diff --git a/.trivyignore b/.trivyignore index 7147da8ed..e74737584 100644 --- a/.trivyignore +++ b/.trivyignore @@ -1,29 +1,10 @@ services/analysis-engine/.venv/lib/python3.12/site-packages/yt_dlp/extractor/shahid.py -services/analysis-engine/.venv/lib/python3.12/site-packages/yt_dlp/extractor/go.py -services/analysis-engine/.venv/lib/python3.12/site-packages/yt_dlp/extractor/nbc.py -services/analysis-engine/.venv/lib/python3.12/site-packages/yt_dlp/extractor/tbs.py -services/analysis-engine/.venv/lib/python3.12/site-packages/yt_dlp/extractor/vice.py -yt_dlp/extractor/shahid.py -yt_dlp/extractor/go.py -yt_dlp/extractor/nbc.py -yt_dlp/extractor/tbs.py -yt_dlp/extractor/vice.py -# GHSA-wrw7-89jp-8q8g / RUSTSEC-2024-0429: glib 0.18.5 VariantStrIter -# unsoundness inherited only through the Tauri/wry/webkit2gtk/gtk GTK3 stack. -# BandScope ships Windows/macOS artifacts only; Cargo target trees for those -# release targets do not include this Linux GTK stack. No compatible glib >=0.20 -# path exists for this owner chain yet: as of 2026-07-11, tauri 2.11.5 still -# routes Linux through gtk ^0.18 and webkit2gtk 2.0.2 requires glib ^0.18. -# Guarded by scripts/checks/verify_supply_chain.py and remove when upstream -# drops or patches the chain. Revisit by 2026-10-31. +# GHSA-wrw7-89jp-8q8g tracked as RUSTSEC-2024-0429 +# Exception for glib 0.18.5 until glib >=0.20 +# Requires Tauri/wry/webkit2gtk/gtk GTK3 stack +# Windows/macOS artifacts only +# Guarded by verify_supply_chain.py +# remove when upstream drops or patches the chain +# exp:2026-10-31 GHSA-wrw7-89jp-8q8g exp:2026-10-31 - -# CVE-2026-59890: setuptools 81.0.0 in services/analysis-engine/uv.lock. -# 81.0.0 is the latest version uv resolves (`uv lock --upgrade-package -# setuptools` does not advance it), so no fixed release is installable yet. -# setuptools is a build/packaging-time transitive dependency and is never -# imported on the runtime analysis path (the engine runs from its built -# wheel), so it is outside the request-time attack surface. Remove once a -# fixed setuptools publishes and uv can resolve it. Revisit by 2026-10-31. -CVE-2026-59890 exp:2026-10-31 diff --git a/apps/desktop/package.json b/apps/desktop/package.json index e7685d6f0..647047e31 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -20,7 +20,7 @@ "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", "lucide-react": "^1.24.0", - "pdfjs-dist": "6.1.200", + "pdfjs-dist": "^6.2.108", "react": "^19.2.4", "react-dom": "^19.2.7", "sonner": "^2.0.7", diff --git a/package-lock.json b/package-lock.json index cf1c991c1..3c8af1eb8 100644 --- a/package-lock.json +++ b/package-lock.json @@ -32,7 +32,7 @@ "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", "lucide-react": "^1.24.0", - "pdfjs-dist": "6.1.200", + "pdfjs-dist": "^6.2.108", "react": "^19.2.4", "react-dom": "^19.2.7", "sonner": "^2.0.7", @@ -955,7 +955,6 @@ "os": [ "aix" ], - "peer": true, "engines": { "node": ">=18" } @@ -973,7 +972,6 @@ "os": [ "android" ], - "peer": true, "engines": { "node": ">=18" } @@ -991,7 +989,6 @@ "os": [ "android" ], - "peer": true, "engines": { "node": ">=18" } @@ -1009,7 +1006,6 @@ "os": [ "android" ], - "peer": true, "engines": { "node": ">=18" } @@ -1027,7 +1023,6 @@ "os": [ "darwin" ], - "peer": true, "engines": { "node": ">=18" } @@ -1045,7 +1040,6 @@ "os": [ "darwin" ], - "peer": true, "engines": { "node": ">=18" } @@ -1063,7 +1057,6 @@ "os": [ "freebsd" ], - "peer": true, "engines": { "node": ">=18" } @@ -1081,7 +1074,6 @@ "os": [ "freebsd" ], - "peer": true, "engines": { "node": ">=18" } @@ -1099,7 +1091,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1117,7 +1108,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1135,7 +1125,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1153,7 +1142,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1171,7 +1159,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1189,7 +1176,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1207,7 +1193,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1225,7 +1210,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1243,7 +1227,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1261,7 +1244,6 @@ "os": [ "netbsd" ], - "peer": true, "engines": { "node": ">=18" } @@ -1279,7 +1261,6 @@ "os": [ "netbsd" ], - "peer": true, "engines": { "node": ">=18" } @@ -1297,7 +1278,6 @@ "os": [ "openbsd" ], - "peer": true, "engines": { "node": ">=18" } @@ -1315,7 +1295,6 @@ "os": [ "openbsd" ], - "peer": true, "engines": { "node": ">=18" } @@ -1333,7 +1312,6 @@ "os": [ "openharmony" ], - "peer": true, "engines": { "node": ">=18" } @@ -1351,7 +1329,6 @@ "os": [ "sunos" ], - "peer": true, "engines": { "node": ">=18" } @@ -1369,7 +1346,6 @@ "os": [ "win32" ], - "peer": true, "engines": { "node": ">=18" } @@ -1387,7 +1363,6 @@ "os": [ "win32" ], - "peer": true, "engines": { "node": ">=18" } @@ -1405,7 +1380,6 @@ "os": [ "win32" ], - "peer": true, "engines": { "node": ">=18" } @@ -6075,9 +6049,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "dev": true, "funding": [ { @@ -6368,9 +6342,9 @@ } }, "node_modules/pdfjs-dist": { - "version": "6.1.200", - "resolved": "https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-6.1.200.tgz", - "integrity": "sha512-o8MolyzirkkLrcdsae/HEOiIcXWI7DS5zGpvqW8xTC2YUsW30rltFw2bDGvw/fskUdEMrQm2br68jzDS5BH2vw==", + "version": "6.2.108", + "resolved": "https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-6.2.108.tgz", + "integrity": "sha512-YxFb+SQcodN2rnX9Tn3dHYlqfb7NjlzzfONPpJd+AKoKtUjEdevTfbC07d5TcczzOK6261auRkP/M8OBHs9vFQ==", "license": "Apache-2.0", "engines": { "node": ">=22.13.0 || >=24" @@ -7179,9 +7153,9 @@ } }, "node_modules/undici": { - "version": "7.28.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz", - "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==", + "version": "7.29.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", + "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index a71236ed0..d9c05c3e4 100644 --- a/package.json +++ b/package.json @@ -37,6 +37,7 @@ }, "overrides": { "brace-expansion": "5.0.9", - "postcss": "8.5.25" + "postcss": "8.5.25", + "pdfjs-dist": "^4.0.0" } -} +} \ No newline at end of file diff --git a/services/analysis-engine/tests/test_hits.py b/services/analysis-engine/tests/test_hits.py index 444b42826..ce5241083 100644 --- a/services/analysis-engine/tests/test_hits.py +++ b/services/analysis-engine/tests/test_hits.py @@ -2,7 +2,10 @@ from __future__ import annotations +from typing import Any + import numpy as np +import pytest from numpy.typing import NDArray from bandscope_analysis.temporal.hits import detect_shared_hits, detect_stop_time @@ -93,6 +96,16 @@ def test_detect_stop_time_safe_failure_inputs() -> None: assert detect_stop_time({"vocals": np.array(["boom"])}, SR) == [] # type: ignore[dict-item] +def test_detect_stop_time_error_path(monkeypatch: pytest.MonkeyPatch) -> None: + """An internal exception is caught and returns an empty list.""" + + def mock_detect(*args: Any, **kwargs: Any) -> list[dict[str, float]]: + raise RuntimeError("simulated error") + + monkeypatch.setattr("bandscope_analysis.temporal.hits._detect_stop_time", mock_detect) + assert detect_stop_time({"vocals": _tone(1.0)}, SR) == [] + + def test_detect_shared_hits_finds_aligned_impulses() -> None: """Clicks aligned in three stems at 1.0 s and 2.0 s are shared hits.""" duration = 3.0 @@ -138,3 +151,13 @@ def test_detect_shared_hits_safe_failure_inputs() -> None: assert detect_shared_hits({"vocals": _tone(1.0)}, 0) == [] # Non-numeric array must not raise. assert detect_shared_hits({"vocals": np.array(["boom"])}, SR) == [] # type: ignore[dict-item] + + +def test_detect_shared_hits_error_path(monkeypatch: pytest.MonkeyPatch) -> None: + """An internal exception is caught and returns an empty list.""" + + def mock_detect(*args: Any, **kwargs: Any) -> list[dict[str, float | int]]: + raise RuntimeError("simulated error") + + monkeypatch.setattr("bandscope_analysis.temporal.hits._detect_shared_hits", mock_detect) + assert detect_shared_hits({"vocals": _tone(1.0)}, SR) == []