Tags: bQuery/bQuery
Tags
Release 1.15.1 — security & correctness patch (#202) # Release 1.15.1 — Security & correctness patch Promotes `dev` to `main` for the **1.15.1** patch release. This closes the findings of a full-codebase security & correctness audit (issues [#162](https://github.com/bQuery/bQuery/issues/162)–[#181](https://github.com/bQuery/bQuery/issues/181)). **No breaking changes. No module status transitions.** Every 1.15.0 and earlier API continues to work unchanged — upgrading is a drop-in. ## Security fixes | Area | Fix | Issue | | --- | --- | --- | | security | mXSS-detection fallback in `sanitizeHtml` now HTML-escapes its text result (reachable through every HTML sink) | [#162](#162) | | ssr | `bq-text` on raw-text elements (`textarea`/`title`) escaped in the pure renderer (stored XSS) | [#163](#163) | | view/ssr | `bq-bind` guards `on*`/URL/`srcset`/`srcdoc` values via a shared bind-guard | [#164](#164) | | view | `with`-scoped evaluator shadows dangerous globals — closes `constructor.constructor(…)()` RCE | [#168](#168) | | ssr | DOM-backed evaluator routed through the CSP-safe parser (removes `new Function()`) | [#167](#167) | | server | session + CSRF cookies default to `Secure` | [#169](#169) | | security | Trusted Types wired into HTML sinks (new `trustedHtmlForSink()`) | [#171](#171) | | ssr | `bq-style` declarations validated (CSS injection) | [#176](#176) | | security | expanded DOM-clobbering denylist + duplicate-id stripping | [#179](#179) | | i18n | own-property checks for placeholder/key resolution | [#174](#174) | | store | `deepClone` guards `__proto__` | [#175](#175) | | server | file-route loaders default to the action middleware chain (authz) | [#181](#181) | ## Correctness fixes | Area | Fix | Issue | | --- | --- | --- | | store | `$subscribe` snapshots subscribers (no skip on unsubscribe-during-notify) | [#165](#165) | | reactive | self-triggering effects bounded instead of overflowing the stack | [#166](#166) | | view/compiler | bail on unterminated string / invalid numeric literals | [#170](#170) | | reactive | overlapping `useFetch`/`useAsyncData` abort the superseded request | [#172](#172) | | reactive/concurrency | disposal paths for `deferred()` / `persistedSignal()` (+ `effectScope(detached)`) | [#173](#173) | | ssr | `titleTemplate` inserts the title literally (no `$&` mangling) | [#177](#177) | | core | `debounce({leading,trailing})` no longer double-invokes a single call | [#178](#178) | | view | `bq-on` invokes handlers via evaluation, not a paren heuristic | [#180](#180) | ## Additive APIs (backwards-compatible) - `trustedHtmlForSink()` — `@bquery/bquery/security` (also on `/full`) - `effectScope(detached?)` — `@bquery/bquery/reactive` - `deferred()` handle now exposes `dispose()` ## Migration notes Two behavioural defaults tightened, both with explicit opt-outs: - Server session/CSRF cookies now set `Secure` → pass `cookie: { secure: false }` for local HTTP dev. - File-route JSON loaders now inherit `middlewares` → pass `dataMiddlewares: []` to keep them unauthenticated. ## Release chores - `package.json`: 1.15.0 → 1.15.1 - `CHANGELOG.md`: new `[1.15.1]` section (Security + Fixed) and TOC entry - Docs: new `release-notes/1.15.1` page, nav + index entries, `trustedHtmlForSink()` documented in the Security guide ## Validation - `bun test`: 3043 pass / 0 fail - `tsc --noEmit` (src + tests): clean - `bun run build`: succeeds - `check:stability`, `check:doc-exports` (security 11/11), `check:full-bundle`: pass 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security** * Hardened HTML/SSR rendering and `bq-bind`/`bq-html`/`bq-text` handling against XSS, dangerous URL protocols, DOM clobbering, and prototype-chain attacks. * Added/strengthened Trusted Types protections and SSR CSP-safe evaluation behavior. * Updated secure-by-default cookie settings (session + CSRF) and improved authorization middleware inheritance for generated JSON loader routes. * **Bug Fixes** * Fixed store subscriber notification stability, bounded reactive cyclic re-runs, deferred cleanup/disposal behavior, and overlapping `useFetch` aborting. * Corrected `debounce` leading+trailing behavior and various SSR/template and i18n edge cases. * **New Features** * Added `trustedHtmlForSink` helper for Trusted Types HTML sink assignments. * Added `effectScope(detached)` with manual stopping and enhanced `deferred()` to support explicit disposal. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Jonas Pfalzgraf <[email protected]> Co-authored-by: Claude Fable 5 <[email protected]>
PreviousNext