chore: maintenance cleanup (stale PRs, reporter credit, dev deps)

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'npm'
 
       - name: Setup PHP

CHANGELOG.md

@@ -6,7 +6,7 @@
 ### Bug Fixes
 
 * **tabs:** generate editor tab ids without dots ([16cade8](https://github.com/TheWebShop/bootstrap-shortcodes/commit/16cade8dab7de75f946ed602d0c2ce7f6f3b4138))
-* **tabs:** quote bs_tcontent id attribute ([c26659c](https://github.com/TheWebShop/bootstrap-shortcodes/commit/c26659ccb6ddb871c7dee1b77cb81cad63e7a75b))
+* **tabs:** quote bs_tcontent id attribute ([c26659c](https://github.com/TheWebShop/bootstrap-shortcodes/commit/c26659ccb6ddb871c7dee1b77cb81cad63e7a75b)), reported by Andrew Herd ([CVE-2026-112111](https://www.cve.org/CVERecord?id=CVE-2026-112111))
 * update bundled Bootstrap from 3.3.5 to 3.4.1 ([b8f3df4](https://github.com/TheWebShop/bootstrap-shortcodes/commit/b8f3df43ea6d46c466f3bf3b00e14620d5327e3b))
 
 ## [3.4.4](https://github.com/TheWebShop/bootstrap-shortcodes/compare/3.4.2...3.4.4) (2026-03-09)

inc/bs_buttons.php

@@ -4,12 +4,21 @@ function bs_buttons( $params, $content=null ) {
         'size' => '',
         'type' => 'default',
         'value' => 'button',
-        'href' => "#"
+        'href' => "#",
+        'target' => ''
     ), $params ) );
 
     $content = preg_replace( '/<br class="nc".\/>/', '', $content );
     $size_class = ($size && $size !== $type) ? ' btn-' . esc_attr($size) : '';
-    $result = '<a class="btn btn-' . esc_attr($type) . $size_class . '" href="' . esc_url($href) . '">' . esc_attr($value) . '</a>';
+    $target = strtolower( trim( $target ) );
+    $target_attr = '';
+    if ( in_array( $target, array( '_blank', '_self', '_parent', '_top' ), true ) ) {
+        $target_attr = ' target="' . esc_attr($target) . '"';
+        if ( $target === '_blank' ) {
+            $target_attr .= ' rel="noopener noreferrer"';
+        }
+    }
+    $result = '<a class="btn btn-' . esc_attr($type) . $size_class . '" href="' . esc_url($href) . '"' . $target_attr . '>' . esc_attr($value) . '</a>';
     return force_balance_tags( $result );
 }
 add_shortcode( 'bs_button', 'bs_buttons' );

js/plugins/buttons.html

@@ -14,7 +14,8 @@
         var type = $('select[name=type]').val();
         var value = $('input[name=value]').val();
         var link = $('input[name=link]').val();
-        top.tinymce.activeEditor.insertContent('[bs_button size="'+size.toLowerCase()+'" type="'+type.toLowerCase()+'" value="'+value+'" href="'+link+'"]');
+        var target = $('select[name=target]').val();
+        top.tinymce.activeEditor.insertContent('[bs_button size="'+size.toLowerCase()+'" type="'+type.toLowerCase()+'" value="'+value+'" href="'+link+'"'+(target ? ' target="'+target+'"' : '')+']');
         top.tinymce.activeEditor.windowManager.close();
         });
     });
@@ -47,6 +48,11 @@
                 <input type="text" class="form-control" id="value" name="value" placeholder="Value" />
                 <label for="link">Link</label>
                 <input type="text" class="form-control" id="link" name="link" placeholder="#" />
+                <label for="target">Open link in</label>
+                <select class="form-control" id="target" name="target">
+                    <option value="" selected>Same window</option>
+                    <option value="_blank">New tab</option>
+                </select>
             </div>
             <button type="submit" id="insert" class="btn btn-primary">Insert</button>
         </form>

js/plugins/buttons.js

@@ -7,7 +7,7 @@ tinymce.PluginManager.add('bs_buttons', function(editor, url) {
                 title: 'Buttons',
                 url: url + '/buttons.html',
                 width: 480,
-                height: 320
+                height: 380
             });
         }
     });