Garry TanandClaude Fable 5
ddcd4073ef
Root: overrides pin ip-address 10.3.1 (defeats BOTH nested nodes — socks' range pull and express-rate-limit's exact 10.1.0 pin, which a top-level bump provably cannot reach) and sharp 0.35.0 (GHSA-f88m, HIGH; transformers still pins ^0.34 upstream — smoke-tested round-trip); marked ^18.0.11; full in-range lockfile refresh clears hono, fast-uri, protobufjs, qs, body-parser, nanoid, uuid, immutable and friends. lib/diagram-render (via its own build-script contract: exact pins edited, fresh lock, dist rebuilt): mermaid 11.16.1, @excalidraw/excalidraw 0.18.1, @excalidraw/mermaid-to-excalidraw 1.1.2 → 2.2.2 — the 1.x line exact-pinned mermaid 10.9.x and dragged the entire duplicate mermaid-10 advisory chain (dompurify 3.1.6, nanoid 3.3.3, lodash-es); the bundle shrinks 9.96 → 7.59 MB with the duplicate mermaid gone. Nested exact pins that survived get scoped overrides (nanoid 5.1.16, lodash-es 4.18.1). Verification: clean-worktree frozen-lockfile installs (root + nested) + the SAME osv-scanner release the action pins (v2.3.8) with the workflow's exact scan-args → exit 0, 'No issues found'. Smoke tests cover the override surfaces (sharp round-trip, ip-address lockfile assertion, marked parse); socks + diagram-drift suites already pin the rest. Supersedes #2695 (its own lockfile kept socks/ip-address@10.2.0; @anupamme's report credited for the parallel diagnosis). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
diagram-render
Offline diagram rendering for make-pdf and /diagram. One self-contained HTML
page (dist/diagram-render.html, ~9MB) bundles mermaid, the excalidraw export
utilities, and the official mermaid→excalidraw converter. The browse daemon
loads it with load-html; callers drive it through browse js and pull bytes
back with js --out.
The built page is committed (eng-review D2): rendering works with zero
network at install time and render time, and there is no npm supply-chain
surface in ./setup. The drift test (test/diagram-render-drift.test.ts)
fails CI if dist/ is edited by hand or falls out of sync with BUILD_INFO.json.
Page API (window functions)
| Function | In → Out |
|---|---|
__renderMermaid(id, text) |
mermaid text → SVG string. id must be unique per fence (mermaid-fence-<n>) — it namespaces every internal SVG id. |
__mermaidToExcalidraw(text) |
mermaid text → .excalidraw scene JSON (flowcharts fully; other types degrade upstream). |
__excalidrawToSvg(sceneJson) |
scene JSON → SVG string (Excalifont embedded, offline). |
__rasterize(svg, targetWidthPx) |
SVG → PNG data URL. Callers own DPI math: targetWidthPx = placed width (in) × 300. Throws on tainted canvas. |
__downscaleRaster(dataUri, targetWidthPx, mime) |
raster data URI → smaller data URI at targetWidthPx (same mime). make-pdf uses it to normalize oversized photos to print resolution. |
__mountForScreenshot(svg, px) |
taint-proof fallback: mounts SVG at #raster-stage for browse screenshot --selector. |
__probeImage(src) |
data URI/URL → {width, height} JSON. |
__bundleInfo |
{ name, deps } — pinned dependency versions baked at build. |
Readiness: poll until #status text is ready (or browse wait '#done').
Page errors accumulate in window.__errors.
Updating
# 1. edit the exact pin in package.json
cd lib/diagram-render && bun install
# 2. rebuild (deterministic; build twice → same sha)
bun run build
# 3. commit package.json + bun.lock + dist/ together
Render contract details (securityLevel strict, htmlLabels false, print-css font
lock, <base href> + </scri escaping) are documented in src/entry.ts and
scripts/build.ts — read both before touching either.