Merge branch 'development' into feature/drag-n-drop

* development: (42 commits)
  Translated using Weblate (Swedish)
  Translated using Weblate (Arabic)
  Translated using Weblate (Turkish)
  Translated using Weblate (Slovak)
  Translated using Weblate (French)
  Translated using Weblate (Portuguese (Brazil))
  Translated using Weblate (Polish)
  Translated using Weblate (Japanese)
  Translated using Weblate (Russian)
  Translated using Weblate (Danish)
  Translated using Weblate (Italian)
  Bump shaka-player from 5.0.6 to 5.0.7 (FreeTubeApp#8848)
  Bump @babel/preset-env from 7.29.0 to 7.29.2 in the babel group (FreeTubeApp#8842)
  Bump calibreapp/image-actions (FreeTubeApp#8843)
  Bump actions/cache from 5.0.3 to 5.0.4 (FreeTubeApp#8844)
  Bump flatted from 3.3.3 to 3.4.2 (FreeTubeApp#8851)
  Translated using Weblate (German)
  Translated using Weblate (Czech)
  Translated using Weblate (Hungarian)
  Translated using Weblate (Norwegian Bokmål)
  ...

Author: PikachuEXE

.github/workflows/build.yml

@@ -86,7 +86,7 @@ jobs:
 
     - name: Restore yarn cache
       id: restore_cache
-      uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 #v5.0.3
+      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 #v5.0.4
       with:
         key: ${{ format('node-cache-{0}-{1}-yarn-{2}', runner.os, runner.arch, hashFiles('yarn.lock')) }}
         path: ${{ steps.cache_dir.outputs.cache_dir }}
@@ -361,7 +361,7 @@ jobs:
         path: build/freetube-${{ steps.versionNumber.outputs.version }}-arm64-mac.7z
 
     - name: Save yarn cache
-      uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 #v5.0.3
+      uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 #v5.0.4
       # Only save the cache if we weren't able to restore an existing one above
       if: steps.restore_cache.outputs.cache-primary-key != steps.restore_cache.outputs.cache-matched-key
       with:

.github/workflows/calibreapp-image-actions.yml

@@ -30,7 +30,7 @@ jobs:
 
       - name: Compress Images
         id: calibre
-        uses: calibreapp/image-actions@d9c8ee5c3dc52ae4622c82ead88d658f4b16b65f
+        uses: calibreapp/image-actions@03c976c29803442fc4040a9de5509669e7759b81
         with:
           githubToken: ${{ secrets.GITHUB_TOKEN }}
           compressOnly: true

.github/workflows/codeql.yml

@@ -43,12 +43,12 @@ jobs:
         persist-credentials: false
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
+      uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
+      uses: github/codeql-action/analyze@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/linter.yml

@@ -46,7 +46,7 @@ jobs:
     # so we only restore the yarn cache, we don't save it to avoid cache poisoning
     - name: Restore yarn cache
       id: restore_cache
-      uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 #v5.0.3
+      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 #v5.0.4
       with:
         key: ${{ format('node-cache-{0}-{1}-yarn-{2}', runner.os, runner.arch, hashFiles('yarn.lock')) }}
         path: ${{ steps.cache_dir.outputs.cache_dir }}

_scripts/_undefinedDefaultExport.mjs

@@ -0,0 +1 @@
+export default undefined

_scripts/webpack.renderer.config.js

@@ -196,11 +196,14 @@ const config = {
 
       'youtubei.js$': 'youtubei.js/web',
 
-      // change to "shaka-player.ui.debug.js" to get debug logs (update jsconfig to get updated types)
-      'shaka-player$': 'shaka-player/dist/shaka-player.ui.js',
+      // change to "shaka-player.ui-es2021.debug.js" to get debug logs (update jsconfig to get updated types)
+      'shaka-player$': 'shaka-player/dist/shaka-player.ui-es2021.js',
 
       // Make @fortawesome/vue-fontawesome use the trimmed down API instead of the original @fortawesome/fontawesome-svg-core
-      '@fortawesome/fontawesome-svg-core$': path.resolve(__dirname, '../src/renderer/fontawesome-minimal.js')
+      '@fortawesome/fontawesome-svg-core$': path.resolve(__dirname, '../src/renderer/fontawesome-minimal.js'),
+
+      // Fix dompurify not being tree-shaking friendly
+      dompurify$: path.resolve(__dirname, '_undefinedDefaultExport.mjs')
     },
     extensions: ['.js', '.vue']
   },

_scripts/webpack.web.config.js

@@ -173,8 +173,8 @@ const config = {
     alias: {
       DB_HANDLERS_ELECTRON_RENDERER_OR_WEB$: path.resolve(__dirname, '../src/datastores/handlers/web.js'),
 
-      // change to "shaka-player.ui.debug.js" to get debug logs (update jsconfig to get updated types)
-      'shaka-player$': 'shaka-player/dist/shaka-player.ui.js',
+      // change to "shaka-player.ui-es2021.debug.js" to get debug logs (update jsconfig to get updated types)
+      'shaka-player$': 'shaka-player/dist/shaka-player.ui-es2021.js',
 
       // Make @fortawesome/vue-fontawesome use the trimmed down API instead of the original @fortawesome/fontawesome-svg-core
       '@fortawesome/fontawesome-svg-core$': path.resolve(__dirname, '../src/renderer/fontawesome-minimal.js')

eslint.config.mjs

@@ -270,7 +270,11 @@ export default [
     rules: {
       '@stylistic/space-before-function-paren': 'off',
       '@stylistic/comma-dangle': ['error', 'only-multiline'],
-      'vue/no-v-html': 'off',
+
+      // Ban v-html as it inserts HTML via innerHTML without sanitizing it
+      // if inserting raw HTML is unavoidable the custom v-safer-html directive should be used
+      // which sanitizes the HTML before inserting it into the DOM
+      'vue/no-v-html': 'error',
 
       'no-console': ['error', {
         allow: ['warn', 'error'],
@@ -342,6 +346,15 @@ export default [
       }
     }
   },
+  {
+    files: ['src/renderer/directives/vSaferHtml.js'],
+    languageOptions: {
+      globals: {
+        // Fix Sanitizer not being listed in `globals` yet, remove it when it gets added in the future
+        Sanitizer: 'readable'
+      }
+    }
+  },
 
   ...eslintPluginJsonc.configs.base,
   {

jsconfig.json

@@ -13,7 +13,7 @@
         "src/datastores/handlers/web"
       ],
       "shaka-player": [
-        "./node_modules/shaka-player/dist/shaka-player.ui"
+        "./node_modules/shaka-player/dist/shaka-player.ui-es2021"
       ]
     }
   }

package.json

@@ -2,7 +2,7 @@
   "name": "freetube",
   "productName": "FreeTube",
   "description": "A private YouTube client",
-  "version": "0.23.14",
+  "version": "0.23.15",
   "license": "AGPL-3.0-or-later",
   "main": "./dist/main.js",
   "private": true,
@@ -41,10 +41,10 @@
     "lint-style-fix": "stylelint --fix \"src/**/*.{css,scss}\"",
     "lint-yml": "eslint --config eslint.config.mjs \"**/*.yml\" \"**/*.yaml\"",
     "pack": "run-p pack:main pack:renderer pack:preload pack:botGuardScript && node _scripts/injectAllowedPaths.mjs",
-    "pack:main": "webpack --mode=production --node-env=production --config _scripts/webpack.main.config.js",
-    "pack:renderer": "webpack --mode=production --node-env=production --config _scripts/webpack.renderer.config.js",
-    "pack:preload": "webpack --mode=production --node-env=production --config _scripts/webpack.preload.config.js",
-    "pack:web": "webpack --mode=production --node-env=production --config _scripts/webpack.web.config.js",
+    "pack:main": "webpack --mode=production --config-node-env=production --config _scripts/webpack.main.config.js",
+    "pack:renderer": "webpack --mode=production --config-node-env=production --config _scripts/webpack.renderer.config.js",
+    "pack:preload": "webpack --mode=production --config-node-env=production --config _scripts/webpack.preload.config.js",
+    "pack:web": "webpack --mode=production --config-node-env=production --config _scripts/webpack.web.config.js",
     "pack:botGuardScript": "webpack --config _scripts/webpack.botGuardScript.config.js",
     "checkforbadtemplates": "node _scripts/findMissingTemplates.mjs",
     "ci": "yarn install --silent --frozen-lockfile --network-concurrency 1"
@@ -58,31 +58,32 @@
     "@seald-io/nedb": "^4.1.2",
     "autolinker": "^4.1.5",
     "bgutils-js": "^3.2.0",
-    "electron-context-menu": "^4.1.1",
+    "dompurify": "^3.3.3",
+    "electron-context-menu": "^4.1.2",
     "googlevideo": "^4.0.4",
     "marked": "^17.0.4",
     "process": "^0.11.10",
-    "shaka-player": "^4.16.20",
+    "shaka-player": "^5.0.7",
     "swiper": "^12.1.2",
     "vue": "^3.5.30",
     "vue-i18n": "^11.3.0",
     "vue-observe-visibility": "^2.0.0-alpha.1",
-    "vue-router": "^5.0.3",
+    "vue-router": "^5.0.4",
     "vuex": "^4.1.0",
-    "youtubei.js": "^16.0.1"
+    "youtubei.js": "^17.0.1"
   },
   "devDependencies": {
     "@babel/core": "^7.29.0",
-    "@babel/preset-env": "^7.29.0",
-    "@double-great/stylelint-a11y": "^3.4.5",
+    "@babel/preset-env": "^7.29.2",
+    "@double-great/stylelint-a11y": "^3.4.6",
     "@eslint/js": "^10.0.1",
     "@intlify/eslint-plugin-vue-i18n": "^4.3.0",
     "@stylistic/eslint-plugin": "^5.10.0",
     "babel-loader": "^10.1.1",
     "copy-webpack-plugin": "^14.0.0",
     "css-loader": "^7.1.4",
     "css-minimizer-webpack-plugin": "^8.0.0",
-    "electron": "^41.0.2",
+    "electron": "^41.0.3",
     "electron-builder": "^26.8.1",
     "eslint": "^10.0.3",
     "eslint-plugin-import-x": "^4.16.2",
@@ -105,7 +106,7 @@
     "postcss-scss": "^4.0.9",
     "sass": "^1.98.0",
     "sass-loader": "^16.0.7",
-    "stylelint": "^17.4.0",
+    "stylelint": "^17.5.0",
     "stylelint-config-sass-guidelines": "^13.0.0",
     "stylelint-config-standard": "^40.0.0",
     "stylelint-high-performance-animation": "^2.0.0",
@@ -114,7 +115,7 @@
     "vue-eslint-parser": "^10.2.0",
     "vue-loader": "^17.4.2",
     "webpack": "^5.105.4",
-    "webpack-cli": "^6.0.1",
+    "webpack-cli": "^7.0.2",
     "webpack-dev-server": "^5.2.3"
   }
 }