sync with upstream

.github/workflows/node.js.yml

@@ -9,13 +9,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+    - uses: actions/checkout@v4
       with:
         persist-credentials: false
     - name: Install Node.js
-      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
+      uses: actions/setup-node@v4
       with:
-        node-version: 20
+        node-version: 22
         cache: npm
     - run: npm ci
     - run: npm run build

package.json

@@ -36,7 +36,7 @@
     "@turbowarp/jszip": "^3.11.1",
     "@turbowarp/nanolog": "^0.2.0",
     "@turbowarp/scratch-l10n": "^3.1001.0-202401241456-994097a5",
-    "@turbowarp/scratch-storage": "^0.0.202502192258",
+    "@turbowarp/scratch-storage": "^0.0.202505311821",
     "@turbowarp/scratch-svg-renderer": "^1.0.0-202312242305-12c360b",
     "@turbowarp/startaudiocontext": "^1.0.0",
     "arraybuffer-loader": "^1.0.6",

src/addons/addons/middle-click-popup/BlockTypeInfo.js

@@ -207,7 +207,7 @@ export class BlockInputEnum extends BlockInput {
     this.values = [];
     for (let i = 0; i < options.length; i++) {
       if (typeof options[i][1] === "string" && BlockInputEnum.INVALID_VALUES.indexOf(options[i][1]) === -1) {
-        this.values.push({ value: options[i][1], string: options[i][0].replaceAll(String.fromCharCode(160), " ") });
+        this.values.push({ value: options[i][1], string: options[i][0].replace(/\u00a0/g, " ") });
       }
     }
     this.isRound = isRound;

src/addons/addons/middle-click-popup/WorkspaceQuerier.js

@@ -1072,7 +1072,7 @@ class QueryInfo {
     /** @type {WorkspaceQuerier} */
     this.querier = querier;
     /** @type {string} The query */
-    this.str = query.replaceAll(String.fromCharCode(160), " ");
+    this.str = query.replace(/\u00a0/g, " ");
     /** @type {string} A lowercase version of the query. Used for case insensitive comparisons. */
     this.lowercase = this.str.toLowerCase();
     /** @type {number} A unique identifier for this query */

src/addons/addons/onion-skinning/userscript.js

@@ -1,3 +1,5 @@
+import {sanitizeSvg} from '@turbowarp/scratch-svg-renderer';
+
 export default async function ({ addon, console, msg }) {
   const paper = await addon.tab.traps.getPaper();
 
@@ -300,6 +302,8 @@ export default async function ({ addon, console, msg }) {
 
   const makeVectorOnion = (opacity, costume, asset, isBefore) =>
     new Promise((resolve, reject) => {
+      asset = sanitizeSvg.sanitizeSvgText(asset);
+
       const { rotationCenterX, rotationCenterY } = costume;
       // https://github.com/scratchfoundation/scratch-paint/blob/cdf0afc217633e6cfb8ba90ea4ae38b79882cf6c/src/containers/paper-canvas.jsx#L196-L218
       asset = asset.split(/<\s*svg:/).join("<");

src/addons/addons/reorder-custom-inputs/modified-funcs.js

@@ -33,7 +33,7 @@ export function modifiedCreateAllInputs(connectionMap) {
   }
 
   // remove all traces of %l at the earliest possible time
-  this.procCode_ = this.procCode_.replaceAll("%l ", "");
+  this.procCode_ = this.procCode_.replace(/%l /g, "");
 }
 
 //https://github.com/scratchfoundation/scratch-blocks/blob/f210e042988b91bcdc2abeca7a2d85e178edadb2/blocks_vertical/procedures.js#L565

src/addons/generated/upstream-meta.json

@@ -1 +1 @@
-{"commit":"c237cfa"}
+{"commit":"df5f51e"}

src/addons/settings/translations.json

@@ -125,13 +125,16 @@
     },
     "fr": {
         "addonFeedback": "Commentaires sur les addons",
+        "confirmResetAll": "Êtes-vous sûr de vouloir réinitialiser tous les paramètres des addons à leurs valeurs par défaut ?",
         "credits": "Crédits:",
+        "dirty": "Rechargez les onglets pour appliquer les paramètres.",
         "dirtyButton": "Recharger maintenant",
         "enableDangerous": "Cet addon est dangereux et va intentionnellement DÉSACTIVER certaines fonctionnalitées. La plupart des utilisateurs NE DOIVENT PAS activer cet addon. Êtes-vous sûr de vouloir l'activer ?",
         "export": "Exporter les paramètres",
         "groupDanger": "Dangereux ({number})",
         "groupOthers": "Autres ({number})",
         "import": "Importer les paramètres",
+        "noCompiler": "Cet addon ne fonctionne que lorsque le compilateur est désactivé via le menu Avancé > Désactiver le compilateur ou à l'aide de l'addon « Désactiver le compilateur dans l'éditeur ».",
         "noResults": "Aucun résultat.",
         "presets": "Préconfigurations",
         "reset": "Réinitialiser",
@@ -194,7 +197,7 @@
         "tagNew": "Új!",
         "tagRecommended": "Javasolt",
         "tagTheme": "Téma",
-        "title": "Kiegészítő-beállítások",
+        "title": "Kiegészítők beállításai",
         "unsupported": "Néhány kiegészítő nem érhető el ebben a böngészőben."
     },
     "it": {
@@ -653,12 +656,15 @@
         "addonFeedback": "附加元件回饋",
         "confirmResetAll": "你確定要重設所有附件設定？",
         "credits": "感謝：",
+        "dirty": "重新加載頁面以套用設定",
         "dirtyButton": "重新載入",
+        "enableDangerous": "此插件非常危險，可能會停用功能。大部分使用者不應啟用此插件。你非常確定要開啟他嗎?",
         "export": "匯出設定",
         "groupDanger": "危險（{number}）",
         "groupNew": "全新（{number}）",
         "groupOthers": "其他（{number}）",
         "import": "匯入設定",
+        "noCompiler": "此插件只有在通過\"高級 > 禁用編譯器\"的選項或者使用\"禁用編譯器\"插件才可以正常運行。",
         "noResults": "沒有相符的結果。",
         "presets": "預設",
         "reset": "重設",

src/components/gui/gui.css

@@ -4,10 +4,12 @@
 
 .page-wrapper {
     height: 100%;
+    display: flex;
+    flex-direction: column;
 }
 
 .body-wrapper {
-    height: calc(100% - $menu-bar-height);
+    flex-grow: 1;
     background-color: $ui-primary;
 }
 

src/components/monitor/monitor.jsx

@@ -45,7 +45,7 @@ const MonitorComponent = props => (
         // TW: if export is defined, we always show it, even outside of the editor
         disable={!props.draggable && !props.onExport}
         holdToDisplay={props.mode === 'slider' ? -1 : 1000}
-        id={`monitor-${props.label}`}
+        id={`monitor-${props.id}`}
     >
         <Draggable
             bounds=".monitor-overlay" // Class for monitor container
@@ -75,7 +75,7 @@ const MonitorComponent = props => (
             // positioning conflicts between the monitors `transform: scale` and
             // the context menus `position: fixed`. For more details, see
             // http://meyerweb.com/eric/thoughts/2011/09/12/un-fixing-fixed-elements-with-css-transforms/
-            <ContextMenu id={`monitor-${props.label}`}>
+            <ContextMenu id={`monitor-${props.id}`}>
                 {props.draggable && props.onSetModeToDefault &&
                     <MenuItem onClick={props.onSetModeToDefault}>
                         <FormattedMessage

src/components/tw-security-manager-modal/download.jsx

@@ -54,6 +54,7 @@ const DEFINITELY_EXECUTABLE = [
     'webloc',
     'inetloc',
     'lnk',
+    'shortcut',
 
     // Windows scripting languages
     'bat',

src/containers/extension-library.jsx

@@ -169,6 +169,7 @@ class ExtensionLibrary extends React.PureComponent {
                 const locale = this.props.intl.locale;
                 library.push(
                     ...this.state.gallery
+                        .filter(i => i.extensionId !== 'faceSensing')
                         .map(i => translateGalleryItem(i, locale))
                         .map(toLibraryItem)
                 );

src/containers/paint-editor-wrapper.jsx

@@ -3,7 +3,7 @@ import React from 'react';
 import bindAll from 'lodash.bindall';
 import VM from 'scratch-vm';
 import PaintEditor from '../lib/tw-scratch-paint';
-import {inlineSvgFonts} from '@turbowarp/scratch-svg-renderer';
+import {inlineSvgFonts, sanitizeSvg} from '@turbowarp/scratch-svg-renderer';
 import ErrorBoundaryHOC from '../lib/error-boundary-hoc.jsx';
 import {openFontsModal} from '../reducers/modals';
 
@@ -71,11 +71,11 @@ class PaintEditorWrapper extends React.Component {
             vm,
             ...componentProps
         } = this.props;
-
+        const costume = vm.getCostume(selectedCostumeIndex);
         return (
             <PaintEditor
                 {...componentProps}
-                image={vm.getCostume(selectedCostumeIndex)}
+                image={this.props.imageFormat === 'svg' ? sanitizeSvg.sanitizeSvgText(costume) : costume}
                 onUpdateImage={this.handleUpdateImage}
                 onUpdateName={this.handleUpdateName}
                 fontInlineFn={this.fontInlineFn}

src/containers/stage.jsx

@@ -193,7 +193,7 @@ class Stage extends React.Component {
         // Set editing target from cursor position, if clicking on a sprite.
         const mousePosition = [x - this.rect.left, y - this.rect.top];
         const drawableId = this.renderer.pick(mousePosition[0], mousePosition[1]);
-        if (drawableId === null) return;
+        if (drawableId === -1) return;
         const targetId = this.props.vm.getTargetIdForDrawableId(drawableId);
         if (targetId === null) return;
         this.props.vm.setEditingTarget(targetId);
@@ -376,7 +376,7 @@ class Stage extends React.Component {
     onStartDrag (x, y) {
         if (this.state.dragId) return;
         const drawableId = this.renderer.pick(x, y);
-        if (drawableId === null) return;
+        if (drawableId === -1) return;
         const targetId = this.props.vm.getTargetIdForDrawableId(drawableId);
         if (targetId === null) return;
 

src/containers/tw-security-manager.jsx

@@ -39,16 +39,16 @@ const isTrustedExtension = url => (
 );
 
 /**
- * Set of fetch resource origins that were manually trusted by the user.
+ * Set of fetch resource hosts that were manually trusted by the user.
  * @type {Set<string>}
  */
-const fetchOriginsTrustedByUser = new Set();
+const fetchHostsTrustedByUser = new Set();
 
 /**
- * Set of origins manually trusted by the user for embedding.
+ * Set of hosts manually trusted by the user for embedding.
  * @type {Set<string>}
  */
-const embedOriginsTrustedByUser = new Set();
+const embedHostsTrustedByUser = new Set();
 
 /**
  * @param {URL} parsed Parsed URL object
@@ -298,16 +298,21 @@ class TWSecurityManagerComponent extends React.Component {
             return true;
         }
         const {showModal, releaseLock} = await this.acquireModalLock();
-        const origin = (parsed.protocol === 'http:' || parsed.protocol === 'https:') ? parsed.origin : null;
-        if (origin && fetchOriginsTrustedByUser.has(origin)) {
+        const host = (
+            parsed.protocol === 'http:' ||
+            parsed.protocol === 'https:' ||
+            parsed.protocol === 'ws:' ||
+            parsed.protocol === 'wss:'
+        ) ? parsed.host : null;
+        if (host && fetchHostsTrustedByUser.has(host)) {
             releaseLock();
             return true;
         }
         const allowed = await showModal(SecurityModals.Fetch, {
             url
         });
-        if (origin && allowed) {
-            fetchOriginsTrustedByUser.add(origin);
+        if (host && allowed) {
+            fetchHostsTrustedByUser.add(host);
         }
         return allowed;
     }
@@ -406,15 +411,15 @@ class TWSecurityManagerComponent extends React.Component {
         if (!parsed) {
             return false;
         }
-        const origin = (parsed.protocol === 'http:' || parsed.protocol === 'https:') ? parsed.origin : null;
+        const host = (parsed.protocol === 'http:' || parsed.protocol === 'https:') ? parsed.host : null;
         const {showModal, releaseLock} = await this.acquireModalLock();
-        if (origin && embedOriginsTrustedByUser.has(origin)) {
+        if (host && embedHostsTrustedByUser.has(host)) {
             releaseLock();
             return true;
         }
         const allowed = await showModal(SecurityModals.Embed, {url});
-        if (origin && allowed) {
-            embedOriginsTrustedByUser.add(origin);
+        if (host && allowed) {
+            embedHostsTrustedByUser.add(host);
         }
         return allowed;
     }