Skip to content

4.3.5

Latest
Latest

Choose a tag to compare

View all tags
@LuiggiVal08 LuiggiVal08 released this 05 Aug 00:04
v4.3.5
3177ac2

Security fixes

  • Viewer XSS hardening — innerHTML injection points now escape & < > " '; inline onclick handlers on stored category/id values replaced with data-id + delegated click handling; category/date/ttl/lastAccessed escaped in the graph, timeline, tooltips, stats bar, and detail panel.
  • Shell-free browser launch — openBrowser no longer uses execSync with string interpolation; uses spawn with argv arrays (no shell).
  • Offline d3 loading — viewer resolves d3.v7.min.js from the installed package for both CLI and MCP bundles, no more runtime fallback to the d3js.org CDN.

Smaller install

  • @inquirer/prompts umbrella → direct @inquirer/checkbox / @inquirer/select / @inquirer/confirm imports, dropping @inquirer/editor → @inquirer/external-editor → chardet → iconv-lite → safer-buffer (unmaintained since 2018).
  • Clean install: ~4.4 MB across 8 packages (was ~5.5 MB / 11).

416 tests passing. 0 audit vulnerabilities.

Assets 2
Loading