SnapOtter bdadb843d8 fix(security): close remaining high-severity CodeQL alerts ...

- svg-sanitize.ts: strip each dangerous element repeatedly until stable with
  whitespace-tolerant end tags, defeating nested/overlapping tags (closes 5
  incomplete-multi-character-sanitization + 1 bad-tag-filter; the prior
  single-pass regex could leave a residual <script>/<iframe>).
- file-preview.ts: add a resolve()+containment barrier (the path-traversal
  guard CodeQL recognizes) on top of the id charset check (closes 9
  path-injection).
- metadata.ts: bound the XMP namespace:name key segments so parseXmp cannot
  backtrack polynomially (closes js/polynomial-redos).
- analytics-disabled.spec.ts: match analytics by URL host, not substring
  (closes 4 incomplete-url-substring-sanitization).

typecheck + lint green; svg (119), preview (22), metadata (164) tests pass.

2026-06-21 13:47:22 +08:00

..

src

fix(security): close remaining high-severity CodeQL alerts

2026-06-21 13:47:22 +08:00

tests

refactor: rename Tool.alpha to Tool.experimental

2026-03-26 01:10:51 +08:00

package.json

feat!: SnapOtter 2.0.0

2026-06-17 14:33:09 +08:00

stryker.config.json

test: testing overhaul -- CI e2e gates, parallel suites, generated matrices, mutation testing (#215)

2026-06-10 22:01:13 +08:00

tsconfig.json

feat: add image-engine and ai stub packages

2026-03-22 02:44:46 +08:00

vitest.config.ts

feat(image-engine): add Sharp wrapper with 14 image operations

2026-03-22 03:42:40 +08:00