Security Updates

[rick12000]

LLM dependencies

• llama-cpp-python and huggingface-hub extracted to [llm] optional extra in pyproject.toml
• Installer prompts user; core app runs without LLM deps; Smart/Amend modes disabled at runtime when absent

Supply chain integrity

• setup.ps1 verifies SHA-256 of uv zip before extraction; mismatch aborts install
• uv sync --frozen enforces per-package SHA-256 from uv.lock
• GGUF model downloads: model-ID allowlist + HF redirect hostname allowlist + post-download SHA-256 verification; mismatch deletes file and raises IntegrityError

Input validation

• hotkey_validation.py: single-combo enforcement (,/; rejected), token allowlist (modifiers, named keys, alphanum, F-keys); enforced at UI, service layer, and storage ingestion
• alias_validation.py: control-character block (\x00–\x1f, \x7f, \u0085, \u2028, \u2029), length caps (key 100, value 2000)
• Pydantic ge/le bounds added to LLMConfig, VADConfig, GridConfig, SoundRecognizerConfig fields
• AutomationServiceConfig.max_repeat_count = 100 caps parameterized command repetition

Activity tracker

• New ActivityTracker class; writes JSONL to %APPDATA%\Vocalance\activity_logs\
• Records dictation outputs and automation executions; lazy file creation
• ActivityTrackingConfig.enabled defaults to False; CI-enforced via static AST check

CI/CD

• Added: Trivy filesystem scan (CVE, secrets, misconfig); action pinned to commit SHA; SARIF → GitHub Security tab; CRITICAL/HIGH fails job
• Added: unit-test job (xvfb-run pytest, excludes integration/slow/memory/stress marks)
• Added: privacy-guard jobs asserting enable_logs and activity_tracking.enabled both default False
• Added: draft-release job (main-only); version-compares against latest published release; assembles minimal zip + SHA-256; attaches zip, checksum, setup.ps1, cleanup.ps1
• Added: setup.ps1 version-consistency check against pyproject.toml

Installer / uninstaller

• Install target changed to %LOCALAPPDATA%\Programs\Vocalance\ (no elevation)
• App, venv, and bundled uv binary co-located under install root; user data separated to %APPDATA%\Vocalance\
• Release zip is a minimal bundle (app source + uv.lock + essentials only; no tests, docs, or scripts)
• setup.ps1 and cleanup.ps1 distributed from GitHub releases, not pulled from main
• cleanup.ps1 rewritten: guarded removals with try-catch, printed summary of removed/skipped paths

Dependencies (CVE fixes)

• moonshine-voice → 0.0.62, pillow → 12.2.0, httpx → 0.28.1
• Pinned previously-transitive packages: keras==3.14.1, protobuf==7.35.1, urllib3==2.7.0
• Pinned dev: starlette==1.3.1, black>=26.3.1

Documentation

• New docs/security/ section: releases, privacy, supply chain, installation/uninstallation, input validation, security assumptions

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.