securite: #87 T6-T8 fin dette — deps qualifiées, semgrep, Secure auto, CORS

backend/render.py

@@ -15,6 +15,7 @@ import html as html_mod
 import re
 import unicodedata
 from pathlib import Path
+from typing import cast
 
 import mistune
 
@@ -196,7 +197,9 @@ def _render_markdown(raw_md: str, vault_name: str, current_file_path: Path | Non
     # Normalize line breaks to match Obsidian behavior (single \n → hard break)
     converted = _normalize_line_breaks(converted)
 
-    rendered = _markdown_renderer(converted)
+    # mistune 3.3 types `Markdown.__call__` as `str | list[...]` (les
+    # renderers HTML renvoient toujours `str` à l'exécution).
+    rendered = cast(str, _markdown_renderer(converted))
 
     # Add heading IDs for TOC navigation
     rendered = _add_heading_ids(rendered)