v1.1.0 — Security & Bug Fixes

What's Changed

Security

• Path traversal fix in static file server — realpath + prefix check prevents directory escape attacks

Bug Fixes

• Image resize in load_image — images now resized to declared width × height before returning tensor; previously wrong-shaped tensors would silently crash downstream ControlNet nodes
• PIL context manager — Image.open now uses with block to prevent file handle leaks on NTFS/WSL2
• dataUrlToBlob — guards against malformed data URLs (missing comma, missing MIME type)
• uploadImage — checks resp.ok and json.name before returning
• ESC handler — closeBtn disabled synchronously before async close to prevent concurrent doCloseAndSave calls
• doCloseAndSave re-entrancy — closing flag prevents parallel execution from node removal and button click
• openEditors Map leak — node.onRemoved hook cleans up map entry, overlay, and key listener when node is deleted while modal is open
• queuePrompt patch — optional chaining (?.) prevents TypeError if queuePrompt is undefined at load time; __openpose_patched flag prevents double-patching

Code Quality

• Removed unused imports (base64, io, json) from nodes.py
• postMessage target origin changed from "*" to window.location.origin
• Incoming message event handler validates e.origin
• triggerSetRandomPose wrapped in try/catch for cross-origin resilience

Previous Releases

• v1.0.1 — Output size via postMessage, random pose button, capture reliability improvements
• v1.0.0 — Initial release