nodes/MajoorWaldi-ComfyUI-Majoor-AssetsManager
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
890 Commits 5 Branches 22 Tags
34aebea35bb28cd93e6c1947c090567becc71087
Commit Graph
145 Commits
Author SHA1 Message Date
EwaldandClaude Sonnet 5 815993aae0 feat(nodes): migrate to ComfyUI Nodes V3 API 
MajoorGenInfoOverride/MajoorSaveImage/MajoorSaveVideo now use
comfy_api.latest.io.ComfyNode (define_schema/execute) exposed via
comfy_entrypoint(), replacing the legacy NODE_CLASS_MAPPINGS dict style.
node_id values are unchanged so existing saved workflows keep resolving
to the same node classes.

Also bumps @comfyorg/comfyui-frontend-types to 1.54.3 (was pinned to
1.47.12) so JS typechecking matches the frontend versions ComfyUI
actually ships.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-09-04 19:44:28 +02:00
Ewald ALOEBOETOE 26f6c7b640 Merge pull request #218 from MajoorWaldi/dependabot/npm_and_yarn/vitest-4.1.11 
chore(deps-dev): bump vitest from 4.1.10 to 4.1.11
 2026-09-04 18:50:58 +02:00
dependabot[bot] ed241b82d8 chore(deps-dev): bump vitest from 4.1.10 to 4.1.11 
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.1.10 to 4.1.11.
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-04 16:50:05 +00:00
dependabot[bot] 76cd9c2a4e chore(deps-dev): bump @vitest/coverage-v8 from 4.1.10 to 4.1.11 
Bumps [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) from 4.1.10 to 4.1.11.
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8)

---
updated-dependencies:
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-04 16:50:01 +00:00
Ewald ALOEBOETOE df18fb356a Merge pull request #220 from MajoorWaldi/dependabot/npm_and_yarn/tanstack/vue-virtual-3.13.36 
chore(deps): bump @tanstack/vue-virtual from 3.13.35 to 3.13.36
 2026-09-04 18:48:07 +02:00
dependabot[bot] 4f63fb752b chore(deps): bump @tanstack/vue-virtual from 3.13.35 to 3.13.36 
Bumps [@tanstack/vue-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/vue-virtual) from 3.13.35 to 3.13.36.
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/vue-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/vue-virtual@3.13.36/packages/vue-virtual)

---
updated-dependencies:
- dependency-name: "@tanstack/vue-virtual"
  dependency-version: 3.13.36
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-04 16:45:49 +00:00
dependabot[bot] 647224cef2 chore(deps-dev): bump eslint from 10.8.1 to 10.9.1 
Bumps [eslint](https://github.com/eslint/eslint) from 10.8.1 to 10.9.1.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.8.1...v10.9.1)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-04 16:45:46 +00:00
Ewald 0db328352a fix: close auth bypass on /api route mirror, revert PrimeVue to MIT 4.5.5 
Security
--------
ComfyUI's PromptServer.add_routes() mirrors every registered route under a
second "/api" prefix, so /mjr/am/<mutation> is also served at
/api/mjr/am/<mutation>. The auth middleware matched only the canonical
prefix, so the mirrored path reached the same handler with the
authentication check skipped entirely, and without the hardening headers:

    POST /mjr/am/assets/delete      -> requires_auth = True
    POST /api/mjr/am/assets/delete  -> requires_auth = False

Replaced the prefix test with a shared _is_majoor_path() boundary covering
the canonical prefixes, ComfyUI's /api mirror, and the /api/v2/assets
compat surface. Verified it does not capture ComfyUI's own routes. CSRF,
rate limiting and safe-mode gates are per-handler and were unaffected.

Licensing
---------
PrimeVue 5 is no longer MIT: PrimeTek moved it to the commercial "PrimeUI"
license, which requires a key, shows a license notice without one, and
forbids redistributing it "as a component library or development tool"
without a separate OEM License. Dependabot had auto-merged 4.5.5 -> 5.0.1.
This project is GPL-3.0 and commits dist/ to the repo, so shipping it would
nag every user and conflict with the GPL's redistribution requirement.

Pinned back to 4.5.5 (last MIT release). The 5.x bump had touched only
package.json/package-lock.json, so no source depended on v5 APIs. The
revert drops @primeui/license-manager and its @noble/ed25519 key-signature
stack; the primevue chunk shrinks 555.70 -> 520.61 kB. Dependabot is now
configured to ignore primevue major bumps.

Correctness
-----------
- api_v2_assets: stop returning the DB's absolute filepath on this
  network-reachable surface; subfolder + root_id already convey location
  without disclosing local disk layout.
- watcher: enforce _RECENT_GENERATED_HARD_CAP after inserting a batch;
  pruning only beforehand let a large batch overshoot the cap.
- routes/registry: track registered route groups individually so a group
  failing part-way through does not re-register earlier groups on retry.
- fs_walker/scanner: apply the viewer's root check to symlinked files, so
  the scanner stops indexing symlinks whose target escapes every allowed
  root ("ghost assets" the viewer then refuses to open). Consulted only for
  actual symlinks, so ordinary scans pay no extra I/O.
- routes/registry_app: skip the redundant app.add_routes() on the live
  PromptServer app; ComfyUI adds the shared table itself after node
  loading, so every core and Majoor route was registered twice at startup.
- Result: unwrap()/unwrap_or()/map() gated on `data is not None`, treating
  a legitimate Ok(None) as failure; gate on `ok` instead.
- custom_roots: replace a leftover debug print() that wrote user file paths
  to stderr on every move request with logger.debug.
- schema: drop the redundant UNIQUE(filepath, source, root_id) index
  (migration m022). assets.filepath is already UNIQUE, so it could never
  reject a row the column constraint does not, nor narrow a lookup - it
  only cost a second B-tree write per asset on the scan hot path.

Frontend
--------
- entry.ts: app.registerExtension() throws on a duplicate name and ComfyUI
  exposes no unregisterExtension, so a live re-import threw before setup()
  ran and the reload-safe teardown never executed. Catch it and re-run
  setup() directly.
- Rebuilt dist/ so both the reload fix and the PrimeVue revert ship.

CI / tooling
------------
- frontend-compat-nightly: the types step died with a bare "cp: cannot
  stat" (upstream's build has not emitted dist/index.d.ts since Aug 26).
  Check both candidate paths and dump dist/ with an actionable message.
- package.json: lenient checks that swallowed their exit code are now
  suffixed :advisory, the plain names are strict, and quality:strict runs
  the full set.

Verified: 1841 Python tests pass (5 skipped, symlink privileges), ruff
clean; tsc --noEmit clean, 831 JS tests pass, eslint clean, build succeeds.
 2026-09-04 18:41:48 +02:00
dependabot[bot] c51713d77d chore(deps): bump pinia from 4.0.2 to 4.0.3 
Bumps [pinia](https://github.com/vuejs/pinia) from 4.0.2 to 4.0.3.
- [Release notes](https://github.com/vuejs/pinia/releases)
- [Commits](https://github.com/vuejs/pinia/compare/v4.0.2...v4.0.3)

---
updated-dependencies:
- dependency-name: pinia
  dependency-version: 4.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-24 06:38:56 +00:00
Ewald ALOEBOETOE 8440ce11f8 Merge pull request #211 from MajoorWaldi/dependabot/npm_and_yarn/vite-8.2.1 
chore(deps-dev): bump vite from 8.1.5 to 8.2.2
 2026-08-24 08:37:01 +02:00
Ewald ALOEBOETOE ed2044b3ae Merge pull request #212 from MajoorWaldi/dependabot/npm_and_yarn/primevue-5.0.1 
chore(deps): bump primevue from 5.0.0 to 5.0.1
 2026-08-24 08:36:35 +02:00
dependabot[bot] 75778dd1dc chore(deps-dev): bump vite from 8.1.5 to 8.2.2 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.1.5 to 8.2.2.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-23 21:18:14 +00:00
dependabot[bot] b530a49aad chore(deps-dev): bump knip from 6.32.1 to 6.32.2 
Bumps [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) from 6.32.1 to 6.32.2.
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.32.2/packages/knip)

---
updated-dependencies:
- dependency-name: knip
  dependency-version: 6.32.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-23 21:18:07 +00:00
dependabot[bot] aa8cb3a4e6 chore(deps-dev): bump oxlint from 1.75.0 to 1.78.0 
Bumps [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) from 1.75.0 to 1.78.0.
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.78.0/npm/oxlint)

---
updated-dependencies:
- dependency-name: oxlint
  dependency-version: 1.78.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-21 07:34:14 +00:00
dependabot[bot] 03254fc757 chore(deps): bump primevue from 5.0.0 to 5.0.1 
Bumps [primevue](https://github.com/primefaces/primevue/tree/HEAD/packages/primevue) from 5.0.0 to 5.0.1.
- [Release notes](https://github.com/primefaces/primevue/releases)
- [Changelog](https://github.com/primefaces/primevue/blob/master/CHANGELOG_ARCHIVE.md)
- [Commits](https://github.com/primefaces/primevue/commits/HEAD/packages/primevue)

---
updated-dependencies:
- dependency-name: primevue
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-21 07:33:58 +00:00
Ewald ALOEBOETOE 6c88dfe4dc Merge pull request #205 from MajoorWaldi/dependabot/npm_and_yarn/primevue-5.0.0 
chore(deps): bump primevue from 4.5.5 to 5.0.0
 2026-08-19 08:45:38 +02:00
Ewald ALOEBOETOE 947f82438d Merge pull request #206 from MajoorWaldi/dependabot/npm_and_yarn/typescript-7.0.2 
chore(deps-dev): bump typescript from 6.0.3 to 7.0.2
 2026-08-18 09:06:10 +02:00
dependabot[bot] a47140338b chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 
Bumps [eslint](https://github.com/eslint/eslint) from 10.8.0 to 10.8.1.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.8.0...v10.8.1)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-17 09:28:10 +00:00
dependabot[bot] 7cbe85b54a chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 
Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-17 09:28:02 +00:00
Ewald ALOEBOETOE 0f91b50fd5 Merge pull request #208 from MajoorWaldi/dependabot/npm_and_yarn/knip-6.32.1 
chore(deps-dev): bump knip from 6.31.0 to 6.32.1
 2026-08-17 11:25:55 +02:00
dependabot[bot] a426c16bad chore(deps-dev): bump @types/node from 26.1.2 to 26.2.0 
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.1.2 to 26.2.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-14 07:34:09 +00:00
dependabot[bot] b6bf6c6c3a chore(deps-dev): bump knip from 6.31.0 to 6.32.1 
Bumps [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) from 6.31.0 to 6.32.1.
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.32.1/packages/knip)

---
updated-dependencies:
- dependency-name: knip
  dependency-version: 6.32.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-14 07:34:03 +00:00
dependabot[bot] b0564d2629 chore(deps): bump primevue from 4.5.5 to 5.0.0 
Bumps [primevue](https://github.com/primefaces/primevue/tree/HEAD/packages/primevue) from 4.5.5 to 5.0.0.
- [Release notes](https://github.com/primefaces/primevue/releases)
- [Changelog](https://github.com/primefaces/primevue/blob/master/CHANGELOG.md)
- [Commits](https://github.com/primefaces/primevue/commits/HEAD/packages/primevue)

---
updated-dependencies:
- dependency-name: primevue
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-14 07:33:44 +00:00
Ewald b700104588 feat: modernize ComfyUI integration and add KJNodes previews 2026-08-12 11:16:06 +02:00
Ewald 52db03fddf refactor: reduce cyclomatic complexity at CI threshold and fix npm vulnerabilities 
- Extract _finalize_saved_workflow from save_workflow (CC 25 -> 18)
- Extract browse/indexed-response helpers from handle_input_scope (CC 25 -> 18)
- Extract _hydrate_rating_tags/_rating_tags_missing from get_asset (CC 25 -> 11)
- Extract grouping/propagation helpers from backfill_job_ids_by_prefix (CC 25 -> <11)
- npm audit fix: nanoid 3.3.18 (high, infinite loop)
- bump brace-expansion override to 5.0.9 (high, DoS GHSA-rgw5-rvv9-x895)

Behavior preserved: 202 targeted Python tests pass, 806 JS tests pass,
quality gate (mypy/bandit/xenon/changed-file CC) passes.
 2026-08-12 09:54:56 +02:00
Ewald ALOEBOETOE ae61308117 Merge pull request #196 from MajoorWaldi/dependabot/npm_and_yarn/vue-3.5.40 
chore(deps): bump vue from 3.5.35 to 3.5.41
 2026-08-12 08:55:34 +02:00
Ewald ALOEBOETOE 535353b766 Merge branch 'main' into dependabot/npm_and_yarn/playwright/test-1.62.1 2026-08-12 08:55:03 +02:00
dependabot[bot] 19e9068b2d chore(deps): bump vue from 3.5.35 to 3.5.41 
Bumps [vue](https://github.com/vuejs/core) from 3.5.35 to 3.5.41.
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](https://github.com/vuejs/core/compare/v3.5.35...v3.5.41)

---
updated-dependencies:
- dependency-name: vue
  dependency-version: 3.5.40
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-12 06:55:01 +00:00
Ewald ALOEBOETOE 83e2e76d93 Merge pull request #198 from MajoorWaldi/dependabot/npm_and_yarn/knip-6.31.0 
chore(deps-dev): bump knip from 6.29.0 to 6.31.0
 2026-08-12 08:54:25 +02:00
Ewald ALOEBOETOE bbdcdab4a8 Merge pull request #199 from MajoorWaldi/dependabot/npm_and_yarn/types/node-26.1.2 
chore(deps-dev): bump @types/node from 26.1.1 to 26.1.2
 2026-08-12 08:52:57 +02:00
dependabot[bot] 13849fd5c6 chore(deps): bump @tanstack/vue-virtual from 3.13.34 to 3.13.35 
Bumps [@tanstack/vue-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/vue-virtual) from 3.13.34 to 3.13.35.
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/vue-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/vue-virtual@3.13.35/packages/vue-virtual)

---
updated-dependencies:
- dependency-name: "@tanstack/vue-virtual"
  dependency-version: 3.13.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-07 07:34:27 +00:00
dependabot[bot] 098f7248cd chore(deps-dev): bump @types/node from 26.1.1 to 26.1.2 
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.1.1 to 26.1.2.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-07 07:34:20 +00:00
dependabot[bot] 4c8c123afd chore(deps-dev): bump knip from 6.29.0 to 6.31.0 
Bumps [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) from 6.29.0 to 6.31.0.
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.31.0/packages/knip)

---
updated-dependencies:
- dependency-name: knip
  dependency-version: 6.31.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-07 07:34:14 +00:00
dependabot[bot] b4c90d5c5f chore(deps-dev): bump @playwright/test from 1.61.1 to 1.62.1 
Bumps [@playwright/test](https://github.com/microsoft/playwright) from 1.61.1 to 1.62.1.
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](https://github.com/microsoft/playwright/compare/v1.61.1...v1.62.1)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-07 07:34:07 +00:00
Ewald bf0fe4b9af Hide unavailable file info and update frontend build 2026-08-06 20:22:59 +02:00
MajoorWaldi 30b2d394b9 Harden bundled Pinia state merging 2026-08-06 19:12:07 +02:00
MajoorWaldi e7a2f8b88d Improve save placeholders and floating viewer 2026-08-06 19:08:06 +02:00
Ewald ALOEBOETOE 23c9113e9f Merge branch 'main' into dependabot/npm_and_yarn/vite-8.1.5 2026-08-06 18:28:32 +02:00
Ewald ALOEBOETOE 1ac0aa6f55 Merge pull request #190 from MajoorWaldi/dependabot/npm_and_yarn/eslint-10.8.0 
chore(deps-dev): bump eslint from 10.7.0 to 10.8.0
 2026-08-06 18:26:21 +02:00
Ewald ALOEBOETOE ef218854b1 Merge pull request #189 from MajoorWaldi/dependabot/npm_and_yarn/knip-6.29.0 
chore(deps-dev): bump knip from 6.25.0 to 6.29.0
 2026-08-06 18:25:54 +02:00
Ewald ALOEBOETOE 38bfb2a431 Merge pull request #191 from MajoorWaldi/dependabot/npm_and_yarn/vitejs/plugin-vue-6.0.8 
chore(deps-dev): bump @vitejs/plugin-vue from 6.0.7 to 6.0.8
 2026-08-06 18:25:24 +02:00
Ewald ALOEBOETOE 14fb5090c6 Merge pull request #193 from MajoorWaldi/dependabot/npm_and_yarn/tanstack/vue-virtual-3.13.34 
chore(deps): bump @tanstack/vue-virtual from 3.13.31 to 3.13.34
 2026-08-06 18:25:05 +02:00
dependabot[bot] fc61d8c583 chore(deps): bump @tanstack/vue-virtual from 3.13.31 to 3.13.34 
Bumps [@tanstack/vue-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/vue-virtual) from 3.13.31 to 3.13.34.
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/vue-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/vue-virtual@3.13.34/packages/vue-virtual)

---
updated-dependencies:
- dependency-name: "@tanstack/vue-virtual"
  dependency-version: 3.13.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-31 07:34:14 +00:00
dependabot[bot] 609bbcc90f chore(deps-dev): bump vite from 8.1.4 to 8.1.5 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.1.4 to 8.1.5.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-31 07:34:07 +00:00
dependabot[bot] 54bbd5266d chore(deps-dev): bump @vitejs/plugin-vue from 6.0.7 to 6.0.8 
Bumps [@vitejs/plugin-vue](https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue) from 6.0.7 to 6.0.8.
- [Release notes](https://github.com/vitejs/vite-plugin-vue/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-vue/blob/main/packages/plugin-vue/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-vue/commits/plugin-vue@6.0.8/packages/plugin-vue)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-vue"
  dependency-version: 6.0.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-31 07:33:58 +00:00
dependabot[bot] 31b2ba4007 chore(deps-dev): bump eslint from 10.7.0 to 10.8.0 
Bumps [eslint](https://github.com/eslint/eslint) from 10.7.0 to 10.8.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.7.0...v10.8.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-31 07:33:48 +00:00
dependabot[bot] c42b2b5579 chore(deps-dev): bump knip from 6.25.0 to 6.29.0 
Bumps [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) from 6.25.0 to 6.29.0.
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.29.0/packages/knip)

---
updated-dependencies:
- dependency-name: knip
  dependency-version: 6.29.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-31 07:33:41 +00:00
bsawang 957960005d fix: npm audit vulnerabilities via postcss upgrade and brace-expansion overrides 
- npm audit fix upgrades postcss to a non-vulnerable version.
- Add package.json overrides for brace-expansion@5.0.8 to resolve
  nested dependency chain (js-beautify -> glob -> minimatch ->
  brace-expansion) without forced breaking changes.
 2026-07-29 15:01:41 +08:00
Ewald ALOEBOETOE 07071e7d76 Merge pull request #186 from MajoorWaldi/agent/fix-viewer-paths-and-write-access-docs 
fix(security): harden workflow path containment and bump brace-expansion
 2026-07-24 16:20:00 +02:00
Ewald 17db2fe9d7 fix(security): harden workflow path containment and bump brace-expansion 
- Resolve CodeQL py/path-injection alerts: enforce lexical containment
  (normpath + prefix check) before any filesystem access in
  list_workflow_versions, diff_workflow_versions,
  list_workflow_thumbnail_candidates and _resolve_path_under_roots,
  with post-resolve symlink re-validation. Also removes a file
  existence oracle for paths outside the allowed roots.
- npm audit fix: brace-expansion DoS (GHSA-3jxr-9vmj-r5cp, dev-only).
 2026-07-24 16:16:50 +02:00