Merge branch 'develop'

# Conflicts:
#	admin/package.json
#	bin/package.json
#	package.json
#	src/package.json

Author: Etherpad Release Bot

CHANGELOG.md

@@ -1,3 +1,11 @@
+# 3.3.13
+
+3.3.13 is a security release. It stops `.etherpad` imports from setting a pad's ownership, privacy or deletion token (GHSA-qq7c-m9pc-7q7v).
+
+### Security
+
+- **Import — `.etherpad` files can no longer change who owns a pad, make it public or plant a deletion token (GHSA-qq7c-m9pc-7q7v).** Importing a `.etherpad` file into a pad with fewer than 10 revisions wrote every `pad:<id>:*` record in the file and every field of the pad record. Anyone who could edit a new pad could replace the creator's deletion token with their own, make a private group pad public, or name themselves as the pad's creator. Imports now only take the pad text, revisions and chat. The pad keeps its public status, pad-wide settings come from the file only when the creator imports it, and a file that names a different creator can only be imported by the pad's creator. Reported by @barnessomer.
+
 # 3.3.12
 
 3.3.12 is a security release. It closes an open redirect in the timeslider's "Return to pad" button (GHSA-35rj-7vrx-29wq) and stops revision-bound `.etherpad` exports from leaking later chat.

admin/package.json

@@ -1,7 +1,7 @@
 {
   "name": "admin",
   "private": true,
-  "version": "3.3.12",
+  "version": "3.3.13",
   "type": "module",
   "scripts": {
     "dev": "pnpm gen:api && vite",
@@ -15,8 +15,8 @@
   },
   "dependencies": {
     "@radix-ui/react-switch": "^1.4.1",
-    "@tanstack/react-query": "^5.104.5",
-    "@tanstack/react-query-devtools": "^5.104.5",
+    "@tanstack/react-query": "^5.105.1",
+    "@tanstack/react-query-devtools": "^5.105.1",
     "jsonc-parser": "^3.3.1",
     "openapi-fetch": "^0.17.0",
     "openapi-react-query": "^0.5.4"
@@ -27,21 +27,21 @@
     "@radix-ui/react-visually-hidden": "^1.2.13",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "@typescript-eslint/eslint-plugin": "^8.72.0",
-    "@typescript-eslint/parser": "^8.72.0",
+    "@typescript-eslint/eslint-plugin": "^8.72.1",
+    "@typescript-eslint/parser": "^8.72.1",
     "@vitejs/plugin-react": "^6.1.2",
     "babel-plugin-react-compiler": "19.1.0-rc.3",
-    "eslint": "^10.13.0",
+    "eslint": "^10.14.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "eslint-plugin-react-refresh": "^0.5.7",
-    "i18next": "^26.5.11",
-    "i18next-browser-languagedetector": "^8.2.3",
-    "lucide-react": "^1.61.0",
+    "i18next": "^26.5.12",
+    "i18next-browser-languagedetector": "^8.2.4",
+    "lucide-react": "^1.65.0",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
     "react-hook-form": "^7.91.0",
-    "react-i18next": "^17.1.9",
-    "react-router-dom": "^7.18.4",
+    "react-i18next": "^17.1.10",
+    "react-router-dom": "^7.18.5",
     "socket.io-client": "^4.8.4",
     "tsx": "^4.23.15",
     "typescript": "^7.0.2",

bin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bin",
-  "version": "3.3.12",
+  "version": "3.3.13",
   "description": "",
   "main": "checkAllPads.js",
   "directories": {
@@ -14,7 +14,7 @@
     "ueberdb2": "6.1.18"
   },
   "devDependencies": {
-    "@types/node": "^26.6.5",
+    "@types/node": "^26.6.6",
     "@types/semver": "^7.8.0",
     "typescript": "^7.0.2"
   },

bin/push-after-release.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+set -euo pipefail
 
 # Specify the path to your package.json file
 PACKAGE_JSON_PATH="./src/package.json"
@@ -11,6 +12,7 @@ fi
 
 # Read the version from package.json into a variable
 VERSION=$(jq -r '.version' "$PACKAGE_JSON_PATH")
-git push origin master develop $VERSION
-git push --tags
+# --atomic: if any ref is rejected (e.g. by branch protection), push none of
+# them and fail the job instead of shipping a tag with develop left behind.
+git push --atomic origin master develop "$VERSION" "v$VERSION"
 (cd ../ether.github.com && git push)

bin/release.ts

@@ -194,10 +194,10 @@ try {
   console.log(`Creating ${newVersion} tag...`);
   run(`git tag -a '${newVersion}' -m '${newVersion}'`);
   run(`git tag -a 'v${newVersion}' -m 'v${newVersion}'`);
+  // develop requires linear history, so it is not merged back from master: it
+  // keeps the "bump version" commit made above and is pushed as a fast-forward.
   console.log('Switching back to develop...');
   run('git checkout develop');
-  console.log('Merging master into develop...');
-  run('git merge --no-ff --no-edit master');
 } catch (err:any) {
   console.error(err.toString());
   console.warn('Resetting repository...');

doc/package.json

@@ -1,6 +1,6 @@
 {
   "devDependencies": {
-    "oxc-minify": "^0.155.0",
+    "oxc-minify": "^0.156.0",
     "vitepress": "^2.0.0-alpha.21"
   },
   "scripts": {

package.json

@@ -52,6 +52,6 @@
     "url": "https://github.com/ether/etherpad.git"
   },
   "engineStrict": true,
-  "version": "3.3.12",
+  "version": "3.3.13",
   "license": "Apache-2.0"
 }