mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-09-10 23:15:40 +00:00
xarmian
3544e42de1
web/package-lock.json had 11 advisories (1 low, 1 moderate, 9 high) before this PR: @sveltejs/kit (redirect/body-size), cookie<0.7.0, dompurify<=3.3.3, vite 7.0.0-7.3.1, lodash-es, picomatch, chevrotain, etc. All required a mix of `npm audit fix` and targeted upgrades. Changes: - web/package.json: upgrade @sveltejs/kit to ^2.57.1. Add `overrides` map pinning cookie to ^0.7.2 (upstream @sveltejs/kit@2.57.1 still ships cookie@0.6.0 which is LOW severity but trivially fixable). - web/package-lock.json: regenerated via `npm install` + `npm audit fix`. - .github/workflows/ci.yml: add `npm audit --audit-level=high --omit=dev` step after `npm ci`. Fails the build on any HIGH+ advisory in production deps; dev-only issues stay informational so CI isn't held hostage by unfixable upstream chevrotain/vite dev-server advisories. `npm audit --audit-level=high --omit=dev` now reports 0 vulnerabilities locally. `npm run build` and `go test ./...` remain green. Parent: PLAN-643 (OSS Security Hardening).
51 lines
1.4 KiB
JSON
51 lines
1.4 KiB
JSON
{
|
|
"name": "web",
|
|
"private": true,
|
|
"version": "0.0.1",
|
|
"license": "Apache-2.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite dev",
|
|
"build": "vite build",
|
|
"preview": "vite preview",
|
|
"prepare": "svelte-kit sync || echo ''",
|
|
"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
|
|
"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch"
|
|
},
|
|
"devDependencies": {
|
|
"@sveltejs/adapter-auto": "^7.0.0",
|
|
"@sveltejs/adapter-static": "^3.0.10",
|
|
"@sveltejs/kit": "^2.57.1",
|
|
"@sveltejs/vite-plugin-svelte": "^6.2.4",
|
|
"@types/marked": "^5.0.2",
|
|
"marked": "^17.0.5",
|
|
"svelte": "^5.51.0",
|
|
"svelte-check": "^4.4.2",
|
|
"typescript": "^5.9.3",
|
|
"vite": "^7.3.1"
|
|
},
|
|
"overrides": {
|
|
"cookie": "^0.7.2"
|
|
},
|
|
"dependencies": {
|
|
"@tiptap/core": "^3.20.4",
|
|
"@tiptap/extension-bubble-menu": "^3.20.4",
|
|
"@tiptap/extension-code-block-lowlight": "^3.20.4",
|
|
"@tiptap/extension-link": "^3.20.4",
|
|
"@tiptap/extension-placeholder": "^3.20.4",
|
|
"@tiptap/extension-table": "^3.20.4",
|
|
"@tiptap/extension-task-item": "^3.20.4",
|
|
"@tiptap/extension-task-list": "^3.20.4",
|
|
"@tiptap/pm": "^3.20.4",
|
|
"@tiptap/starter-kit": "^3.20.4",
|
|
"@tiptap/suggestion": "^3.20.4",
|
|
"diff": "^8.0.3",
|
|
"dompurify": "^3.3.3",
|
|
"lowlight": "^3.3.0",
|
|
"mermaid": "^11.13.0",
|
|
"qrcode": "^1.5.4",
|
|
"svelte-dnd-action": "^0.9.69",
|
|
"tiptap-markdown": "^0.9.0"
|
|
}
|
|
}
|