{"payload":{"feedbackUrl":"https://github.com/orgs/community/discussions/53140","repo":{"id":114829503,"defaultBranch":"master","name":"remark42","ownerLogin":"umputun","currentUserCanPush":false,"isFork":false,"isEmpty":false,"createdAt":"2017-12-20T01:42:35.000Z","ownerAvatar":"https://avatars.githubusercontent.com/u/535880?v=4","public":true,"private":false,"isOrgOwned":false},"refInfo":{"name":"","listCacheKey":"v0:1726889515.0","currentOid":""},"activityList":{"items":[{"before":"8906b1ed59a52ca4770990bd06321b6faf3814ec","after":null,"ref":"refs/heads/dependabot/npm_and_yarn/site/micromatch-4.0.8","pushedAt":"2024-09-21T03:31:55.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"umputun","name":"Umputun","path":"/umputun","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/535880?s=80&v=4"}},{"before":"872b818323dbc724affd14f8f8414d289ed17636","after":"2a9b29dd532a91ae219a4e6f2d842674118023bc","ref":"refs/heads/master","pushedAt":"2024-09-21T03:31:53.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"umputun","name":"Umputun","path":"/umputun","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/535880?s=80&v=4"},"commit":{"message":"Bump micromatch from 4.0.5 to 4.0.8 in /site\n\nBumps [micromatch](https://github.com/micromatch/micromatch) from 4.0.5 to 4.0.8.\n- [Release notes](https://github.com/micromatch/micromatch/releases)\n- [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/micromatch/micromatch/compare/4.0.5...4.0.8)\n\n---\nupdated-dependencies:\n- dependency-name: micromatch\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>","shortMessageHtmlLink":"Bump micromatch from 4.0.5 to 4.0.8 in /site"}},{"before":"1ccbdd64a118ab530bec41ab1c8dcad776d5f2f4","after":"8906b1ed59a52ca4770990bd06321b6faf3814ec","ref":"refs/heads/dependabot/npm_and_yarn/site/micromatch-4.0.8","pushedAt":"2024-09-21T02:38:38.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"dependabot[bot]","name":null,"path":"/apps/dependabot","primaryAvatarUrl":"https://avatars.githubusercontent.com/in/29110?s=80&v=4"},"commit":{"message":"Bump micromatch from 4.0.5 to 4.0.8 in /site\n\nBumps [micromatch](https://github.com/micromatch/micromatch) from 4.0.5 to 4.0.8.\n- [Release notes](https://github.com/micromatch/micromatch/releases)\n- [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/micromatch/micromatch/compare/4.0.5...4.0.8)\n\n---\nupdated-dependencies:\n- dependency-name: micromatch\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>","shortMessageHtmlLink":"Bump micromatch from 4.0.5 to 4.0.8 in /site"}},{"before":null,"after":"bd8769f87f3661046f258215b0cad4c5a2ea9629","ref":"refs/heads/paskal/fix_avatar_types","pushedAt":"2024-09-21T02:35:44.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"paskal","name":"Dmitry Verkhoturov","path":"/paskal","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/712534?s=80&v=4"},"commit":{"message":"Detect proper avatar type to return instead of returning image/*","shortMessageHtmlLink":"Detect proper avatar type to return instead of returning image/*"}},{"before":"4a7bee1d98126234b3ba5e9ac477e091d522c4f5","after":"872b818323dbc724affd14f8f8414d289ed17636","ref":"refs/heads/master","pushedAt":"2024-09-20T00:06:06.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"umputun","name":"Umputun","path":"/umputun","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/535880?s=80&v=4"},"commit":{"message":"docs: fix frontend paths in translation guide (`frontend/{path}` -> `frontend/apps/remark42/{path}`)","shortMessageHtmlLink":"docs: fix frontend paths in translation guide (<code>frontend/{path}</code> -&gt; `…"}},{"before":"6d1bacefe9027ebca14dedb0efd96e9d5a0cdaaa","after":null,"ref":"refs/heads/paskal/fix_anon_usernames_doc","pushedAt":"2024-09-20T00:05:45.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"umputun","name":"Umputun","path":"/umputun","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/535880?s=80&v=4"}},{"before":"cbe793fb42dadd1d0e3ec6a576d88d4085a552ec","after":"4a7bee1d98126234b3ba5e9ac477e091d522c4f5","ref":"refs/heads/master","pushedAt":"2024-09-20T00:05:43.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"umputun","name":"Umputun","path":"/umputun","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/535880?s=80&v=4"},"commit":{"message":"Fix restrictions for anonymous usernames\n\nTested on remark42 demo to clarify what works and what doesn't.","shortMessageHtmlLink":"Fix restrictions for anonymous usernames"}},{"before":"efb33fa6846ef7dc49ec2211bc1b8ace01ef604d","after":null,"ref":"refs/heads/dependabot/npm_and_yarn/site/path-to-regexp-6.3.0","pushedAt":"2024-09-20T00:05:24.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"umputun","name":"Umputun","path":"/umputun","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/535880?s=80&v=4"}},{"before":"cbf9a82a926f9b2951cb401243e6126f71aa894b","after":"cbe793fb42dadd1d0e3ec6a576d88d4085a552ec","ref":"refs/heads/master","pushedAt":"2024-09-20T00:05:23.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"umputun","name":"Umputun","path":"/umputun","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/535880?s=80&v=4"},"commit":{"message":"Bump path-to-regexp from 6.2.1 to 6.3.0 in /site\n\nBumps [path-to-regexp](https://github.com/pillarjs/path-to-regexp) from 6.2.1 to 6.3.0.\n- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)\n- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)\n- [Commits](https://github.com/pillarjs/path-to-regexp/compare/v6.2.1...v6.3.0)\n\n---\nupdated-dependencies:\n- dependency-name: path-to-regexp\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>","shortMessageHtmlLink":"Bump path-to-regexp from 6.2.1 to 6.3.0 in /site"}},{"before":"72b35bd2558145719ec6c3227ad08bfd4121ee9f","after":null,"ref":"refs/heads/paskal/improve_docker_build","pushedAt":"2024-09-20T00:05:03.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"umputun","name":"Umputun","path":"/umputun","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/535880?s=80&v=4"}},{"before":"6cd5c45a6c7da899e62b87eef4f41c5594caa728","after":"cbf9a82a926f9b2951cb401243e6126f71aa894b","ref":"refs/heads/master","pushedAt":"2024-09-20T00:05:01.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"umputun","name":"Umputun","path":"/umputun","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/535880?s=80&v=4"},"commit":{"message":"Move gcc installation before backend files addition\n\nThis allows to not reinstall apk files when backend files change and the\nnew image is built.","shortMessageHtmlLink":"Move gcc installation before backend files addition"}},{"before":"835953a26025e75866e9bcacbc0cf5103313affc","after":"72b35bd2558145719ec6c3227ad08bfd4121ee9f","ref":"refs/heads/paskal/improve_docker_build","pushedAt":"2024-09-20T00:04:52.000Z","pushType":"push","commitsCount":2,"pusher":{"login":"umputun","name":"Umputun","path":"/umputun","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/535880?s=80&v=4"},"commit":{"message":"Merge branch 'master' into paskal/improve_docker_build","shortMessageHtmlLink":"Merge branch 'master' into paskal/improve_docker_build"}},{"before":"f9e51e037b8ae6b8f8d5fa4945f1baddc1e472b4","after":null,"ref":"refs/heads/paskal/fix_logout","pushedAt":"2024-09-20T00:04:23.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"umputun","name":"Umputun","path":"/umputun","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/535880?s=80&v=4"}},{"before":"0bc85a6ff6aabc34d7443ceaa3904cfc78329a6a","after":"6cd5c45a6c7da899e62b87eef4f41c5594caa728","ref":"refs/heads/master","pushedAt":"2024-09-20T00:04:21.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"umputun","name":"Umputun","path":"/umputun","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/535880?s=80&v=4"},"commit":{"message":"Fix problem with logout button\n\nThe logout auth endpoint was returning no response body and type\napplication/json which is not valid, this commit changes it to return\nplain/text instead which makes it valid.","shortMessageHtmlLink":"Fix problem with logout button"}},{"before":"e4ab202615ea2f4a89bad9a7c892a213be368e36","after":"f9e51e037b8ae6b8f8d5fa4945f1baddc1e472b4","ref":"refs/heads/paskal/fix_logout","pushedAt":"2024-09-19T23:49:36.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"paskal","name":"Dmitry Verkhoturov","path":"/paskal","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/712534?s=80&v=4"},"commit":{"message":"Fix problem with logout button\n\nThe logout auth endpoint was returning no response body and type\napplication/json which is not valid, this commit changes it to return\nplain/text instead which makes it valid.","shortMessageHtmlLink":"Fix problem with logout button"}},{"before":null,"after":"e4ab202615ea2f4a89bad9a7c892a213be368e36","ref":"refs/heads/paskal/fix_logout","pushedAt":"2024-09-19T23:39:30.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"paskal","name":"Dmitry Verkhoturov","path":"/paskal","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/712534?s=80&v=4"},"commit":{"message":"Fix problem with logout button\n\nThe logout auth endpoint was returning no response body and type\napplication/json which is not valid, this commit changes it to return\nplain/text instead which makes it valid.","shortMessageHtmlLink":"Fix problem with logout button"}},{"before":null,"after":"835953a26025e75866e9bcacbc0cf5103313affc","ref":"refs/heads/paskal/improve_docker_build","pushedAt":"2024-09-19T23:03:31.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"paskal","name":"Dmitry Verkhoturov","path":"/paskal","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/712534?s=80&v=4"},"commit":{"message":"Move gcc installation before backend files addition\n\nThis allows to not reinstall apk files when backend files change and the\nnew image is built.","shortMessageHtmlLink":"Move gcc installation before backend files addition"}},{"before":null,"after":"efb33fa6846ef7dc49ec2211bc1b8ace01ef604d","ref":"refs/heads/dependabot/npm_and_yarn/site/path-to-regexp-6.3.0","pushedAt":"2024-09-12T18:51:49.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"dependabot[bot]","name":null,"path":"/apps/dependabot","primaryAvatarUrl":"https://avatars.githubusercontent.com/in/29110?s=80&v=4"},"commit":{"message":"Bump path-to-regexp from 6.2.1 to 6.3.0 in /site\n\nBumps [path-to-regexp](https://github.com/pillarjs/path-to-regexp) from 6.2.1 to 6.3.0.\n- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)\n- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)\n- [Commits](https://github.com/pillarjs/path-to-regexp/compare/v6.2.1...v6.3.0)\n\n---\nupdated-dependencies:\n- dependency-name: path-to-regexp\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>","shortMessageHtmlLink":"Bump path-to-regexp from 6.2.1 to 6.3.0 in /site"}},{"before":null,"after":"6d1bacefe9027ebca14dedb0efd96e9d5a0cdaaa","ref":"refs/heads/paskal/fix_anon_usernames_doc","pushedAt":"2024-09-08T22:46:13.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"paskal","name":"Dmitry Verkhoturov","path":"/paskal","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/712534?s=80&v=4"},"commit":{"message":"Fix restrictions for anonymous usernames\n\nTested on remark42 demo to clarify what works and what doesn't.","shortMessageHtmlLink":"Fix restrictions for anonymous usernames"}},{"before":null,"after":"1ccbdd64a118ab530bec41ab1c8dcad776d5f2f4","ref":"refs/heads/dependabot/npm_and_yarn/site/micromatch-4.0.8","pushedAt":"2024-09-08T14:29:28.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"dependabot[bot]","name":null,"path":"/apps/dependabot","primaryAvatarUrl":"https://avatars.githubusercontent.com/in/29110?s=80&v=4"},"commit":{"message":"Bump micromatch from 4.0.5 to 4.0.8 in /site\n\nBumps [micromatch](https://github.com/micromatch/micromatch) from 4.0.5 to 4.0.8.\n- [Release notes](https://github.com/micromatch/micromatch/releases)\n- [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/micromatch/micromatch/compare/4.0.5...4.0.8)\n\n---\nupdated-dependencies:\n- dependency-name: micromatch\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>","shortMessageHtmlLink":"Bump micromatch from 4.0.5 to 4.0.8 in /site"}},{"before":"88bf4b7d7048fff9b0080c9f753b6cc902b21067","after":"0bc85a6ff6aabc34d7443ceaa3904cfc78329a6a","ref":"refs/heads/master","pushedAt":"2024-08-24T23:08:09.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"umputun","name":"Umputun","path":"/umputun","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/535880?s=80&v=4"},"commit":{"message":"added RTL support","shortMessageHtmlLink":"added RTL support"}},{"before":"a9b439602b094a694c30d4de47056f3fa2ed9734","after":"88bf4b7d7048fff9b0080c9f753b6cc902b21067","ref":"refs/heads/master","pushedAt":"2024-08-24T00:19:59.000Z","pushType":"pr_merge","commitsCount":5,"pusher":{"login":"umputun","name":"Umputun","path":"/umputun","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/535880?s=80&v=4"},"commit":{"message":"✨ feat: Update CLI help message","shortMessageHtmlLink":"✨ feat: Update CLI help message"}},{"before":"dcc664040f164b47d90f388b892a89cb875685d9","after":"35aa780f256ea41f47491c4608521afd9d1a765d","ref":"refs/heads/paskal/csp","pushedAt":"2024-08-06T21:43:43.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"paskal","name":"Dmitry Verkhoturov","path":"/paskal","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/712534?s=80&v=4"},"commit":{"message":"Add Content-Security-Policy and Permissions-Policy headers\n\n`Content-Security-Policy` now restricts resource loading and execution\nto enhance security:\n  - `default-src 'none'`: Disallow all resource loading by default.\n  - `base-uri 'none'`: Prevents the use of `<base>` tag to change the\n  base URL for relative URLs.\n  - `form-action 'none'`: Disallows form submissions.\n  - `connect-src 'self'`: Restricts the origins that can be connected to\n   (via XHR, WebSockets, etc.) to the same origin.\n  - `frame-src 'self'`: Restricts the origins that can be embedded using\n   `<frame>` and `<iframe>` to the same origin (for `/web/` demo\n    endpoint).\n  - `frame-ancestors %s;`: Specifies the origins that are allowed to\n  embed this content in a frame. If no specific origins are allowed, it\n  defaults to `*` (any origin). This enhances security by controlling\n  which sites can embed your content.\n  - `img-src 'self'`: Allows images to be loaded only from the same\n  origin. If `imageProxyEnabled` is true, allows images from any origin\n  (`*`).\n  - `script-src 'self' 'unsafe-inline'`: Allows scripts to be loaded and\n   executed only from the same origin and allows inline scripts.\n  - `style-src 'self' 'unsafe-inline'`: Allows styles to be loaded and\n  applied only from the same origin and allows inline styles.\n  - `font-src data:`: Allows fonts to be loaded from data URIs.\n  - `object-src 'none'`: Disallows the use of `<object>`, `<embed>`, and\n   `<applet>` tags.\n\n`Permissions-Policy` now restricts the use of certain browser features\nwhich we don't use to enhance user privacy and security:\n  - `accelerometer=()`: Disables the use of the accelerometer sensor.\n  - `autoplay=()`: Disables automatic playback of media.\n  - `camera=()`: Disables the use of the camera.\n  - `cross-origin-isolated=()`: Disallows the page from being treated as\n   cross-origin isolated.\n  - `display-capture=()`: Disables the ability to capture the display.\n  - `encrypted-media=()`: Disables the use of Encrypted Media Extensions\n  .\n  - `fullscreen=()`: Disables the ability to use fullscreen mode.\n  - `geolocation=()`: Disables the use of geolocation.\n  - `gyroscope=()`: Disables the use of the gyroscope sensor.\n  - `keyboard-map=()`: Disables the use of the keyboard map.\n  - `magnetometer=()`: Disables the use of the magnetometer sensor.\n  - `microphone=()`: Disables the use of the microphone.\n  - `midi=()`: Disables the use of the MIDI API.\n  - `payment=()`: Disables the Payment Request API.\n  - `picture-in-picture=()`: Disables the use of Picture-in-Picture mode\n  .\n  - `publickey-credentials-get=()`: Disables the use of the Web\n  Authentication API.\n  - `screen-wake-lock=()`: Disables the ability to prevent the screen\n  from dimming.\n  - `sync-xhr=()`: Disables synchronous XMLHttpRequest.\n  - `usb=()`: Disables the use of the USB API.\n  - `xr-spatial-tracking=()`: Disables the use of spatial tracking in\n  WebXR.\n  - `clipboard-read=()`: Disables the ability to read from the clipboard\n  .\n  - `clipboard-write=()`: Disables the ability to write to the clipboard\n  .\n  - `gamepad=()`: Disables the use of the Gamepad API.\n  - `hid=()`: Disables the use of the Human Interface Device API.\n  - `idle-detection=()`: Disables the ability to detect idle state.\n  - `interest-cohort=()`: Disables the use of interest cohort tracking.\n  - `serial=()`: Disables the use of the Serial API.\n  - `unload=()`: Disables the ability to use the `beforeunload` and\n  `unload` events.\n  - `window-management=()`: Disables the ability to use window\n  management APIs.","shortMessageHtmlLink":"Add Content-Security-Policy and Permissions-Policy headers"}},{"before":"be89b16b89ba72f00b48b7aca709d6d06a83b9be","after":"dcc664040f164b47d90f388b892a89cb875685d9","ref":"refs/heads/paskal/csp","pushedAt":"2024-08-04T22:39:12.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"paskal","name":"Dmitry Verkhoturov","path":"/paskal","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/712534?s=80&v=4"},"commit":{"message":"Add Content-Security-Policy and Permissions-Policy headers\n\n`Content-Security-Policy` now restricts resource loading and execution\nto enhance security:\n  - `default-src 'none'`: Disallow all resource loading by default.\n  - `base-uri 'none'`: Prevents the use of `<base>` tag to change the\n  base URL for relative URLs.\n  - `form-action 'none'`: Disallows form submissions.\n  - `connect-src 'self'`: Restricts the origins that can be connected to\n   (via XHR, WebSockets, etc.) to the same origin.\n  - `frame-src 'self'`: Restricts the origins that can be embedded using\n   `<frame>` and `<iframe>` to the same origin (for `/web/` demo\n    endpoint).\n  - `frame-ancestors %s;`: Specifies the origins that are allowed to\n  embed this content in a frame. If no specific origins are allowed, it\n  defaults to `*` (any origin). This enhances security by controlling\n  which sites can embed your content.\n  - `img-src 'self'`: Allows images to be loaded only from the same\n  origin. If `imageProxyEnabled` is true, allows images from any origin\n  (`*`).\n  - `script-src 'self' 'unsafe-inline'`: Allows scripts to be loaded and\n   executed only from the same origin and allows inline scripts.\n  - `style-src 'self' 'unsafe-inline'`: Allows styles to be loaded and\n  applied only from the same origin and allows inline styles.\n  - `font-src data:`: Allows fonts to be loaded from data URIs.\n  - `object-src 'none'`: Disallows the use of `<object>`, `<embed>`, and\n   `<applet>` tags.\n\n`Permissions-Policy` now restricts the use of certain browser features\nwhich we don't use to enhance user privacy and security:\n  - `accelerometer=()`: Disables the use of the accelerometer sensor.\n  - `autoplay=()`: Disables automatic playback of media.\n  - `camera=()`: Disables the use of the camera.\n  - `cross-origin-isolated=()`: Disallows the page from being treated as\n   cross-origin isolated.\n  - `display-capture=()`: Disables the ability to capture the display.\n  - `encrypted-media=()`: Disables the use of Encrypted Media Extensions\n  .\n  - `fullscreen=()`: Disables the ability to use fullscreen mode.\n  - `geolocation=()`: Disables the use of geolocation.\n  - `gyroscope=()`: Disables the use of the gyroscope sensor.\n  - `keyboard-map=()`: Disables the use of the keyboard map.\n  - `magnetometer=()`: Disables the use of the magnetometer sensor.\n  - `microphone=()`: Disables the use of the microphone.\n  - `midi=()`: Disables the use of the MIDI API.\n  - `payment=()`: Disables the Payment Request API.\n  - `picture-in-picture=()`: Disables the use of Picture-in-Picture mode\n  .\n  - `publickey-credentials-get=()`: Disables the use of the Web\n  Authentication API.\n  - `screen-wake-lock=()`: Disables the ability to prevent the screen\n  from dimming.\n  - `sync-xhr=()`: Disables synchronous XMLHttpRequest.\n  - `usb=()`: Disables the use of the USB API.\n  - `xr-spatial-tracking=()`: Disables the use of spatial tracking in\n  WebXR.\n  - `clipboard-read=()`: Disables the ability to read from the clipboard\n  .\n  - `clipboard-write=()`: Disables the ability to write to the clipboard\n  .\n  - `gamepad=()`: Disables the use of the Gamepad API.\n  - `hid=()`: Disables the use of the Human Interface Device API.\n  - `idle-detection=()`: Disables the ability to detect idle state.\n  - `interest-cohort=()`: Disables the use of interest cohort tracking.\n  - `serial=()`: Disables the use of the Serial API.\n  - `unload=()`: Disables the ability to use the `beforeunload` and\n  `unload` events.\n  - `window-management=()`: Disables the ability to use window\n  management APIs.","shortMessageHtmlLink":"Add Content-Security-Policy and Permissions-Policy headers"}},{"before":"afa9524a079e0c4811bca9aeb0574663f0706650","after":"be89b16b89ba72f00b48b7aca709d6d06a83b9be","ref":"refs/heads/paskal/csp","pushedAt":"2024-08-04T22:34:59.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"paskal","name":"Dmitry Verkhoturov","path":"/paskal","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/712534?s=80&v=4"},"commit":{"message":"Add Content-Security-Policy and Permissions-Policy headers\n\n`Content-Security-Policy` now restricts resource loading and execution\nto enhance security:\n  - `default-src 'none'`: Disallow all resource loading by default.\n  - `base-uri 'none'`: Prevents the use of `<base>` tag to change the\n  base URL for relative URLs.\n  - `form-action 'none'`: Disallows form submissions.\n  - `connect-src 'self'`: Restricts the origins that can be connected to\n   (via XHR, WebSockets, etc.) to the same origin.\n  - `frame-src 'self'`: Restricts the origins that can be embedded using\n   `<frame>` and `<iframe>` to the same origin (for `/web/` demo\n    endpoint).\n  - `frame-ancestors %s;`: Specifies the origins that are allowed to\n  embed this content in a frame. If no specific origins are allowed, it\n  defaults to `*` (any origin). This enhances security by controlling\n  which sites can embed your content.\n  - `img-src 'self'`: Allows images to be loaded only from the same\n  origin. If `imageProxyEnabled` is true, allows images from any origin\n  (`*`).\n  - `script-src 'self' 'unsafe-inline'`: Allows scripts to be loaded and\n   executed only from the same origin and allows inline scripts.\n  - `style-src 'self' 'unsafe-inline'`: Allows styles to be loaded and\n  applied only from the same origin and allows inline styles.\n  - `font-src data:`: Allows fonts to be loaded from data URIs.\n  - `object-src 'none'`: Disallows the use of `<object>`, `<embed>`, and\n   `<applet>` tags.\n\n`Permissions-Policy` now restricts the use of certain browser features\nwhich we don't use to enhance user privacy and security:\n  - `accelerometer=()`: Disables the use of the accelerometer sensor.\n  - `autoplay=()`: Disables automatic playback of media.\n  - `camera=()`: Disables the use of the camera.\n  - `cross-origin-isolated=()`: Disallows the page from being treated as\n   cross-origin isolated.\n  - `display-capture=()`: Disables the ability to capture the display.\n  - `encrypted-media=()`: Disables the use of Encrypted Media Extensions\n  .\n  - `fullscreen=()`: Disables the ability to use fullscreen mode.\n  - `geolocation=()`: Disables the use of geolocation.\n  - `gyroscope=()`: Disables the use of the gyroscope sensor.\n  - `keyboard-map=()`: Disables the use of the keyboard map.\n  - `magnetometer=()`: Disables the use of the magnetometer sensor.\n  - `microphone=()`: Disables the use of the microphone.\n  - `midi=()`: Disables the use of the MIDI API.\n  - `payment=()`: Disables the Payment Request API.\n  - `picture-in-picture=()`: Disables the use of Picture-in-Picture mode\n  .\n  - `publickey-credentials-get=()`: Disables the use of the Web\n  Authentication API.\n  - `screen-wake-lock=()`: Disables the ability to prevent the screen\n  from dimming.\n  - `sync-xhr=()`: Disables synchronous XMLHttpRequest.\n  - `usb=()`: Disables the use of the USB API.\n  - `xr-spatial-tracking=()`: Disables the use of spatial tracking in\n  WebXR.\n  - `clipboard-read=()`: Disables the ability to read from the clipboard\n  .\n  - `clipboard-write=()`: Disables the ability to write to the clipboard\n  .\n  - `gamepad=()`: Disables the use of the Gamepad API.\n  - `hid=()`: Disables the use of the Human Interface Device API.\n  - `idle-detection=()`: Disables the ability to detect idle state.\n  - `interest-cohort=()`: Disables the use of interest cohort tracking.\n  - `serial=()`: Disables the use of the Serial API.\n  - `unload=()`: Disables the ability to use the `beforeunload` and\n  `unload` events.\n  - `window-management=()`: Disables the ability to use window\n  management APIs.","shortMessageHtmlLink":"Add Content-Security-Policy and Permissions-Policy headers"}},{"before":"09e663709217e86cbf45c81b6b06d5580bb3e837","after":"afa9524a079e0c4811bca9aeb0574663f0706650","ref":"refs/heads/paskal/csp","pushedAt":"2024-08-04T22:21:46.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"paskal","name":"Dmitry Verkhoturov","path":"/paskal","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/712534?s=80&v=4"},"commit":{"message":"Add Content-Security-Policy and Permissions-Policy headers\n\n`Content-Security-Policy` now restricts resource loading and execution\nto enhance security:\n  - `default-src 'none'`: Disallow all resource loading by default.\n  - `base-uri 'none'`: Prevents the use of `<base>` tag to change the\n  base URL for relative URLs.\n  - `form-action 'none'`: Disallows form submissions.\n  - `connect-src 'self'`: Restricts the origins that can be connected to\n   (via XHR, WebSockets, etc.) to the same origin.\n  - `frame-src 'self'`: Restricts the origins that can be embedded using\n   `<frame>` and `<iframe>` to the same origin (for `/web/` demo\n    endpoint).\n  - `frame-ancestors %s;`: Specifies the origins that are allowed to\n  embed this content in a frame. If no specific origins are allowed, it\n  defaults to `*` (any origin). This enhances security by controlling\n  which sites can embed your content.\n  - `img-src 'self'`: Allows images to be loaded only from the same\n  origin. If `imageProxyEnabled` is true, allows images from any origin\n  (`*`).\n  - `script-src 'self' 'unsafe-inline'`: Allows scripts to be loaded and\n   executed only from the same origin and allows inline scripts.\n  - `style-src 'self' 'unsafe-inline'`: Allows styles to be loaded and\n  applied only from the same origin and allows inline styles.\n  - `font-src data:`: Allows fonts to be loaded from data URIs.\n  - `object-src 'none'`: Disallows the use of `<object>`, `<embed>`, and\n   `<applet>` tags.\n\n`Permissions-Policy` now restricts the use of certain browser features\nwhich we don't use to enhance user privacy and security:\n  - `accelerometer=()`: Disables the use of the accelerometer sensor.\n  - `autoplay=()`: Disables automatic playback of media.\n  - `camera=()`: Disables the use of the camera.\n  - `cross-origin-isolated=()`: Disallows the page from being treated as\n   cross-origin isolated.\n  - `display-capture=()`: Disables the ability to capture the display.\n  - `encrypted-media=()`: Disables the use of Encrypted Media Extensions\n  .\n  - `fullscreen=()`: Disables the ability to use fullscreen mode.\n  - `geolocation=()`: Disables the use of geolocation.\n  - `gyroscope=()`: Disables the use of the gyroscope sensor.\n  - `keyboard-map=()`: Disables the use of the keyboard map.\n  - `magnetometer=()`: Disables the use of the magnetometer sensor.\n  - `microphone=()`: Disables the use of the microphone.\n  - `midi=()`: Disables the use of the MIDI API.\n  - `payment=()`: Disables the Payment Request API.\n  - `picture-in-picture=()`: Disables the use of Picture-in-Picture mode\n  .\n  - `publickey-credentials-get=()`: Disables the use of the Web\n  Authentication API.\n  - `screen-wake-lock=()`: Disables the ability to prevent the screen\n  from dimming.\n  - `sync-xhr=()`: Disables synchronous XMLHttpRequest.\n  - `usb=()`: Disables the use of the USB API.\n  - `xr-spatial-tracking=()`: Disables the use of spatial tracking in\n  WebXR.\n  - `clipboard-read=()`: Disables the ability to read from the clipboard\n  .\n  - `clipboard-write=()`: Disables the ability to write to the clipboard\n  .\n  - `gamepad=()`: Disables the use of the Gamepad API.\n  - `hid=()`: Disables the use of the Human Interface Device API.\n  - `idle-detection=()`: Disables the ability to detect idle state.\n  - `interest-cohort=()`: Disables the use of interest cohort tracking.\n  - `serial=()`: Disables the use of the Serial API.\n  - `unload=()`: Disables the ability to use the `beforeunload` and\n  `unload` events.\n  - `window-management=()`: Disables the ability to use window\n  management APIs.","shortMessageHtmlLink":"Add Content-Security-Policy and Permissions-Policy headers"}},{"before":null,"after":"09e663709217e86cbf45c81b6b06d5580bb3e837","ref":"refs/heads/paskal/csp","pushedAt":"2024-08-04T22:00:20.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"paskal","name":"Dmitry Verkhoturov","path":"/paskal","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/712534?s=80&v=4"},"commit":{"message":"Add Content-Security-Policy and Permissions-Policy headers\n\n`Content-Security-Policy` now restricts resource loading and execution\nto enhance security:\n  - `default-src 'none'`: Disallow all resource loading by default.\n  - `base-uri 'none'`: Prevents the use of `<base>` tag to change the\n  base URL for relative URLs.\n  - `form-action 'none'`: Disallows form submissions.\n  - `connect-src 'self'`: Restricts the origins that can be connected to\n   (via XHR, WebSockets, etc.) to the same origin.\n  - `frame-src *`: Allow to be embedded on any domain.\n  - `img-src 'self'`: Allows images to be loaded only from the same\n  origin. If `imageProxyEnabled` is true, allows images from any origin\n  (`*`).\n  - `script-src 'self' 'unsafe-inline'`: Allows scripts to be loaded and\n   executed only from the same origin and allows inline scripts.\n  - `style-src 'self' 'unsafe-inline'`: Allows styles to be loaded and\n  applied only from the same origin and allows inline styles.\n  - `font-src data:`: Allows fonts to be loaded from data URIs.\n  - `object-src 'none'`: Disallows the use of `<object>`, `<embed>`, and\n   `<applet>` tags.\n\n`Permissions-Policy` now restricts the use of certain browser features\nwhich we don't use to enhance user privacy and security:\n  - `accelerometer=()`: Disables the use of the accelerometer sensor.\n  - `autoplay=()`: Disables automatic playback of media.\n  - `camera=()`: Disables the use of the camera.\n  - `cross-origin-isolated=()`: Disallows the page from being treated as\n   cross-origin isolated.\n  - `display-capture=()`: Disables the ability to capture the display.\n  - `encrypted-media=()`: Disables the use of Encrypted Media Extensions\n  .\n  - `fullscreen=()`: Disables the ability to use fullscreen mode.\n  - `geolocation=()`: Disables the use of geolocation.\n  - `gyroscope=()`: Disables the use of the gyroscope sensor.\n  - `keyboard-map=()`: Disables the use of the keyboard map.\n  - `magnetometer=()`: Disables the use of the magnetometer sensor.\n  - `microphone=()`: Disables the use of the microphone.\n  - `midi=()`: Disables the use of the MIDI API.\n  - `payment=()`: Disables the Payment Request API.\n  - `picture-in-picture=()`: Disables the use of Picture-in-Picture mode\n  .\n  - `publickey-credentials-get=()`: Disables the use of the Web\n  Authentication API.\n  - `screen-wake-lock=()`: Disables the ability to prevent the screen\n  from dimming.\n  - `sync-xhr=()`: Disables synchronous XMLHttpRequest.\n  - `usb=()`: Disables the use of the USB API.\n  - `xr-spatial-tracking=()`: Disables the use of spatial tracking in\n  WebXR.\n  - `clipboard-read=()`: Disables the ability to read from the clipboard\n  .\n  - `clipboard-write=()`: Disables the ability to write to the clipboard\n  .\n  - `gamepad=()`: Disables the use of the Gamepad API.\n  - `hid=()`: Disables the use of the Human Interface Device API.\n  - `idle-detection=()`: Disables the ability to detect idle state.\n  - `interest-cohort=()`: Disables the use of interest cohort tracking.\n  - `serial=()`: Disables the use of the Serial API.\n  - `unload=()`: Disables the ability to use the `beforeunload` and\n  `unload` events.\n  - `window-management=()`: Disables the ability to use window\n  management APIs.","shortMessageHtmlLink":"Add Content-Security-Policy and Permissions-Policy headers"}},{"before":"dc98b14ddc1980c09b7d9e79a2e68e0ef70cbed8","after":"a0b287f301f807b7ea662f277917e9fb809a4e93","ref":"refs/heads/paskal/dependabot","pushedAt":"2024-08-04T20:56:23.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"paskal","name":"Dmitry Verkhoturov","path":"/paskal","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/712534?s=80&v=4"},"commit":{"message":"add dependabot updates for Go, TypeScript, GitHub Actions","shortMessageHtmlLink":"add dependabot updates for Go, TypeScript, GitHub Actions"}},{"before":"b2c17e5e96622929ac406b6a39f886721b2b6940","after":"40c44b66b23117969bfcfd827f6dc40a85f8ff49","ref":"refs/heads/paskal/image_proxy_blacklist","pushedAt":"2024-08-04T20:01:53.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"paskal","name":"Dmitry Verkhoturov","path":"/paskal","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/712534?s=80&v=4"},"commit":{"message":"Disallow image proxy for private IPs, add blacklist support\n\nThis mitigates the problem where a user might probe machines that are\nunavailable to the user directly but accessible to the server\nhosting Remark42.\n\nScenarios addressed:\n\n1. A malicious user could learn about the presence of specific software\nor hardware running on an internal address. For example, the presence of\nan image at `http://192.168.0.1/img/container_bottom_shade_login.png`\ncan expose the type of router you have.\n\n2. A malicious user might receive non-timeout `invalid content type`\nresponses from internal addresses, enabling them to scan and identify\nHTTP servers running in the internal IP range without revealing their\ncontent but indicating their presence.\n\nThe new functionality is breaking, but I assume no one intends to expose\nonly private network images to the outside world. The old behavior can\nbe restored by setting the `--image-proxy.allow-private-networks` flag.\n\nAdditionally, this change adds the `--image-proxy.blacklist` flag to\nallow blacklisting private parts of the infrastructure from being\naccessed by the image proxy. You can blacklist IPs (e.g., `8.8.8.8`),\nCIDR subnets (e.g., `8.8.8.8/31`), and domains (e.g., `private.example\n.com`). Note that all subdomains of a given domain will also be\nblacklisted.\n\n`127.0.0.0/8` and `::1/128` ranges are not included as they are most\ncommonly used for local testing, and it would be cumbersome to prohibit\nthem. Localhost is considered less of a security threat than probing\nother hosts in the network. If desired, localhost can be restricted\nusing the blacklist functionality.","shortMessageHtmlLink":"Disallow image proxy for private IPs, add blacklist support"}},{"before":null,"after":"b2c17e5e96622929ac406b6a39f886721b2b6940","ref":"refs/heads/paskal/image_proxy_blacklist","pushedAt":"2024-08-04T20:00:31.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"paskal","name":"Dmitry Verkhoturov","path":"/paskal","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/712534?s=80&v=4"},"commit":{"message":"Disallow image proxy for private IPs, add blacklist support\n\nThis mitigates the problem where a user might probe machines that are\nunavailable to the user directly but accessible to the server\nhosting Remark42.\n\nScenarios addressed:\n\n1. A malicious user could learn about the presence of specific software\nor hardware running on an internal address. For example, the presence of\nan image at `http://192.168.0.1/img/container_bottom_shade_login.png`\ncan expose the type of router you have.\n\n2. A malicious user might receive non-timeout `invalid content type`\nresponses from internal addresses, enabling them to scan and identify\nHTTP servers running in the internal IP range without revealing their\ncontent but indicating their presence.\n\nThe new functionality is breaking, but I assume no one intends to expose\n only private network images to the outside world. The old behavior can\n be restored by setting the `--image-proxy.allow-private-networks` flag.\n\nAdditionally, this change adds the `--image-proxy.blacklist` flag to\nallow blacklisting private parts of the infrastructure from being\naccessed by the image proxy. You can blacklist IPs (e.g., `8.8.8.8`),\nCIDR subnets (e.g., `8.8.8.8/31`), and domains (e.g., `private.example\n.com`). Note that all subdomains of a given domain will also be\nblacklisted.\n\n`127.0.0.0/8` and `::1/128` ranges are not included as they are most\ncommonly used for local testing, and it would be cumbersome to prohibit\nthem. Localhost is considered less of a security threat than probing\nother hosts in the network. If desired, localhost can be restricted\nusing the blacklist functionality.","shortMessageHtmlLink":"Disallow image proxy for private IPs, add blacklist support"}}],"hasNextPage":true,"hasPreviousPage":false,"activityType":"all","actor":null,"timePeriod":"all","sort":"DESC","perPage":30,"cursor":"Y3Vyc29yOnYyOpK7MjAyNC0wOS0yMVQwMzozMTo1NS4wMDAwMDBazwAAAAS8hGBu","startCursor":"Y3Vyc29yOnYyOpK7MjAyNC0wOS0yMVQwMzozMTo1NS4wMDAwMDBazwAAAAS8hGBu","endCursor":"Y3Vyc29yOnYyOpK7MjAyNC0wOC0wNFQyMDowMDozMS4wMDAwMDBazwAAAASRcYJg"}},"title":"Activity · umputun/remark42"}