scenri 0.22.0 → 0.22.2

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [0.22.2](https://github.com/tonygorb/Scenri/compare/v0.22.1...v0.22.2) (2026-11-02)
+
+
+### Bug Fixes
+
+* **deps:** lift glob and minimatch past their advisories ([92ecff4](https://github.com/tonygorb/Scenri/commit/92ecff44159dc21488ca26355982deadd213593b))
+* **deps:** lift glob and minimatch past their advisories ([781cd20](https://github.com/tonygorb/Scenri/commit/781cd2081f0e5c25b97706589d865c6e7a0f12dc))
+* **deps:** patch vulnerable dependencies ([f05b04b](https://github.com/tonygorb/Scenri/commit/f05b04b807c532a68abc487de56bf075c4c9f26c))
+* **deps:** patch vulnerable dependencies ([40c9a86](https://github.com/tonygorb/Scenri/commit/40c9a869030d7eb49aff5536b1b5747025006be1))
+
+## [0.22.1](https://github.com/tonygorb/Scenri/compare/v0.22.0...v0.22.1) (2026-10-09)
+
+
+### Bug Fixes
+
+* patch sharp, the multipart reader and source-map-js against three advisories ([6bebbdd](https://github.com/tonygorb/Scenri/commit/6bebbdd477dd76f56b7346f840ba4bc3d19a3dd9))
+* patch sharp, the multipart reader and source-map-js against three advisories ([0786e5c](https://github.com/tonygorb/Scenri/commit/0786e5cfceb534f642133ecb9085811b72b62582))
+
 ## [0.22.0](https://github.com/tonygorb/Scenri/compare/v0.21.2...v0.22.0) (2026-10-07)
 
 

package/dist/serve.js

@@ -861,7 +861,7 @@ function outcomeFor(code) {
 }
 function availabilityFrom(shallow, conn) {
   if (!shallow.ok) return shallow;
-  if (!conn || conn.outcome !== "refused" || !conn.failure) return shallow;
+  if (conn?.outcome !== "refused" || !conn.failure) return shallow;
   const { code, reason } = conn.failure;
   switch (code) {
     case "CODEX_AUTH_CONFLICT":
@@ -13116,7 +13116,7 @@ function beginRun(deps, id, view, chained) {
 }
 function endRun(deps, id, view, aborted) {
   const run4 = runs.get(id);
-  if (!run4 || run4.status !== "running") return;
+  if (run4?.status !== "running") return;
   const rec = getPresenterDraft(deps.core, id);
   const own = view ? rec?.views[view].error : rec?.readError;
   const error = own && own !== "cancelled" ? own : run4.error;
@@ -13508,7 +13508,7 @@ async function generateView(deps, id, view, opts = {}) {
   for (const dep of DEPENDS[view]) {
     if (rec.views[dep].status !== "approved") throw fail(`approve the ${VIEW_LABEL[dep]} first`, 400);
   }
-  if (!engine || !engine.capabilities().maxReferenceImages) throw fail("no engine here can draw a person", 400);
+  if (!engine?.capabilities().maxReferenceImages) throw fail("no engine here can draw a person", 400);
   const adjustment = str4(opts.adjustment, TYPED_TEXT_MAX) || void 0;
   const decide = opts.decide === "auto" ? "auto" : void 0;
   const before = rec.views[view].status;
@@ -16386,6 +16386,28 @@ function registerImageRoutes(app, deps) {
 var HEADLINES_KEPT = 5;
 var FIRST_PUBLIC = "0.2.0";
 var RELEASES = [
+  {
+    version: "0.22.2",
+    date: "2026-11-02",
+    title: "The local server and the shop reader are patched",
+    sections: [
+      {
+        heading: "Security",
+        body: "The server Scenri runs on this computer and the reader that fetches a shop's product pages are on their patched releases, for several published advisories. Nothing about how Scenri works changes."
+      }
+    ]
+  },
+  {
+    version: "0.22.1",
+    date: "2026-10-10",
+    title: "The image library and the upload reader are patched",
+    sections: [
+      {
+        heading: "Security",
+        body: "The image library Scenri resizes pictures with and the reader that takes in uploaded files are on their patched releases, for two published advisories. Nothing about how Scenri works changes."
+      }
+    ]
+  },
   {
     version: "0.22.0",
     date: "2026-10-07",

package/launcher/starting.html

@@ -42,7 +42,7 @@
   // fragment does not survive open(1) or Start-Process. The fragment is the
   // fallback for a page opened by hand.
   var meta = document.querySelector('meta[name="scenri-studio"]');
-  var target = (meta && meta.getAttribute('content')) || location.hash.slice(1);
+  var target = (meta?.getAttribute('content')) || location.hash.slice(1);
   var ok = /^http:\/\/(127\.0\.0\.1|localhost):\d{2,5}\/$/.test(target);
   var title = document.getElementById('title');
   var text = document.getElementById('text');
@@ -68,9 +68,9 @@
     // from a local page.
     var img = new Image();
     img.onload = go;
-    img.src = target + 'favicon.ico?' + Date.now();
+    img.src = `${target}favicon.ico?${Date.now()}`;
     if (window.fetch) {
-      fetch(target + 'api/version', { mode: 'no-cors', cache: 'no-store' }).then(go, () => {});
+      fetch(`${target}api/version`, { mode: 'no-cors', cache: 'no-store' }).then(go, () => {});
     }
     setTimeout(probe, failed ? 2000 : 500);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scenri",
-  "version": "0.22.0",
+  "version": "0.22.2",
   "author": "Tony Gorb <hello@scenri.co>",
   "license": "AGPL-3.0-only",
   "type": "module",
@@ -16,19 +16,19 @@
     "prepublishOnly": "node scripts/prepack.mjs"
   },
   "dependencies": {
-    "@fastify/multipart": "^9.0.0",
-    "@fastify/static": "^10.1.3",
-    "ajv": "^8.17.1",
+    "@fastify/multipart": "^9.4.0",
+    "@fastify/static": "^10.1.8",
+    "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
-    "better-sqlite3": "^12.0.0",
-    "cheerio": "^1.0.0",
-    "fastify": "^5.12.5",
-    "jszip": "^3.10.1",
-    "node-html-parser": "^7.0.1",
-    "open": "^10.1.0",
-    "pixelmatch": "^7.1.0",
+    "better-sqlite3": "^12.11.1",
+    "cheerio": "^1.2.0",
+    "fastify": "^5.12.7",
+    "jszip": "^3.10.2",
+    "node-html-parser": "^7.1.0",
+    "open": "^10.2.0",
+    "pixelmatch": "^7.2.0",
     "pngjs": "^7.0.0",
-    "sharp": "^0.35.4"
+    "sharp": "^0.35.5"
   },
   "devDependencies": {
     "@scenri/brand": "workspace:*",
@@ -39,7 +39,7 @@
     "@scenri/engine-fal": "workspace:*",
     "@scenri/engine-openrouter": "workspace:*",
     "@scenri/engine-replicate": "workspace:*",
-    "@types/better-sqlite3": "^7.6.11",
+    "@types/better-sqlite3": "^7.6.13",
     "@types/pngjs": "^6.0.5",
     "tsup": "^8.5.1"
   },