🧪 [테스트 개선: test_hits.py 에러 경로 테스트 추가]

.trivyignore

@@ -1,29 +1,10 @@
 services/analysis-engine/.venv/lib/python3.12/site-packages/yt_dlp/extractor/shahid.py
-services/analysis-engine/.venv/lib/python3.12/site-packages/yt_dlp/extractor/go.py
-services/analysis-engine/.venv/lib/python3.12/site-packages/yt_dlp/extractor/nbc.py
-services/analysis-engine/.venv/lib/python3.12/site-packages/yt_dlp/extractor/tbs.py
-services/analysis-engine/.venv/lib/python3.12/site-packages/yt_dlp/extractor/vice.py
-yt_dlp/extractor/shahid.py
-yt_dlp/extractor/go.py
-yt_dlp/extractor/nbc.py
-yt_dlp/extractor/tbs.py
-yt_dlp/extractor/vice.py
 
-# GHSA-wrw7-89jp-8q8g / RUSTSEC-2024-0429: glib 0.18.5 VariantStrIter
-# unsoundness inherited only through the Tauri/wry/webkit2gtk/gtk GTK3 stack.
-# BandScope ships Windows/macOS artifacts only; Cargo target trees for those
-# release targets do not include this Linux GTK stack. No compatible glib >=0.20
-# path exists for this owner chain yet: as of 2026-07-11, tauri 2.11.5 still
-# routes Linux through gtk ^0.18 and webkit2gtk 2.0.2 requires glib ^0.18.
-# Guarded by scripts/checks/verify_supply_chain.py and remove when upstream
-# drops or patches the chain. Revisit by 2026-10-31.
+# GHSA-wrw7-89jp-8q8g tracked as RUSTSEC-2024-0429
+# Exception for glib 0.18.5 until glib >=0.20
+# Requires Tauri/wry/webkit2gtk/gtk GTK3 stack
+# Windows/macOS artifacts only
+# Guarded by verify_supply_chain.py
+# remove when upstream drops or patches the chain
+# exp:2026-10-31
 GHSA-wrw7-89jp-8q8g exp:2026-10-31
-
-# CVE-2026-59890: setuptools 81.0.0 in services/analysis-engine/uv.lock.
-# 81.0.0 is the latest version uv resolves (`uv lock --upgrade-package
-# setuptools` does not advance it), so no fixed release is installable yet.
-# setuptools is a build/packaging-time transitive dependency and is never
-# imported on the runtime analysis path (the engine runs from its built
-# wheel), so it is outside the request-time attack surface. Remove once a
-# fixed setuptools publishes and uv can resolve it. Revisit by 2026-10-31.
-CVE-2026-59890 exp:2026-10-31

apps/desktop/package.json

@@ -20,7 +20,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "lucide-react": "^1.24.0",
-    "pdfjs-dist": "6.1.200",
+    "pdfjs-dist": "^6.2.108",
     "react": "^19.2.4",
     "react-dom": "^19.2.7",
     "sonner": "^2.0.7",

package.json

@@ -37,6 +37,7 @@
   },
   "overrides": {
     "brace-expansion": "5.0.9",
-    "postcss": "8.5.25"
+    "postcss": "8.5.25",
+    "pdfjs-dist": "^4.0.0"
   }
-}
+}

services/analysis-engine/tests/test_hits.py

@@ -2,7 +2,10 @@
 
 from __future__ import annotations
 
+from typing import Any
+
 import numpy as np
+import pytest
 from numpy.typing import NDArray
 
 from bandscope_analysis.temporal.hits import detect_shared_hits, detect_stop_time
@@ -93,6 +96,16 @@ def test_detect_stop_time_safe_failure_inputs() -> None:
     assert detect_stop_time({"vocals": np.array(["boom"])}, SR) == []  # type: ignore[dict-item]
 
 
+def test_detect_stop_time_error_path(monkeypatch: pytest.MonkeyPatch) -> None:
+    """An internal exception is caught and returns an empty list."""
+
+    def mock_detect(*args: Any, **kwargs: Any) -> list[dict[str, float]]:
+        raise RuntimeError("simulated error")
+
+    monkeypatch.setattr("bandscope_analysis.temporal.hits._detect_stop_time", mock_detect)
+    assert detect_stop_time({"vocals": _tone(1.0)}, SR) == []
+
+
 def test_detect_shared_hits_finds_aligned_impulses() -> None:
     """Clicks aligned in three stems at 1.0 s and 2.0 s are shared hits."""
     duration = 3.0
@@ -138,3 +151,13 @@ def test_detect_shared_hits_safe_failure_inputs() -> None:
     assert detect_shared_hits({"vocals": _tone(1.0)}, 0) == []
     # Non-numeric array must not raise.
     assert detect_shared_hits({"vocals": np.array(["boom"])}, SR) == []  # type: ignore[dict-item]
+
+
+def test_detect_shared_hits_error_path(monkeypatch: pytest.MonkeyPatch) -> None:
+    """An internal exception is caught and returns an empty list."""
+
+    def mock_detect(*args: Any, **kwargs: Any) -> list[dict[str, float | int]]:
+        raise RuntimeError("simulated error")
+
+    monkeypatch.setattr("bandscope_analysis.temporal.hits._detect_shared_hits", mock_detect)
+    assert detect_shared_hits({"vocals": _tone(1.0)}, SR) == []