securite: #87 T6-T8 fin dette — deps qualifiées, semgrep, Secure auto, CORS

backend/export.py

@@ -23,6 +23,7 @@ import re
 import unicodedata
 import zipfile
 from pathlib import Path
+from typing import cast
 
 import frontmatter
 import mistune
@@ -246,7 +247,9 @@ def _render_body(md: str, file_dir: Path, vault_path: Path, current: Path) -> st
     """Render raw markdown to an HTML fragment (images inlined, wikilinks resolved)."""
     md = _inline_images(md, file_dir, vault_path)
     md = _convert_wikilinks(md, vault_path, current)
-    return _markdown(md)
+    # mistune 3.3 types `Markdown.__call__` as `str | list[...]` (le renderer
+    # HTML renvoie toujours `str` à l'exécution).
+    return cast(str, _markdown(md))
 
 
 def _build_nav(vault_path: Path, current: Path) -> str: