From 67d6832be211600656560dd5c9e645a74c2c400e Mon Sep 17 00:00:00 2001 From: Alexey Date: Mon, 9 Feb 2026 15:32:54 +0300 Subject: [PATCH 1/7] update test URLs in domain plugins --- plugins/domains/tumblr.com/tumblr.photo.js | 6 ++++-- plugins/domains/vbox7.com.js | 5 ++++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/plugins/domains/tumblr.com/tumblr.photo.js b/plugins/domains/tumblr.com/tumblr.photo.js index 3ee26e90a..cbb8f7fe4 100644 --- a/plugins/domains/tumblr.com/tumblr.photo.js +++ b/plugins/domains/tumblr.com/tumblr.photo.js @@ -48,8 +48,10 @@ export default { }, tests: [{ - pageWithFeed: "http://lincolnmotorco.tumblr.com/" + pageWithFeed: "https://lincolnmotorco.tumblr.com/" }, - "http://fewthistle.tumblr.com/post/58045916432" + "https://fewthistle.tumblr.com/post/58045916432", + "https://butts-bouncing-on-the-beltway.tumblr.com/post/804116029629399040", + "https://tuulikki.tumblr.com/post/806272596495794176/what-is-the-sex-is-just-rock-climbing" ] }; diff --git a/plugins/domains/vbox7.com.js b/plugins/domains/vbox7.com.js index 3ed733d16..6cfeacc3b 100644 --- a/plugins/domains/vbox7.com.js +++ b/plugins/domains/vbox7.com.js @@ -17,6 +17,9 @@ export default { }, tests: [ - "http://www.vbox7.com/play:86abb51a7d?pos=src" + "https://www.vbox7.com/play:5ee2789f45", + "https://vbox7.com/play:41d3840bcb", + "https://www.vbox7.com/play:bc53a41285", + "https://www.vbox7.com/play:3008fee68a" ] }; \ No newline at end of file From 11eda3249fbd60e8286df5abd6a38bda62c86268 Mon Sep 17 00:00:00 2001 From: Alexey Date: Mon, 9 Feb 2026 15:55:27 +0300 Subject: [PATCH 2/7] tumblr: update test URLs --- plugins/domains/tumblr.com/tumblr.oembed.js | 4 +++- plugins/domains/tumblr.com/tumblr.photo.js | 8 +++----- plugins/domains/tumblr.com/tumblr.text.js | 4 +++- plugins/domains/vbox7.com.js | 3 +-- 4 files changed, 10 insertions(+), 9 deletions(-) diff --git a/plugins/domains/tumblr.com/tumblr.oembed.js b/plugins/domains/tumblr.com/tumblr.oembed.js index 2e3310b36..53584bcd7 100644 --- a/plugins/domains/tumblr.com/tumblr.oembed.js +++ b/plugins/domains/tumblr.com/tumblr.oembed.js @@ -37,6 +37,8 @@ export default { tests: [ "http://fewthistle.tumblr.com/post/58045916432", - "https://nasa.tumblr.com/post/186150527809/pew-pew-pew-imagine-slow-motion-fireworks-that" + "https://nasa.tumblr.com/post/186150527809/pew-pew-pew-imagine-slow-motion-fireworks-that", + "https://tuulikki.tumblr.com/post/806272596495794176/what-is-the-sex-is-just-rock-climbing", + "https://lincolnmotorco.tumblr.com/post/159272549438/the-1961-continental-convertible-photographed-at" ] }; \ No newline at end of file diff --git a/plugins/domains/tumblr.com/tumblr.photo.js b/plugins/domains/tumblr.com/tumblr.photo.js index cbb8f7fe4..8e7b91336 100644 --- a/plugins/domains/tumblr.com/tumblr.photo.js +++ b/plugins/domains/tumblr.com/tumblr.photo.js @@ -47,11 +47,9 @@ export default { return links; }, - tests: [{ - pageWithFeed: "https://lincolnmotorco.tumblr.com/" - }, + tests: [ "https://fewthistle.tumblr.com/post/58045916432", - "https://butts-bouncing-on-the-beltway.tumblr.com/post/804116029629399040", - "https://tuulikki.tumblr.com/post/806272596495794176/what-is-the-sex-is-just-rock-climbing" + "https://lincolnmotorco.tumblr.com/post/159272549438/the-1961-continental-convertible-photographed-at", + "https://the-wolf-and-moon.tumblr.com/post/622353448279621632/ngc-2170-angel-nebula" ] }; diff --git a/plugins/domains/tumblr.com/tumblr.text.js b/plugins/domains/tumblr.com/tumblr.text.js index 36a92569e..3c9725c0c 100644 --- a/plugins/domains/tumblr.com/tumblr.text.js +++ b/plugins/domains/tumblr.com/tumblr.text.js @@ -31,6 +31,8 @@ export default { }, tests: [{skipMethods: ["getData"]}, - "http://blog.slides.com/post/84828911898/slides-turns-one-year-old" + "http://blog.slides.com/post/84828911898/slides-turns-one-year-old", + "https://butts-bouncing-on-the-beltway.tumblr.com/post/804116029629399040", + "https://benimpencerelerim.tumblr.com/post/670837733034541056/muhafazakarligin-arkeolojisi" ] }; diff --git a/plugins/domains/vbox7.com.js b/plugins/domains/vbox7.com.js index 6cfeacc3b..c7653884a 100644 --- a/plugins/domains/vbox7.com.js +++ b/plugins/domains/vbox7.com.js @@ -17,8 +17,7 @@ export default { }, tests: [ - "https://www.vbox7.com/play:5ee2789f45", - "https://vbox7.com/play:41d3840bcb", + "https://vbox7.com/play:dacbe546dd", "https://www.vbox7.com/play:bc53a41285", "https://www.vbox7.com/play:3008fee68a" ] From 7032a13ef051956c49ae9ffbefa964a9e31972a9 Mon Sep 17 00:00:00 2001 From: Alexey Date: Mon, 9 Feb 2026 16:00:20 +0300 Subject: [PATCH 3/7] tumblr.text: remove bad test URL --- plugins/domains/tumblr.com/tumblr.text.js | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/plugins/domains/tumblr.com/tumblr.text.js b/plugins/domains/tumblr.com/tumblr.text.js index 3c9725c0c..e707f5957 100644 --- a/plugins/domains/tumblr.com/tumblr.text.js +++ b/plugins/domains/tumblr.com/tumblr.text.js @@ -31,8 +31,7 @@ export default { }, tests: [{skipMethods: ["getData"]}, - "http://blog.slides.com/post/84828911898/slides-turns-one-year-old", - "https://butts-bouncing-on-the-beltway.tumblr.com/post/804116029629399040", - "https://benimpencerelerim.tumblr.com/post/670837733034541056/muhafazakarligin-arkeolojisi" + "https://blog.slides.com/post/84828911898/slides-turns-one-year-old", + "https://butts-bouncing-on-the-beltway.tumblr.com/post/804116029629399040" ] }; From f1360d02762739876df1f88163c07a050526a005 Mon Sep 17 00:00:00 2001 From: Alexey Date: Mon, 9 Feb 2026 16:22:19 +0300 Subject: [PATCH 4/7] clips.twitch.tv: add parent to test URLs --- plugins/domains/twitch.tv/clips.twitch.tv.js | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/plugins/domains/twitch.tv/clips.twitch.tv.js b/plugins/domains/twitch.tv/clips.twitch.tv.js index 5499747b4..362be3bc4 100644 --- a/plugins/domains/twitch.tv/clips.twitch.tv.js +++ b/plugins/domains/twitch.tv/clips.twitch.tv.js @@ -32,9 +32,9 @@ export default { }, tests: [{skipMethods: ['getData']}, - "https://clips.twitch.tv/RacySweetJackalBlargNaut-Aurg1DNlYiUgIhJd", - "https://clips.twitch.tv/CourageousRichPeafowlYouDontSay-opqgmVBfJExmluP9", - "https://www.twitch.tv/uhsnow/clip/BlitheHedonisticQuailWutFace-0LqwKOVTwqmrSA_e?filter=clips&range=all&sort=time", - "https://www.twitch.tv/sliggytv/clip/SmoothBoxyCurlewOSsloth-m1exZeUdrO46iNQB", + "https://clips.twitch.tv/RacySweetJackalBlargNaut-Aurg1DNlYiUgIhJd?parent=localhost", + "https://clips.twitch.tv/CourageousRichPeafowlYouDontSay-opqgmVBfJExmluP9?parent=localhost", + "https://www.twitch.tv/uhsnow/clip/BlitheHedonisticQuailWutFace-0LqwKOVTwqmrSA_e?parent=localhost", + "https://www.twitch.tv/sliggytv/clip/SmoothBoxyCurlewOSsloth-m1exZeUdrO46iNQB?parent=localhost", ] }; \ No newline at end of file From e50c05571f553d3065a3402bcc851c3929431bbc Mon Sep 17 00:00:00 2001 From: Alexey Date: Mon, 9 Feb 2026 16:30:32 +0300 Subject: [PATCH 5/7] twitch-live-fallback: add parent param --- plugins/domains/twitch.tv/twitch-live-fallback.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plugins/domains/twitch.tv/twitch-live-fallback.js b/plugins/domains/twitch.tv/twitch-live-fallback.js index 81a56af1b..439c2f901 100644 --- a/plugins/domains/twitch.tv/twitch-live-fallback.js +++ b/plugins/domains/twitch.tv/twitch-live-fallback.js @@ -39,8 +39,8 @@ export default { tests: [{ noFeeds: true, skipMethods: ["getData"] }, - "https://www.twitch.tv/ninja", - "https://www.twitch.tv/videos/520219960", - "https://www.twitch.tv/videos/2686933296" + "https://www.twitch.tv/ninja?parent=localhost", + "https://www.twitch.tv/videos/520219960?parent=localhost", + "https://www.twitch.tv/videos/2686933296?parent=localhost" ] }; \ No newline at end of file From b81fef96c5adfe9f7724ce3bd8ee00c0240d7cf4 Mon Sep 17 00:00:00 2001 From: Nazar Leush Date: Mon, 9 Feb 2026 16:10:03 +0200 Subject: [PATCH 6/7] Update audit.log --- audit.log | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/audit.log b/audit.log index 72c3ec67f..21ebb71f0 100644 --- a/audit.log +++ b/audit.log @@ -1,4 +1,18 @@ ┌─────────────────────┬────────────────────────────────────────────────────────┐ +│ high │ @isaacs/brace-expansion has Uncontrolled Resource │ +│ │ Consumption │ +├─────────────────────┼────────────────────────────────────────────────────────┤ +│ Package │ @isaacs/brace-expansion │ +├─────────────────────┼────────────────────────────────────────────────────────┤ +│ Vulnerable versions │ <=5.0.0 │ +├─────────────────────┼────────────────────────────────────────────────────────┤ +│ Patched versions │ >=5.0.1 │ +├─────────────────────┼────────────────────────────────────────────────────────┤ +│ Paths │ .>mocha>glob>minimatch>@isaacs/brace-expansion │ +├─────────────────────┼────────────────────────────────────────────────────────┤ +│ More info │ https://github.com/advisories/GHSA-7h2j-956f-4vf2 │ +└─────────────────────┴────────────────────────────────────────────────────────┘ +┌─────────────────────┬────────────────────────────────────────────────────────┐ │ moderate │ Undici has an unbounded decompression chain in HTTP │ │ │ responses on Node.js Fetch API via Content-Encoding │ │ │ leads to resource exhaustion │ @@ -27,5 +41,5 @@ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ More info │ https://github.com/advisories/GHSA-73rr-hh4g-fpgx │ └─────────────────────┴────────────────────────────────────────────────────────┘ -2 vulnerabilities found -Severity: 1 low | 1 moderate +3 vulnerabilities found +Severity: 1 low | 1 moderate | 1 high From 42aae35bec8f48e0c699e0d176a37d61f2fbc0f5 Mon Sep 17 00:00:00 2001 From: Ivan Paramonau Date: Tue, 10 Feb 2026 08:22:00 -0500 Subject: [PATCH 7/7] review failing Facebook post test --- plugins/domains/facebook.com/facebook.post.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/plugins/domains/facebook.com/facebook.post.js b/plugins/domains/facebook.com/facebook.post.js index 716e91dd2..625acf511 100644 --- a/plugins/domains/facebook.com/facebook.post.js +++ b/plugins/domains/facebook.com/facebook.post.js @@ -7,7 +7,7 @@ export default { /^https?:\/\/(?:www|m|business)\.facebook\.com\/photo\.php\?(?:[^\?]+)?fbid=(\d{10,})/i, /^https?:\/\/(?:www|m|business)\.facebook\.com\/photo\/?\?(?:[^\?]+)?fbid=(\d{10,})/i, /^https?:\/\/(?:www|m|business)\.facebook\.com\/[^\/]+\/(posts|activity)\/(\d{10,})/i, - /^https?:\/\/(?:www|m|business)\.facebook\.com\/[^\/]+\/posts\/[^\/]+\/(\d{10,})/i, + /^https?:\/\/(?:www|m|business)\.facebook\.com\/[^\/]+\/posts\/[^\/]+\/(\d{10,})/i, // Facebook still does not recognize it in oEmbed as of Feb 10, 2026 /^https?:\/\/(?:www|m|business)\.facebook\.com\/[^\/]+\/(posts|activity)\/pfbid([a-zA-Z0-9\.\-]+)/i, /^https?:\/\/(?:www|m|business)\.facebook\.com\/[^\/]+\/photos(?:\/[^\/]+)?\/(\d{10,})/i, /^https?:\/\/(?:www|m|business)\.facebook\.com\/notes\/[^\/\?]+\/[^\/]+\/(\d{10,})/i, @@ -58,7 +58,9 @@ export default { "https://www.facebook.com/logvynenko/posts/10151487164961783", "https://www.facebook.com/chamvermeil/photos/a.398119066992522.1073741828.398102673660828/715129168624842/?type=1&theater", "https://www.facebook.com/photo?fbid=3242822485762635&set=pcb.3242829905761893", - "https://www.facebook.com/141700922567987_3903702929701082", + // "https://www.facebook.com/141700922567987_3903702929701082", // Redirects to the unrecognized URL + "https://www.facebook.com/Asda/posts/pfbid02dPKr6XHAY8Ga6MyWNyM3XAEF9YG4WNWhxRUoUU3qJ5nDY7RpXkULPmZVGkHWQB3Ll", + // "https://www.facebook.com/Asda/posts/weve-been-named-the-cheapest-major-online-supermarket-in-may-by-which-the-third-/3903702929701082/", // Facebook still does not recognize it in oEmbed as of Feb 10, 2026 "https://www.facebook.com/docmonkeyorthoanimal/photos/105294651313771/", {noFeeds: true}, {skipMixins: ["fb-error"]} ]