From 92f72fea50753426c3507027cd0d6d87502572f6 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 5 Jul 2026 22:05:40 +0000 Subject: [PATCH 1/2] feat (config): make FontAwesome CDN base URL configurable via env The FontAwesome CDN location changed again. Introduce a required PUBLIC_FONTAWESOME_CSS_BASE_URL environment variable so the CSS base URL can be configured in production instead of being hard-coded in app.html. The stylesheet links now use a %fontawesome.baseUrl% placeholder that is substituted in the server hook. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01T4QrtB6cFFZPx8VnAuiK4F --- .env.example | 6 ++++++ src/app.html | 17 ++++------------- src/config/public.ts | 4 ++++ src/hooks.server.ts | 5 ++++- 4 files changed, 18 insertions(+), 14 deletions(-) diff --git a/.env.example b/.env.example index 356e653b..c430b86c 100644 --- a/.env.example +++ b/.env.example @@ -153,6 +153,12 @@ PUBLIC_FEEDBACK_URL=https://fb-delegator.dmun.de # When set, shows a warning when inviting emails from other domains # PUBLIC_TEAM_ORGANIZATION_DOMAIN=dmun.de +# [REQUIRED] Base URL for the FontAwesome CSS files (without trailing slash) +# The app loads /fontawesome.min.css, /solid.min.css, +# /duotone.min.css and /brands.min.css from this location. +# Change this if the FontAwesome CDN moves. +PUBLIC_FONTAWESOME_CSS_BASE_URL=https://cdn.dmun.de/cdn/fontawesome-pro-6.7.2/css + # ─────────────────────────────────────────────────────────────────────────────── # CERTIFICATES # ─────────────────────────────────────────────────────────────────────────────── diff --git a/src/app.html b/src/app.html index 407737ab..83391a78 100644 --- a/src/app.html +++ b/src/app.html @@ -3,19 +3,10 @@ - - - - + + + + %sveltekit.head% diff --git a/src/config/public.ts b/src/config/public.ts index 33630073..2f911cac 100644 --- a/src/config/public.ts +++ b/src/config/public.ts @@ -15,6 +15,10 @@ const schema = z.object({ PUBLIC_FEEDBACK_URL: z.optional(z.string()), PUBLIC_GLOBAL_USER_NOTES_ACTIVE: z.coerce.boolean().default(false), + // Base URL for the FontAwesome CSS files (without trailing slash). + // The app loads `/fontawesome.min.css`, `/solid.min.css`, etc. from here. + PUBLIC_FONTAWESOME_CSS_BASE_URL: z.string(), + // --- TEMPORARY: Migration notice (remove after migration period) --- PUBLIC_OIDC_MIGRATION_NOTICE: z.coerce.boolean().default(false), diff --git a/src/hooks.server.ts b/src/hooks.server.ts index ced675d3..caaa10bd 100644 --- a/src/hooks.server.ts +++ b/src/hooks.server.ts @@ -4,6 +4,7 @@ import { sequence } from '@sveltejs/kit/hooks'; import { paraglideMiddleware } from '$lib/paraglide/server'; import { building } from '$app/environment'; import { configPrivate } from '$config/private'; +import { configPublic } from '$config/public'; // Initialize Sentry (only if DSN provided and not building) if (!building && configPrivate.SENTRY_DSN) { @@ -21,7 +22,9 @@ const paraglideHandle: Handle = ({ event, resolve }) => event.request = localizedRequest; return resolve(event, { transformPageChunk: ({ html }) => { - return html.replace('%lang%', locale); + return html + .replace('%lang%', locale) + .replaceAll('%fontawesome.baseUrl%', configPublic.PUBLIC_FONTAWESOME_CSS_BASE_URL); }, // Houdini's fetch plugin reads the content-type header from responses // fetched during SSR load; SvelteKit only serializes headers that pass From 70092b6ea0ec5ffb6598fe2af1e19392f5dedaf9 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 5 Jul 2026 22:28:44 +0000 Subject: [PATCH 2/2] fix (deps): upgrade nodemailer to ^9.0.1 to resolve GHSA-p6gq-j5cr-w38f Trivy flagged nodemailer 7.0.13 with GHSA-p6gq-j5cr-w38f (HIGH): the message-level raw option bypasses disableFileAccess/disableUrlAccess. The vulnerability is not reachable in this codebase (emailService only sends from/to/subject/html/text/replyTo, never raw or attachments), but upgrading to 9.0.3 removes the finding at the source and unblocks the security CI check. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01T4QrtB6cFFZPx8VnAuiK4F --- bun.lock | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bun.lock b/bun.lock index 976540e9..8e026940 100644 --- a/bun.lock +++ b/bun.lock @@ -7,7 +7,7 @@ "dependencies": { "diff-match-patch": "^1.0.5", "humanparser": "^2.7.0", - "nodemailer": "^7.0.11", + "nodemailer": "^9.0.1", "typst": "^0.10.0-8", }, "devDependencies": { @@ -2326,7 +2326,7 @@ "node-schedule": ["node-schedule@2.1.1", "", { "dependencies": { "cron-parser": "^4.2.0", "long-timeout": "0.1.1", "sorted-array-functions": "^1.3.0" } }, "sha512-OXdegQq03OmXEjt2hZP33W2YPs/E5BcFQks46+G2gAxs4gHOIVD1u7EqlYLYSKsaIpyKCK9Gbk0ta1/gjRSMRQ=="], - "nodemailer": ["nodemailer@7.0.13", "", {}, "sha512-PNDFSJdP+KFgdsG3ZzMXCgquO7I6McjY2vlqILjtJd0hy8wEvtugS9xKRF2NWlPNGxvLCXlTNIae4serI7dinw=="], + "nodemailer": ["nodemailer@9.0.3", "", {}, "sha512-n+YP+NKwR5zRWa60k3GiQ6Q3B4KXCoAw40dAKeCtYn020iNN74aWK2liXIC3ZEATeGql7we3tE3t8QwhY0eskw=="], "normalize-path": ["normalize-path@3.0.0", "", {}, "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA=="], diff --git a/package.json b/package.json index f4e7d270..a663fcdd 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,7 @@ "dependencies": { "diff-match-patch": "^1.0.5", "humanparser": "^2.7.0", - "nodemailer": "^7.0.11", + "nodemailer": "^9.0.1", "typst": "^0.10.0-8" }, "devDependencies": {