mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 21:46:49 +00:00
Maurice
8acfaea3c4
Docker Scout turned the release PR red overnight on advisories published after the last green run: multer < 2.3.0 CVE-2026-82333, CVE-2026-77078, CVE-2026-77037 nodemailer < 9.1.0 GHSA-2x7j-588g-ccc2 Both are patch-level resource-exhaustion fixes with no API change — multer 2.3.0 carries the same four dependencies as 2.2.0. multer resolves through the root override (@nestjs/platform-express asks for 2.1.1), so the range there has to move with it, and the server's own override list beside it.
49 lines
3.0 KiB
JSON
49 lines
3.0 KiB
JSON
{
|
|
"name": "@trek/root",
|
|
"private": true,
|
|
"version": "4.2.0",
|
|
"workspaces": [
|
|
"client",
|
|
"server",
|
|
"shared"
|
|
],
|
|
"scripts": {
|
|
"version:major": "npm version major --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:minor": "npm version minor --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:patch": "npm version patch --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:premajor": "npm version premajor --preid=rc --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:preminor": "npm version preminor --preid=beta --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:prepatch": "npm version prepatch --preid=alpha --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:prerelease": "npm version prerelease --preid=pre --workspaces --include-workspace-root --no-git-tag-version",
|
|
"dev": "npm run build --workspace=shared && concurrently --names shared,server,client \"npm run build:watch --workspace=shared\" \"npm run dev --workspace=server\" \"npm run dev --workspace=client\"",
|
|
"build": "npm run build --workspace=shared && npm run build --workspace=server && npm run build --workspace=client",
|
|
"test": "npm run test --workspace=shared && npm run test --workspace=server && npm run test --workspace=client",
|
|
"test:cov": "npm run test:coverage --workspace=shared && npm run test:coverage --workspace=server && npm run test:coverage --workspace=client && npm run test:coverage --prefix plugin-sdk",
|
|
"test:e2e": "npm run test:e2e --workspace=server",
|
|
"lint": "npm run lint --workspace=shared && npm run lint --workspace=server && npm run lint --workspace=client",
|
|
"format": "npm run format --workspace=shared && npm run format --workspace=server && npm run format --workspace=client",
|
|
"format:check": "npm run format:check --workspace=shared && npm run format:check --workspace=server && npm run format:check --workspace=client"
|
|
},
|
|
"devDependencies": {
|
|
"concurrently": "^10.0.4",
|
|
"unrun": "^0.3.1"
|
|
},
|
|
"comment:scarfSettings": "swagger-ui-dist ships @scarf/scarf install-time analytics; TREK sends no telemetry, so it stays off.",
|
|
"scarfSettings": {
|
|
"enabled": false
|
|
},
|
|
"comment:overrides": "Force a single React 19 across the workspace so the test renderer (@testing-library/react) and the app share one react-dom.",
|
|
"overrides": {
|
|
"react": "19.2.6",
|
|
"react-dom": "19.2.6",
|
|
"multer": "^2.3.0"
|
|
},
|
|
"comment:optionalDependencies": "The lockfile is generated on glibc, so the musl builds the Alpine image needs never land in it on their own. Keep the @img/* pins on the same version as client's sharp — a mismatch nests the binary away from libvips and the image build dies in generate-icons.",
|
|
"optionalDependencies": {
|
|
"@img/sharp-linuxmusl-arm64": "0.35.0",
|
|
"@img/sharp-linuxmusl-x64": "0.35.0",
|
|
"@rollup/rollup-linux-arm64-musl": "4.62.0",
|
|
"@rollup/rollup-linux-x64-musl": "4.62.0"
|
|
}
|
|
}
|