CI: pin runners to ubuntu-24.04, tinymce 8.10.0 for GHSA-mf2p-h6hf-fcwm

.github/workflows/ci-browser-security.yml

@@ -18,7 +18,7 @@ concurrency:
 jobs:
   browser-security:
     name: Packaged app · 3 browsers · axe-core · OWASP ZAP
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 75
     permissions:
       contents: read # Build and scan the checked-out application.

.github/workflows/ci-database-compatibility.yml

@@ -18,7 +18,7 @@ concurrency:
 jobs:
   database:
     name: ${{ matrix.database.name }} schema and behavior
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 35
     permissions:
       contents: read # Read application, schema and test sources.

.github/workflows/ci-deep-regression.yml

@@ -19,7 +19,7 @@ concurrency:
 jobs:
   regression:
     name: Browser regression shard ${{ matrix.shard }}/4
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 120
     strategy:
       fail-fast: false
@@ -250,7 +250,7 @@ jobs:
 
   installer-locales:
     name: Fresh installer (${{ matrix.locale }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     strategy:
       fail-fast: false

.github/workflows/ci-e2e.yml

@@ -17,7 +17,7 @@ concurrency:
 jobs:
   e2e:
     name: Full E2E suite (Playwright · Apache · MySQL)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
 
     services:

.github/workflows/ci-quality.yml

@@ -40,7 +40,7 @@ concurrency:
 jobs:
   quality:
     name: Static quality checks
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     # MySQL for the DB-backed unit tests (migration-*, book-field-types,
     # loan-edge-cases, session-fixes). Without it those tests can't read a DB
@@ -376,7 +376,7 @@ jobs:
 
   php-compatibility:
     name: PHP ${{ matrix.php }} compatibility
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -403,7 +403,7 @@ jobs:
 
   frontend:
     name: Frontend audit, lint and reproducible build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:

.github/workflows/ci-real-upgrade.yml

@@ -29,7 +29,7 @@ concurrency:
 jobs:
   emeroteca-412:
     name: Emeroteca 412 — previous release upgraded through the admin UI
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
 
     services:

.github/workflows/ci-security-supply-chain.yml

@@ -18,7 +18,7 @@ concurrency:
 jobs:
   workflow-security:
     name: Workflow, YAML and shell security
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     permissions:
       contents: read # Read workflow and script sources.
@@ -58,7 +58,7 @@ jobs:
   dependency-review:
     name: Dependency diff policy
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       contents: read # Compare dependency manifests in the pull request.
@@ -75,7 +75,7 @@ jobs:
 
   repository-security:
     name: Secrets, vulnerabilities and misconfigurations
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 25
     permissions:
       contents: read # Scan the repository and complete Git history.
@@ -108,7 +108,7 @@ jobs:
 
   release-artifact:
     name: Reproducible release, SBOM and archive audit
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 35
     permissions:
       contents: read # Build the release from checked-out sources.

.github/workflows/ci-upgrade-smoke.yml

@@ -35,7 +35,7 @@ concurrency:
 jobs:
   upgrade-smoke:
     name: Upgrade from latest release → verify schema
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     services:
       mysql:

.github/workflows/codeql.yml

@@ -19,7 +19,7 @@ concurrency:
 jobs:
   analyze:
     name: Analyze (javascript-typescript)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       security-events: write # Upload CodeQL SARIF results.
       actions: read # Read workflow metadata for private-repository analysis.

.github/workflows/pullfrog.yml

@@ -28,7 +28,7 @@ permissions:
 jobs:
   pullfrog:
     name: Pullfrog agent
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45 # Two bounded attempts plus checkout and cleanup.
     env:
       # Whether a second subscription token is configured. Only the presence is

.github/workflows/release.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   build:
     name: Verify and build release (read-only)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     permissions:
       contents: read # Checkout and inspect the tagged source; never publish from this job.
@@ -152,7 +152,7 @@ jobs:
   publish:
     name: Attest and publish verified release
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     permissions:
       contents: write # Create the GitHub Release and upload its assets.

.github/workflows/test-migrations.yml

@@ -25,7 +25,7 @@ jobs:
   # version is silently ignored by the updater (version_compare guard).
   verify-versions:
     name: Verify migration versions ≤ release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
@@ -62,7 +62,7 @@ jobs:
   # assertion is the real pass/fail gate.
   test-full-chain:
     name: Full migration chain (schema → all migrations)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     services:
       mysql:
@@ -196,7 +196,7 @@ jobs:
   # ─── Job 3: existing single-migration test (upgrade 0.3.x → 0.4.0) ─────────
   test-migrations:
     name: Legacy migration regression (0.3.x to 0.4.0)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     services:
       mysql:

.gitleaksignore

@@ -0,0 +1,39 @@
+# Gitleaks fingerprints (commit:path:rule:line) for findings in the full-history
+# scan that are documentation examples or published test vectors, not secrets.
+# The pull_request and push runs only scan the changed range; the scheduled and
+# manual runs scan every commit and were failing on these 28 entries.
+#
+# api-book-scraper docs and views: placeholder keys in curl examples
+b868a6b5d2180172b101171ac9eb98ae3e65ce5f:storage/plugins/api-book-scraper/README.md:stripe-access-token:43
+b868a6b5d2180172b101171ac9eb98ae3e65ce5f:storage/plugins/api-book-scraper/SERVER_IMPLEMENTATION_GUIDE.md:stripe-access-token:89
+b868a6b5d2180172b101171ac9eb98ae3e65ce5f:storage/plugins/api-book-scraper/SERVER_IMPLEMENTATION_GUIDE.md:stripe-access-token:113
+b868a6b5d2180172b101171ac9eb98ae3e65ce5f:storage/plugins/api-book-scraper/SERVER_IMPLEMENTATION_GUIDE.md:curl-auth-header:1034
+b868a6b5d2180172b101171ac9eb98ae3e65ce5f:storage/plugins/api-book-scraper/SERVER_IMPLEMENTATION_GUIDE.md:curl-auth-header:1039
+b868a6b5d2180172b101171ac9eb98ae3e65ce5f:storage/plugins/api-book-scraper/SERVER_IMPLEMENTATION_GUIDE.md:curl-auth-header:1043
+b868a6b5d2180172b101171ac9eb98ae3e65ce5f:app/Views/admin/plugins.php:stripe-access-token:426
+84f14515c448bbadf6ee55cec463ba858a32faa4:app/Views/admin/plugins.php:stripe-access-token:474
+c9453c46fe2225531790a2edc90c25b1cb667f05:app/Views/admin/plugins.php:stripe-access-token:474
+# Settings page and admin docs: "your-api-key-here" style curl examples
+16ba645f1f990600f69d3842ce3bcd319fbe15f0:app/Views/settings/advanced-tab.php:curl-auth-header:607
+b868a6b5d2180172b101171ac9eb98ae3e65ce5f:app/Views/settings/advanced-tab.php:curl-auth-header:684
+e851035fbe920538a6bf8fc5980312891e4eb878:admin/configurazione.md:curl-auth-header:546
+# z39-server plugin: array literals matched by the generic rule
+412253a18455260a5a793b04df36acc23712e7d2:storage/plugins/z39-server/Z39ServerPlugin.php:generic-api-key:122
+b868a6b5d2180172b101171ac9eb98ae3e65ce5f:storage/plugins/z39-server/Z39ServerPlugin.php:generic-api-key:126
+b868a6b5d2180172b101171ac9eb98ae3e65ce5f:storage/plugins/z39-server/Z39ServerPlugin.php:generic-api-key:169
+# French translation strings matched by the generic rule
+ad01c97eb68aefad0c1067adfd8377d8f882fa89:locale/fr_FR.json:generic-api-key:2861
+3511b34a1e45f1f59a02cd2ebedf36f7dfe32f3e:locale/fr_FR.json:generic-api-key:2867
+8cfb76efc76183f5fdffb702d682238b2b5dcaac:locale/fr_FR.json:generic-api-key:2871
+320d3a3df0475fbe34d765e50b243499bd5b1414:locale/fr_FR.json:generic-api-key:2874
+9d70038db598cccc7ab2f2f5941e1ff3a66a75cb:locale/fr_FR.json:generic-api-key:4439
+# Update scripts: option names matched by the generic rule
+03a8f3e1f75140af13b065d9b52b1d41ebf63e96:scripts/manual-update.php:generic-api-key:443
+5e4ea3f42c694595559f9122932a0eb9fec023e7:scripts/manual-upgrade.php:generic-api-key:569
+f0b1f8b5d473119235892e5dcec8860937eb8f67:test-updater/manual-update.php:generic-api-key:443
+# Tests: RFC 8291 Appendix A web-push vectors and fixture strings
+abbe641a9221c29f1ed009bde2873835b53c20f7:tests/mobile-webpush-encryption.unit.php:private-key:25
+abbe641a9221c29f1ed009bde2873835b53c20f7:tests/mobile-webpush-encryption.unit.php:generic-api-key:34
+ac4fcabc00953f3fd5f5c9d59fe5fb5da7f744cb:tests/schema-integrity.spec.js:generic-api-key:91
+5eb52517f88d1ea3fadfffc1f92af21dbd9a1da2:tests/schema-integrity.spec.js:generic-api-key:117
+8cfea8b8d47a8df9efef4d203ca96d8697203908:tests/security-hardening.spec.js:generic-api-key:37

.rsync-filter

@@ -220,6 +220,8 @@
 - /.github/
 - /docs/
 - /*.md
+# Upstream TinyMCE changelog: gitignored, never part of the release.
+- /public/assets/tinymce/CHANGELOG.md
 - .travis.yml
 - .circleci/
 - azure-pipelines.yml

package.json

@@ -34,7 +34,7 @@
   "dependencies": {
     "sortablejs": "^1.15.6",
     "star-rating.js": "^4.3.1",
-    "tinymce": "^8.1.2"
+    "tinymce": "^8.10.0"
   },
   "devDependencies": {
     "@axe-core/playwright": "4.13.0",

public/assets/tinymce/README.md

@@ -74,4 +74,4 @@ Visit the [TinyMCE website](https://tiny.cloud/) and check out the [TinyMCE docu
 
 ## License
 
-Licensed under the terms of GNU General Public License Version 2 or later. For full details about the license, please check the LICENSE.md file.
+License terms can be found in the license.md file.

public/assets/tinymce/bower.json

@@ -1,7 +1,7 @@
 {
 	"name": "tinymce",
 	"description": "Web based JavaScript HTML WYSIWYG editor control.",
-	"license": "GPL-2.0-or-later",
+	"license": "SEE LICENSE IN license.md",
 	"keywords": [
 		"wysiwyg",
 		"tinymce",

public/assets/tinymce/composer.json

@@ -1,9 +1,9 @@
 {
 	"name": "tinymce/tinymce",
-	"version": "8.1.2",
+	"version": "8.10.0",
 	"description": "Web based JavaScript HTML WYSIWYG editor control.",
 	"license": [
-		"GPL-2.0-or-later"
+		"SEE LICENSE IN license.md"
 	],
 	"keywords": [
 		"wysiwyg",