From 22dbf5b51b59647792956fb92b87b95c6bef7886 Mon Sep 17 00:00:00 2001 From: John McLear Date: Wed, 10 Jun 2026 10:25:38 +0100 Subject: [PATCH] =?UTF-8?q?chore(release):=20prep=203.3.1=20=E2=80=94=20bu?= =?UTF-8?q?mp=20ueberdb2=20to=20^6.1.9=20+=20changelog?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps ueberdb2 6.1.8 -> 6.1.9 (postgres pool-error handling + TCP keep-alive for #7878; redis/rethink connection-error handlers so a dropped DB connection no longer crashes the process) and adds the 3.3.1 CHANGELOG entry required by bin/release.ts before the release workflow can run. Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 25 +++++++++++++++++++++++++ bin/package.json | 2 +- pnpm-lock.yaml | 14 +++++++------- src/package.json | 2 +- 4 files changed, 34 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ae46220482d..de9c171efc5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,28 @@ +# 3.3.1 + +3.3.1 is a small bug-fix and hardening follow-up to 3.3.0. It closes a stored-XSS vector in the numbered-list `start` attribute, hardens the database layer so a dropped connection to PostgreSQL / Redis / RethinkDB no longer crashes the process (via ueberdb2 6.1.9), and fixes a handful of pad and admin regressions — the iOS dark-mode status bar, the settings language dropdown, the pad-deletion modal under `allowPadDeletionByAllUsers`, and a single unreadable pad blanking the admin Manage-pads list. + +### Security + +- **Pad editor — escape and integer-coerce the numbered-list `start` attribute (GHSA-f7h5-v9hm-548j, #7937).** A crafted `
    ` value flowed unescaped into `domline.ts`, a distinct client-side sink from the export-path fix in 3.3.0's #7905. The value is now integer-coerced and HTML-escaped before it reaches the DOM. A jsdom regression test covers the sink. + +### Notable fixes + +- **Skin — paint the root canvas so iOS dark mode has no white status bar (#7606 / #7931).** iOS Safari paints the top safe area from the `html` root background, which `theme-color` (an Android address-bar hint) does not affect, so dark-mode pads showed a white status-bar strip on iOS. Colibris now sets the root background and `color-scheme` so the safe area matches the editor. +- **Settings — show the detected language in the dropdown (#7925 / #7928).** The settings language `