From d6d062a77132ba7d6ba3b482d46ae329d3b8d695 Mon Sep 17 00:00:00 2001
From: Miodec <jack@monkeytype.com>
Date: Thu, 4 Dec 2025 18:06:50 +0100
Subject: [PATCH 1/4] fix: stored xss in quote approve modal

---
 frontend/src/ts/modals/quote-approve.ts | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/frontend/src/ts/modals/quote-approve.ts b/frontend/src/ts/modals/quote-approve.ts
index f017c7f27bc1..988c7c5a3728 100644
--- a/frontend/src/ts/modals/quote-approve.ts
+++ b/frontend/src/ts/modals/quote-approve.ts
@@ -4,6 +4,7 @@ import * as Notifications from "../elements/notifications";
 import { format } from "date-fns/format";
 import AnimatedModal, { ShowOptions } from "../utils/animated-modal";
 import { Quote } from "@monkeytype/schemas/quotes";
+import { escapeHTML } from "../utils/misc";
 
 let quotes: Quote[] = [];
 
@@ -12,10 +13,10 @@ function updateList(): void {
   quotes.forEach((quote, index) => {
     const quoteEl = $(`
       <div class="quote" data-id="${index}" data-db-id="${quote._id}">
-        <textarea class="text">${quote.text}</textarea>
-        <input type="text" class="source" placeholder="Source" value="${
-          quote.source
-        }">
+        <textarea class="text">${escapeHTML(quote.text)}</textarea>
+        <input type="text" class="source" placeholder="Source" value="${escapeHTML(
+          quote.source,
+        )}">
         <div class="buttons">
           <button disabled class="textButton undo" aria-label="Undo changes" data-balloon-pos="left"><i class="fas fa-fw fa-undo-alt"></i></button>
           <button class="textButton refuse" aria-label="Refuse quote" data-balloon-pos="left"><i class="fas fa-fw fa-times"></i></button>

From 088ca5dc0d2320b683380cd19c0b3cc78a047d52 Mon Sep 17 00:00:00 2001
From: Miodec <jack@monkeytype.com>
Date: Thu, 4 Dec 2025 18:50:42 +0100
Subject: [PATCH 2/4] fix: show all lines causing timed tests to not scroll

---
 frontend/src/ts/test/test-ui.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/frontend/src/ts/test/test-ui.ts b/frontend/src/ts/test/test-ui.ts
index f8050950ac44..d75939f14b2f 100644
--- a/frontend/src/ts/test/test-ui.ts
+++ b/frontend/src/ts/test/test-ui.ts
@@ -254,7 +254,14 @@ export function updateActiveElement(
       void scrollTape();
     }
 
-    if (!Config.showAllLines && previousActiveWordTop !== null) {
+    if (previousActiveWordTop === null) return;
+
+    const isTimedTest =
+      Config.mode === "time" ||
+      (Config.mode === "custom" && CustomText.getLimitMode() === "time") ||
+      (Config.mode === "custom" && CustomText.getLimitValue() === 0);
+
+    if (isTimedTest || !Config.showAllLines) {
       const newActiveWordTop = newActiveWord.offsetTop;
       if (newActiveWordTop > previousActiveWordTop) {
         void lineJump(previousActiveWordTop);

From 2f9195ee561873d099fc371672388e1cde28f852 Mon Sep 17 00:00:00 2001
From: Miodec <jack@monkeytype.com>
Date: Thu, 4 Dec 2025 19:00:03 +0100
Subject: [PATCH 3/4] fix: rare issue where previous test mistakes would show
 in a new test

---
 frontend/src/ts/test/test-ui.ts                    |  6 +++++-
 frontend/src/ts/utils/debounced-animation-frame.ts | 12 ++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/frontend/src/ts/test/test-ui.ts b/frontend/src/ts/test/test-ui.ts
index d75939f14b2f..b647c4dcdcac 100644
--- a/frontend/src/ts/test/test-ui.ts
+++ b/frontend/src/ts/test/test-ui.ts
@@ -26,7 +26,10 @@ import {
 } from "./funbox/list";
 import * as TestState from "./test-state";
 import * as PaceCaret from "./pace-caret";
-import { requestDebouncedAnimationFrame } from "../utils/debounced-animation-frame";
+import {
+  cancelPendingAnimationFramesStartingWith,
+  requestDebouncedAnimationFrame,
+} from "../utils/debounced-animation-frame";
 import * as SoundController from "../controllers/sound-controller";
 import * as Numbers from "@monkeytype/util/numbers";
 import * as TestStats from "./test-stats";
@@ -165,6 +168,7 @@ export function setResultCalculating(val: boolean): void {
 
 export function reset(): void {
   currentTestLine = 0;
+  cancelPendingAnimationFramesStartingWith("test-ui");
 }
 
 export function focusWords(force = false): void {
diff --git a/frontend/src/ts/utils/debounced-animation-frame.ts b/frontend/src/ts/utils/debounced-animation-frame.ts
index a491768aabfe..246f970d3094 100644
--- a/frontend/src/ts/utils/debounced-animation-frame.ts
+++ b/frontend/src/ts/utils/debounced-animation-frame.ts
@@ -19,3 +19,15 @@ function cancelIfPending(frameId: string): void {
     pendingFrames.delete(frameId);
   }
 }
+
+export function cancelPendingAnimationFrame(frameId: string): void {
+  cancelIfPending(frameId);
+}
+
+export function cancelPendingAnimationFramesStartingWith(prefix: string): void {
+  for (const frameId of pendingFrames.keys()) {
+    if (frameId.startsWith(prefix)) {
+      cancelIfPending(frameId);
+    }
+  }
+}

From 132bdc309a96f4a35af74e510954e0606ee120f1 Mon Sep 17 00:00:00 2001
From: Miodec <jack@monkeytype.com>
Date: Thu, 4 Dec 2025 20:50:20 +0100
Subject: [PATCH 4/4] fix: use the right env in env-config plugin

---
 frontend/vite-plugins/env-config.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/frontend/vite-plugins/env-config.ts b/frontend/vite-plugins/env-config.ts
index 414f509fbc0e..702193cd93fb 100644
--- a/frontend/vite-plugins/env-config.ts
+++ b/frontend/vite-plugins/env-config.ts
@@ -1,5 +1,10 @@
 import { Plugin } from "vite";
 import { EnvConfig } from "virtual:env-config";
+import { config as dotenvConfig } from "dotenv";
+
+const envFile =
+  process.env["NODE_ENV"] === "production" ? ".env.production" : ".env";
+dotenvConfig({ path: envFile });
 
 const virtualModuleId = "virtual:env-config";
 const resolvedVirtualModuleId = "\0" + virtualModuleId;