v10.0.4

It has been very quiet around the H5P NodeJS library, but it's not dead and will be continued to be maintained!

There have been hundreds of dependency updates since 9.3.2 was last released, they are all included and mostly non-breaking expect for the ones mentioned below:

Major changes

• BREAKING: Packages now require Node 20 (because of dependencies that require it)
• BREAKING: Packaged files are now ES2022
• BREAKING: h5p-server: Updated to v1.27 of H5P Core. You need to re-download the H5P Core and Editor files with updated references (see https://github.com/Lumieducation/H5P-Nodejs-library/blob/3272d41463a8024f5a5316f4afa02209b4008d9d/scripts/install.sh#L4)
• BREAKING: h5p-mongos3: dependency aws-sdk updated from v2 to v3. There were changes in initialization in the v3 API. See the docs how to initialize S3
• BREAKING: h5p-mongos3: dependency mongodb updated from v4 to v6. All _id attributes must now be of type ObjectId. That's why the library storage schema needed changing. It now includes the ubername attribute and _id is now a regular ObjectId. You need to migrate data in your library collection! There are migration methods in MongoLibraryStorage and MongoS3LibraryStorage.
• BREAKING: h5p-redis-lock: now uses redis instead of ioredis (initialization might need to be changed)
• BREAKING: SVG files are not allowed as content anymore, as this is unsafe if you don't sanitize the file. We've introduced a SVG sanitizer that makes SVGs safe to use (see below). If you have set your own contentWhitelist you should check whether you want to allow SVGs!
• The NPM package csurf has been deprecated. Unfortunately the way the H5P core works requires the usage of a package like this. That's why the example has moved to the fork @dr.pogodin/csurf. If you've used csurf, you should consider switching to an alternative!

Refactoring (internal)

• Removed dependencies not needed anymore because the functionality is now part of ES or NodeJS.
• Updated eslint and all files.
• Updated prettier and all files.
• Now uses NPM workspaces instead of Lerna package management and is much more stable and convenient to use.

Bugfixes

• H5PConfig now loads contentFilesUrlPlayerOverride from storage

New features

• Virus / malware scanner interface
• ClamAV scanner
• File sanitization interface
• SVG file sanitization

What's to come?

• The library will move to a hybrid package with ESM and CommonJS. The JS ecosystem is slowly moving to ESM-only packages and it is becoming harder and harder to keep up releasing a CommonJS package as more and more dependencies only offer ESM versions. Thus, at some point in the future this library will become ESM-only. You should start preparing for this now!
• We will fix bugs and look at feature requests in the GitHub Issues
• We will review open pull requests.
• Future release will include the H5P client in the package.

Full list of further dependency updates

• deps: update dependency ajv to v8.17.1 (ff19b74)
• deps: update dependency async-lock to v1.4.1 (5576fcc)
• deps: update dependency axios to v1.7.9 (#3768) (6f55565)
• deps: update dependency body-parser to v1.20.3 [security] (#3786) (065c0ba)
• deps: update dependency bootstrap to v5.3.3 (0824a12)
• deps: update dependency debug to v4.4.0 (#3775) (ca0643c)
• deps: update dependency dotenv to v16.4.7 (955236e)
• deps: update dependency express to v4.21.2 (7c6af66)
• deps: update dependency express-fileupload to v1.5.1 (a80cb93)
• deps: update dependency express-session to v1.18.1 (#3801) (2375a00)
• deps: update dependency fs-extra to v11.3.0 (#3871) (15b79aa)
• deps: update dependency get-all-files to v5 (fb3b1c3)
• deps: update dependency http-proxy-middleware to v3 (#3880) (26c181f)
• deps: update dependency i18next to v24.2.2 (#3896) (5d61912)
• deps: update dependency i18next-fs-backend to v2.6.0 (8251ee7)
• deps: update dependency i18next-http-middleware to v3.7.1 (#3819) (d7a681f)
• deps: update dependency image-size to v1.2.0 (4cda642)
• deps: update dependency mongodb to v6.14.2 (#3953) (64ad76f)
• deps: update dependency nanoid to v3.3.8 [security] (#3825) (8c1f03c)
• deps: update dependency passport to v0.7.0 (d597178)
• deps: update dependency postcss to v8.5.3 (#3922) (9334897)
• deps: update dependency postcss-import to v16 (3d3a8a5)
• deps: update dependency postcss-safe-parser to v7 (491df08)
• deps: update dependency postcss-safe-parser to v7.0.1 (75e0583)
• deps: update dependency qs to v6.13.1 (884a603)
• deps: update dependency react-bootstrap to v2.9.2 (181e8d2)
• deps: update dependency redis to v4 (#3881) (1ea57a2)
• deps: update dependency requirejs to v2.3.7 (f4b90ec)
• deps: update dependency sanitize-html to v2.14.0 (e5ee2db)
• deps: update dependency sharedb to v5.2.0 (#3955) (a6c2b2a)
• deps: update dependency simple-redis-mutex to v2 (#3822) (535df73)
• deps: update dependency stream-buffers to v3.0.3 (be7dda6)
• deps: update dependency uglify-js to v3.19.3 (c007b9a)
• deps: update dependency ws to v8.17.1 [security] (#3851) (4e87a4e)
• deps: update dependency yazl to v3 (#3808) (23104d3)
• deps: update font awesome to v6.7.2 (c2bd7b4)

10.0.4 only includes a fix in the NPM packages (build artifacts were missing). Releases 10.0.0-10.0.3 were broken!

v9.3.3

9.3.3 (2025-02-11)

Security fix

• h5p-server: added sanization of text strings without formatting (#3894) (e94e6e0)

v9.3.2

9.3.2 (2023-09-20)

Note: Version bump only for package @lumieducation/h5p-monorepo

v9.3.1

9.3.1 (2023-09-01)

Bug Fixes

• deps: update dependency aws-sdk to v2.1426.0 (3ab22e9)
• deps: update dependency aws-sdk to v2.1427.0 (7651a11)
• deps: update dependency aws-sdk to v2.1428.0 (233d756)
• deps: update dependency aws-sdk to v2.1429.0 (16c69b5)
• deps: update dependency aws-sdk to v2.1430.0 (ddcc818)
• deps: update dependency aws-sdk to v2.1431.0 (969bf36)
• deps: update dependency aws-sdk to v2.1432.0 (4035c81)
• deps: update dependency aws-sdk to v2.1433.0 (0791181)
• deps: update dependency aws-sdk to v2.1434.0 (cfa790d)
• deps: update dependency aws-sdk to v2.1435.0 (4eac39b)
• deps: update dependency aws-sdk to v2.1436.0 (60e6e36)
• deps: update dependency aws-sdk to v2.1437.0 (a1a9d68)
• deps: update dependency aws-sdk to v2.1438.0 (213cb98)
• deps: update dependency aws-sdk to v2.1439.0 (d82e87f)
• deps: update dependency aws-sdk to v2.1440.0 (2b19220)
• deps: update dependency aws-sdk to v2.1441.0 (863f8a7)
• deps: update dependency aws-sdk to v2.1442.0 (9dfd91e)
• deps: update dependency aws-sdk to v2.1443.0 (975d94a)
• deps: update dependency aws-sdk to v2.1444.0 (d768d33)
• deps: update dependency aws-sdk to v2.1445.0 (3446337)
• deps: update dependency aws-sdk to v2.1447.0 (d37d442)
• deps: update dependency aws-sdk to v2.1448.0 (58cb49b)
• deps: update dependency aws-sdk to v2.1449.0 (02a488b)
• deps: update dependency axios to v1.5.0 (82b5d59)
• deps: update dependency mongodb to v4.17.0 (0b23c2b)
• deps: update dependency mongodb to v4.17.1 (7f78017)
• deps: update dependency postcss to v8.4.28 (1670a50)
• deps: update dependency postcss to v8.4.29 (76d5693)
• deps: update font awesome to v6.4.2 (e15f164)

v9.3.0

9.3.0 (2023-07-31)

Features

• You an now have multiple user states per content object and user. (#3011) (798975e) See the documentation page for more details.
• You can now impersonate users when displaying user states. ([#3042])(#3042) See the documentation page for more details.
• Authorization is now its own sub-system and not part of the Mongo(/S3) content storage classes. If you have used the authorization system of the Mongo(/S3) content storage classes before, you must migrate to the new model. See the documentation page for more details.

Maintenance

• Updates several dependencies

v9.2.2

9.2.2 (2023-06-11)

Bug Fixes

• deps: update dependency aws-sdk to v2.1388.0 (d6095c7)
• deps: update dependency aws-sdk to v2.1389.0 (99a0328)
• deps: update dependency aws-sdk to v2.1390.0 (39b9a5f)
• deps: update dependency aws-sdk to v2.1391.0 (dad5699)
• deps: update dependency aws-sdk to v2.1392.0 (92bfc04)
• deps: update dependency aws-sdk to v2.1394.0 (2ec248d)
• deps: update dependency aws-sdk to v2.1395.0 (44a8699)
• deps: update dependency dotenv to v16.1.3 (da3c3c4)
• deps: update dependency dotenv to v16.1.4 (546e353)
• deps: update dependency i18next to v22.5.1 (d9c3940)
• deps: update dependency i18next-fs-backend to v2.1.3 (0f18629)
• mongo-s3: library.json can be retrieved with GET (b73e4f5)

v9.2.1

9.2.1 (2023-05-31)

This is a maintenance release.

Changes

The release is now compatible with more recent H5P core versions:

• https://github.com/h5p/h5p-php-library: 661d4f6c7d7b1117587654941f5fcf91acb5f4eb
• https://github.com/h5p/h5p-editor-php-library: 0365b081efa8b55ab9fd58594aa599f9630268f6

The H5P Group has removed the live reference to the Google Fonts in the core files and added some local fonts instead. You should upgrade your H5P core to benefit from this privacy improvement.

Fixes

• html exporter compatible with @import (dbc3ab9)

Dependency Updates

• deps: update dependency @fortawesome/free-solid-svg-icons to v6.2.0 (1283813)
• deps: update dependency @fortawesome/react-fontawesome to v0.2.0 (8e58cee)
• deps: update dependency ajv to v8.12.0 (cdd6f5a)
• deps: update dependency async-lock to v1.4.0 (a721e73)
• deps: update dependency aws-sdk to v2.1387.0 (b32c98f)
• deps: update dependency body-parser to v1.20.2 (6dd3e63)
• deps: update dependency bootstrap to v5.3.0 (d017fb5)
• deps: update dependency cache-manager to v4 (#2315) (c039cf2)
• deps: update dependency cache-manager to v4.1.0 (4512e17)
• deps: update dependency deepmerge to v4.3.1 (e09b5a8)
• deps: update dependency dotenv to v16.1.0 (9410151)
• deps: update dependency express to v4.18.2 (f3ee4b2)
• deps: update dependency fs-extra to v11 (298235f)
• deps: update dependency i18next to v22 (a748407)
• deps: update dependency i18next to v22.5.0 (5a41ee8)
• deps: update dependency i18next-fs-backend to v2.1.2 (7d0c73c)
• deps: update dependency i18next-http-middleware to v3.3.1 (69d09c8)
• deps: update dependency jsonpath-plus to v7 (#2362) (d40d177)
• deps: update dependency mongodb to v4.9.1 (f1512b5)
• deps: update dependency nanoid to v3.3.6 (53696ce)
• deps: update dependency postcss to v8.4.24 (2355859)
• deps: update dependency qs to v6.11.2 (33424fc)
• deps: update dependency react-bootstrap to v2.7.4 (8c1da99)
• deps: update dependency sanitize-html to v2.10.0 (4769cbe)
• deps: update dependency sharedb to v3.3.1 (745b55e)
• deps: update dependency simple-redis-mutex to v1.3.1 (5d44618)
• deps: update dependency ws to v8.13.0 (7e1851f)
• deps: update font awesome to v6.4.0 (3309570)
• package: remove duplicate scripts (82aa5ae)

v9.2.0

9.2.0 (2022-06-14)

Bug Fixes

• deps: updated several dependencies
• h5p-server: added getLocalIdOverride to h5p editor options (#2251) (da2ce76)
• translation updates for various languages (43464a9)
• h5p-webcomponents: fixed import of deepmerge (relevant for Babel transpilers) (closes #2196)

Features

• h5p-server: added content user state (closes #1014)

v9.1.2

9.1.2 (2022-03-19)

Bug Fixes

• deps: update dependency @fortawesome/react-fontawesome to v0.1.17 (d656e43)
• deps: update dependency @fortawesome/react-fontawesome to v0.1.18 (c31a106)
• deps: update dependency aws-sdk to v2.1094.0 (fcc68b4)
• deps: update dependency aws-sdk to v2.1095.0 (9d364aa)
• deps: update dependency aws-sdk to v2.1096.0 (1d4210b)
• deps: update dependency http-proxy-middleware to v2.0.4 (d04ada9)
• h5p-server: fixed contentWasCreated hook (f2a5c50)

v9.1.1

9.1.1 (2022-03-12)

Bug Fixes

• deps: update dependency aws-sdk to v2.1088.0 (d4887b3)
• deps: update dependency aws-sdk to v2.1089.0 (8e80d0b)
• deps: update dependency aws-sdk to v2.1090.0 (96c78dd)
• deps: update dependency aws-sdk to v2.1092.0 (8f0753a)
• deps: update dependency i18next to v21.6.14 (d86e4f5)
• deps: update dependency react-bootstrap to v2.2.1 (95b4514)
• h5p-mongos3: s3 lifecycle helper not taking effect (8894815)