@mastra/memory 1.26.1-alpha.4 → 1.26.1-alpha.6

package/dist/{src-hv0DMVM-.js → src-B_n15_Xg.js}

@@ -19,7 +19,7 @@ import { estimateTokenCount } from "tokenx";
 import { createHash, randomBytes, randomUUID } from "crypto";
 import { InMemoryStore } from "@mastra/core/storage";
 import { AsyncLocalStorage } from "async_hooks";
-import imageSize from "image-size";
+import probeImageSizeSync from "probe-image-size/sync.js";
 import { createTool } from "@mastra/core/tools";
 import { isStandardSchemaWithJSON as isStandardSchemaWithJSON$1, toStandardSchema as toStandardSchema$1 } from "@mastra/core/schema";
 import { ErrorCategory, ErrorDomain, MastraError } from "@mastra/core/error";
@@ -17345,6 +17345,42 @@ var ObserverRunner = class {
 	}
 };
 //#endregion
+//#region src/processors/observational-memory/measure-image-buffer.ts
+/**
+* Synchronous image dimension lookup for in-memory image buffers.
+*
+* Uses `probe-image-size`'s sync parsers rather than `image-size`, which has unfixed
+* denial-of-service advisories (GHSA-w3rx-r6r6-pgpr / CVE-2025-71330 and
+* GHSA-5p2g-fcmc-qvqq) affecting every published version, on an archived repository
+* with no fixed release coming. A malformed 32-byte ICNS buffer was enough to hang the
+* parse loop and exhaust the heap, and image bytes reaching agent memory are untrusted.
+*
+* `probe-image-size` covers the formats models actually accept (PNG, JPEG, WebP, GIF,
+* AVIF, BMP, ICO, PSD, SVG, TIFF). Anything else returns `undefined`, which callers
+* already handle as "dimensions unknown".
+*/
+const probeBuffer = probeImageSizeSync;
+/**
+* Read the pixel dimensions of an image buffer.
+*
+* @returns The dimensions, or `undefined` if the buffer isn't a recognized image.
+*/
+function measureImageBuffer(buffer) {
+	let probed;
+	try {
+		probed = probeBuffer(buffer);
+	} catch {
+		return;
+	}
+	if (!probed) return;
+	const { width, height } = probed;
+	if (typeof width !== "number" || !Number.isFinite(width) || typeof height !== "number" || !Number.isFinite(height)) return;
+	return {
+		width,
+		height
+	};
+}
+//#endregion
 //#region src/processors/observational-memory/token-counter.ts
 const IMAGE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
 	"png",
@@ -17651,26 +17687,23 @@ function resolveImageDimensions(part) {
 		width,
 		height
 	};
-	try {
-		const measured = imageSize(buffer);
-		const measuredWidth = getFiniteNumber(measured.width);
-		const measuredHeight = getFiniteNumber(measured.height);
-		if (!measuredWidth || !measuredHeight) return {
-			width,
-			height
-		};
-		const resolved = {
-			width: width ?? measuredWidth,
-			height: height ?? measuredHeight
-		};
-		persistImageDimensions(part, resolved);
-		return resolved;
-	} catch {
-		return {
-			width,
-			height
-		};
-	}
+	const measured = measureImageBuffer(buffer);
+	if (!measured) return {
+		width,
+		height
+	};
+	const measuredWidth = getFiniteNumber(measured.width);
+	const measuredHeight = getFiniteNumber(measured.height);
+	if (!measuredWidth || !measuredHeight) return {
+		width,
+		height
+	};
+	const resolved = {
+		width: width ?? measuredWidth,
+		height: height ?? measuredHeight
+	};
+	persistImageDimensions(part, resolved);
+	return resolved;
 }
 function getBase64Size(base64) {
 	const sanitized = base64.replace(/\s+/g, "");
@@ -28619,4 +28652,4 @@ Notes:
 //#endregion
 export { extractCurrentTask as A, OBSERVATION_CONTEXT_INSTRUCTIONS as B, WorkingMemoryExtractor as C, OBSERVER_SYSTEM_PROMPT as D, TokenCounter as E, injectAnchorIds as F, OBSERVATION_CONTINUATION_HINT as H, parseAnchorId as I, stripEphemeralAnchorIds as L, hasCurrentTaskSection as M, optimizeObservationsForContext as N, buildObserverPrompt as O, parseObserverOutput as P, Extractor as R, deepMergeWorkingMemory as S, summarizeConversation as T, OBSERVATION_CONTEXT_PROMPT as V, reconcileObservationGroupsFromReflection as _, extractWorkingMemoryContent as a, wrapInObservationGroup as b, WORKING_MEMORY_STATE_ID as c, getObservationsAsOf as d, ObservationalMemoryProcessor as f, parseObservationGroups as g, deriveObservationGroupProvenance as h, WorkingMemory as i, formatMessagesForObserver as j, buildObserverSystemPrompt as k, WORKING_MEMORY_STATE_PROCESSOR_ID as l, combineObservationGroupRanges as m, MessageHistory$1 as n, extractWorkingMemoryTags as o, ObservationalMemory as p, SemanticRecall as r, removeWorkingMemoryTags as s, Memory as t, WorkingMemoryStateProcessor as u, renderObservationGroupsForReflection as v, SUMMARIZE_THREAD_DEFAULTS as w, ModelByInputTokens as x, stripObservationGroups as y, OBSERVATIONAL_MEMORY_DEFAULTS as z };
 
-//# sourceMappingURL=src-hv0DMVM-.js.map
+//# sourceMappingURL=src-B_n15_Xg.js.map