chore(web): clear the 2026-07-22 JS advisory wave — overrides + lock re-resolve
bun-audit went red mid-day on a fresh advisory wave (13 findings across two snapshots of a moving DB): node-tar DoS trio+1 (critical), sharp/libvips CVEs, fast-uri host confusion, undici ×7, brace-expansion/linkify-it/js-yaml/postcss DoS-class, immutable, dompurify. All transitive pins in the management-console tree; none ship in the streaming stack. Every fix version is in-range for its consumers, so: pin overrides for the single-major packages (tar/dompurify/linkify-it/sharp/fast-uri/immutable/ undici/postcss/js-yaml — bun ignores range-scoped override keys, so plain keys) and a full lockfile re-resolve, which also lifts brace-expansion 2.1.1→2.1.2 in place while its 5.x line (minimatch@10) stays untouched. : No vulnerabilities found. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Claude Fable 5
+68
-64
@@ -1,66 +1,70 @@
|
||||
{
|
||||
"name": "punktfunk-web",
|
||||
"private": true,
|
||||
"type": "module",
|
||||
"description": "punktfunk management console — TanStack Start + React Query (orval) + @unom/ui + Paraglide i18n",
|
||||
"scripts": {
|
||||
"prepare": "bun run codegen",
|
||||
"codegen": "orval --config orval.config.ts && paraglide-js compile --project ./project.inlang --outdir ./src/paraglide && node tools/check-i18n.mjs",
|
||||
"predev": "orval --config orval.config.ts",
|
||||
"dev": "vite dev --port 47992",
|
||||
"prebuild": "orval --config orval.config.ts",
|
||||
"build": "vite build",
|
||||
"start": "bun run .output/server/index.mjs",
|
||||
"api:gen": "orval --config orval.config.ts",
|
||||
"lint": "tsc --noEmit",
|
||||
"storybook": "storybook dev -p 6006",
|
||||
"build-storybook": "storybook build",
|
||||
"screenshots": "node tools/screenshots.mjs",
|
||||
"screenshots:build": "bun run build-storybook && node tools/screenshots.mjs"
|
||||
},
|
||||
"dependencies": {
|
||||
"@fontsource-variable/geist": "^5.2.9",
|
||||
"@tanstack/react-query": "^5.101.2",
|
||||
"@tanstack/react-router": "^1.170.17",
|
||||
"@tanstack/react-start": "^1.168.27",
|
||||
"@unom/style": "^0.4.4",
|
||||
"@unom/ui": "^0.8.16",
|
||||
"class-variance-authority": "^0.7.1",
|
||||
"clsx": "^2.1.1",
|
||||
"lucide-react": "^0.469.0",
|
||||
"motion": "^12.42.2",
|
||||
"radix-ui": "^1.6.2",
|
||||
"react": "^19.2.7",
|
||||
"react-dom": "^19.2.7",
|
||||
"recharts": "^3.9.2",
|
||||
"tailwind-merge": "^2.6.1",
|
||||
"zod": "^4.4.3"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@biomejs/biome": "^2.5.2",
|
||||
"@inlang/paraglide-js": "^2.20.2",
|
||||
"@inlang/plugin-message-format": "^4.4.0",
|
||||
"@storybook/react-vite": "^10.4.6",
|
||||
"@tailwindcss/vite": "^4.3.2",
|
||||
"@tanstack/nitro-v2-vite-plugin": "^1.155.0",
|
||||
"@types/node": "^22.20.0",
|
||||
"@types/react": "^19.2.17",
|
||||
"@types/react-dom": "^19.2.3",
|
||||
"@vitejs/plugin-react": "^5.2.0",
|
||||
"orval": "^8.20.0",
|
||||
"playwright": "^1.61.1",
|
||||
"storybook": "^10.4.6",
|
||||
"tailwindcss": "^4.3.2",
|
||||
"tw-animate-css": "^1.4.0",
|
||||
"typescript": "^5.9.3",
|
||||
"vite": "^7.3.6",
|
||||
"vite-tsconfig-paths": "^5.1.4"
|
||||
},
|
||||
"overrides": {
|
||||
"undici": "^7.28.0",
|
||||
"dompurify": "^3.4.11",
|
||||
"postcss": "^8.5.16",
|
||||
"esbuild": "^0.28.1",
|
||||
"js-yaml": "^4.2.0"
|
||||
}
|
||||
"name": "punktfunk-web",
|
||||
"private": true,
|
||||
"type": "module",
|
||||
"description": "punktfunk management console \u2014 TanStack Start + React Query (orval) + @unom/ui + Paraglide i18n",
|
||||
"scripts": {
|
||||
"prepare": "bun run codegen",
|
||||
"codegen": "orval --config orval.config.ts && paraglide-js compile --project ./project.inlang --outdir ./src/paraglide && node tools/check-i18n.mjs",
|
||||
"predev": "orval --config orval.config.ts",
|
||||
"dev": "vite dev --port 47992",
|
||||
"prebuild": "orval --config orval.config.ts",
|
||||
"build": "vite build",
|
||||
"start": "bun run .output/server/index.mjs",
|
||||
"api:gen": "orval --config orval.config.ts",
|
||||
"lint": "tsc --noEmit",
|
||||
"storybook": "storybook dev -p 6006",
|
||||
"build-storybook": "storybook build",
|
||||
"screenshots": "node tools/screenshots.mjs",
|
||||
"screenshots:build": "bun run build-storybook && node tools/screenshots.mjs"
|
||||
},
|
||||
"dependencies": {
|
||||
"@fontsource-variable/geist": "^5.3.0",
|
||||
"@tanstack/react-query": "^5.101.4",
|
||||
"@tanstack/react-router": "^1.170.18",
|
||||
"@tanstack/react-start": "^1.168.32",
|
||||
"@unom/style": "^0.4.4",
|
||||
"@unom/ui": "^0.8.16",
|
||||
"class-variance-authority": "^0.7.1",
|
||||
"clsx": "^2.1.1",
|
||||
"lucide-react": "^0.469.0",
|
||||
"motion": "^12.42.2",
|
||||
"radix-ui": "^1.6.4",
|
||||
"react": "^19.2.8",
|
||||
"react-dom": "^19.2.8",
|
||||
"recharts": "^3.10.0",
|
||||
"tailwind-merge": "^2.6.1",
|
||||
"zod": "^4.4.3"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@biomejs/biome": "^2.5.5",
|
||||
"@inlang/paraglide-js": "^2.22.0",
|
||||
"@inlang/plugin-message-format": "^4.4.0",
|
||||
"@storybook/react-vite": "^10.5.3",
|
||||
"@tailwindcss/vite": "^4.3.3",
|
||||
"@tanstack/nitro-v2-vite-plugin": "^1.155.0",
|
||||
"@types/node": "^22.20.1",
|
||||
"@types/react": "^19.2.17",
|
||||
"@types/react-dom": "^19.2.3",
|
||||
"@vitejs/plugin-react": "^5.2.0",
|
||||
"orval": "^8.22.0",
|
||||
"playwright": "^1.61.1",
|
||||
"storybook": "^10.5.3",
|
||||
"tailwindcss": "^4.3.3",
|
||||
"tw-animate-css": "^1.4.0",
|
||||
"typescript": "^5.9.3",
|
||||
"vite": "^7.3.6",
|
||||
"vite-tsconfig-paths": "^5.1.4"
|
||||
},
|
||||
"overrides": {
|
||||
"tar": "^7.5.21",
|
||||
"dompurify": "^3.4.12",
|
||||
"linkify-it": "^5.0.2",
|
||||
"sharp": "^0.35.3",
|
||||
"fast-uri": "^3.1.4",
|
||||
"immutable": "^4.3.9",
|
||||
"undici": "^7.28.0",
|
||||
"postcss": "^8.5.10",
|
||||
"js-yaml": "^4.3.0"
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user