block NAT64 local-use prefix in SSRF protection

escape username in password recovery email
invalidate existing sessions on password change
2026-11-02 18:34:48 +00:00 · 2026-11-02 13:09:31 +01:00 · 2026-11-02 12:34:14 +01:00 · 2026-11-02 12:17:45 +01:00 · 2026-11-02 00:55:45 +00:00
19 changed files with 568 additions and 165 deletions
--- a/commafeed-client/package-lock.json
+++ b/commafeed-client/package-lock.json
@@ -163,13 +163,13 @@
            }
        },
        "node_modules/@babel/generator": {
-            "version": "7.29.8",
-            "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz",
-            "integrity": "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==",
+            "version": "7.29.12",
+            "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.12.tgz",
+            "integrity": "sha512-2W76mhjrpQFO1lK5e8IvGYB2D0YZ7S2R1Z2BjO2ZUYuW+amcpK/z60U6ZZmzskwoa7sJ6XohP/Wg8H5KxXI/IA==",
            "license": "MIT",
            "dependencies": {
-                "@babel/parser": "^7.29.8",
-                "@babel/types": "^7.29.8",
+                "@babel/parser": "^7.29.12",
+                "@babel/types": "^7.29.11",
                "@jridgewell/gen-mapping": "^0.3.12",
                "@jridgewell/trace-mapping": "^0.3.28",
                "jsesc": "^3.0.2"
@@ -283,9 +283,9 @@
            }
        },
        "node_modules/@babel/parser": {
-            "version": "7.29.11",
-            "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.11.tgz",
-            "integrity": "sha512-OZ6+oaK7GMyg3IfCpj8JOmn8n+w2rJbDT0LLfVDTLb1ZFeKDh3AiNELgCMUw175IJHSkLl74hG0M0VLsvx+gag==",
+            "version": "7.29.12",
+            "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.12.tgz",
+            "integrity": "sha512-WJ7JBp/Q4+z/ImydtI7jS6NVco5++632ExBemSX+Ysb+G1lCwQ5BVo3SY+jGGOcZXI4ZccbZSUSJLNBW6eEpJg==",
            "license": "MIT",
            "dependencies": {
                "@babel/types": "^7.29.11"
@@ -321,17 +321,17 @@
            }
        },
        "node_modules/@babel/traverse": {
-            "version": "7.29.10",
-            "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.10.tgz",
-            "integrity": "sha512-B3lYAs2nkKskbgQ1nfy8Ma9ao9Q1rntTAQHrzzyDuj+TSO+X3le6PfWwqDvodsb+OumE10eMFfuMCTQSQ5iuIQ==",
+            "version": "7.29.12",
+            "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.12.tgz",
+            "integrity": "sha512-MscXe/NAZcOkYEsRajHZFt3ynsb22PUi6CTrp5U7+RYycR9By84mn9mFN54YgfITiqK4hFx3Ju3tZSyzfpS5ew==",
            "license": "MIT",
            "dependencies": {
                "@babel/code-frame": "^7.29.7",
-                "@babel/generator": "^7.29.8",
+                "@babel/generator": "^7.29.12",
                "@babel/helper-globals": "^7.29.7",
-                "@babel/parser": "^7.29.9",
+                "@babel/parser": "^7.29.12",
                "@babel/template": "^7.29.7",
-                "@babel/types": "^7.29.8",
+                "@babel/types": "^7.29.11",
                "debug": "^4.3.1"
            },
            "engines": {
@@ -631,9 +631,9 @@
            }
        },
        "node_modules/@csstools/css-color-parser": {
-            "version": "4.2.6",
-            "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.2.6.tgz",
-            "integrity": "sha512-iiPQ3iRWwnJkeEn6RIu6SJPr7hYrLz6XZ9s/QZl+2/LI5KQVjpl2fdmDSZKuD4xP6GMmMPgHFFXg6k1Wkz0Trg==",
+            "version": "4.2.7",
+            "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.2.7.tgz",
+            "integrity": "sha512-zgm9yjQz5iJB4VL8RyVwd71TWB8Q89FSxt/NzXoWqPSkEBOVtn9L6vAPtSc9hpKfB0Awo/AL2VKFHjYetBLFHQ==",
            "dev": true,
            "funding": [
                {
@@ -682,9 +682,9 @@
            }
        },
        "node_modules/@csstools/css-syntax-patches-for-csstree": {
-            "version": "1.1.15",
-            "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.15.tgz",
-            "integrity": "sha512-J0u7HkVl2nzSlhsiTOp4AmwcUQ3D+mGEEKfBy/7To5/y7F2OHwyLrXfrhR0SMgr4p5Lo+eaMVSeai24zUcBIxA==",
+            "version": "1.1.16",
+            "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.16.tgz",
+            "integrity": "sha512-LsDbJPP/B8cPasUJyTA5S99F7C4G93ngW8hUluXz8CFeOaaRnBPtBiIlvgcPYU0HmHNz8CXg+1vwFrIB4F6Dgw==",
            "dev": true,
            "funding": [
                {
@@ -1581,9 +1581,9 @@
            }
        },
        "node_modules/@oxc-project/types": {
-            "version": "0.155.0",
-            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.155.0.tgz",
-            "integrity": "sha512-SeE8JPwW1xs1tHeNycjUtUBdhorRa8o4jlvjwk49R7/Z291i+4DQa7JJIgOm/TaYQZx+QrPQbVJ/9c8dMIZN8Q==",
+            "version": "0.156.0",
+            "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.156.0.tgz",
+            "integrity": "sha512-1Duyg48TdJNdyhEB8Xn1L36bT9Pv6GUtlKjHxOys8xkaF/rQq3XJE+bAurSK/AgIz5mGFsb77cn9Pb20+WCScw==",
            "license": "MIT",
            "funding": {
                "url": "https://github.com/sponsors/oxc-project"
@@ -1679,9 +1679,9 @@
            }
        },
        "node_modules/@rolldown/binding-android-arm-eabi": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.15.tgz",
-            "integrity": "sha512-aLcgK9gIJ3YRvrrtfSBbRa27F5WrpiTaPulnFpsHPxpUHgFlSgnU4854MHwoRGEBhfRJDWCS2WQ7lIjskE9Olw==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.16.tgz",
+            "integrity": "sha512-ia3DwAs0OsMGS7+IConptSiyk9pEXkOx/AbJ2n/lAGxH3QkWQus1t8d7gnAT38FCU2sQu8lUbeR6AiZFv4JxaA==",
            "cpu": [
                "arm"
            ],
@@ -1695,9 +1695,9 @@
            }
        },
        "node_modules/@rolldown/binding-android-arm64": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.15.tgz",
-            "integrity": "sha512-xD7DdZCrbThKuxNg7ooQmvp07ys4J/pnSEMTG3/OdOWl6daC67m/Q4fL78sRHMxTH/N4fGUbYhcPM0MF5WFHkg==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.16.tgz",
+            "integrity": "sha512-kx5wBiMB6E7TEvpl2B9gjLU004BkvEm2Dr941BFjx/SontPwSzNuQUIoVKxHHoSjpFIfHMmcguyLOtyn0hObRg==",
            "cpu": [
                "arm64"
            ],
@@ -1711,9 +1711,9 @@
            }
        },
        "node_modules/@rolldown/binding-darwin-arm64": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.15.tgz",
-            "integrity": "sha512-m2WuQ6r0B4OTYxyPpNLtXaMRbRDUbG8YQV2Q3KTdSSK8Th6KHCnC8jVCJt8bvYeSB5WivkkNbc85mKadaSdOxA==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.16.tgz",
+            "integrity": "sha512-qslZrXnKJU4cUpjoAmtAo/KQM9e2IRMlmpig6Zpwj+8KWxW8v+nkAf9216Bsek9lOC1jvg2yCjygCFo2f83msQ==",
            "cpu": [
                "arm64"
            ],
@@ -1727,9 +1727,9 @@
            }
        },
        "node_modules/@rolldown/binding-darwin-x64": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.15.tgz",
-            "integrity": "sha512-5RtnsHM36nodM9WbMy+zip0LGS/G+y5wro5RHrpOlr4ac24+1zSi9kiV2MP1myZeZ/ifEHfulQcWjnAXzc2C2A==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.16.tgz",
+            "integrity": "sha512-FdF+y48ND13eAyM2mQn+85kvAqNlvRWROy2rhgA463X/0Gv4vGtazZtfaF1mRBLscYvtOlh4QnLjOWiFzX69OQ==",
            "cpu": [
                "x64"
            ],
@@ -1743,9 +1743,9 @@
            }
        },
        "node_modules/@rolldown/binding-freebsd-x64": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.15.tgz",
-            "integrity": "sha512-g3l09pyFqhu+135JKkbkwiKGQmwU5hUMUPJ4VdBADvuqR8d33L6H578rh8m7rtxbdp+VmX/+nzI7nvhSZlzpUQ==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.16.tgz",
+            "integrity": "sha512-ddjqFM5e95AgLbUPtKIS7V1KTVlA0RUgCVr5mn+/IEhsdy3pr+Vuj/HZ7nlMN2FyxIwUktOH1LEPIQXO1v9y1Q==",
            "cpu": [
                "x64"
            ],
@@ -1759,9 +1759,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.15.tgz",
-            "integrity": "sha512-nIe3VugI97nGQtspPxDqA4sXMUpeiocKIP/CqpY/u/vgbT+alX+cVxu1C/oVBPKg4feNTmYovE91v4DgXvXNwQ==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.16.tgz",
+            "integrity": "sha512-tHdKWbFkFBI687iim3LIyIvyL7j66VvQYkDPss5Stn/qyE2tWkR1YD0dXmXPFKKqT/o5ZEJVsaRsWS2meQwGOA==",
            "cpu": [
                "arm"
            ],
@@ -1775,9 +1775,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm64-gnu": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.15.tgz",
-            "integrity": "sha512-iTBjXx+B5QSvgI89lJfmqh4wTh8NabR1YZIIN3hNx4zSG0EVfVqkOvLulNpG4251pbd6/IAmZ/LefVk1Y4rPhw==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.16.tgz",
+            "integrity": "sha512-FJiLGAblPBMlBEdbOqw6kW6QcXDWAf/oJu7gYs9ZJZwmg+K+/zjFLxPTIY9izJUzxzc24FHvmseyA0IvJSl17w==",
            "cpu": [
                "arm64"
            ],
@@ -1794,9 +1794,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-arm64-musl": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.15.tgz",
-            "integrity": "sha512-uN26XOnVR7rqQupG3V9oAG2EGGatWjcJHOeDOHUFCh4TBWmP2tHTFoVN13aYbwfm0aHqJAEmcwhAu6sooIjfqQ==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.16.tgz",
+            "integrity": "sha512-hrJpblMsrQ58U9veWpbXzkhV5zStunds6HWLprqq1qauvgBr1E6P+24kLj6lSLI9vjRn/RYpjprhkHQPKGWpNg==",
            "cpu": [
                "arm64"
            ],
@@ -1813,9 +1813,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.15.tgz",
-            "integrity": "sha512-9nWkcdd+H+XhaA3fQIwpHnKIrfx/PQ6rO0pivr78Og07tXlUlctBBJoEYLPfhTmCR/QxEVdn6uPjHV5SymPhdw==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.16.tgz",
+            "integrity": "sha512-qJd/dC6j6CwLG9/s/RP2nb1RZ0GIgj7Ioj7x/SYa3RzjVrlzrmH0fhIOpfvqQDeIsdP0loi+kHaMhJzY1PBIaA==",
            "cpu": [
                "ppc64"
            ],
@@ -1832,9 +1832,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-s390x-gnu": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.15.tgz",
-            "integrity": "sha512-Ggh0ciFjLwIusLSLz7LZYEaGdxOAUJXI+Qu5JCbhPJJHEt8vP+IjRATTJheiJsdzzTYgUiHUiw3X1Ea3ZpMBdA==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.16.tgz",
+            "integrity": "sha512-Vx7Xg5uUJuNcujJjI70OICaH0EYj80BtOLZTSN7uOYg8QOLlyKnaG0IW7Fn/J0IpJsaKzmDKMhOQv1JBM9m9vg==",
            "cpu": [
                "s390x"
            ],
@@ -1851,9 +1851,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-x64-gnu": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.15.tgz",
-            "integrity": "sha512-FHg60rS6DBePAYZ9X9F67x+JObFdmgn6tupA1C/a3B+CufFmTD4mX+e8M75tCiAO3foR/6xwVBI0KQiI7sn/rw==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.16.tgz",
+            "integrity": "sha512-TNKhgE3uJTsTzatUSSYt0Kgo+Oa2uSlSjz4r1aEIea7HX6ULBym4fAlYUhG1i6pjNf2njfCUAfKwr6C3E9Xg1w==",
            "cpu": [
                "x64"
            ],
@@ -1870,9 +1870,9 @@
            }
        },
        "node_modules/@rolldown/binding-linux-x64-musl": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.15.tgz",
-            "integrity": "sha512-/cvV/7v5VGz/moiz0XKRj2dE8DzsKyhIu1KpOvJGPjRywg3yscON889UGvAe8zfiJLHup7VLjBduoGWi3HusWQ==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.16.tgz",
+            "integrity": "sha512-7chXdpjXZ8qG0+mIxECN3cT9kvhZ3/oZhMX6Pp876P7CDrIy8nJswva6Mq357JR7eYXfuskwZxMeV1SzoZdHrA==",
            "cpu": [
                "x64"
            ],
@@ -1889,9 +1889,9 @@
            }
        },
        "node_modules/@rolldown/binding-openharmony-arm64": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.15.tgz",
-            "integrity": "sha512-MyzC5Hrv/sm+Z7TSGKP/j8001RO2xQm1zOpCNVL4j0cY/VhBZviludA2YFQ7i4lH6ZAXxQm0lcMdBzM+99mE7w==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.16.tgz",
+            "integrity": "sha512-Kwjt+7uNTJK5/MDkGWGVO2KQPnj8yAV75dMpfwyHZrJSXWHrniOB0aUEWlVYf3H1hOqFLIStLdM5QXq6bnKmOQ==",
            "cpu": [
                "arm64"
            ],
@@ -1905,9 +1905,9 @@
            }
        },
        "node_modules/@rolldown/binding-win32-arm64-msvc": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.15.tgz",
-            "integrity": "sha512-+PgYiS+AH5omy6L45ZLxybasauJaj3M8buoT83D+nzPmCayXlxUV9hydhciCKVyIg0B/v0BtXPDE1uGqNwCPpg==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.16.tgz",
+            "integrity": "sha512-/LH6WfjDRXXJz/p5xl4TmU+jpcnwcxbKEQBW/GZE0JHfN0lGIyTtsUEGaQ/q/GikkGJ2yLKe6pwm7AnEWO8pdw==",
            "cpu": [
                "arm64"
            ],
@@ -1921,9 +1921,9 @@
            }
        },
        "node_modules/@rolldown/binding-win32-x64-msvc": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.15.tgz",
-            "integrity": "sha512-HFZd2QNQYn1JbIi+Hpd7H+r/lkWxcfIu28nirZ6eCn2LafuvmExMlb/P96Sfx5tf7pPArw39IdhmCF8vmV+NhQ==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.16.tgz",
+            "integrity": "sha512-1lv1KvX0Z871zfk7vw+dnXMMnHNyDwMzWG8Kv3HxDXMOhzCX4SHc7HK319fInP0i+0p9D8brkfzL7pJOaGl+tw==",
            "cpu": [
                "x64"
            ],
@@ -2158,9 +2158,9 @@
            "license": "MIT"
        },
        "node_modules/@types/estree": {
-            "version": "1.0.9",
-            "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
-            "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+            "version": "1.0.10",
+            "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.10.tgz",
+            "integrity": "sha512-lTyOMnOcmRBzdCv6/4zUZCrEhV0xrqQiUZBZtVcbmLHBXKLnN8q89v/wKRF/Q0HbwVsqbIG3o5HDoFl9sduM+g==",
            "dev": true,
            "license": "MIT"
        },
@@ -2202,9 +2202,9 @@
            "license": "MIT"
        },
        "node_modules/@types/node": {
-            "version": "26.6.5",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.5.tgz",
-            "integrity": "sha512-uMzsv9stDdofIZBx4UGh4Z9ZgXnGC9seRDscilBcTHAeOFk67MZg/k9bWVfO+bk4qZmG+l52hRnLwUiH2LnJTg==",
+            "version": "26.6.6",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.6.tgz",
+            "integrity": "sha512-MzQj+8Kx3XI40OmUAE6Qoh58ZMNstNNMwn2nfd3qWsfe7nDNSqJNzes4njhz6AHwrSHOffSLwXU6yb474Q4aog==",
            "license": "MIT",
            "dependencies": {
                "undici-types": "~8.9.0"
@@ -2796,9 +2796,9 @@
            }
        },
        "node_modules/baseline-browser-mapping": {
-            "version": "2.11.33",
-            "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.33.tgz",
-            "integrity": "sha512-yiVKDX+qCMRKBE084lXvq9EcwFUhKZ2nU8TK1EQQuOgPNR/lmbGxXOeDdlGUqC2Zz11Cs9rk1d/8NfgBmlkt0w==",
+            "version": "2.11.34",
+            "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.34.tgz",
+            "integrity": "sha512-Aqr8mA1kIvyJ3UY5YAY7ib8LSo1DmDMbMnVqGPtsKW1LxaFQFwn9Eb3yvq2fUKJsRvaXjnAV7R5osqETapzNiA==",
            "license": "Apache-2.0",
            "bin": {
                "baseline-browser-mapping": "dist/cli.cjs"
@@ -2831,9 +2831,9 @@
            }
        },
        "node_modules/browserslist": {
-            "version": "4.29.4",
-            "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.29.4.tgz",
-            "integrity": "sha512-2TcbbiwXEq+N0kD36tykpCfyyQigUXmuwNQbnPp4Xk4PX9JOqVIKjJlIDjpH7uY6tmRGoAd+apeT1p60T8wsdA==",
+            "version": "4.29.5",
+            "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.29.5.tgz",
+            "integrity": "sha512-khTmKu5NGYTotqcYo8Bew2k4RAE9PuXRSFRXG2lQBrCEQHyeQ/vX6gKMxfokwywBsLiXZMnHsmWMG1pnO8J7uQ==",
            "funding": [
                {
                    "type": "opencollective",
@@ -2850,10 +2850,10 @@
            ],
            "license": "MIT",
            "dependencies": {
-                "baseline-browser-mapping": "^2.11.29",
-                "caniuse-lite": "^1.0.30001816",
-                "electron-to-chromium": "^1.5.459",
-                "node-releases": "^2.0.59",
+                "baseline-browser-mapping": "^2.11.33",
+                "caniuse-lite": "^1.0.30001819",
+                "electron-to-chromium": "^1.5.464",
+                "node-releases": "^2.0.60",
                "update-browserslist-db": "^1.3.4"
            },
            "bin": {
@@ -2898,9 +2898,9 @@
            }
        },
        "node_modules/caniuse-lite": {
-            "version": "1.0.30001819",
-            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001819.tgz",
-            "integrity": "sha512-LFUqIIAwpzsIuevnKnsR9qnStBcgzPShTX61lBwN9uFkkf8o8zLiebEjbW8AYtZiF+1YKDWfdt/pWDtMuG8Xwg==",
+            "version": "1.0.30001820",
+            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001820.tgz",
+            "integrity": "sha512-gfWD6MxqVCqAOwmODfZf7DchWvlrA+SRdNX7ceLfg3xRqe5ssjjpF7EgslC/0tiLiNTajdaNN/q8c/5u/7Gz8w==",
            "funding": [
                {
                    "type": "opencollective",
@@ -3245,9 +3245,9 @@
            }
        },
        "node_modules/electron-to-chromium": {
-            "version": "1.5.464",
-            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.464.tgz",
-            "integrity": "sha512-nRa65aFge40viPAKxMKULIY8tcXKwKboJWNn4RoKwyWXJ6SP7BnrDGKUTzc64818jIciH0PK7LSF8QzZes19GA==",
+            "version": "1.5.472",
+            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.472.tgz",
+            "integrity": "sha512-s4+nfT29b0FKpVKoaIxl2pWsoNcn7A/nMPSrxayw4T3BsmPeV2lF9Y06BsAQeMGhCTQ4nYJ5XST7jkqe4ZEqFw==",
            "license": "ISC"
        },
        "node_modules/emoji-regex": {
@@ -3258,9 +3258,9 @@
            "license": "MIT"
        },
        "node_modules/entities": {
-            "version": "8.1.0",
-            "resolved": "https://registry.npmjs.org/entities/-/entities-8.1.0.tgz",
-            "integrity": "sha512-kxL7msIffSuh9aaFAMD7rxAIuTRMAHMeBtgHW2yUdWw732ZNh4MehkF2gdjvtdmikkaIP9bFDDJOPlsvm7avrA==",
+            "version": "9.0.0",
+            "resolved": "https://registry.npmjs.org/entities/-/entities-9.0.0.tgz",
+            "integrity": "sha512-oJFNDJg3kTPwAD1cNn2+WmUq4wFoo09npc3Ydf1D7ED4smRiWrsKnaLxykrTWgyGEcusc87P5dxlAleol9kpkg==",
            "dev": true,
            "license": "BSD-2-Clause",
            "engines": {
@@ -4274,9 +4274,9 @@
            }
        },
        "node_modules/magic-string": {
-            "version": "1.4.3",
-            "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.3.tgz",
-            "integrity": "sha512-z12OxmaPGE0F4xlpGdjuAUckipLpQlTAuAmyGhNoD7ODpYUzvDfvtxUbjM/jwznyP178oju/KDdyi220wNJ0RQ==",
+            "version": "1.4.5",
+            "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.5.tgz",
+            "integrity": "sha512-oLLC2+YvQUfAa+vxoufE/yc1icb87M9iXIRqAoR/2EhE/8cb3SF/+Gi0c2By1B+5Vz2e2vQtUvHiu1+63Znh+w==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -4430,9 +4430,9 @@
            }
        },
        "node_modules/node-releases": {
-            "version": "2.0.60",
-            "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.60.tgz",
-            "integrity": "sha512-OmO8+GM1JUZqXET720VrJCwkjUCXmCMQm0Z3UDDRbfNLHS4NEAvY60j5jiFv0tkKw2PNNlqOLhahVmwJIOLDIQ==",
+            "version": "2.0.63",
+            "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.63.tgz",
+            "integrity": "sha512-6li2QanLsAXpIH2R6j77MzRyvOyrvdTqlKtO4CgBdHGNvN99ZZfyxszHc5o5+IZBWD5u6Hzwg83JoGXmqZNG9Q==",
            "license": "MIT",
            "engines": {
                "node": ">=18"
@@ -4536,9 +4536,9 @@
            }
        },
        "node_modules/ora/node_modules/ansi-regex": {
-            "version": "6.4.0",
-            "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.4.0.tgz",
-            "integrity": "sha512-KzTVk2tCWAHtYrvvvaP8bJKJq2pVinhLcGEQdtLIYPbmNGNyYe8QwNaTUYQp2J7/vIsUKt5QCqAfUkYyG9DkOw==",
+            "version": "6.5.0",
+            "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.5.0.tgz",
+            "integrity": "sha512-zhvbbbdt1kbw7EJ9OQoxmQcuaNR9P5kTj7e/YdmOSU10aHWbycofJxA6jKfoEy3vlLdctOF9ZHaxLtmSm998wQ==",
            "dev": true,
            "license": "MIT",
            "engines": {
@@ -4625,13 +4625,13 @@
            }
        },
        "node_modules/parse5": {
-            "version": "8.0.1",
-            "resolved": "https://registry.npmjs.org/parse5/-/parse5-8.0.1.tgz",
-            "integrity": "sha512-z1e/HMG90obSGeidlli3hj7cbocou0/wa5HacvI3ASx34PecNjNQeaHNo5WIZpWofN9kgkqV1q5YvXe3F0FoPw==",
+            "version": "8.1.0",
+            "resolved": "https://registry.npmjs.org/parse5/-/parse5-8.1.0.tgz",
+            "integrity": "sha512-sq3qBFpee5jeocbFbO48VHlGr8sT7mbXS0vxlKN6sottBtJzrOG3998sr0llSZcQAGgfpdmEYAIZE0P9z0dE8w==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
-                "entities": "^8.0.0"
+                "entities": "^9.0.0"
            },
            "funding": {
                "url": "https://github.com/inikulin/parse5?sponsor=1"
@@ -4694,9 +4694,9 @@
            }
        },
        "node_modules/postcss": {
-            "version": "8.5.31",
-            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.31.tgz",
-            "integrity": "sha512-YUbWYCgErwnMAVkjUnYa+KlMBzGpHwiIt/DE7f0G33AuX2LH9UcTk6KgWxd3zRU+pN3u/C+Xl3EnMLM4Hea7Sg==",
+            "version": "8.5.32",
+            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.32.tgz",
+            "integrity": "sha512-LJlKCCAUFKOuZxipUdYw1NzIITEsPcgyOG9LkvRJvuKj/bRzbuRY0ARXvL0pWGpsZvn8jku+LMep2eU0seHp8g==",
            "devOptional": true,
            "funding": [
                {
@@ -5228,12 +5228,12 @@
            }
        },
        "node_modules/rolldown": {
-            "version": "1.2.15",
-            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.15.tgz",
-            "integrity": "sha512-6odND+fel5zVw3I4Yc2e69gvguDnX0CAAGiNDZSq4ik5WUcaLrkD2GLuog0XcODbor31hZ5ayEMgVDno+KPV5g==",
+            "version": "1.2.16",
+            "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.16.tgz",
+            "integrity": "sha512-bWvlMpFKiTfDKfnK7FC2MPgPeWCf/Kpwsq49ApdW+FQaBZb6O6dZ4MAPbPUjp7hYQrw/RobqCzn64BRrQecGHw==",
            "license": "MIT",
            "dependencies": {
-                "@oxc-project/types": "=0.155.0",
+                "@oxc-project/types": "=0.156.0",
                "@rolldown/pluginutils": "^1.0.0"
            },
            "bin": {
@@ -5243,21 +5243,21 @@
                "node": "^20.19.0 || >=22.12.0"
            },
            "optionalDependencies": {
-                "@rolldown/binding-android-arm-eabi": "1.2.15",
-                "@rolldown/binding-android-arm64": "1.2.15",
-                "@rolldown/binding-darwin-arm64": "1.2.15",
-                "@rolldown/binding-darwin-x64": "1.2.15",
-                "@rolldown/binding-freebsd-x64": "1.2.15",
-                "@rolldown/binding-linux-arm-gnueabihf": "1.2.15",
-                "@rolldown/binding-linux-arm64-gnu": "1.2.15",
-                "@rolldown/binding-linux-arm64-musl": "1.2.15",
-                "@rolldown/binding-linux-ppc64-gnu": "1.2.15",
-                "@rolldown/binding-linux-s390x-gnu": "1.2.15",
-                "@rolldown/binding-linux-x64-gnu": "1.2.15",
-                "@rolldown/binding-linux-x64-musl": "1.2.15",
-                "@rolldown/binding-openharmony-arm64": "1.2.15",
-                "@rolldown/binding-win32-arm64-msvc": "1.2.15",
-                "@rolldown/binding-win32-x64-msvc": "1.2.15"
+                "@rolldown/binding-android-arm-eabi": "1.2.16",
+                "@rolldown/binding-android-arm64": "1.2.16",
+                "@rolldown/binding-darwin-arm64": "1.2.16",
+                "@rolldown/binding-darwin-x64": "1.2.16",
+                "@rolldown/binding-freebsd-x64": "1.2.16",
+                "@rolldown/binding-linux-arm-gnueabihf": "1.2.16",
+                "@rolldown/binding-linux-arm64-gnu": "1.2.16",
+                "@rolldown/binding-linux-arm64-musl": "1.2.16",
+                "@rolldown/binding-linux-ppc64-gnu": "1.2.16",
+                "@rolldown/binding-linux-s390x-gnu": "1.2.16",
+                "@rolldown/binding-linux-x64-gnu": "1.2.16",
+                "@rolldown/binding-linux-x64-musl": "1.2.16",
+                "@rolldown/binding-openharmony-arm64": "1.2.16",
+                "@rolldown/binding-win32-arm64-msvc": "1.2.16",
+                "@rolldown/binding-win32-x64-msvc": "1.2.16"
            }
        },
        "node_modules/saxes": {
@@ -5467,9 +5467,9 @@
            "license": "MIT"
        },
        "node_modules/tinybench": {
-            "version": "6.2.2",
-            "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-6.2.2.tgz",
-            "integrity": "sha512-nIZ2N2dFpjBsg2hgitKu7mA+FvsIJuGJOwysRngmVRRmWgR/UyPjwJj8c/fT/dhm8EkHnF5EOogRf+0Z2qrimA==",
+            "version": "6.2.3",
+            "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-6.2.3.tgz",
+            "integrity": "sha512-Al01C2JIBnO2CXCAPbpAl6sUiOZHeThGtHYNTa51JRw9PyWOCdr+9Ong05R4qg/Sk3+H645E8ov1h2c58ityNw==",
            "dev": true,
            "license": "MIT",
            "engines": {
@@ -5533,9 +5533,9 @@
            }
        },
        "node_modules/tldts-core": {
-            "version": "7.4.19",
-            "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.19.tgz",
-            "integrity": "sha512-goNXV6Ho9TIOfpJZanTd6CKG5DyYgYAL+k+22T0SLh8l6+KHIfBUPFuePuSZv05UttIaaLmI9tb7TmGIdK5AkQ==",
+            "version": "7.4.20",
+            "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.20.tgz",
+            "integrity": "sha512-C630TWXZCZmLq0F2bW4QqwnaaxCQ/svpAqvJwnC4JvgEM5ohhBnGsEzTLSOXcN+xjz+kEaHS5uoWIw2klnqd0A==",
            "dev": true,
            "license": "MIT"
        },
@@ -5579,9 +5579,9 @@
            }
        },
        "node_modules/tslib": {
-            "version": "2.8.1",
-            "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-            "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+            "version": "2.9.1",
+            "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.9.1.tgz",
+            "integrity": "sha512-a4Ux9VKuIMHsOS7ENbEq6hK2ZGYIT27Rtl0E4eD9KqwxhKiQeMZE/9xb3IdYwWaSOyIBQLExhQgXDTYoiCxnWA==",
            "license": "0BSD"
        },
        "node_modules/tss-react": {
--- a/commafeed-server/src/main/java/com/commafeed/ExceptionMappers.java
+++ b/commafeed-server/src/main/java/com/commafeed/ExceptionMappers.java
@@ -10,7 +10,10 @@ import io.quarkus.security.UnauthorizedException;

 import jakarta.annotation.Priority;
 import jakarta.validation.ValidationException;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.NewCookie;
+import jakarta.ws.rs.core.UriInfo;
 import jakarta.ws.rs.ext.Provider;

 import lombok.RequiredArgsConstructor;
@@ -49,8 +52,19 @@ public class ExceptionMappers {

    @ServerExceptionMapper(AuthenticationFailedException.class)
    public RestResponse<AuthenticationFailed> authenticationFailed(
-            AuthenticationFailedException e) {
+            AuthenticationFailedException e, HttpHeaders headers, UriInfo uriInfo) {
        NewCookie logoutCookie = cookieService.buildLogoutCookie();
+
+        // a browser navigating with an invalidated session would otherwise display the error
+        // instead of the page, retry the request now that the cookie is removed
+        if (headers.getAcceptableMediaTypes().stream()
+                .anyMatch(m -> MediaType.TEXT_HTML_TYPE.isCompatible(m) && !m.isWildcardType())) {
+            return ResponseBuilder.<AuthenticationFailed>create(Status.TEMPORARY_REDIRECT)
+                    .location(uriInfo.getRequestUri())
+                    .cookie(logoutCookie)
+                    .build();
+        }
+
        return ResponseBuilder.create(Status.UNAUTHORIZED, new AuthenticationFailed(e.getMessage()))
                .cookie(logoutCookie)
                .build();
--- a/commafeed-server/src/main/java/com/commafeed/backend/HttpClientFactory.java
+++ b/commafeed-server/src/main/java/com/commafeed/backend/HttpClientFactory.java
@@ -56,6 +56,8 @@ public class HttpClientFactory {

    private static final DnsResolver DNS_RESOLVER = SystemDefaultDnsResolver.INSTANCE;
    private static final IPAddress CGNAT_RANGE = new IPAddressString("100.64.0.0/10").getAddress();
+    private static final IPAddress NAT64_LOCAL_USE_RANGE =
+            new IPAddressString("64:ff9b:1::/48").getAddress();

    private final CommaFeedConfiguration config;
    private final CommaFeedVersion version;
@@ -149,7 +151,11 @@ public class HttpClientFactory {
    }

    private static boolean isLocalAddress(IPAddress ip) {
-        if (ip.isLocal() || ip.isLoopback() || ip.isMulticast() || CGNAT_RANGE.contains(ip)) {
+        if (ip.isLocal()
+                || ip.isLoopback()
+                || ip.isMulticast()
+                || CGNAT_RANGE.contains(ip)
+                || NAT64_LOCAL_USE_RANGE.contains(ip)) {
            return true;
        }

--- a/commafeed-server/src/main/java/com/commafeed/backend/model/User.java
+++ b/commafeed-server/src/main/java/com/commafeed/backend/model/User.java
@@ -42,6 +42,9 @@ public class User extends AbstractModel {
    @Column(nullable = false)
    private boolean disabled;

+    @Column(nullable = false)
+    private int sessionVersion;
+
    @Column private Instant lastLogin;

    @Column private Instant created;
--- a/commafeed-server/src/main/java/com/commafeed/backend/service/UserService.java
+++ b/commafeed-server/src/main/java/com/commafeed/backend/service/UserService.java
@@ -155,6 +155,17 @@ public class UserService {
        userDAO.delete(user);
    }

+    public void changePassword(User user, String password) {
+        user.setPassword(encryptionService.getEncryptedPassword(password, user.getSalt()));
+        userDAO.merge(user);
+
+        invalidateSessions(user);
+    }
+
+    public void invalidateSessions(User user) {
+        user.setSessionVersion(user.getSessionVersion() + 1);
+    }
+
    public String generateApiKey(User user) {
        byte[] key =
                encryptionService.getEncryptedPassword(
--- a/commafeed-server/src/main/java/com/commafeed/frontend/resource/AdminREST.java
+++ b/commafeed-server/src/main/java/com/commafeed/frontend/resource/AdminREST.java
@@ -6,7 +6,6 @@ import com.commafeed.backend.dao.UserRoleDAO;
 import com.commafeed.backend.model.User;
 import com.commafeed.backend.model.UserRole;
 import com.commafeed.backend.model.UserRole.Role;
-import com.commafeed.backend.service.PasswordEncryptionService;
 import com.commafeed.backend.service.UserService;
 import com.commafeed.frontend.model.UserModel;
 import com.commafeed.frontend.model.request.AdminSaveUserRequest;
@@ -56,7 +55,6 @@ public class AdminREST {
    private final UserDAO userDAO;
    private final UserRoleDAO userRoleDAO;
    private final UserService userService;
-    private final PasswordEncryptionService encryptionService;
    private final MetricRegistry metrics;

    @Path("/user/save")
@@ -102,10 +100,15 @@ public class AdminREST {
            User u = userDAO.findById(id);
            u.setName(req.getName());
            if (StringUtils.isNotBlank(req.getPassword())) {
-                u.setPassword(
-                        encryptionService.getEncryptedPassword(req.getPassword(), u.getSalt()));
+                userService.changePassword(u, req.getPassword());
+                if (StringUtils.isNotBlank(u.getApiKey())) {
+                    u.setApiKey(userService.generateApiKey(u));
+                }
            }
            u.setEmail(req.getEmail());
+            if (!u.isDisabled() && !req.isEnabled()) {
+                userService.invalidateSessions(u);
+            }
            u.setDisabled(!req.isEnabled());

            Set<Role> roles = userRoleDAO.findRoles(u);
--- a/commafeed-server/src/main/java/com/commafeed/frontend/resource/UserREST.java
+++ b/commafeed-server/src/main/java/com/commafeed/frontend/resource/UserREST.java
@@ -21,7 +21,6 @@ import com.commafeed.backend.model.UserSettings.ReadingMode;
 import com.commafeed.backend.model.UserSettings.ReadingOrder;
 import com.commafeed.backend.model.UserSettings.ScrollMode;
 import com.commafeed.backend.service.MailService;
-import com.commafeed.backend.service.PasswordEncryptionService;
 import com.commafeed.backend.service.PushNotificationService;
 import com.commafeed.backend.service.UserService;
 import com.commafeed.backend.service.db.DatabaseStartupService;
@@ -36,6 +35,7 @@ import com.commafeed.frontend.model.request.RegistrationRequest;
 import com.commafeed.security.AuthenticationContext;
 import com.commafeed.security.Roles;
 import com.google.common.base.Preconditions;
+import com.google.common.html.HtmlEscapers;

 import jakarta.annotation.security.PermitAll;
 import jakarta.annotation.security.RolesAllowed;
@@ -86,7 +86,6 @@ public class UserREST {
    private final UserRoleDAO userRoleDAO;
    private final UserSettingsDAO userSettingsDAO;
    private final UserService userService;
-    private final PasswordEncryptionService encryptionService;
    private final DatabaseStartupService databaseStartupService;
    private final MailService mailService;
    private final CommaFeedConfiguration config;
@@ -316,10 +315,7 @@ public class UserREST {
        }

        if (StringUtils.isNotBlank(request.getNewPassword())) {
-            byte[] password =
-                    encryptionService.getEncryptedPassword(
-                            request.getNewPassword(), user.getSalt());
-            user.setPassword(password);
+            userService.changePassword(user, request.getNewPassword());
            user.setApiKey(userService.generateApiKey(user));
        }

@@ -417,7 +413,7 @@ public class UserREST {
                Urls.removeTrailingSlash(config.passwordRecoveryPublicBaseUrl().orElseThrow());
        return String.format(
                "You asked for password recovery for account '%s', <a href='%s'>follow this link</a> to change your password. Ignore this if you didn't request a password recovery.",
-                user.getName(), callbackUrl(user, publicUrl));
+                HtmlEscapers.htmlEscaper().escape(user.getName()), callbackUrl(user, publicUrl));
    }

    private String callbackUrl(User user, String publicUrl) throws URISyntaxException {
@@ -455,8 +451,7 @@ public class UserREST {
            return Response.status(Status.UNAUTHORIZED).entity("Token expired.").build();
        }

-        byte[] encryptedPassword = encryptionService.getEncryptedPassword(password, user.getSalt());
-        user.setPassword(encryptedPassword);
+        userService.changePassword(user, password);
        if (StringUtils.isNotBlank(user.getApiKey())) {
            user.setApiKey(userService.generateApiKey(user));
        }
--- a/commafeed-server/src/main/java/com/commafeed/security/AuthenticationContext.java
+++ b/commafeed-server/src/main/java/com/commafeed/security/AuthenticationContext.java
@@ -21,11 +21,11 @@ public class AuthenticationContext {
            return null;
        }

-        String userId = securityIdentity.getPrincipal().getName();
-        if (userId == null) {
+        String name = securityIdentity.getPrincipal().getName();
+        if (name == null) {
            return null;
        }

-        return userDAO.findById(Long.valueOf(userId));
+        return userDAO.findById(SessionPrincipal.parse(name).userId());
    }
 }
--- a/commafeed-server/src/main/java/com/commafeed/security/SessionPrincipal.java
+++ b/commafeed-server/src/main/java/com/commafeed/security/SessionPrincipal.java
@@ -0,0 +1,27 @@
+package com.commafeed.security;
+
+import com.commafeed.backend.model.User;
+
+/** Value of the security principal, which is also what ends up in the encrypted session cookie. */
+public record SessionPrincipal(long userId, int sessionVersion) {
+
+    private static final String SEPARATOR = ":";
+
+    public static SessionPrincipal of(User user) {
+        return new SessionPrincipal(user.getId(), user.getSessionVersion());
+    }
+
+    public static SessionPrincipal parse(String name) {
+        // cookies created before session versions were introduced only contain the user id
+        if (!name.contains(SEPARATOR)) {
+            return new SessionPrincipal(Long.parseLong(name), 0);
+        }
+
+        String[] parts = name.split(SEPARATOR, 2);
+        return new SessionPrincipal(Long.parseLong(parts[0]), Integer.parseInt(parts[1]));
+    }
+
+    public String toName() {
+        return userId + SEPARATOR + sessionVersion;
+    }
+}
--- a/commafeed-server/src/main/java/com/commafeed/security/identity/DatabaseApiKeyIdentityProvider.java
+++ b/commafeed-server/src/main/java/com/commafeed/security/identity/DatabaseApiKeyIdentityProvider.java
@@ -4,6 +4,7 @@ import com.commafeed.backend.dao.UnitOfWork;
 import com.commafeed.backend.model.User;
 import com.commafeed.backend.model.UserRole.Role;
 import com.commafeed.backend.service.UserService;
+import com.commafeed.security.SessionPrincipal;

 import io.quarkus.security.AuthenticationFailedException;
 import io.quarkus.security.identity.AuthenticationRequestContext;
@@ -47,7 +48,7 @@ public class DatabaseApiKeyIdentityProvider

            Set<Role> roles = unitOfWork.call(() -> userService.getRoles(user.get()));
            return QuarkusSecurityIdentity.builder()
-                    .setPrincipal(new QuarkusPrincipal(String.valueOf(user.get().getId())))
+                    .setPrincipal(new QuarkusPrincipal(SessionPrincipal.of(user.get()).toName()))
                    .addRoles(roles.stream().map(Enum::name).collect(Collectors.toSet()))
                    .build();
        });
--- a/commafeed-server/src/main/java/com/commafeed/security/identity/DatabaseUsernamePasswordIdentityProvider.java
+++ b/commafeed-server/src/main/java/com/commafeed/security/identity/DatabaseUsernamePasswordIdentityProvider.java
@@ -6,6 +6,7 @@ import com.commafeed.backend.model.UserRole.Role;
 import com.commafeed.backend.service.UserService;
 import com.commafeed.frontend.exception.CommaFeedApplicationException;
 import com.commafeed.frontend.exception.CommaFeedExceptionType;
+import com.commafeed.security.SessionPrincipal;

 import io.quarkus.security.identity.AuthenticationRequestContext;
 import io.quarkus.security.identity.IdentityProvider;
@@ -52,7 +53,7 @@ public class DatabaseUsernamePasswordIdentityProvider

            Set<Role> roles = unitOfWork.call(() -> userService.getRoles(user.get()));
            return QuarkusSecurityIdentity.builder()
-                    .setPrincipal(new QuarkusPrincipal(String.valueOf(user.get().getId())))
+                    .setPrincipal(new QuarkusPrincipal(SessionPrincipal.of(user.get()).toName()))
                    .addRoles(roles.stream().map(Enum::name).collect(Collectors.toSet()))
                    .build();
        });
--- a/commafeed-server/src/main/java/com/commafeed/security/identity/TrustedIdentityProvider.java
+++ b/commafeed-server/src/main/java/com/commafeed/security/identity/TrustedIdentityProvider.java
@@ -6,6 +6,7 @@ import com.commafeed.backend.model.User;
 import com.commafeed.backend.model.UserRole.Role;
 import com.commafeed.backend.service.UserService;
 import com.commafeed.backend.service.internal.PostLoginActivities;
+import com.commafeed.security.SessionPrincipal;

 import io.quarkus.security.AuthenticationFailedException;
 import io.quarkus.security.identity.AuthenticationRequestContext;
@@ -41,11 +42,17 @@ public class TrustedIdentityProvider implements IdentityProvider<TrustedAuthenti
    public Uni<SecurityIdentity> authenticate(
            TrustedAuthenticationRequest request, AuthenticationRequestContext context) {
        return context.runBlocking(() -> {
-            Long userId = Long.valueOf(request.getPrincipal());
-            User user = unitOfWork.call(() -> userDAO.findById(userId));
+            SessionPrincipal principal = SessionPrincipal.parse(request.getPrincipal());
+            User user = unitOfWork.call(() -> userDAO.findById(principal.userId()));
            if (user == null) {
                throw new AuthenticationFailedException("user not found");
            }
+            if (user.isDisabled()) {
+                throw new AuthenticationFailedException("user disabled");
+            }
+            if (user.getSessionVersion() != principal.sessionVersion()) {
+                throw new AuthenticationFailedException("session invalidated");
+            }

            // execute post login activities manually because we didn't call login() since
            // we received
@@ -54,7 +61,7 @@ public class TrustedIdentityProvider implements IdentityProvider<TrustedAuthenti

            Set<Role> roles = unitOfWork.call(() -> userService.getRoles(user));
            return QuarkusSecurityIdentity.builder()
-                    .setPrincipal(new QuarkusPrincipal(String.valueOf(userId)))
+                    .setPrincipal(new QuarkusPrincipal(principal.toName()))
                    .addRoles(roles.stream().map(Enum::name).collect(Collectors.toSet()))
                    .build();
        });
--- a/commafeed-server/src/main/resources/changelogs/db.changelog-7.5.xml
+++ b/commafeed-server/src/main/resources/changelogs/db.changelog-7.5.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog https://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd">
+
+	<changeSet id="user-session-version" author="athou">
+		<addColumn tableName="USERS">
+			<column name="sessionVersion" type="INT" valueNumeric="0" defaultValueNumeric="0">
+				<constraints nullable="false" />
+			</column>
+		</addColumn>
+	</changeSet>
+
+</databaseChangeLog>
--- a/commafeed-server/src/main/resources/migrations.xml
+++ b/commafeed-server/src/main/resources/migrations.xml
@@ -39,5 +39,6 @@
 	<include file="changelogs/db.changelog-5.12.xml" />
 	<include file="changelogs/db.changelog-7.0.xml" />
 	<include file="changelogs/db.changelog-7.2.xml" />
+	<include file="changelogs/db.changelog-7.5.xml" />

 </databaseChangeLog> 
--- a/commafeed-server/src/test/java/com/commafeed/backend/HttpGetterTest.java
+++ b/commafeed-server/src/test/java/com/commafeed/backend/HttpGetterTest.java
@@ -561,6 +561,17 @@ class HttpGetterTest {
                    () -> getter.get("http://[64:ff9b::a00:1]")); // 10.0.0.1
        }

+        @Test
+        void nat64LocalUse() {
+            // 64:ff9b:1::/48 is reserved for local use (RFC 8215), the whole range is blocked
+            Assertions.assertThrows(
+                    UnknownHostException.class,
+                    () -> getter.get("http://[64:ff9b:1::a9fe:a9fe]")); // 169.254.169.254
+            Assertions.assertThrows(
+                    UnknownHostException.class,
+                    () -> getter.get("http://[64:ff9b:1:ffff::a00:1]")); // 10.0.0.1
+        }
+
        @Test
        void sixToFour() {
            // 2002::/16 embeds the IPv4 address in bits 16-47 (RFC 3056)
--- a/commafeed-server/src/test/java/com/commafeed/integration/BaseIT.java
+++ b/commafeed-server/src/test/java/com/commafeed/integration/BaseIT.java
@@ -109,15 +109,15 @@ public abstract class BaseIT {
    }

    protected List<HttpCookie> login() {
+        return login(TestConstants.ADMIN_USERNAME, TestConstants.ADMIN_PASSWORD);
+    }
+
+    protected List<HttpCookie> login(String userName, String password) {
        List<Header> setCookieHeaders =
                RestAssured.given()
                        .auth()
                        .none()
-                        .formParams(
-                                "j_username",
-                                TestConstants.ADMIN_USERNAME,
-                                "j_password",
-                                TestConstants.ADMIN_PASSWORD)
+                        .formParams("j_username", userName, "j_password", password)
                        .post("j_security_check")
                        .then()
                        .statusCode(HttpStatus.SC_OK)
--- a/commafeed-server/src/test/java/com/commafeed/integration/SecurityIT.java
+++ b/commafeed-server/src/test/java/com/commafeed/integration/SecurityIT.java
@@ -6,6 +6,7 @@ import com.commafeed.TestConstants;
 import com.commafeed.frontend.exception.CommaFeedExceptionType;
 import com.commafeed.frontend.model.Entries;
 import com.commafeed.frontend.model.UserModel;
+import com.commafeed.frontend.model.request.AdminSaveUserRequest;
 import com.commafeed.frontend.model.request.MarkRequest;
 import com.commafeed.frontend.model.request.ProfileModificationRequest;
 import com.commafeed.frontend.model.request.SubscribeRequest;
@@ -17,6 +18,7 @@ import io.restassured.http.ContentType;
 import jakarta.ws.rs.core.HttpHeaders;

 import org.apache.hc.core5.http.HttpStatus;
+import org.hamcrest.Matchers;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -28,6 +30,10 @@ import java.util.stream.Collectors;
@QuarkusTest
 class SecurityIT extends BaseIT {

+    private static final String USER_NAME = "session-user";
+    private static final String USER_PASSWORD = "MyPassword123!";
+    private static final String NEW_USER_PASSWORD = "MyNewPassword123!";
+
    @BeforeEach
    void setup() {
        initialSetup(TestConstants.ADMIN_USERNAME, TestConstants.ADMIN_PASSWORD);
@@ -184,4 +190,232 @@ class SecurityIT extends BaseIT {
                .then()
                .statusCode(HttpStatus.SC_UNAUTHORIZED);
    }
+
+    @Test
+    void selfPasswordChangeInvalidatesSessions() {
+        createUser(false);
+        String sessionA = session(USER_NAME, USER_PASSWORD);
+        String sessionB = session(USER_NAME, USER_PASSWORD);
+        String adminSession = session(TestConstants.ADMIN_USERNAME, TestConstants.ADMIN_PASSWORD);
+
+        ProfileModificationRequest req = new ProfileModificationRequest();
+        req.setCurrentPassword(USER_PASSWORD);
+        req.setNewPassword(NEW_USER_PASSWORD);
+        RestAssured.given()
+                .header(HttpHeaders.COOKIE, sessionA)
+                .body(req)
+                .contentType(ContentType.JSON)
+                .post("rest/user/profile")
+                .then()
+                .statusCode(HttpStatus.SC_OK);
+
+        assertSessionStatus(sessionA, HttpStatus.SC_UNAUTHORIZED);
+        assertSessionStatus(sessionB, HttpStatus.SC_UNAUTHORIZED);
+        assertSessionStatus(adminSession, HttpStatus.SC_OK);
+        assertSessionStatus(session(USER_NAME, NEW_USER_PASSWORD), HttpStatus.SC_OK);
+    }
+
+    @Test
+    void profileChangeWithoutNewPasswordKeepsSessions() {
+        createUser(false);
+        String session = session(USER_NAME, USER_PASSWORD);
+
+        ProfileModificationRequest req = new ProfileModificationRequest();
+        req.setCurrentPassword(USER_PASSWORD);
+        req.setEmail("session-user@commafeed.com");
+        RestAssured.given()
+                .header(HttpHeaders.COOKIE, session)
+                .body(req)
+                .contentType(ContentType.JSON)
+                .post("rest/user/profile")
+                .then()
+                .statusCode(HttpStatus.SC_OK);
+
+        assertSessionStatus(session, HttpStatus.SC_OK);
+    }
+
+    @Test
+    void adminPasswordChangeInvalidatesSessionsAndRotatesApiKey() {
+        Long id = createUser(false);
+        String session = session(USER_NAME, USER_PASSWORD);
+
+        ProfileModificationRequest apiKeyReq = new ProfileModificationRequest();
+        apiKeyReq.setCurrentPassword(USER_PASSWORD);
+        apiKeyReq.setNewApiKey(true);
+        RestAssured.given()
+                .header(HttpHeaders.COOKIE, session)
+                .body(apiKeyReq)
+                .contentType(ContentType.JSON)
+                .post("rest/user/profile")
+                .then()
+                .statusCode(HttpStatus.SC_OK);
+        String apiKey = profile(session).getApiKey();
+        Assertions.assertNotNull(apiKey);
+
+        AdminSaveUserRequest req = saveUserRequest(false);
+        req.setId(id);
+        req.setPassword(NEW_USER_PASSWORD);
+        saveUser(req);
+
+        assertSessionStatus(session, HttpStatus.SC_UNAUTHORIZED);
+        String newSession = session(USER_NAME, NEW_USER_PASSWORD);
+        assertSessionStatus(newSession, HttpStatus.SC_OK);
+        Assertions.assertNotEquals(apiKey, profile(newSession).getApiKey());
+    }
+
+    @Test
+    void adminPasswordChangeDoesNotCreateApiKey() {
+        Long id = createUser(false);
+
+        AdminSaveUserRequest req = saveUserRequest(false);
+        req.setId(id);
+        req.setPassword(NEW_USER_PASSWORD);
+        saveUser(req);
+
+        Assertions.assertNull(profile(session(USER_NAME, NEW_USER_PASSWORD)).getApiKey());
+    }
+
+    @Test
+    void disablingUserInvalidatesSessions() {
+        Long id = createUser(false);
+        String session = session(USER_NAME, USER_PASSWORD);
+        assertSessionStatus(session, HttpStatus.SC_OK);
+
+        AdminSaveUserRequest req = saveUserRequest(false);
+        req.setId(id);
+        req.setEnabled(false);
+        saveUser(req);
+
+        assertSessionStatus(session, HttpStatus.SC_UNAUTHORIZED);
+
+        // sessions opened before the user was disabled stay invalid after enabling it again
+        req.setEnabled(true);
+        saveUser(req);
+
+        assertSessionStatus(session, HttpStatus.SC_UNAUTHORIZED);
+        assertSessionStatus(session(USER_NAME, USER_PASSWORD), HttpStatus.SC_OK);
+    }
+
+    @Test
+    void savingUserWithoutChangesKeepsSessions() {
+        Long id = createUser(false);
+        String session = session(USER_NAME, USER_PASSWORD);
+
+        AdminSaveUserRequest req = saveUserRequest(false);
+        req.setId(id);
+        saveUser(req);
+
+        assertSessionStatus(session, HttpStatus.SC_OK);
+    }
+
+    @Test
+    void disablingAdminRevokesAdminAccess() {
+        Long id = createUser(true);
+        String session = session(USER_NAME, USER_PASSWORD);
+        RestAssured.given()
+                .header(HttpHeaders.COOKIE, session)
+                .get("rest/admin/metrics")
+                .then()
+                .statusCode(HttpStatus.SC_OK);
+
+        AdminSaveUserRequest req = saveUserRequest(true);
+        req.setId(id);
+        req.setEnabled(false);
+        saveUser(req);
+
+        RestAssured.given()
+                .header(HttpHeaders.COOKIE, session)
+                .get("rest/admin/metrics")
+                .then()
+                .statusCode(HttpStatus.SC_UNAUTHORIZED);
+    }
+
+    @Test
+    void invalidatedSessionRemovesCookie() {
+        Long id = createUser(false);
+        String session = session(USER_NAME, USER_PASSWORD);
+
+        AdminSaveUserRequest req = saveUserRequest(false);
+        req.setId(id);
+        req.setEnabled(false);
+        saveUser(req);
+
+        // api calls receive an error
+        String apiSetCookie =
+                RestAssured.given()
+                        .header(HttpHeaders.COOKIE, session)
+                        .get("rest/user/profile")
+                        .then()
+                        .statusCode(HttpStatus.SC_UNAUTHORIZED)
+                        .extract()
+                        .header(HttpHeaders.SET_COOKIE);
+        Assertions.assertTrue(apiSetCookie.contains("Max-Age=0"));
+
+        // browsers are redirected to the page they asked for, this time without the cookie
+        String browserSetCookie =
+                RestAssured.given()
+                        .redirects()
+                        .follow(false)
+                        .header(HttpHeaders.COOKIE, session)
+                        .header(HttpHeaders.ACCEPT, "text/html,application/xhtml+xml,*/*;q=0.8")
+                        .get("next?category=all")
+                        .then()
+                        .statusCode(HttpStatus.SC_TEMPORARY_REDIRECT)
+                        .header(HttpHeaders.LOCATION, Matchers.endsWith("/next?category=all"))
+                        .extract()
+                        .header(HttpHeaders.SET_COOKIE);
+        Assertions.assertTrue(browserSetCookie.contains("Max-Age=0"));
+    }
+
+    private Long createUser(boolean admin) {
+        AdminSaveUserRequest req = saveUserRequest(admin);
+        req.setPassword(USER_PASSWORD);
+        return saveUser(req);
+    }
+
+    private AdminSaveUserRequest saveUserRequest(boolean admin) {
+        AdminSaveUserRequest req = new AdminSaveUserRequest();
+        req.setName(USER_NAME);
+        req.setEnabled(true);
+        req.setAdmin(admin);
+        return req;
+    }
+
+    private Long saveUser(AdminSaveUserRequest req) {
+        return RestAssured.given()
+                .auth()
+                .preemptive()
+                .basic(TestConstants.ADMIN_USERNAME, TestConstants.ADMIN_PASSWORD)
+                .body(req)
+                .contentType(ContentType.JSON)
+                .post("rest/admin/user/save")
+                .then()
+                .statusCode(HttpStatus.SC_OK)
+                .extract()
+                .as(Long.class);
+    }
+
+    private String session(String userName, String password) {
+        return login(userName, password).stream()
+                .map(HttpCookie::toString)
+                .collect(Collectors.joining(";"));
+    }
+
+    private UserModel profile(String session) {
+        return RestAssured.given()
+                .header(HttpHeaders.COOKIE, session)
+                .get("rest/user/profile")
+                .then()
+                .statusCode(HttpStatus.SC_OK)
+                .extract()
+                .as(UserModel.class);
+    }
+
+    private void assertSessionStatus(String session, int status) {
+        RestAssured.given()
+                .header(HttpHeaders.COOKIE, session)
+                .get("rest/user/profile")
+                .then()
+                .statusCode(status);
+    }
 }
--- a/commafeed-server/src/test/java/com/commafeed/integration/rest/UserIT.java
+++ b/commafeed-server/src/test/java/com/commafeed/integration/rest/UserIT.java
@@ -4,6 +4,7 @@ import com.commafeed.TestConstants;
 import com.commafeed.frontend.model.Settings;
 import com.commafeed.frontend.model.request.PasswordResetConfirmationRequest;
 import com.commafeed.frontend.model.request.PasswordResetRequest;
+import com.commafeed.frontend.model.request.RegistrationRequest;
 import com.commafeed.integration.BaseIT;

 import io.quarkus.mailer.MockMailbox;
@@ -13,17 +14,21 @@ import io.restassured.http.ContentType;
 import io.vertx.ext.mail.MailMessage;

 import jakarta.inject.Inject;
+import jakarta.ws.rs.core.HttpHeaders;

 import org.jsoup.Jsoup;
 import org.jsoup.nodes.Element;
+import org.jsoup.select.Elements;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;

+import java.net.HttpCookie;
 import java.net.URLDecoder;
 import java.nio.charset.StandardCharsets;
 import java.util.List;
+import java.util.stream.Collectors;

@QuarkusTest
 class UserIT extends BaseIT {
@@ -47,6 +52,9 @@ class UserIT extends BaseIT {

    @Test
    void resetPassword() {
+        String session =
+                login().stream().map(HttpCookie::toString).collect(Collectors.joining(";"));
+
        PasswordResetRequest req = new PasswordResetRequest();
        req.setEmail("admin@commafeed.com");
        RestAssured.given()
@@ -99,11 +107,59 @@ class UserIT extends BaseIT {
                .then()
                .statusCode(200);

+        // sessions opened before the reset are no longer valid
+        RestAssured.given()
+                .auth()
+                .none()
+                .header(HttpHeaders.COOKIE, session)
+                .get("rest/user/settings")
+                .then()
+                .statusCode(401);
+
        RestAssured.authentication =
                RestAssured.preemptive().basic(TestConstants.ADMIN_USERNAME, newPassword);
        RestAssured.given().get("rest/user/settings").then().statusCode(200);
    }

+    @Test
+    void resetPasswordEscapesUsernameInEmail() {
+        String name = "<a href=//evil.example>CLICK</a>";
+        String email = "victim@commafeed.com";
+
+        RegistrationRequest registrationReq = new RegistrationRequest();
+        registrationReq.setName(name);
+        registrationReq.setPassword("MyPassword123!");
+        registrationReq.setEmail(email);
+        RestAssured.given()
+                .body(registrationReq)
+                .contentType(ContentType.JSON)
+                .post("rest/user/register")
+                .then()
+                .statusCode(200);
+
+        PasswordResetRequest req = new PasswordResetRequest();
+        req.setEmail(email);
+        RestAssured.given()
+                .body(req)
+                .contentType(ContentType.JSON)
+                .post("rest/user/passwordReset")
+                .then()
+                .statusCode(200);
+
+        List<MailMessage> mails = mailbox.getMailMessagesSentTo(email);
+        Assertions.assertEquals(1, mails.size());
+
+        String html = mails.getFirst().getHtml();
+        Assertions.assertTrue(
+                html.startsWith(
+                        "You asked for password recovery for account '&lt;a href=//evil.example&gt;CLICK&lt;/a&gt;'"));
+
+        Elements links = Jsoup.parse(html).select("a");
+        Assertions.assertEquals(1, links.size());
+        Assertions.assertTrue(
+                links.getFirst().attr("href").startsWith("https://commafeed.example.com"));
+    }
+
    @Test
    void saveSettings() {
        Settings settings =
--- a/commafeed-server/src/test/java/com/commafeed/security/SessionPrincipalTest.java
+++ b/commafeed-server/src/test/java/com/commafeed/security/SessionPrincipalTest.java
@@ -0,0 +1,19 @@
+package com.commafeed.security;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+class SessionPrincipalTest {
+
+    @Test
+    void roundTrip() {
+        SessionPrincipal principal = new SessionPrincipal(12, 3);
+        Assertions.assertEquals("12:3", principal.toName());
+        Assertions.assertEquals(principal, SessionPrincipal.parse(principal.toName()));
+    }
+
+    @Test
+    void cookieWithoutSessionVersion() {
+        Assertions.assertEquals(new SessionPrincipal(12, 0), SessionPrincipal.parse("12"));
+    }
+}
Author	SHA1	Message	Date
Athou	01ac8d6ebd	block NAT64 local-use prefix in SSRF protection	2026-11-02 13:09:31 +01:00
Athou	ddff408afe	escape username in password recovery email	2026-11-02 12:34:14 +01:00
Athou	0c280c4dc4	invalidate existing sessions on password change	2026-11-02 12:17:45 +01:00
renovate[bot]	ca4642f7c9	Lock file maintenance	2026-11-02 00:55:45 +00:00