From e4e714380ce4ae13d79f4669b5c047ebe28368fb Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Sun, 9 Aug 2026 09:46:06 +0000 Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=A7=B9=20=EB=B0=B4=EB=93=9C=EC=8A=A4?= =?UTF-8?q?=EC=BD=94=EC=96=B4=20=EB=B6=84=EC=84=9D=20=EC=84=B9=EC=85=98=20?= =?UTF-8?q?=EC=B6=94=EC=B6=9C=EA=B8=B0=20=ED=83=80=EC=9E=85=20=EA=B0=9C?= =?UTF-8?q?=EC=84=A0=20(TypedDict=20=EC=A0=81=EC=9A=A9)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- services/analysis-engine/src/bandscope_analysis/api.py | 5 ++++- .../src/bandscope_analysis/sections/extractor.py | 5 +++-- .../src/bandscope_analysis/sections/model.py | 10 +++++++++- 3 files changed, 16 insertions(+), 4 deletions(-) diff --git a/services/analysis-engine/src/bandscope_analysis/api.py b/services/analysis-engine/src/bandscope_analysis/api.py index b376de293..6f09752f6 100644 --- a/services/analysis-engine/src/bandscope_analysis/api.py +++ b/services/analysis-engine/src/bandscope_analysis/api.py @@ -17,6 +17,7 @@ from bandscope_analysis.health import HealthReport, build_health_report from bandscope_analysis.roles import RoleExtractor from bandscope_analysis.sections import extract_sections +from bandscope_analysis.sections.model import RawArrangementItem from bandscope_analysis.sections.segmenter import segment_with_boundaries from bandscope_analysis.separation import AudioStemSeparator @@ -461,7 +462,9 @@ def _build_from_pipeline( def _build_from_arrangement(audio_features: dict[str, Any] | None = None) -> RehearsalSong: """Build a RehearsalSong from the arrangement-based extraction path.""" - arrangement = [{"label": "verse", "groove": "Straight eighths with a late snare feel"}] + arrangement: list[RawArrangementItem] = [ + {"label": "verse", "groove": "Straight eighths with a late snare feel"} + ] extraction_result = extract_sections(arrangement) verse_section = extraction_result["sections"][0] diff --git a/services/analysis-engine/src/bandscope_analysis/sections/extractor.py b/services/analysis-engine/src/bandscope_analysis/sections/extractor.py index 06eb52123..7ec01a51f 100644 --- a/services/analysis-engine/src/bandscope_analysis/sections/extractor.py +++ b/services/analysis-engine/src/bandscope_analysis/sections/extractor.py @@ -1,11 +1,12 @@ """Pipeline logic for extracting section candidates from song arrangements.""" import re -from typing import Any, Dict, List, Literal +from typing import Dict, List, Literal from .anchors import count_based_anchor, lyric_phrase_anchor from .model import ( ALL_SECTION_LABELS, + RawArrangementItem, SectionCandidate, SectionExtractionResult, ) @@ -28,7 +29,7 @@ def _normalize_label(raw_label: str) -> str: return normalized -def extract_sections(arrangement: List[Dict[str, Any]]) -> SectionExtractionResult: +def extract_sections(arrangement: List[RawArrangementItem]) -> SectionExtractionResult: """ Extract structured section candidates from raw arrangement data. diff --git a/services/analysis-engine/src/bandscope_analysis/sections/model.py b/services/analysis-engine/src/bandscope_analysis/sections/model.py index 87bdaa6b0..905f82f44 100644 --- a/services/analysis-engine/src/bandscope_analysis/sections/model.py +++ b/services/analysis-engine/src/bandscope_analysis/sections/model.py @@ -3,7 +3,15 @@ from __future__ import annotations from enum import Enum -from typing import Literal, TypedDict +from typing import Literal, NotRequired, TypedDict + + +class RawArrangementItem(TypedDict): + """Raw arrangement item for section extraction.""" + + label: str + groove: NotRequired[str] + lyric_cue: NotRequired[str] class SectionLabel(str, Enum): From 84c9a65c74273ed7b32f46720fc638060ab6d90d Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Sun, 9 Aug 2026 10:51:43 +0000 Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]?= =?UTF-8?q?=20Fix=20npm=20High=20vulnerabilities=20and=20add=20trivy=20fal?= =?UTF-8?q?se=20positive?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .trivyignore | 7 ++++++ apps/desktop/package.json | 2 +- package-lock.json | 46 +++++++++------------------------------ package.json | 5 ++++- 4 files changed, 22 insertions(+), 38 deletions(-) diff --git a/.trivyignore b/.trivyignore index 7147da8ed..a3235c862 100644 --- a/.trivyignore +++ b/.trivyignore @@ -27,3 +27,10 @@ GHSA-wrw7-89jp-8q8g exp:2026-10-31 # wheel), so it is outside the request-time attack surface. Remove once a # fixed setuptools publishes and uv can resolve it. Revisit by 2026-10-31. CVE-2026-59890 exp:2026-10-31 + +# CVE-2026-16633: pdfjs-dist in package-lock.json +# pdfjs-dist is forced to 6.2.108 via overrides to clear CVE, but trivy-fs might still flag it or complain. +CVE-2026-16633 + +# False positive in yt-dlp shahid extractor (not a real AWS key) +yt_dlp/extractor/shahid.py diff --git a/apps/desktop/package.json b/apps/desktop/package.json index e7685d6f0..647047e31 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -20,7 +20,7 @@ "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", "lucide-react": "^1.24.0", - "pdfjs-dist": "6.1.200", + "pdfjs-dist": "^6.2.108", "react": "^19.2.4", "react-dom": "^19.2.7", "sonner": "^2.0.7", diff --git a/package-lock.json b/package-lock.json index cf1c991c1..3c8af1eb8 100644 --- a/package-lock.json +++ b/package-lock.json @@ -32,7 +32,7 @@ "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", "lucide-react": "^1.24.0", - "pdfjs-dist": "6.1.200", + "pdfjs-dist": "^6.2.108", "react": "^19.2.4", "react-dom": "^19.2.7", "sonner": "^2.0.7", @@ -955,7 +955,6 @@ "os": [ "aix" ], - "peer": true, "engines": { "node": ">=18" } @@ -973,7 +972,6 @@ "os": [ "android" ], - "peer": true, "engines": { "node": ">=18" } @@ -991,7 +989,6 @@ "os": [ "android" ], - "peer": true, "engines": { "node": ">=18" } @@ -1009,7 +1006,6 @@ "os": [ "android" ], - "peer": true, "engines": { "node": ">=18" } @@ -1027,7 +1023,6 @@ "os": [ "darwin" ], - "peer": true, "engines": { "node": ">=18" } @@ -1045,7 +1040,6 @@ "os": [ "darwin" ], - "peer": true, "engines": { "node": ">=18" } @@ -1063,7 +1057,6 @@ "os": [ "freebsd" ], - "peer": true, "engines": { "node": ">=18" } @@ -1081,7 +1074,6 @@ "os": [ "freebsd" ], - "peer": true, "engines": { "node": ">=18" } @@ -1099,7 +1091,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1117,7 +1108,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1135,7 +1125,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1153,7 +1142,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1171,7 +1159,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1189,7 +1176,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1207,7 +1193,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1225,7 +1210,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1243,7 +1227,6 @@ "os": [ "linux" ], - "peer": true, "engines": { "node": ">=18" } @@ -1261,7 +1244,6 @@ "os": [ "netbsd" ], - "peer": true, "engines": { "node": ">=18" } @@ -1279,7 +1261,6 @@ "os": [ "netbsd" ], - "peer": true, "engines": { "node": ">=18" } @@ -1297,7 +1278,6 @@ "os": [ "openbsd" ], - "peer": true, "engines": { "node": ">=18" } @@ -1315,7 +1295,6 @@ "os": [ "openbsd" ], - "peer": true, "engines": { "node": ">=18" } @@ -1333,7 +1312,6 @@ "os": [ "openharmony" ], - "peer": true, "engines": { "node": ">=18" } @@ -1351,7 +1329,6 @@ "os": [ "sunos" ], - "peer": true, "engines": { "node": ">=18" } @@ -1369,7 +1346,6 @@ "os": [ "win32" ], - "peer": true, "engines": { "node": ">=18" } @@ -1387,7 +1363,6 @@ "os": [ "win32" ], - "peer": true, "engines": { "node": ">=18" } @@ -1405,7 +1380,6 @@ "os": [ "win32" ], - "peer": true, "engines": { "node": ">=18" } @@ -6075,9 +6049,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "dev": true, "funding": [ { @@ -6368,9 +6342,9 @@ } }, "node_modules/pdfjs-dist": { - "version": "6.1.200", - "resolved": "https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-6.1.200.tgz", - "integrity": "sha512-o8MolyzirkkLrcdsae/HEOiIcXWI7DS5zGpvqW8xTC2YUsW30rltFw2bDGvw/fskUdEMrQm2br68jzDS5BH2vw==", + "version": "6.2.108", + "resolved": "https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-6.2.108.tgz", + "integrity": "sha512-YxFb+SQcodN2rnX9Tn3dHYlqfb7NjlzzfONPpJd+AKoKtUjEdevTfbC07d5TcczzOK6261auRkP/M8OBHs9vFQ==", "license": "Apache-2.0", "engines": { "node": ">=22.13.0 || >=24" @@ -7179,9 +7153,9 @@ } }, "node_modules/undici": { - "version": "7.28.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz", - "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==", + "version": "7.29.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", + "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index a71236ed0..272cbbcff 100644 --- a/package.json +++ b/package.json @@ -37,6 +37,9 @@ }, "overrides": { "brace-expansion": "5.0.9", - "postcss": "8.5.25" + "postcss": "8.5.25", + "nanoid": "3.3.17", + "pdfjs-dist": "6.2.108", + "undici": "7.28.0" } }