Merge tag 'v0.15.0' into release

Release v0.15.0

Author: nodiscc

.github/act/Dockerfile

@@ -0,0 +1,28 @@
+FROM ubuntu:latest
+
+# Install necessary dependencies
+RUN apt-get update && apt-get install -y \
+    sudo \
+    git \
+    curl \
+    make \
+    wget \
+    && rm -rf /var/lib/apt/lists/*
+
+# Get correct version of nodejs
+RUN curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - \
+    && sudo apt install -y nodejs
+
+RUN sudo npm install -g yarn
+
+# Create a non-root user (same as GitHub Actions)
+RUN useradd -m runner && \
+    echo "runner ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+
+# Set user to 'runner'
+USER runner
+
+# Set working directory (GitHub Actions uses this location)
+WORKDIR /home/runner
+
+CMD ["/bin/bash"]

.github/workflows/ci.yml

@@ -2,50 +2,54 @@ name: Shaarli CI
 on: [push, pull_request]
 jobs:
   php:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1', '8.2']
+        php-versions: ['8.1', '8.2', '8.3', '8.4']
     name: PHP ${{ matrix.php-versions }}
     steps:
-      - name: Set locales
-        run: |
-          sudo locale-gen de_DE.utf8 && \
-          sudo locale-gen en_US.utf8 && \
-          sudo locale-gen fr_FR.utf8 && \
-          sudo dpkg-reconfigure --frontend=noninteractive locales
-
-      - name: Install Gettext
-        run: sudo apt-get install gettext
-
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Install Gettext
+        run: |
+          sudo apt-get update && \
+          sudo apt-get install -y gettext
+
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          extensions: gd, xml, curl, mbstring, intl, gettext
+          extensions: gd, xml, curl, mbstring, intl, gettext, ldap
           tools: composer:v2
 
+      - name: Allow APT Release label changes # workaround for https://github.com/oerdnj/deb.sury.org/issues/2295
+        run: echo 'Acquire::AllowReleaseInfoChange::Label "true";' | sudo tee /etc/apt/apt.conf.d/label_change
+
       - name: Check PHP version
         run: php -v
 
       - name: Setup Composer from PHP version + update
         run: composer config --unset platform && composer config platform.php ${{ matrix.php-versions }}
 
       - name: Update dependencies for PHP 8.x
-        if: ${{ matrix.php-versions == '8.0' || matrix.php-versions == '8.1' }}
         run: |
-          composer update && \
-          composer remove --dev phpunit/phpunit && \
-          composer require --dev phpunit/php-text-template ^2.0 && \
-          composer require --dev phpunit/phpunit ^9.0
+          composer update
+
+      - name: Install locales
+        run: |
+          sudo apt-get update && \
+          sudo apt-get install -y locales
+
+      - name: Set locales
+        run: |
+          sudo locale-gen de_DE.utf8 && \
+          sudo locale-gen en_US.utf8 && \
+          sudo locale-gen fr_FR.utf8
 
-      - name: Update dependencies for PHP 7.x
-        if: ${{ matrix.php-versions != '8.0' && matrix.php-versions != '8.1' }}
-        run: composer update
+      - name: Check locales
+        run: locale -a
 
       - name: Clean up
         run: make clean
@@ -60,7 +64,7 @@ jobs:
         run: make all_tests
 
   node:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -83,7 +87,7 @@ jobs:
         run: make sasslint
 
   python:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -97,7 +101,7 @@ jobs:
         run: make htmldoc
 
   trivy-repo:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/docker-latest.yml

@@ -4,7 +4,7 @@ on:
     branches: [ master ]
 jobs:
   docker-build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3

.github/workflows/docker-pr.yml

@@ -5,7 +5,7 @@ on:
 
 jobs:
   docker-build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3

.github/workflows/docker-tags.yml

@@ -8,7 +8,7 @@ on:
       - release
 jobs:
   docker-build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Get the tag name
         run: echo "REF=${GITHUB_REF##*/}" >> $GITHUB_ENV

.github/workflows/trivy-release.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   trivy-repo:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: trivy scan (release composer/yarn dependencies)
     steps:
       - name: Checkout
@@ -16,7 +16,7 @@ jobs:
       - name: Run trivy scanner on repository
         run: make test_trivy_repo TRIVY_TARGET_BRANCH=origin/release TRIVY_EXIT_CODE=1
   trivy-docker:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: trivy scan (release docker image)
     steps:
       - name: Checkout

AUTHORS

@@ -1,9 +1,9 @@
   1221	ArthurHoaro <arthur@hoa.ro>
-   518	nodiscc <nodiscc@gmail.com>
+   544	nodiscc <nodiscc@gmail.com>
    405	VirtualTam <virtualtam@flibidi.net>
     56	Sébastien Sauvage <sebsauvage@sebsauvage.net>
-    31	Keith Carangelo <mail@kcaran.com>
-    28	dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
+    33	Keith Carangelo <mail@kcaran.com>
+    29	dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
     16	Luce Carević <lcarevic@access42.net>
     15	Florian Eula <eula.florian@gmail.com>
     14	Emilien Klein <emilien@klein.st>
@@ -25,10 +25,13 @@
      3	Andreas Waschinski <25221082+waschinski@users.noreply.github.com>
      3	Christoph Stoettner <christoph.stoettner@stoeps.de>
      3	Olivier <bourreauolivier@gmail.com>
+     3	Robert Riebisch <15858666+bttrx@users.noreply.github.com>
      3	Teromene <teromene@teromene.fr>
      3	yudete <yu@yude.moe>
+     2	7Ds7 <7Ds7@users.noreply.github.com>
      2	Alexander Railean <alexandr.railean@arculus.de>
      2	Alexandre G.-Raymond <alex@ndre.gr>
+     2	BinaryUnit <admin@binaryunit.com>
      2	Chris Kuethe <chris.kuethe@gmail.com>
      2	Doug Breaux <25640850+dougbreaux@users.noreply.github.com>
      2	Felix Bartels <felix@host-consultants.de>
@@ -40,17 +43,16 @@
      2	Miloš Jovanović <mjovanovic@gmail.com>
      2	Neros <contact@neros.fr>
      2	Qwerty <champlywood@free.fr>
-     2	Robert Riebisch <15858666+bttrx@users.noreply.github.com>
      2	Sebastien Wains <sebw@users.noreply.github.com>
      2	Stephen Muth <smuth4@gmail.com>
+     2	Thibaud CANALE <thican@thican.net>
      2	Timo Van Neerden <fire@lehollandaisvolant.net>
      2	flow.gunso <flow.gunso@gmail.com>
      2	julienCXX <software@chmodplusx.eu>
      2	philipp-r <philipp-r@users.noreply.github.com>
      2	pips <pips@e5150.fr>
      2	prog-it <pash.vld@gmail.com>
      2	trailjeep <trailjeep@gmail.com>
-     1	7Ds7 <7Ds7@users.noreply.github.com>
      1	Adrien Oliva <adrien.oliva@yapbreak.fr>
      1	Adrien le Maire <adrien@alemaire.be>
      1	Ajabep <ajabep@users.noreply.github.com>
@@ -70,6 +72,7 @@
      1	Denis Renning <denis@devtty.de>
      1	Dennis Verspuij <dennisverspuij@users.noreply.github.com>
      1	Dimtion <zizou.xena@gmail.com>
+     1	Eric Masson <emss.ads@gmail.com>
      1	Fanch <fanch-github@qth.fr>
      1	Felix Kästner <github.qkg1.top-fpunktk@fpunktk.de>
      1	Florian Voigt <flvoigt@me.com>
@@ -96,7 +99,7 @@
      1	Paul van den Burg <github@paulvandenburg.nl>
      1	Rajat Hans <rajathans9@gmail.com>
      1	Sbgodin <Sbgodin@users.noreply.github.com>
-     1	Thibaud CANALE <thican@thican.net>
+     1	Tai Lam <47955724+taivlam@users.noreply.github.com>
      1	ToM <tom@leloop.org>
      1	TsT <tst2005@gmail.com>
      1	agentcobra <agentcobra@free.fr>
@@ -106,6 +109,7 @@
      1	clach04 <clach04@gmail.com>
      1	dimtion <zizou.xena@gmail.com>
      1	durcheinandr <jochen@durcheinandr.de>
+     1	emss-github <54211944+emss-github@users.noreply.github.com>
      1	heimpogo <hypertexthome@googlemail.com>
      1	jalr <mail@jalr.de>
      1	lapineige <lapineige@users.noreply.github.com>

CHANGELOG.md

@@ -6,17 +6,48 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ------------------------
 
-## [v0.14.0](https://github.com/shaarli/Shaarli/releases/tag/v0.14.0) - UNRELEASED
+## [v0.15.0](https://github.com/shaarli/Shaarli/releases/tag/v0.15.0) - 2025-08-16
+
+### Added
+
+* doc: add SECURITY.md
+* doc: Added colorscheme and youtube plugins, and shirley-template
+
+### Changed
+
+* refactor video plugin
+* github actions: update/pin all base images to ubuntu-24.04
+* github actions: workaround for ondrej/php apt repository update error
+* github actions: re-enable currently supported PHP versions in the test matrix
+* docker: udpate base alpine image to v3.19.7
+
+### Fixed
+
+* Fix `PHP message: TypeError: get_headers(): Argument #2 ($associative) must be of type bool, int given`
+* doc: fix typos and inconsistencies
+
+### Security
+
+* fix insufficient filename sanitization in bookmarks import form
+* fix reflected XSS via searchtags parameter*
+* keep private links number private
+
+**Full Changelog**: https://github.com/shaarli/Shaarli/compare/v0.14.0...v0.15.0
+
+
+------------------------
+
+## [v0.14.0](https://github.com/shaarli/Shaarli/releases/tag/v0.14.0) - 2024-12-08
 
 ### Added
 
 * doc: add third party plugins clickcounter and targetblank by @waschinski in https://github.com/shaarli/Shaarli/pull/2063
 * doc: add shaarli-offen plugin to Community & related software by @waschinski in https://github.com/shaarli/Shaarli/pull/2064
 * doc: add Shaanti browser extension to Community & related software by @7Ds7 in https://github.com/shaarli/Shaarli/pull/2078
 * doc: add image-upload plugin to Community & related software by @bttrx in https://github.com/shaarli/Shaarli/pull/2097
-* doc: add shaarli2bluesky plugin to Community & related software by @bttrx in https://github.com/shaarli/Shaarli/pull/2097
+* doc: add shaarli2bluesky plugin to Community & related software by @kalvn in https://github.com/shaarli/Shaarli/pull/2111
 * doc: server configuration: allow accessing and caching SVG assets by @nodiscc in https://github.com/shaarli/Shaarli/pull/2074
-* doc: usage: document "Sticky" mode by @kalvn in https://github.com/shaarli/Shaarli/pull/2111
+* doc: usage: document "Sticky" mode by @nodiscc in https://github.com/shaarli/Shaarli/pull/2055
 * doc: troubleshooting: add solution for `Allowed memory size of xxx bytes exhausted` by @nodiscc in https://github.com/shaarli/Shaarli/pull/2083
 * doc: usage: add opensearch/browser search engine integration instructions by @nodiscc in https://github.com/shaarli/Shaarli/pull/2096
 * doc: troubleshooting: list more cases in which title retrieval fails by @nodiscc in https://github.com/shaarli/Shaarli/pull/2060

Dockerfile

@@ -25,7 +25,7 @@ RUN cd shaarli \
 
 # Stage 4:
 # - Shaarli image
-FROM docker.io/alpine:3.19.4
+FROM docker.io/alpine:3.19.7
 LABEL maintainer="Shaarli Community"
 
 RUN apk --no-cache del icu-data-en \

Makefile

@@ -76,17 +76,13 @@ test: translate
 	@$(BIN)/phpunit --coverage-php coverage/main.cov --bootstrap tests/bootstrap.php --testsuite unit-tests
 
 locale_test_%:
-	@UT_LOCALE=$*.utf8 \
+	@LANG=$*.utf8 \
 		$(BIN)/phpunit \
 		--coverage-php coverage/$(firstword $(subst _, ,$*)).cov \
 		--bootstrap tests/languages/bootstrap.php \
 		--testsuite language-$(firstword $(subst _, ,$*))
 
 all_tests: test locale_test_de_DE locale_test_en_US locale_test_fr_FR
-	@# --The current version is not compatible with PHP 7.2
-	@#$(BIN)/phpcov merge --html coverage coverage
-	@# --text doesn't work with phpunit 4.* (v5 requires PHP 5.6)
-	@#$(BIN)/phpcov merge --text coverage/txt coverage
 
 ### download 3rd-party PHP libraries, including dev dependencies
 composer_dependencies_dev: clean