scratch-paint 4.1.50 → 4.1.52

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scratch-paint",
-  "version": "4.1.50",
+  "version": "4.1.52",
   "description": "Graphical User Interface for the Scratch 3.0 paint editor, which is used to make and edit sprites for use in projects.",
   "main": "./dist/scratch-paint.js",
   "browser": "./src/index.js",
@@ -24,6 +24,7 @@
   },
   "dependencies": {
     "@scratch/paper": "^0.11.20221201200345",
+    "@scratch/scratch-svg-renderer": "13.7.2",
     "classnames": "^2.2.5",
     "keymirror": "^0.1.1",
     "lodash.bindall": "^4.4.0",
@@ -43,13 +44,13 @@
     "react-style-proptype": "^3",
     "react-tooltip": "^4",
     "redux": "^4",
-    "scratch-render-fonts": "^1.0.0"
+    "scratch-render-fonts": "1.0.252"
   },
   "devDependencies": {
     "@babel/cli": "7.28.6",
-    "@babel/core": "7.28.6",
-    "@babel/node": "7.28.6",
-    "@babel/preset-env": "7.28.6",
+    "@babel/core": "7.29.0",
+    "@babel/node": "7.29.0",
+    "@babel/preset-env": "7.29.3",
     "@babel/preset-react": "7.28.5",
     "@commitlint/cli": "17.8.1",
     "@commitlint/config-conventional": "17.8.1",
@@ -59,10 +60,10 @@
     "babel-loader": "8.4.1",
     "babel-plugin-react-intl": "3.5.1",
     "babel-plugin-transform-object-rest-spread": "6.26.0",
-    "canvas": "2.11.2",
+    "canvas": "3.2.3",
     "css-loader": "3.6.0",
-    "eslint": "9.39.2",
-    "eslint-config-scratch": "12.0.45",
+    "eslint": "9.39.4",
+    "eslint-config-scratch": "12.0.51",
     "gh-pages": "3.2.3",
     "globals": "16.5.0",
     "html-webpack-plugin": "3.2.0",
@@ -81,12 +82,12 @@
     "redux-throttle": "0.1.1",
     "regenerator-runtime": "0.13.9",
     "rimraf": "2.7.1",
-    "scratch-l10n": "6.1.57",
-    "scratch-semantic-release-config": "4.0.0",
-    "semantic-release": "19.0.5",
+    "scratch-l10n": "6.1.75",
+    "scratch-semantic-release-config": "4.0.1",
+    "semantic-release": "25.0.3",
     "style-loader": "1.3.0",
     "svg-url-loader": "3.0.3",
-    "tap": "21.5.0",
+    "tap": "21.7.2",
     "uglifyjs-webpack-plugin": "2.2.0",
     "url-loader": "2.3.0",
     "webpack": "4.47.0",
@@ -106,7 +107,8 @@
     "testURL": "http://localhost",
     "moduleNameMapper": {
       "\\.(jpg|jpeg|png|gif|eot|otf|webp|svg|ttf|woff|woff2|mp4|webm|wav|mp3|m4a|aac|oga)$": "<rootDir>/test/__mocks__/fileMock.js",
-      "\\.(css|less)$": "<rootDir>/test/__mocks__/styleMock.js"
+      "\\.(css|less)$": "<rootDir>/test/__mocks__/styleMock.js",
+      "^css-tree/utils$": "<rootDir>/node_modules/css-tree/cjs/utils/index.cjs"
     },
     "transformIgnorePatterns": [
       "/node_modules/(?!intl-messageformat|intl-messageformat-parser).+\\.js$"

package/src/containers/paper-canvas.jsx

@@ -3,6 +3,7 @@ import PropTypes from 'prop-types';
 import React from 'react';
 import {connect} from 'react-redux';
 import paper from '@scratch/paper';
+import {sanitizeSvg} from '@scratch/scratch-svg-renderer';
 import Formats from '../lib/format';
 import log from '../log/log';
 
@@ -206,6 +207,13 @@ class PaperCanvas extends React.Component {
             svg = svg.replace(
                 '<svg ', '<svg xmlns="http://www.w3.org/2000/svg" ');
         }
+        // 3. Strip elements and attributes that fire on DOM-insertion. paper.js
+        // calls importSVG -> appendChild internally, so anything dangerous left
+        // in the SVG executes against the embedding origin. DOMPurify's SVG
+        // profile drops <script>, <foreignObject>, <a>, event-handler attrs,
+        // and similar. Run after the namespace fixups so DOMPurify sees a
+        // well-formed document.
+        svg = sanitizeSvg.sanitizeSvgText(svg);
 
         // Get the origin which the viewBox is defined relative to. During import, Paper will translate
         // the viewBox to start at (0, 0), and we need to translate it back for some costumes to render

package/webpack.config.js

@@ -21,7 +21,12 @@ const base = {
                 path.resolve(__dirname, 'src'),
                 path.join(__dirname, 'node_modules/react-intl'),
                 path.join(__dirname, 'node_modules/intl-messageformat'),
-                path.join(__dirname, 'node_modules/intl-messageformat-parser')
+                path.join(__dirname, 'node_modules/intl-messageformat-parser'),
+                // scratch-svg-renderer's published bundle ships modern JS
+                // that webpack 4's default parser can't read; transpile it
+                // here. The library output externalizes the same package, so
+                // this is only on the path for the playground bundle.
+                path.join(__dirname, 'node_modules/@scratch/scratch-svg-renderer')
             ],
             options: {
                 plugins: ['transform-object-rest-spread'],
@@ -102,6 +107,7 @@ module.exports = [
     // For use as a library
     defaultsDeep({}, base, {
         externals: {
+            '@scratch/scratch-svg-renderer': '@scratch/scratch-svg-renderer',
             'minilog': 'minilog',
             'prop-types': 'prop-types',
             'react': 'react',