fix(deps): update socket.io packages to v4.8.3

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/docker.yml

@@ -53,7 +53,7 @@ jobs:
 
       - name: Cache node_modules
         id: cache-node-modules
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: var-cache-node-modules
           key: var-cache-node-modules-${{ hashFiles('Dockerfile', 'install/package.json') }}
@@ -77,7 +77,7 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: digests-${{ env.PLATFORM_PAIR }}
           path: ${{ runner.temp }}/digests/*
@@ -93,7 +93,7 @@ jobs:
           echo "IMAGE=ghcr.io/${GITHUB_REPOSITORY@L}" >> $GITHUB_ENV
           echo "CURRENT_DATE_NST=$(date +'%Y%m%d-%H%M%S' -d '-3 hours -30 minutes')" >> $GITHUB_ENV
       - name: Download digests
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           path: ${{ runner.temp }}/digests
           pattern: digests-*

CHANGELOG.md

@@ -1,3 +1,75 @@
+#### v4.7.1 (2025-12-17)
+
+##### Chores
+
+*  up widget-essentials (9d666550)
+*  remove log (2142b680)
+*  up harmony (59f649b8)
+*  incrementing version number - v4.7.0 (e82d40f8)
+*  update changelog for v4.7.0 (1c0a43dc)
+*  incrementing version number - v4.6.3 (9fc5b0f3)
+*  incrementing version number - v4.6.2 (f98747db)
+*  incrementing version number - v4.6.1 (f47aa678)
+*  incrementing version number - v4.6.0 (ee395bc5)
+*  incrementing version number - v4.5.2 (ad2da639)
+*  incrementing version number - v4.5.1 (69f4b61f)
+*  incrementing version number - v4.5.0 (f05c5d06)
+*  incrementing version number - v4.4.6 (074043ad)
+*  incrementing version number - v4.4.5 (6f106923)
+*  incrementing version number - v4.4.4 (d323af44)
+*  incrementing version number - v4.4.3 (d354c2eb)
+*  incrementing version number - v4.4.2 (55c510ae)
+*  incrementing version number - v4.4.1 (5ae79b4e)
+*  incrementing version number - v4.4.0 (0a75eee3)
+*  incrementing version number - v4.3.2 (b92b5d80)
+*  incrementing version number - v4.3.1 (308e6b9f)
+*  incrementing version number - v4.3.0 (bff291db)
+*  incrementing version number - v4.2.2 (17fecc24)
+*  incrementing version number - v4.2.1 (852a270c)
+*  incrementing version number - v4.2.0 (87581958)
+*  incrementing version number - v4.1.1 (b2afbb16)
+*  incrementing version number - v4.1.0 (36c80850)
+*  incrementing version number - v4.0.6 (4a52fb2e)
+*  incrementing version number - v4.0.5 (1792a62b)
+*  incrementing version number - v4.0.4 (b1125cce)
+*  incrementing version number - v4.0.3 (2b65c735)
+*  incrementing version number - v4.0.2 (73fe5fcf)
+*  incrementing version number - v4.0.1 (a461b758)
+*  incrementing version number - v4.0.0 (c1eaee45)
+
+##### Continuous Integration
+
+*  drop ARM v7 from docker builds (#13808) (254370c5)
+
+##### New Features
+
+*  stop extraneous vote and tids_read data from being saved for remote users (9f729964)
+*  add hreflang to buildLinkTag (ba85474d)
+*  #13790, allow ssl setup in psql (5bd1f7b7)
+
+##### Bug Fixes
+
+*  wrong increment value (b1fc5bfd)
+*  increment progress on upgrade script (9f94a721)
+*  disallow inline viewing of unsafe files (#13833) (5ae8d553)
+*  moving topic to cid=-1 will remove it from list (90a15134)
+*  show errors when saving settings (f49f540b)
+*  closes #13666, update category label (193aaf55)
+*  respect user pagination settings in infinite scroll (#13765) (#13788) (ebf2a2c5)
+*  remove hardcoded name for sentinel, #13794 (53e22acf)
+
+##### Other Changes
+
+*  fix missing comma (9fb41c69)
+
+##### Reverts
+
+*  spec change (b19281b0)
+
+##### Tests
+
+*  fix tests (11b01dfc)
+
 #### v4.7.0 (2025-11-26)
 
 ##### Chores

install/package.json

@@ -2,7 +2,7 @@
     "name": "nodebb",
     "license": "GPL-3.0",
     "description": "NodeBB Forum",
-    "version": "4.7.0",
+    "version": "4.7.1",
     "homepage": "https://www.nodebb.org",
     "repository": {
         "type": "git",
@@ -42,7 +42,7 @@
         "ace-builds": "1.43.5",
         "archiver": "7.0.1",
         "async": "3.2.6",
-        "autoprefixer": "10.4.22",
+        "autoprefixer": "10.4.23",
         "bcryptjs": "3.0.3",
         "benchpressjs": "2.5.5",
         "body-parser": "2.2.1",
@@ -66,13 +66,13 @@
         "csrf-sync": "4.2.1",
         "daemon": "1.1.0",
         "diff": "8.0.2",
-        "esbuild": "0.27.1",
+        "esbuild": "0.27.2",
         "express": "4.22.1",
         "express-session": "1.18.2",
         "express-useragent": "2.0.2",
-        "fetch-cookie": "3.1.0",
+        "fetch-cookie": "3.2.0",
         "file-loader": "6.2.0",
-        "fs-extra": "11.3.2",
+        "fs-extra": "11.3.3",
         "graceful-fs": "4.2.11",
         "helmet": "7.2.0",
         "html-to-text": "9.0.5",
@@ -96,23 +96,23 @@
         "mousetrap": "1.6.5",
         "multer": "2.0.2",
         "nconf": "0.13.0",
-        "nodebb-plugin-2factor": "7.6.0",
+        "nodebb-plugin-2factor": "7.6.1",
         "nodebb-plugin-composer-default": "10.3.1",
         "nodebb-plugin-dbsearch": "6.3.4",
         "nodebb-plugin-emoji": "6.0.5",
         "nodebb-plugin-emoji-android": "4.1.1",
         "nodebb-plugin-link-preview": "2.1.5",
         "nodebb-plugin-markdown": "13.2.2",
-        "nodebb-plugin-mentions": "4.8.3",
+        "nodebb-plugin-mentions": "4.8.4",
         "nodebb-plugin-spam-be-gone": "2.3.2",
         "nodebb-plugin-web-push": "0.7.6",
         "nodebb-rewards-essentials": "1.0.2",
-        "nodebb-theme-harmony": "2.1.26",
+        "nodebb-theme-harmony": "2.1.28",
         "nodebb-theme-lavender": "7.1.19",
         "nodebb-theme-peace": "2.2.49",
-        "nodebb-theme-persona": "14.1.18",
+        "nodebb-theme-persona": "14.1.20",
         "nodebb-widget-essentials": "7.0.41",
-        "nodemailer": "7.0.11",
+        "nodemailer": "7.0.12",
         "nprogress": "0.2.0",
         "passport": "0.7.0",
         "passport-http-bearer": "1.0.1",
@@ -129,19 +129,19 @@
         "rss": "1.2.2",
         "rtlcss": "4.3.0",
         "sanitize-html": "2.17.0",
-        "sass": "1.96.0",
+        "sass": "1.97.0",
         "satori": "0.18.3",
         "sbd": "^1.0.19",
         "semver": "7.7.3",
         "serve-favicon": "2.5.1",
         "sharp": "0.34.5",
         "sitemap": "9.0.0",
-        "socket.io": "4.8.1",
-        "socket.io-client": "4.8.1",
+        "socket.io": "4.8.3",
+        "socket.io-client": "4.8.3",
         "@socket.io/redis-adapter": "8.3.0",
         "sortablejs": "1.15.6",
         "spdx-license-list": "6.10.0",
-        "terser-webpack-plugin": "5.3.15",
+        "terser-webpack-plugin": "5.3.16",
         "textcomplete": "0.18.2",
         "textcomplete.contenteditable": "0.1.1",
         "timeago": "1.6.7",
@@ -149,8 +149,8 @@
         "toobusy-js": "0.5.1",
         "tough-cookie": "6.0.0",
         "undici": "^7.10.0",
-        "validator": "13.15.23",
-        "webpack": "5.103.0",
+        "validator": "13.15.26",
+        "webpack": "5.104.1",
         "webpack-merge": "6.0.1",
         "winston": "3.19.0",
         "workerpool": "10.0.1",
@@ -164,7 +164,7 @@
         "@commitlint/cli": "20.2.0",
         "@commitlint/config-angular": "20.2.0",
         "coveralls": "3.1.1",
-        "@eslint/js": "9.39.1",
+        "@eslint/js": "9.39.2",
         "@stylistic/eslint-plugin": "5.6.1",
         "eslint-config-nodebb": "1.1.11",
         "eslint-plugin-import": "2.32.0",
@@ -177,10 +177,10 @@
         "mocha-lcov-reporter": "1.3.0",
         "mockdate": "3.0.5",
         "nyc": "17.1.0",
-        "smtp-server": "3.17.0"
+        "smtp-server": "3.17.1"
     },
     "optionalDependencies": {
-        "sass-embedded": "1.96.0"
+        "sass-embedded": "1.97.1"
     },
     "resolutions": {
         "*/jquery": "3.7.1"

public/src/client/account/settings.js

@@ -102,7 +102,7 @@ define('forum/account/settings', [
 			if (languageChanged && parseInt(app.user.uid, 10) === parseInt(ajaxify.data.theirid, 10)) {
 				window.location.reload();
 			}
-		});
+		}).catch(alerts.error);
 	}
 
 	function toggleCustomRoute() {

public/src/client/category/tools.js

@@ -285,7 +285,7 @@ define('forum/category/tools', [
 	}
 
 	async function onTopicMoved(data) {
-		if (ajaxify.data.template.category) {
+		if (ajaxify.data.template.category || String(data.toCid) === '-1') {
 			getTopicEl(data.tid).remove();
 		} else {
 			const category = await api.get(`/categories/${data.toCid}`);

public/src/modules/quickreply.js

@@ -60,7 +60,7 @@ define('quickreply', [
 				return;
 			}
 
-			const replyMsg = components.get('topic/quickreply/text').val();
+			const replyMsg = element.val();
 			const replyData = {
 				tid: ajaxify.data.tid,
 				handle: undefined,
@@ -74,9 +74,11 @@ define('quickreply', [
 			}
 
 			ready = false;
+			element.val('');
 			api.post(`/topics/${ajaxify.data.tid}`, replyData, function (err, data) {
 				ready = true;
 				if (err) {
+					element.val(replyMsg);
 					return alerts.error(err);
 				}
 				if (data && data.queued) {
@@ -91,7 +93,7 @@ define('quickreply', [
 					});
 				}
 
-				components.get('topic/quickreply/text').val('');
+				element.val('');
 				storage.removeItem(qrDraftId);
 				QuickReply._autocomplete.hide();
 				hooks.fire('action:quickreply.success', { data });

src/middleware/index.js

@@ -273,10 +273,19 @@ middleware.buildSkinAsset = helpers.try(async (req, res, next) => {
 middleware.addUploadHeaders = function addUploadHeaders(req, res, next) {
 	// Trim uploaded files' timestamps when downloading + force download if html
 	let basename = path.basename(req.path);
-	const extname = path.extname(req.path);
-	if (req.path.startsWith('/uploads/files/') && middleware.regexes.timestampedUpload.test(basename)) {
-		basename = basename.slice(14);
-		res.header('Content-Disposition', `${extname.startsWith('.htm') ? 'attachment' : 'inline'}; filename="${basename}"`);
+	const extname = path.extname(req.path).toLowerCase();
+	const unsafeExtensions = [
+		'.html', '.htm', '.xhtml', '.mht', '.mhtml', '.stm', '.shtm', '.shtml',
+		'.svg', '.svgz',
+		'.xml', '.xsl', '.xslt',
+	];
+	const isInlineSafe = !unsafeExtensions.includes(extname);
+	const dispositionType = isInlineSafe ? 'inline' : 'attachment';
+	if (req.path.startsWith('/uploads/files/')) {
+		if (middleware.regexes.timestampedUpload.test(basename)) {
+			basename = basename.slice(14);
+		}
+		res.header('Content-Disposition', `${dispositionType}; filename="${basename}"`);
 	}
 
 	next();

test/activitypub/feps.js

@@ -164,9 +164,9 @@ describe('FEPs', () => {
 					});
 					pid = id;
 					({ activity } = await helpers.mocks.create(note));
-
+					console.log('before inbox create', activitypub._sent);
 					await activitypub.inbox.create({ body: activity });
-
+					console.log('after inbox create', activitypub._sent);
 					const activities = Array.from(activitypub._sent);
 
 					const test1 = activities.some((activity) => {
@@ -175,13 +175,13 @@ describe('FEPs', () => {
 							activity.object && activity.object.type === 'Create' &&
 							activity.object.object && activity.object.object.type === 'Note';
 					});
-
+					assert(test1);
 					const test2 = activities.some((activity) => {
 						[, activity] = activity;
 						return activity.type === 'Announce' &&
 							activity.object && activity.object.type === 'Note';
 					});
-					assert(test1 && test2);
+					assert(test2);
 				});
 
 				it('should federate out an Announce(Create(Note)) on reply', async () => {