SnapOtterandGitHub 5d5117acf7 fix(deps): close js-yaml DoS alert + document rembg non-reachability (#286)
* fix(deps): patch gray-matter onto js-yaml 4.2.0 (close js-yaml DoS alert)

js-yaml 3.14.2 (quadratic-complexity DoS in merge-key handling, GHSA
patched only in 4.2.0) was kept in the tree by a scoped pnpm override
"gray-matter>js-yaml": "^3.14.1" that exempted gray-matter from the
global js-yaml>=4.2.0 override. gray-matter is a build-time-only
transitive dep of the docs site (vitepress-plugin-llms,
@sugarat/theme-shared) and pinned 3.x because it calls the removed
yaml.safeLoad / yaml.safeDump APIs.

Remove the exemption so gray-matter resolves js-yaml 4.2.0, and add a
pnpm patch renaming safeLoad->load / safeDump->dump (the 4.x
equivalents; load is safe by default). js-yaml 3.x is now gone from the
lockfile.

Verified: gray-matter parse+stringify smoke test passes on 4.2.0; full
VitePress docs build green (177 pages, llms plugin parses all tool
frontmatter with no safeLoad/safeDump error).

* docs(ai): document rembg 2.0.69 pin and advisory non-reachability

The patched rembg 2.0.75 pulls a numpy 2.x closure (numpy>=2.3,
scipy>=1.16, scikit-image>=0.26) that is incompatible with the
numpy==1.26.4-locked AI stack (realesrgan 0.3.0 and codeformer-pip 0.0.4
break on numpy 2.x). Both open rembg advisories are unreachable in this
codebase: rembg is used purely as a library (never the `rembg s`
server), and new_session() only receives allowlisted model names
(remove_bg.py ALLOWED_MODELS), never user-controlled paths. Record this
rationale next to the pin; the Dependabot alerts are dismissed as
not_used.
2026-06-21 23:24:10 +08:00
2026-04-25 01:02:25 +08:00

SnapOtter - A Self-Hosted File Manipulation Suite

Note

SnapOtter v2.0.0 is coming soon. The current Docker image (latest) is v1.x and includes image tools only. v2.0 adds 157 tools across image, video, audio, documents, and data. We're fixing a last-minute issue with local AI installs before publishing the new image. Stay tuned!

Docker Hub GHCR CI OpenSSF Best Practices License Stars Website Live Demo Discord Sponsor

SnapOtter - Dashboard

Key Features

  • 157 tools across 5 modalities:
    • Image (64): resize, crop, compress, convert, watermark, color adjust, beautify screenshots, generate memes, vectorize, GIF tools, find duplicates, passport photos, and more. Supports 55+ input formats (including 23 camera RAW formats) and 14 output formats
    • Video (29): convert, compress, trim, resize, crop, merge, video-to-GIF, extract audio, stabilize, change FPS, burn/extract subtitles, and more
    • Audio (17): convert, trim, normalize, volume, fade, pitch shift, silence removal, noise reduction, merge/split, waveform, and more
    • Documents / PDF (37): merge, split, compress, convert (Word/Excel/PowerPoint/EPUB), protect/unlock, redact, watermark, page numbers, OCR, and more
    • Data (10): CSV/JSON/XML/YAML conversion, CSV merge/split, chart maker, ZIP create/extract
  • Image editor: Layer-based editor with brushes, shapes, adjustments, filters, curves, and keyboard shortcuts. Runs in your browser, processes on your hardware
  • Local AI: Remove backgrounds, upscale images, restore and colorize old photos, erase objects, blur faces, enhance faces, extract text (OCR from images and PDFs), transcribe audio, auto-generate video subtitles, expand canvas, and fix transparency. All on your hardware, no internet required
  • OIDC / SSO: Login with Google, GitHub, Okta, or any OpenID Connect provider
  • 21 languages: English, Arabic, Chinese (Simplified & Traditional), Dutch, French, German, Hindi, Indonesian, Italian, Japanese, Korean, Polish, Portuguese, Russian, Spanish, Swedish, Thai, Turkish, Ukrainian, Vietnamese. RTL support for Arabic
  • Pipelines: Chain tools into reusable workflows with unlimited steps. Import/export as JSON. Batch process unlimited files at once
  • REST API: Every tool available via API with API key auth. Interactive docs at /api/docs
  • Self-hosted stack: SnapOtter + Postgres 17 + Redis 8, run together with one docker compose up. No external SaaS dependencies
  • Multi-arch: Runs on AMD64 and ARM64 (Intel, Apple Silicon, Raspberry Pi)
  • Privacy first: Your files never leave your network. SnapOtter asks once whether you'd like to share anonymous product analytics (which tools are used, errors encountered, never file data). Change anytime in Settings, or set ANALYTICS_ENABLED=false to disable completely

Quick Start

SnapOtter runs as a small Docker Compose stack (app + Postgres 17 + Redis 8). Save this as compose.yaml:

services:
  snapotter:
    image: snapotter/snapotter:latest
    ports: ["1349:1349"]
    environment:
      DATABASE_URL: postgres://snapotter:snapotter@postgres:5432/snapotter
      REDIS_URL: redis://redis:6379
    volumes:
      - snapotter-data:/data
    depends_on: [postgres, redis]
    restart: unless-stopped
  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_USER: snapotter
      POSTGRES_PASSWORD: snapotter
      POSTGRES_DB: snapotter
    volumes: ["snapotter-pgdata:/var/lib/postgresql/data"]
    restart: unless-stopped
  redis:
    image: redis:8-alpine
    volumes: ["snapotter-redisdata:/data"]
    restart: unless-stopped
volumes:
  snapotter-data:
  snapotter-pgdata:
  snapotter-redisdata:

Then start the stack:

docker compose up -d
Have an NVIDIA GPU? Click here for GPU acceleration.

Use the GPU Compose file for GPU-accelerated background removal, upscaling, transcription, and OCR. See Docker Tags for the GPU Compose example and benchmarks.

Default credentials:

Field Value
Username admin
Password admin

You will be asked to change your password on first login.

For Docker Compose, persistent storage, and other setup options, see the Getting Started Guide. For GPU acceleration and tag details, see Docker Tags.

Documentation

Contributing

We welcome bug reports, feature ideas, and pull requests. See CONTRIBUTING.md for the full guide, or jump in:

Support SnapOtter

SnapOtter is built and maintained independently with no venture capital or corporate backing. Sponsorships fund infrastructure, keep releases flowing, and ensure the project stays free and open for everyone.

If SnapOtter saves you from paying for cloud file-processing services, consider supporting its development:

Sponsor SnapOtter on GitHub

Star History Chart

License

This project is dual-licensed under the AGPLv3 and a commercial license.

  • AGPLv3 (free): You may use, modify, and distribute this software under the AGPLv3. If you run a modified version as a network service, you must make your source code available under the AGPLv3.
  • Commercial license (paid): For use in proprietary software or SaaS products where AGPLv3 source-disclosure is not suitable, a commercial license is available. Contact us for pricing and terms.

See LICENSING.md for full details on the open-core boundary between AGPLv3 and commercial code.

Languages
TypeScript 91%
Python 3.5%
JavaScript 2.4%
Shell 1.6%
Astro 1.1%
Other 0.3%