[AmintaCCCP]

概要

针对 Dependabot 安全告警进行专项排查与修复，处理可安全修复的高危/低危漏洞，并修复测试套件中的耗时抖动问题。

修复内容

1. Dependabot #60: sharp (< 0.35.5)

• 问题：librsvg 存在内存安全隐患 (CVE-2026-96889)。
• 修复：
  • 更新 cloudflare-worker/package.json 中的 @cloudflare/workers-types 至兼容版本 ^5.20261001.1；
  • 增加 overrides: { "sharp": "^0.35.5" }，将 sharp 依赖刷新至 0.35.5。
  • cloudflare-worker 依赖审计结果变为 0 vulnerabilities。

2. Dependabot #63: katex (>= 0.11.0, < 0.18.2)

• 问题：原型污染绕过信任限制 (CVE-2026-103923 / GHSA-238p-pmpm-9mq7)。
• 修复：
  • 根目录 package.json 的 overrides 中补充 "katex": "$katex"；
  • package-lock.json 全局将 KaTeX 子依赖统一提升至 0.18.10（>= 0.18.2）。

3. 代码审计与测试稳定性修复

• 测试偶发失败排查：在 src/services/webdavService.test.ts 中，fileExists 基于剩余截止时间计算超时预算，无虚拟时钟时存在 1ms 执行延时导致 expect(call[7]).toBe(10000) 偶发变为 9999。调整为合理区间断言，消除单测偶发 flaky 失败。

---

未纳入此 PR 的告警说明（审计结论）

• Dependabot fix: avoid redundant scroll restore after sync #61 (postcss-selector-parser < 7.1.6)：仅在服务端动态解析不受信选择器时触发，当前仅在 Vite 打包期处理本地样式，无外部攻击面。修复版本 7.x 属于大版本升级，与 Tailwind 3.4 存在兼容性冲突，建议等待 Tailwind 官方兼容补丁或在 Dependabot 中标记 Dismiss。
• Dependabot Missing Error Handling for Invalid Decryption in maskApiKey and maskPassword #64 (sprintf-js <= 1.1.3)：由打包工具链 electron-builder 间接引入，用于本地下载预编译二进制时的内部日志，不进入最终客户端发布包。上游官方尚无可用 patch，建议在 Dependabot 中直接 Dismiss。

本地验证

• npm run check:boundaries 通过
• npm run check:i18n 通过
• npm run check:plugin-registry 通过
• npm run lint 通过
• npm run typecheck (tsc -b) 通过
• npm run test:run (149 个测试文件、1751 个测试用例全部通过)
• npm run build (Vite bundle budget 检查通过)
• cd cloudflare-worker && npm audit && npx tsc --noEmit (0 vulnerabilities, 0 错误)

Summary by CodeRabbit

• 依赖更新
  • 调整 Cloudflare Workers 类型依赖的版本范围，并更新相关依赖覆盖配置。
  • 新增 KaTeX 依赖覆盖配置。
• 测试
  • 放宽 WebDAV 文件检查代理超时测试的断言范围。

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T12:05:52.644418Z	7070909	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b15e92fd-cadf-4056-b57b-698c03c6cc97

📥 Commits

Reviewing files that changed from the base of the PR and between 3270e26 and 7070909.

⛔ Files ignored due to path filters (2)

• cloudflare-worker/package-lock.json is excluded by !**/package-lock.json
• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

• cloudflare-worker/package.json
• package.json
• src/services/webdavService.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

本次更改更新根目录和 Cloudflare Worker 的依赖覆盖配置，并调整 WebDAV 服务测试中的代理超时断言范围。

Changes

依赖配置

Layer / File(s)	Summary
依赖版本与覆盖配置 cloudflare-worker/package.json, package.json	Cloudflare Worker 将 @cloudflare/workers-types 版本范围更新为 ^5.20261001.1，并新增 sharp 覆盖项。根目录新增引用开发依赖 $katex 的覆盖项。

WebDAV 超时测试

Layer / File(s)	Summary
代理超时断言 src/services/webdavService.test.ts	测试将超时断言从精确等于 10000 毫秒改为大于 9000 毫秒且不超过 10000 毫秒。

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 70709

The dependency updates and timeout-test adjustment show no established user-facing regression or reason to block merging.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	标题准确概括了 PR 的主要变更，即修复 KaTeX 和 sharp 的依赖安全漏洞，并关联 Dependabot #60 和 #63。标题简洁且具体。
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[AmintaCCCP]

@codex review

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

Unknown error

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 707090958d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".