Etherpad Lite - Package updates

[Package Updates]

[4.10.6]

• Update etherpad-lite to 3.3.7
• Full Changelog
• Renderer attribute-pool values can no longer forge class tokens (GHSA-4mx2-rqx5-2pp6, #8302). linestylefilter appended the start and list line-attribute values verbatim to the space-delimited class string that domline parses back, and domline emits any tag: token in that string as a raw element. A start value containing a space, which can be planted through a crafted changeset or .etherpad import, therefore smuggled in a token such as tag:img/src=x/onerror=... and rendered a live element with a live event handler for every viewer of the pad and its timeslider. This is the same function as GHSA-f7h5-v9hm-548j but a different token. start is now emitted only when it is an integer and list only when it is a plain list type, and domline accepts only a bare element name (letters, digits and hyphens) for tag: tokens, which also covers class strings contributed by plugins. Reported by @arpitjain099.
• Auth an empty-string password is refused on both login paths (#8261). A settings.users entry configured as "password": "" authenticated anyone who submitted an empty password, on the OIDC interaction path and on HTTP Basic. Both already failed closed for a nullish password; an empty string slipped through because it is a string and compares equal to an empty submission. Only explicit misconfiguration produces it, so this is hardening rather than a vulnerability. Reported by Wenhao Wu (Southeast University) while verifying the fix for GHSA-62cj-9j72-mfrh.
• Admin the plugin catalog no longer offers deprecated or known-broken plugins (#8246). The "Available plugins" list was built straight from the plugin feed, so any package the feed knew about could be installed from the admin UI including packages npm marks deprecated, packages the plugin registry itself could not get working against the current release, and ep_adminpads2, which is archived upstream and takes over /admin/pads with a template whose scripts core no longer ships, hanging the admin page on "Loading". Those are now filtered out of the catalog, the admin UI refuses to install one if a stale page asks for it anyway (pnpm run plugins i ep_<name> on the server still overrides), and an already-installed plugin in that state is flagged as deprecated in the Installed plugins list. The npm deprecation lookup is cached for 12 hours and fails open: if the registry cannot be reached the full catalog is still listed. Reported by @JohnMcLear.

[Package Updates]

[4.10.7]

• Update etherpad-lite to 3.3.8
• Full Changelog
• 3.3.8 is a security release. It closes an HTTP API privilege escalation for instances using the built-in OIDC provider with API clients (GHSA-38vj-95q4-gwvx).
• HTTP API client_credentials tokens are identified by a signed grant marker (GHSA-38vj-95q4-gwvx). The API decided whether a bearer JWT came from the OAuth2 client_credentials grant by checking whether its sub claim equalled a configured client_id, and client_credentials tokens skip the admin === true claim check. A non-admin user whose account name collided with a configured client ID could therefore use an ordinary login token to get admin access to the HTTP API. This is a variant of GHSA-qfmh-fph3-mw8q. The provider now signs an etherpad_grant: "client_credentials" marker into client_credentials access tokens, and extraParams cannot override it. The API trusts that marker instead of comparing sub to client IDs. Upgrade note: client_credentials tokens issued before the upgrade don't carry the marker and are refused with 401 until they are re-issued. These tokens are short-lived. Reported by Yves Soete of Blacksight LLC (@yssoe).
• OIDC numeric and boolean admin passwords work again (#8263, #8327). The settings loader coerces environment-variable values, so ADMIN_PASSWORD=123456 (for example via settings.json.docker) arrives as the number 123456. The 3.3.6 login check (GHSA-62cj-9j72-mfrh) only accepted string passwords, so these admins could no longer log in. Finite numbers and booleans are now compared as strings. Missing, empty, NaN and non-scalar values are still refused.
• Settings dropdowns open under prefers-reduced-motion (#8290, #8328). With reduced motion enabled, the settings popup kept transform: scale(1). That made the popup the containing block for the dropdown list, so the font and language lists rendered out of view. The popup now uses transform: none. Thanks to @kfogel.

[Package Updates]

[4.10.8]

• Update etherpad-lite to 3.3.9
• Full Changelog
• Plugins dependency names are validated on uninstall as well as install (GHSA-g9xm-3pqr-wcph). GHSA-92hr-gmr6-h8cp made the plugin installer validate dependency names on install, but the uninstall path still passed the raw package.json dependency key to rmSync/unlinkSync. A plugin declaring a dependency named like zzz/../../.. could therefore delete a directory outside the plugin folder when an admin uninstalled it. Every install and uninstall path now resolves dependency paths through one helper that refuses names that escape the plugin directory. Exploiting it needs an admin to install and then uninstall the malicious plugin. Reported by @baeseungwon1010.
• Pad retention delete pads nobody has edited for N days (#8340). A new padRetention setting replaces the unmaintained ep_delete_after_delay plugin without its HTML archive copies or tombstone pads. It is off by default and, once enabled, only logs would delete pad <id> until dryRun is set to false. A periodic sweep reads each pad's last-edit time straight from the database without loading pads into the cache, and an overdue pad is also deleted when someone opens it instead of showing stale content. Deletion uses the same path as the deletePad API. Options: deleteAfterDays, warnBeforeDays, sweepIntervalHours, excludeGroupPads and excludePattern.
• Settings hide the deletion-token modal without widening deletion rights (#7996, #8319). The new suppressPadDeletionTokenModal setting (SUPPRESS_PAD_DELETION_TOKEN_MODAL in the container image) stops the one-time "Save your pad deletion token" modal from appearing. Until now the only way to hide it was allowPadDeletionByAllUsers: true, which also let any editor delete the pad. The token is still issued and still works, and non-creators still can't delete. Thanks to @sirsqm.
• Performance fonts are no longer inlined into the minified CSS (#8268, #8314). The pad stylesheet embedded every editor and icon font as base64, so pad.css was about 1.7 MB and every visitor downloaded all of it before the pad rendered. Fonts are now fetched separately and only when used, and pad.css is about 61 KB. Thanks to @sirsqm.
• Toolbar a popup opened from the toolbar keeps focus (#8345). The editor grabbed focus back after every toolbar command, so in current Firefox Escape didn't close the settings or users popup and typing a name didn't reach the name field.
• Colibris dark mode colours apply everywhere (#8271). The light --text-color and --bg-color values could override the dark ones on elements outside the editor, such as the history banner. Thanks to @bobmullut.
• Session transfer failed requests are reported as failures (#8172, #8273). Errors from the session transfer endpoint were treated as success. They now show a localized error, and a retry clears it. Thanks to @toashu123.
• Share dialog "Read only" is now "Use read-only link" (#8181, #8326). The checkbox switches which link and embed code you copy; it never locked the pad. The new label and an accessible description say so. Thanks to @jum-apzn.
• Localisation updates from translatewiki.net.
• Dependency updates, including express 5.3.0, ejs 7.0.1, nodemailer 10.1.1, surrealdb 2.1.1, mssql 12.7.9 and ueberdb2 6.1.18.

[Package Updates]

[4.11.0]

• Update node-base | final to 24-20261021
• security: fix eMudhra cert compromise

[Package Updates]

[4.11.1]

• Update etherpad-lite to 3.3.10
• Full Changelog

[Package Updates]

[4.11.2]

• Update etherpad-lite to 3.3.11
• Full Changelog
• Pads clients without an author token no longer share one author (GHSA-746x-9w89-7xv6). Since the author token moved to an HttpOnly cookie, a pad connection that carried neither the cookie nor a legacy token resolved its token to null, and every such client was mapped to the same token2author:null author. Unrelated users (for example behind cookie blockers or in cross-site embeds) then appeared as one author and kicked each other off, and any of them counted as the creator of a pad another one had created, so they could delete it or change its pad-wide settings. A connection without a token now gets a fresh one for that session, and the access check does the same for HTTP callers such as import. Reported by @MaBeFHDW.

[Package Updates]

[4.11.3]

• Update etherpad-lite to 3.3.12
• Full Changelog
• Timeslider "Return to pad" no longer follows a cross-origin referrer (GHSA-35rj-7vrx-29wq). The button navigated to document.referrer whenever the character before its last / was p, so a link from https://attacker/p/login to /p/<pad>/timeslider?embed=1 sent the user back to the attacker's site when they clicked it. The referrer is now only followed when it is a pad page on the same origin; otherwise the button returns to the pad. Reported by @sun1024.
• Export revision-bound .etherpad exports only include chat up to that revision. Exporting /p/<pad>/<rev>/export/etherpad shipped the pad's entire chat history, including messages posted after that revision. Reported by @temantih.

[Package Updates]

[4.11.4]

• Update etherpad-lite to 3.3.13
• Full Changelog
• Import .etherpad files can no longer change who owns a pad, make it public or plant a deletion token (GHSA-qq7c-m9pc-7q7v). Importing a .etherpad file into a pad with fewer than 10 revisions wrote every pad:<id>:* record in the file and every field of the pad record. Anyone who could edit a new pad could replace the creator's deletion token with their own, make a private group pad public, or name themselves as the pad's creator. Imports now only take the pad text, revisions and chat. The pad keeps its public status, pad-wide settings come from the file only when the creator imports it, and a file that names a different creator can only be imported by the pad's creator. Reported by @barnessomer.

[Package Updates]

[4.11.5]

• Update etherpad-lite to 3.3.15
• Full Changelog

[Package Updates]

[4.11.6]

• Update etherpad-lite to 3.3.16
• Full Changelog
• Collaboration every socket message now stays bound to the pad it was authorized for (GHSA-c36r-65p6-q3m9, #8458). The earlier fix for GHSA-6mcx-x5h6-rpw2 only pinned the target pad for USER_CHANGES. Chat, history (CHANGESET_REQ), saved revisions, pad options and pad deletion still read the pad from the socket's session when they ran. A second CLIENT_READY on the same socket rewrote that session before its own access check. A message authorized for one pad could then run against another, which leaked the other pad's text, history and chat and let chat messages and saved revisions be written into it, including on pads the user could only view. CLIENT_READY now changes the session only after access is granted, and each message carries the pad and access mode it was authorized with. Reported by @leograntquinn-crypto.
• Database ueberdb2 6.1.19 (#8444). Fixes SQL injection in the MSSQL driver's bulk writes (GHSA-xmqq-59rx-x7pf). Only installs using "dbType": "mssql" are affected.
• The default-content author test no longer depends on the local defaultPadText setting (#8445).
• Dependency updates, including undici 8.12.4, mssql 12.7.14, entities 9.0.0, surrealdb 2.2.2 and resolve 1.22.14.