diff --git a/.github/workflows/assets_code_analysis.yaml b/.github/workflows/assets_code_analysis.yaml
index 4540ae9e5..e180a496c 100644
--- a/.github/workflows/assets_code_analysis.yaml
+++ b/.github/workflows/assets_code_analysis.yaml
@@ -21,6 +21,12 @@ jobs:
- name: Lint on SCSS files
run: npm run stylelint
+ - name: UI Unit Tests
+ run: npm run test:coverage
+
+ - name: Type Check
+ run: npm run typecheck
+
- name: Build for production
run: npm run build
diff --git a/.stylelintrc b/.stylelintrc
index f3d909b63..72e095d1a 100644
--- a/.stylelintrc
+++ b/.stylelintrc
@@ -3,9 +3,39 @@
"stylelint-config-standard",
"stylelint-config-recommended-scss"
],
- "syntax": "scss",
+ "customSyntax": "postcss-scss",
+ "ignoreFiles": [
+ "assets/scss/vendor/**/*.scss"
+ ],
"plugins": ["stylelint-scss"],
"rules": {
- "no-descending-specificity": null
+ "alpha-value-notation": null,
+ "color-function-alias-notation": null,
+ "color-function-notation": null,
+ "custom-property-pattern": null,
+ "declaration-block-no-redundant-longhand-properties": null,
+ "font-family-name-quotes": null,
+ "function-url-quotes": null,
+ "import-notation": null,
+ "keyframes-name-pattern": null,
+ "no-descending-specificity": null,
+ "no-invalid-position-at-import-rule": null,
+ "number-max-precision": null,
+ "property-no-deprecated": null,
+ "property-no-vendor-prefix": null,
+ "scss/at-extend-no-missing-placeholder": null,
+ "scss/comment-no-empty": null,
+ "scss/load-no-partial-leading-underscore": null,
+ "scss/load-partial-extension": null,
+ "scss/no-global-function-names": null,
+ "scss/operator-no-unspaced": null,
+ "selector-attribute-quotes": null,
+ "selector-class-pattern": null,
+ "selector-id-pattern": null,
+ "selector-not-notation": null,
+ "shorthand-property-no-redundant-values": null,
+ "unit-no-unknown": null,
+ "value-keyword-case": null,
+ "value-no-vendor-prefix": null
}
}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a004d750e..731a48bf0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,20 @@ Released: Not yet released
- The default query limit can now be configured. Thanks @Vondry! (https://github.com/bolt/core/pull/3727)
+
+## 6.1.4
+
+Released: 2026-07-04
+
+This release includes several security-related fixes. Our thanks to @Vondry and @0xmgaye for identifying these issues and disclosing them to us responsibly! ππ
+
+### π Security related changes
+
+- Fix SQL injection in ListFormatHelper (@Vondry)
+- Prevent SSRF in upload-from-URL and embed endpoint (@Vondry)
+- Filter unpublished/viewless content from the public Relation API (@Vondry)
+- Block open redirect on login endpoint (@0xmgaye, fix by @bobvandevijver)
+
## 6.1.3
Released: 2026-05-16
diff --git a/assets/js/app/common.js b/assets/js/app/common.js
index 8523ef607..fdb7110fb 100644
--- a/assets/js/app/common.js
+++ b/assets/js/app/common.js
@@ -144,7 +144,10 @@ $(document).ready(function () {
/*
** Copy text to clipboard. Used in filemanager actions.
*/
- new ClipboardJS('*[data-clipboard-text]');
+ const clipboard = new ClipboardJS('*[data-clipboard-text]');
+ clipboard.on('success', function (event) {
+ event.clearSelection();
+ });
/* End of copy text to clipboard */
/*
diff --git a/assets/js/app/editor/Components/Checkbox.vue b/assets/js/app/editor/Components/Checkbox.vue
index d507424c8..1f82e07f5 100644
--- a/assets/js/app/editor/Components/Checkbox.vue
+++ b/assets/js/app/editor/Components/Checkbox.vue
@@ -8,9 +8,9 @@
:checked="value"
type="checkbox"
:readonly="readonly"
- @change="liveValue = $event.target.checked"
+ @change="liveValue = ($event.target as HTMLInputElement).checked"
/>
-
+
@@ -19,36 +19,18 @@
-
diff --git a/assets/js/app/editor/Components/Collection.vue b/assets/js/app/editor/Components/Collection.vue
index 2e19a10d3..17cc7af3a 100644
--- a/assets/js/app/editor/Components/Collection.vue
+++ b/assets/js/app/editor/Components/Collection.vue
@@ -1,7 +1,7 @@