
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
@picassio/sync-core
Advanced tools
Platform-neutral contracts and crash-safe ordered client state machine for WebObsidian Sync Protocol 1.0
Shared, platform-neutral Sync Protocol 1.0 contracts and deterministic client state machine for WebObsidian Central Sync. It includes strict Zod schemas/types, path policy, SHA-256 helpers, replay/conflict primitives, golden fixtures, and ordered manifest/catch-up/apply-intent/offline-queue orchestration.
import { OrderedSyncClient, HandshakeResponseSchema, PROTOCOL_VERSION } from '@picassio/sync-core';
Adapters provide persistence, transport, and local materialization; this package performs no filesystem,
Obsidian, browser, or credential storage itself. A client must durably record an apply intent before local
materialization and advance/acknowledge its cursor only afterward. Wake and polling work flush durable local
operations before pulling remote events. Adapters that maintain a separate dirty-path marker can call enqueue(),
durably clear that marker, and then call flush() so the server echo cannot race the local preparation boundary.
Servers advertising ordered-batch-stop-v1 allow ordered publication in protocol-sized batches; older servers
remain at one operation/request. Optional lifecycle observers expose safe bootstrap/progress boundaries only after
the corresponding persistence transition.
MIT licensed. Protocol 1.0 is pre-stable until the corresponding WebObsidian stable release is published.
FAQs
Platform-neutral contracts and crash-safe ordered client state machine for WebObsidian Sync Protocol 1.0
The npm package @picassio/sync-core receives a total of 1 weekly downloads. As such, @picassio/sync-core popularity was classified as not popular.
We found that @picassio/sync-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.