Bump hexo-blog-encrypt from 3.1.9 to 4.0.3

[dependabot]

Bumps hexo-blog-encrypt from 3.1.9 to 4.0.3.

Release notes

Sourced from hexo-blog-encrypt's releases.

v4.0.3

[4.0.3] — 2026-09-04

Fixed

• Script dependency order after decryption (#237) — attach decrypted content before restoring its scripts, wait for ordinary external dependencies before following initializers, and dispatch hexo-blog-decrypt after external scripts load, fail, or reach a 15-second per-script deadline. Preserve existing load/error handlers, CSP nonces, explicit async behavior, import maps, and skipped nomodule/data blocks. Inline modules retain native asynchronous execution; they do not produce a false load timeout. Inspired by WANG-Guangxin's DPlayer fix.
• Template substitution escaping — replacement values containing another {{hbe…}} token are now kept literal. A single pass over the template prevents a later text substitution from bypassing attribute-context escaping.

Tests and demo

• Added deterministic browser regressions for delayed dependencies, manual and cached decryption, callbacks, errors, async scripts, modules, import maps, and timeouts. Added a nested-placeholder escaping regression.
• Added the encrypted script-loading demo (password hello) with a local library, visible initialization checks, and a saved-key reset button. The browser suite exercises its actual markup and library under a held network request and cached reload.

Documentation

• Replaced the unsafe hidden-TOC example that exposed encrypted headings through post.origin; clarified plaintext integration boundaries in both READMEs.
• Corrected callback usage, production packaging, IIFE architecture, current theme checklist, and automated GitHub Release/retry guidance. Added regression checks for these documentation contracts.

No encryption, key-derivation, storage-default, or v4 wire-format changes. Rebuild the site to deploy the updated content-hashed browser bundle.

---

Commits since v4.0.2

• fix: decrypted script order, tested demo, and v4.0.3 (#238) (56c2860)
• ci(release): create GitHub Release on tag (notes from CHANGELOG + commits since prev tag) (d2d4c65)

Full changelog: D0n9X1n/hexo-blog-encrypt@v4.0.2...v4.0.3

v4.0.2

[4.0.2] — 2026-06-07

... (truncated)

Changelog

Sourced from hexo-blog-encrypt's changelog.

[4.0.3] — 2026-09-04

Fixed

• Script dependency order after decryption (#237) — attach decrypted content before restoring its scripts, wait for ordinary external dependencies before following initializers, and dispatch hexo-blog-decrypt after external scripts load, fail, or reach a 15-second per-script deadline. Preserve existing load/error handlers, CSP nonces, explicit async behavior, import maps, and skipped nomodule/data blocks. Inline modules retain native asynchronous execution; they do not produce a false load timeout. Inspired by WANG-Guangxin's DPlayer fix.
• Template substitution escaping — replacement values containing another {{hbe…}} token are now kept literal. A single pass over the template prevents a later text substitution from bypassing attribute-context escaping.

Tests and demo

• Added deterministic browser regressions for delayed dependencies, manual and cached decryption, callbacks, errors, async scripts, modules, import maps, and timeouts. Added a nested-placeholder escaping regression.
• Added the encrypted script-loading demo (password hello) with a local library, visible initialization checks, and a saved-key reset button. The browser suite exercises its actual markup and library under a held network request and cached reload.

Documentation

• Replaced the unsafe hidden-TOC example that exposed encrypted headings through post.origin; clarified plaintext integration boundaries in both READMEs.
• Corrected callback usage, production packaging, IIFE architecture, current theme checklist, and automated GitHub Release/retry guidance. Added regression checks for these documentation contracts.

No encryption, key-derivation, storage-default, or v4 wire-format changes. Rebuild the site to deploy the updated content-hashed browser bundle.

---

[4.0.2] — 2026-06-07

Tests

• stableSalt clean-rebuild e2e regression — added end-to-end coverage for the headline stableSalt guarantee that previously had none. With stableSalt: true + autoSave: true, a clean static rebuild re-emits the same permalink-derived salt but a fresh nonce and ciphertext. A new Playwright test seeds the localStorage key cache from one build, then simulates a rebuild (re-encrypting the same plaintext under the same salt via the server crypto, yielding a new nonce/ciphertext) and asserts the

... (truncated)

Commits

• 56c2860 fix: decrypted script order, tested demo, and v4.0.3 (#238)
• d2d4c65 ci(release): create GitHub Release on tag (notes from CHANGELOG + commits sin...
• 8613cc7 test: add stableSalt clean-rebuild e2e regression; bump v4.0.2 (#236)
• b88fa11 Feat/stable salt (#234)
• 53cf48f chore(claude): add CHANGELOG-gate hook for version tags
• df70bc5 docs: slim docs/, drop feature-crew references, add 4.0.1 CHANGELOG
• 4943637 chore(release): v4.0.1
• 341f63e fix: decrypt button layout and hidden-state rendering across themes (#232)
• 30cf23e chore: remove feature-crew submodule (installed globally)
• 0301a00 docs: promote docs/ to source of truth, slim copilot-instructions
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hexo-blog-encrypt since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)