Merge tag '2024.5.0-io.4b' into bun

package.json

@@ -1,12 +1,12 @@
 {
 	"name": "misskey",
-	"version": "2024.5.0-io.4a",
+	"version": "2024.5.0-io.4b",
 	"codename": "nasubi",
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/MisskeyIO/misskey.git"
 	},
-	"packageManager": "pnpm@9.12.2",
+	"packageManager": "pnpm@9.12.3",
 	"workspaces": [
 		"packages/frontend",
 		"packages/backend",
@@ -48,13 +48,16 @@
 	},
 	"resolutions": {
 		"@tensorflow/tfjs-core": "4.22.0",
+		"axios": "1.7.7",
 		"chokidar": "4.0.1",
 		"cookie": "1.0.1",
 		"cookie-signature": "1.2.2",
 		"debug": "4.3.7",
 		"esbuild": "0.24.0",
+		"jpeg-js": "0.4.4",
 		"lodash": "4.17.21",
 		"sharp": "0.33.5",
+		"tough-cookie": "5.0.0",
 		"web-streams-polyfill": "4.0.0"
 	},
 	"dependencies": {
@@ -70,7 +73,7 @@
 		"@typescript-eslint/eslint-plugin": "7.10.0",
 		"@typescript-eslint/parser": "7.10.0",
 		"cross-env": "7.0.3",
-		"cypress": "13.15.1",
+		"cypress": "13.15.2",
 		"eslint": "8.57.1",
 		"ncp": "2.0.0",
 		"start-server-and-test": "2.0.8"

packages/backend/package.json

@@ -34,16 +34,16 @@
 		"generate-api-json": "pnpm build && bun run ./scripts/generate_api_json.js"
 	},
 	"optionalDependencies": {
-		"@swc/core-darwin-arm64": "1.8.0",
+		"@swc/core-darwin-arm64": "1.9.1",
-		"@swc/core-darwin-x64": "1.8.0",
+		"@swc/core-darwin-x64": "1.9.1",
-		"@swc/core-linux-arm-gnueabihf": "1.8.0",
+		"@swc/core-linux-arm-gnueabihf": "1.9.1",
-		"@swc/core-linux-arm64-gnu": "1.8.0",
+		"@swc/core-linux-arm64-gnu": "1.9.1",
-		"@swc/core-linux-arm64-musl": "1.8.0",
+		"@swc/core-linux-arm64-musl": "1.9.1",
-		"@swc/core-linux-x64-gnu": "1.8.0",
+		"@swc/core-linux-x64-gnu": "1.9.1",
-		"@swc/core-linux-x64-musl": "1.8.0",
+		"@swc/core-linux-x64-musl": "1.9.1",
-		"@swc/core-win32-arm64-msvc": "1.8.0",
+		"@swc/core-win32-arm64-msvc": "1.9.1",
-		"@swc/core-win32-ia32-msvc": "1.8.0",
+		"@swc/core-win32-ia32-msvc": "1.9.1",
-		"@swc/core-win32-x64-msvc": "1.8.0",
+		"@swc/core-win32-x64-msvc": "1.9.1",
 		"@tensorflow/tfjs": "4.22.0",
 		"@tensorflow/tfjs-node": "4.22.0",
 		"bufferutil": "4.0.8",
@@ -64,8 +64,8 @@
 	},
 	"dependencies": {
 		"@authenio/samlify-node-xmllint": "2.0.0",
-		"@aws-sdk/client-s3": "3.685.0",
+		"@aws-sdk/client-s3": "3.687.0",
-		"@aws-sdk/lib-storage": "3.685.0",
+		"@aws-sdk/lib-storage": "3.687.0",
 		"@bull-board/api": "6.3.3",
 		"@bull-board/fastify": "6.3.3",
 		"@bull-board/ui": "6.3.3",
@@ -81,8 +81,8 @@
 		"@fastify/static": "8.0.2",
 		"@fastify/view": "10.0.1",
 		"@misskey-dev/sharp-read-bmp": "1.2.0",
-		"@misskey-dev/summaly": "5.1.0",
+		"@misskey-dev/summaly": "MisskeyIO/summaly#5.1.1",
-		"@napi-rs/canvas": "0.1.59",
+		"@napi-rs/canvas": "0.1.60",
 		"@nestjs/common": "10.4.7",
 		"@nestjs/core": "10.4.7",
 		"@nestjs/testing": "10.4.7",
@@ -91,7 +91,7 @@
 		"@sinonjs/fake-timers": "11.3.1",
 		"@smithy/node-http-handler": "3.2.5",
 		"@swc/cli": "0.5.0",
-		"@swc/core": "1.8.0",
+		"@swc/core": "1.9.1",
 		"@twemoji/parser": "15.1.1",
 		"accepts": "1.3.8",
 		"ajv": "8.17.1",
@@ -100,9 +100,9 @@
 		"bcryptjs": "2.4.3",
 		"blurhash": "2.0.5",
 		"body-parser": "1.20.3",
-		"bullmq": "5.24.0",
+		"bullmq": "5.25.2",
 		"cacheable-lookup": "7.0.0",
-		"cbor": "10.0.2",
+		"cbor": "10.0.3",
 		"chalk": "5.3.0",
 		"chalk-template": "1.1.0",
 		"chokidar": "4.0.1",
@@ -119,7 +119,7 @@
 		"fluent-ffmpeg": "2.1.3",
 		"form-data": "4.0.1",
 		"got": "14.4.4",
-		"happy-dom": "15.9.0",
+		"happy-dom": "15.11.0",
 		"hpagent": "1.2.0",
 		"htmlescape": "1.1.1",
 		"http-link-header": "1.1.3",
@@ -154,7 +154,7 @@
 		"parse5": "7.2.1",
 		"pg": "8.13.1",
 		"pino": "9.5.0",
-		"pino-pretty": "11.3.0",
+		"pino-pretty": "12.0.0",
 		"pkce-challenge": "4.1.0",
 		"probe-image-size": "7.2.3",
 		"promise-limit": "2.7.0",

packages/backend/src/misc/sql-like-escape.ts

@@ -4,5 +4,5 @@
  */
 
 export function sqlLikeEscape(s: string) {
-	return s.replace(/([%_])/g, '\\$1');
+	return s.replace(/([\\%_])/g, '\\$1');
 }

packages/backend/src/server/web/UrlPreviewService.ts

@@ -6,7 +6,7 @@
 import { Inject, Injectable } from '@nestjs/common';
 import RE2 from 're2';
 import { summaly } from '@misskey-dev/summaly';
-import { SummalyResult } from '@misskey-dev/summaly/built/summary.js';
+import { SummalyResult } from '@misskey-dev/summaly/dist/summary.js';
 import { DI } from '@/di-symbols.js';
 import type { Config } from '@/config.js';
 import { MetaService } from '@/core/MetaService.js';

packages/frontend/package.json

@@ -41,7 +41,7 @@
 		"chartjs-chart-matrix": "2.0.1",
 		"chartjs-plugin-gradient": "0.6.1",
 		"chartjs-plugin-zoom": "2.0.1",
-		"chromatic": "11.16.5",
+		"chromatic": "11.18.0",
 		"compare-versions": "6.1.1",
 		"cropperjs": "2.0.0-rc.0",
 		"date-fns": "4.1.0",
@@ -80,7 +80,7 @@
 	},
 	"devDependencies": {
 		"@misskey-dev/eslint-plugin": "1.0.0",
-		"@misskey-dev/summaly": "5.1.0",
+		"@misskey-dev/summaly": "MisskeyIO/summaly#5.1.1",
 		"@storybook/addon-actions": "8.4.2",
 		"@storybook/addon-essentials": "8.4.2",
 		"@storybook/addon-interactions": "8.4.2",
@@ -116,15 +116,15 @@
 		"@vue/runtime-core": "3.5.12",
 		"acorn": "8.14.0",
 		"cross-env": "7.0.3",
-		"cypress": "13.15.1",
+		"cypress": "13.15.2",
 		"eslint": "8.57.1",
 		"eslint-plugin-import": "2.31.0",
 		"eslint-plugin-vue": "9.30.0",
 		"fast-glob": "3.3.2",
-		"happy-dom": "15.9.0",
+		"happy-dom": "15.11.0",
 		"intersection-observer": "0.12.2",
 		"micromatch": "4.0.8",
-		"msw": "2.6.0",
+		"msw": "2.6.2",
 		"msw-storybook-addon": "2.0.4",
 		"nodemon": "3.1.7",
 		"prettier": "3.3.3",

packages/frontend/src/pages/auth.vue

@@ -62,7 +62,7 @@ function accepted() {
 	state.value = 'accepted';
 	if (session.value && session.value.app.callbackUrl) {
 		const url = new URL(session.value.app.callbackUrl);
-		if (['javascript:', 'file:', 'data:', 'mailto:', 'tel:'].includes(url.protocol)) throw new Error('invalid url');
+		if (['javascript:', 'file:', 'data:', 'mailto:', 'tel:', 'vbscript:'].includes(url.protocol)) throw new Error('invalid url');
 		location.href = `${session.value.app.callbackUrl}?token=${session.value.token}`;
 	}
 }

packages/frontend/src/pages/miauth.vue

@@ -65,7 +65,7 @@ async function onAccept(token: string) {
 
 	if (props.callback && props.callback !== '') {
 		const cbUrl = new URL(props.callback);
-		if (['javascript:', 'file:', 'data:', 'mailto:', 'tel:'].includes(cbUrl.protocol)) throw new Error('invalid url');
+		if (['javascript:', 'file:', 'data:', 'mailto:', 'tel:', 'vbscript:'].includes(cbUrl.protocol)) throw new Error('invalid url');
 		cbUrl.searchParams.set('session', props.session);
 		location.href = cbUrl.toString();
 	} else {

packages/frontend/src/scripts/sound.ts

@@ -11,6 +11,15 @@ import { RateLimiter } from '@/scripts/rate-limiter.js';
 let ctx: AudioContext;
 const cache = new Map<string, AudioBuffer>();
 
+function isValidUrl(url: string): boolean {
+	try {
+		new URL(url);
+		return true;
+	} catch (_) {
+		return false;
+	}
+}
+
 export const soundsTypes = [
 	// 音声なし
 	null,
@@ -260,8 +269,12 @@ export function createSourceNode(buffer: AudioBuffer, opts: {
  */
 export async function getSoundDuration(file: string): Promise<number> {
 	const audioEl = document.createElement('audio');
-	audioEl.src = file;
+	audioEl.src = isValidUrl(file) ? file : '';
-	return new Promise((resolve) => {
+	return new Promise((resolve, reject) => {
+		if (!audioEl.src) {
+			reject(new Error('Invalid URL'));
+			return;
+		}
 		const si = setInterval(() => {
 			if (audioEl.readyState > 0) {
 				resolve(audioEl.duration * 1000);

packages/misskey-js/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "misskey-js",
-	"version": "2024.5.0-io.4a",
+	"version": "2024.5.0-io.4b",
 	"description": "Misskey SDK for JavaScript",
 	"types": "./built/dts/index.d.ts",
 	"exports": {
@@ -59,7 +59,7 @@
 	],
 	"dependencies": {
 		"@swc/cli": "0.5.0",
-		"@swc/core": "1.8.0",
+		"@swc/core": "1.9.1",
 		"eventemitter3": "5.0.1",
 		"reconnecting-websocket": "4.4.0"
 	}