- minimatch below 11.0.1 can blow up a pattern into a huge set of glob parts
(denial of service). c8 12.0.0, the newest, still pulls test-exclude 8, which
pins minimatch ^10.2.2, so Dependabot cannot raise an update on its own.
- Override minimatch to 11.0.8 and glob to 14.0.4 together: glob 13 reads
Minimatch.set as RegExps, which minimatch 11 replaced with Matcher objects,
and glob 14 is the release built on minimatch 11.
- Dev-only: tools/ is excluded from the registry package by .comfyignore, and
c8 only matches the repo's own coverage globs. npm audit now reports 0.
- VALIDATE_INPUTS lets unknown family labels reach create()
- no size is listed under two chips; SD 1.5 3:4 gets true 3:4 sizes
- model change before the families payload loads is applied on load
- custom ratio: clear error on chip click, cap sides at 8192, accept X
- real-host assertions for model change and wired-in state
- render the static chip list in every state; payload only drives enabled/active
- re-derive size on model change via sizeOnModelChange
- validate custom ratio, keep last valid list, ignore repeated commits
- add swap, model change, custom ratio and route failure browser tests
- add coverage floors for the three picker files
Vito Sansevero