Tha.Les
4f571de38e
* fix: normalize all WAV uploads through ffmpeg and fix Docker jobs permissions - runner.py: remove MP3-only guard in _prepare_local_source; now all local uploads (WAV and MP3) are transcoded to 16-bit 44.1 kHz stereo WAV before Demucs. Professional WAVs (24-bit, 32-bit float, high sample rate, multi-channel) were silently processed by Demucs and output as silence. - Dockerfile: add gosu, add entrypoint script that re-chowns /app/jobs before dropping to the app user. Fixes PermissionError when Docker creates the bind-mount host directory as root on first run. Fixes #75 * chore: update uv.lock for requires-python <3.14 bound * fix: remove invalid StreamReader.close() call in MP3 stem streaming asyncio.create_subprocess_exec sets proc.stdout to asyncio.StreamReader, which has no .close() method. The call crashed every MP3 stem export. Also kill ffmpeg if still running on early exit (client disconnect). * chore: bump version to 0.5.0-alpha.3 in pyproject.toml and version.json * ci: ignore new torch/joblib PYSEC advisories blocked by torch <2.7 pin * fix(ci): suppress trivy DS-0002 for gosu entrypoint privilege-drop pattern * chore: sync uv.lock with 0.5.0-alpha.3 version bump
19 lines
1002 B
Plaintext
19 lines
1002 B
Plaintext
# CVE-2025-32434: torch remote code execution via torch.load, fixed in 2.6.0.
|
|
# The Intel macOS (x86_64) runtime is pinned to torch>=2.2,<2.3 because
|
|
# PyTorch does not publish macOS x86_64 wheels for 2.6.x. StemDeck never
|
|
# calls torch.load() on untrusted input; all model weights are fetched by
|
|
# Demucs from its own trusted cache. Risk on a local single-user app with
|
|
# no network-facing torch.load path is negligible.
|
|
# Drop this ignore once PyTorch publishes 2.6.x macOS x86_64 wheels or once
|
|
# the torchaudio/torchcodec story stabilises and the pin can be lifted.
|
|
CVE-2025-32434
|
|
|
|
# DS-0002: Dockerfile missing USER instruction.
|
|
# The image intentionally starts as root so the entrypoint script
|
|
# (build/docker-entrypoint.sh) can re-chown the bind-mounted /app/jobs
|
|
# directory before dropping to the app user (uid 1001) via gosu. The
|
|
# process runs as non-root for its entire lifetime after the entrypoint
|
|
# executes. Trivy's check does not account for the gosu privilege-drop
|
|
# pattern.
|
|
DS-0002
|