Migrate to Vue 3 Composition API and TypeScript

.github/workflows/assets_code_analysis.yaml

@@ -21,6 +21,12 @@ jobs:
           - name: Lint on SCSS files
             run: npm run stylelint
 
+          - name: UI Unit Tests
+            run: npm run test:coverage
+
+          - name: Type Check
+            run: npm run typecheck
+
           - name: Build for production
             run: npm run build
 

.stylelintrc

@@ -3,9 +3,39 @@
     "stylelint-config-standard",
     "stylelint-config-recommended-scss"
   ],
-  "syntax": "scss",
+  "customSyntax": "postcss-scss",
+  "ignoreFiles": [
+    "assets/scss/vendor/**/*.scss"
+  ],
   "plugins": ["stylelint-scss"],
   "rules": {
-    "no-descending-specificity": null
+    "alpha-value-notation": null,
+    "color-function-alias-notation": null,
+    "color-function-notation": null,
+    "custom-property-pattern": null,
+    "declaration-block-no-redundant-longhand-properties": null,
+    "font-family-name-quotes": null,
+    "function-url-quotes": null,
+    "import-notation": null,
+    "keyframes-name-pattern": null,
+    "no-descending-specificity": null,
+    "no-invalid-position-at-import-rule": null,
+    "number-max-precision": null,
+    "property-no-deprecated": null,
+    "property-no-vendor-prefix": null,
+    "scss/at-extend-no-missing-placeholder": null,
+    "scss/comment-no-empty": null,
+    "scss/load-no-partial-leading-underscore": null,
+    "scss/load-partial-extension": null,
+    "scss/no-global-function-names": null,
+    "scss/operator-no-unspaced": null,
+    "selector-attribute-quotes": null,
+    "selector-class-pattern": null,
+    "selector-id-pattern": null,
+    "selector-not-notation": null,
+    "shorthand-property-no-redundant-values": null,
+    "unit-no-unknown": null,
+    "value-keyword-case": null,
+    "value-no-vendor-prefix": null
   }
 }

CHANGELOG.md

@@ -7,6 +7,20 @@ Released: Not yet released
 
 - The default query limit can now be configured. Thanks @Vondry! (https://github.com/bolt/core/pull/3727)
 
+
+## 6.1.4
+
+Released: 2026-07-04
+
+This release includes several security-related fixes. Our thanks to @Vondry and @0xmgaye for identifying these issues and disclosing them to us responsibly! 👏🙏
+
+### 🔐 Security related changes
+
+- Fix SQL injection in ListFormatHelper (@Vondry)
+- Prevent SSRF in upload-from-URL and embed endpoint (@Vondry)
+- Filter unpublished/viewless content from the public Relation API (@Vondry)
+- Block open redirect on login endpoint (@0xmgaye, fix by @bobvandevijver)
+
 ## 6.1.3
 
 Released: 2026-05-16

assets/js/app/common.js

@@ -144,7 +144,10 @@ $(document).ready(function () {
     /*
      ** Copy text to clipboard. Used in filemanager actions.
      */
-    new ClipboardJS('*[data-clipboard-text]');
+    const clipboard = new ClipboardJS('*[data-clipboard-text]');
+    clipboard.on('success', function (event) {
+        event.clearSelection();
+    });
     /* End of copy text to clipboard */
 
     /*

assets/js/app/editor/Components/Checkbox.vue

@@ -8,9 +8,9 @@
                 :checked="value"
                 type="checkbox"
                 :readonly="readonly"
-                @change="liveValue = $event.target.checked"
+                @change="liveValue = ($event.target as HTMLInputElement).checked"
             />
-            <label class="custom-control-label form-label" :for="name">{{ label }}</label>
+            <label class="custom-control-label form-label" :for="id">{{ label }}</label>
 
             <!-- This hidden input is actually what gets submitted. It submits "true" when checked, and "false" when not checked -->
             <!-- It exists because we need an "unchecked" value submitted. See https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/checkbox -->
@@ -19,36 +19,18 @@
     </div>
 </template>
 
-<script>
-export default {
-    name: 'EditorCheckbox',
-    props: {
-        value: {
-            type: Boolean,
-        },
-        name: {
-            type: String,
-        },
-        id: {
-            type: String,
-        },
-        required: {
-            type: Boolean,
-        },
-        readonly: {
-            type: Boolean,
-        },
-        label: {
-            type: String,
-        },
-        mode: {
-            type: String,
-        },
-    },
-    data() {
-        return {
-            liveValue: this.value,
-        };
-    },
-};
+<script setup lang="ts">
+import { ref } from 'vue';
+
+const props = defineProps<{
+    value?: boolean;
+    name?: string;
+    id?: string;
+    required?: boolean;
+    readonly?: boolean;
+    label?: string;
+    mode?: string;
+}>();
+
+const liveValue = ref(props.value);
 </script>