Etherpad Lite - Package updates

[Package Updates]

[4.10.3]

• Update etherpad-lite to 3.3.3
• Full Changelog
• Prevent pre-auth path traversal / arbitrary file read in /static/* (GHSA-mc8w-wjhw-45x5, #8081).
• Stop shipping a hardcoded OIDC cookie key and reflecting arbitrary CORS origins (GHSA-pp5v-mvwg-76mp, #8070, #8071, #8072).
• Regenerate the session id on authentication (GHSA-73h9-c5xp-gfg4, #8074).
• Apply queued USER_CHANGES to the enqueue-time pad (GHSA-6mcx-x5h6-rpw2, #8075).
• Reject the ueberdb key delimiter : in copyPad/movePad destination ids (GHSA-wg58-mhwv-35pq, #8073).
• Migrate the server build to TypeScript 7 / tsgo (#8039).
• Editor PageDown/PageUp now advance across consecutive long wrapped lines (#7555).
• Docker make the plugin_packages volume mountpoint writable (#8042).

[Package Updates]

[4.10.4]

• Update etherpad-lite to 3.3.5
• Full Changelog
• Fresh installs no longer crash at startup under pnpm 12 (#8232). On first boot (no var/installed_plugins.json), Etherpad runs pnpm ls to migrate plugins found in node_modules, passing --no-production. pnpm 12 renamed that flag to --no-prod and rejects the old name, so the server exited with Error occurred while starting Etherpad before it bound a port. The call now uses --no-prod, which pnpm 10 and 11 also accept. Existing installs were not affected. The repository, release tooling, Docker image and snap also move to pnpm 12.
• Updater spawn pnpm through cross-spawn so updates work on Windows (#8218). On Windows pnpm is a .cmd shim that plain child_process.spawn can't run, so the built-in update actions failed there. Thanks to Kaan elebi.

[Package Updates]

[4.10.5]

• Update etherpad-lite to 3.3.6
• Full Changelog
• 3.3.6 is a security and bug-fix release. It closes an OIDC login bypass for accounts configured without a password (GHSA-62cj-9j72-mfrh), and fixes a batch of reported defects across the installer, the admin settings editor, session transfer, the welcome screen, accessibility and plugin configuration.
• OIDC refuse interactive logins for accounts without a password (GHSA-62cj-9j72-mfrh, #8247).
• PDF export honours font-family without LibreOffice (#8245, #8249).
• Installer the Node version check no longer fails under Windows PowerShell 5.1 (#8214, #8235).
• Admin settings form fields honour escape sequences (#8211, #8239).
• Session transfer preferences survive the transfer, and the cookie is no longer double-encoded (#8171, #8238).
• Session transfer the dialog describes what actually happens (#8173, #8236).
• Welcome screen deleted pads leave the recent list (#8201, #8237).
• Accessibility screen readers can move through a pad line by line (#7778, #8240).
• Plugins settings.ep_<plugin> config blocks are reachable again from require() (#8109, #8110).

[Package Updates]

[4.10.6]

• Update etherpad-lite to 3.3.7
• Full Changelog
• Renderer attribute-pool values can no longer forge class tokens (GHSA-4mx2-rqx5-2pp6, #8302). linestylefilter appended the start and list line-attribute values verbatim to the space-delimited class string that domline parses back, and domline emits any tag: token in that string as a raw element. A start value containing a space, which can be planted through a crafted changeset or .etherpad import, therefore smuggled in a token such as tag:img/src=x/onerror=... and rendered a live element with a live event handler for every viewer of the pad and its timeslider. This is the same function as GHSA-f7h5-v9hm-548j but a different token. start is now emitted only when it is an integer and list only when it is a plain list type, and domline accepts only a bare element name (letters, digits and hyphens) for tag: tokens, which also covers class strings contributed by plugins. Reported by @arpitjain099.
• Auth an empty-string password is refused on both login paths (#8261). A settings.users entry configured as "password": "" authenticated anyone who submitted an empty password, on the OIDC interaction path and on HTTP Basic. Both already failed closed for a nullish password; an empty string slipped through because it is a string and compares equal to an empty submission. Only explicit misconfiguration produces it, so this is hardening rather than a vulnerability. Reported by Wenhao Wu (Southeast University) while verifying the fix for GHSA-62cj-9j72-mfrh.
• Admin the plugin catalog no longer offers deprecated or known-broken plugins (#8246). The "Available plugins" list was built straight from the plugin feed, so any package the feed knew about could be installed from the admin UI including packages npm marks deprecated, packages the plugin registry itself could not get working against the current release, and ep_adminpads2, which is archived upstream and takes over /admin/pads with a template whose scripts core no longer ships, hanging the admin page on "Loading". Those are now filtered out of the catalog, the admin UI refuses to install one if a stale page asks for it anyway (pnpm run plugins i ep_<name> on the server still overrides), and an already-installed plugin in that state is flagged as deprecated in the Installed plugins list. The npm deprecation lookup is cached for 12 hours and fails open: if the registry cannot be reached the full catalog is still listed. Reported by @JohnMcLear.

[Package Updates]

[4.10.7]

• Update etherpad-lite to 3.3.8
• Full Changelog
• 3.3.8 is a security release. It closes an HTTP API privilege escalation for instances using the built-in OIDC provider with API clients (GHSA-38vj-95q4-gwvx).
• HTTP API client_credentials tokens are identified by a signed grant marker (GHSA-38vj-95q4-gwvx). The API decided whether a bearer JWT came from the OAuth2 client_credentials grant by checking whether its sub claim equalled a configured client_id, and client_credentials tokens skip the admin === true claim check. A non-admin user whose account name collided with a configured client ID could therefore use an ordinary login token to get admin access to the HTTP API. This is a variant of GHSA-qfmh-fph3-mw8q. The provider now signs an etherpad_grant: "client_credentials" marker into client_credentials access tokens, and extraParams cannot override it. The API trusts that marker instead of comparing sub to client IDs. Upgrade note: client_credentials tokens issued before the upgrade don't carry the marker and are refused with 401 until they are re-issued. These tokens are short-lived. Reported by Yves Soete of Blacksight LLC (@yssoe).
• OIDC numeric and boolean admin passwords work again (#8263, #8327). The settings loader coerces environment-variable values, so ADMIN_PASSWORD=123456 (for example via settings.json.docker) arrives as the number 123456. The 3.3.6 login check (GHSA-62cj-9j72-mfrh) only accepted string passwords, so these admins could no longer log in. Finite numbers and booleans are now compared as strings. Missing, empty, NaN and non-scalar values are still refused.
• Settings dropdowns open under prefers-reduced-motion (#8290, #8328). With reduced motion enabled, the settings popup kept transform: scale(1). That made the popup the containing block for the dropdown list, so the font and language lists rendered out of view. The popup now uses transform: none. Thanks to @kfogel.

[Package Updates]

[4.10.8]

• Update etherpad-lite to 3.3.9
• Full Changelog
• Plugins dependency names are validated on uninstall as well as install (GHSA-g9xm-3pqr-wcph). GHSA-92hr-gmr6-h8cp made the plugin installer validate dependency names on install, but the uninstall path still passed the raw package.json dependency key to rmSync/unlinkSync. A plugin declaring a dependency named like zzz/../../.. could therefore delete a directory outside the plugin folder when an admin uninstalled it. Every install and uninstall path now resolves dependency paths through one helper that refuses names that escape the plugin directory. Exploiting it needs an admin to install and then uninstall the malicious plugin. Reported by @baeseungwon1010.
• Pad retention delete pads nobody has edited for N days (#8340). A new padRetention setting replaces the unmaintained ep_delete_after_delay plugin without its HTML archive copies or tombstone pads. It is off by default and, once enabled, only logs would delete pad <id> until dryRun is set to false. A periodic sweep reads each pad's last-edit time straight from the database without loading pads into the cache, and an overdue pad is also deleted when someone opens it instead of showing stale content. Deletion uses the same path as the deletePad API. Options: deleteAfterDays, warnBeforeDays, sweepIntervalHours, excludeGroupPads and excludePattern.
• Settings hide the deletion-token modal without widening deletion rights (#7996, #8319). The new suppressPadDeletionTokenModal setting (SUPPRESS_PAD_DELETION_TOKEN_MODAL in the container image) stops the one-time "Save your pad deletion token" modal from appearing. Until now the only way to hide it was allowPadDeletionByAllUsers: true, which also let any editor delete the pad. The token is still issued and still works, and non-creators still can't delete. Thanks to @sirsqm.
• Performance fonts are no longer inlined into the minified CSS (#8268, #8314). The pad stylesheet embedded every editor and icon font as base64, so pad.css was about 1.7 MB and every visitor downloaded all of it before the pad rendered. Fonts are now fetched separately and only when used, and pad.css is about 61 KB. Thanks to @sirsqm.
• Toolbar a popup opened from the toolbar keeps focus (#8345). The editor grabbed focus back after every toolbar command, so in current Firefox Escape didn't close the settings or users popup and typing a name didn't reach the name field.
• Colibris dark mode colours apply everywhere (#8271). The light --text-color and --bg-color values could override the dark ones on elements outside the editor, such as the history banner. Thanks to @bobmullut.
• Session transfer failed requests are reported as failures (#8172, #8273). Errors from the session transfer endpoint were treated as success. They now show a localized error, and a retry clears it. Thanks to @toashu123.
• Share dialog "Read only" is now "Use read-only link" (#8181, #8326). The checkbox switches which link and embed code you copy; it never locked the pad. The new label and an accessible description say so. Thanks to @jum-apzn.
• Localisation updates from translatewiki.net.
• Dependency updates, including express 5.3.0, ejs 7.0.1, nodemailer 10.1.1, surrealdb 2.1.1, mssql 12.7.9 and ueberdb2 6.1.18.

[Package Updates]

[4.11.0]

• Update node-base | final to 24-20261021
• security: fix eMudhra cert compromise

[Package Updates]

[4.11.1]

• Update etherpad-lite to 3.3.10
• Full Changelog

[Package Updates]

[4.11.2]

• Update etherpad-lite to 3.3.11
• Full Changelog
• Pads clients without an author token no longer share one author (GHSA-746x-9w89-7xv6). Since the author token moved to an HttpOnly cookie, a pad connection that carried neither the cookie nor a legacy token resolved its token to null, and every such client was mapped to the same token2author:null author. Unrelated users (for example behind cookie blockers or in cross-site embeds) then appeared as one author and kicked each other off, and any of them counted as the creator of a pad another one had created, so they could delete it or change its pad-wide settings. A connection without a token now gets a fresh one for that session, and the access check does the same for HTTP callers such as import. Reported by @MaBeFHDW.

[Package Updates]

[4.11.3]

• Update etherpad-lite to 3.3.12
• Full Changelog
• Timeslider "Return to pad" no longer follows a cross-origin referrer (GHSA-35rj-7vrx-29wq). The button navigated to document.referrer whenever the character before its last / was p, so a link from https://attacker/p/login to /p/<pad>/timeslider?embed=1 sent the user back to the attacker's site when they clicked it. The referrer is now only followed when it is a pad page on the same origin; otherwise the button returns to the pad. Reported by @sun1024.
• Export revision-bound .etherpad exports only include chat up to that revision. Exporting /p/<pad>/<rev>/export/etherpad shipped the pad's entire chat history, including messages posted after that revision. Reported by @temantih.