mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-24 07:53:09 +00:00
Maurice
9b8626622f
Zod before 4.6.6 can exhaust memory while it validates an oversized constrained collection (GHSA-mrhx-c7xc-m3w5), and every request body and tool call goes through it. The workspaces ask for 4.6.7 and the root holds it as a floor for the whole tree, so jimp, which pins zod 3 and has no release on 4, resolves to the same copy. Its option schemas use only object, number, tuple, literal, union, nativeEnum, boolean, string, instanceof and array, all of which zod 4 keeps; resize, scaleToFit, crop, cover, contain, blit, composite, rotate, flip, quantize and the jpeg and png encoders run on it.
70 lines
4.0 KiB
JSON
70 lines
4.0 KiB
JSON
{
|
|
"name": "@trek/root",
|
|
"private": true,
|
|
"version": "4.3.4",
|
|
"engines": {
|
|
"node": "^22.22.2 || ^24.15.0 || >=26.0.0"
|
|
},
|
|
"workspaces": [
|
|
"client",
|
|
"server",
|
|
"shared"
|
|
],
|
|
"scripts": {
|
|
"version:major": "npm version major --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:minor": "npm version minor --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:patch": "npm version patch --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:premajor": "npm version premajor --preid=rc --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:preminor": "npm version preminor --preid=beta --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:prepatch": "npm version prepatch --preid=alpha --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:prerelease": "npm version prerelease --preid=pre --workspaces --include-workspace-root --no-git-tag-version",
|
|
"dev": "npm run build --workspace=shared && concurrently --names shared,server,client \"npm run build:watch --workspace=shared\" \"npm run dev --workspace=server\" \"npm run dev --workspace=client\"",
|
|
"build": "npm run build --workspace=shared && npm run build --workspace=server && npm run build --workspace=client",
|
|
"test": "npm run test --workspace=shared && npm run test --workspace=server && npm run test --workspace=client",
|
|
"test:cov": "npm run test:coverage --workspace=shared && npm run test:coverage --workspace=server && npm run test:coverage --workspace=client && npm run test:coverage --prefix plugin-sdk",
|
|
"test:e2e": "npm run test:e2e --workspace=server",
|
|
"test:ci-scripts": "node --test scripts/ci/*.test.mjs",
|
|
"test:lib-scripts": "node --test scripts/lib/*.test.mjs",
|
|
"lint:knip": "node scripts/ci/knip-ratchet.mjs",
|
|
"lint": "npm run lint --workspace=shared && npm run lint --workspace=server && npm run lint --workspace=client",
|
|
"lint:fix": "npm run lint:fix --workspace=shared && npm run lint:fix --workspace=server",
|
|
"format": "npm run format --workspace=shared && npm run format --workspace=server && npm run format --workspace=client",
|
|
"format:check": "npm run format:check --workspace=shared && npm run format:check --workspace=server && npm run format:check --workspace=client"
|
|
},
|
|
"devDependencies": {
|
|
"concurrently": "^10.0.6",
|
|
"knip": "^6.38.0",
|
|
"unrun": "^0.3.1"
|
|
},
|
|
"comment:scarfSettings": "swagger-ui-dist ships @scarf/scarf install-time analytics; TREK sends no telemetry, so it stays off.",
|
|
"scarfSettings": {
|
|
"enabled": false
|
|
},
|
|
"comment:overrides": "React and react-dom: one React 19 across the workspace, so the test renderer (@testing-library/react) and the app share one react-dom. Everything else is a security floor. npm reads overrides from the root package.json only, so a floor in a workspace package.json does nothing. A floor never crosses a major its dependents ask for (brace-expansion is pinned per line for that reason), and npm ls <name> shows whether it holds.",
|
|
"overrides": {
|
|
"react": "19.3.0",
|
|
"react-dom": "19.3.0",
|
|
"@hono/node-server": "^1.19.13",
|
|
"brace-expansion@^2.0.0": "^2.1.7",
|
|
"dompurify": "^3.4.17",
|
|
"fast-uri": "^3.1.8",
|
|
"file-type": "^21.3.4",
|
|
"hono": "^4.13.11",
|
|
"ip-address": "^10.7.4",
|
|
"js-yaml@^5.0.0": "^5.4.1",
|
|
"multer": "^2.4.0",
|
|
"proxy-addr": "^2.0.8",
|
|
"qs": "^6.15.2",
|
|
"source-map-js": "^1.2.2",
|
|
"ws": "^8.21.3",
|
|
"zod": "^4.6.7"
|
|
},
|
|
"comment:optionalDependencies": "The lockfile is generated on glibc, so the musl builds the Alpine image needs never land in it on their own. Keep the @img/* pins on the same version as client's sharp — a mismatch nests the binary away from libvips and the image build dies in generate-icons.",
|
|
"optionalDependencies": {
|
|
"@img/sharp-linuxmusl-arm64": "0.35.4",
|
|
"@img/sharp-linuxmusl-x64": "0.35.4",
|
|
"@rollup/rollup-linux-arm64-musl": "4.62.0",
|
|
"@rollup/rollup-linux-x64-musl": "4.62.0"
|
|
}
|
|
}
|