Skip to content

v1.2.0: Hardening pass

Choose a tag to compare

View all tags
@beeswaxpat beeswaxpat released this 18 Apr 21:45
· 21 commits to main since this release
v1.2.0
3f84a70

A comprehensive hardening pass: correctness, security, and performance. API is fully backward-compatible; no worker scripts or MCP integrations need changes.

Critical fixes

  • Dashboard no longer crashes at render completion (const overallPct reassignment bug)
  • Hardened the dashboard static-file server against path traversal (URL-decode, null-byte filter, segment-level .. rejection, path.relative check)
  • Removed shell interpolation from the cross-platform browser launcher (spawn with argv array instead of exec with a template string)

Correctness

  • writeFrame surfaces stdin/stream errors instead of hanging on a never-resolved Promise
  • finish() no longer hangs if ffmpeg already closed before it was called
  • SIGINT/SIGTERM handlers scoped to each renderParallel call (no leak)
  • MCP server reports real package version (read from package.json)
  • Structured fast-forward-start message type (was fragile substring match)
  • fs.rmSync({recursive, force}) for temp cleanup on Windows
  • Concat list file in os.tmpdir() with random suffix (no collisions)
  • Stricter fps/duration/port validation
  • Capped stderr buffers at 8KB

Performance

  • Parallel worker JSON fetches in dashboard (was sequential, N × RTT per tick)
  • ffmpeg -encoders cached per detectGPU run (~5× fewer subprocess spawns)
  • basic-worker precomputes per-bar colors (~25% faster frame generation at 1080p)
  • writeFrame skips Promise alloc on synchronous writes
  • ProgressTracker writes global.json once per tick (was twice)

Security

  • Dashboard binds to 127.0.0.1 only
  • Content-Security-Policy on every response
  • X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer
  • CORS: same-origin only, not wildcard
  • HTTP method restriction (GET/HEAD only)
  • Documented MCP server's filesystem-access posture

Meta

  • CHANGELOG.md added
  • Smoke test suite (npm test) + MCP stdio smoke test
  • Loose-pinned deps so users get patch releases
  • Added ffmpeg-render-pro-mcp bin alias + corrected MCP install snippets
  • Quick Start leads with npm install -g
  • Fixed placeholder README badge links

Verification

  • 39/39 smoke tests
  • 5/5 MCP stdio tests
  • 21/21 dashboard HTTP security tests (7 traversal attack vectors blocked)
  • 10/10 edge-case input validation
  • 4 real renders produced valid h264 MP4s at 640×360, 1920×1080, 1080×1920
  • Deterministic output confirmed byte-identical across runs with the same seed

See CHANGELOG.md for the full list.

Assets 2
Loading