Skip to main content

max / makenotwork

Release mnw-server v0.11.16 0.11.15's clippy gate caught needless raw-string hashes in the carousel's XSS test. Missed locally because clippy was run over --lib, which skips the test targets the gate compiles.
Co-Authored-By
Claude Opus 5 (1M context) <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-08-14 17:55 UTC
Signed with PGP, not checked
Commit: bbf6e2584635e9d361378233bf9d0b28d061c3ad
Parent: a4e7df9
4 files changed, +16 insertions, -16 deletions
M server/Cargo.lock +13 -13
@@ -5196,7 +5196,7 @@
5196 5196
5197 5197 [[package]]
5198 5198 name = "makenotwork"
5199 - version = "0.11.15"
5199 + version = "0.11.16"
5200 5200 dependencies = [
5201 5201 "ammonia",
5202 5202 "anyhow",
@@ -10687,6 +10687,18 @@
10687 10687 "pkg-config",
10688 10688 ]
10689 10689
10690 + [[patch.unused]]
10691 + name = "quasi-immediate"
10692 + version = "0.3.0"
10693 +
10694 + [[patch.unused]]
10695 + name = "quasi-store"
10696 + version = "0.1.0"
10697 +
10698 + [[patch.unused]]
10699 + name = "quasi-tauri"
10700 + version = "0.3.0"
10701 +
10690 10702 [[patch.unused]]
10691 10703 name = "kberg"
10692 10704 version = "0.1.0"
@@ -10706,15 +10718,3 @@
10706 10718 [[patch.unused]]
10707 10719 name = "synckit-config"
10708 10720 version = "0.2.0"
10709 -
10710 - [[patch.unused]]
10711 - name = "quasi-immediate"
10712 - version = "0.3.0"
10713 -
10714 - [[patch.unused]]
10715 - name = "quasi-store"
10716 - version = "0.1.0"
10717 -
10718 - [[patch.unused]]
10719 - name = "quasi-tauri"
10720 - version = "0.3.0"
M server/Cargo.toml +1 -1
@@ -1,6 +1,6 @@
1 1 [package]
2 2 name = "makenotwork"
3 - version = "0.11.15"
3 + version = "0.11.16"
4 4 edition = "2024"
5 5 license = "LicenseRef-PolyForm-Noncommercial-1.0.0"
6 6 # Server binary: never published to a registry. Marks the crate private so
M server/openapi.json +1 -1
@@ -6,7 +6,7 @@
6 6 "license": {
7 7 "name": "PolyForm Noncommercial 1.0.0"
8 8 },
9 - "version": "0.11.15"
9 + "version": "0.11.16"
10 10 },
11 11 "paths": {
12 12 "/api/git/{owner}/{repo}/notes": {
M server/src/quasi/widgets/carousel.rs +1 -1
@@ -198,7 +198,7 @@
198 198 fn a_hostile_source_cannot_break_out_of_the_attribute() {
199 199 let html = render(
200 200 "g",
201 - vec![Frame::new(r#"x" onerror="alert(1)"#, r#"</title><script>"#)],
201 + vec![Frame::new(r#"x" onerror="alert(1)"#, "</title><script>")],
202 202 );
203 203 assert!(!html.contains("onerror=\"alert"), "{html}");
204 204 assert!(!html.contains("<script>"), "{html}");