From 5958292804400f75e8061f6ad5e239e49d14aa4f Mon Sep 17 00:00:00 2001 From: JeffreyChen Date: Thu, 23 Jul 2026 15:56:53 +0800 Subject: [PATCH 1/2] Floor je_auto_control at the release that fixes the pillow CVEs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit requirements.txt asked for je_auto_control unpinned, so the dependency graph resolved it to whatever was published — 0.0.214, which pins pillow==12.2.0 and pulls 13 open CVEs in transitively. 0.0.216 ships pillow==12.3.0. The floor is also what makes the alerts close: GitHub re-resolves a pip manifest when the file changes, not when a transitive dependency's upstream gets a new release, so the alerts sat untouched since 2026-07-21 while pyproject.toml and uv.lock moved on without them. --- requirements.txt | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index cb422a5a..ad9d5cea 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,7 @@ -je_auto_control +# Floor, not a pin: releases before 0.0.216 resolve pillow==12.2.0, which +# carries 13 CVEs fixed in 12.3.0. A floor keeps the dependency graph honest +# without needing a bump here on every release. +je_auto_control>=0.0.216 qt-material==2.17 mss==10.2.0 PySide6==6.11.1 From 09aabaee734ceefe258dc467eee80921ed996d55 Mon Sep 17 00:00:00 2001 From: JeffreyChen Date: Thu, 23 Jul 2026 16:34:28 +0800 Subject: [PATCH 2/2] Widen the no-AI-attribution rule past commit messages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The rule only covered commit messages, so assistant footers still landed in pull request bodies. Anything published under this repo — PR text, review comments, release notes, docs, code comments — reads as the author's own work. --- CLAUDE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CLAUDE.md b/CLAUDE.md index d06de150..8bf015a4 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -134,7 +134,7 @@ Features that are inherently interactive (e.g. region picking with the mouse, te ## Commit Conventions - Write concise commit messages focused on **why**, not what. -- **Do not mention any AI tools, assistants, or models in commit messages** — no "Co-Authored-By" AI attributions, no references to AI-generated code. +- **No AI attribution anywhere.** Not in commit messages, pull request titles or bodies, issue and review comments, release notes, code comments, or documentation. Specifically forbidden: `Co-Authored-By:` lines naming an assistant, "Generated with …" / "Created by …" footers, tool badges, links to assistant products, emoji markers standing in for the same thing, and any statement that code was AI-generated. Everything published under this repo reads as the author's own work. - Use imperative mood: "Add feature", "Fix bug", "Remove unused code". - Examples: - `Add image threshold parameter validation`