Jahia Cloud - Threads and heap dumps provider

Bug Fixes

Fix RepositoryException: Invalid path for dump folders with colons in their name (SUPPORT-608)

Dump directories generated by Jahia Cloud use ISO 8601 timestamps as folder names
(e.g. 2026-01-22T14:15:28.106Z_cluster_restart). The colon character (:) in those
names is the JCR namespace separator and is illegal in unqualified JCR node names,
causing Jackrabbit to throw a MalformedPathException whenever the external content
store provider tried to look up extension nodes for those folders:

javax.jcr.RepositoryException: Invalid path: … ':' not valid name character
    at org.jahia.modules.external.ExternalNodeImpl.getExtensionNode(…)

Root cause: JCRContentUtils.escapeLocalNodeName() (Jackrabbit's
Text.escapeIllegalJcrChars) escapes % as %25. Because VFS2 returns file paths
in percent-encoded URI form, a file named …T08:44:34… was already represented as
…T08%3A44%3A34… by the time the escape function was applied — causing % to be
re-encoded to %25 (double-encoding), which then confounded extension-node path
resolution under Jahia 8.2.3.0.

Fix: Introduced a package-private Escaping utility class whose
escapeIllegalJcrChars method encodes only the characters that are genuinely illegal
in JCR unqualified names ([ ] * | :), deliberately leaving % untouched. This
prevents double-encoding of paths that VFS2 has already percent-encoded. VFS2's
resolveFile() uses URI semantics and decodes %3A back to : transparently when
accessing the local filesystem, so path resolution is correct regardless of whether
the input carries a bare colon or an encoded one.

Improvements

Privilege check migrated to JCRSessionFactory (SUPPORT-608)

The admin-access check in JahiaCloudDumpDataSource.getPrivilegesNames() was
rewritten to use JCRSessionFactory.getInstance().getCurrentUserSession() +
hasPermission("admin") instead of the deprecated
ServicesRegistry → JahiaGroupManagerService.isAdminMember() call.

Highlights

• WCAG 2.1 AA accessibility compliance achieved across the admin UI, including AAA contrast for read-only text.
• Security hardening via Dependabot automation and multiple CVE fixes (systeminformation, axios, @babel/plugin-transform-modules-systemjs, fast-uri, ip-address).
• Developer experience improvements: Claude/AGENTS context files added, SECURITY.md streamlined.

Features

• Added Dependabot configuration (dependabot.yml) for automated dependency monitoring.
• Added Claude basic context and AGENTS.md (renamed from CLAUDE.md, with CLAUDE.md reference) for AI-assisted development.

Fixes

• Accessibility (WCAG 2.1 AA):
  • CRIT-1: Replaced dynamic role live region with two separate always-in-DOM regions (status + alert) to prevent AT role mutations.
  • CRIT-2: Associated Browse button with new-tab hint via aria-describedby and matching id on sr-only span.
  • MAJ-1: Added required and aria-required=true to the mount path input.
  • MAJ-2: Added aria-invalid on error and extended aria-describedby to include inline error message span (role=alert).
  • MAJ-3: Returns focus to Save button on success, mount path input on error; removed programmatic focus to sr-only live region.
  • MAJ-6: Darkened read-only field border #e0e0e0 -> #767676 for 3:1 contrast.
  • MIN-1: Updated mountPathHint locale to document Ctrl+Enter shortcut.
  • MIN-2: Added aria-hidden=true to alert icon spans.
  • MIN-4: Added autoComplete=off to mount path input.
  • Darkened read-only text #555 -> #525252 for AAA contrast on #f5f5f5 backgrounds.
• Security / CVEs:
  • Upgraded systeminformation 5.31.5 -> 5.31.6 via resolution override (command injection in networkInterfaces()).
  • Upgraded @babel/plugin-transform-modules-systemjs, fast-uri, axios, ip-address to address Dependabot alerts.

Refactoring

• Streamlined SECURITY.md: removed supported versions section, added link to security information.
• Renamed CLAUDE.md to AGENTS.md with CLAUDE.md reference pointer.

Full Changelog: 2_0_0...2_0_1

Tag: https://github.com/Jahia/jahia-cloud-threads-heap-dumps-provider/releases/tag/2_0_0

Full changelog; https://github.com/Jahia/jahia-cloud-threads-heap-dumps-provider/compare/1_0_1...2_0_0

Tag: https://github.com/Jahia/jahia-cloud-threads-heap-dumps-provider/releases/tag/1_0_0

Full changelog; https://github.com/Jahia/jahia-cloud-threads-heap-dumps-provider/compare/1_0_0...1_0_1

Tag: https://github.com/Jahia/jahia-cloud-threads-heap-dumps-provider/releases/tag/1_0_0