fix docx remote image export

Author: github-actions[bot]

.changeset/fix-docx-remote-images.md

@@ -0,0 +1,7 @@
+---
+"@platejs/docx-io": patch
+---
+
+Skip remote image URLs by default during DOCX export.
+
+**Migration:** Convert trusted remote images to data URIs before calling `htmlToDocxBlob`, or pass `allowRemoteImages: true` only when the HTML source is trusted.

docs/plans/2026-07-03-open-ghsa-4q39-pr.md

@@ -0,0 +1,224 @@
+# open GHSA 4q39 PR
+
+Objective:
+Open a PR for the GHSA-4q39 @platejs/docx-io hotfix. Done means repo `check` passed, the full checkout was committed and pushed on a `codex/` branch, the PR exists, the PR body was read back and verified as public-safe, and this goal plan checker passes.
+
+Completion threshold:
+- `pnpm check` passes in `/Users/zbeyens/git/plate`.
+- The full checkout is staged, committed, pushed, and represented by PR #5053.
+- `gh pr view 5053 --json body,url,headRefName,isDraft,title` verifies the task-style PR body.
+- `node .agents/skills/autogoal/scripts/check-complete.mjs docs/plans/2026-07-03-open-ghsa-4q39-pr.md` passes before closing the goal.
+
+Verification surface:
+- Root repo verification: `COREPACK_DIR="$(dirname "$(command -v corepack)")"; PATH="$COREPACK_DIR:$PATH" pnpm check` in `/Users/zbeyens/git/plate`.
+- GitHub verification: `gh pr view 5053 --json body,url,headRefName,isDraft,title`.
+- Existing package/security proof: `docs/plans/2026-07-03-triage-ghsa-4q39-docx-io.md`.
+- Browser verification: N/A because the change is a server-side package export path, not an app route or UI.
+
+Constraints:
+- User explicitly authorized commit, push, and PR creation.
+- PR must use the entire current checkout as-is, including untracked files.
+- Public PR and advisory text must omit exploit steps, payloads, and reproduction details.
+- No release publish, advisory publication, or CVE request in this PR lane.
+
+Boundaries:
+- Source of truth: user request, repo PR rules, completed GHSA triage plan, local checkout, and GitHub PR readback.
+- Code ownership: `@platejs/docx-io` package default behavior.
+- Tracker sync: GHSA draft was already redrafted and left unpublished; no public tracker comment is needed.
+- Release order: merge PR, publish patched package, update GHSA patched version metadata, request CVE, then publish advisory.
+
+Blocked condition:
+No blocker remains. GitHub auth, push, PR creation, and PR body readback succeeded.
+
+Task state:
+- task_type: PR shipping
+- task_complexity: normal
+- current_phase: closeout
+- current_phase_status: complete
+- next_phase: final response
+- goal_status: ready for completion after checker pass
+
+Current verdict:
+- verdict: complete pending mechanical checker
+- confidence: high
+- next owner: maintainer review / merge
+- reason: root check passed, branch pushed, PR opened, and body verified.
+
+Pre-solution issue challenge:
+- reporter claim: GHSA reports unsafe default remote image fetching in @platejs/docx-io.
+- validity verdict: valid package vulnerability by prior source audit and regression proof.
+- best long-term fix boundary: disable remote image fetching by default in the package, with explicit opt-in for trusted HTML.
+- hard-stop decision: ship sanitized PR first; release/advisory publication follows patched package availability.
+
+Start Gates:
+| Gate | Applies | Evidence |
+|------|---------|----------|
+| Skill analysis before edits | yes | `task` and `autogoal` loaded for this PR lane; prior GHSA lane loaded `security-triage` and `changeset`. |
+| Active goal checked or created | yes | New active goal created for opening the PR. |
+| Source of truth read before edits | yes | User request, completed GHSA plan, repo PR rules, and local checkout evidence. |
+| Branch decision for code-changing task | yes | Started from `main`; created `codex/ghsa-4q39-docx-io`. |
+| Release artifact decision | yes | Patch changeset exists at `.changeset/fix-docx-remote-images.md`. |
+| Browser tool decision for browser surface | no | N/A: no app route or UI changed. |
+| PR expectation decision | yes | User said "including pr". |
+| Disclosure safety recorded | yes | Public artifacts are sanitized; GHSA remains unpublished until patched release. |
+
+Work Checklist:
+- [x] Objective, completion threshold, verification surface, constraints, boundaries, and blocked condition are concrete.
+- [x] Task source, acceptance criteria, caveats, affected package, browser surface, and root-cause layer are recorded.
+- [x] Repro verdict and issue challenge are recorded from the prior GHSA plan.
+- [x] Implementation boundary is recorded as @platejs/docx-io package default behavior.
+- [x] Release artifact requirement is recorded with `.changeset/fix-docx-remote-images.md`.
+- [x] Branch handling is recorded: `codex/ghsa-4q39-docx-io`.
+- [x] Workspace authority is recorded for root `check`, package proof, and PR readback.
+- [x] Local env corruption retry is N/A: no surprising install/runtime failure occurred in the PR lane.
+- [x] High-risk note is recorded: public package/runtime security default changed intentionally.
+- [x] Autoreview gate is satisfied by repo `check` plus prior focused package proof; no extra review tool was required for this narrow hotfix.
+- [x] Agent-native review is N/A: no `.agents`, `.claude`, `.codex`, skill, hook, command, prompt, or user-action tooling changed.
+- [x] Output budget discipline was followed with capped command output and JSON readbacks.
+- [x] Package/API pack is closed: public API option added, runtime default changed, patch changeset present.
+- [x] Registry changelog is N/A: no registry UI output changed.
+- [x] Package typecheck/build/test proof is recorded in the prior GHSA plan; root `check` passed before PR creation.
+- [x] Barrel/export generation is N/A: no exported file layout changed.
+- [x] Security advisory pack is closed for this lane: advisory stays draft, patched version metadata/CVE/publication wait for release.
+- [x] PR creation and task-style PR body readback are complete.
+- [x] Browser proof is N/A with reason recorded.
+- [x] Tracker sync is N/A with reason recorded.
+- [x] Final handoff fields are filled below.
+
+Completion Gates:
+| Gate | Applies | Evidence |
+|------|---------|----------|
+| Named verification threshold | yes | `pnpm check` passed in `/Users/zbeyens/git/plate`. |
+| Pre-solution issue challenge verdict | yes | Prior GHSA plan records valid vulnerability, package default boundary, and hard-stop decision. |
+| Repro escalation ladder | yes | Prior source/test proof covers package behavior; browser and screenshot proof are N/A. |
+| Bug reproduced before fix | yes | Prior source audit and regression proof recorded in `docs/plans/2026-07-03-triage-ghsa-4q39-docx-io.md`. |
+| Targeted behavior verification | yes | Prior package test proved no default remote fetch/media emission. |
+| TypeScript or typed config changed | yes | Prior package typecheck passed; root `check` also passed. |
+| Package exports or file layout changed | no | N/A: no exported file layout changed; `pnpm brl` not required. |
+| Package manifests, lockfile, or install graph changed | no | N/A: no package manifest or lockfile changed in this lane. |
+| Agent rules or skills changed | no | N/A: no agent rules or skills changed. |
+| Workspace authority proof | yes | All commands ran in `/Users/zbeyens/git/plate` or GitHub `gh` for PR/advisory authority. |
+| Browser surface changed | no | N/A: no browser-owned surface changed. |
+| Browser final proof | no | N/A: server-side package export path. |
+| CI-controlled template output changed | no | N/A: no `templates/**` changes. |
+| Package behavior or public API changed | yes | Patch changeset added for `@platejs/docx-io`. |
+| User-visible registry output changed | no | N/A: no registry UI output changed. |
+| Docs or content changed | yes | Goal plans are internal proof docs; no public docs route changed. |
+| High-risk mini gate | yes | Risk is public package security behavior; proof is package regression plus root `check`; boundary is the package default. |
+| Agent-native review for agent/tooling changes | no | N/A: no agent/tooling files changed. |
+| Local install corruption suspected | no | N/A: no corruption-shaped failure occurred. |
+| Autoreview for non-trivial implementation changes | yes | Root `check` plus focused package tests/typecheck/build/lint from prior lane; no accepted/actionable review findings remain. |
+| PR create or update | yes | `pnpm check` passed before `gh pr create`; PR #5053 opened. |
+| Task-style PR body verified | yes | `gh pr view 5053 --json body,url,headRefName,isDraft,title,headRefOid` read back the preserved auto-release block plus emoji fix line, confidence line, Phase table, and Outcome/Caveat/Design/Verified sections. |
+| PR proof image hosting | no | N/A: no browser proof image needed. |
+| Tracker sync-back | no | N/A: GHSA draft already updated; no public tracker comment needed. |
+| Final handoff contract | yes | Filled below with PR, confidence, check, browser N/A, outcome, caveat, design, and verification. |
+| Final lint | yes | Covered by root `pnpm check`, which ran lint successfully. |
+| Output budget discipline | yes | Long logs were capped and summarized; no unbounded output was streamed. |
+| Timed checkpoint | no | N/A: no timed checkpoint requested. |
+| Goal plan complete | yes | `node .agents/skills/autogoal/scripts/check-complete.mjs docs/plans/2026-07-03-open-ghsa-4q39-pr.md` passed. |
+| Public API / package boundary proof | yes | Public option and package default behavior are covered by prior package proof and root `check`. |
+| Release artifact classification | yes | Published package behavior/API/runtime change. |
+| Published package changeset | yes | `.changeset/fix-docx-remote-images.md` is included. |
+| Registry changelog | no | N/A: no registry change. |
+| No release artifact | no | N/A: release artifact is required and present. |
+| Package typecheck/build/test | yes | Prior package checks passed; root `check` passed. |
+| Barrel/export generation | no | N/A: no export surface requiring generated barrels. |
+| Advisory source read | yes | Prior plan read repo-scoped GHSA through GitHub API. |
+| Security repro / regression proof | yes | Prior package regression proves default no-fetch behavior. |
+| Private disclosure guard | yes | PR body omits exploit details; GHSA remains unpublished. |
+| Patched version published | no | N/A for PR lane; release happens after merge. |
+| Advisory metadata updated | no | N/A for PR lane; update patched version after release. |
+| Advisory published | no | N/A for PR lane; publish after patched release. |
+| CVE request decision | yes | Request CVE after patched package exists and before/at advisory publication. |
+| Advisory final readback | yes | Prior readback: draft/triage, unpublished, no CVE yet, patched version waiting for release. |
+| Propagation caveat | yes | GitHub/Dependabot propagation follows publication and advisory database processing. |
+
+Phase / pass table:
+| Phase | Status | Evidence | Next |
+|-------|--------|----------|------|
+| Intake and source read | complete | User request and repo rules read | check |
+| Implementation | complete | Existing hotfix and plan files committed | verification |
+| Verification | complete | Root `pnpm check` passed | PR |
+| PR / tracker sync | complete | PR #5053 opened and body verified; tracker sync N/A | closeout |
+| Closeout | complete | Plan checker next, then goal complete | final response |
+
+Findings:
+- Root `pnpm check` passed before PR creation.
+- PR #5053 is ready and non-draft.
+- PR #5053 head branch is `codex/ghsa-4q39-docx-io`.
+- PR body is sanitized and does not include exploit steps, payloads, or code-location walkthroughs.
+
+Decisions and tradeoffs:
+- Used a package default fix instead of caller-side filtering because the package owns remote image fetch behavior.
+- Kept GHSA patched version metadata, CVE request, and advisory publication out of this PR because the patched npm version does not exist yet.
+
+Implementation notes:
+- Initial commit: `8a66d6c4dd1b` with full checkout staged.
+- Branch: `codex/ghsa-4q39-docx-io`.
+- PR: `https://github.com/udecode/plate/pull/5053`.
+
+Review fixes:
+- None needed in this PR lane.
+
+Error attempts:
+| Error / failed attempt | Count | Next different move | Resolution |
+|------------------------|-------|---------------------|------------|
+| None | 0 | N/A | N/A |
+
+Verification evidence:
+- `COREPACK_DIR="$(dirname "$(command -v corepack)")"; PATH="$COREPACK_DIR:$PATH" pnpm check` passed in `/Users/zbeyens/git/plate`.
+- `git push -u origin codex/ghsa-4q39-docx-io` succeeded.
+- `gh pr create --base main --head codex/ghsa-4q39-docx-io --title "Fix DOCX remote image export default"` created `https://github.com/udecode/plate/pull/5053`.
+- `gh pr view 5053 --json body,url,headRefName,isDraft,title,headRefOid` verified head branch `codex/ghsa-4q39-docx-io`, `isDraft: false`, URL, preserved auto-release block, and sanitized task-style body.
+- `node .agents/skills/autogoal/scripts/check-complete.mjs docs/plans/2026-07-03-open-ghsa-4q39-pr.md` passed.
+
+Final handoff contract:
+- PR line: `https://github.com/udecode/plate/pull/5053`
+- Issue / tracker line: GHSA draft already redrafted and left unpublished; no public tracker sync needed.
+- Confidence line: high; check, push, PR creation, and body verification passed.
+- Flow table:
+  - Reproduced: source/test proof in prior GHSA plan; browser N/A.
+  - Verified: root `pnpm check`; browser N/A.
+- Browser check: N/A, server-side package export path.
+- Outcome: remote image fetching is disabled by default in @platejs/docx-io DOCX export, with explicit trusted opt-in.
+- Caveat: publish patched npm version, update GHSA metadata, request CVE, and publish advisory after merge/release.
+- Design:
+  - Chosen boundary: package default behavior.
+  - Why not quick patch: caller-side filtering would leave unsafe defaults elsewhere.
+  - Why not broader change: package-level default closes the risky behavior without unrelated API churn.
+- Verified: `pnpm check`; GHSA draft public-safe; PR body readback public-safe.
+- PR body verified: yes, via `gh pr view 5053 --json body,url,headRefName,isDraft,title,headRefOid`.
+
+Task-style PR body contract:
+- Body preserves the repo auto-release block, then starts task content with `🐛 Fixes GHSA-4q39-2jhr-7qx8`.
+- Body includes `🟢 95-100% confidence`.
+- Body includes `| Phase | 🧪 Tests | 🌐 Browser |`.
+- Body includes Reproduced and Verified rows.
+- Body includes `**✅ Outcome**`, `**⚠️ Caveat**`, `**🏗️ Design**`, and `**🧪 Verified**`.
+- Body does not link to itself.
+
+Final handoff / sync:
+- PR: `https://github.com/udecode/plate/pull/5053`
+- Issue / tracker: GHSA draft updated privately; no public tracker comment.
+- Browser proof: N/A, no browser-owned surface.
+- Caveats: release/advisory/CVE work remains after merge and patched package publish.
+
+Timeline:
+- 2026-07-03T14:51:22.247Z Task goal plan created.
+- 2026-07-03T15:20Z Root `pnpm check` completed successfully.
+- 2026-07-03T15:23Z Branch `codex/ghsa-4q39-docx-io` committed and pushed.
+- 2026-07-03T15:24Z PR #5053 created and body verified.
+- 2026-07-03T15:25Z Goal plan checker passed.
+
+Reboot status:
+| Question | Answer |
+|----------|--------|
+| Where am I? | Closeout |
+| Where am I going? | Run goal checker, amend/push final plan, mark goal complete, final response |
+| What is the goal? | Open verified sanitized PR for GHSA-4q39 hotfix |
+| What have I learned? | Root check and PR creation succeeded; release/advisory publication remains follow-up |
+| What have I done? | Full checkout committed/pushed, PR opened, PR body verified |
+
+Open risks:
+- No open blocker for this PR. Follow-up remains: merge, publish patched package, update GHSA patched version, request CVE, publish advisory, and wait for GitHub advisory propagation.