Repository navigation
fix: keep the preset picker hover working in Demo Mode - #623
Merged
Merged
Conversation
dompurify 3.4.17 clears GHSA-cg2g-xh64-v4q7 (SAFE_FOR_TEMPLATES expressions surviving in shadow roots), GHSA-mrv2-3pqr-j5jr (IN_PLACE hooks that detach a parent or sibling leave its handlers armed) and GHSA-c6gr-qvv4-5v3f (SMIL attributeName=href guard skipped in XHTML mode). All three need options the app does not use: src/lib/sanitize.ts sets none of SAFE_FOR_TEMPLATES, IN_PLACE, RETURN_DOM, PARSER_MEDIA_TYPE or a hook. ^3.4.11 already allows it, so only the lockfile moves. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Stefan Vill <stefan.vill@tngtech.com>
ip-address 10.7.4 clears GHSA-rxp7-6hxx-x8q5 (CVE-2026-111997): Address6 stripped a zone identifier with /%.*$/ before its length check, so a long run of '%' followed by a newline took quadratic time to reject. It is reached only through @modelcontextprotocol/sdk's express-rate-limit (ip-address ^10.2.0), which the SDK uses in its OAuth server handlers; the app only imports the MCP client. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Stefan Vill <stefan.vill@tngtech.com>
vitest 4.1.12 pins @vitest/mocker 4.1.12, which clears GHSA-qxg6-89mg-rqv8 (CVE-2026-112949, code injection through an unauthenticated manual-mock registration on the dev-server WebSocket) and GHSA-xp26-3454-mjgp (CVE-2026-112950, a Windows backslash traversal past the redirect allowlist). vitest 4.1.11 pins @vitest/mocker exactly, so vitest itself has to move. Dev-only: the handlers exist only while a Vite server runs with mockerPlugin/interceptorPlugin. Re-resolving vitest also lifts its in-range chai 6.3.0 and tinyrainbow 3.2.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Stefan Vill <stefan.vill@tngtech.com>
gitpython 3.2.1 clears GHSA-83vg-56qc-22m7 (CVE-2026-114145): create_submodule() cloned into a ".git/hooks" path before rejecting it, so a crafted submodule could plant an executable hook. Only reachable when a submodule path comes from untrusted input. gitpython sits in the ComfyUI environment for ComfyUI-Manager. Its runtime requirements are unchanged (gitdb>=4.0.1,<5). The ComfyUI lock was updated in place with only the gitpython entry and its specifier. Both uv 0.12.5 and the bundled 0.13.5 accept it with `uv lock --check`, and the sdist and wheel hashes were checked against the downloaded files. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Stefan Vill <stefan.vill@tngtech.com>
electron 44.5.0 clears GHSA-x562-297c-g43g (CVE-2026-113798): pointer lock permission requests from some cross-origin iframes reached setPermissionRequestHandler with the top-level frame's origin. This takes the latest 44.x, which keeps the same dependencies and carries the later Chromium security backports. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Stefan Vill <stefan.vill@tngtech.com>
Fresh ComfyUI installs failed with "No solution found when resolving dependencies for split (... platform_machine == 'aarch64' and sys_platform == 'linux'; included: aipg-comfyui[xpu] ...)". The install copies only pyproject.toml into ComfyUI/ and lets `uv sync` resolve universally for every platform in `environments`. `sys_platform == 'linux'` includes aarch64, and the xpu torch index has no aarch64 wheels. uv 0.12.14 (astral-sh/uv#21672) started requiring installable wheels within each resolver fork instead of pooling them across the cpu/cuda/xpu forks, so that one fork now fails the whole resolution on every OS. The bundled uv crossed that version when it moved from 0.11.23 to 0.13.5 in ee46bb4. Linux ARM was never a target: Linux ships as x64 AppImage/deb only and the bundled uv and 7-Zip are x86_64-only. Narrow `environments` and `required-environments` to Linux x86_64 in both pyproject files; narrowing only `required-environments` is not enough. Resolving the old config with uv 0.12.13 and the new one with 0.13.5 yields identical packages, versions and sources. The re-lock keeps all 257 pins and only drops wheels for non-x86_64 Linux architectures and simplifies markers; uv 0.12.5 and 0.13.5 both pass `uv lock --check`. A lockless `uv sync --extra cpu` with uv 0.13.5 on macOS now installs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Stefan Vill <stefan.vill@tngtech.com>
Fix dependabot alerts
filelock 4.2.1 clears GHSA-v4x8-3wr5-3wq8 (CVE-2026-112940), GHSA-9vhv-jxww-xfm5 (CVE-2026-112913) and GHSA-567q-5qvw-pf92 (CVE-2026-112907); setuptools 84.1.0 clears GHSA-xmj3-9gf7-h52w. Both are floored in every sidecar that locks them: service, whisper-backend, qwen3-tts and comfyui-deps. filelock is transitive via torch / huggingface_hub / transformers; nothing of ours imports it, and no dependent caps it below 4. The ComfyUI lock was updated in place with only the filelock and setuptools entries: re-locking with uv 0.12.5 rewrote markers across the whole file. All four pass `uv lock --check`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Stefan Vill <stefan.vill@tngtech.com>
All in range of their dependents, so lock-only apart from the zod floor: - undici 7.30.1 and 6.29.1 (dev, node-gyp) clear GHSA-xjj6-f33q-929c (CVE-2026-109869), GHSA-4qv8-2p9j-2685 (CVE-2026-109924) and, for 7.x, GHSA-f72v-6w45-q472 (CVE-2026-109841). - fast-uri 3.1.9 (via ajv) clears GHSA-w74x-v6f9-j3xg, GHSA-xhq7-xmqj-769h, GHSA-wjr9-j795-jxcr and GHSA-333x-w4r6-6crp. - body-parser 2.4.0 (via express) clears GHSA-27r3-jxmh-p828 (CVE-2026-111181). - zod 4.6.7 clears GHSA-mrhx-c7xc-m3w5 (CVE-2023-54404); the direct range is raised to ^4.6.7, every peer accepts ^4. The undici 8.x copy under pi-coding-agent is pinned exactly and is handled separately. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Stefan Vill <stefan.vill@tngtech.com>
undici 8.12.2 clears GHSA-xjj6-f33q-929c (CVE-2026-109869), GHSA-4qv8-2p9j-2685 (CVE-2026-109924) and GHSA-f72v-6w45-q472 (CVE-2026-109841). pi-coding-agent pins undici to exactly 8.10.2, and the latest release (1.4.0) still does, so bumping pi cannot clear it; the override is scoped to pi's copy and is a patch-level move inside 8.x. `npm run verify:pi` passes with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Stefan Vill <stefan.vill@tngtech.com>
Dependabot alerts
Demo Mode turned the prompt bar's hover preset picker off for the whole session, so the preset cards never appeared. Suppress it only while a driver.js demo tour is on screen, which is the overlap the guard was for, and close an open picker when a tour starts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Demo Mode turned the prompt bar's hover preset picker off for the whole
session, so the preset cards never appeared. Suppress it only while a
driver.js demo tour is on screen, which is the overlap the guard was for,
and close an open picker when a tour starts.
Also update some dependencies :)
Testing Done:
Tested locally on B70 and PTL
Checklist: