mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-20 05:56:53 +00:00
Maurice
43ed960f30
The image scan has been red since 10-06 on five advisories in four runtime packages: proxy-addr 2.0.7 (critical, IP spoofing through an IPv4-mapped IPv6 trust subnet), brace-expansion 2.1.4, source-map-js 1.2.1 and @modelcontextprotocol/sdk 1.30.0. brace-expansion had been fixed once already; the ORM squash regenerated the lockfile and took it back to 2.1.4 without anything noticing. The overrides block in server/package.json was meant to hold such floors, but npm reads overrides from the root package.json only, so none of them ever applied: @nestjs/platform-ws kept its own ws 8.21.2 next to the 8.21.3 the block asked for. The floors move to the root, together with new ones for every package this lifts, so the next lockfile regeneration cannot quietly undo them. picomatch ^4 is dropped instead of moved: at the root it would force micromatch's 2.x copy across a major. js-yaml is lifted only inside its 5.x line, the one @nestjs/swagger pins. The SDK goes to 1.31.0, the first fixed release; it stays hoisted, which the CJS path aliases in server/tsconfig.json depend on. dompurify, fast-uri, ip-address and js-yaml come along because npm audit flags the same lockfile for them and each fix is inside the range already used. @mikro-orm/postgresql (with pg), marked and topojson-client are dropped: nothing in src, tests or scripts imports them, and the ORM config names only the SQLite driver. The Postgres driver comes back with a Postgres job that exercises it. npm audit --omit=dev now reports only maplibre-gl, whose fix is the 6.x major tracked separately.
61 lines
3.6 KiB
JSON
61 lines
3.6 KiB
JSON
{
|
|
"name": "@trek/root",
|
|
"private": true,
|
|
"version": "4.3.3",
|
|
"workspaces": [
|
|
"client",
|
|
"server",
|
|
"shared"
|
|
],
|
|
"scripts": {
|
|
"version:major": "npm version major --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:minor": "npm version minor --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:patch": "npm version patch --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:premajor": "npm version premajor --preid=rc --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:preminor": "npm version preminor --preid=beta --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:prepatch": "npm version prepatch --preid=alpha --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:prerelease": "npm version prerelease --preid=pre --workspaces --include-workspace-root --no-git-tag-version",
|
|
"dev": "npm run build --workspace=shared && concurrently --names shared,server,client \"npm run build:watch --workspace=shared\" \"npm run dev --workspace=server\" \"npm run dev --workspace=client\"",
|
|
"build": "npm run build --workspace=shared && npm run build --workspace=server && npm run build --workspace=client",
|
|
"test": "npm run test --workspace=shared && npm run test --workspace=server && npm run test --workspace=client",
|
|
"test:cov": "npm run test:coverage --workspace=shared && npm run test:coverage --workspace=server && npm run test:coverage --workspace=client && npm run test:coverage --prefix plugin-sdk",
|
|
"test:e2e": "npm run test:e2e --workspace=server",
|
|
"lint": "npm run lint --workspace=shared && npm run lint --workspace=server && npm run lint --workspace=client",
|
|
"format": "npm run format --workspace=shared && npm run format --workspace=server && npm run format --workspace=client",
|
|
"format:check": "npm run format:check --workspace=shared && npm run format:check --workspace=server && npm run format:check --workspace=client"
|
|
},
|
|
"devDependencies": {
|
|
"concurrently": "^10.0.4",
|
|
"unrun": "^0.3.1"
|
|
},
|
|
"comment:scarfSettings": "swagger-ui-dist ships @scarf/scarf install-time analytics; TREK sends no telemetry, so it stays off.",
|
|
"scarfSettings": {
|
|
"enabled": false
|
|
},
|
|
"comment:overrides": "React and react-dom: one React 19 across the workspace, so the test renderer (@testing-library/react) and the app share one react-dom. Everything else is a security floor. npm reads overrides from the root package.json only, so a floor in a workspace package.json does nothing. A floor never crosses a major its dependents ask for (brace-expansion is pinned per line for that reason), and npm ls <name> shows whether it holds.",
|
|
"overrides": {
|
|
"react": "19.3.0",
|
|
"react-dom": "19.3.0",
|
|
"@hono/node-server": "^1.19.13",
|
|
"brace-expansion@^2.0.0": "^2.1.7",
|
|
"dompurify": "^3.4.16",
|
|
"fast-uri": "^3.1.8",
|
|
"file-type": "^21.3.4",
|
|
"hono": "^4.12.16",
|
|
"ip-address": "^10.7.1",
|
|
"js-yaml@^5.0.0": "^5.4.1",
|
|
"multer": "^2.4.0",
|
|
"proxy-addr": "^2.0.8",
|
|
"qs": "^6.15.2",
|
|
"source-map-js": "^1.2.2",
|
|
"ws": "^8.21.3"
|
|
},
|
|
"comment:optionalDependencies": "The lockfile is generated on glibc, so the musl builds the Alpine image needs never land in it on their own. Keep the @img/* pins on the same version as client's sharp — a mismatch nests the binary away from libvips and the image build dies in generate-icons.",
|
|
"optionalDependencies": {
|
|
"@img/sharp-linuxmusl-arm64": "0.35.4",
|
|
"@img/sharp-linuxmusl-x64": "0.35.4",
|
|
"@rollup/rollup-linux-arm64-musl": "4.62.0",
|
|
"@rollup/rollup-linux-x64-musl": "4.62.0"
|
|
}
|
|
}
|