Marc-André Bombeck 933be858c5 fix(images): size a GIF by its largest frame, not only its logical screen ...

The header check before a thumbnail decode read only the GIF logical screen.
A decoder sizes its buffer from the frame's image descriptor, so a file with a
small screen and a huge frame passed the pixel cap and allocated the full
frame. Walk every block, read each image descriptor, size the image by the
largest of screen and frames, and refuse a file that ends inside a header or
descriptor, carries an unknown block, or has no frame.

2026-10-25 16:53:31 +01:00

..

achievements-no-insults.test.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

acting-account-resolver.test.ts

feat(api): carry the request id in meta.requestId on every error envelope

2026-10-15 22:05:06 +02:00

ai-refusal-envelope.test.ts

Merge branch 'v143/ai' into release/v1.43.0

2026-10-15 23:12:51 +02:00

api-handler-429-dressing.test.ts

fix(api): dress only the 429s a limiter actually refused

2026-09-10 04:55:19 +02:00

api-handler-cross-site.test.ts

fix(http): refuse state changes a browser sends from another site

2026-10-25 13:52:04 +01:00

api-handler-error-request-id.test.ts

fix(api): read the error code before the status

2026-10-20 09:48:15 +02:00

api-handler-key-mismatch.test.ts

feat(api): carry the request id in meta.requestId on every error envelope

2026-10-15 22:05:06 +02:00

api-handler-safe-request-prop.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

api-handler-session-unavailable.test.ts

fix(auth): answer 503 when the session store cannot be read

2026-10-20 05:43:58 +02:00

api-response-safe-json.test.ts

feat(api): cap request-body size on batch and export ingest routes

2026-06-03 08:56:19 +02:00

api-response-unrecognized-keys.test.ts

fix: refuse an unrecognised request field where the caller can act on it

2026-09-03 05:49:13 +02:00

api-response-zod.test.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

auth-error-codes.test.ts

feat(api): give every error envelope a meta.errorCode

2026-10-20 05:53:37 +02:00

avatar.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

clinical-floors.test.ts

refactor(dashboard): remove the orphaned verdict resolver

2026-08-02 02:32:24 +02:00

crypto-bytes.test.ts

chore: write NUL as an escape instead of a raw byte

2026-10-19 14:57:00 +02:00

crypto.property.test.ts

test: property tests for zones, statistics, cadence, crypto and backups

2026-10-22 05:32:48 +02:00

crypto.test.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

dashboard-layout.test.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

date-format-preference-surfaces.test.ts

fix(format): carry the date-order preference to every numeric date

2026-09-05 17:06:34 +02:00

date-format.test.ts

fix(dates): show the year whenever a date is not the current one

2026-07-18 01:23:37 +02:00

db-to-json.test.ts

v1.4.34.4 — audit-driven hotfix bundle (security, UX, code-quality, docs)

2026-05-17 00:39:58 +02:00

db.test.ts

style: format the database helper test

2026-10-22 15:08:14 +02:00

docker-entrypoint.test.ts

fix(runtime): harden process startup and health

2026-07-21 00:05:03 +02:00

doctor-report-allergy-reaction.test.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

doctor-report-data.test.ts

feat(medications): let a course end at an instant

2026-10-24 22:20:06 +02:00

doctor-report-module-backstop.test.ts

test(export): prove the scope holds at the artefact, not just at the switch

2026-07-26 00:45:08 +02:00

doctor-report-pdf-core.test.ts

fix(documents): read the text layer through the same pdf.js that renders

2026-10-24 19:32:13 +02:00

doctor-report-recovery-canonical.test.ts

fix(doctor-report): resolve recovery by night in the user timezone

2026-06-14 17:57:21 +02:00

env.test.ts

fix(config): treat an empty environment variable as unset

2026-09-26 15:20:42 +02:00

export.test.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

format-active-locale.test.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

format-date-or-relative.test.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

format-locale-calendar-date.test.ts

fix(dates): show a stated calendar date as that date east of UTC+12

2026-10-03 18:44:06 +02:00

format-locale.test.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

geo-asn.test.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

geo-offline-detection.test.ts

refactor(boot): register the offline-geo notice from its own helper

2026-10-23 11:01:47 +02:00

geo-offline-first.test.ts

fix(geo): read the offline databases first

2026-08-08 01:05:44 +02:00

geo.test.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

get-client-ip.test.ts

docs(proxy): say TRUST_CF_CONNECTING_IP needs a Cloudflare-only origin

2026-10-25 16:00:35 +01:00

gif-fixture.ts

fix(images): size a GIF by its largest frame, not only its logical screen

2026-10-25 16:53:31 +01:00

glitchtip-path-secret-redaction.test.ts

fix(mood): make the bulk upsert and its tag links one transaction

2026-07-19 14:16:02 +02:00

glucose.test.ts

fix(glucose): state band edges in the reader's glucose unit

2026-10-01 22:07:07 +02:00

i18n-locale-integrity.test.ts

feat(mental-health): keep questionnaire wording in code, one cited file per language

2026-10-23 08:13:56 +02:00

idempotency.test.ts

refactor(sharing): read and judge grants from a leaf module

2026-10-23 11:02:10 +02:00

image-dimensions.test.ts

fix(images): size a GIF by its largest frame, not only its logical screen

2026-10-25 16:53:31 +01:00

insights-arrange-draft.test.ts

fix(insights): keep a pill save when the overview arrangement saves after it

2026-10-08 22:57:47 +02:00

insights-layout-reorder.test.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

insights-layout.test.ts

fix: guard managed setting label inventories

2026-08-06 04:01:00 +02:00

learn-links.test.ts

Add typed Learn-article link registry

2026-06-26 13:22:21 +02:00

measurement-type-enum-coverage.test.ts

feat(measurements): accept indoor CO2, temperature and humidity

2026-10-21 20:26:15 +02:00

medical-citations.test.ts

v1.4 medical-safety: protect against silent DBP hypotension, align BP & step citations, ACE body-fat consolidation (#123)

2026-05-08 12:07:46 +02:00

medication-category.test.ts

Let a person name their own medication categories

2026-10-03 21:38:03 +02:00

medication-list-layout.test.ts

feat(medications): a sortable table view with an order you choose

2026-06-12 18:10:21 +02:00

medication-schedule.test.ts

refactor(medications): drop the legacy today walker and its own zone solver

2026-09-26 17:07:02 +02:00

module-list-prefs.test.ts

feat(settings): keep list order and preview opt-ins on the server

2026-10-21 19:11:23 +02:00

motion.test.ts

chore(release): v1.4.44 — REG-11 dashboard summary fix (iOS Home tile sparkline + value)

2026-05-21 22:07:32 +02:00

passkey-errors.test.ts

fix: i18n completeness + UX polish (closes #73, #74) (#75)

2026-04-18 17:15:43 +02:00

private-origin-policy.test.ts

fix(egress): keep loopback grantable under an exact operator origin

2026-09-10 19:08:04 +02:00

process-type.test.ts

feat(v1.4): multi-tenant prep — off-host backup, encryption-key versioning, worker/web split, native-Bearer UA gating (#135)

2026-05-08 14:33:39 +02:00

query-keys.test.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

random-id.test.ts

Make uploads and every other write work over plain HTTP

2026-09-05 16:22:39 +02:00

rate-limit-auth-surface.test.ts

chore: strip planning tags from comments and enable the rule

2026-10-20 09:08:40 +02:00

rate-limit-headers.test.ts

fix(api): floor Retry-After at one second on a refusal

2026-09-10 04:55:47 +02:00

reference-ranges.test.ts

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

request-cache.test.ts

fix(ai): read AI switches, modules and consent afresh inside background jobs

2026-09-24 12:08:39 +02:00

require-auth-bearer.test.ts

refactor(auth): move the request guards out of api-handler into lib/auth/guards

2026-10-23 10:54:23 +02:00

require-fresh-mfa-if-enrolled.test.ts

fix(auth): let every fresh-factor refusal open the re-proof dialog

2026-10-17 09:17:03 +02:00

require-fresh-mfa-or-elevation-if-enrolled.test.ts

fix(auth): let every fresh-factor refusal open the re-proof dialog

2026-10-17 09:17:03 +02:00

require-fresh-mfa.test.ts

test(auth): read the password hash off the stored row in proof tests

2026-10-20 20:56:08 +02:00

require-recent-proof.test.ts

test(auth): read the password hash off the stored row in proof tests

2026-10-20 20:56:08 +02:00

require-record-auth-scope.test.ts

refactor(sharing): read and judge grants from a leaf module

2026-10-23 11:02:10 +02:00

retry-import.test.ts

fix(charts): degrade chart failures to one card and heal stale shells per version

2026-06-11 21:17:27 +02:00

safe-fetch-dispatcher-timeouts.test.ts

fix(safe-fetch): leave the deadline to the caller's signal

2026-10-22 13:01:10 +02:00

safe-fetch-dispatcher.test.ts

fix(egress): keep loopback grantable under an exact operator origin

2026-09-10 19:08:04 +02:00

safe-fetch-pinned.test.ts

fix(egress): check every redirect hop and close the reserved-range gaps

2026-10-25 13:52:04 +01:00

safe-fetch.test.ts

fix(nightscout): pin approved private origins

2026-07-29 15:54:01 +02:00

safe-json-bounded-read.test.ts

fix(http): stop reading request bodies of up to 512 MB before authentication

2026-09-26 16:31:03 +02:00

secret-shape.test.ts

feat(sharing): hand a managed profile over to the person it describes

2026-10-08 11:18:14 +02:00

server-translator.test.ts

chore(style): repo-wide prettier sweep before v1.4.6 tag

2026-05-09 02:27:17 +02:00

sheet-gesture.test.ts

feat(ui): make every bottom sheet draggable

2026-10-22 10:20:28 +02:00

ssrf-pin-inventory.test.ts

fix(security): keep ALLOW_LOCAL_AI_PRIVATE_HOSTS=true for the operator's own AI, deprecated

2026-09-26 20:59:10 +02:00

time-window-format.test.ts

fix(medications): collapse an equal-bound dose time to a single time

2026-06-07 14:41:15 +02:00

timezone-mirror.test.ts

fix(format): carry the date-order preference to every numeric date

2026-09-05 17:06:34 +02:00

url-safety.test.ts

fix(security): reject a same-origin next path that re-resolves protocol-relative

2026-07-17 17:30:04 +02:00

url-state.test.ts

fix(url): write page state into the query string through one serialised helper

2026-10-23 02:04:21 +02:00