[B0yko]

What changes

Bug fixes found by rebuilding the project from a clean clone and following the README step by step:

• Search. A query containing a capital AND, OR, NOT or NEAR raised an FTS5 syntax error, so the transcript and on-screen channels returned nothing. The four words are now treated as plain words (whole words only).
• FCPXML. Asset src is now a percent-encoded file:// URL. A raw path with a space, # or % in it is not a URL, and Final Cut reported that media as missing.
• API.
  • /api/export/fcpxml applies the same workspace-and-index allowlist as the other file endpoints, before ffprobe runs on a request path. The README already claimed this for every file endpoint.
  • /api/index answers 503 with the real cause when the image model cannot be loaded, instead of an unhandled 500, and claims the run atomically so two quick requests cannot both start one.
  • A different key that fails validation no longer replaces an active licence.
  • The Content-Security-Policy is also sent as a response header with frame-ancestors 'none' (browsers ignore that directive in a <meta> tag, and log an error), plus X-Frame-Options, X-Content-Type-Options and Referrer-Policy. The UI page is served with Cache-Control: no-cache like its scripts and styles.
• Demo scripts. demo/real_videos/download.sh asked YouTube for a single combined stream that it no longer serves. init_demo.sh exits with a message when the trial refused or failed files instead of reporting a ready demo. qa_smoke.py skips the three checks that need the synthetic podcast episodes when no audio is indexed.

Dependencies and CI:

• Python locks: pillow 13.0.0, starlette 1.3.1, python-multipart 0.0.32, urllib3 2.8.0, torch 2.13.0, transformers 5.10.4, sentence-transformers 5.6.1 and others with published advisories. Vulnerable packages go from 16 to 3 in api/uv.lock and from 9 to 3 in service_pipeline/uv.lock. The remaining three have no fix or are not used in the affected way (see SECURITY.md).
• Rust: rustls, rustls-webpki, tokio, webpki-root-certs.
• Actions: checkout v7.0.1, setup-uv v10.3.2, rust-cache v2.9.3 and the current rust-toolchain stable branch, still pinned by SHA, now on Node 24.

Docs: test counts, "searched independently" instead of "in parallel", the unconfigured update check, the Whisper model size (574 MB), measured indexing times, and a new "Dependency advisories" section in SECURITY.md.

Checks

• CI on this branch: run 40021232851, all three jobs green.
• Full runs on a Mac Studio M4 Max, clean clone, macOS 26.5: 556 tests (171 pipeline, 372 API, 13 Deno). With the full demo set all 543 Python tests pass and scripts/qa_smoke.py is 89/89. On a fresh clone with the downloadable demo, 357 pass and 15 skip, and qa_smoke.py is 71/71 with 4 skips.
• 19 search queries return identical top hits and scores (difference 0.0000) before and after the dependency update.
• Every new regression test fails on the previous code and passes with the change.
• The UI was exercised in a browser (search by picture, speech and on-screen text, trim editor, FCPXML export), and the tern command line was run end to end on a folder with spaces in its name.

Not covered

A packaged .app or DMG was not built. The FCPXML was not imported into Final Cut Pro. The UI was checked in a Chromium browser, not in the Tauri webview.