From b62209fbbff53182e02fbc6bb1d61858f24c7ce6 Mon Sep 17 00:00:00 2001 From: "Andrei.Ovcharenko" Date: Fri, 19 Jun 2026 22:05:45 +0300 Subject: [PATCH 1/4] Apply Codex audit fixes --- .github/workflows/CI_build.yml | 50 +++-- .github/workflows/release.yml | 21 +- doc/plugin_list_arm64.md | 4 +- doc/plugin_list_x64.md | 12 +- doc/plugin_list_x86.md | 13 +- requirements.lock | 377 +++++++++++++++++++++++++++++++++ src/pl.x64.json | 16 +- src/pl.x86.json | 20 -- validator.py | 53 ++--- 9 files changed, 468 insertions(+), 98 deletions(-) create mode 100644 requirements.lock diff --git a/.github/workflows/CI_build.yml b/.github/workflows/CI_build.yml index d0cbf7087..077406b00 100644 --- a/.github/workflows/CI_build.yml +++ b/.github/workflows/CI_build.yml @@ -2,15 +2,14 @@ name: CI_build on: [push, pull_request] +permissions: + contents: read + jobs: build: runs-on: windows-latest - permissions: - # Give the default GITHUB_TOKEN write permission to commit and push the changed files back to the repository. - contents: write - strategy: fail-fast: false matrix: @@ -19,11 +18,13 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + persist-credentials: false - name: Install python modules working-directory: . - run: pip3 install -r requirements.txt + run: pip3 install --require-hashes -r requirements.lock - name: check used package versions working-directory: . @@ -34,7 +35,7 @@ jobs: run: python validator.py ${{ matrix.build_platform }} - name: Add msbuild to PATH - uses: microsoft/setup-msbuild@v3 + uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3 - name: MSBuild of plugin dll working-directory: vcxproj @@ -42,7 +43,7 @@ jobs: - name: Archive artifacts for x64 if: matrix.build_platform == 'x64' && matrix.build_configuration == 'Release' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: plugin_dll_and_list_x64 path: | @@ -51,7 +52,7 @@ jobs: - name: Archive artifacts for Win32 if: matrix.build_platform == 'Win32' && matrix.build_configuration == 'Release' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: plugin_dll_and_list_x86 path: | @@ -60,26 +61,39 @@ jobs: - name: Archive artifacts for ARM64 if: matrix.build_platform == 'ARM64' && matrix.build_configuration == 'Release' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: plugin_dll_and_list_arm64 path: | binarm64\nppPluginList.dll doc\plugin_list_arm64.md - - name: Checkout main branch if push trigger is a tag - if: github.repository_owner == 'notepad-plus-plus' && github.ref_type == 'tag' && matrix.build_platform == 'ARM64' && matrix.build_configuration == 'Release' - run: | - git fetch --all - git checkout master + update-plugin-lists: + + runs-on: windows-latest + if: github.repository_owner == 'notepad-plus-plus' && github.ref_type == 'tag' + + permissions: + contents: write + + steps: + - name: Checkout repo + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + fetch-depth: 0 + + - name: Install python modules + working-directory: . + run: pip3 install --require-hashes -r requirements.lock + + - name: Checkout main branch + run: git checkout master - name: Generate all plugin lists markdown from json on tagging - if: startsWith(github.ref, 'refs/tags/') && matrix.build_platform == 'ARM64' && matrix.build_configuration == 'Release' working-directory: . run: python validator.py all_md - name: Push markdown changes on tagging - if: startsWith(github.ref, 'refs/tags/') && matrix.build_platform == 'ARM64' && matrix.build_configuration == 'Release' - uses: stefanzweifel/git-auto-commit-action@v7 + uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7 with: file_pattern: 'doc/*.md' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f70151938..a939efe94 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -2,6 +2,9 @@ name: release on: [workflow_dispatch] +permissions: + contents: read + jobs: build: @@ -21,11 +24,13 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + persist-credentials: false - name: Install python modules working-directory: . - run: pip3 install -r requirements.txt + run: pip3 install --require-hashes -r requirements.lock - name: check used package versions working-directory: . @@ -36,7 +41,7 @@ jobs: run: python validator.py ${{ matrix.build_platform }} - name: Add msbuild to PATH - uses: microsoft/setup-msbuild@v3 + uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3 - name: MSBuild of plugin dll working-directory: vcxproj @@ -44,7 +49,7 @@ jobs: - name: Azure CLI login with federated credential - uses: azure/login@v3 + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -67,7 +72,7 @@ jobs: - name: Archive artifacts for x64 if: matrix.build_platform == 'x64' && matrix.build_configuration == 'Release' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: plugin_dll_and_list_x64 path: | @@ -76,7 +81,7 @@ jobs: - name: Archive artifacts for Win32 if: matrix.build_platform == 'Win32' && matrix.build_configuration == 'Release' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: plugin_dll_and_list_x86 path: | @@ -85,7 +90,7 @@ jobs: - name: Archive artifacts for ARM64 if: matrix.build_platform == 'ARM64' && matrix.build_configuration == 'Release' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: plugin_dll_and_list_arm64 path: | @@ -105,6 +110,6 @@ jobs: - name: Push markdown changes on tagging if: startsWith(github.ref, 'refs/tags/') && matrix.build_platform == 'ARM64' && matrix.build_configuration == 'Release' - uses: stefanzweifel/git-auto-commit-action@v7 + uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7 with: file_pattern: 'doc/*.md' diff --git a/doc/plugin_list_arm64.md b/doc/plugin_list_arm64.md index 2a6fd94f6..da7d77a56 100644 --- a/doc/plugin_list_arm64.md +++ b/doc/plugin_list_arm64.md @@ -15,14 +15,14 @@ version 1.9.6 | GotoLineCol | Shridhar Kumar | https://github.com/shriprem/Goto-Line-Col-NPP-Plugin | [2.4.5.1 - arm64 bit](https://github.com/shriprem/Goto-Line-Col-NPP-Plugin/releases/download/v2.4.5.1/GotoLineCol_arm64.zip) |
A plugin to navigate to a specified line and (byte-based or character-based) column position. Will also display character byte code, UTF-8 byte sequence & Unicode code point, name & block at cursor position. Darkmode enabled. Command line options.
| | HEX-Editor | Jens Lorenz | https://github.com/chcg/NPP_HexEditor | [0.9.14.0 - arm64 bit](https://github.com/chcg/NPP_HexEditor/releases/download/0.9.14/HexEditor_0.9.14_ARM64.zip) | Hex editor. Some reported issues, however many bugs fixed in latest release. | | HTML Tag | Martijn Coppoolse | https://github.com/rdipardo/nppHTMLTag | [1.6.0.0 - arm64 bit](https://github.com/rdipardo/nppHTMLTag/releases/download/v1.6.0/HTMLTag_v1.6.0_arm64.zip) |
Provides three core functions:
- HTML and XML tag jumping, like the built-in brace matching and selection
of tags and/or contents.
- HTML entity encoding/decoding (example: é to é)
- JS character encoding/decoding (example: é to \u00E9)
| -| JSON Viewer | Kapil Ratnani, Rajendra Singh | https://github.com/NPP-JSONViewer/JSON-Viewer | [2.1.1.0 - arm64 bit](https://github.com/NPP-JSONViewer/JSON-Viewer/releases/download/v2.1.1.0/NppJSONViewer_ARM64_Release.zip) | JSON viewer that displays the selected JSON string in a tree view. | +| JSON Viewer | Kapil Ratnani, Rajendra Singh | https://github.com/NPP-JSONViewer/JSON-Viewer | [2.2.0.0 - arm64 bit](https://github.com/NPP-JSONViewer/JSON-Viewer/releases/download/v2.2.0.0/NppJSONViewer_ARM64_Release.zip) | JSON viewer that displays the selected JSON string in a tree view. | | JSTool | Sun Junwen | https://github.com/sunjw/jstoolnpp | [25.11.16 - arm64 bit](https://sourceforge.net/projects/jsminnpp/files/Uni/JSToolNPP.25.11.16.uni.arm64.zip) |
Javascript plugin.
* Douglas Crockford's JSMin algorithm to minimize javascript code.
* My own algorithm to format javascript code.
* A JSON data viewer. This JSON data viewer can handle >10MB JSON file easily.
* Support 64bit Notepad++ (from version 1.20.0).
Really helpful to javascript coder on Notepad++ and really easy to use it.
Made in China.
| | Language Selector | Abdellah Hassaine | https://github.com/hassaine-abdellah/npp-language-selector | [1.2.0.0 - arm64 bit](https://github.com/hassaine-abdellah/npp-language-selector/releases/download/v1.2/plugin_dll_arm64.zip) |
Set the programming language and see the syntax highlighting on new files without the need to save them, or to go each time to the menu to choose the language.
You can also pin your favourite languages for quick access.
| | LanguageHelp | Franco Stellari | https://github.com/francostellari/NppPlugins | [1.7.5.0 - arm64 bit](https://github.com/francostellari/NppPlugins/raw/main/LanguageHelp/LanguageHelp_dll_1v75_arm64.zip) |
Allows loading a language specific help file (CHM, HLP, PDF) and search for the keyword under the cursor.
The latest version allows showing the help files as menu entries or in the context menu.
| | Linter++ | Tom Tanner | https://github.com/thosrtanner/notepad-pp-linter | [1.0.3.0 - arm64 bit](https://github.com/ThosRTanner/notepad-pp-linter/releases/download/1.0.3/plugin_dll_ARM64.zip) |
Allows realtime code check against any checkstyle-compatible linter: jshint, eslint, jscs, phpcs, csslint, and many others.
| | MenuIcons | Franco Stellari | https://github.com/francostellari/NppPlugins | [2.0.7 - arm64 bit](https://github.com/francostellari/NppPlugins/raw/main/MenuIcons/MenuIcons_dll_2v07_arm64.zip) | Adds icons to the main menu, tab menu, context menu, and the tabs themselves. | | Mime tools | Don HO | https://github.com/npp-plugins/mimetools | [3.1 - arm64 bit](https://github.com/npp-plugins/mimetools/releases/download/v3.1/mimetools.v3.1.arm64.zip) |
Implements several main functionalities defined in MIME (Multipurpose Internet Mail Extensions): Base64, Quoted-printable and URL encode/decode
| -| MultiReplace | Thomas Knoefel | https://github.com/daddel80/notepadpp-multireplace | [5.0.0.35 - arm64 bit](https://github.com/daddel80/notepadpp-multireplace/releases/download/5.0.0.35/MultiReplace-v5.0.0.35-ARM64.zip) |
Multi-pattern search & replace across single or multiple files; reusable search/replace lists; CSV column operations (sort, delete, replace); FlowTabs for visual column alignment; external lookup tables; rectangular selection support; conditional (if/then) and math logic.
| +| MultiReplace | Thomas Knoefel | https://github.com/daddel80/notepadpp-multireplace | [6.0.0.36 - arm64 bit](https://github.com/daddel80/notepadpp-multireplace/releases/download/6.0.0.36/MultiReplace-v6.0.0.36-ARM64.zip) |
Multi-pattern search & replace across single or multiple files; reusable search & replace lists; CSV column operations (sort, delete, deduplicate); FlowTabs for visual column alignment; dockable search results; rectangular selection support; Lua/ExprTk formula engine with conditional and math logic.
| | NestedDSV Data Visualizer | Shridhar Kumar | https://github.com/shriprem/NestedDSV | [1.1.0.1 - arm64 bit](https://github.com/shriprem/NestedDSV/releases/download/v1.1.0.1/NestedDSV_arm64.zip) |
Plugin for visualizing hierarchical (nested) delimiter-separated values (DSV) data in Notepad++. Displays cursor position data. Jumps to specific fields. Folding Record Blocks. Extracts Data. Builtin dialogs to configure file-type, record-type & fields; Themes & Colors; and Folding.
| | Notepad++ bplist plugin | Sergiy Azarovsky | https://github.com/azerg/NppBplistPlugin | [3.0.0.0 - arm64 bit](https://github.com/azerg/NppBplistPlugin/releases/download/3.0.0.0/NppBplistPlugin_arm64.zip) |
Supports viewing/editing binary plist files. Due to the fact that ordinary plist files have XML format, this plugin does not support them. It only loads binary plist files (bplist).
| | Notepad++ Plugin Demo | Don HO | https://github.com/npp-plugins/plugindemo | [4.5 - arm64 bit](https://github.com/npp-plugins/plugindemo/releases/download/v4.5/pluginDemo.v4.5.bin.arm64.zip) |
Notepad++ Plugin Demo is written from Notepad++ Plugin Template to demonstrate the usage of plugin API.
| diff --git a/doc/plugin_list_x64.md b/doc/plugin_list_x64.md index 57130d11b..8ea7a354f 100644 --- a/doc/plugin_list_x64.md +++ b/doc/plugin_list_x64.md @@ -31,6 +31,7 @@ version 1.9.6 | Compare | Ty Landercasper, Jean-Sebastien Leroy, Pavel Nedev | https://github.com/pnedev/compare-plugin | [2.0.2 - 64 bit](https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip) | Shows the differences between 2 files (side by side). | | ComparePlus | Pavel Nedev | https://github.com/pnedev/comparePlus | [3.0.0 - 64 bit](https://github.com/pnedev/comparePlus/releases/download/cp_3.0.0/ComparePlus_cp_3.0.0_x64.zip) |
Advanced compare tool based on the well-known Compare-plugin by Ty Landercasper and Jean-Sebastien Leroy.
| | Compose | Randall Joseph Fellmy | https://github.com/Coises/Compose-for-NotepadPlusPlus | [1.1 - 64 bit](https://github.com/Coises/Compose-for-NotepadPlusPlus/releases/download/v1.1/Compose-1.1-x64.zip) |
Implements a Compose key for entering characters not available on the keyboard with easily remembered key sequences.
| +| CompressedFileViewer | Pascal Krenckel | https://github.com/Pascal-Krenckel/CompressedFileViewer | [5.1.0 - 64 bit](https://github.com/Pascal-Krenckel/CompressedFileViewer/releases/download/v5.1.0-ver/CompressedFileViewerX64.zip) |
[Requires .Net 8] A Notepad++ plugin to open and save files in the gzip, bzip2, brotli, XZ or ZStd format.
| | CS-Script - C# Intellisense | Oleg Shilo | https://github.com/oleg-shilo/cs-script.npp | [2.0.13.0 - 64 bit](https://github.com/oleg-shilo/cs-script.npp/releases/download/v2.0.13.0/CSScriptNpp.2.0.13.0.x64.zip) |
CS-Script integration. Implements a real C# Intellisense solution based on CS-Script and Roslyn. Allows loading, executing modifying and debugging C# scripts in a way very similar to the Visual Studio C# projects support. This includes referencing assemblies and other scripts, code formatting, adding missing namespaces and intercepting Debug and Console output.
| | CSV Lint | Bas de Reuver | https://github.com/BdR76/CSVLint/ | [0.4.7 - 64 bit](https://github.com/BdR76/CSVLint/releases/download/0.4.7/CSVLint_x64.zip) |
Syntax highlighting and quality control for csv and fixed width data, detect column and datatypes, convert datetime/decimal format, sql, xml
| | CsvQuery | jokedst | https://github.com/jokedst/CsvQuery | [1.2.9 - 64 bit](https://github.com/jokedst/CsvQuery/releases/download/v1.2.9/CsvQuery-v1.2.9-x64.zip) | Enables SQL queries against CSV files. | @@ -51,6 +52,7 @@ version 1.9.6 | ExtSettings | Andreas Heim | https://sourceforge.net/projects/extsettings | [1.3.1 - 64 bit](https://sourceforge.net/projects/extsettings/files/v1.3.1/plugin/x64/ExtSettings_v1.3.1_x64.zip) | Set various Scintilla settings which are not available via Notepad++ preferences dialog. | | F# Interactive | Prapin Peethambaran | https://github.com/rdipardo/nppFSIPlugin | [0.2.3.4 - 64 bit](https://github.com/rdipardo/nppFSIPlugin/releases/download/v0.2.3.4/NPPFSIPlugin_v0.2.3.4_x64.zip) |
F# source code lexer and IPC client for F# Interactive.
Note: the .NET SDK must be installed separately.
| | FileFinder | UFO-Pu55y | https://github.com/ufo/filefinder | [0.3 - 64 bit](https://github.com/ufo/filefinder/releases/download/v0.3.0/FileFinder.v0.3.0.x64.bin.zip) | Quickly and comfortably find files by name, both in folders and in N++'s file history. | +| FingerText2 | Jimmy Pautz | https://github.com/ultimatejimmy/FingerText2 | [26.5.26.1 - 64 bit](https://github.com/ultimatejimmy/FingerText2/releases/download/26.5.26.1/FingerText2_26.5.26.1_64bit.zip) | Tab-triggered snippet plugin with hotspot navigation, dynamic hotspots, and a snippet dock. | | Fixed-width Data Visualizer | Shridhar Kumar | https://github.com/shriprem/FWDataViz | [2.6.7.0 - 64 bit](https://github.com/shriprem/FWDataViz/releases/download/v2.6.7.0/FWDataViz_x64.zip) |
Fixed Width Data Visualizer adds Excel-like features for fixed-width data files in Notepad++. Displays cursor position data. Foldable Record Blocks; Hop & Jump to specific fields. Field Copy & Field Paste. Data Extraction. Builtin dialogs to configure file-type, record-type & fields; and themes & colors. Automatic File Type Detection. Handles homogenous, mixed & multi-line records. Full Multi-byte character support. Darkmode enabled.
| | Folding Line Hider | leonardchai@gmail.com | https://github.com/leonardchai/FoldingLineHider | [1.1 - 64 bit](https://github.com/leonardchai/FoldingLineHider/releases/download/v1.1/FoldingLineHider1.1.x64.zip) |
This Notepad++ plugin can hide the unsightly folding lines, and for convenience, you can fold and unfold the current level using the Alt + Left/Right keys.
| | GEDCOM Lexer | Stan Mitchell | https://sourceforge.net/projects/gedcomlexer/ | [0.5.0.170 - 64 bit](https://sourceforge.net/projects/gedcomlexer/files/GedcomLexer-0.5.0-r170/GedcomLexer-0.5.0-r170-x64.zip) |
View and edit GEDCOM files with syntax highlighting of: level, xref id, tag, pointer, value and escape tokens. Customize coloration and font styles. Grammar errors are also highlighted. View GEDCOM files in outline mode by folding sections based on line level.
| @@ -67,7 +69,7 @@ version 1.9.6 | jN Notepad++ Plugin | Eugen Kremer | https://github.com/sieukrem/jn-npp-plugin/wiki | [2.2.190.21986 - 64 bit](https://github.com/sieukrem/jn-npp-plugin/releases/download/2.2.190/jN_2.2.190_x64.zip) |
Allows you to extend Notepad++ by using JavaScript.
- You can create new menu elements which execute JavaScript
- You can use manu ActiveX components available on your PC
- You can add shortcuts executing JavaScript
- You can create HTML-based dialogs and docking windows
- You can write JavaScript wrappers around Win32 API
- Since version 2.0.116 you can debug your automating scripts
- Selection highlighting and navigation bar
- Integrated Zen Coding v0.7
- You can catch context menu request and create your own
| | JSFunctionViewer | Sover David | https://github.com/davidsover/nppJSFunctionViewer | [1.1.0 - 64 bit](https://github.com/davidsover/nppJSFunctionViewer/releases/download/v1.1.0/JSFunctionViewer_x64.zip) |
Provides an easier way to view and/or navigate to functions from function calls. Also works with external files if the src attribute is the last attribute of the | still text", + } + ) + ) + markdown = validator.gen_pl_table_from_catalog(catalog) + self.assertIn("Unsafe | Name", markdown) + self.assertIn( + "<script>alert(1)</script> | still text", markdown + ) + self.assertNotIn("