mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-30 16:47:01 +09:00
Juan DenisandClaude Opus 5
ad32930d4f
js-yaml was pinned to 4.3.0 in the overrides block, so `npm audit fix` could never reach it -- the advisory (GHSA-5p4m-2wfm-xmqj, quadratic CPU in !!omap) sat permanently HIGH and masked anything landing behind it. Bumping the pin to 4.3.1 keeps the deliberate supply-chain pin and clears it. The other five were stale-lockfile problems: every fixed version already satisfied its parent's declared range, so re-resolution was enough and no dependency range changed. js-yaml 4.3.0 -> 4.3.1 GHSA-5p4m-2wfm-xmqj socket.io-parser 4.2.6 -> 4.2.7 GHSA-2m8v-j782-fhvr react-router 7.18.1 -> 7.18.2 GHSA-qwww-vcr4-c8h2 nanoid 3.3.16 -> 3.3.18 GHSA-2v37-7h3g-55p8 brace-expansion 1.1.16 -> 1.1.18 GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895 Only one of the six is reachable in a shipped panel at all: socket.io-parser runs in the browser, though an attacker must already control or MITM the panel's own websocket and the payoff is a hung operator tab. The react-router CSRF bypass is RSC-mode only and this is a declarative BrowserRouter SPA with no data router; js-yaml and brace-expansion are eslint-only; nanoid is build-time via postcss. Hygiene, not incident response. package.json and package-lock.json move together -- `npm ci` runs in frontend-ci.yml and release-smoke.yml and hard-fails if they disagree. Verified: npm audit reports 0 vulnerabilities, npm run lint passes with 0 errors, npm run build succeeds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
72 lines
2.5 KiB
JSON
72 lines
2.5 KiB
JSON
{
|
|
"name": "serverkit-frontend",
|
|
"private": true,
|
|
"version": "0.1.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "vite build",
|
|
"lint": "eslint . && node scripts/check-settings-index.mjs && node scripts/check-theme-tokens.mjs && node ../scripts/check-html-sinks.mjs",
|
|
"lint:settings-index": "node scripts/check-settings-index.mjs",
|
|
"lint:html-sinks": "node ../scripts/check-html-sinks.mjs",
|
|
"capture:skeletons": "node scripts/capture-skeletons.mjs",
|
|
"preview": "vite preview"
|
|
},
|
|
"optionalDependencies": {
|
|
"@rollup/rollup-win32-x64-msvc": "^4.62.2"
|
|
},
|
|
"dependencies": {
|
|
"@radix-ui/react-accordion": "^1.2.12",
|
|
"@radix-ui/react-alert-dialog": "^1.1.15",
|
|
"@radix-ui/react-avatar": "^1.1.11",
|
|
"@radix-ui/react-checkbox": "^1.3.3",
|
|
"@radix-ui/react-dialog": "^1.1.15",
|
|
"@radix-ui/react-dropdown-menu": "^2.1.16",
|
|
"@radix-ui/react-label": "^2.1.8",
|
|
"@radix-ui/react-popover": "^1.1.15",
|
|
"@radix-ui/react-progress": "^1.1.8",
|
|
"@radix-ui/react-scroll-area": "^1.2.10",
|
|
"@radix-ui/react-select": "^2.2.6",
|
|
"@radix-ui/react-separator": "^1.1.8",
|
|
"@radix-ui/react-slot": "^1.2.4",
|
|
"@radix-ui/react-switch": "^1.2.6",
|
|
"@radix-ui/react-tabs": "^1.1.13",
|
|
"@radix-ui/react-tooltip": "^1.2.8",
|
|
"@xterm/addon-fit": "^0.10.0",
|
|
"@xterm/addon-web-links": "^0.11.0",
|
|
"@xterm/xterm": "^5.5.0",
|
|
"@xyflow/react": "^12.10.0",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"cmdk": "^1.1.1",
|
|
"lucide-react": "^0.363.0",
|
|
"react": "^18.3.1",
|
|
"react-dom": "^18.3.1",
|
|
"react-icons": "^5.6.0",
|
|
"react-router-dom": "^7.18.1",
|
|
"recharts": "^2.12.3",
|
|
"socket.io-client": "^4.7.2",
|
|
"sonner": "^2.0.7"
|
|
},
|
|
"devDependencies": {
|
|
"@types/react": "^18.3.3",
|
|
"@types/react-dom": "^18.3.0",
|
|
"@vitejs/plugin-react": "^6.0.3",
|
|
"boneyard-js": "^1.9.0",
|
|
"eslint": "^9.9.0",
|
|
"eslint-plugin-react": "^7.35.0",
|
|
"eslint-plugin-react-hooks": "^5.1.0-rc.0",
|
|
"eslint-plugin-react-refresh": "^0.4.9",
|
|
"globals": "^15.9.0",
|
|
"sass": "^1.86.0",
|
|
"vite": "^8.1.4"
|
|
},
|
|
"overrides": {
|
|
"lodash": "4.18.1",
|
|
"js-yaml": "4.3.1",
|
|
"@babel/core": "7.29.7",
|
|
"ws": "8.21.0",
|
|
"engine.io-client": "6.6.6"
|
|
}
|
|
}
|