Repository navigation
chore: update license from MIT to Apache 2.0 - #183
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
miguel-heygen
approved these changes
Apr 1, 2026
dahans-msft2
pushed a commit
to dahans-msft2/hyperframes
that referenced
this pull request
Aug 6, 2026
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
SanHsien
added a commit
to SanHsien/hyperframes
that referenced
this pull request
Oct 8, 2026
Nothing but its own tests called it; the catalog cache is filled by installLocalVectors from the bundled package (CodeQL js/http-to-file-access heygen-com#183). Removes it with its options type and timeout constant, ports the media-vector validation tests onto installLocalVectors, and adds a test that installLocalVectors does not touch fetch. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
SanHsien
added a commit
to SanHsien/hyperframes
that referenced
this pull request
Oct 12, 2026
* chore(upstream): adopt upstream/main d94708e as a whole tree Adopt all pending upstream work (about 837 commits) on top of the fork. The fork history is squashed with no shared ancestry, so this was merged through a bridge on v0.8.35 (63574a7) and squashed onto fork main. 400 generated catalog pages come from upstream; 39 other conflicts were resolved by hand, keeping fork overlay files and the fork's CodeQL hardening where it could coexist with upstream's rewrites. Conflict table, kept fork deltas, dropped hardening, and verification are in docs/DECISIONS.md (2026-10-07). Baseline reviewed_through moves to d94708e. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * fix(security): validate remote media magic bytes before freezing Restore the fork's assertRemoteMediaBytes in the adopted upstream freezeUrl: downloaded bytes must match the destination extension (SVG still goes through sanitizeSvg, .cube through cube-validate, unknown extensions fail closed). Replace the invalid streaming fixture with valid ISO base media bytes, add HTML-as-.png and #EXTM3U-as-.mp4 rejection tests, and delete the now callerless freeze-publisher module and its test. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * chore(capture): drop callerless frameworkMarkup Nothing imports stripFrameworkMarkup after the upstream adoption; upstream's DOM-based filterExtractedScripts covers the same threat. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * chore(github): remove upstream CODEOWNERS The file names an upstream maintainer as owner of the capture-check files; on this fork it would request reviews from a person who does not maintain it. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * ci(fork): gate pr-captures to the upstream repository The Before/After capture requirement is upstream's contributor process and fails on every fork PR. Gate the job like the other upstream-process workflows, list catalog-publish, canary-sunset and pr-captures in FORK.md, and add a maintenance test that keeps the gates and the table in sync. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * fix(security): install media vectors from the package and contain row.file Upstream's fetchMediaVectors downloaded media-vectors.* from a mutable raw.githubusercontent.com path with no timeout, size cap or pair validation, then trusted row.file via resolve(row.file), so a tampered catalog could make any local file the SFX result that freeze copies into the project. - build-copy ships media-vectors.json/.bin in dist/catalog-artifact - installMediaVectors installs from the bundled directory with the same pair and row validation as vectorPairAgrees, refuses absolute or .. row files, writes 0o600 via temp file and rename, and never fetches - resolveBundledMediaFile accepts only relative paths that stay inside the bundled root; the cwd-relative candidate is gone - resolve.mjs uses searchLocalSfxIndex; fetchMediaVectors and the HYPERFRAMES_REGISTRY path are removed - tests: absolute and .. row files rejected, ranking works with fetch forbidden Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * docs(studio-server): fix stale collision-suffix comment on upload The comment claimed the suffixed path was validated at that point; the check runs on the requested destination and suffixed names are chosen later in the exclusive-create loop. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * docs(fork): record the post-merge review of the upstream adoption Append the findings, fixes and the two judged-covered items (upload mode, frameworkMarkup) to the 2026-10-07 entry. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * fix(media-use): drop unused fs imports from the vendored heygen helper The fork's downloadTo rewrite moved writes into normalizeCloudAudio, so existsSync, mkdirSync and writeFileSync were left unused and failed the Preflight lint. Record the lint result and the two pre-existing CI failures that come from upstream in DECISIONS. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(core): match scoped scripts after the fork's JSON-literal wrapping The upstream render-order test looked for push("n") as raw text, but the fork wraps scoped composition scripts as JSON string literals, so the marker was not found in one mode and sorted first. Unescape quotes before matching and require every marker to be present in both modes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(fork): correct why the drag-frames check fails before merge Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(core): bound the url(#id) scan so hostile render input cannot stall the event loop Exclude '(' from the fragment id class so a long run of 'url(#!' with no closing paren no longer backtracks quadratically (CodeQL js/polynomial-redos heygen-com#156). Adds linear-time regression tests and keeps url(#a), url('#a') and url( "#a" ) rewriting unchanged. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * fix(engine): refuse an extract cache root another user could control The default root is a predictable name under the shared tmpdir, so a local user could pre-create it to plant cached frames or a symlinked .hf-last-gc (CodeQL js/insecure-temporary-file heygen-com#177). assertPrivateCacheRoot creates the root 0700 and requires a real directory, owned by the caller and closed to group/other on POSIX. The extractor disables caching with its existing warning when the check fails, clean skips the sweep, and the sweep marker is written via exclusive temp file plus rename so it never follows a symlink. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * fix(media-use): re-encode Gemini TTS audio through ffmpeg before writing it Gemini response bytes were written to disk after only a RIFF header check (CodeQL js/http-to-file-access heygen-com#180). Route them through normalizeCloudAudio like the HeyGen path, injectable for tests, and report a transcode failure as ok:false without leaving a raw file behind. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * refactor(cli): delete the callerless fetchLocalVectors download path Nothing but its own tests called it; the catalog cache is filled by installLocalVectors from the bundled package (CodeQL js/http-to-file-access heygen-com#183). Removes it with its options type and timeout constant, ports the media-vector validation tests onto installLocalVectors, and adds a test that installLocalVectors does not touch fetch. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * docs(fork): record the PR #2 CodeQL fixes and dispositions Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * fix(engine): tighten an own 0755 extract cache root instead of disabling it A root left at 0755 by an older umask belongs to this user and nobody else can write to it, so chmod it to 0700 and keep caching. Roots that group or others can write to are still refused. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(producer): check the extract cache root before using the GIF cache The animated-GIF cache sits under the same extract cache root and is used during compile, before the frame cache's ownership check, so a root another local user controlled could still poison or redirect it. Route it through assertPrivateCacheRoot and disable only the GIF cache on failure. Also format the Gemini TTS test and correct DECISIONS (heygen-com#182 is fixed; media vectors install via installMediaVectors). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ci): validate adoption comments and test the exact PR candidate * fix(security): restore capture and media guards and harden Frost assets --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
LICENSEfileREADME.mdfrom MIT to Apache 2.0Test plan
LICENSEcontains full Apache 2.0 text with correct copyright (2026 HeyGen, Inc.)🤖 Generated with Claude Code