Branch: refs/heads/master Home: https://github.com/xwiki-contrib/application-blog Commit: 5816d284111d946b401b84ed61638d5107aa86b9 https://github.com/xwiki-contrib/application-blog/commit/5816d284111d946b401... Author: Marius Dumitru Florea <[email protected]> Date: 2026-10-08 (Thu, 08 Oct 2026) Changed paths: M application-blog-ui/src/main/resources/Blog/BlogScripts.xml Log Message: ----------- [Misc] Stop using String#unescapeHTML() from Prototype.js * Newer XWiki versions no longer provide String#unescapeHTML() (and String#stripTags()) because Prototype.js' implementation is vulnerable to ReDoS (CVE-2020-27511, see XWIKI-24358). * Use the standard String#repeat() with a non-breaking space escape to indent the category options. Since Prototype.js 1.7 String#unescapeHTML() no longer decoded " ", so the options were displayed with a literal " " prefix. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki-contrib/application-blog/settings/notifications