release 7.3.1

prevent Host header injection attacks
Merge pull request #2267 from Athou/renovate/com.diffplug.spotless-spotless-maven-plugin-3.x
2026-10-24 05:59:11 +00:00 · 2026-08-17 22:32:32 +02:00 · 2026-08-17 22:27:46 +02:00 · 2026-08-17 08:49:07 +02:00 · 2026-08-17 07:45:37 +02:00 · 2026-08-17 05:44:41 +00:00
12 changed files with 196 additions and 161 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog

+## [7.3.1]
+
+- Prevent Host header injection attacks on the password recovery endpoint. A new setting
+  `commafeed.password-recovery-public-base-url` has been added to specify the base URL to use in password recovery
+  emails. This setting is only required when the password recovery feature is enabled, which is not the default.
+
 ## [7.3.0]

 - Add support for the Google Reader API for native mobile apps that don't support the Fever API
--- a/commafeed-client/biome.json
+++ b/commafeed-client/biome.json
@@ -1,5 +1,5 @@
 {
-    "$schema": "https://biomejs.dev/schemas/2.5.7/schema.json",
+    "$schema": "https://biomejs.dev/schemas/2.5.8/schema.json",
    "formatter": {
        "indentStyle": "space",
        "indentWidth": 4,
--- a/commafeed-client/package-lock.json
+++ b/commafeed-client/package-lock.json
@@ -20,7 +20,7 @@
                "@mantine/notifications": "9.5.1",
                "@mantine/spotlight": "9.5.1",
                "@monaco-editor/react": "4.7.0",
-                "@react-querybuilder/mantine": "8.22.3",
+                "@react-querybuilder/mantine": "8.22.5",
                "@reduxjs/toolkit": "2.12.0",
                "@rolldown/plugin-babel": "0.2.3",
                "axios": "1.19.0",
@@ -36,7 +36,7 @@
                "react-draggable": "4.7.1",
                "react-icons": "5.7.0",
                "react-infinite-scroller": "1.2.6",
-                "react-querybuilder": "8.22.3",
+                "react-querybuilder": "8.22.5",
                "react-redux": "9.3.0",
                "react-router-dom": "7.18.2",
                "react-swipeable": "7.0.2",
@@ -48,13 +48,13 @@
            },
            "devDependencies": {
                "@babel/types": "^8.0.4",
-                "@biomejs/biome": "2.5.7",
+                "@biomejs/biome": "2.5.8",
                "@lingui/babel-plugin-lingui-macro": "6.6.0",
                "@lingui/cli": "6.6.0",
                "@lingui/vite-plugin": "6.6.0",
-                "@testing-library/jest-dom": "7.0.0",
+                "@testing-library/jest-dom": "7.0.1",
                "@testing-library/react": "16.3.2",
-                "@testing-library/user-event": "14.6.3",
+                "@testing-library/user-event": "14.6.4",
                "@types/mousetrap": "1.6.15",
                "@types/react": "19.2.18",
                "@types/react-dom": "19.2.4",
@@ -592,9 +592,9 @@
            }
        },
        "node_modules/@biomejs/biome": {
-            "version": "2.5.7",
-            "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.5.7.tgz",
-            "integrity": "sha512-zr8K/DcY5tYsQOQwqMJ0AWElo6QgmgNI7idXgXLhevVszlt8RGVpesEJPqx3ThazLaOwjJ5Y8fz3BtH5fGZNsw==",
+            "version": "2.5.8",
+            "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.5.8.tgz",
+            "integrity": "sha512-aeAeeJB9fSDc7Gq+2GqpQxA0qBj6gj1k2R6L1cYqGePKP/baIq1WX8y6B+D+nRsO5ViQL22K/8IwbqERW0q1nw==",
            "dev": true,
            "license": "MIT OR Apache-2.0",
            "bin": {
@@ -608,20 +608,20 @@
                "url": "https://opencollective.com/biome"
            },
            "optionalDependencies": {
-                "@biomejs/cli-darwin-arm64": "2.5.7",
-                "@biomejs/cli-darwin-x64": "2.5.7",
-                "@biomejs/cli-linux-arm64": "2.5.7",
-                "@biomejs/cli-linux-arm64-musl": "2.5.7",
-                "@biomejs/cli-linux-x64": "2.5.7",
-                "@biomejs/cli-linux-x64-musl": "2.5.7",
-                "@biomejs/cli-win32-arm64": "2.5.7",
-                "@biomejs/cli-win32-x64": "2.5.7"
+                "@biomejs/cli-darwin-arm64": "2.5.8",
+                "@biomejs/cli-darwin-x64": "2.5.8",
+                "@biomejs/cli-linux-arm64": "2.5.8",
+                "@biomejs/cli-linux-arm64-musl": "2.5.8",
+                "@biomejs/cli-linux-x64": "2.5.8",
+                "@biomejs/cli-linux-x64-musl": "2.5.8",
+                "@biomejs/cli-win32-arm64": "2.5.8",
+                "@biomejs/cli-win32-x64": "2.5.8"
            }
        },
        "node_modules/@biomejs/cli-darwin-arm64": {
-            "version": "2.5.7",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.5.7.tgz",
-            "integrity": "sha512-vxo/Ls3/PYdQWyLhYYcgMOCzQypAjcY+iihS8M0wW03l16TCLW4zqZzGo75gm1VdCMj38hTVZ31KBWrZ4G9dJw==",
+            "version": "2.5.8",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.5.8.tgz",
+            "integrity": "sha512-mk1QON9PHllvvLN5gU3f4rMxeh4syK5p9OvKyWH6/W8ueh04uaC8TUXXByhGufWf/y5mQc03ZLM45zU+cmqMjA==",
            "cpu": [
                "arm64"
            ],
@@ -636,9 +636,9 @@
            }
        },
        "node_modules/@biomejs/cli-darwin-x64": {
-            "version": "2.5.7",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.5.7.tgz",
-            "integrity": "sha512-Cd3Ga61amT/Yl/0x8elP5hhGYaFy4bw6WuysTgf7oo8TA5tJ5A1k+DkVoJ2BHbTVil51gTX9VPzArnrlLJ3Kyg==",
+            "version": "2.5.8",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.5.8.tgz",
+            "integrity": "sha512-bsGwFMBNyHPyiLSsQcZJxdoRrg1V4JL+d7wEsvUBczlP9U9lwM+7mzQHxI4o1mhBsTmdOBbAb6fHU3Z3snN45w==",
            "cpu": [
                "x64"
            ],
@@ -653,9 +653,9 @@
            }
        },
        "node_modules/@biomejs/cli-linux-arm64": {
-            "version": "2.5.7",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.5.7.tgz",
-            "integrity": "sha512-rR2QE0yF2GYSuYuKIa7pKvODGJqnOH+2eDREAM8wV+mWKSkMQKdAp4zXEZfTaxY8PMoNONnpgSWcBCyLDPDOKg==",
+            "version": "2.5.8",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.5.8.tgz",
+            "integrity": "sha512-XmFiA0WPYFC+uiUDC8WRFzAIH9bo7vwQLav38Uoq4ETC+T/+uBi0TsYGJECkugY3r8USl3jc+Ae2/irAF6F2lQ==",
            "cpu": [
                "arm64"
            ],
@@ -673,9 +673,9 @@
            }
        },
        "node_modules/@biomejs/cli-linux-arm64-musl": {
-            "version": "2.5.7",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.5.7.tgz",
-            "integrity": "sha512-xPI5yB6XlpDbNkS+bm1t42olw5c4l3UrlOmLg7KtLJvjvkNF/1V4tnUgfkylGIeb3u/T+BzMGYqgQhzjAoJzuQ==",
+            "version": "2.5.8",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.5.8.tgz",
+            "integrity": "sha512-VcJNbstduTHx83NGAdhp78/JOcP45BZHXL7yNsfI1uGzdUgegAz2s+mSoT7wK6PBNzLoqG0zDOXaz/RQYVtSiw==",
            "cpu": [
                "arm64"
            ],
@@ -693,9 +693,9 @@
            }
        },
        "node_modules/@biomejs/cli-linux-x64": {
-            "version": "2.5.7",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.5.7.tgz",
-            "integrity": "sha512-FQgqJhscrqJUFptGaRSUJWlXAExwWcDwLuK49dvKfkQ1bB5SEEyFssnsxQY83Xm6jR0EbbX3+8+D5bfvYqUG2Q==",
+            "version": "2.5.8",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.5.8.tgz",
+            "integrity": "sha512-S5wcm9OBDvLHodD4PUaN488hCpco9QD/9ZxuYJiw4euWtr/oQvLR72z2ixItH8Wd5BCm6FZaeb+YNvOoM1xHtQ==",
            "cpu": [
                "x64"
            ],
@@ -713,9 +713,9 @@
            }
        },
        "node_modules/@biomejs/cli-linux-x64-musl": {
-            "version": "2.5.7",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.5.7.tgz",
-            "integrity": "sha512-rE5VZi+qtmPgQH+l7jVxYoZ18b/TiHEhulhMpjmCZH1PltSbjRcxNWywC3HZ9tYottG7ORkeTtoscBilKSBm0g==",
+            "version": "2.5.8",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.5.8.tgz",
+            "integrity": "sha512-kKmiyokeISRGq2FLwvr+TzsgBusfxaZ0FZNLcOYOpCK/78tRrEjeEBLvq3xLZMpqbANgJdRPI7vZX8ZL37u9/w==",
            "cpu": [
                "x64"
            ],
@@ -733,9 +733,9 @@
            }
        },
        "node_modules/@biomejs/cli-win32-arm64": {
-            "version": "2.5.7",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.5.7.tgz",
-            "integrity": "sha512-Oq4x0CCwP4jirrcTywXs5kOGZ4v5vuEP+gWrbtjApOA2CL9F3F9GlIdQIci8AKSCa/zURanMRpX/4wQ7Am6hHg==",
+            "version": "2.5.8",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.5.8.tgz",
+            "integrity": "sha512-nILH0mzm3Hi3iEdd7o7GpB8kBR/mSQwfQG/tyBqyNrY2GFtcgwfV9nV8xLmbtUpMNY/Oi0Ml1XgfR4flOdq+AA==",
            "cpu": [
                "arm64"
            ],
@@ -750,9 +750,9 @@
            }
        },
        "node_modules/@biomejs/cli-win32-x64": {
-            "version": "2.5.7",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.5.7.tgz",
-            "integrity": "sha512-V+0wu/nrj2S+MhP4EQ0uHNolP0IALEsz45pg0WoKkHfDeh0+ItHwP/p7bX5RPoMOl9NkpHYWdYPhIcy2mACHvQ==",
+            "version": "2.5.8",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.5.8.tgz",
+            "integrity": "sha512-I2czzXTY61f3nFJxXoMDq80t7MivxDEnCjE+8sDKoFfcKMaoQdkqhIFQ3KyY0XLzeSpUBYeNAXgD+iOV/BU0VA==",
            "cpu": [
                "x64"
            ],
@@ -791,9 +791,9 @@
            }
        },
        "node_modules/@csstools/color-helpers": {
-            "version": "6.1.0",
-            "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.1.0.tgz",
-            "integrity": "sha512-064IFJdjTfUqnjpCVpMOdbr8FLQBhinbZj6yRv2An2E41O/pLEXqfFRWqGq/SxlE5PEUYTlvWsG2r8MswAVvkg==",
+            "version": "6.1.1",
+            "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.1.1.tgz",
+            "integrity": "sha512-gLNsunvwf3mCi5u5o46/Z/JcJMnhbHSaZ69rkgPzNM3J4s8hWwpPUQB6/tt0EDFyCiWzxANlx+2LJwpYj4zS1w==",
            "dev": true,
            "funding": [
                {
@@ -835,9 +835,9 @@
            }
        },
        "node_modules/@csstools/css-color-parser": {
-            "version": "4.1.10",
-            "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.1.10.tgz",
-            "integrity": "sha512-UZhQLIUyJaaMepqehrCODwCg2KW25vFvLWBmqYFaPclYvvxzj/sG8LBOhBFCp11i9uE7t1EyS+RAoV9tztPFyw==",
+            "version": "4.2.0",
+            "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.2.0.tgz",
+            "integrity": "sha512-5+5LEmFuY1AjXdYhmgjTJogtQnP1evJ1zrBZGUNZ0thkpwnnmKxcHdAMn/OtFjAb25zA+jKDVYVRl+5G7rjv1A==",
            "dev": true,
            "funding": [
                {
@@ -851,7 +851,7 @@
            ],
            "license": "MIT",
            "dependencies": {
-                "@csstools/color-helpers": "^6.1.0",
+                "@csstools/color-helpers": "^6.1.1",
                "@csstools/css-calc": "^3.3.0"
            },
            "engines": {
@@ -886,9 +886,9 @@
            }
        },
        "node_modules/@csstools/css-syntax-patches-for-csstree": {
-            "version": "1.1.7",
-            "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.7.tgz",
-            "integrity": "sha512-fQ+05118eQS1cofO3aJpB5efgpBZMvIzwr/sbC8kDLVA5XLG8q1kJV5yzrUAI1f7lvhPnm8fgIjzFB8/O/5Dig==",
+            "version": "1.1.8",
+            "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.8.tgz",
+            "integrity": "sha512-CpMLjAvwQg3BL5S0IeqsZNMH7EQrEWi0kLKOC13ZBF0ZwERiLWlibNPJr8G1kdU3Ms/r2KiNrF81pUh2HwAHdg==",
            "dev": true,
            "funding": [
                {
@@ -1617,23 +1617,24 @@
            }
        },
        "node_modules/@oxc-project/types": {
-            "version": "0.143.0",
-            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.143.0.tgz",
-            "integrity": "sha512-u6JZdLBTLotrNC9Vd6vPssINdzcCzleKAH6EJKImQb7GtYvX5keN2dxkoK44stCc4tffE6QQRtZTXVSzsLUlWA==",
+            "version": "0.144.0",
+            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.144.0.tgz",
+            "integrity": "sha512-nuhZIOLuI6TFQ32I/WnUx+SCPY7SdSKwgnFHydAuoS1+Z4BRcaP+RRJmGzl9lw+0OFF7UmaESf7KQRXaNLHypg==",
            "license": "MIT",
            "funding": {
                "url": "https://github.com/sponsors/Boshen"
            }
        },
        "node_modules/@react-querybuilder/core": {
-            "version": "8.22.4",
-            "resolved": "https://registry.npmjs.org/@react-querybuilder/core/-/core-8.22.4.tgz",
-            "integrity": "sha512-Av4Eoa31JBsR3HwfAVwqGT2pepRB+En4GMR1ua7umBgMrvyP18uQlvIoV1zhR7WhQ6M8zsPhy6Bybbw1Dt93rg==",
+            "version": "8.23.0",
+            "resolved": "https://registry.npmjs.org/@react-querybuilder/core/-/core-8.23.0.tgz",
+            "integrity": "sha512-5EHBNwC31K0E4LJE2vea7s7bHnlRnYShH3ceSF4ZMcW5pnfcByfJA6JHymT1bh67l+n7iYq5n2gXtJuCZMLDSw==",
            "license": "MIT",
            "dependencies": {
                "@ts-jison/lexer": "0.4.1-alpha.1",
                "@ts-jison/parser": "0.4.1-alpha.1",
-                "immer": "^11.1.15",
+                "@types/json-logic-js": ">=2",
+                "immer": "^11.1.16",
                "numeric-quantity": "^3.2.2"
            },
            "peerDependencies": {
@@ -1674,9 +1675,9 @@
            }
        },
        "node_modules/@react-querybuilder/mantine": {
-            "version": "8.22.3",
-            "resolved": "https://registry.npmjs.org/@react-querybuilder/mantine/-/mantine-8.22.3.tgz",
-            "integrity": "sha512-ZPOL0myiNt2qxxGBA6+aHl9RFp8js/IUX7Hu87HEsz7KHlWkBqYC9IXD6YGWzm1P8nPnPBWVEwFJHSQbE1wIFQ==",
+            "version": "8.22.5",
+            "resolved": "https://registry.npmjs.org/@react-querybuilder/mantine/-/mantine-8.22.5.tgz",
+            "integrity": "sha512-ciLXWRh6YhFdQQwkS9x0h/z7nxe2thtq3mseTC3/KV2SQBrjBDiBoRVxQe8H2koL0FuasTmdiPU/TqDkqV9Acg==",
            "license": "MIT",
            "peerDependencies": {
                "@mantine/core": ">=7",
@@ -1684,7 +1685,7 @@
                "@mantine/hooks": ">=7",
                "dayjs": ">=1",
                "react": ">=18",
-                "react-querybuilder": "8.22.3"
+                "react-querybuilder": "8.22.5"
            }
        },
        "node_modules/@reduxjs/toolkit": {
@@ -1714,9 +1715,9 @@
            }
        },
        "node_modules/@rolldown/binding-android-arm64": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.3.tgz",
-            "integrity": "sha512-zrJtHDcaZJ1Fp7xf4hNl+7seH9Cn/N5TwLYkhgXREtBwAd/jaqW3uqeHxpDugJLVICWg4eW44kOQEGJ1r6jCGw==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.4.tgz",
+            "integrity": "sha512-jHC2cnyKz5xU2fhECtFl8OZ83cYNt13GZQD+0uMJ/X3o+ijmd56okHhTUwxVSHPx1IRVIJEZ1/1pPzeLCU6XKA==",
            "cpu": [
                "arm64"
            ],
@@ -1730,9 +1731,9 @@
            }
        },
        "node_modules/@rolldown/binding-darwin-arm64": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.3.tgz",
-            "integrity": "sha512-ieIiibVCp0tX7TLu2cafoNPv8wJyYi01ekXpbf8q2j7F4rGAhhXb/eQh7ge9DRBY78GwmRQtvjZDux7EDbA8kA==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.4.tgz",
+            "integrity": "sha512-Dc5mPD8F5F/FS8i01syd7FTF6yB2fVthH/TRkjwJkzUK6EpoxHtqvZQP5Zwq80/5z19TWYHIg1KOHboCgVx/aQ==",
            "cpu": [
                "arm64"
            ],
@@ -1746,9 +1747,9 @@
            }
        },
        "node_modules/@rolldown/binding-darwin-x64": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.3.tgz",
-            "integrity": "sha512-Zh9tCon19eDXJoihx0rqKhMUlMYqzwj3aPsSuHmI4RWZh62dWUL+DJN4C5YQya5TcQBJU/Fe8+rY0jhXTQITqA==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.4.tgz",
+            "integrity": "sha512-fpDm4oBo6SqLvWUYCmFhdde3U9KH2fRNNMeAnAPAIwxRL345xutL0EtEUcuoxsoazdJGv/MuDBQHlCDrtbvqOg==",
            "cpu": [
                "x64"
            ],
@@ -1762,9 +1763,9 @@
            }
        },
        "node_modules/@rolldown/binding-freebsd-x64": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.3.tgz",
-            "integrity": "sha512-nGbJWewA1wrXXZiQhjAT5rhibGfns5ZNkDVqxsO6zJ3f3YvpoDNNmGMSbbhLuXKjNScaBJVOAboztAWVespQMg==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.4.tgz",
+            "integrity": "sha512-rSJoreDE/HoIzoaib6MTp5jQtCTdMHKIvItAKT/ImS6Y6Ww76oUaeMyp4Vc/fAgd/ehji068IxetHXAnqUwN9A==",
            "cpu": [
                "x64"
            ],
@@ -1778,9 +1779,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.3.tgz",
-            "integrity": "sha512-QNniJr5Kml0kDEB98jiDOJjXNroxIIi0IXIbdYzY26Xt1pVbeP62+KnoIZLwirOymX/0jDk/2gI/bNUv7A7OIw==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.4.tgz",
+            "integrity": "sha512-/jm8OGHgn7oGaJu3i/qZI9spUGcJ+y/lk43ttQ/iO1tOd9NissG6o97bighBCiL+BKRngmcDuR6ikfwYdJmVuQ==",
            "cpu": [
                "arm"
            ],
@@ -1794,9 +1795,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm64-gnu": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.3.tgz",
-            "integrity": "sha512-TkqEAcmmvH3I/q4114NB4RVt6241Dao48pF45uLcFGrwAaIn0iITgTAKP/dLjbN0R4buJjGb91+UHSoFmpgIWw==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.4.tgz",
+            "integrity": "sha512-tIP06BeD9EqvECBrPZ+sqdPlYrT+aYaAiu1wYziVx5elRK/ftm33JxVDy2bXGbr6J0CrtirCkR87/X5a2euEng==",
            "cpu": [
                "arm64"
            ],
@@ -1813,9 +1814,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm64-musl": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.3.tgz",
-            "integrity": "sha512-NHqjnxpsndf4MPymxteFAWHHfkTL8HjWh1KB7z23ofZ6QO2euONuxDXjat69dKZRALnGypg8k8SsK8vZJoXv1Q==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.4.tgz",
+            "integrity": "sha512-Ql1Q0EQqVThvn9VAVlwNzsUvbSFtCMGjLpRRi4pk5i7NZZ4n5ISiLMjHYtus4VQ2PvkSw24zyaCVsiS+sXPj1w==",
            "cpu": [
                "arm64"
            ],
@@ -1832,9 +1833,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.3.tgz",
-            "integrity": "sha512-6tbrbwfz5GB9DQ4Jwo6hy9v+vR31xZlvzZ6n5Xut6Hhx5PvrA9q/HsK8KMaYQp063iqZGXwNvZtYNLD7EM/x0w==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.4.tgz",
+            "integrity": "sha512-GjbjXD4XXfN19D0LZNbmiCBUoDiRACsYHr0yaIbbn8aFsXjHZifcYqu/W5Er5X2X990WjHXFrxarn5chzItorQ==",
            "cpu": [
                "ppc64"
            ],
@@ -1851,9 +1852,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-s390x-gnu": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.3.tgz",
-            "integrity": "sha512-oyuXxXmoZHjXC917IAPFAAv4wWAa0cM9afk8nx1+9/jNNOX1uPf8yDA6p7G0RypOfw/X0PQt5IfoquY1um+zSg==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.4.tgz",
+            "integrity": "sha512-p5WR0NOwaRmJ/B1b6IjEFLLivwEsf3PrdBIhRbhTCQisbo2SvHHpG4ELB/+FgQNnB88LTOF86upmJmbvZdQ2lw==",
            "cpu": [
                "s390x"
            ],
@@ -1870,9 +1871,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-x64-gnu": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.3.tgz",
-            "integrity": "sha512-TytMwF2KVGqP2tgd0I1OY0PAv78dZRAYcF5ssDzjM34SUXCED3uXvSd5+lHoC0bTD6eEdFz7LdQNCO1y0oVk9w==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.4.tgz",
+            "integrity": "sha512-4/GyVjmhR+Tc6HLJvwc1sOhPqAZtySiSMesOZyX6JQ5XBxoTDEMKQzvo07NIK6nTon/SivlZqvhzvuVBNQhObQ==",
            "cpu": [
                "x64"
            ],
@@ -1889,9 +1890,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-x64-musl": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.3.tgz",
-            "integrity": "sha512-/E9m3qstrJFVPoULV25mVQblSNExY2+kBsYe4sy0Tn0yOOgJ8wZbZt3KnRbF/XeU2Gl1STKUQnDNTqhIE5MD4A==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.4.tgz",
+            "integrity": "sha512-l9eeLsCNvPpmSXUej0etw/J1eqV0Jj1D5G/xG6YTijmE6dkv6E2QezgWbTfQk63v952DPqrjOCoiqxq7Bw0YUQ==",
            "cpu": [
                "x64"
            ],
@@ -1908,9 +1909,9 @@
            }
        },
        "node_modules/@rolldown/binding-openharmony-arm64": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.3.tgz",
-            "integrity": "sha512-Kr0OcsoQI816i6HOl3vFHpd1K0eZyh76zgfj4c1nTyaTsd5r2Mj1lwM4R90y/qaCfmTn9eHy0SKwi98eitRxug==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.4.tgz",
+            "integrity": "sha512-e0F355MSTMm3+UOqtV3L24gFUp2N5m1f8L/7d56deik6va+AXdrt9F8LbzGpeWGWRbZEDq4m8NVnJDeBtf9DZg==",
            "cpu": [
                "arm64"
            ],
@@ -1924,9 +1925,9 @@
            }
        },
        "node_modules/@rolldown/binding-win32-arm64-msvc": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.3.tgz",
-            "integrity": "sha512-hOtMwTqnME+/gJcH/PCZ0wn0zPUjiWOgkHpxbSJpfGKMezHltx1S7/k1SitzVa7Ww2cqrDDaFbZEhcJZO8o+Jw==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.4.tgz",
+            "integrity": "sha512-AWLi0uBRYh6QlE7OKhiz+phZC0qwtij2QZmhmOdsLdFn64m7oMpooE9ICE3lhm9xMb4SpDo2WbHcxX1iFLFtqw==",
            "cpu": [
                "arm64"
            ],
@@ -1940,9 +1941,9 @@
            }
        },
        "node_modules/@rolldown/binding-win32-x64-msvc": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.3.tgz",
-            "integrity": "sha512-ekcqMMkI2PlhYnfzQnB/cEdYUVVJViWvoUyLrbzgDoi3Snfc1mVBwdnc306ufA5ejy8JSPjT2RlW1nQSjW7efg==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.4.tgz",
+            "integrity": "sha512-UwSDJOg3dqCAejWdxclJjCsh3Qq4vLYMDxmyHqo1btz3stK2VqgwNd3mm5tuIwzSlGIQ/1H9Hr+Zn09mrezNqQ==",
            "cpu": [
                "x64"
            ],
@@ -2031,9 +2032,9 @@
            }
        },
        "node_modules/@testing-library/jest-dom": {
-            "version": "7.0.0",
-            "resolved": "https://registry.npmjs.org/@testing-library/jest-dom/-/jest-dom-7.0.0.tgz",
-            "integrity": "sha512-HKAH9C6mBo5yBG6yRO5i43L2iisencAo5z+o5P/saHUoY+miC5ivXRxHBJcFyB5ypPNxHJdK3BoF/3O4DIptMg==",
+            "version": "7.0.1",
+            "resolved": "https://registry.npmjs.org/@testing-library/jest-dom/-/jest-dom-7.0.1.tgz",
+            "integrity": "sha512-oMDTC3oA+6CXSO2JZnvOI7CA6oVub6kij5ggk9ohwye5slmkwxYDXcPOVxgMw/RQlticjtO0C1RZkR97HgrWMw==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -2050,7 +2051,13 @@
                "yarn": ">=1"
            },
            "peerDependencies": {
-                "@testing-library/dom": ">=10 <11"
+                "@testing-library/dom": ">=10 <11",
+                "vitest": ">= 0.32"
+            },
+            "peerDependenciesMeta": {
+                "vitest": {
+                    "optional": true
+                }
            }
        },
        "node_modules/@testing-library/jest-dom/node_modules/dom-accessibility-api": {
@@ -2089,9 +2096,9 @@
            }
        },
        "node_modules/@testing-library/user-event": {
-            "version": "14.6.3",
-            "resolved": "https://registry.npmjs.org/@testing-library/user-event/-/user-event-14.6.3.tgz",
-            "integrity": "sha512-6dBq67jT8lE+JTE8Exm02Kt6ze43hz1jdiSpSJwtTZiT1xQQ6b7nZYTTQ9njdArdU8XklOwaDp/AbT/eYSKF4g==",
+            "version": "14.6.4",
+            "resolved": "https://registry.npmjs.org/@testing-library/user-event/-/user-event-14.6.4.tgz",
+            "integrity": "sha512-QCGwP6QrjypBLwyj5cuyfVamkaIEy/XGY+1VDehbtbQqOggYmTFpFOdWR5mPz14vX8vXLMVjDHlRNBcClyO9ew==",
            "dev": true,
            "license": "MIT",
            "engines": {
@@ -2184,6 +2191,12 @@
                "@types/istanbul-lib-report": "*"
            }
        },
+        "node_modules/@types/json-logic-js": {
+            "version": "2.0.8",
+            "resolved": "https://registry.npmjs.org/@types/json-logic-js/-/json-logic-js-2.0.8.tgz",
+            "integrity": "sha512-WgNsDPuTPKYXl0Jh0IfoCoJoAGGYZt5qzpmjuLSEg7r0cKp/kWtWp0HAsVepyPSPyXiHo6uXp/B/kW/2J1fa2Q==",
+            "license": "MIT"
+        },
        "node_modules/@types/mousetrap": {
            "version": "1.6.15",
            "resolved": "https://registry.npmjs.org/@types/mousetrap/-/mousetrap-1.6.15.tgz",
@@ -2891,9 +2904,9 @@
            }
        },
        "node_modules/baseline-browser-mapping": {
-            "version": "2.11.13",
-            "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.13.tgz",
-            "integrity": "sha512-k9HNuUVMlqVjQ9UHzfPjIqiDbWw7WqT1AoT7GL8VwvF3r0ZfArtgiSPAlmupyNquNgOJHTuH4CKYf8ttMTWBTQ==",
+            "version": "2.11.14",
+            "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.14.tgz",
+            "integrity": "sha512-JyJ954WzuIR8/FFzX0o5krdSTrBAkcCSRfWSleRsIHSWV+cZe2FI1PKggVkFke1hBldRs+LRxUczzE9iPmgZww==",
            "license": "Apache-2.0",
            "bin": {
                "baseline-browser-mapping": "dist/cli.cjs"
@@ -3355,9 +3368,9 @@
            }
        },
        "node_modules/electron-to-chromium": {
-            "version": "1.5.403",
-            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.403.tgz",
-            "integrity": "sha512-MQsYmdaLzvaCX5j+ZZBr5Fm6uCCnPQcRtlvmvRlWqrXy+BH2O4ffXIAScF+JQznQWB9brWp4lSD9Z4yNmaf2BA==",
+            "version": "1.5.407",
+            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.407.tgz",
+            "integrity": "sha512-4R8XgQOdfxexCd/u63lRm6wCHjECwI45MV9wxAs2ggtfWe2hwlo1ql97jKsju2IcJ+jFSTwBssyYoiWhh7mauQ==",
            "license": "ISC"
        },
        "node_modules/emoji-regex": {
@@ -3761,9 +3774,9 @@
            }
        },
        "node_modules/immer": {
-            "version": "11.1.16",
-            "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.16.tgz",
-            "integrity": "sha512-Xs7H9rBc+kti1J6RueUvbEBkmOz7jqj11XYgf+YMXAYzu8EeE7hwZ9poLXdVfVnGmJu7QAf41T7H2KuF6QoK6Q==",
+            "version": "11.1.17",
+            "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.17.tgz",
+            "integrity": "sha512-8Vu44Y0MuMBlTQz/jQ8HEMYNq/bBqk87MnBwYR5mC8AthfhEXidZ5aT/oA/CUqboa8THKltnD9L3xyqhU/Sy1Q==",
            "license": "MIT",
            "funding": {
                "type": "opencollective",
@@ -4653,9 +4666,9 @@
            }
        },
        "node_modules/ora/node_modules/ansi-regex": {
-            "version": "6.2.2",
-            "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-            "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
+            "version": "6.3.0",
+            "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.3.0.tgz",
+            "integrity": "sha512-WpDfL7NO6j7tH88IDBNVdUJxDh9nmCteAVW9dsep846XdwF4naCBK+/tGLX3KJgcpgMRXCFlTM2hKGoK9FsdrQ==",
            "dev": true,
            "license": "MIT",
            "engines": {
@@ -5067,12 +5080,12 @@
            }
        },
        "node_modules/react-querybuilder": {
-            "version": "8.22.3",
-            "resolved": "https://registry.npmjs.org/react-querybuilder/-/react-querybuilder-8.22.3.tgz",
-            "integrity": "sha512-mSnCxTOUkWBVnQ2hxAZbS/jJHHOrzPgIw89yZpERysuQZc8jG6THraWguUilUAX84MiAyW3Zt3GOuUvw4LNvYw==",
+            "version": "8.22.5",
+            "resolved": "https://registry.npmjs.org/react-querybuilder/-/react-querybuilder-8.22.5.tgz",
+            "integrity": "sha512-UyLmmxB0fp9O54pexYW/fV3skQaQT7rW1wM3LzIEbnzStvXiCj8dEQDYqwOspwDajCOScYyFBVn6tMC05OpYTg==",
            "license": "MIT",
            "dependencies": {
-                "@react-querybuilder/core": "^8.22.3",
+                "@react-querybuilder/core": "^8.22.5",
                "@reduxjs/toolkit": "^2.12.0",
                "react-redux": "^9.3.0"
            },
@@ -5352,12 +5365,12 @@
            }
        },
        "node_modules/rolldown": {
-            "version": "1.2.3",
-            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.3.tgz",
-            "integrity": "sha512-rn9wpmxplLf7NLNyCk9FyWh3FM43DbY8jOzCdEPzH7uflhTftRbCEpqi6Ly2osgoU8OwObtmavMbWLaWy4LX7A==",
+            "version": "1.2.4",
+            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.4.tgz",
+            "integrity": "sha512-rSr7irW0K7QRWzjdJXqZowkcRdDtjRduh43rBltnVKd0VFq839l1lJoDvGJb6gl7+4rTTCrPWu+YfujUL8Ug7w==",
            "license": "MIT",
            "dependencies": {
-                "@oxc-project/types": "=0.143.0",
+                "@oxc-project/types": "=0.144.0",
                "@rolldown/pluginutils": "^1.0.0"
            },
            "bin": {
@@ -5367,20 +5380,20 @@
                "node": "^20.19.0 || >=22.12.0"
            },
            "optionalDependencies": {
-                "@rolldown/binding-android-arm64": "1.2.3",
-                "@rolldown/binding-darwin-arm64": "1.2.3",
-                "@rolldown/binding-darwin-x64": "1.2.3",
-                "@rolldown/binding-freebsd-x64": "1.2.3",
-                "@rolldown/binding-linux-arm-gnueabihf": "1.2.3",
-                "@rolldown/binding-linux-arm64-gnu": "1.2.3",
-                "@rolldown/binding-linux-arm64-musl": "1.2.3",
-                "@rolldown/binding-linux-ppc64-gnu": "1.2.3",
-                "@rolldown/binding-linux-s390x-gnu": "1.2.3",
-                "@rolldown/binding-linux-x64-gnu": "1.2.3",
-                "@rolldown/binding-linux-x64-musl": "1.2.3",
-                "@rolldown/binding-openharmony-arm64": "1.2.3",
-                "@rolldown/binding-win32-arm64-msvc": "1.2.3",
-                "@rolldown/binding-win32-x64-msvc": "1.2.3"
+                "@rolldown/binding-android-arm64": "1.2.4",
+                "@rolldown/binding-darwin-arm64": "1.2.4",
+                "@rolldown/binding-darwin-x64": "1.2.4",
+                "@rolldown/binding-freebsd-x64": "1.2.4",
+                "@rolldown/binding-linux-arm-gnueabihf": "1.2.4",
+                "@rolldown/binding-linux-arm64-gnu": "1.2.4",
+                "@rolldown/binding-linux-arm64-musl": "1.2.4",
+                "@rolldown/binding-linux-ppc64-gnu": "1.2.4",
+                "@rolldown/binding-linux-s390x-gnu": "1.2.4",
+                "@rolldown/binding-linux-x64-gnu": "1.2.4",
+                "@rolldown/binding-linux-x64-musl": "1.2.4",
+                "@rolldown/binding-openharmony-arm64": "1.2.4",
+                "@rolldown/binding-win32-arm64-msvc": "1.2.4",
+                "@rolldown/binding-win32-x64-msvc": "1.2.4"
            }
        },
        "node_modules/saxes": {
@@ -5841,9 +5854,9 @@
            }
        },
        "node_modules/update-browserslist-db": {
-            "version": "1.3.0",
-            "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.0.tgz",
-            "integrity": "sha512-x/M6q3w4Ybp91CNaS4S69UnliqR3BzRpOT6LWbksjth0S/+jhfaPJsWjt/TewpT8j9eLIojUf5jr29WextHroA==",
+            "version": "1.3.1",
+            "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.1.tgz",
+            "integrity": "sha512-ZZ61DsRsOnakl74HAmp3oSN4aXUmEWXf+i/yv0h7tIBfICc3VdrFErQKUUKPgu3AMsTUMbcongALEN4l6GSUrQ==",
            "funding": [
                {
                    "type": "opencollective",
--- a/commafeed-client/package.json
+++ b/commafeed-client/package.json
@@ -27,7 +27,7 @@
        "@mantine/notifications": "9.5.1",
        "@mantine/spotlight": "9.5.1",
        "@monaco-editor/react": "4.7.0",
-        "@react-querybuilder/mantine": "8.22.3",
+        "@react-querybuilder/mantine": "8.22.5",
        "@reduxjs/toolkit": "2.12.0",
        "@rolldown/plugin-babel": "0.2.3",
        "axios": "1.19.0",
@@ -43,7 +43,7 @@
        "react-draggable": "4.7.1",
        "react-icons": "5.7.0",
        "react-infinite-scroller": "1.2.6",
-        "react-querybuilder": "8.22.3",
+        "react-querybuilder": "8.22.5",
        "react-redux": "9.3.0",
        "react-router-dom": "7.18.2",
        "react-swipeable": "7.0.2",
@@ -55,13 +55,13 @@
    },
    "devDependencies": {
        "@babel/types": "^8.0.4",
-        "@biomejs/biome": "2.5.7",
+        "@biomejs/biome": "2.5.8",
        "@lingui/babel-plugin-lingui-macro": "6.6.0",
        "@lingui/cli": "6.6.0",
        "@lingui/vite-plugin": "6.6.0",
-        "@testing-library/jest-dom": "7.0.0",
+        "@testing-library/jest-dom": "7.0.1",
        "@testing-library/react": "16.3.2",
-        "@testing-library/user-event": "14.6.3",
+        "@testing-library/user-event": "14.6.4",
        "@types/mousetrap": "1.6.15",
        "@types/react": "19.2.18",
        "@types/react-dom": "19.2.4",
--- a/commafeed-client/pom.xml
+++ b/commafeed-client/pom.xml
@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>com.commafeed</groupId>
 		<artifactId>commafeed</artifactId>
-		<version>7.3.0</version>
+		<version>7.3.1</version>
 	</parent>
 	<artifactId>commafeed-client</artifactId>
 	<name>CommaFeed Client</name>
--- a/commafeed-server/pom.xml
+++ b/commafeed-server/pom.xml
@@ -6,14 +6,14 @@
    <parent>
        <groupId>com.commafeed</groupId>
        <artifactId>commafeed</artifactId>
-        <version>7.3.0</version>
+        <version>7.3.1</version>
    </parent>
    <artifactId>commafeed-server</artifactId>
    <name>CommaFeed Server</name>
    <packaging>quarkus</packaging>

    <properties>
-        <quarkus.version>3.38.1</quarkus.version>
+        <quarkus.version>3.38.2</quarkus.version>
        <querydsl.version>7.5</querydsl.version>
        <rome.version>2.1.0</rome.version>
        <!-- renovate: depName=com.google.googlejavaformat:google-java-format -->
@@ -245,7 +245,7 @@
                    <dependency>
                        <groupId>com.puppycrawl.tools</groupId>
                        <artifactId>checkstyle</artifactId>
-                        <version>13.10.0</version>
+                        <version>13.11.0</version>
                    </dependency>
                </dependencies>
                <executions>
@@ -274,7 +274,7 @@
            <plugin>
                <groupId>com.diffplug.spotless</groupId>
                <artifactId>spotless-maven-plugin</artifactId>
-                <version>3.9.0</version>
+                <version>3.10.0</version>
                <?m2e ignore?>
                <executions>
                    <execution>
@@ -302,7 +302,7 @@
        <dependency>
            <groupId>com.commafeed</groupId>
            <artifactId>commafeed-client</artifactId>
-            <version>7.3.0</version>
+            <version>7.3.1</version>
        </dependency>

        <!-- compile-time processors -->
--- a/commafeed-server/src/main/java/com/commafeed/CommaFeedApplication.java
+++ b/commafeed-server/src/main/java/com/commafeed/CommaFeedApplication.java
@@ -41,6 +41,11 @@ public class CommaFeedApplication {
            ImageProxyUrl.generateKey();
        }

+        if (config.passwordRecoveryEnabled() && config.passwordRecoveryPublicBaseUrl().isEmpty()) {
+            throw new IllegalStateException(
+                    "password recovery is enabled but no public base url is set");
+        }
+
        feedRefreshEngine.start();
        taskScheduler.start();
    }
--- a/commafeed-server/src/main/java/com/commafeed/CommaFeedConfiguration.java
+++ b/commafeed-server/src/main/java/com/commafeed/CommaFeedConfiguration.java
@@ -49,6 +49,13 @@ public interface CommaFeedConfiguration {
    @WithDefault("false")
    boolean passwordRecoveryEnabled();

+    /**
+     * The base URL of the application to use in the password recovery link in the email. We can't
+     * use the URL sent by the browser of the user because of malicious Host header injection
+     * attacks.
+     */
+    Optional<String> passwordRecoveryPublicBaseUrl();
+
    /** Message displayed in a notification at the bottom of the page. */
    Optional<String> announcement();

--- a/commafeed-server/src/main/java/com/commafeed/frontend/resource/UserREST.java
+++ b/commafeed-server/src/main/java/com/commafeed/frontend/resource/UserREST.java
@@ -413,7 +413,8 @@ public class UserREST {
    }

    private String buildEmailContent(User user) throws URISyntaxException {
-        String publicUrl = Urls.removeTrailingSlash(uri.getBaseUri().toString());
+        String publicUrl =
+                Urls.removeTrailingSlash(config.passwordRecoveryPublicBaseUrl().orElseThrow());
        return String.format(
                "You asked for password recovery for account '%s', <a href='%s'>follow this link</a> to change your password. Ignore this if you didn't request a password recovery.",
                user.getName(), callbackUrl(user, publicUrl));
--- a/commafeed-server/src/main/resources/application.properties
+++ b/commafeed-server/src/main/resources/application.properties
@@ -52,6 +52,7 @@ quarkus.native.additional-build-args=-H:PageSize=65536
 %test.commafeed.users.create-demo-account=true
 %test.commafeed.users.allow-registrations=true
 %test.commafeed.password-recovery-enabled=true
+%test.commafeed.password-recovery-public-base-url=https://commafeed.example.com
 %test.commafeed.http-client.cache.enabled=false
 %test.commafeed.http-client.block-local-addresses=false
 %test.commafeed.database.cleanup.entries-max-age=0
--- a/commafeed-server/src/test/java/com/commafeed/integration/rest/UserIT.java
+++ b/commafeed-server/src/test/java/com/commafeed/integration/rest/UserIT.java
@@ -52,6 +52,7 @@ class UserIT extends BaseIT {
        RestAssured.given()
                .body(req)
                .contentType(ContentType.JSON)
+                .header("Host", "malicious.url.com")
                .post("rest/user/passwordReset")
                .then()
                .statusCode(200);
@@ -64,6 +65,7 @@ class UserIT extends BaseIT {
        Assertions.assertTrue(
                message.getHtml()
                        .startsWith("You asked for password recovery for account 'admin'"));
+        Assertions.assertTrue(message.getHtml().contains("https://commafeed.example.com"));
        Assertions.assertEquals("admin@commafeed.com", message.getTo().getFirst());

        Element a = Jsoup.parse(message.getHtml()).select("a").getFirst();
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@

 	<groupId>com.commafeed</groupId>
 	<artifactId>commafeed</artifactId>
-	<version>7.3.0</version>
+	<version>7.3.1</version>
 	<name>CommaFeed</name>
 	<packaging>pom</packaging>
Author	SHA1	Message	Date
Athou	2d90ccf856	release 7.3.1	2026-08-17 22:32:32 +02:00
Athou	7f77cf0268	prevent Host header injection attacks	2026-08-17 22:27:46 +02:00
Jérémie Panzer	f3c390e0e0	Merge pull request #2267 from Athou/renovate/com.diffplug.spotless-spotless-maven-plugin-3.x Update dependency com.diffplug.spotless:spotless-maven-plugin to v3.10.0	2026-08-17 08:49:07 +02:00
Jérémie Panzer	1fdc471197	Merge pull request #2266 from Athou/renovate/com.puppycrawl.tools-checkstyle-13.x Update dependency com.puppycrawl.tools:checkstyle to v13.11.0	2026-08-17 07:45:37 +02:00
renovate[bot]	ecf5d9e50e	Update dependency com.diffplug.spotless:spotless-maven-plugin to v3.10.0	2026-08-17 05:44:41 +00:00
renovate[bot]	97a49e8faa	Lock file maintenance	2026-08-17 00:41:26 +00:00
renovate[bot]	f5a020cdc2	Update dependency com.puppycrawl.tools:checkstyle to v13.11.0	2026-08-17 00:40:24 +00:00
renovate[bot]	1f0507ee65	Update dependency @testing-library/user-event to v14.6.4	2026-08-15 01:00:48 +00:00
renovate[bot]	393c90f334	Update react-querybuilder to v8.22.5	2026-08-14 23:10:07 +00:00
renovate[bot]	03ecc2f49b	Update dependency @biomejs/biome to v2.5.8	2026-08-14 09:15:31 +00:00
renovate[bot]	17743adce6	Update quarkus.version to v3.38.2	2026-08-13 17:05:44 +00:00
renovate[bot]	126dde103a	Update dependency @testing-library/jest-dom to v7.0.1	2026-08-13 00:07:02 +00:00
renovate[bot]	14a25581b4	Update react-querybuilder to v8.22.4	2026-08-11 06:18:20 +00:00