Summarize Files

Highlights: security fixes for Markdown rendering and Vite, plus more reliable OpenRouter reasoning, media extraction, and transcription uploads.

• Security: backport Markdown rendering denial-of-service fixes and update Vite editor-launch protection while retaining the seven-day dependency stabilization policy.
• OpenRouter: forward reasoning effort and omit implicit output limits for text completions and streams; retain provider error diagnostics (#527, fixes [#519], thanks @Ehsan-hash).
• Media and CLI: terminate timed-out process trees, handle early child stdin closure, and close slide image streams on disconnect without masking extraction failures during cleanup (#520, [#521], [#524], thanks @SebTardif).
• Transcription: abort stalled FAL and AssemblyAI uploads and response bodies while preserving the existing post-upload processing allowance (#522, thanks @SebTardif).
• Browser extraction: bound YouTube audio downloads without a content length and honor the configured summarize fetch timeout, with a two-minute fallback (#523, [#526], thanks @SebTardif).
• Spotify: reject lookalike hostnames when resolving episode IDs (#525, thanks @SebTardif).
• Maintenance: refresh stabilized nanoid and UUID overrides.
• Maintenance: update the provider runtime and lint tooling after their seven-day stabilization hold.
• Maintenance: refresh stabilized terminal rendering, MIME detection, browser media, AWS provider, and test dependencies while retaining Node 24 and the seven-day adoption hold.
• Maintenance: move macOS CI and release jobs to macOS 27, verify x86_64 under Rosetta, and retain the macOS 13 minimum with a shared artifact gate; add a publish-disabled release dry run.
• Maintenance: update the provider runtime, Preact, Playwright, and DOM test dependencies after their seven-day stabilization hold, retaining Node 24.
• Maintenance: refresh stabilized provider, localization, browser media, Preact, Oxc, and GitHub Actions dependencies; migrate picker style types for Preact 11 while retaining Node 24 and the seven-day adoption hold (#515, [#516], thanks @dependabot).

Release verification

Release workflow (attempt 2) passed. Both macOS archives passed Developer ID signature, notarization, execution, and macOS 13 deployment-target checks. SHA256SUMS covers the four downloadable archives.

Both npm packages are published to latest with GitHub Actions provenance:

• @steipete/summarize-core@0.25.3: registry tarball, provenance; integrity sha512-fbTQHsUTlBcktQZvZpKmKDam3yTJK5csQKaL6HZWvwHWnpm5JtvW1Ulv5mH7guPmiORFuuuh+nFfx5PSz/1qSg==.
• @steipete/summarize@0.25.3: registry tarball, provenance; integrity sha512-d/Z9QlG0oxTSA0Vy7dFCAYAe/GEquYPqc6u8OIz0B3MQlfvzEdwPKwiuSMrbnkmxouNJr36xVWcfOV4eEebqGg==.