enricobuehler
ad806be70a
ci / rust-arm64 (pull_request) Failing after 5s
ci / web (pull_request) Successful in 1m9s
ci / docs-site (pull_request) Failing after 1m19s
ci / bun-nix (pull_request) Successful in 25s
ci / rust (pull_request) Successful in 6m47s
nix / flake (pull_request) Successful in 13m37s
The audit workflow's blocking `bun audit` leg went red on web with five
findings; sdk and plugin-kit stayed clean. Three had published fixes and are
bumped through the existing overrides block:
* dompurify 3.4.12 → 3.4.13 GHSA-55q2-fjhq-7xh7 (IN_PLACE hook removal
leaves a detached subtree executable). The override was already pinned at
^3.4.12, which the new advisory range swallowed.
* js-yaml 4.3.0 → 4.3.1 GHSA-5p4m-2wfm-xmqj (quadratic CPU in !!omap).
* nanoid 3.3.16 → 3.3.18 GHSA-2v37-7h3g-55p8 (custom generators loop
forever at size zero). New override — it arrives under postcss, which was
already pinned, but the pin does not reach postcss's own dependency.
The remaining two are the image-size infinite-loop DoS pair
(GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq), and they are ignored in the
workflow rather than fixed, because they are both unfixable and unreachable:
the vulnerable range is `<= 2.0.2` and 2.0.2 is the latest published version,
so no override can clear them; and image-size rides in under
@unom/ui > @payloadcms/richtext-lexical > ... > payload, where
@payloadcms/richtext-lexical is a peer that only @unom/ui's ./richtext export
needs. The console imports section, toast, button, card, dialog, form/*,
material and tabs — never ./richtext — so payload is auto-installed peer weight
that no bundle and no request path touches. The ignores are scoped to the web
matrix leg so sdk and plugin-kit stay strictly fail-on-any, and the reasoning
is recorded at the step so they can be dropped once image-size ships a fix or
@unom/ui marks that peer optional.
bun.nix is regenerated by the bun2nix postinstall; scripts/ci/check-bun-nix.sh
reports both bun packages in sync. web build, typecheck and server tests pass.
77 lines
2.3 KiB
JSON
77 lines
2.3 KiB
JSON
{
|
|
"name": "punktfunk-web",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "punktfunk management console — TanStack Start + React Query (orval) + @unom/ui + Paraglide i18n",
|
|
"scripts": {
|
|
"prepare": "bun run codegen",
|
|
"postinstall": "bun2nix -o bun.nix",
|
|
"codegen": "orval --config orval.config.ts && paraglide-js compile --project ./project.inlang --outdir ./src/paraglide && node tools/check-i18n.mjs",
|
|
"predev": "orval --config orval.config.ts",
|
|
"dev": "vite dev --port 47992",
|
|
"prebuild": "orval --config orval.config.ts",
|
|
"build": "vite build",
|
|
"postbuild": "node tools/check-i18n.mjs",
|
|
"start": "bun run .output/server/index.mjs",
|
|
"api:gen": "orval --config orval.config.ts",
|
|
"lint": "tsc --noEmit",
|
|
"test": "bun test server/",
|
|
"storybook": "storybook dev -p 6006",
|
|
"build-storybook": "storybook build",
|
|
"screenshots": "node tools/screenshots.mjs",
|
|
"screenshots:build": "bun run build-storybook && node tools/screenshots.mjs"
|
|
},
|
|
"dependencies": {
|
|
"@fontsource-variable/geist": "^5.3.0",
|
|
"@tanstack/react-query": "^5.101.4",
|
|
"@tanstack/react-router": "^1.170.18",
|
|
"@tanstack/react-start": "^1.168.32",
|
|
"@unom/style": "^0.4.4",
|
|
"@unom/ui": "^0.9.2",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"lucide-react": "^0.469.0",
|
|
"motion": "^12.42.2",
|
|
"radix-ui": "^1.6.4",
|
|
"react": "^19.2.8",
|
|
"react-dom": "^19.2.8",
|
|
"recharts": "^3.10.0",
|
|
"tailwind-merge": "^2.6.1",
|
|
"zod": "^4.4.3"
|
|
},
|
|
"devDependencies": {
|
|
"@biomejs/biome": "^2.5.5",
|
|
"@inlang/paraglide-js": "^2.22.0",
|
|
"@inlang/plugin-message-format": "^4.4.0",
|
|
"@storybook/react-vite": "^10.5.3",
|
|
"@tailwindcss/vite": "^4.3.3",
|
|
"@tanstack/nitro-v2-vite-plugin": "^1.155.0",
|
|
"@types/node": "^22.20.1",
|
|
"@types/react": "^19.2.17",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@vitejs/plugin-react": "^5.2.0",
|
|
"bun2nix": "2.1.2",
|
|
"orval": "^8.22.0",
|
|
"playwright": "^1.61.1",
|
|
"storybook": "^10.5.3",
|
|
"tailwindcss": "^4.3.3",
|
|
"tw-animate-css": "^1.4.0",
|
|
"typescript": "^5.9.3",
|
|
"vite": "^7.3.6",
|
|
"vite-tsconfig-paths": "^5.1.4"
|
|
},
|
|
"overrides": {
|
|
"tar": "^7.5.21",
|
|
"dompurify": "^3.4.13",
|
|
"linkify-it": "^5.0.2",
|
|
"sharp": "^0.35.3",
|
|
"fast-uri": "^3.1.5",
|
|
"immutable": "^4.3.9",
|
|
"undici": "^7.29.0",
|
|
"postcss": "^8.5.25",
|
|
"nanoid": "^3.3.18",
|
|
"js-yaml": "^4.3.1",
|
|
"brace-expansion": "^5.0.9"
|
|
}
|
|
}
|