mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtterandGitHub
5d5117acf7
* fix(deps): patch gray-matter onto js-yaml 4.2.0 (close js-yaml DoS alert) js-yaml 3.14.2 (quadratic-complexity DoS in merge-key handling, GHSA patched only in 4.2.0) was kept in the tree by a scoped pnpm override "gray-matter>js-yaml": "^3.14.1" that exempted gray-matter from the global js-yaml>=4.2.0 override. gray-matter is a build-time-only transitive dep of the docs site (vitepress-plugin-llms, @sugarat/theme-shared) and pinned 3.x because it calls the removed yaml.safeLoad / yaml.safeDump APIs. Remove the exemption so gray-matter resolves js-yaml 4.2.0, and add a pnpm patch renaming safeLoad->load / safeDump->dump (the 4.x equivalents; load is safe by default). js-yaml 3.x is now gone from the lockfile. Verified: gray-matter parse+stringify smoke test passes on 4.2.0; full VitePress docs build green (177 pages, llms plugin parses all tool frontmatter with no safeLoad/safeDump error). * docs(ai): document rembg 2.0.69 pin and advisory non-reachability The patched rembg 2.0.75 pulls a numpy 2.x closure (numpy>=2.3, scipy>=1.16, scikit-image>=0.26) that is incompatible with the numpy==1.26.4-locked AI stack (realesrgan 0.3.0 and codeformer-pip 0.0.4 break on numpy 2.x). Both open rembg advisories are unreachable in this codebase: rembg is used purely as a library (never the `rembg s` server), and new_session() only receives allowlisted model names (remove_bg.py ALLOWED_MODELS), never user-controlled paths. Record this rationale next to the pin; the Dependabot alerts are dismissed as not_used.
16 lines
421 B
Diff
16 lines
421 B
Diff
diff --git a/lib/engines.js b/lib/engines.js
|
|
index 38f993db06cf364191ac635a6590c2d29303297d..1dfec8d9527653ad9ccfaacfa59732246fdb1e32 100644
|
|
--- a/lib/engines.js
|
|
+++ b/lib/engines.js
|
|
@@ -13,8 +13,8 @@ const engines = exports = module.exports;
|
|
*/
|
|
|
|
engines.yaml = {
|
|
- parse: yaml.safeLoad.bind(yaml),
|
|
- stringify: yaml.safeDump.bind(yaml)
|
|
+ parse: yaml.load.bind(yaml),
|
|
+ stringify: yaml.dump.bind(yaml)
|
|
};
|
|
|
|
/**
|