Commit graph

3354 commits

Author SHA1 Message Date
David Mehren
2bec179272
Merge pull request #1412 from hedgedoc/renovate/master-prismjs-1.x
chore(deps): update dependency prismjs to v1.24.0 (master)
2021-07-03 10:28:11 +02:00
David Mehren
9553c7193b
Merge pull request #1422 from hedgedoc/renovate/master-linters
chore(deps): update dependency eslint to v7.30.0 (master)
2021-07-03 10:27:24 +02:00
David Mehren
efae24bfff
Merge pull request #1408 from hedgedoc/renovate/master-mini-css-extract-plugin-1.x
chore(deps): update dependency mini-css-extract-plugin to v1.6.2 (master)
2021-07-03 10:26:51 +02:00
Renovate Bot
b50005842e
chore(deps): update dependency prismjs to v1.24.0
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-07-03 08:16:59 +00:00
Renovate Bot
639a8bedd8
chore(deps): update dependency eslint to v7.30.0
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-07-03 08:16:30 +00:00
Renovate Bot
19c0125edf
chore(deps): update dependency mini-css-extract-plugin to v1.6.2
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-07-03 08:16:02 +00:00
David Mehren
4263cbf5b0
Merge pull request #1395 from hedgedoc/renovate/master-test-packages
chore(deps): update dependency mocha to v9.0.1 (master)
2021-07-03 10:14:38 +02:00
Renovate Bot
cbf3c51edd
chore(deps): update dependency mocha to v9.0.1
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-07-03 08:03:11 +00:00
David Mehren
53bfb8d149
Merge pull request #1415 from hedgedoc/renovate/master-turndown-7.x
chore(deps): update dependency turndown to v7.1.1 (master)
2021-07-03 09:59:22 +02:00
David Mehren
5d66755831
Merge pull request #1406 from hedgedoc/renovate/master-mkdocs-material-7.x
chore(deps): update dependency mkdocs-material to v7.1.9 (master)
2021-07-03 09:57:08 +02:00
Renovate Bot
c8472b5823
chore(deps): update dependency turndown to v7.1.1
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-29 16:57:05 +00:00
Renovate Bot
f0110eae23
chore(deps): update dependency mkdocs-material to v7.1.9
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-25 10:53:38 +00:00
David Mehren
3c504f2dc9
Merge pull request #1387 from hedgedoc/renovate/master-lock-file-maintenance 2021-06-21 14:00:13 +02:00
Renovate Bot
bfa2eac7f5
chore(deps): lock file maintenance
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-21 11:35:26 +00:00
David Mehren
bf0c348e74
Merge pull request #1400 from hedgedoc/renovate/master-linters
chore(deps): update dependency eslint to v7.29.0 (master)
2021-06-21 13:30:37 +02:00
David Mehren
8ab65869ff
Merge pull request #1384 from hedgedoc/renovate/master-mkdocs-material-7.x
chore(deps): update dependency mkdocs-material to v7.1.8 (master)
2021-06-21 13:30:12 +02:00
Renovate Bot
26b8abe2a9
chore(deps): update dependency eslint to v7.29.0
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-18 20:29:58 +00:00
Renovate Bot
2125e9b98d
chore(deps): update dependency mkdocs-material to v7.1.8
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-12 14:17:30 +00:00
David Mehren
66bdbc1f43
Merge pull request #1370 from hedgedoc/feature/lazy_load 2021-06-12 16:16:22 +02:00
David Mehren
7ff685933e
Lazy-load highlight.js
This commit moves the import of highlight.js into a `require.ensure`
block, that is only executed when a code-block is actually present
in a note. Webpack automatically splits the library into a separate
chunk and loads that on demand.

The call to `hljs.listLanguages()` in `index.js` is also replaced
by a static list. This is important, as `index.js` would otherwise
need to import highlight.js, which would cause the quite big
library to be included into nearly every entrypoint, needlessly
increasing the transferred code size.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:29:27 +02:00
David Mehren
5b8b76135b
Lazy-load viz.js
This commit moves the import of viz.js into a `require.ensure` block,
that is only executed when a graphviz diagram is actually present
in a note. Webpack automatically splits the library into a separate
chunk and loads that on demand.

To ensure that graphviz code-blocks are not treated as normal
code-blocks while the chunk is loading, a corresponding check is added
to `finishView`.

The library is also removed from the Webpack config file, as it only
is used at one place in extra.js, which is handled by Webpack
without any extra config.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:29:26 +02:00
David Mehren
1c023e7881
Lazy-load abcjs
This commit moves the import of abcjs into a `require.ensure` block,
that is only executed when a abc diagram is actually present
in a note. Webpack automatically splits the library into a separate
chunk and loads that on demand.

To ensure that abc code-blocks are not treated as normal
code-blocks while the chunk is loading, a corresponding check is added
to `finishView`.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:29:26 +02:00
David Mehren
938afbddc3
Replace handlebars with string.replace
The html.hbs template does not contain any logic,
so we can replace the lib with good old string.replace calls.
This significantly reduces the bundle size, as we don't have to ship
a full template engine to the client.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:29:26 +02:00
David Mehren
b45b8b9c0d
Lazy-load mermaid
This commit moves the import of mermaid into a `require.ensure` block,
that is only executed when a mermaid diagram is actually present
in a note. Webpack automatically splits the library into a separate
chunk and loads that on demand.

To ensure that mermaid code-blocks are not treated as normal
code-blocks while the chunk is loading, a corresponding check is added
to `finishView`.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:26:03 +02:00
David Mehren
3f5755ed80
Merge pull request #1362 from hedgedoc/renovate/master-lock-file-maintenance
chore(deps): lock file maintenance (master)
2021-06-10 21:55:57 +02:00
Renovate Bot
33c1ce00e4
chore(deps): lock file maintenance
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-10 19:30:50 +00:00
David Mehren
3125217e17
Merge pull request #1381 from hedgedoc/renovate/master-mkdocs-1.x
chore(deps): update dependency mkdocs to v1.2.1 (master)
2021-06-10 21:27:35 +02:00
Renovate Bot
7dd0efa688
chore(deps): update dependency mkdocs to v1.2.1
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-09 17:35:54 +00:00
David Mehren
37605447e2
Merge pull request #1366 from hedgedoc/renovate/master-mkdocs-1.x
chore(deps): update dependency mkdocs to v1.2 (master)
2021-06-08 23:10:01 +02:00
Renovate Bot
0a7d0a74fa
chore(deps): update dependency mkdocs to v1.2
Signed-off-by: Renovate Bot <bot@renovateapp.com>
2021-06-08 20:35:36 +00:00
Yannick Bungers
1d082ae827
Merge pull request #1369 from hedgedoc/feature/remove_unsafe_eval 2021-06-08 22:16:07 +02:00
David Mehren
e7e1313691
Merge pull request #1371 from hedgedoc/feature/optimize_webpack 2021-06-08 21:09:44 +02:00
David Mehren
960f5c1b22
Merge pull request #1375 from hedgedoc/feature/yeet_google_analytics 2021-06-08 14:54:03 +02:00
David Mehren
f86fae3bd7
Don't use eval-based source maps
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 23:04:45 +02:00
David Mehren
3cd169a650
Remove unsafe-eval from default CSP
As script-loader was removed in the previous commits,
we can finally tighten up security.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 23:04:45 +02:00
David Mehren
2cecb9184b
Merge pull request #1368 from hedgedoc/feature/remove_script_loader 2021-06-07 22:58:35 +02:00
David Mehren
5e771c2f65
Update Content Security Policy docs
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 22:57:12 +02:00
David Mehren
7283ccd5e8
Allow configuring Disqus & GA CSP with env vars
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 22:57:12 +02:00
David Mehren
0c6482abc5
Add release notes for CSP changes
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 22:57:12 +02:00
David Mehren
52231f688d
Disable GA and Disqus in default CSP
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 22:57:12 +02:00
David Mehren
bf3b45bc11
Uninstall script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
fa1ed66088
Load abcjs from npm package
This also loads abcjs without script-loader.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
fddd97391b
Load gist-embed without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
1150c72fa7
Load handlebars without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
a98d184f2c
Load mermaid without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
bd62e79f7d
Load ot without script-loader
The ot library is tricky to load with Webpack, as it writes
it's functions into a global `ot` object and does not export anything.
I got it working using `exports-loader` to put the `ot` object
into a CommonJS export and then forcing Webpack to only
load using CommonJS.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
4f4a4cb747
Load jquery-textcomplete without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
2515ad962b
Load inline-attachment without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:35 +02:00
David Mehren
cf867daf99
Load Idle.js without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:23 +02:00
David Mehren
0e7a9df97d
Load jquery-ui resizable from npm package
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:23 +02:00