[waleedlatif1]

Summary

• FFmpeg picks an input's demuxer from its bytes, not its filename. An uploaded DASH manifest declared as video/mp4 was demuxed as DASH and pulled media from a path outside the operation's temp dir into the output (reproduced against the shipped ffmpeg 7.1 via convert, probe, and the STT video path)
• Every ffmpeg/ffprobe input now carries -format_whitelist limited to media containers (mov/mp4, matroska/webm, avi, flv, asf, mpegts, mpeg, mp3, wav, ogg, flac, aac, aiff, amr, caf, png/jpeg/webp/gif), so concat, hls, dash, and imf can no longer be selected by content
• A demuxer the code forces with -f (our own concat list, the lavfi silence source) is added to that input's whitelist rather than exempting it, so nothing opened through it escapes the media list
• The posture no longer depends on upstream per-demuxer defaults (concat safe, hls/dash extension allowlists, mov enable_drefs). Pinning -safe 1 etc. per input was rejected: ffmpeg fails any input whose demuxer doesn't own that option

Type of Change

• Bug fix

Testing

• E2E against the prod image's ffmpeg 7.1.5 (non-root app user), running the real runFfmpegOperation / extractAudioFromVideo before and after:
  • 38 legitimate cases — every operation (incl. concat with silent-audio synthesis, add_text, overlay png/jpg/webp/gif), 22 container/codec types, both STT paths — succeed with byte-identical outputs pre/post
  • DASH manifest: pre-fix read an outside-temp-dir media file through convert/probe/STT; post-fix rejected with "Format not on whitelist". ffconcat, HLS (.m3u8 via declared MIME), and IMF also rejected at the format gate
• Same matrix natively on ffmpeg 9.0: identical pre/post results for all legitimate cases
• lib/media + lib/audio vitest (67 passing); pinned-argv expectations updated for the new flag
• biome on changed files; full audits/type-check/tests via CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 2, 2026 8:39pm UTC

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no blocking issue remains.

Summary

The PR adds media-format allowlists to FFmpeg and FFprobe inputs. The latest change adds support for animated PNG files through apng.

• FFmpeg and FFprobe limit inputs to media formats.

_{Reviews (3) · Last reviewed commit: "fix(media): allow apng demuxer" · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}