Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
39 commits
Select commit Hold shift + click to select a range
dc9e79c
Add benchmarks + 100% test coverage
dgrelaud Sep 7, 2026
9d1feb1
switch to npm, keep one safe/modern gihtub CI
dgrelaud Sep 7, 2026
ee0438e
test(security): add an isolated harness for proving denial-of-service…
dgrelaud Sep 7, 2026
b2ccb82
fix(utils): keep every integer read inside the caller's view
dgrelaud Sep 7, 2026
bdcb7bc
fix(utils): parse ISO base media box headers to spec
dgrelaud Sep 7, 2026
4e1debc
fix(icns): stop the infinite loop on a zero-length entry (CVE-2025-71…
dgrelaud Sep 7, 2026
f0a18ba
fix(heif): walk the property container once (CVE-2025-71329)
dgrelaud Sep 7, 2026
ea5cf96
fix(jxl): reject an empty codestream instead of feeding the bit reader
dgrelaud Sep 7, 2026
91dfde3
fix(jpg): scan segments by index instead of reslicing the buffer
dgrelaud Sep 7, 2026
f3dc8c6
fix(tiff): walk the tag list by index, and drop the unused fs import
dgrelaud Sep 7, 2026
74fc7fc
fix(bit-reader): reject a truncated codestream with a TypeError
dgrelaud Sep 7, 2026
6320926
fix(ico): trust the buffer, not the declared entry count
dgrelaud Sep 7, 2026
3defe80
fix(png): report a corrupt file from calculate, not from validate
dgrelaud Sep 7, 2026
d96b5b8
fix(detector): a validator that cannot read is not a verdict
dgrelaud Sep 7, 2026
4a4b18d
fix(lookup): refuse to hand back a size no image can have
dgrelaud Sep 7, 2026
4e49ff7
test(security): group the two linear-time scan proofs together
dgrelaud Sep 7, 2026
a64ca86
docs: add a CHANGELOG for the 2.1.0 security release
dgrelaud Sep 7, 2026
955156f
style(utils): track the scan offset in a local, not the parameter
dgrelaud Sep 7, 2026
9219cfa
chore: release 3.0.0
dgrelaud Sep 7, 2026
f3c4972
simplify changelog
dgrelaud Sep 7, 2026
b8571af
fix(pnm): read the header line by line instead of decoding the whole …
dgrelaud Sep 7, 2026
e3511bc
fix(webp): check each stream against its own signature
dgrelaud Sep 7, 2026
438bb4b
fix(jxl): read the ftyp brand at the real payload offset
dgrelaud Sep 7, 2026
4f04d5f
fix(fromFile): parse only the bytes the read actually returned
dgrelaud Sep 7, 2026
349520d
perf(svg): match the root tag in the window that was already validated
dgrelaud Sep 7, 2026
a56ee0e
perf(utils): read through a view instead of copying the range first
dgrelaud Sep 7, 2026
e8950de
docs: record the second audit pass in the 3.0.0 entry
dgrelaud Sep 7, 2026
42d0737
fix(fromFile): count the jobs in flight, so the budget is a real limit
dgrelaud Sep 7, 2026
5186271
perf(jxl): view the codestream instead of copying it out of the conta…
dgrelaud Sep 7, 2026
5e24d7c
perf(jpg): read the EXIF entries where they lie
dgrelaud Sep 7, 2026
677ce2c
docs: record the third audit pass in the 3.0.0 entry
dgrelaud Sep 7, 2026
72dfe84
docs: fix the CVE links and cover the last commit
dgrelaud Sep 7, 2026
98a9c6c
update CI
dgrelaud Sep 7, 2026
2eec4ae
test(security): stop reading slow start-up as a hang
dgrelaud Sep 7, 2026
cc9c659
Make the tests compatible with GitHub CI.
dgrelaud Sep 7, 2026
8703038
Fix JPEG, TIFF, and optimize
dgrelaud Sep 8, 2026
7f03f70
update README and prepare for publication
dgrelaud Sep 8, 2026
f3de274
simplify the Readme
dgrelaud Sep 8, 2026
f36ec9a
fix readme.md
dgrelaud Sep 8, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 0 additions & 36 deletions .circleci/config.yml

This file was deleted.

19 changes: 11 additions & 8 deletions .github/workflows/build-test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,27 +3,30 @@ name: Build and test
on:
push:
branches:
- master
- main
pull_request:
branches:
- master
- main

jobs:
build-and-test:
runs-on: ubuntu-latest
strategy:
matrix:
node: [ '18', '20']
node: [ '18', '20', '22', '24', '26' ]
name: Node ${{ matrix.node }}
steps:
- uses: actions/checkout@v2
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 1
- uses: actions/setup-node@v2
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: ${{ matrix.node }}
cache: npm
# No dependency needs its install script: esbuild falls back to resolving
# its platform binary at runtime, and fsevents ships prebuilt.
- name: Build and run all tests
run: |
yarn
yarn build
yarn test
npm ci --ignore-scripts
npm run build
npm test
22 changes: 0 additions & 22 deletions .github/workflows/npm-publish.yml

This file was deleted.

27 changes: 0 additions & 27 deletions .github/workflows/publish-gh-pages.yml

This file was deleted.

5 changes: 1 addition & 4 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,11 +1,8 @@
.DS_Store
coverage/
node_modules
yarn-debug.log
yarn-error.log
npm-debug.log*
.nyc_output
dist/
docs/
.yarn/*.gz
.yarn/cache
*.tgz
3 changes: 0 additions & 3 deletions .prettierrc.yaml

This file was deleted.

35 changes: 0 additions & 35 deletions .yarn/plugins/@yarnpkg/plugin-outdated.cjs

This file was deleted.

25 changes: 0 additions & 25 deletions .yarnrc.yml

This file was deleted.

Loading