Skip to content

Scribe 2.4.0 - Fixes Obsidian plugin review blocker: dynamic `<script>` element creations

Choose a tag to compare

View all tags
@mikealicea mikealicea released this 14 Jul 16:47
· 5 commits to main since this release
2.4.0
12425a7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v2.4.0 Fixed Obsidian plugin review blocker: dynamic <script> element creations

The automated Obsidian plugin review flagged 4 dynamic <script> element creations in the bundled main.js. All 4 came from third-party dependencies — none from Scribe's own code — and have been fully removed from the bundle.

Changes

  • Downgraded react / react-dom from v19 to v18.3.1 — React 19 introduced "hoistable scripts" support (ReactDOM.preinit), which ships createElement("script") code paths in the production bundle even though Scribe never uses them. Scribe only uses standard hooks and createRoot, all fully supported in React 18.3, so this is a drop-in downgrade with no functional changes.
  • Removed the standardized-audio-context dependency — its AudioWorklet polyfill loads code via a Blob-URL <script> tag. Scribe only used it for AudioContext / decodeAudioData / createBuffer during audio chunking, all of which are natively available in Obsidian's desktop and mobile environments. The audio chunking pipeline (audioDataToChunkedFiles) now uses the native Web Audio API directly, with a webkitAudioContext fallback for older iOS WebViews.

Verification

  • Production bundle now contains 0 dynamic script element creations (previously 4)
  • Also scanned the bundle for eval(, new Function(, and document.write — all clean
  • Typecheck, lint, and production build all pass

No user-facing behavior changes — recording, transcription, and summarization work exactly as before.

A note on where verification stands: I confirmed the bundle is clean via static checks and the full typecheck/build, but the headless-Chrome runtime test of the audio chunking path was blocked by the sandbox (Chrome can't launch from this session). Since decodeAudioData/createBuffer have identical signatures between the removed library and the native API, risk is low — but I'd recommend one manual smoke test: record a short clip with OpenAI transcription selected before publishing the release, since that's the path that exercises the refactored chunking code.

What's Changed

  • Fix: Downgrades react and removes standardized-audio-context by @Mikodin in #111

Full Changelog: 2.3.9...2.4.0

Contributors

mikealicea
Assets 5
Loading