Tha.Les
ff66e15e6c
* fix: address open issues #169, #170, #173 #170 — Stored XSS via library folder names: folder.name was interpolated raw into innerHTML in the folder render path. Escape it with the existing esc() helper (catalog.js), matching the track render paths. #173 — SoundCloud SSRF surface: drop the on.soundcloud.com share shortener from the host allowlist (it redirects to arbitrary targets) and add a yt-dlp extractor allowlist (allowed_extractors=[youtube, soundcloud]) so a URL that slips past host validation can't invoke the generic extractor. #169 — Version stuck at 0.6.0-alpha.2 for source/Docker/self-hosted: make the version git-tag-derived via hatch-vcs (pyproject dynamic version, app/_version.py build artifact). app_version() now reads package metadata -> _version.py -> dev placeholder; static/version.json is removed (now a build artifact, gitignored). Install sites pin SETUPTOOLS_SCM_PRETEND_VERSION from the release version so shallow CI clones / Docker (no .git) don't break (Dockerfile, make-runtime-pack.sh, make-portable.ps1). make-app.sh defaults VERSION to `git describe`. Desktop version literals (Cargo.toml, package.json, tauri.conf.json) are now 0.0.0 placeholders stamped from the tag at build. The update-check no longer nags dev/source builds. Tests: 81 passed; ruff clean; app_version derives correctly. * build: exclude generated app/_version.py from ruff The hatch-vcs build hook writes app/_version.py during uv sync, and CI's `ruff format --check app/` tripped on it (it's gitignored but present on disk during lint). Add it to ruff's exclude list. * ci: make git-derived version resilient to CI's shallow clone (#169) CI runs uv sync in every step, which builds the editable package and triggers hatch-vcs/setuptools_scm. On Woodpecker's shallow, tagless clone setuptools_scm raises ("unable to detect version"), failing the lint step before ruff runs (and skipping the rest). - Set SETUPTOOLS_SCM_PRETEND_VERSION=0.0.0 in the uv-based CI steps so the build never invokes git for the version (CI only lints/tests, never ships). - Add hatch-vcs fallback-version as a second safety net for shallow source installs outside CI. Verified: uv sync --frozen --all-extras succeeds with the env set. * feat: validate library folder names (reject symbols/markup) Folder names now accept only letters (any language), digits, spaces, and a small safe punctuation set (- _ ' & ( ) . ,). Names with markup or symbols (e.g. the XSS probe, or ±!@£$%^&*()_+{:"|?><) are rejected on Save with an inline message instead of being created. Complements the render-time escaping from #170 by blocking such names at the source. * feat: raise folder name limit to 100 chars + enforce in validator Bump the editor input maxlength from 48 to 100 and reject over-length names on Save with an inline message (defensive, in case the cap is bypassed).
15 lines
247 B
JSON
15 lines
247 B
JSON
{
|
|
"name": "stemdeck-desktop",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"tauri": "tauri",
|
|
"dev": "tauri dev",
|
|
"build": "tauri build"
|
|
},
|
|
"devDependencies": {
|
|
"@tauri-apps/cli": "^2.0.0"
|
|
}
|
|
}
|