HitFrostbite/punktfunk
1
0
Fork 0
forked from unom/punktfunk
Code Pull Requests Activity

chore(docs-site): current deps all around — the 67 leftover advisories all live inside @unom/ui's payload chain

Browse Source 
bun update (fumadocs 16.14, tanstack ~1.170, react 19.2) plus @unom/ui 0.8.16
-> 0.9.2 and @unom/app-ui 0.1 -> 0.2.1. Build, tsc --noEmit and a served
smoke test all pass. The audit stays non-blocking: every remaining advisory
is pinned inside @unom/ui's own dependency tree (@payloadcms/* -> fast-uri/
image-size/sharp, next 16.x, sass -> immutable) — nothing bumpable from this
lockfile, and overrides would fork what the CMS actually ships. The comment
in audit.yml now names that blocker instead of the stale dompurify/node-tar
list.
This commit is contained in:
enricobuehler
2026-08-14 18:14:29 +02:00
parent ea5afbaa8c
commit 39b9e9e276
3 changed files with 564 additions and 216 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/audit.yml
+7 -5
View File
@@ -9,11 +9,13 @@
# login gate, session sealing, mgmt bearer token), sdk (@punktfunk/host),
# plugin-kit (@punktfunk/plugin-kit).
# * pnpm audit → clients/decky (the Steam Deck plugin).
# * docs-site → scanned NON-blocking (continue-on-error): known transitive advisories ride in
# via the CMS/UI chain (@unom/ui → payload → dompurify/monaco) and the nitropack
# build chain (node-tar, brace-expansion); clearing them needs coordinated bumps
# verified against the LIVE site (the docs don't build standalone) — tracked in
# punktfunk-planning design/cra-readiness.md. Flip to blocking once clean.
# * docs-site → scanned NON-blocking (continue-on-error). 2026-08-14: docs-site's own deps
# are current (fumadocs/tanstack/react bumped; build + tsc + serve verified),
# but every remaining advisory is pinned INSIDE @unom/ui 0.9.2's dependency
# tree (@payloadcms/* → fast-uri/image-size/sharp, next 16.x, sass→immutable) —
# nothing bumpable from this lockfile, and overrides would fork what the CMS
# actually ships. The fix belongs in the @unom/ui package repo; flip this to
# blocking after a ui release with a clean payload chain lands here.
# * cargo-about → license-allowlist gate over the host + driver workspaces (about.toml `accepted`);
# fails if any crate carries a license outside the allowlist — the regression
# guard about.toml always promised. (The Android Gradle tree has no lockfile, so
docs-site/bun.lock
+537 -191
View File
File diff suppressed because it is too large Load Diff
docs-site/package.json
+20 -20
View File
@@ -10,30 +10,30 @@
"lint": "tsc --noEmit"
},
"dependencies": {
"@fontsource-variable/geist": "^5.2.9",
"@scalar/api-reference-react": "^0.9.47",
"@tanstack/react-router": "^1.121.0",
"@tanstack/react-start": "^1.121.0",
"@unom/app-ui": "^0.1.0",
"@fontsource-variable/geist": "^5.3.0",
"@scalar/api-reference-react": "^0.9.63",
"@tanstack/react-router": "^1.170.28",
"@tanstack/react-start": "^1.168.45",
"@unom/app-ui": "^0.2.1",
"@unom/style": "^0.4.4",
"@unom/ui": "^0.8.16",
"fumadocs-core": "^16.10.5",
"fumadocs-ui": "^16.10.5",
"react": "^19.0.0",
"react-dom": "^19.0.0"
"@unom/ui": "^0.9.2",
"fumadocs-core": "^16.14.4",
"fumadocs-ui": "^16.14.4",
"react": "^19.2.8",
"react-dom": "^19.2.8"
},
"devDependencies": {
"@tailwindcss/vite": "^4.0.0",
"@tailwindcss/vite": "^4.3.3",
"@tanstack/nitro-v2-vite-plugin": "^1.155.0",
"@types/mdx": "^2.0.14",
"@types/node": "^22.10.0",
"@types/react": "^19.0.0",
"@types/react-dom": "^19.0.0",
"@vitejs/plugin-react": "^5",
"fumadocs-mdx": "^15.0.12",
"tailwindcss": "^4.0.0",
"typescript": "^5.7.0",
"vite": "^7.3.5",
"vite-tsconfig-paths": "^5.1.0"
"@types/node": "^22.20.1",
"@types/react": "^19.2.18",
"@types/react-dom": "^19.2.4",
"@vitejs/plugin-react": "^5.2.0",
"fumadocs-mdx": "^15.2.3",
"tailwindcss": "^4.3.3",
"typescript": "^5.9.3",
"vite": "^7.3.6",
"vite-tsconfig-paths": "^5.1.4"
}
}