search

scijs / get-pixels

Reads an image into an ndarray
MIT License
543 stars 108 forks source link

Bump jpeg-js from 0.3.7 to 0.4.1 #49

Closed dependabot[bot] closed 3 years ago

dependabot[bot] commented 4 years ago

Bumps jpeg-js from 0.3.7 to 0.4.1.

Release notes

Sourced from jpeg-js's releases.

v0.4.1

v0.4.1 (2020-06-27)

v0.4.0

v0.4.0 (2020-04-23)

  • feat: add memory and resolution limits (135705b)
  • feat: expose exif buffers (#47) (d3e272a), closes #47
  • feat: support browser usage (#55) (7e7e2dc), closes #55
  • feat(decode): add tolerantDecoding option (#57) (69f6415), closes #57
  • fix: enable tolerantDecoding by default (5d3277f)
  • fix: don’t fail if scan contains trailing bytes (#66) (cfeb1c7), closes #66
  • docs: update README for breaking changes (78408c6)
  • refactor: use spread for decode options (a2c93e0)
  • chore: update typedefs for 0.4.0 (a2f7080)
  • chore: add vscode to ignores (238a7fe)
  • chore: track version in tags only (cbc1244)
  • chore: drop support for node versions <8 (21ef116)
  • chore: switch to jest (1731741)
  • chore: switch to yarn (0a750c0)

BREAKING CHANGE

  • drop decode boolean second argument, options must be an object
  • images larger than 100 megapixels or requiring more than 512MB of memory to decode will throw unless maxMemoryInMB and maxResolutionInMP options are increased
  • no longer support node versions before 8 LTS
Commits
  • d2323c1 feat(decoder): add comment support (#71)
  • a2f7080 chore: update typedefs for 0.4.0
  • 238a7fe chore: add vscode to ignores
  • cbc1244 chore: track version in tags only
  • 78408c6 docs: update README for breaking changes
  • 5d3277f fix: enable tolerantDecoding by default
  • 135705b feat: add memory and resolution limits
  • a2c93e0 refactor: use spread for decode options
  • 21ef116 chore: drop support for node versions <8
  • 1731741 chore: switch to jest
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/scijs/get-pixels/network/alerts).
dmmulroy commented 4 years ago

Any chance this could get merged and a new version released?

knokbak commented 3 years ago

https://nvd.nist.gov/vuln/detail/CVE-2020-8175 https://github.com/advisories/GHSA-w7q9-p3jq-fmhm https://github.com/eugeneware/jpeg-js/commit/135705b1510afb6cb4275a4655d92c58f6843e79

50 @mikolalysenko

knokbak commented 3 years ago

Seen as this looks like it has been abandoned by the original developers, and is licensed under the MIT license, I have forked it and created an updated version. https://github.com/sysollie/get-pixels-updated https://github.com/sysollie/save-pixels-updated

striezel commented 3 years ago

@mikolalysenko + @scijs Is this project still maintained? And if so, is there an estimate on when this pull request can be reviewed and merged?

mikolalysenko commented 3 years ago

Sorry, I turned off my github notifications because the spam became totally unmanageable. Merging