fix: security alerts & bump version

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
     - name: setup nodejs
       uses: actions/setup-node@v3
       with:
-        node-version: '16.16.x'
+        node-version: '20.x'
     - name: Install yarn
       run: npm install -g yarn
     - name: Check lint
@@ -31,7 +31,7 @@ jobs:
     - name: setup nodejs
       uses: actions/setup-node@v3
       with:
-        node-version: '16.16.x'
+        node-version: '20.x'
     - name: Install yarn
       run: npm install -g yarn
     - name: Run unittest

.gitignore

@@ -21,3 +21,6 @@
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
+
+# agent spec
+.specx

README.md

@@ -24,6 +24,7 @@ Install in Chrome Web Store directly: [link](https://chromewebstore.google.com/d
 ## Release
 | Version | Description | PR | Note |
 | ------ | ------ | ------ | ------ |
+| v1.3.1 | fixed some security issue | https://github.com/hj24/bookmark-search/pull/19 ||
 | v1.3.0 | auto focus input after initial load | https://github.com/hj24/bookmark-search/pull/17 ||
 | v1.2.2 | optmize doc | https://github.com/hj24/bookmark-search/pull/16 ||
 | v1.2.1 | fix bug, filter folder correctly for imported bookmarks | https://github.com/hj24/bookmark-search/pull/15 | Issue: https://github.com/hj24/bookmark-search/issues/9 |

craco.config.js

@@ -1,4 +1,78 @@
 // craco.config.js
+function captureAppUse(devServer, setup) {
+    const app = devServer.app;
+    const originalUse = app.use.bind(app);
+    const captured = [];
+
+    app.use = (...args) => {
+        const hasPath =
+            typeof args[0] === 'string' ||
+            args[0] instanceof RegExp ||
+            Array.isArray(args[0]);
+        const path = hasPath ? args[0] : undefined;
+        const handlers = hasPath ? args.slice(1) : args;
+
+        handlers.forEach((middleware) => {
+            captured.push(path === undefined ? {middleware} : {path, middleware});
+        });
+
+        return app;
+    };
+
+    try {
+        setup(devServer);
+    } finally {
+        app.use = originalUse;
+    }
+
+    return captured;
+}
+
+function adaptReactScriptsDevServerHooks(config) {
+    const {
+        https,
+        onBeforeSetupMiddleware,
+        onAfterSetupMiddleware,
+        setupMiddlewares,
+        ...restConfig
+    } = config;
+    const nextConfig = {
+        ...restConfig,
+        server: https ? {type: 'https', options: https} : {type: 'http'},
+    };
+
+    if (!onBeforeSetupMiddleware && !onAfterSetupMiddleware) {
+        return nextConfig;
+    }
+
+    return {
+        ...nextConfig,
+        setupMiddlewares(middlewares, devServer) {
+            let nextMiddlewares = middlewares;
+
+            if (typeof onBeforeSetupMiddleware === 'function') {
+                nextMiddlewares = [
+                    ...captureAppUse(devServer, onBeforeSetupMiddleware),
+                    ...nextMiddlewares,
+                ];
+            }
+
+            if (typeof setupMiddlewares === 'function') {
+                nextMiddlewares = setupMiddlewares(nextMiddlewares, devServer);
+            }
+
+            if (typeof onAfterSetupMiddleware === 'function') {
+                nextMiddlewares = [
+                    ...nextMiddlewares,
+                    ...captureAppUse(devServer, onAfterSetupMiddleware),
+                ];
+            }
+
+            return nextMiddlewares;
+        },
+    };
+}
+
 module.exports = {
     style: {
         // why use postcssOptions? -> https://github.com/dilanx/craco/issues/353
@@ -9,4 +83,5 @@ module.exports = {
             ],
         },
     },
+    devServer: adaptReactScriptsDevServerHooks,
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "bookmark-search",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "private": true,
   "dependencies": {
     "@craco/craco": "^7.1.0",
@@ -17,7 +17,7 @@
     "@xstate/react": "^3.2.2",
     "autoprefixer": "^10.4.14",
     "fuse.js": "^6.6.2",
-    "postcss": "^8.4.23",
+    "postcss": "^8.5.10",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
     "react-infinite-scroller": "^1.2.6",
@@ -68,5 +68,21 @@
     "prettier": "^2.8.8",
     "tailwindcss-cli": "^0.1.2",
     "ts-jest": "^29.1.0"
+  },
+  "resolutions": {
+    "@babel/plugin-transform-modules-systemjs": "7.29.4",
+    "@tootallnate/once": "2.0.1",
+    "flatted": "3.4.2",
+    "follow-redirects": "1.16.0",
+    "launch-editor": "2.9.0",
+    "lodash": "4.18.0",
+    "node-forge": "1.4.0",
+    "path-to-regexp": "0.1.13",
+    "picomatch": "2.3.2",
+    "postcss": "8.5.10",
+    "serialize-javascript": "7.0.5",
+    "tmp": "0.2.6",
+    "uuid": "11.1.1",
+    "webpack-dev-server": "5.2.4"
   }
 }

public/manifest.json

@@ -1,7 +1,8 @@
 {
   "name": "bookmark-search",
   "description": "Find the bookmark you want",
-  "version": "1.3.0",
+  "version": "1.3.1",
+  "version_name": "1.3.1+build.2",
   "manifest_version": 3,
   "permissions": [
     "bookmarks"
@@ -17,7 +18,6 @@
   "background": {
     "service_worker": "background.js"
   },
-  "persistent": true,
   "commands": {
     "_execute_action": {
         "suggested_key": {