Merge branch 'hotfix/1.4.3'

Author: overheadhunter

CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.3](https://github.com/cryptomator/hub/compare/1.4.2...1.4.3)
+
+### Changed
+
+- Updated Keycloak to 26.2.5
+- Updated to Quarkus 3.20.1 LTS
+
+### Fixed
+
+- Health check in Docker Compose not working due to curl missing from native images (#344, #249)
+- Bumped build time dependencies (fixes CVE-2025-5889, CVE-2025-46565, neither affected any Hub release)
+
+
 ## [1.4.2](https://github.com/cryptomator/hub/compare/1.4.1...1.4.2)
 
 ### Fixed
@@ -191,4 +204,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - CVE-2023-45133: Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code 
 - CVE-2024-4068: Uncontrolled resource consumption in braces
-- CVE-2024-39338: Server-Side Request Forgery in axios
+- CVE-2024-39338: Server-Side Request Forgery in axios

backend/pom.xml

@@ -4,13 +4,13 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.cryptomator</groupId>
   <artifactId>hub-backend</artifactId>
-  <version>1.4.2</version>
+  <version>1.4.3</version>
 
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <project.jdk.version>21</project.jdk.version>
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
-    <quarkus.platform.version>3.15.4</quarkus.platform.version>
+    <quarkus.platform.version>3.20.1</quarkus.platform.version>
     <jwt.version>4.5.0</jwt.version>
     <compiler-plugin.version>3.14.0</compiler-plugin.version>
     <dependency-plugin.version>3.8.1</dependency-plugin.version>

backend/src/main/docker/Dockerfile.native

@@ -9,9 +9,17 @@ RUN ./mvnw -B quarkus:go-offline --no-transfer-progress
 COPY src /code/src
 RUN ./mvnw -B package -Dnative -DskipTests --no-transfer-progress --strict-checksums
 
+# install additional packages
+FROM registry.access.redhat.com/ubi9 AS installer
+RUN mkdir -p /mnt/rootfs
+RUN dnf install --installroot /mnt/rootfs curl --releasever 9 --setopt install_weak_deps=false --nodocs -y \
+    && dnf --installroot /mnt/rootfs clean all \
+    && rpm --root /mnt/rootfs -e --nodeps setup
+
 ## Stage 2 : create the docker final image
 FROM quay.io/quarkus/quarkus-micro-image:2.0
 COPY --from=builder /code/target/*-runner /work/application
+COPY --from=installer /mnt/rootfs /
 WORKDIR /work/
 
 # set up permissions for user `1001`

backend/src/main/resources/application.properties

@@ -17,8 +17,8 @@ hub.keycloak.realm=cryptomator
 
 hub.managed-instance=false
 
-quarkus.resteasy-reactive.path=/api
-%test.quarkus.resteasy-reactive.path=/
+quarkus.rest.path=/api
+%test.quarkus.rest.path=/
 
 quarkus.http.port=8080
 
@@ -33,7 +33,7 @@ hub.keycloak.oidc.cryptomator-client-id=cryptomator
 %dev.quarkus.keycloak.devservices.start-command=start-dev
 %dev.quarkus.keycloak.devservices.port=8180
 %dev.quarkus.keycloak.devservices.service-name=quarkus-cryptomator-hub
-%dev.quarkus.keycloak.devservices.image-name=ghcr.io/cryptomator/keycloak:26.1.5
+%dev.quarkus.keycloak.devservices.image-name=ghcr.io/cryptomator/keycloak:26.2.5
 %dev.quarkus.oidc.devui.grant.type=code
 # OIDC will be mocked during unit tests. Use fake auth url to prevent dev services to start:
 %test.quarkus.oidc.auth-server-url=http://localhost:43210/dev/null

frontend/package-lock.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "name": "cryptomator-hub",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "description": "Web-Frontend for Cryptomator Hub",
   "author": "Skymatic GmbH",
   "license": "AGPL-3.0-or-later",
@@ -48,17 +48,18 @@
     "ts-node": "^10.9.2",
     "typescript": "^5.8.3",
     "typescript-eslint": "^8.29.1",
-    "vite": "^6.2.6",
+    "vite": "^6.3.5",
     "vue-tsc": "^2.2.8"
   },
   "dependencies": {
+    "@headlessui/tailwindcss": "^0.2.2",
     "@headlessui/vue": "^1.7.23",
     "@heroicons/vue": "^2.2.0",
     "axios": "^1.8.4",
     "file-saver": "^2.0.5",
     "jdenticon": "^3.3.0",
     "jszip": "^3.10.1",
-    "keycloak-js": "^26.1.5",
+    "keycloak-js": "^26.2.0",
     "miscreant": "^0.3.2",
     "rfc4648": "^1.5.4",
     "semver": "^7.7.1",

frontend/package.json

@@ -150,7 +150,7 @@ export class JWEBuilder {
       apu: base64url.stringify(apu, { pad: false }),
       apv: base64url.stringify(apv, { pad: false })
     })();
-    const encryptedKey = (async () => Uint8Array.of())(); // empty for Direct Key Agreement as per spec
+    const encryptedKey = Promise.resolve(Uint8Array.of()); // empty for Direct Key Agreement as per spec
     const cek = (async () => ECDH_ES.deriveContentKey(recipientPublicKey, (await ephemeralKey).privateKey, 384, 32, await header))();
     return new JWEBuilder(header, encryptedKey, cek);
   }

frontend/src/common/jwe.ts

@@ -105,12 +105,12 @@
                           <ListboxOption 
                             v-for="(label, key) in eventTypeOptions" 
                             :key="key" 
-                            v-slot="{ selected }" 
+                            v-slot="{ active, selected }" 
                             class="relative cursor-default select-none py-2 pl-3 pr-9 ui-not-active:text-gray-900 ui-active:text-white ui-active:bg-primary" 
                             :value="key"
                           >
                             <span :class="[selected ? 'font-semibold' : 'font-normal', 'block truncate']">{{ label }}</span>
-                            <span v-if="selected" :class="['absolute inset-y-0 right-0 flex items-center pr-4', selected ? 'text-primary' : 'text-gray-400']">
+                            <span v-if="selected" :class="[active ? 'text-white' : 'text-primary', 'absolute inset-y-0 right-0 flex items-center pr-4']">
                               <CheckIcon class="h-5 w-5" aria-hidden="true" />
                             </span>
                           </ListboxOption>

frontend/src/components/AuditLog.vue

@@ -35,13 +35,13 @@
                 <ListboxOptions class="absolute z-10 mt-1 max-h-60 w-full overflow-auto rounded-md bg-white py-1 shadow-lg ring-1 ring-black/5 focus:outline-hidden text-sm">
                   <ListboxOption v-slot="{ active, selected }" :value="browserLocale" class="relative cursor-default select-none py-2 pl-3 pr-9 ui-not-active:text-gray-900 ui-active:text-white ui-active:bg-primary" @click="saveLanguage(undefined)">
                     <span :class="[selected || active ? 'font-semibold' : 'font-normal', 'block truncate']">{{ t('userProfile.actions.changeLanguage.entry.browser') }}</span>
-                    <span v-if="selected" :class="['absolute inset-y-0 right-0 flex items-center pr-4', selected ? 'text-primary' : 'text-gray-400']">
+                    <span v-if="selected" :class="[active ? 'text-white' : 'text-primary', 'absolute inset-y-0 right-0 flex items-center pr-4']">
                       <CheckIcon class="h-5 w-5" aria-hidden="true" />
                     </span>
                   </ListboxOption>
                   <ListboxOption v-for="availableLocale in Locale" :key="availableLocale" v-slot="{ active, selected }" class="relative cursor-default select-none py-2 pl-3 pr-9 ui-not-active:text-gray-900 ui-active:text-white ui-active:bg-primary" :value="availableLocale" @click="saveLanguage(availableLocale)">
                     <span :class="[selected || active ? 'font-semibold' : 'font-normal', 'block truncate']">{{ t(`locale.${availableLocale}`) }}</span>
-                    <span v-if="selected" :class="['absolute inset-y-0 right-0 flex items-center pr-4', selected ? 'text-primary' : 'text-gray-400']">
+                    <span v-if="selected" :class="[active ? 'text-white' : 'text-primary', 'absolute inset-y-0 right-0 flex items-center pr-4']">
                       <CheckIcon class="h-5 w-5" aria-hidden="true" />
                     </span>
                   </ListboxOption>

frontend/src/components/UserProfile.vue

@@ -1,6 +1,7 @@
 @import 'tailwindcss';
 
 @plugin '@tailwindcss/forms';
+@plugin '@headlessui/tailwindcss';
 
 @theme {
   --font-*: initial;