fix(security): complete comment stripping and YAML escaping; update dev deps #73

2026-10-16T21:10:20Z

KofTwentyTwo commented

2026-10-16 21:10:20 +00:00

(Migrated from github.com)

Fixes #72

#1/#2 (js/incomplete-multi-character-sanitization): new stripHtmlComments loops until no comment remains; used by countProseWords and voice-rules parsing.
#3 (js/incomplete-sanitization): escape backslashes before quotes in the YAML query: value.
Dependabot: npm audit fix plus vitest 4.1.11 -> npm audit reports 0 vulnerabilities. Supersedes #71.

Verification: tsc --noEmit, vitest run 531/531 (one Ollama timeout test is flaky and passed on rerun).

🤖 Generated with Claude Code

Fixes #72 - #1/#2 (`js/incomplete-multi-character-sanitization`): new `stripHtmlComments` loops until no comment remains; used by `countProseWords` and voice-rules parsing. - #3 (`js/incomplete-sanitization`): escape backslashes before quotes in the YAML `query:` value. - Dependabot: `npm audit fix` plus vitest 4.1.11 -> `npm audit` reports 0 vulnerabilities. Supersedes #71. Verification: `tsc --noEmit`, `vitest run` 531/531 (one Ollama timeout test is flaky and passed on rerun). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feature/security-findings-2026-10:feature/security-findings-2026-10

git checkout feature/security-findings-2026-10

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/obsidian-penny#73