Switch the bash packaging scripts from [ to [[ for conditional tests,
give positional parameters descriptive local names, and end the shared
env.sh helpers with an explicit return. No behaviour change: every
comparison is against a literal, and a bare return keeps the last
command's status.
* segment: bound checkpoint tensors and pickle work
* segment: bound entry size, memo clones, and total tensor elements
* segment: cap cumulative decompressed storage bytes
The stat is the validation that rejects anything but an existing regular
file; annotate it with that reasoning.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
The path is the developer's own CLI build, stat'ed as a regular file before
use; suppress the taint finding with that reasoning.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Sonar applies NOSONAR to the line that carries the marker, so the
explanation above the call did not suppress anything.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Resolve the argument and require a regular file before spawnSync, which
never uses a shell and only runs fixed binaries or that validated path.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
- scriptui.js: replace the self-comparison NaN check (o.max === o.max) with
the explicit Number.isNaN(o.max) (S1764).
- sw.js: mark the fire-and-forget cache.put() with void and a .catch() so the
promise rejection is handled (S9383).
- prelude.js: return __err(...) from the activeCamera getter so every path
yields a value (S4275); __err always throws, so behavior is unchanged.
Replace Math.random() with crypto.randomUUID() when generating the unique
suffix for the atomic write-then-move temp file. The value isn't security-
sensitive, but a CSPRNG gives a stronger uniqueness guarantee and resolves
SonarCloud javascript:S2245.
Calls storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
with secrets: inherit. Adds SonarCloud badge to README where missing and
removes the redundant sonar-project.properties (config now passed by the
reusable workflow).
FreeBSD aarch64: build with 16 codegen units and no LTO in the emulated release VM, which ran past
the job's 5-hour limit with the single-unit thin-LTO profile.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Found while testing crates/keyframe/src/value.rs:79-95 (ShapePath::feather_after_remove, called from crates/engine/src/commands/mask.rs:330)
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Adds .coderabbit.yaml so CodeRabbit no longer reviews or comments on PRs opened by dependabot[bot].
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A 2-D point property took any array: `[1, 2, 3]` and `[1, 2, 3, 4]` were cut to `[1, 2]` and
`[1]` was broadcast to `[1, 1]`, each reported as success, so a script holding a wrong value
silently did something else instead of failing. After Effects raises "Array is not of the
correct dimension" and leaves the property unchanged.
The length must now match the property's dimension, with the one exception After Effects also
makes: two values for a 3-D property, where z stays 0, so `position.setValue([x, y])` keeps
working.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Dylan M. Taylor