mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-09-11 21:39:01 +00:00
xarmian
9f85a85427
CI on main has been red since 2026-06-25 on two dependency-audit gates, not on tests or code: - govulncheck: golang.org/x/image@v0.41.0 carries two TIFF-decoder CVEs (GO-2026-5066 out-of-bounds strip offset panic, GO-2026-5062 unbounded tile sizes) reached via internal/attachments/processor_purego.go -> image.Decode -> tiff.Decode. Both fixed in v0.43.0. The go mod tidy that follows pulls the usual transitive x/{text,mod,sync,tools} bumps. - npm audit (--audit-level=high --omit=dev): linkify-it@5.0.0 has a high-severity quadratic-complexity ReDoS (GHSA-22p9-wv53-3rq4), transitive via tiptap-markdown -> markdown-it -> linkify-it. Pinned to ^5.0.1 via an overrides entry (5.0.1 satisfies markdown-it's ^5.0.0). Verified locally: govulncheck clean, go vet/build/test green, npm audit high gate exits 0, web build + svelte-check green. Claude-Session: https://claude.ai/code/session_01HxBkAMiFBtCRJ2tKSCt3ST
75 lines
2.1 KiB
JSON
75 lines
2.1 KiB
JSON
{
|
|
"name": "web",
|
|
"private": true,
|
|
"version": "0.0.1",
|
|
"license": "Apache-2.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite dev",
|
|
"build": "vite build",
|
|
"preview": "vite preview",
|
|
"prepare": "svelte-kit sync || echo ''",
|
|
"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
|
|
"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:e2e": "playwright test",
|
|
"test:e2e:ui": "playwright test --ui",
|
|
"test:e2e:install": "playwright install --with-deps chromium"
|
|
},
|
|
"devDependencies": {
|
|
"@playwright/test": "^1.59.1",
|
|
"@sveltejs/adapter-auto": "^7.0.1",
|
|
"@sveltejs/adapter-static": "^3.0.10",
|
|
"@sveltejs/kit": "^2.59.1",
|
|
"@sveltejs/vite-plugin-svelte": "^7.1.2",
|
|
"@types/d3-scale": "4.0.9",
|
|
"@types/qrcode": "^1.5.6",
|
|
"marked": "^18.0.3",
|
|
"svelte": "^5.55.5",
|
|
"svelte-check": "^4.4.7",
|
|
"typescript": "^6.0.3",
|
|
"vite": "^8.0.11",
|
|
"vitest": "3.2.6"
|
|
},
|
|
"overrides": {
|
|
"cookie": "^0.7.2",
|
|
"linkify-it": "^5.0.1",
|
|
"layercake": {
|
|
"typescript": "$typescript"
|
|
}
|
|
},
|
|
"dependencies": {
|
|
"@dagrejs/dagre": "3.0.0",
|
|
"@tiptap/core": "^3.22.5",
|
|
"@tiptap/extension-bubble-menu": "^3.22.5",
|
|
"@tiptap/extension-code-block-lowlight": "^3.22.5",
|
|
"@tiptap/extension-collaboration": "3.22.5",
|
|
"@tiptap/extension-collaboration-caret": "3.22.5",
|
|
"@tiptap/extension-link": "^3.22.5",
|
|
"@tiptap/extension-placeholder": "^3.22.5",
|
|
"@tiptap/extension-table": "^3.22.5",
|
|
"@tiptap/extension-task-item": "^3.22.5",
|
|
"@tiptap/extension-task-list": "^3.22.5",
|
|
"@tiptap/pm": "^3.20.4",
|
|
"@tiptap/starter-kit": "^3.22.5",
|
|
"@tiptap/suggestion": "^3.22.5",
|
|
"@tiptap/y-tiptap": "^3.0.3",
|
|
"3d-force-graph": "1.80.0",
|
|
"d3-scale": "4.0.2",
|
|
"diff": "^9.0.0",
|
|
"dompurify": "^3.4.2",
|
|
"idb": "^8.0.3",
|
|
"layercake": "10.0.2",
|
|
"lowlight": "^3.3.0",
|
|
"mermaid": "^11.14.0",
|
|
"minisearch": "7.2.0",
|
|
"qrcode": "^1.5.4",
|
|
"svelte-dnd-action": "^0.9.69",
|
|
"three-spritetext": "1.10.0",
|
|
"tiptap-markdown": "^0.9.0",
|
|
"y-protocols": "^1.0.7",
|
|
"yjs": "^13.6.30"
|
|
}
|
|
}
|