mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-10-27 14:57:15 +00:00
xarmian
dd8674255c
mermaid 12.0.0 introduces chevrotain 11.1.2, which exact-pins "lodash-es": "4.17.23" in chevrotain, @chevrotain/gast and @chevrotain/cst-dts-gen. That version carries GHSA-r5fr-rjxr-66jc (high, code injection via _.template import key names) and GHSA-f23m-r3pf-42rh (moderate, prototype pollution in _.unset/_.omit), which is the whole of the PR's 5 high advisories -- the chevrotain and mermaid rows carry no advisory of their own, every `via` resolves here. The tree already shipped lodash-es 4.18.1 at the top level (3d-force-graph -> kapsule takes a ^4 range), so this override does not add a version: it collapses chevrotain's three nested 4.17.23 duplicates onto the copy the app already loads. The lockfile delta is exactly those three removals, with nothing added and no other version changed. An override is the only instrument available, since the pin is exact. Overriding chevrotain to 13.2.0 -- which drops lodash-es entirely -- was rejected because mermaid declares "chevrotain": "~11.1.2", so that would run mermaid against a parser two majors from what it was tested against. Claude-Session: https://claude.ai/code/session_01BLg7wiBeSgXvAhWi23mT4Z
83 lines
2.4 KiB
JSON
83 lines
2.4 KiB
JSON
{
|
|
"name": "web",
|
|
"private": true,
|
|
"version": "0.0.1",
|
|
"license": "Apache-2.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite dev",
|
|
"build": "vite build",
|
|
"preview": "vite preview",
|
|
"prepare": "svelte-kit sync || echo ''",
|
|
"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
|
|
"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:e2e": "playwright test",
|
|
"test:e2e:ui": "playwright test --ui",
|
|
"test:e2e:install": "playwright install --with-deps chromium",
|
|
"check:tiptap-pins": "node scripts/check-tiptap-pins.mjs",
|
|
"audit:ci": "node scripts/ci-audit.mjs"
|
|
},
|
|
"devDependencies": {
|
|
"@playwright/test": "^1.63.0",
|
|
"@sveltejs/adapter-auto": "^7.0.1",
|
|
"@sveltejs/adapter-static": "^3.0.10",
|
|
"@sveltejs/kit": "^2.70.3",
|
|
"@sveltejs/vite-plugin-svelte": "^7.3.0",
|
|
"@testing-library/jest-dom": "^7.0.1",
|
|
"@testing-library/svelte": "^5.2.8",
|
|
"@types/d3-scale": "4.0.9",
|
|
"@types/qrcode": "^1.5.6",
|
|
"fake-indexeddb": "6.2.5",
|
|
"jsdom": "^29.1.1",
|
|
"marked": "^18.0.12",
|
|
"svelte": "^5.57.0",
|
|
"svelte-check": "^4.7.6",
|
|
"typescript": "^6.0.3",
|
|
"vite": "^8.3.0",
|
|
"vitest": "5.0.0"
|
|
},
|
|
"overrides": {
|
|
"cookie": "^0.7.2",
|
|
"linkify-it": "^5.0.2",
|
|
"lodash-es": "^4.18.1",
|
|
"markdown-it": "^14.3.0",
|
|
"layercake": {
|
|
"typescript": "$typescript"
|
|
}
|
|
},
|
|
"dependencies": {
|
|
"@dagrejs/dagre": "3.1.1",
|
|
"@tiptap/core": "3.31.3",
|
|
"@tiptap/extension-bubble-menu": "^3.31.3",
|
|
"@tiptap/extension-code-block-lowlight": "^3.31.3",
|
|
"@tiptap/extension-collaboration": "3.31.3",
|
|
"@tiptap/extension-collaboration-caret": "3.31.3",
|
|
"@tiptap/extension-link": "^3.22.5",
|
|
"@tiptap/extension-placeholder": "^3.31.3",
|
|
"@tiptap/extension-table": "^3.31.3",
|
|
"@tiptap/extension-task-item": "^3.31.3",
|
|
"@tiptap/extension-task-list": "^3.31.3",
|
|
"@tiptap/pm": "3.31.3",
|
|
"@tiptap/starter-kit": "^3.31.3",
|
|
"@tiptap/suggestion": "^3.31.3",
|
|
"@tiptap/y-tiptap": "3.0.9",
|
|
"3d-force-graph": "1.80.0",
|
|
"d3-scale": "4.0.2",
|
|
"diff": "^9.0.0",
|
|
"dompurify": "^3.4.15",
|
|
"idb": "^8.0.3",
|
|
"layercake": "11.0.0",
|
|
"lowlight": "^3.3.0",
|
|
"mermaid": "^12.0.0",
|
|
"minisearch": "7.2.0",
|
|
"qrcode": "^1.5.4",
|
|
"svelte-dnd-action": "^0.9.79",
|
|
"three-spritetext": "1.10.0",
|
|
"tiptap-markdown": "^0.9.0",
|
|
"y-protocols": "^1.0.7",
|
|
"yjs": "^13.6.32"
|
|
}
|
|
}
|