chore: add permissions and improve code

.github/workflows/docker.yml

@@ -10,6 +10,8 @@ on:
         required: true
 permissions:
   contents: read
+  packages: write
+
 jobs:
   docker:
     runs-on: ubuntu-latest

.github/workflows/e2e.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build-and-e2e:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -46,6 +46,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+      actions: write
     uses: ./.github/workflows/docker.yml
     secrets:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}

.github/workflows/unit-tests.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build-and-unit:
     runs-on: ubuntu-latest

package.json

@@ -58,7 +58,7 @@
     "list:licenses": "node ./scripts/list-licenses.js",
     "license:check": "npx license-checker --production --onlyAllow 'MIT;ISC;Apache-2.0;BSD;BSD-2-Clause;BSD-3-Clause;CC-BY-4.0;CC0-1.0;Python-2.0 ' --summary",
     "changeset": "npx @changesets/cli --",
-    "release": "npm run build && npm run changeset publish",
+    "release": "npm run build && npm run changeset publish --tag next",
     "publish-cdn": "scripts/publish-cdn.sh"
   },
   "peerDependencies": {

src/utils/helpers.ts

@@ -153,8 +153,8 @@ export function escapeHTMLAttrChars(str: string): string {
 export function unescapeHTMLChars(str: string): string {
   return str
     .replace(/&#(\d+);/g, (_m, code) => String.fromCharCode(parseInt(code, 10)))
-    .replace(/&/g, '&')
-    .replace(/"/g, '"');
+    .replace(/"/g, '"')
+    .replace(/&/g, '&');
 }
 
 export function sanitizeItemId(id: string): string {

src/utils/string.ts

@@ -43,7 +43,7 @@ export function tryDecodeURIComponent(str: string): string {
   try {
     return decodeURIComponent(str);
   } catch (e) {
-    console.error(`Decoding failed: ${str}`, e);
+    console.error('Decoding failed: %s', str, e);
     return str;
   }
 }

src/utils/url.ts

@@ -9,7 +9,7 @@ export function urlParse(url: string, slashesDenoteHost = false): URL | null {
   try {
     return URL?.parse ? URL?.parse(processedUrl) : new URL(processedUrl);
   } catch (error) {
-    console.error(`Invalid URL: ${processedUrl}`, error);
+    console.error('Invalid URL: %s', processedUrl, error);
     return null;
   }
 }