mirror of
https://github.com/jambonz/speech-utils.git
synced 2026-08-19 09:40:19 +00:00
7a9a3e24688fe8b9507caf1a74fb0d3e9b4e9fd8
The Azure speech SDK was pinned to exactly 1.38.0 since the initial commit. It pulls in uuid <11.1.1, which carries GHSA-w5hq-g745-h8pq (missing buffer bounds check in v3/v5/v6 when buf is provided). The advisory covers Azure SDK 1.14.0-1.50.0; 1.51.0 clears it. Loosened the exact pin to a caret range so future patches come in without another PR. The SDK surface used here (SpeechConfig, SpeechSynthesizer, ResultReason, CancellationDetails, SpeechSynthesisOutputFormat) is unchanged in 1.51.0. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Languages
JavaScript
99.8%
Dockerfile
0.2%