Changeset 0d5bd2c in Klonkt for CHANGELOG.md

Timestamp:

08/07/2026 03:57:42 PM (5 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

7d7b36d, 952baf3

Parents:

1ff801d

git-author:

Robin <roboburr@…> (08/07/2026 03:57:02 PM)

git-committer:

Robin <roboburr@…> (08/07/2026 03:57:42 PM)

Message:

chore(release): 1.7.0

Minor omdat de afhankelijkheden onder Klonkt verschoven zijn, niet omdat er
functionaliteit bij kwam: zeven adviezen dicht, waarvan sanitize-html kritiek
was en nodemailer drie hoofdversies opschoof.

Changelog in nl/en/de krijgt daarvoor een rubriek Beveiliging/Security/
Sicherheit -- die bestond nog niet, en dit is precies waar keep-a-changelog
hem voor heeft.

Co-Authored-By: Claude Opus 5 <noreply@…>

File:

• CHANGELOG.md (modified) (2 diffs)

CHANGELOG.md

@@ -5 +5 @@
 
 ## [Unreleased]
+
+## [1.7.0] · 2026-08-07
 
 ### Added
@@ -54 +56 @@
   — and because the app never saw the like, it could only offer "like" again and
   never undo it. Un-liking from an app now works.
+
+### Security
+
+- **Updated components close seven security advisories.** The heaviest one sat
+  in the library that cleans up posts arriving from elsewhere: a carefully built
+  post could slip a script past it, and a script running on your page can act as
+  if it were you. At the same time mail handling moved three major versions on,
+  closing a cluster of holes around sending — among them one where a prepared
+  name could smuggle commands into the conversation with the mail server, and
+  one where a message could end up at a different domain than the one addressed.
+  None of this changes how Klonkt looks or behaves. One advisory is knowingly
+  left open: it concerns a way of generating identifiers that Klonkt does not
+  use.
 
 ## [1.6.0] · 2026-07-31