PCD 2.01 - Create SynchroniseKeyringController and binding
+- PB-51783 PCD 2.02 - Create KeyringServiceWorkerService
+- PB-51785 PCD 2.04 - Create GetOrFindGroupService
+- PB-51786 PCD 2.05 - Create GetOrFindGroupController and binding
+- PB-51787 PCD 2.06 - Create GetOrFindGroupsUsersService
+- PB-51788 PCD 2.07 - Create GetOrFindGroupsUsersController and binding
+- PB-51789 PCD 2.08 - Create GetOrFindUsersService
+- PB-51790 PCD 2.09 - Create GetOrFindUsersController and binding
+- PB-51791 PCD 2.10 - Add new methods getByIds, getGroupsUsersByGropuId on GroupServiceWorkerService
+- PB-51999 PCD 2.10.B - Consolidate UserEntity between browser extension and styleguide
+- PB-52000 PCD 2.10.C - Move GroupEntity + GroupsCollection to the styleguide
+- PB-51792 PCD 2.11 - Create UserServiceWorkerService
+- PB-51793 PCD 2.12 - Create PermissionServiceWorkerService
+- PB-51794 PCD 2.13 - Create SearchUsersAndGroupsService
+- PB-51795 PCD 2.14 - Refactor ShareService into ShareApiService
+- PB-51796 PCD 2.15 - Update GroupApiService to support the new filter
+- PB-51798 PCD 2.17 - Update FindAndUpdateGroupsLocalStorageService to add a method findForLocalStorageByIds
+- PB-51799 PCD 2.18 - Align UserLocalStorage to add memory cache
+- PB-51800 PCD 2.19 - Rename UserService to UserApiService
+- PB-52047 CE/PRO upgrade
+- PB-49605 Grid columns min-width
+- PB-51808 PCD 2.27 - Create UserPermissionItem
+- PB-51809 PCD 2.28 - Create GroupUserPermissionItem
+- PB-47929 PAG - WP1.1 Add pagination support to ResourceService
+- PB-47930 PAG - WP1.2 Paginate resource fetch for updating local storage in FindResourceService
+- PB-52056 Add create method to SubscriptionKeyServiceWorkerService
+- PB-52057 Add delete method to SubscriptionKeyServiceWorkerService
+- PB-52058 Adapt EditSubscriptionKey to be customizable
+- PB-52061 Adapt DisplaySubscriptionKeyTeasing to handle upgrade from app
+- PB-52064 Create ConfirmDowngradeSubscriptionDialog
+- PB-52062 Adapt DisplaySubscriptionKey to handle downgrading
+- PB-52128 DisplaySubscriptionKey new layout
+
+### Security
+- PB-51937 Fix ws GHSA-58qx-3vcg-4xpx - MEDIUM CVSS3.1
+- PB-51938 Fix brace-expansion GHSA-jxxr-4gwj-5jf2 - MEDIUM CVSS3.1
+- PB-52029 Fix tmp GHSA-ph9p-34f9-6g65 - HIGH CVSS4.0
+- PB-51532 Include GitLab file from ci-definitions repo
+- PB-51642 Fix fast-uri GHSA-q3j6-qgpj-74h6 - HIGH CVSS3.1
+- PB-51643 Fix @babel/plugin-transform-modules-systemjs GHSA-fv7c-fp4j-7gwp - HIGH CVSS3.1
+- PB-51940 Fix qs GHSA-q8mj-m7cp-5q26 - MEDIUM CVSS4.0
+- PB-52030 Fix webpack-dev-server GHSA-79cf-xcqc-c78w - MEDIUM CVSS3.1
+- PB-51698 Use correct passbolt repo names in safe-chain whitelist
+
+### Fixed
+- PB-52148 CSP is blocking upload to TOTP QRCode on Firefox
+- PB-50949 Fix MetadataKeysSettingsLocalStorageContext and MetadataTypesSettingsLocalStorageContext entity issue on storage changes
+- PB-52047 Fix Passbolt Pro Edition wording
+- PB-52156 Fix password preview button min-width
+
+### Maintenance
+- PB-48560 Use NODE_ENV for webpack mode config
+- PB-48564 Remove grunt-header
+- PB-48528 Transpile LESS from webpack
+- PB-48558 Extract translations directly from webpack
+- PB-48559 Remove rimraf
+- PB-49064 Remove Grunt
+- PB-48516 Replace eval sourcemap by inline
+- PB-48516 Prevent br tags to be added in translations.
+- PB-48516 Remove duplicated translations
+- PB-51793: Add PermissionServiceWorkerService and transfer Permission entity and collection on styleguide
+- PB-51160 Update Firefox manifest to avoid Mozilla warnings
+- PB-52155 Update github issue template
+
 ## [5.12.2] - 2026-05-19
 ### Fixed
 - PB-51648 Fix add user to group reducing set timeout
@@ -2725,7 +2925,15 @@ self registration settings option in the left-side bar
 - AP: User with plugin installed
 - LU: Logged in user
 
-[Unreleased]: https://github.com/passbolt/passbolt_browser_extension/compare/v5.12.2...HEAD
+[Unreleased]: https://github.com/passbolt/passbolt_browser_extension/compare/v5.14.2...HEAD
+[5.14.2]: https://github.com/passbolt/passbolt_browser_extension/compare/v5.14.1...v5.14.2
+[5.14.1]: https://github.com/passbolt/passbolt_browser_extension/compare/v5.14.0...v5.14.1
+[5.14.0]: https://github.com/passbolt/passbolt_browser_extension/compare/v5.13.4...v5.14.0
+[5.13.4]: https://github.com/passbolt/passbolt_browser_extension/compare/v5.13.3...v5.13.4
+[5.13.3]: https://github.com/passbolt/passbolt_browser_extension/compare/v5.13.2...v5.13.3
+[5.13.2]: https://github.com/passbolt/passbolt_browser_extension/compare/v5.13.1...v5.13.2
+[5.13.1]: https://github.com/passbolt/passbolt_browser_extension/compare/v5.13.0...v5.13.1
+[5.13.0]: https://github.com/passbolt/passbolt_browser_extension/compare/v5.12.1...v5.13.0
 [5.12.2]: https://github.com/passbolt/passbolt_browser_extension/compare/v5.12.1...v5.12.2
 [5.12.1]: https://github.com/passbolt/passbolt_browser_extension/compare/v5.12.0...v5.12.1
 [5.12.0]: https://github.com/passbolt/passbolt_browser_extension/compare/v5.11.3...v5.12.0

package/CODEOWNERS

@@ -0,0 +1,2 @@
+[Front-end]
+* @passbolt/groups/front-end-group

package/CONTRIBUTING.md

@@ -15,18 +15,7 @@ There are a few guidelines that we need contributors to follow so that we have a
 
 ### Reporting a security Issue
 
-If you've found a security related issue in Passbolt, please don't open an issue in GitHub.
-Instead contact us at security@passbolt.com. In the spirit of responsible disclosure we ask that the reporter keep the
-issue confidential until we announce it.
-
-The passbolt team will take the following actions:
-- Try to first reproduce the issue and confirm the vulnerability.
-- Acknowledge to the reporter that we’ve received the issue and are working on a fix.
-- Get a fix/patch prepared and create associated automated tests.
-- Prepare a post describing the vulnerability, and the possible exploits.
-- Release new versions of all affected major versions.
-- Prominently feature the problem in the release announcement.
-- Provide credits in the release announcement to the reporter if they so desire.
+If you've found a security related issue in Passbolt, please don't open an issue on GitHub. Follow our responsible disclosure process: https://www.passbolt.com/docs/contribute/security/vulnerability/.
 
 ### Reporting a bug
 Please only use github for bugs or pull request.

package/README.md

@@ -5,14 +5,14 @@
 	  /_/    \__,_/____/____/_.___/\____/_/\__/
 
 	Open source password manager for teams
-	(c) 2025 Passbolt SA
+	(c) 2026 Passbolt SA
 	https://www.passbolt.com
 
 ## License
 
 Passbolt - Open source password manager for teams
 
-(c) 2025 Passbolt SA
+(c) 2026 Passbolt SA
 
 This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
 Public License (AGPL) as published by the Free Software Foundation version 3.
@@ -54,22 +54,11 @@ such as auto filling your passwords when visiting known websites.
 
 # Contributing
 
-Please check ```CONTRIBUTING.md``` for more information about how to get involved.
+Please check [CONTRIBUTING.md](CONTRIBUTING.md) for more information about how to get involved.
 
-### Reporting a security Issue
+## Reporting a security Issue
 
-If you've found a security related issue in Passbolt, please don't open an issue in GitHub.
-Instead contact us at security@passbolt.com. In the spirit of responsible disclosure we ask that the reporter keep the
-issue confidential until we announce it.
-
-The passbolt team will take the following actions:
-- Try to first reproduce the issue and confirm the vulnerability.
-- Acknowledge to the reporter that we’ve received the issue and are working on a fix.
-- Get a fix/patch prepared and create associated automated tests.
-- Prepare a post describing the vulnerability, and the possible exploits.
-- Release new versions of all affected major versions.
-- Prominently feature the problem in the release announcement.
-- Provide credits in the release announcement to the reporter if they so desire.
+If you've found a security related issue in Passbolt, please don't open an issue on GitHub. Follow our responsible disclosure process: https://www.passbolt.com/docs/contribute/security/vulnerability/.
 
 # Quick how-to for developers
 

package/RELEASE_NOTES.md

@@ -1,4 +1,6 @@
-Passbolt 5.12.2 fixes an issue that arose in Chrome 148, which caused a service worker that did not respond within the specified time limit to be terminated.
+# v5.14.2
 
 ### Fixed
-- PB-51648 Fix add user to group reducing set timeout
+- PB-53322: throttle permissions confirmation dialog requests
+- PB-53211: fix an error when creating an account
+- PB-53316: fix edition name translation

package/SECURITY.md

@@ -0,0 +1,7 @@
+# Security Policy
+
+For general information about security at Passbolt, see https://www.passbolt.com/security
+
+## Reporting a security issue
+
+If you've found a security issue in Passbolt, please do not open a public issue. Follow our responsible disclosure process: https://www.passbolt.com/docs/contribute/security/vulnerability/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passbolt-browser-extension",
-  "version": "5.13.0-alpha.1",
+  "version": "5.14.2",
   "license": "AGPL-3.0",
   "copyright": "Copyright 2025 Passbolt SA",
   "description": "Passbolt web extension for the open source password manager for teams",
@@ -14,14 +14,14 @@
     "await-lock": "^2.1.0",
     "downloadjs": "^1.4.7",
     "eckey-utils": "^0.7.14",
-    "i18next": "^25.4.0",
+    "i18next": "^26.3.4",
     "i18next-http-backend": "^3.0.5",
     "ip-regex": "^5.0.0",
     "jssha": "~3.3.1",
     "kdbxweb": "2.1.1",
     "openpgp": "^6.1.1",
     "papaparse": "^5.5.2",
-    "passbolt-styleguide": "^5.13.0-alpha.6",
+    "passbolt-styleguide": "^5.14.6",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "secrets-passbolt": "github:passbolt/secrets.js#v2.0.1",
@@ -31,7 +31,7 @@
     "xregexp": "~5.1.2"
   },
   "devDependencies": {
-    "@babel/core": "^7.23.2",
+    "@babel/core": "^7.29.7",
     "@babel/helpers": "^7.26.10",
     "@babel/plugin-transform-runtime": "^7.22.9",
     "@babel/preset-env": "^7.29.5",
@@ -71,13 +71,15 @@
     "prettier": "3.6.2",
     "terser-webpack-plugin": "^5.4.0",
     "text-encoding-utf-8": "^1.0.2",
-    "web-ext": "^10.3.0",
-    "webpack": "^5.105.2",
+    "web-ext": "^10.4.0",
+    "webpack": "^5.107.2",
     "webpack-cli": "^7.0.2"
   },
   "overrides": {
     "@xmldom/xmldom": "0.8.13",
-    "uuid": "^14.0.0"
+    "uuid": "^14.0.0",
+    "shell-quote": "1.8.4",
+    "js-yaml": "^4.2.0"
   },
   "scripts": {
     "build": "webpack",

package/renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "local>passbolt/passbolt-ops/renovate"
+  ]
+}

package/src/all/background_page/controller/InformMenuController/InformMenuController.js

@@ -12,15 +12,14 @@
  * @since         3.4.0
  */
 
-import ResourceModel from "../../model/resource/resourceModel";
 import { QuickAccessService } from "../../service/ui/quickAccess.service";
 import GetPassphraseService from "../../service/passphrase/getPassphraseService";
 import BrowserTabService from "../../service/ui/browserTab.service";
 import ExternalResourceEntity from "../../model/entity/resource/external/externalResourceEntity";
 import ResourceInProgressCacheService from "../../service/cache/resourceInProgressCache.service";
 import WorkerService from "../../service/worker/workerService";
-import ResourceTypeModel from "../../model/resourceType/resourceTypeModel";
 import ResourceMetadataEntity from "passbolt-styleguide/src/shared/models/entity/resource/metadata/resourceMetadataEntity";
+import { sortResourcesByUriMatchingScore } from "passbolt-styleguide/src/shared/utils/sortUtils";
 import GetOrFindResourcesService from "../../service/resource/getOrFindResourcesService";
 
 /**
@@ -35,8 +34,6 @@ class InformMenuController {
    */
   constructor(worker, apiClientOptions, account) {
     this.worker = worker;
-    this.resourceModel = new ResourceModel(apiClientOptions, account);
-    this.resourceTypeModel = new ResourceTypeModel(apiClientOptions);
     this.getPassphraseService = new GetPassphraseService(account);
     this.getOrFindResourcesService = new GetOrFindResourcesService(account, apiClientOptions);
   }
@@ -61,7 +58,7 @@ class InformMenuController {
       const configuration = {
         inputType: callToActionInput.type,
         inputValue: callToActionInput.value,
-        suggestedResources: suggestedResources.toDto(),
+        suggestedResources: sortResourcesByUriMatchingScore(suggestedResources.toDto(), this.worker.tab.url),
       };
 
       this.worker.port.emit(requestId, "SUCCESS", configuration);

package/src/all/background_page/controller/InformMenuController/InformMenuController.test.js

@@ -27,6 +27,9 @@ import { defaultResourcesDtos } from "passbolt-styleguide/src/shared/models/enti
 import ResourcesCollection from "../../model/entity/resource/resourcesCollection";
 import ExternalResourceEntity from "../../model/entity/resource/external/externalResourceEntity";
 import ResourceMetadataEntity from "passbolt-styleguide/src/shared/models/entity/resource/metadata/resourceMetadataEntity";
+import { sortResourcesByUriMatchingScore } from "passbolt-styleguide/src/shared/utils/sortUtils";
+import { defaultResourceDto } from "passbolt-styleguide/src/shared/models/entity/resource/resourceEntity.test.data";
+import { defaultResourceMetadataDto } from "passbolt-styleguide/src/shared/models/entity/resource/metadata/resourceMetadataEntity.test.data";
 
 describe("InformMenuController", () => {
   let requestId, worker, port, controller, webIntegrationPort;
@@ -79,10 +82,37 @@ describe("InformMenuController", () => {
       expect(port.emit).toHaveBeenCalledWith(requestId, "SUCCESS", {
         inputType: "password",
         inputValue: "test",
-        suggestedResources: suggestedResourcesDtos,
+        suggestedResources: sortResourcesByUriMatchingScore(suggestedResourcesDtos, worker.tab.url),
       });
     });
 
+    it("Should sort suggestedResources by URI matching score with the tab url, best match first", async () => {
+      expect.assertions(2);
+
+      const noMatch = defaultResourceDto({ metadata: defaultResourceMetadataDto({ uris: ["https://example.com"] }) });
+      const sameDomain = defaultResourceDto({ metadata: defaultResourceMetadataDto({ uris: ["passbolt.com"] }) });
+      const sameFqdn = defaultResourceDto({
+        metadata: defaultResourceMetadataDto({ uris: ["https://www.passbolt.com/login"] }),
+      });
+      const exactMatch = defaultResourceDto({
+        metadata: defaultResourceMetadataDto({ uris: ["https://www.passbolt.com"] }),
+      });
+
+      const unsortedCollection = new ResourcesCollection([noMatch, sameDomain, sameFqdn, exactMatch]);
+      jest.spyOn(controller.getOrFindResourcesService, "getOrFindSuggested").mockResolvedValue(unsortedCollection);
+
+      await controller.getInitialConfiguration(requestId);
+
+      const emittedConfiguration = port.emit.mock.calls[0][2];
+      expect(port.emit).toHaveBeenCalledWith(requestId, "SUCCESS", expect.anything());
+      expect(emittedConfiguration.suggestedResources.map((resource) => resource.id)).toEqual([
+        exactMatch.id,
+        sameFqdn.id,
+        sameDomain.id,
+        noMatch.id,
+      ]);
+    });
+
     it("Should catch and emit ERROR when WorkerService throws an error", async () => {
       expect.assertions(1);
 

package/src/all/background_page/controller/account/getAndInitializeAccountLocaleController.js

@@ -25,7 +25,7 @@ class GetAndInitializeAccountLocaleController {
     this.worker = worker;
     this.requestId = requestId;
     this.account = account;
-    this.localeModel = new LocaleModel(apiClientOptions);
+    this.localeModel = new LocaleModel(apiClientOptions, account);
   }
 
   /**