Permalink
Comparing changes
Choose two branches to see what’s changed or to start a new pull request.
If you need to, you can also or
learn more about diff comparisons.
Open a pull request
Create a new pull request by comparing changes across two branches. If you need to, you can also .
Learn more about diff comparisons here.
...
- 3 commits
- 10 files changed
- 2 contributors
Commits on Mar 20, 2026
-
ci: harden GitHub Actions workflows (#1284)
* Add GitHub Actions audit job (actionlint + zizmor) Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * Configure dependabot for github-actions, npm, and bundler with batching and cooldowns Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * Add local GitHub Actions linting (actionlint + zizmor) to bin/setup and bin/ci Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * Pin all GitHub Actions to SHA hashes Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * Fix zizmor findings: add permissions and persist-credentials: false Set workflow-level permissions: {} and add per-job contents: read. Add persist-credentials: false to all checkout steps. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
Commits on Mar 26, 2026
-
Fix XSS via javascript: URI in JSON drag-drop deserialization (#1293)
StringPiece.fromJSON trusted href attributes from application/x-trix-document JSON payloads, allowing javascript: URIs to reach the DOM via drag-and-drop in Level0InputController. Add DOMPurify.isValidAttribute check to strip invalid hrefs at deserialization time.
-
Loading
This comparison is taking too long to generate.
Unfortunately it looks like we can’t render this comparison for you right now. It might be too big, or there might be something weird with your repository.
You can try running this command locally to see the comparison on your machine:
git diff v2.1.17...v2.1.18