🔖(minor) release 4.5.0 #1839

AntoLC · 2026-01-28T17:06:31Z

Added

✨(frontend) integrate configurable Waffle ✨(frontend) integrate configurable Waffle #1795
✨ Import of documents ✨ Import of documents #1609
🚨(CI) gives warning if theme not updated 🚨(CI) gives warning if theme not updated #1811
✨(frontend) Add stat for Crisp ✨(frontend) Add stat from Crisp #1824
✨(auth) add silent login ✨(auth) Add silent login #1690
🔧(project) add DJANGO_EMAIL_URL_APP environment variable 🔧(project) add DJANGO_EMAIL_URL_APP environment variable #1825

Changed

♿(frontend) improve accessibility:
- ♿️(frontend) fix subdoc opening and emoji pick focus ♿️(frontend) fix subdoc opening and emoji pick focus #1745
✨(backend) add field for button label in email template ✨(backend) add field for button label in email template #1817

socket-security · 2026-01-28T17:07:34Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@15.5.9
	eslint-config-next@15.5.9
	convert-stream@1.0.2
	jest@30.2.0
	workbox-webpack-plugin@7.1.0
	lodash@4.17.23
	@html-to/text-cli@0.5.4
	crisp-sdk-web@1.0.27
	vitest@4.0.17
	clsx@2.1.1
	express-ws@5.0.2
	i18next-parser@9.3.0
	nodemon@3.1.11
	cross-env@10.1.0
	emoji-mart@5.6.0
	stylelint-prettier@5.0.3
	ts-node@10.9.2
	vitest-mock-extended@3.1.0
	eslint-plugin-react@7.37.5
	canvg@4.0.3
	tsc-alias@1.8.16
	uuid@13.0.0
	eslint-plugin-import@2.32.0
	eslint-plugin-jsx-a11y@6.10.2
	react@19.2.3
	i18next-browser-languagedetector@8.2.0
	fetch-mock@9.11.0
	react-dropzone@14.3.8
	luxon@3.7.2
	react-select@5.10.2
	react-intersection-observer@10.0.2
	use-debounce@10.1.0
	copy-webpack-plugin@13.0.1
See 30 more rows in the dashboard

View full report

socket-security · 2026-01-28T17:07:36Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `entities` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: `?` → `npm/[email protected]` → `npm/@html-to/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `entities` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: `?` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `js-beautify` is 100.0% likely obfuscated Confidence: 1.00 Location: Package overview From: `?` → `npm/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `vite` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: `?` → `npm/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `vite` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: `?` → `npm/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2026-01-28T17:13:46Z

Size Change: +2.58 kB (+0.06%)

Total Size: 4.2 MB

Filename	Size	Change
`apps/impress/out/_next/static/3f51ee04/_buildManifest.js`	0 B	-831 B (removed)	🏆
`apps/impress/out/_next/static/16f2327d/_buildManifest.js`	831 B	+831 B (new file)	🆕
`apps/impress/out/_next/static/chunks/pages/_app.js`	595 kB	+2.58 kB (+0.44%)

_{compressed-size-action}

.github/workflows/docker-hub.yml

CHANGELOG.md

We need to do a release but the backend cannot build because of a trivy issue. So we temporarily remove the backend trivy guard to be able to release.

Update translated files with new translations

A "v" was introduced in the link format, we need to update the version in the link accordingly to match it. We add "v" to fit with others projects.

We want to split the cache config between the app cache and the session cache. In the app cache, the default one, we allow to configure a prefix. By default this prefix is a fixed string so the cache will be never revoked because it is changing but it allow every instance to implement its own strategy like prefixing the keyx cache with a timestamp. To not impact session, the session cache is splitted in the settings.

Added: - ✨(frontend) integrate configurable Waffle - ✨ Import of documents - 🚨(CI) gives warning if theme not updated - ✨(frontend) Add stat for Crisp - ✨(auth) add silent login - 🔧(project) add DJANGO_EMAIL_URL_APP environment variable Changed: - ♿(frontend) improve accessibility: - ♿️(frontend) fix subdoc opening and emoji pick focus - ✨(backend) add field for button label in email template Fixed: - ✅(e2e) fix e2e test for other browsers - 🐛(export) fix export column NaN - 🐛(frontend) add fallback for unsupported Blocknote languages - 🐛(frontend) fix emojipicker closing in tree - 🐛(frontend) display children in favorite - 🐛(frontend) preserve typed text after @ on escape Removed: - 🔥(project) remove all code related to template Security: - 🔒️(trivy) fix vulnerability about jaraco.context

AntoLC self-assigned this Jan 28, 2026

AntoLC added the release label Jan 28, 2026

AntoLC force-pushed the release/4.5.0 branch from 9113548 to 1bbf64c Compare January 28, 2026 17:15

lunika force-pushed the release/4.5.0 branch from 708dfc7 to 1bbf64c Compare January 28, 2026 20:31

AntoLC force-pushed the release/4.5.0 branch from 29b5881 to fd1e003 Compare January 29, 2026 08:17

lunika approved these changes Jan 29, 2026

View reviewed changes

.github/workflows/docker-hub.yml Show resolved Hide resolved

CHANGELOG.md Outdated Show resolved Hide resolved

AntoLC and others added 3 commits January 29, 2026 10:11

🩺(CI) remove backend trivy guard

0fddabb

We need to do a release but the backend cannot build because of a trivy issue. So we temporarily remove the backend trivy guard to be able to release.

🌐(i18n) update translated strings

009de52

Update translated files with new translations

🔊(CHANGELOG) change link version CHANGELOG

505b144

A "v" was introduced in the link format, we need to update the version in the link accordingly to match it. We add "v" to fit with others projects.

AntoLC force-pushed the release/4.5.0 branch 2 times, most recently from 5e2e9fb to 87a6ad3 Compare January 29, 2026 15:03

lunika and others added 2 commits January 29, 2026 16:13

lunika force-pushed the release/4.5.0 branch from 87a6ad3 to db014cf Compare January 29, 2026 15:18

AntoLC merged commit db014cf into main Jan 29, 2026
38 of 39 checks passed

AntoLC deleted the release/4.5.0 branch January 29, 2026 15:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🔖(minor) release 4.5.0 #1839

🔖(minor) release 4.5.0 #1839

Uh oh!

AntoLC commented Jan 28, 2026

Uh oh!

socket-security bot commented Jan 28, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Jan 28, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

🔖(minor) release 4.5.0 #1839

🔖(minor) release 4.5.0 #1839

Uh oh!

Conversation

AntoLC commented Jan 28, 2026

Added

Changed

Fixed

Removed

Security

Uh oh!

socket-security bot commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

socket-security bot commented Jan 28, 2026 •

edited

Loading

socket-security bot commented Jan 28, 2026 •

edited

Loading

github-actions bot commented Jan 28, 2026 •

edited

Loading