mirror of
https://github.com/screentinker/screentinker.git
synced 2026-08-13 22:03:13 -06:00
76a8a16130
sharp decodes uploaded files directly (lib/content-ingest.js, routes/content.js both call sharp(file.path) on whatever a user uploaded), so its bundled libvips is part of the request path rather than a build-time detail. Moves 0.33.5 -> 0.35.3, libvips 8.15 -> 8.18. Validated against the calls this codebase actually makes, because it is a major bump: metadata() still reports EXIF orientation (1/3/6/8 all round-trip, which is what lib/media-orientation.js exifSwapsWH and the rotation-aware dimensions depend on), a bare .rotate() still auto-orients, and resize().jpeg().toFile() is unchanged. png/webp/jpeg/gif/avif all still encode and decode, and malformed input still throws rather than crashing. The new libpng is stricter, which surfaced a latent problem in the AUTH-01 test: its 1x1 PNG literal had a corrupt IDAT chunk whose stored CRC did not match its data. The old decoder accepted it; the new one refuses with "vipspng: libpng read error", so no thumbnail was written and the content-gate assertions failed with a 404 that reads like an auth regression. Replaced with a PNG whose every chunk CRC verifies. The stricter decode is the correct behaviour and is kept. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| config | ||
| db | ||
| lib | ||
| middleware | ||
| player | ||
| routes | ||
| scripts | ||
| services | ||
| test | ||
| ws | ||
| .gitignore | ||
| config.js | ||
| package-lock.json | ||
| package.json | ||
| server.js | ||
| version.js | ||