On a host with no usable CJK TTF the first probe correctly rendered
with Helvetica, but it also marked the font probe as done, so every
later render in the same process asked platypus for the unregistered
VibeShadowCJK family and reportlab refused the paragraph. The report
then silently degraded to HTML-only from the second render on, which
is exactly what CI showed on the second reportlab test in a process.
Cache the resolved family instead of a bare probed flag, and add a
regression test that renders twice on a fontless host.
Also add reportlab to the desktop embedded-runtime lock; the wheel
metadata check failed packaging because the new dependency was not
installed there.
Signed-off-by: Yufeng He <40085740+he-yufeng@users.noreply.github.com>
Requesty (added in #474) is an OpenAI-compatible gateway whose capabilities
were a copy of OpenRouter's: same provider/model naming, same
extra_body.reasoning opt-in, no adapter code of its own. Built-in slots are
kept for providers with their own behaviour; a gateway that speaks an
existing wire format is configured through that provider, and #1532 (API
Route) is being closed on the same grounds.
Migration, identical request shape: LANGCHAIN_PROVIDER=openrouter,
OPENROUTER_BASE_URL=https://router.requesty.ai/v1, OPENROUTER_API_KEY=<the
Requesty key>. Past news and contributor credits in the READMEs are left
as history; the supported-provider lists drop it.
Dependabot #37 (js-yaml, high) and #38/#39 (weasyprint SSRF, medium).
weasyprint 70.0 declares exactly the same requirements as 69.0, so both
hash locks change by the pin and its two hashes only. Every js-yaml
dependent in the desktop lock asks for ^4.1.0, so 4.3.2 satisfies them
without touching package.json.
All seven Dependabot alerts on this repo, all transitive, all development scope:
frontend/package-lock.json
browserslist 4.28.6 -> 4.28.8 (patched 4.28.7, HIGH)
crash / prototype write via untrusted browserslist-stats.json
postcss-selector-parser 6.1.2 -> 6.1.4 (patched 6.1.3, LOW)
denial of service through uncontrolled AST recursion
two nested copies, under postcss-nested and tailwindcss
desktop/electron/package-lock.json
fast-uri 3.1.5 -> 3.1.7 (patched 3.1.6, HIGH x4)
host confusion via percent-encoded scheme normalization; SSRF via
malformed IPv6 normalization; SSRF via repeated hostname percent-decoding;
host confusion via skipped IDN canonicalization
@xmldom/xmldom 0.8.13 -> 0.8.15 (patched 0.8.15, MEDIUM)
XML fragment injection via invalid EntityReference.nodeName
Every parent range already admitted the patched version (autoprefixer wants
browserslist ^4.28.6, postcss-nested/tailwindcss want ^6.1.1 and ^6.1.2, ajv
wants fast-uri ^3.0.1, plist wants @xmldom/xmldom ^0.8.8), so `npm update` on
the named packages was enough and no package.json or override was needed. Both
lock files carry only these bumps plus the transitive tail browserslist pulls
with it (caniuse-lite, electron-to-chromium, node-releases, baseline-browser-
mapping, update-browserslist-db).
The third root copy of postcss-selector-parser stays at 6.0.10: @tailwindcss/
typography pins that exact version, and 6.0.10 sits outside the advisory's
>= 6.1.0, < 6.1.3 range, so it is not affected.
Verified after installing both locks: frontend `npm run build` clean and 617
vitest tests pass; desktop `npm run build`, test-locales (parity verified),
test-backend-resolution, and test-packaging-preparation all pass.
isProcessAlive treated every kill error as not alive, so EPERM
(process exists but no permission) was misclassified as exited.
This made shutdown evidence report backendExited and watchdogExited
true while the PID was still alive, allowing stopForUpdate to
succeed prematurely and risk installer launch while the backend
still held the loopback listener.
Distinguish EPERM (alive) from ESRCH (not alive) in both
backend-manager.ts and backend-watchdog.ts, matching Node.js
process.kill semantics.
Signed-off-by: lorenzozanee <wyz0707@proton.me>
Haozhe Wu