release 7.3.1

Update dependency com.diffplug.spotless:spotless-maven-plugin to v3.10.0

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [7.3.1]
+
+- Prevent Host header injection attacks on the password recovery endpoint. A new setting
+  `commafeed.password-recovery-public-base-url` has been added to specify the base URL to use in password recovery
+  emails. This setting is only required when the password recovery feature is enabled, which is not the default.
+
 ## [7.3.0]
 
 - Add support for the Google Reader API for native mobile apps that don't support the Fever API

commafeed-client/biome.json

@@ -1,5 +1,5 @@
 {
-    "$schema": "https://biomejs.dev/schemas/2.5.7/schema.json",
+    "$schema": "https://biomejs.dev/schemas/2.5.8/schema.json",
     "formatter": {
         "indentStyle": "space",
         "indentWidth": 4,

commafeed-client/package-lock.json

@@ -20,7 +20,7 @@
                 "@mantine/notifications": "9.5.1",
                 "@mantine/spotlight": "9.5.1",
                 "@monaco-editor/react": "4.7.0",
-                "@react-querybuilder/mantine": "8.22.3",
+                "@react-querybuilder/mantine": "8.22.5",
                 "@reduxjs/toolkit": "2.12.0",
                 "@rolldown/plugin-babel": "0.2.3",
                 "axios": "1.19.0",
@@ -36,7 +36,7 @@
                 "react-draggable": "4.7.1",
                 "react-icons": "5.7.0",
                 "react-infinite-scroller": "1.2.6",
-                "react-querybuilder": "8.22.3",
+                "react-querybuilder": "8.22.5",
                 "react-redux": "9.3.0",
                 "react-router-dom": "7.18.2",
                 "react-swipeable": "7.0.2",
@@ -48,13 +48,13 @@
             },
             "devDependencies": {
                 "@babel/types": "^8.0.4",
-                "@biomejs/biome": "2.5.7",
+                "@biomejs/biome": "2.5.8",
                 "@lingui/babel-plugin-lingui-macro": "6.6.0",
                 "@lingui/cli": "6.6.0",
                 "@lingui/vite-plugin": "6.6.0",
-                "@testing-library/jest-dom": "7.0.0",
+                "@testing-library/jest-dom": "7.0.1",
                 "@testing-library/react": "16.3.2",
-                "@testing-library/user-event": "14.6.3",
+                "@testing-library/user-event": "14.6.4",
                 "@types/mousetrap": "1.6.15",
                 "@types/react": "19.2.18",
                 "@types/react-dom": "19.2.4",
@@ -592,9 +592,9 @@
             }
         },
         "node_modules/@biomejs/biome": {
-            "version": "2.5.7",
+            "version": "2.5.8",
-            "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.5.7.tgz",
+            "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.5.8.tgz",
-            "integrity": "sha512-zr8K/DcY5tYsQOQwqMJ0AWElo6QgmgNI7idXgXLhevVszlt8RGVpesEJPqx3ThazLaOwjJ5Y8fz3BtH5fGZNsw==",
+            "integrity": "sha512-aeAeeJB9fSDc7Gq+2GqpQxA0qBj6gj1k2R6L1cYqGePKP/baIq1WX8y6B+D+nRsO5ViQL22K/8IwbqERW0q1nw==",
             "dev": true,
             "license": "MIT OR Apache-2.0",
             "bin": {
@@ -608,20 +608,20 @@
                 "url": "https://opencollective.com/biome"
             },
             "optionalDependencies": {
-                "@biomejs/cli-darwin-arm64": "2.5.7",
+                "@biomejs/cli-darwin-arm64": "2.5.8",
-                "@biomejs/cli-darwin-x64": "2.5.7",
+                "@biomejs/cli-darwin-x64": "2.5.8",
-                "@biomejs/cli-linux-arm64": "2.5.7",
+                "@biomejs/cli-linux-arm64": "2.5.8",
-                "@biomejs/cli-linux-arm64-musl": "2.5.7",
+                "@biomejs/cli-linux-arm64-musl": "2.5.8",
-                "@biomejs/cli-linux-x64": "2.5.7",
+                "@biomejs/cli-linux-x64": "2.5.8",
-                "@biomejs/cli-linux-x64-musl": "2.5.7",
+                "@biomejs/cli-linux-x64-musl": "2.5.8",
-                "@biomejs/cli-win32-arm64": "2.5.7",
+                "@biomejs/cli-win32-arm64": "2.5.8",
-                "@biomejs/cli-win32-x64": "2.5.7"
+                "@biomejs/cli-win32-x64": "2.5.8"
             }
         },
         "node_modules/@biomejs/cli-darwin-arm64": {
-            "version": "2.5.7",
+            "version": "2.5.8",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.5.7.tgz",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.5.8.tgz",
-            "integrity": "sha512-vxo/Ls3/PYdQWyLhYYcgMOCzQypAjcY+iihS8M0wW03l16TCLW4zqZzGo75gm1VdCMj38hTVZ31KBWrZ4G9dJw==",
+            "integrity": "sha512-mk1QON9PHllvvLN5gU3f4rMxeh4syK5p9OvKyWH6/W8ueh04uaC8TUXXByhGufWf/y5mQc03ZLM45zU+cmqMjA==",
             "cpu": [
                 "arm64"
             ],
@@ -636,9 +636,9 @@
             }
         },
         "node_modules/@biomejs/cli-darwin-x64": {
-            "version": "2.5.7",
+            "version": "2.5.8",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.5.7.tgz",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.5.8.tgz",
-            "integrity": "sha512-Cd3Ga61amT/Yl/0x8elP5hhGYaFy4bw6WuysTgf7oo8TA5tJ5A1k+DkVoJ2BHbTVil51gTX9VPzArnrlLJ3Kyg==",
+            "integrity": "sha512-bsGwFMBNyHPyiLSsQcZJxdoRrg1V4JL+d7wEsvUBczlP9U9lwM+7mzQHxI4o1mhBsTmdOBbAb6fHU3Z3snN45w==",
             "cpu": [
                 "x64"
             ],
@@ -653,9 +653,9 @@
             }
         },
         "node_modules/@biomejs/cli-linux-arm64": {
-            "version": "2.5.7",
+            "version": "2.5.8",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.5.7.tgz",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.5.8.tgz",
-            "integrity": "sha512-rR2QE0yF2GYSuYuKIa7pKvODGJqnOH+2eDREAM8wV+mWKSkMQKdAp4zXEZfTaxY8PMoNONnpgSWcBCyLDPDOKg==",
+            "integrity": "sha512-XmFiA0WPYFC+uiUDC8WRFzAIH9bo7vwQLav38Uoq4ETC+T/+uBi0TsYGJECkugY3r8USl3jc+Ae2/irAF6F2lQ==",
             "cpu": [
                 "arm64"
             ],
@@ -673,9 +673,9 @@
             }
         },
         "node_modules/@biomejs/cli-linux-arm64-musl": {
-            "version": "2.5.7",
+            "version": "2.5.8",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.5.7.tgz",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.5.8.tgz",
-            "integrity": "sha512-xPI5yB6XlpDbNkS+bm1t42olw5c4l3UrlOmLg7KtLJvjvkNF/1V4tnUgfkylGIeb3u/T+BzMGYqgQhzjAoJzuQ==",
+            "integrity": "sha512-VcJNbstduTHx83NGAdhp78/JOcP45BZHXL7yNsfI1uGzdUgegAz2s+mSoT7wK6PBNzLoqG0zDOXaz/RQYVtSiw==",
             "cpu": [
                 "arm64"
             ],
@@ -693,9 +693,9 @@
             }
         },
         "node_modules/@biomejs/cli-linux-x64": {
-            "version": "2.5.7",
+            "version": "2.5.8",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.5.7.tgz",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.5.8.tgz",
-            "integrity": "sha512-FQgqJhscrqJUFptGaRSUJWlXAExwWcDwLuK49dvKfkQ1bB5SEEyFssnsxQY83Xm6jR0EbbX3+8+D5bfvYqUG2Q==",
+            "integrity": "sha512-S5wcm9OBDvLHodD4PUaN488hCpco9QD/9ZxuYJiw4euWtr/oQvLR72z2ixItH8Wd5BCm6FZaeb+YNvOoM1xHtQ==",
             "cpu": [
                 "x64"
             ],
@@ -713,9 +713,9 @@
             }
         },
         "node_modules/@biomejs/cli-linux-x64-musl": {
-            "version": "2.5.7",
+            "version": "2.5.8",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.5.7.tgz",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.5.8.tgz",
-            "integrity": "sha512-rE5VZi+qtmPgQH+l7jVxYoZ18b/TiHEhulhMpjmCZH1PltSbjRcxNWywC3HZ9tYottG7ORkeTtoscBilKSBm0g==",
+            "integrity": "sha512-kKmiyokeISRGq2FLwvr+TzsgBusfxaZ0FZNLcOYOpCK/78tRrEjeEBLvq3xLZMpqbANgJdRPI7vZX8ZL37u9/w==",
             "cpu": [
                 "x64"
             ],
@@ -733,9 +733,9 @@
             }
         },
         "node_modules/@biomejs/cli-win32-arm64": {
-            "version": "2.5.7",
+            "version": "2.5.8",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.5.7.tgz",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.5.8.tgz",
-            "integrity": "sha512-Oq4x0CCwP4jirrcTywXs5kOGZ4v5vuEP+gWrbtjApOA2CL9F3F9GlIdQIci8AKSCa/zURanMRpX/4wQ7Am6hHg==",
+            "integrity": "sha512-nILH0mzm3Hi3iEdd7o7GpB8kBR/mSQwfQG/tyBqyNrY2GFtcgwfV9nV8xLmbtUpMNY/Oi0Ml1XgfR4flOdq+AA==",
             "cpu": [
                 "arm64"
             ],
@@ -750,9 +750,9 @@
             }
         },
         "node_modules/@biomejs/cli-win32-x64": {
-            "version": "2.5.7",
+            "version": "2.5.8",
-            "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.5.7.tgz",
+            "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.5.8.tgz",
-            "integrity": "sha512-V+0wu/nrj2S+MhP4EQ0uHNolP0IALEsz45pg0WoKkHfDeh0+ItHwP/p7bX5RPoMOl9NkpHYWdYPhIcy2mACHvQ==",
+            "integrity": "sha512-I2czzXTY61f3nFJxXoMDq80t7MivxDEnCjE+8sDKoFfcKMaoQdkqhIFQ3KyY0XLzeSpUBYeNAXgD+iOV/BU0VA==",
             "cpu": [
                 "x64"
             ],
@@ -791,9 +791,9 @@
             }
         },
         "node_modules/@csstools/color-helpers": {
-            "version": "6.1.0",
+            "version": "6.1.1",
-            "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.1.0.tgz",
+            "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.1.1.tgz",
-            "integrity": "sha512-064IFJdjTfUqnjpCVpMOdbr8FLQBhinbZj6yRv2An2E41O/pLEXqfFRWqGq/SxlE5PEUYTlvWsG2r8MswAVvkg==",
+            "integrity": "sha512-gLNsunvwf3mCi5u5o46/Z/JcJMnhbHSaZ69rkgPzNM3J4s8hWwpPUQB6/tt0EDFyCiWzxANlx+2LJwpYj4zS1w==",
             "dev": true,
             "funding": [
                 {
@@ -835,9 +835,9 @@
             }
         },
         "node_modules/@csstools/css-color-parser": {
-            "version": "4.1.10",
+            "version": "4.2.0",
-            "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.1.10.tgz",
+            "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.2.0.tgz",
-            "integrity": "sha512-UZhQLIUyJaaMepqehrCODwCg2KW25vFvLWBmqYFaPclYvvxzj/sG8LBOhBFCp11i9uE7t1EyS+RAoV9tztPFyw==",
+            "integrity": "sha512-5+5LEmFuY1AjXdYhmgjTJogtQnP1evJ1zrBZGUNZ0thkpwnnmKxcHdAMn/OtFjAb25zA+jKDVYVRl+5G7rjv1A==",
             "dev": true,
             "funding": [
                 {
@@ -851,7 +851,7 @@
             ],
             "license": "MIT",
             "dependencies": {
-                "@csstools/color-helpers": "^6.1.0",
+                "@csstools/color-helpers": "^6.1.1",
                 "@csstools/css-calc": "^3.3.0"
             },
             "engines": {
@@ -886,9 +886,9 @@
             }
         },
         "node_modules/@csstools/css-syntax-patches-for-csstree": {
-            "version": "1.1.7",
+            "version": "1.1.8",
-            "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.7.tgz",
+            "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.8.tgz",
-            "integrity": "sha512-fQ+05118eQS1cofO3aJpB5efgpBZMvIzwr/sbC8kDLVA5XLG8q1kJV5yzrUAI1f7lvhPnm8fgIjzFB8/O/5Dig==",
+            "integrity": "sha512-CpMLjAvwQg3BL5S0IeqsZNMH7EQrEWi0kLKOC13ZBF0ZwERiLWlibNPJr8G1kdU3Ms/r2KiNrF81pUh2HwAHdg==",
             "dev": true,
             "funding": [
                 {
@@ -1617,23 +1617,24 @@
             }
         },
         "node_modules/@oxc-project/types": {
-            "version": "0.143.0",
+            "version": "0.144.0",
-            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.143.0.tgz",
+            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.144.0.tgz",
-            "integrity": "sha512-u6JZdLBTLotrNC9Vd6vPssINdzcCzleKAH6EJKImQb7GtYvX5keN2dxkoK44stCc4tffE6QQRtZTXVSzsLUlWA==",
+            "integrity": "sha512-nuhZIOLuI6TFQ32I/WnUx+SCPY7SdSKwgnFHydAuoS1+Z4BRcaP+RRJmGzl9lw+0OFF7UmaESf7KQRXaNLHypg==",
             "license": "MIT",
             "funding": {
                 "url": "https://github.com/sponsors/Boshen"
             }
         },
         "node_modules/@react-querybuilder/core": {
-            "version": "8.22.4",
+            "version": "8.23.0",
-            "resolved": "https://registry.npmjs.org/@react-querybuilder/core/-/core-8.22.4.tgz",
+            "resolved": "https://registry.npmjs.org/@react-querybuilder/core/-/core-8.23.0.tgz",
-            "integrity": "sha512-Av4Eoa31JBsR3HwfAVwqGT2pepRB+En4GMR1ua7umBgMrvyP18uQlvIoV1zhR7WhQ6M8zsPhy6Bybbw1Dt93rg==",
+            "integrity": "sha512-5EHBNwC31K0E4LJE2vea7s7bHnlRnYShH3ceSF4ZMcW5pnfcByfJA6JHymT1bh67l+n7iYq5n2gXtJuCZMLDSw==",
             "license": "MIT",
             "dependencies": {
                 "@ts-jison/lexer": "0.4.1-alpha.1",
                 "@ts-jison/parser": "0.4.1-alpha.1",
-                "immer": "^11.1.15",
+                "@types/json-logic-js": ">=2",
+                "immer": "^11.1.16",
                 "numeric-quantity": "^3.2.2"
             },
             "peerDependencies": {
@@ -1674,9 +1675,9 @@
             }
         },
         "node_modules/@react-querybuilder/mantine": {
-            "version": "8.22.3",
+            "version": "8.22.5",
-            "resolved": "https://registry.npmjs.org/@react-querybuilder/mantine/-/mantine-8.22.3.tgz",
+            "resolved": "https://registry.npmjs.org/@react-querybuilder/mantine/-/mantine-8.22.5.tgz",
-            "integrity": "sha512-ZPOL0myiNt2qxxGBA6+aHl9RFp8js/IUX7Hu87HEsz7KHlWkBqYC9IXD6YGWzm1P8nPnPBWVEwFJHSQbE1wIFQ==",
+            "integrity": "sha512-ciLXWRh6YhFdQQwkS9x0h/z7nxe2thtq3mseTC3/KV2SQBrjBDiBoRVxQe8H2koL0FuasTmdiPU/TqDkqV9Acg==",
             "license": "MIT",
             "peerDependencies": {
                 "@mantine/core": ">=7",
@@ -1684,7 +1685,7 @@
                 "@mantine/hooks": ">=7",
                 "dayjs": ">=1",
                 "react": ">=18",
-                "react-querybuilder": "8.22.3"
+                "react-querybuilder": "8.22.5"
             }
         },
         "node_modules/@reduxjs/toolkit": {
@@ -1714,9 +1715,9 @@
             }
         },
         "node_modules/@rolldown/binding-android-arm64": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.4.tgz",
-            "integrity": "sha512-zrJtHDcaZJ1Fp7xf4hNl+7seH9Cn/N5TwLYkhgXREtBwAd/jaqW3uqeHxpDugJLVICWg4eW44kOQEGJ1r6jCGw==",
+            "integrity": "sha512-jHC2cnyKz5xU2fhECtFl8OZ83cYNt13GZQD+0uMJ/X3o+ijmd56okHhTUwxVSHPx1IRVIJEZ1/1pPzeLCU6XKA==",
             "cpu": [
                 "arm64"
             ],
@@ -1730,9 +1731,9 @@
             }
         },
         "node_modules/@rolldown/binding-darwin-arm64": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.4.tgz",
-            "integrity": "sha512-ieIiibVCp0tX7TLu2cafoNPv8wJyYi01ekXpbf8q2j7F4rGAhhXb/eQh7ge9DRBY78GwmRQtvjZDux7EDbA8kA==",
+            "integrity": "sha512-Dc5mPD8F5F/FS8i01syd7FTF6yB2fVthH/TRkjwJkzUK6EpoxHtqvZQP5Zwq80/5z19TWYHIg1KOHboCgVx/aQ==",
             "cpu": [
                 "arm64"
             ],
@@ -1746,9 +1747,9 @@
             }
         },
         "node_modules/@rolldown/binding-darwin-x64": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.4.tgz",
-            "integrity": "sha512-Zh9tCon19eDXJoihx0rqKhMUlMYqzwj3aPsSuHmI4RWZh62dWUL+DJN4C5YQya5TcQBJU/Fe8+rY0jhXTQITqA==",
+            "integrity": "sha512-fpDm4oBo6SqLvWUYCmFhdde3U9KH2fRNNMeAnAPAIwxRL345xutL0EtEUcuoxsoazdJGv/MuDBQHlCDrtbvqOg==",
             "cpu": [
                 "x64"
             ],
@@ -1762,9 +1763,9 @@
             }
         },
         "node_modules/@rolldown/binding-freebsd-x64": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.4.tgz",
-            "integrity": "sha512-nGbJWewA1wrXXZiQhjAT5rhibGfns5ZNkDVqxsO6zJ3f3YvpoDNNmGMSbbhLuXKjNScaBJVOAboztAWVespQMg==",
+            "integrity": "sha512-rSJoreDE/HoIzoaib6MTp5jQtCTdMHKIvItAKT/ImS6Y6Ww76oUaeMyp4Vc/fAgd/ehji068IxetHXAnqUwN9A==",
             "cpu": [
                 "x64"
             ],
@@ -1778,9 +1779,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.4.tgz",
-            "integrity": "sha512-QNniJr5Kml0kDEB98jiDOJjXNroxIIi0IXIbdYzY26Xt1pVbeP62+KnoIZLwirOymX/0jDk/2gI/bNUv7A7OIw==",
+            "integrity": "sha512-/jm8OGHgn7oGaJu3i/qZI9spUGcJ+y/lk43ttQ/iO1tOd9NissG6o97bighBCiL+BKRngmcDuR6ikfwYdJmVuQ==",
             "cpu": [
                 "arm"
             ],
@@ -1794,9 +1795,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-arm64-gnu": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.4.tgz",
-            "integrity": "sha512-TkqEAcmmvH3I/q4114NB4RVt6241Dao48pF45uLcFGrwAaIn0iITgTAKP/dLjbN0R4buJjGb91+UHSoFmpgIWw==",
+            "integrity": "sha512-tIP06BeD9EqvECBrPZ+sqdPlYrT+aYaAiu1wYziVx5elRK/ftm33JxVDy2bXGbr6J0CrtirCkR87/X5a2euEng==",
             "cpu": [
                 "arm64"
             ],
@@ -1813,9 +1814,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-arm64-musl": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.4.tgz",
-            "integrity": "sha512-NHqjnxpsndf4MPymxteFAWHHfkTL8HjWh1KB7z23ofZ6QO2euONuxDXjat69dKZRALnGypg8k8SsK8vZJoXv1Q==",
+            "integrity": "sha512-Ql1Q0EQqVThvn9VAVlwNzsUvbSFtCMGjLpRRi4pk5i7NZZ4n5ISiLMjHYtus4VQ2PvkSw24zyaCVsiS+sXPj1w==",
             "cpu": [
                 "arm64"
             ],
@@ -1832,9 +1833,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.4.tgz",
-            "integrity": "sha512-6tbrbwfz5GB9DQ4Jwo6hy9v+vR31xZlvzZ6n5Xut6Hhx5PvrA9q/HsK8KMaYQp063iqZGXwNvZtYNLD7EM/x0w==",
+            "integrity": "sha512-GjbjXD4XXfN19D0LZNbmiCBUoDiRACsYHr0yaIbbn8aFsXjHZifcYqu/W5Er5X2X990WjHXFrxarn5chzItorQ==",
             "cpu": [
                 "ppc64"
             ],
@@ -1851,9 +1852,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-s390x-gnu": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.4.tgz",
-            "integrity": "sha512-oyuXxXmoZHjXC917IAPFAAv4wWAa0cM9afk8nx1+9/jNNOX1uPf8yDA6p7G0RypOfw/X0PQt5IfoquY1um+zSg==",
+            "integrity": "sha512-p5WR0NOwaRmJ/B1b6IjEFLLivwEsf3PrdBIhRbhTCQisbo2SvHHpG4ELB/+FgQNnB88LTOF86upmJmbvZdQ2lw==",
             "cpu": [
                 "s390x"
             ],
@@ -1870,9 +1871,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-x64-gnu": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.4.tgz",
-            "integrity": "sha512-TytMwF2KVGqP2tgd0I1OY0PAv78dZRAYcF5ssDzjM34SUXCED3uXvSd5+lHoC0bTD6eEdFz7LdQNCO1y0oVk9w==",
+            "integrity": "sha512-4/GyVjmhR+Tc6HLJvwc1sOhPqAZtySiSMesOZyX6JQ5XBxoTDEMKQzvo07NIK6nTon/SivlZqvhzvuVBNQhObQ==",
             "cpu": [
                 "x64"
             ],
@@ -1889,9 +1890,9 @@
             }
         },
         "node_modules/@rolldown/binding-linux-x64-musl": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.4.tgz",
-            "integrity": "sha512-/E9m3qstrJFVPoULV25mVQblSNExY2+kBsYe4sy0Tn0yOOgJ8wZbZt3KnRbF/XeU2Gl1STKUQnDNTqhIE5MD4A==",
+            "integrity": "sha512-l9eeLsCNvPpmSXUej0etw/J1eqV0Jj1D5G/xG6YTijmE6dkv6E2QezgWbTfQk63v952DPqrjOCoiqxq7Bw0YUQ==",
             "cpu": [
                 "x64"
             ],
@@ -1908,9 +1909,9 @@
             }
         },
         "node_modules/@rolldown/binding-openharmony-arm64": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.4.tgz",
-            "integrity": "sha512-Kr0OcsoQI816i6HOl3vFHpd1K0eZyh76zgfj4c1nTyaTsd5r2Mj1lwM4R90y/qaCfmTn9eHy0SKwi98eitRxug==",
+            "integrity": "sha512-e0F355MSTMm3+UOqtV3L24gFUp2N5m1f8L/7d56deik6va+AXdrt9F8LbzGpeWGWRbZEDq4m8NVnJDeBtf9DZg==",
             "cpu": [
                 "arm64"
             ],
@@ -1924,9 +1925,9 @@
             }
         },
         "node_modules/@rolldown/binding-win32-arm64-msvc": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.4.tgz",
-            "integrity": "sha512-hOtMwTqnME+/gJcH/PCZ0wn0zPUjiWOgkHpxbSJpfGKMezHltx1S7/k1SitzVa7Ww2cqrDDaFbZEhcJZO8o+Jw==",
+            "integrity": "sha512-AWLi0uBRYh6QlE7OKhiz+phZC0qwtij2QZmhmOdsLdFn64m7oMpooE9ICE3lhm9xMb4SpDo2WbHcxX1iFLFtqw==",
             "cpu": [
                 "arm64"
             ],
@@ -1940,9 +1941,9 @@
             }
         },
         "node_modules/@rolldown/binding-win32-x64-msvc": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.4.tgz",
-            "integrity": "sha512-ekcqMMkI2PlhYnfzQnB/cEdYUVVJViWvoUyLrbzgDoi3Snfc1mVBwdnc306ufA5ejy8JSPjT2RlW1nQSjW7efg==",
+            "integrity": "sha512-UwSDJOg3dqCAejWdxclJjCsh3Qq4vLYMDxmyHqo1btz3stK2VqgwNd3mm5tuIwzSlGIQ/1H9Hr+Zn09mrezNqQ==",
             "cpu": [
                 "x64"
             ],
@@ -2031,9 +2032,9 @@
             }
         },
         "node_modules/@testing-library/jest-dom": {
-            "version": "7.0.0",
+            "version": "7.0.1",
-            "resolved": "https://registry.npmjs.org/@testing-library/jest-dom/-/jest-dom-7.0.0.tgz",
+            "resolved": "https://registry.npmjs.org/@testing-library/jest-dom/-/jest-dom-7.0.1.tgz",
-            "integrity": "sha512-HKAH9C6mBo5yBG6yRO5i43L2iisencAo5z+o5P/saHUoY+miC5ivXRxHBJcFyB5ypPNxHJdK3BoF/3O4DIptMg==",
+            "integrity": "sha512-oMDTC3oA+6CXSO2JZnvOI7CA6oVub6kij5ggk9ohwye5slmkwxYDXcPOVxgMw/RQlticjtO0C1RZkR97HgrWMw==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
@@ -2050,7 +2051,13 @@
                 "yarn": ">=1"
             },
             "peerDependencies": {
-                "@testing-library/dom": ">=10 <11"
+                "@testing-library/dom": ">=10 <11",
+                "vitest": ">= 0.32"
+            },
+            "peerDependenciesMeta": {
+                "vitest": {
+                    "optional": true
+                }
             }
         },
         "node_modules/@testing-library/jest-dom/node_modules/dom-accessibility-api": {
@@ -2089,9 +2096,9 @@
             }
         },
         "node_modules/@testing-library/user-event": {
-            "version": "14.6.3",
+            "version": "14.6.4",
-            "resolved": "https://registry.npmjs.org/@testing-library/user-event/-/user-event-14.6.3.tgz",
+            "resolved": "https://registry.npmjs.org/@testing-library/user-event/-/user-event-14.6.4.tgz",
-            "integrity": "sha512-6dBq67jT8lE+JTE8Exm02Kt6ze43hz1jdiSpSJwtTZiT1xQQ6b7nZYTTQ9njdArdU8XklOwaDp/AbT/eYSKF4g==",
+            "integrity": "sha512-QCGwP6QrjypBLwyj5cuyfVamkaIEy/XGY+1VDehbtbQqOggYmTFpFOdWR5mPz14vX8vXLMVjDHlRNBcClyO9ew==",
             "dev": true,
             "license": "MIT",
             "engines": {
@@ -2184,6 +2191,12 @@
                 "@types/istanbul-lib-report": "*"
             }
         },
+        "node_modules/@types/json-logic-js": {
+            "version": "2.0.8",
+            "resolved": "https://registry.npmjs.org/@types/json-logic-js/-/json-logic-js-2.0.8.tgz",
+            "integrity": "sha512-WgNsDPuTPKYXl0Jh0IfoCoJoAGGYZt5qzpmjuLSEg7r0cKp/kWtWp0HAsVepyPSPyXiHo6uXp/B/kW/2J1fa2Q==",
+            "license": "MIT"
+        },
         "node_modules/@types/mousetrap": {
             "version": "1.6.15",
             "resolved": "https://registry.npmjs.org/@types/mousetrap/-/mousetrap-1.6.15.tgz",
@@ -2891,9 +2904,9 @@
             }
         },
         "node_modules/baseline-browser-mapping": {
-            "version": "2.11.13",
+            "version": "2.11.14",
-            "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.13.tgz",
+            "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.14.tgz",
-            "integrity": "sha512-k9HNuUVMlqVjQ9UHzfPjIqiDbWw7WqT1AoT7GL8VwvF3r0ZfArtgiSPAlmupyNquNgOJHTuH4CKYf8ttMTWBTQ==",
+            "integrity": "sha512-JyJ954WzuIR8/FFzX0o5krdSTrBAkcCSRfWSleRsIHSWV+cZe2FI1PKggVkFke1hBldRs+LRxUczzE9iPmgZww==",
             "license": "Apache-2.0",
             "bin": {
                 "baseline-browser-mapping": "dist/cli.cjs"
@@ -3355,9 +3368,9 @@
             }
         },
         "node_modules/electron-to-chromium": {
-            "version": "1.5.403",
+            "version": "1.5.407",
-            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.403.tgz",
+            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.407.tgz",
-            "integrity": "sha512-MQsYmdaLzvaCX5j+ZZBr5Fm6uCCnPQcRtlvmvRlWqrXy+BH2O4ffXIAScF+JQznQWB9brWp4lSD9Z4yNmaf2BA==",
+            "integrity": "sha512-4R8XgQOdfxexCd/u63lRm6wCHjECwI45MV9wxAs2ggtfWe2hwlo1ql97jKsju2IcJ+jFSTwBssyYoiWhh7mauQ==",
             "license": "ISC"
         },
         "node_modules/emoji-regex": {
@@ -3761,9 +3774,9 @@
             }
         },
         "node_modules/immer": {
-            "version": "11.1.16",
+            "version": "11.1.17",
-            "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.16.tgz",
+            "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.17.tgz",
-            "integrity": "sha512-Xs7H9rBc+kti1J6RueUvbEBkmOz7jqj11XYgf+YMXAYzu8EeE7hwZ9poLXdVfVnGmJu7QAf41T7H2KuF6QoK6Q==",
+            "integrity": "sha512-8Vu44Y0MuMBlTQz/jQ8HEMYNq/bBqk87MnBwYR5mC8AthfhEXidZ5aT/oA/CUqboa8THKltnD9L3xyqhU/Sy1Q==",
             "license": "MIT",
             "funding": {
                 "type": "opencollective",
@@ -4653,9 +4666,9 @@
             }
         },
         "node_modules/ora/node_modules/ansi-regex": {
-            "version": "6.2.2",
+            "version": "6.3.0",
-            "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
+            "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.3.0.tgz",
-            "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
+            "integrity": "sha512-WpDfL7NO6j7tH88IDBNVdUJxDh9nmCteAVW9dsep846XdwF4naCBK+/tGLX3KJgcpgMRXCFlTM2hKGoK9FsdrQ==",
             "dev": true,
             "license": "MIT",
             "engines": {
@@ -5067,12 +5080,12 @@
             }
         },
         "node_modules/react-querybuilder": {
-            "version": "8.22.3",
+            "version": "8.22.5",
-            "resolved": "https://registry.npmjs.org/react-querybuilder/-/react-querybuilder-8.22.3.tgz",
+            "resolved": "https://registry.npmjs.org/react-querybuilder/-/react-querybuilder-8.22.5.tgz",
-            "integrity": "sha512-mSnCxTOUkWBVnQ2hxAZbS/jJHHOrzPgIw89yZpERysuQZc8jG6THraWguUilUAX84MiAyW3Zt3GOuUvw4LNvYw==",
+            "integrity": "sha512-UyLmmxB0fp9O54pexYW/fV3skQaQT7rW1wM3LzIEbnzStvXiCj8dEQDYqwOspwDajCOScYyFBVn6tMC05OpYTg==",
             "license": "MIT",
             "dependencies": {
-                "@react-querybuilder/core": "^8.22.3",
+                "@react-querybuilder/core": "^8.22.5",
                 "@reduxjs/toolkit": "^2.12.0",
                 "react-redux": "^9.3.0"
             },
@@ -5352,12 +5365,12 @@
             }
         },
         "node_modules/rolldown": {
-            "version": "1.2.3",
+            "version": "1.2.4",
-            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.3.tgz",
+            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.4.tgz",
-            "integrity": "sha512-rn9wpmxplLf7NLNyCk9FyWh3FM43DbY8jOzCdEPzH7uflhTftRbCEpqi6Ly2osgoU8OwObtmavMbWLaWy4LX7A==",
+            "integrity": "sha512-rSr7irW0K7QRWzjdJXqZowkcRdDtjRduh43rBltnVKd0VFq839l1lJoDvGJb6gl7+4rTTCrPWu+YfujUL8Ug7w==",
             "license": "MIT",
             "dependencies": {
-                "@oxc-project/types": "=0.143.0",
+                "@oxc-project/types": "=0.144.0",
                 "@rolldown/pluginutils": "^1.0.0"
             },
             "bin": {
@@ -5367,20 +5380,20 @@
                 "node": "^20.19.0 || >=22.12.0"
             },
             "optionalDependencies": {
-                "@rolldown/binding-android-arm64": "1.2.3",
+                "@rolldown/binding-android-arm64": "1.2.4",
-                "@rolldown/binding-darwin-arm64": "1.2.3",
+                "@rolldown/binding-darwin-arm64": "1.2.4",
-                "@rolldown/binding-darwin-x64": "1.2.3",
+                "@rolldown/binding-darwin-x64": "1.2.4",
-                "@rolldown/binding-freebsd-x64": "1.2.3",
+                "@rolldown/binding-freebsd-x64": "1.2.4",
-                "@rolldown/binding-linux-arm-gnueabihf": "1.2.3",
+                "@rolldown/binding-linux-arm-gnueabihf": "1.2.4",
-                "@rolldown/binding-linux-arm64-gnu": "1.2.3",
+                "@rolldown/binding-linux-arm64-gnu": "1.2.4",
-                "@rolldown/binding-linux-arm64-musl": "1.2.3",
+                "@rolldown/binding-linux-arm64-musl": "1.2.4",
-                "@rolldown/binding-linux-ppc64-gnu": "1.2.3",
+                "@rolldown/binding-linux-ppc64-gnu": "1.2.4",
-                "@rolldown/binding-linux-s390x-gnu": "1.2.3",
+                "@rolldown/binding-linux-s390x-gnu": "1.2.4",
-                "@rolldown/binding-linux-x64-gnu": "1.2.3",
+                "@rolldown/binding-linux-x64-gnu": "1.2.4",
-                "@rolldown/binding-linux-x64-musl": "1.2.3",
+                "@rolldown/binding-linux-x64-musl": "1.2.4",
-                "@rolldown/binding-openharmony-arm64": "1.2.3",
+                "@rolldown/binding-openharmony-arm64": "1.2.4",
-                "@rolldown/binding-win32-arm64-msvc": "1.2.3",
+                "@rolldown/binding-win32-arm64-msvc": "1.2.4",
-                "@rolldown/binding-win32-x64-msvc": "1.2.3"
+                "@rolldown/binding-win32-x64-msvc": "1.2.4"
             }
         },
         "node_modules/saxes": {
@@ -5841,9 +5854,9 @@
             }
         },
         "node_modules/update-browserslist-db": {
-            "version": "1.3.0",
+            "version": "1.3.1",
-            "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.0.tgz",
+            "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.1.tgz",
-            "integrity": "sha512-x/M6q3w4Ybp91CNaS4S69UnliqR3BzRpOT6LWbksjth0S/+jhfaPJsWjt/TewpT8j9eLIojUf5jr29WextHroA==",
+            "integrity": "sha512-ZZ61DsRsOnakl74HAmp3oSN4aXUmEWXf+i/yv0h7tIBfICc3VdrFErQKUUKPgu3AMsTUMbcongALEN4l6GSUrQ==",
             "funding": [
                 {
                     "type": "opencollective",

commafeed-client/package.json

@@ -27,7 +27,7 @@
         "@mantine/notifications": "9.5.1",
         "@mantine/spotlight": "9.5.1",
         "@monaco-editor/react": "4.7.0",
-        "@react-querybuilder/mantine": "8.22.3",
+        "@react-querybuilder/mantine": "8.22.5",
         "@reduxjs/toolkit": "2.12.0",
         "@rolldown/plugin-babel": "0.2.3",
         "axios": "1.19.0",
@@ -43,7 +43,7 @@
         "react-draggable": "4.7.1",
         "react-icons": "5.7.0",
         "react-infinite-scroller": "1.2.6",
-        "react-querybuilder": "8.22.3",
+        "react-querybuilder": "8.22.5",
         "react-redux": "9.3.0",
         "react-router-dom": "7.18.2",
         "react-swipeable": "7.0.2",
@@ -55,13 +55,13 @@
     },
     "devDependencies": {
         "@babel/types": "^8.0.4",
-        "@biomejs/biome": "2.5.7",
+        "@biomejs/biome": "2.5.8",
         "@lingui/babel-plugin-lingui-macro": "6.6.0",
         "@lingui/cli": "6.6.0",
         "@lingui/vite-plugin": "6.6.0",
-        "@testing-library/jest-dom": "7.0.0",
+        "@testing-library/jest-dom": "7.0.1",
         "@testing-library/react": "16.3.2",
-        "@testing-library/user-event": "14.6.3",
+        "@testing-library/user-event": "14.6.4",
         "@types/mousetrap": "1.6.15",
         "@types/react": "19.2.18",
         "@types/react-dom": "19.2.4",

commafeed-client/pom.xml

@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>com.commafeed</groupId>
 		<artifactId>commafeed</artifactId>
-		<version>7.3.0</version>
+		<version>7.3.1</version>
 	</parent>
 	<artifactId>commafeed-client</artifactId>
 	<name>CommaFeed Client</name>

commafeed-server/pom.xml

@@ -6,14 +6,14 @@
     <parent>
         <groupId>com.commafeed</groupId>
         <artifactId>commafeed</artifactId>
-        <version>7.3.0</version>
+        <version>7.3.1</version>
     </parent>
     <artifactId>commafeed-server</artifactId>
     <name>CommaFeed Server</name>
     <packaging>quarkus</packaging>
 
     <properties>
-        <quarkus.version>3.38.1</quarkus.version>
+        <quarkus.version>3.38.2</quarkus.version>
         <querydsl.version>7.5</querydsl.version>
         <rome.version>2.1.0</rome.version>
         <!-- renovate: depName=com.google.googlejavaformat:google-java-format -->
@@ -245,7 +245,7 @@
                     <dependency>
                         <groupId>com.puppycrawl.tools</groupId>
                         <artifactId>checkstyle</artifactId>
-                        <version>13.10.0</version>
+                        <version>13.11.0</version>
                     </dependency>
                 </dependencies>
                 <executions>
@@ -274,7 +274,7 @@
             <plugin>
                 <groupId>com.diffplug.spotless</groupId>
                 <artifactId>spotless-maven-plugin</artifactId>
-                <version>3.9.0</version>
+                <version>3.10.0</version>
                 <?m2e ignore?>
                 <executions>
                     <execution>
@@ -302,7 +302,7 @@
         <dependency>
             <groupId>com.commafeed</groupId>
             <artifactId>commafeed-client</artifactId>
-            <version>7.3.0</version>
+            <version>7.3.1</version>
         </dependency>
 
         <!-- compile-time processors -->

commafeed-server/src/main/java/com/commafeed/CommaFeedApplication.java

@@ -41,6 +41,11 @@ public class CommaFeedApplication {
             ImageProxyUrl.generateKey();
         }
 
+        if (config.passwordRecoveryEnabled() && config.passwordRecoveryPublicBaseUrl().isEmpty()) {
+            throw new IllegalStateException(
+                    "password recovery is enabled but no public base url is set");
+        }
+
         feedRefreshEngine.start();
         taskScheduler.start();
     }

commafeed-server/src/main/java/com/commafeed/CommaFeedConfiguration.java

@@ -49,6 +49,13 @@ public interface CommaFeedConfiguration {
     @WithDefault("false")
     boolean passwordRecoveryEnabled();
 
+    /**
+     * The base URL of the application to use in the password recovery link in the email. We can't
+     * use the URL sent by the browser of the user because of malicious Host header injection
+     * attacks.
+     */
+    Optional<String> passwordRecoveryPublicBaseUrl();
+
     /** Message displayed in a notification at the bottom of the page. */
     Optional<String> announcement();
 

commafeed-server/src/main/java/com/commafeed/frontend/resource/UserREST.java

@@ -413,7 +413,8 @@ public class UserREST {
     }
 
     private String buildEmailContent(User user) throws URISyntaxException {
-        String publicUrl = Urls.removeTrailingSlash(uri.getBaseUri().toString());
+        String publicUrl =
+                Urls.removeTrailingSlash(config.passwordRecoveryPublicBaseUrl().orElseThrow());
         return String.format(
                 "You asked for password recovery for account '%s', <a href='%s'>follow this link</a> to change your password. Ignore this if you didn't request a password recovery.",
                 user.getName(), callbackUrl(user, publicUrl));

commafeed-server/src/main/resources/application.properties

@@ -52,6 +52,7 @@ quarkus.native.additional-build-args=-H:PageSize=65536
 %test.commafeed.users.create-demo-account=true
 %test.commafeed.users.allow-registrations=true
 %test.commafeed.password-recovery-enabled=true
+%test.commafeed.password-recovery-public-base-url=https://commafeed.example.com
 %test.commafeed.http-client.cache.enabled=false
 %test.commafeed.http-client.block-local-addresses=false
 %test.commafeed.database.cleanup.entries-max-age=0

commafeed-server/src/test/java/com/commafeed/integration/rest/UserIT.java

@@ -52,6 +52,7 @@ class UserIT extends BaseIT {
         RestAssured.given()
                 .body(req)
                 .contentType(ContentType.JSON)
+                .header("Host", "malicious.url.com")
                 .post("rest/user/passwordReset")
                 .then()
                 .statusCode(200);
@@ -64,6 +65,7 @@ class UserIT extends BaseIT {
         Assertions.assertTrue(
                 message.getHtml()
                         .startsWith("You asked for password recovery for account 'admin'"));
+        Assertions.assertTrue(message.getHtml().contains("https://commafeed.example.com"));
         Assertions.assertEquals("admin@commafeed.com", message.getTo().getFirst());
 
         Element a = Jsoup.parse(message.getHtml()).select("a").getFirst();

pom.xml

@@ -5,7 +5,7 @@
 
 	<groupId>com.commafeed</groupId>
 	<artifactId>commafeed</artifactId>
-	<version>7.3.0</version>
+	<version>7.3.1</version>
 	<name>CommaFeed</name>
 	<packaging>pom</packaging>