Skip to content

feat: upstream feature batch B — CSV BOM, loop colors, images, terminology - #15

Merged
SomethingNew71 merged 6 commits into
masterfrom
fix/upstream-batch-b
Oct 2, 2026
Merged

SomethingNew71 merged 6 commits into
masterfrom
fix/upstream-batch-b

Conversation

@SomethingNew71

Copy link
Copy Markdown

Summary

Batch B: small features from upstream wireviz/WireViz issues. Based on batch A; after batch A merges, the base moves to master.

The review found two security issues; both are fixed:

  • Pillow probed every decoder for data-URI and webp images (EPS → Ghostscript).
  • An image used through many YAML aliases was decoded once per alias.

Test plan

  • pytest on Python 3.9, 3.12 and 3.14
  • Gallery: Graphviz source and BOM unchanged
  • CI green

🤖 Generated with Claude Code

… terminology

- wireviz#98: CSV BOM output (-f c, output_formats="csv", <name>.bom.csv)
- wireviz#457: loop colors, loops: [{RD: [VCC, SENSE]}] (syntax of upstream PR wireviz#288)
- wireviz#460: options.show_title draws metadata.title above the diagram
- wireviz#410: --disable-key / parse(disable_keys=...) drops an attribute from
  all components or one (X1.image)
- wireviz#212, wireviz#453: cable show_box: false draws wires straight between
  connectors, without the cable box
- wireviz#135, wireviz#271: CSS/HTML color names (tomato, lightgreen); WireViz codes
  still win, and no CSS name parses as a code sequence
- wireviz#202: .webp images are converted to PNG before rendering
- wireviz#188, wireviz#322: embedded data:image/...;base64 images (also in untrusted
  mode), decoded into a per-harness temp dir with the pixel cap
- wireviz#331: options.terminology replaces pin/wire/shield (upstream PR wireviz#398)
- wireviz#296: connector strip: {sleeve, insulation} (syntax of upstream PR wireviz#446)

Also: titles and node names are passed as nohtml, so "<X>" is never
read as an HTML label. CLAUDE.md records the YAML loading, escaping and
edge-writing invariants.
# Conflicts:
#	tests/test_upstream_issues.py
- images: Pillow is told the declared format (data URI type, WEBP for
  .webp), so attacker bytes never reach other decoders such as EPS /
  Ghostscript; errors name the src as written, not the server path
- a data URI or .webp used many times (YAML aliases) is decoded once
  per parse
- show_title: backslashes in the title are literal (a trailing \ broke
  the render)
- colored loops use the harness-wide padding, so they are as thick as
  wires
- clear errors for a non-text loop color key and malformed terminology
- terminology keeps the user's capitals after the first letter
- docs: disable_keys uses the key under connectors:/cables:, the image
  limits, and why a .gv with converted images cannot be re-rendered
# Conflicts:
#	CLAUDE.md
#	src/wireviz/Harness.py
#	tests/test_security.py
@SomethingNew71
SomethingNew71 changed the base branch from fix/upstream-batch-a to master October 2, 2026 22:50
@SomethingNew71
SomethingNew71 merged commit 320fc46 into master Oct 2, 2026
24 checks passed
@SomethingNew71
SomethingNew71 deleted the fix/upstream-batch-b branch October 2, 2026 22:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant