Miguel Angel Simon Sierra 502d8d6cd9 fix(media-use): make the sanitizer's CSS scans linear on hostile input ...

The url() check used /url\(\s*(['"]?)([^)]*)\1\s*\)/ and the function
check /([-\w]*)\(/: on attacker padding these backtracked cubically and
quadratically (an unclosed url( plus 4,000 spaces took 20s; an 80,000
character word took 7.7s), and freeze runs the sanitizer synchronously on
bodies up to 256MB. Both are now single-pass indexOf scans (a million
characters in under 15ms), with the same verdict on ordinary input. A url()
value holding "(" is rejected, so a nested url( can't hide inside one.
A size test holds both payloads under 2s.

2026-09-23 07:38:38 -04:00

..

adapters

style: apply oxfmt baseline formatting across all source files (#25)

2026-03-23 17:15:14 -07:00

audio

fix(core): harden audio FX and group identity (#3444)

2026-08-23 17:58:25 -07:00

beats

fix(core): retry bpm-detective import after transient failure (#2736)

2026-08-08 22:32:10 -07:00

compiler

feat(core): add an inlineAssets option to skip base64 asset inlining (#4198)

2026-09-19 17:57:17 -04:00

editing

fix(core): harden audio FX and group identity (#3444)

2026-08-23 17:58:25 -07:00

figma

fix(media-use): make the sanitizer's CSS scans linear on hostile input

2026-09-23 07:38:38 -04:00

fonts

refactor: make @hyperframes/lint depend only on parsers (#1773)

2026-06-27 13:51:21 -04:00

generated

fix(preview): show the correct scene instead of every scene at once on some loads (#3848)

2026-09-10 08:06:43 -07:00

generators

fix(core): contain generated HTML CSS and script contexts (#3800)

2026-09-09 03:56:10 -04:00

inline-scripts

feat(engine): sub-frame multi-sample motion blur, capture-level accumulation (#4019)

2026-09-16 20:10:06 -04:00

lint

refactor: extract @hyperframes/lint from core (#1756)

2026-06-27 01:16:40 -04:00

media

fix: address review feedback from #1333 and #1335 (#1343)

2026-06-12 16:18:18 -07:00

parsers

feat(core): add deterministic keyframe ease runtime

2026-07-25 14:12:16 +02:00

registry

fix(catalog): regenerating the texture-mask page no longer duplicates its section (#4302)

2026-09-23 01:09:08 -04:00

runtime

chore(registry): remove low-use catalog items and variant tails (#4274)

2026-09-22 07:04:54 -04:00

slideshow

refactor: make @hyperframes/lint depend only on parsers (#1773)

2026-06-27 13:51:21 -04:00

storyboard

docs(skills): the agent presents a tailor-made storyboard instead of a Studio board (#4150)

2026-09-19 01:07:24 -04:00

studio-api

refactor(core): own edit protocol contract

2026-07-18 13:24:57 -04:00

templates

feat: font resolution pipeline — compositions capture and embed their own fonts (#1255)

2026-06-07 17:52:19 -04:00

text

feat(core): expose pretext text measurement on window.__hyperframes (#3302)

2026-08-17 16:42:27 -04:00

utils

feat(studio): apply a style to a run of characters (#3142)

2026-08-11 02:48:56 -04:00

audioAutomation.test.ts

fix(studio): make the volume fader tell the truth about the gain it writes (#3305)

2026-08-19 18:08:23 -04:00

audioAutomation.ts

feat(core): speed ramps as a rate lane in data-automation (#4129)

2026-09-19 06:27:42 -04:00

audioCarve.test.ts

fix(audio): pin the slower release and the carve default, fold the requirement, sync the manifest

2026-09-11 13:57:07 -07:00

audioCarve.ts

fix(core): slow the voiceover carve's level release to 2.4s

2026-09-11 11:27:37 -07:00

audioFade.test.ts

feat(studio): typed audio values, clip fades, audible video drops (#4250)

2026-09-21 18:45:08 -04:00

audioFade.ts

feat(studio): typed audio values, clip fades, audible video drops (#4250)

2026-09-21 18:45:08 -04:00

audioFx.test.ts

refactor(audio): the review's cleanup list, and the design record behind the rack (#3176)

2026-08-13 06:08:56 -07:00

audioFx.ts

fix(core): harden audio FX and group identity (#3444)

2026-08-23 17:58:25 -07:00

audioFxCopy.test.ts

feat(studio): fold a preset shut, and give each one its own title design (#3191)

2026-08-13 13:53:29 -07:00

audioFxCopy.ts

feat(core,studio): the character presets pitch shift unlocks (#3277)

2026-08-21 09:08:32 -07:00

audioFxEq.test.ts

feat(core): name every preset node, and add a multi-band EQ over existing filters (#3178)

2026-08-13 06:57:24 -07:00

audioFxEq.ts

feat(core): name every preset node, and add a multi-band EQ over existing filters (#3178)

2026-08-13 06:57:24 -07:00

audioFxJobs.test.ts

feat(studio): fold a preset shut, and give each one its own title design (#3191)

2026-08-13 13:53:29 -07:00

audioFxJobs.ts

feat(studio): fold a preset shut, and give each one its own title design (#3191)

2026-08-13 13:53:29 -07:00

audioFxPresets.test.ts

feat: switch a preset off, or ramp it, as one thing (#3189)

2026-08-13 12:35:44 -07:00

audioFxPresets.ts

feat(core,studio): the character presets pitch shift unlocks (#3277)

2026-08-21 09:08:32 -07:00

audioFxProfiles.test.ts

feat(studio): fold a preset shut, and give each one its own title design (#3191)

2026-08-13 13:53:29 -07:00

audioFxProfiles.ts

feat(studio): fold a preset shut, and give each one its own title design (#3191)

2026-08-13 13:53:29 -07:00

audioGain.test.ts

feat(studio): typed audio values, clip fades, audible video drops (#4250)

2026-09-21 18:45:08 -04:00

audioGain.ts

feat(studio): typed audio values, clip fades, audible video drops (#4250)

2026-09-21 18:45:08 -04:00

audioGroups.test.ts

fix(core): harden audio FX and group identity (#3444)

2026-08-23 17:58:25 -07:00

audioGroups.ts

feat(studio,core)!: remove solo and the group meter (#3454)

2026-08-23 19:19:08 -07:00

audioLeveller.test.ts

feat(core): the levelling script — "Even Out Levels" (#3180)

2026-08-13 07:42:32 -07:00

audioLeveller.ts

fix(audio): raise the authoring gain ceiling and carry it through the probes (#3333)

2026-08-18 20:07:42 -04:00

canary.test.ts

feat(audio): open the audio FX, group and mute features to everyone (#3401)

2026-08-21 18:22:40 -07:00

canary.ts

feat(core,cli): emit the canary decision reason alongside the assignment

2026-08-06 13:57:08 -07:00

canaryRegistry.ts

feat(audio): open the audio FX, group and mute features to everyone (#3401)

2026-08-21 18:22:40 -07:00

clipFacts.test.ts

feat(cli): hyperframes timeline prints a project's tracks and clips (#4138)

2026-09-19 04:27:45 -04:00

clipFacts.ts

feat(cli): hyperframes timeline prints a project's tracks and clips (#4138)

2026-09-19 04:27:45 -04:00

colorGrading.test.ts

fix(core): align secondary mask contracts

2026-07-26 01:25:16 -07:00

colorGrading.ts

fix(core): align secondary mask contracts

2026-07-26 01:25:16 -07:00

colorGradingCurves.test.ts

feat(core): add professional color grading controls

2026-07-25 22:15:30 -07:00

colorGradingCurves.ts

fix(core): address grading review findings

2026-07-25 23:16:50 -07:00

colorLuts.test.ts

feat(core): add media color grading contract

2026-07-06 02:36:17 -07:00

colorLuts.ts

fix(core): address grading review findings

2026-07-25 23:16:50 -07:00

compositionContract.ts

refactor(core): unify composition contract (#2157)

2026-07-16 02:44:22 -04:00

compositionReadiness.test.ts

perf(player): scope preview readiness to first frame (#4239)

2026-09-21 17:15:05 -04:00

compositionReadiness.ts

perf(player): scope preview readiness to first frame (#4239)

2026-09-21 17:15:05 -04:00

core.types.ts

Revert "feat(producer): renderStretch to re-time short compositions across longer scenes (#2676)" (#2730)

2026-07-21 19:39:03 -07:00

index.test.ts

fix(cli): wire aspect-agnostic resolution through cloudrun/lambda/batch + preflight recompute

2026-07-16 08:01:56 +00:00

index.ts

fix(runtime): a finished film rests on its last frame instead of a blank one (#4158)

2026-09-19 10:35:26 -04:00

lottieReadiness.test.ts

fix: ship lottieReadiness + guard studio import.meta.env for non-Vite consumers (#861)

2026-05-16 06:24:30 +02:00

lottieReadiness.ts

fix: ship lottieReadiness + guard studio import.meta.env for non-Vite consumers (#861)

2026-05-16 06:24:30 +02:00

mediaGradeAnalyzer.ts

fix(core): avoid grade stats regex backtracking (#3706)

2026-09-05 12:28:59 -04:00

mediaGradeAnalyzer.vendoredParity.test.ts

feat(cli): route media search through media-use (#4230)

2026-09-21 18:35:47 -04:00

mediaTiming.test.ts

feat(cli): hyperframes timeline prints a project's tracks and clips (#4138)

2026-09-19 04:27:45 -04:00

mediaTiming.ts

feat(cli): hyperframes timeline prints a project's tracks and clips (#4138)

2026-09-19 04:27:45 -04:00

parseFps.test.ts

feat(cli): accept ffmpeg-style rational fps (NTSC, PAL, slow-mo)

2026-05-09 00:09:15 +02:00

playbackRateBounds.ts

feat(core): video, audio and image length come from one shared resolver (#4166)

2026-09-19 08:01:28 -04:00

safePath.test.ts

refactor(core): route project paths through a single resolveWithinProject chokepoint (#1398)

2026-06-12 21:10:36 -07:00

safePath.ts

fix(studio-server): block dangling symlink upload escapes (#3661)

2026-09-04 19:03:08 -04:00

speedRamp.test.ts

feat(engine): render speed ramps with the same source-time mapping as the preview (#4143)

2026-09-19 08:01:17 -04:00

speedRamp.ts

feat(engine): render speed ramps with the same source-time mapping as the preview (#4143)

2026-09-19 08:01:17 -04:00

telemetryRedaction.test.ts

fix(core,producer,skills): unicode paths, non-Error rejections, shell callers

2026-08-04 03:18:21 -07:00

telemetryRedaction.ts

fix(core,producer,skills): unicode paths, non-Error rejections, shell callers

2026-08-04 03:18:21 -07:00

tokenSlug.ts

fix(core): address PR feedback — ReDoS-safe slug trim, getVariables cleanups

2026-07-08 02:34:18 -07:00

variables.ts

feat(sdk): variable usage scan + preview-values adapter seam

2026-07-09 13:31:02 -07:00