Anso 770bead889 fix(deps): bump form-data, protobufjs, and vite to clear high-severity CVEs (#1379) ...

The npm audit and Trivy image-scan CI gates fail on newly disclosed
high-severity advisories in transitive backend dependencies. Bump the
locked versions to their fixed releases:

- form-data 4.0.5 -> 4.0.6 (via axios; CVE-2026-12143, CRLF injection)
- protobufjs 7.5.8 -> 7.6.4 (via dockerode/@grpc; CVE-2026-48712, Any-expansion DoS)
- vite 8.0.5 -> 8.0.16 (vitest dev dependency; fs.deny bypass and launch-editor)

Lockfile-only change (npm audit fix, no package.json edits). Backend build,
lint, and the route/integration tests stay green, and backend
npm audit --audit-level=high now reports 0 vulnerabilities.

2026-06-15 20:33:03 -04:00

..

scripts

fix(fleet): resolve getSenchoVersion crash in Docker containers (#396)

2026-04-06 00:44:36 -04:00

src

feat: make image-update check cadence configurable and visible (#1377)

2026-06-15 20:06:13 -04:00

.npmrc

chore(deps): upgrade major dependencies (ESLint 10, recharts 3, TS 6, Vite 8) (#130)

2026-03-25 00:03:08 -04:00

eslint.config.mjs

refactor(backend): collapse entitlement provider abstraction back to LicenseService (#889)

2026-05-02 23:45:44 -04:00

package-lock.json

fix(deps): bump form-data, protobufjs, and vite to clear high-severity CVEs (#1379)

2026-06-15 20:33:03 -04:00

package.json

feat(recovery): add safe-mode recovery surface and emergency CLI (#1286)

2026-06-02 16:11:24 -04:00

tsconfig.json

perf(build): enable incremental tsc (#827)

2026-04-28 09:15:54 -04:00

vitest.config.ts

perf(test): build baseline DB once via vitest globalSetup (#829)

2026-04-28 10:08:39 -04:00