enricobuehler
b79d90b463
audit.yml's three blocking bun-audit legs (web, sdk, plugin-kit) were all red on
main. Ten findings in sdk and plugin-kit, eight in web; every one of them a
transitive dependency, none reachable by bumping a direct dep.
web already carried the right mechanism — an `overrides` block whose `undici` and
`fast-uri` pins had simply gone stale — so it needed four bumps, not a new idea:
undici 7.28.0 -> ^7.29.0 and fast-uri 3.1.4 -> ^3.1.5 for the reported advisories,
plus postcss ^8.5.10 -> ^8.5.25 and brace-expansion ^5.0.8 -> ^5.0.9 for two more
that were published after the failing run and would have gone red on the next
audit anyway. All four stay inside their current major.
sdk and plugin-kit were harder and the fix deserves an explanation. Their single
finding is undici 8.7.0/8.8.0 pulled in by @effect/platform-node, a devDependency
pinned at 4.0.0-beta.98. That dependency already declares `undici: ^8.7.0`, which
permits the fixed 8.10.0 — the vulnerable version survives purely as a stale
lockfile resolution. Nothing bumps it in place: `bun update` only walks direct
dependencies, `bun install --force` preserves a resolution that still satisfies
its range, and every platform-node release through beta.103 declares the same
`^8.7.0`, so moving the dep changes nothing. Bun rejects the scoped form outright
("Bun currently does not support nested resolutions"), so a flat `overrides` entry
is the only mechanism available, and it necessarily also moves sdk's top-level
undici from 7.x to 8.x.
That is safe here, and was verified rather than assumed. The only source use is
sdk/src/config.ts, which does `new Agent({ connect: { ca } })` behind a dynamic
import and a try/catch with a documented plain-fetch fallback; `Agent` and its
`connect` option are unchanged between undici 7 and 8. sdk typechecks and its 72
tests pass against 8.10.0; plugin-kit typechecks and its 20 tests pass. Both trees
now dedupe to a single undici 8.10.0.
Consumers are deliberately untouched: `overrides` apply only at the root of the
tree that declares them and are not honored when the package is installed as a
dependency, so sdk's published `optionalDependencies: { undici: "^7.0.0" }` is
left alone — a consumer resolves the latest 7.x, which is the fixed 7.29.0. The
override governs this repo's own tree, which is exactly what audit.yml checks.
Worth knowing: sdk's dev tree therefore exercises undici 8 while consumers get 7.
One trap found on the way. Running `bun install` over plugin-kit's existing
lockfile emitted a lockfile with two byte-identical `@punktfunk/host` entries —
its `file:../sdk` dependency crossed with the new override — and bun then refuses
its own output with "Error loading lockfile: InvalidPackageKey". That reads as a
tooling error rather than a finding, so it would have taken the audit gate down
while looking like something else entirely. Regenerating the lockfile from scratch
produces a valid single entry; all three lockfiles are checked for duplicate keys.
Also worth recording, because it nearly shipped: deleting the pinned nested entry
from a lockfile makes `bun audit` report "No vulnerabilities found" while the
vulnerable copy is still installed on disk. bun audit reads the lockfile, not
node_modules. That is a vacuous green, not a fix, and was rejected.
Verified: `bun audit` clean in all three trees; web builds and typechecks (its
typecheck needs the build first, which generates routeTree.gen); sdk 72/72 and
plugin-kit 20/20 tests pass.
75 lines
2.4 KiB
JSON
75 lines
2.4 KiB
JSON
{
|
|
"name": "punktfunk-web",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "punktfunk management console \u2014 TanStack Start + React Query (orval) + @unom/ui + Paraglide i18n",
|
|
"scripts": {
|
|
"prepare": "bun run codegen",
|
|
"postinstall": "bun2nix -o bun.nix",
|
|
"codegen": "orval --config orval.config.ts && paraglide-js compile --project ./project.inlang --outdir ./src/paraglide && node tools/check-i18n.mjs",
|
|
"predev": "orval --config orval.config.ts",
|
|
"dev": "vite dev --port 47992",
|
|
"prebuild": "orval --config orval.config.ts",
|
|
"build": "vite build",
|
|
"postbuild": "node tools/check-i18n.mjs",
|
|
"start": "bun run .output/server/index.mjs",
|
|
"api:gen": "orval --config orval.config.ts",
|
|
"lint": "tsc --noEmit",
|
|
"storybook": "storybook dev -p 6006",
|
|
"build-storybook": "storybook build",
|
|
"screenshots": "node tools/screenshots.mjs",
|
|
"screenshots:build": "bun run build-storybook && node tools/screenshots.mjs"
|
|
},
|
|
"dependencies": {
|
|
"@fontsource-variable/geist": "^5.3.0",
|
|
"@tanstack/react-query": "^5.101.4",
|
|
"@tanstack/react-router": "^1.170.18",
|
|
"@tanstack/react-start": "^1.168.32",
|
|
"@unom/style": "^0.4.4",
|
|
"@unom/ui": "^0.8.16",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"lucide-react": "^0.469.0",
|
|
"motion": "^12.42.2",
|
|
"radix-ui": "^1.6.4",
|
|
"react": "^19.2.8",
|
|
"react-dom": "^19.2.8",
|
|
"recharts": "^3.10.0",
|
|
"tailwind-merge": "^2.6.1",
|
|
"zod": "^4.4.3"
|
|
},
|
|
"devDependencies": {
|
|
"@biomejs/biome": "^2.5.5",
|
|
"@inlang/paraglide-js": "^2.22.0",
|
|
"@inlang/plugin-message-format": "^4.4.0",
|
|
"@storybook/react-vite": "^10.5.3",
|
|
"@tailwindcss/vite": "^4.3.3",
|
|
"@tanstack/nitro-v2-vite-plugin": "^1.155.0",
|
|
"@types/node": "^22.20.1",
|
|
"@types/react": "^19.2.17",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@vitejs/plugin-react": "^5.2.0",
|
|
"bun2nix": "2.1.2",
|
|
"orval": "^8.22.0",
|
|
"playwright": "^1.61.1",
|
|
"storybook": "^10.5.3",
|
|
"tailwindcss": "^4.3.3",
|
|
"tw-animate-css": "^1.4.0",
|
|
"typescript": "^5.9.3",
|
|
"vite": "^7.3.6",
|
|
"vite-tsconfig-paths": "^5.1.4"
|
|
},
|
|
"overrides": {
|
|
"tar": "^7.5.21",
|
|
"dompurify": "^3.4.12",
|
|
"linkify-it": "^5.0.2",
|
|
"sharp": "^0.35.3",
|
|
"fast-uri": "^3.1.5",
|
|
"immutable": "^4.3.9",
|
|
"undici": "^7.29.0",
|
|
"postcss": "^8.5.25",
|
|
"js-yaml": "^4.3.0",
|
|
"brace-expansion": "^5.0.9"
|
|
}
|
|
}
|