d11378c254
Some checks failed
CI / Unit & Component Tests (pull_request) Failing after 4m46s
CI / OCR Service Tests (pull_request) Successful in 24s
CI / Backend Unit Tests (pull_request) Successful in 5m42s
CI / fail2ban Regex (pull_request) Successful in 47s
CI / Semgrep Security Scan (pull_request) Successful in 21s
CI / Compose Bucket Idempotency (pull_request) Successful in 1m8s
CI / Unit & Component Tests (push) Successful in 5m23s
CI / OCR Service Tests (push) Successful in 24s
CI / Backend Unit Tests (push) Successful in 6m4s
CI / fail2ban Regex (push) Successful in 48s
CI / Semgrep Security Scan (push) Successful in 25s
CI / Compose Bucket Idempotency (push) Successful in 1m12s
nightly / deploy-staging (push) Successful in 5m20s
The CI step "Security audit (no dev deps)" (npm audit --audit-level=high --omit=dev) failed repo-wide on every PR: newly-published advisories landed against the already-pinned esbuild 0.27.7 (GHSA-gv7w-rqvm-qjhr, GHSA-g7r4-m6w7-qqqr — both high), pulled in transitively via vite -> @sveltejs/vite-plugin-svelte. The fix for both only exists at esbuild@0.28.1. A scoped vite@7 minor bump cannot help — all vite 7.x pin esbuild ^0.27.0. Add an overrides block: - esbuild 0.28.1 (exact, no caret — a future 0.29.x must not silently float in and re-break vite; let Renovate propose bumps explicitly) - cookie >=0.7.0 (clears the low GHSA-pxg6-pf52-xh8x reaching the prod tree via @sentry/sveltekit; drop-in, done in the same pass) npm audit --audit-level=high --omit=dev now exits 0 with 0 vulnerabilities. npm run build, lint, and a dev-server boot all succeed with the forced esbuild 0.28.1 (validated, not assumed — it sits outside vite@7.3.3's declared ^0.27.0 range). Closes #817 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
82 lines
3.0 KiB
JSON
82 lines
3.0 KiB
JSON
{
|
|
"name": "frontend",
|
|
"private": true,
|
|
"version": "0.0.1",
|
|
"type": "module",
|
|
"//@vitest/browser-playwright": "Exact-pinned (no caret) to 4.1.6 so patches/@vitest+browser-playwright+4.1.6.patch (backport of vitest PR #10267, the duplicate-mock-id birpc race) keeps applying. TODO: remove this pin and the patch once @vitest/browser-playwright ships a release containing PR #10267. See docs/adr/012-browser-test-mocking-strategy.md.",
|
|
"scripts": {
|
|
"dev": "vite dev",
|
|
"build": "vite build",
|
|
"postbuild": "node scripts/assert-pdfjs-wasm.mjs",
|
|
"preview": "vite preview",
|
|
"prepare": "svelte-kit sync || true && git -C .. config core.hooksPath .husky 2>/dev/null || true",
|
|
"postinstall": "patch-package",
|
|
"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
|
|
"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
|
|
"format": "prettier --write .",
|
|
"lint": "prettier --check . && eslint .",
|
|
"lint:boundary-demo": "eslint src/lib/tag/__fixtures__/",
|
|
"test:unit": "vitest",
|
|
"test": "npm run test:unit -- --run",
|
|
"test:coverage": "vitest run --coverage --project=server && vitest run -c vitest.client-coverage.config.ts --coverage",
|
|
"test:e2e": "playwright test",
|
|
"test:e2e:headed": "playwright test --headed",
|
|
"test:e2e:ui": "playwright test --ui",
|
|
"generate:api": "openapi-typescript http://localhost:8080/v3/api-docs -o ./src/lib/generated/api.ts"
|
|
},
|
|
"dependencies": {
|
|
"@sentry/sveltekit": "^10.53.1",
|
|
"@tiptap/core": "3.23.4",
|
|
"@tiptap/extension-mention": "3.23.4",
|
|
"@tiptap/starter-kit": "3.23.4",
|
|
"diff": "^8.0.3",
|
|
"isomorphic-dompurify": "^3.12.0",
|
|
"openapi-fetch": "^0.13.5",
|
|
"pdfjs-dist": "^5.5.207"
|
|
},
|
|
"devDependencies": {
|
|
"@axe-core/playwright": "^4.11.1",
|
|
"@eslint/compat": "^1.4.0",
|
|
"@eslint/js": "^9.39.1",
|
|
"@inlang/paraglide-js": "^2.5.0",
|
|
"@playwright/test": "^1.60.0",
|
|
"@sveltejs/adapter-node": "^5.5.4",
|
|
"@sveltejs/kit": "^2.60.1",
|
|
"@sveltejs/vite-plugin-svelte": "^6.2.1",
|
|
"@tailwindcss/forms": "^0.5.10",
|
|
"@tailwindcss/typography": "^0.5.19",
|
|
"@tailwindcss/vite": "^4.1.17",
|
|
"@types/diff": "^7.0.2",
|
|
"@types/node": "^24",
|
|
"@vitest/browser-playwright": "4.1.6",
|
|
"@vitest/coverage-istanbul": "^4.1.0",
|
|
"@vitest/coverage-v8": "^4.1.0",
|
|
"eslint": "^9.39.1",
|
|
"eslint-config-prettier": "^10.1.8",
|
|
"eslint-import-resolver-typescript": "4.4.4",
|
|
"eslint-plugin-boundaries": "6.0.2",
|
|
"eslint-plugin-svelte": "^3.13.0",
|
|
"globals": "^16.5.0",
|
|
"openapi-typescript": "^7.8.0",
|
|
"patch-package": "^8.0.0",
|
|
"playwright": "^1.60.0",
|
|
"prettier": "^3.6.2",
|
|
"prettier-plugin-svelte": "^3.4.0",
|
|
"prettier-plugin-tailwindcss": "^0.7.1",
|
|
"svelte": "^5.43.8",
|
|
"svelte-check": "^4.3.4",
|
|
"tailwindcss": "^4.1.17",
|
|
"typescript": "^5.9.3",
|
|
"typescript-eslint": "^8.47.0",
|
|
"vite": "^7.3.3",
|
|
"vite-plugin-devtools-json": "^1.0.0",
|
|
"vite-plugin-static-copy": "^4.1.0",
|
|
"vitest": "^4.0.10",
|
|
"vitest-browser-svelte": "^2.0.1"
|
|
},
|
|
"overrides": {
|
|
"esbuild": "0.28.1",
|
|
"cookie": ">=0.7.0"
|
|
}
|
|
}
|