Update from main

[github-actions]

This is an automated pull request to update from branch main

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	phanpy	d83405a	Commit Preview URL Branch Preview URL	Nov 08 2025, 04:17 PM

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​lingui/​macro@​5.5.0 ⏵ 5.5.2				+2
	@​lingui/​detect-locale@​5.5.0 ⏵ 5.5.2	+1			+1
	@​lingui/​vite-plugin@​5.5.0 ⏵ 5.5.2	+1			+1
	@​formatjs/​intl-segmenter@​11.7.11 ⏵ 11.7.12	-2		-23	-5
	gifuct-js@​2.1.2
	@​lingui/​react@​5.5.0 ⏵ 5.5.2	+1		+1	+2
	sonda@​0.9.0 ⏵ 0.10.0	+1		+1	+4
	@​lingui/​cli@​5.5.0 ⏵ 5.5.2	+1		+1	+3
	@​types/​node@​24.6.2 ⏵ 24.10.0	+1		+1
	react-intersection-observer@​9.16.0 ⏵ 10.0.0			+1	-4
	vite@​7.1.9 ⏵ 7.2.2	+1	+8		+1
	p-queue@​9.0.0
	@​lingui/​babel-plugin-lingui-macro@​5.5.0 ⏵ 5.5.2			+1	+3
	react-quick-pinch-zoom@​5.1.0 ⏵ 5.1.1			+1	+8
	p-retry@​7.0.0 ⏵ 7.1.0	+1		+1	+3
	temml@​0.11.11 ⏵ 0.12.1	-2			+3
	@​justinribeiro/​lite-youtube@​1.8.2 ⏵ 1.9.0			+1	+7
	react-hotkeys-hook@​5.1.0 ⏵ 5.2.1				+7
	vite-plugin-pwa@​1.0.3 ⏵ 1.1.0	+1		+1	+3
	masto@​7.2.0 ⏵ 7.4.0	-1			+8
	@​playwright/​test@​1.55.1 ⏵ 1.56.1
	@​biomejs/​biome@​2.2.5 ⏵ 2.3.4				+3

View full report

[cloudflare-workers-and-pages]

Deploying phanpy with    Cloudflare Pages

Latest commit:	d83405a
Status:	✅  Deploy successful!
Preview URL:	https://c579a7b7.phanpy.pages.dev
Branch Preview URL:	https://main.phanpy.pages.dev

View logs

To fix the problem, ensure that any text interpolated into an HTML string is sufficiently escaped for HTML meta-characters to prevent breaking out of expected markup and injecting script or tags. The most targeted fix is to run escapeHTML() (already imported at line 2) on the interpolated portion, specifically text.slice(1), before interpolating it into the string assigned to link.innerHTML on line 102.

Make the following change in src/utils/enhance-content.js:

• On line 102, change:

  link.innerHTML = `${hashSymbol}<span>${text.slice(1)}</span>`;

  to:

  link.innerHTML = `${hashSymbol}<span>${escapeHTML(text.slice(1))}</span>`;

This will ensure any meta-characters in the untrusted portion (text.slice(1)) are safely escaped, preventing XSS via hashtag content.

No new imports/methods are needed since escapeHTML is already imported.

---