@lingo.dev/compiler@0.4.7

lingodotdev/lingo.dev@lingo.dev/compiler@0.4.7Jun 22, 2026by github-actions[bot]

AI Summary

Security hardening release addressing high-severity CodeQL code-scanning findings related to URL string sanitization.

Key Highlights

Fixed `js/incomplete-url-substring-sanitization` in git-remote parsing
Improved host matching logic to prevent look-alike domains
Removed dead code in XML loader

Full Release Notes

### Patch Changes

- [#2134](https://github.com/lingodotdev/lingo.dev/pull/2134) [`e18811f`](https://github.com/lingodotdev/lingo.dev/commit/e18811febc17473ab3a1c695dff2adf154a7344d) Thanks [@cherkanovart](https://github.com/cherkanovart)! - Resolve high-severity CodeQL code-scanning findings (security hardening):
  - `org-id` git-remote parsing now extracts the URL host and matches the platform by exact host or subdomain suffix (`host === "github.com" || host.endsWith(".github.com")`, etc.) instead of a substring `includes()` check. This fixes `js/incomplete-url-substring-sanitization` (cli, compiler, new-compiler) while still recognizing official alt-SSH hosts like `ssh.github.com` / `altssh.gitlab.com` and rejecting look-alikes like `github.com.evil.com`. Platform labels for all real remote forms are preserved.
  - Removed a dead `.replace("\n", "")` in the XML loader (an earlier `\s+` collapse already strips newlines), which also clears the `js/incomplete-sanitization` finding there.

- Updated dependencies [[`e18811f`](https://github.com/lingodotdev/lingo.dev/commit/e18811febc17473ab3a1c695dff2adf154a7344d)]:
  - lingo.dev@0.137.3