enricobuehler
ec9aa415f6
audit / bun-audit (push) Successful in 19s
ci / docs-site (push) Successful in 2m18s
audit / cargo-audit (push) Successful in 3m22s
ci / web (push) Successful in 1m6s
apple / swift (push) Successful in 5m10s
ci / bench (push) Successful in 5m49s
ci / rust-arm64 (push) Successful in 9m52s
arch / build-publish (push) Successful in 13m17s
decky / build-publish (push) Successful in 54s
deb / build-publish-client-arm64 (push) Successful in 12m15s
android / android (push) Successful in 18m58s
deb / build-publish-host (push) Successful in 16m33s
windows-host / package (push) Successful in 19m55s
windows-host / winget-source (push) Skipped
deb / build-publish (push) Successful in 11m50s
apple / screenshots (push) Successful in 23m33s
rpm / build-publish (44, fedora-44, punktfunk-fedora44-rpm) (push) Successful in 20m25s
ci / rust (push) Successful in 33m32s
rpm / build-publish (43, bazzite, punktfunk-fedora-rpm) (push) Successful in 21m45s
docker / build-push (--build-arg FEDORA_VERSION=44, ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora44-rpm) (push) Successful in 37s
docker / build-push (., web/Dockerfile, punktfunk-web) (push) Successful in 32s
docker / build-push (ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora-rpm) (push) Successful in 36s
docker / build-push (ci, ci/rust-ci-noble.Dockerfile, punktfunk-rust-ci-noble) (push) Successful in 28s
docker / build-push (ci, ci/rust-ci.Dockerfile, punktfunk-rust-ci) (push) Successful in 6m18s
docker / build-push (docs-site, docs-site/Dockerfile, punktfunk-docs) (push) Successful in 34s
docker / build-push-arm64cross (push) Successful in 5m16s
docker / deploy-docs (push) Successful in 38s
bun-audit has been red since the advisory published, so it was already failing
before v0.20.0 was cut (same failure on 0323158a). High-severity DoS: unbounded
expansion length causing an OOM crash. All three paths are dev tooling —
orval→typedoc→minimatch, @storybook/react-vite→glob→minimatch, and
nitro-v2-vite-plugin→nitropack→archiver→archiver-utils→glob→minimatch — so
nothing shipped to a user was exposed, but the leg gates every lockfile change.
Done as an `overrides` entry, joining the eight already there for exactly this
purpose. `bun update brace-expansion` is NOT the fix and was reverted: for a
package that is only transitive it adds a spurious DIRECT dependency, and it
does not even resolve the advisory — it hoists 5.0.8 for the new direct dep and
leaves `minimatch/brace-expansion` pinned at the vulnerable 5.0.7.
The advisory's affected range is `<= 5.0.7` across ALL majors with 5.0.8 the
only patched version, so the two nested 2.1.2 copies had to move too — a major
bump for consumers declaring ^2.0.1/^2.0.2. Checked rather than assumed: 5.0.8
is dual ESM/CJS with a real `require` branch in its exports map (2.1.2 was
plain CJS), so those consumers still resolve. Proven by building: the nitro
build is itself one of the forced consumers.
Verified: `bun audit` reports no vulnerabilities, both nested entries are gone
from the lock, and the full CI web sequence is green —
`bun install --frozen-lockfile --ignore-scripts`, `bun run build`, `bun run lint`.
72 lines
2.3 KiB
JSON
72 lines
2.3 KiB
JSON
{
|
|
"name": "punktfunk-web",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "punktfunk management console \u2014 TanStack Start + React Query (orval) + @unom/ui + Paraglide i18n",
|
|
"scripts": {
|
|
"prepare": "bun run codegen",
|
|
"codegen": "orval --config orval.config.ts && paraglide-js compile --project ./project.inlang --outdir ./src/paraglide && node tools/check-i18n.mjs",
|
|
"predev": "orval --config orval.config.ts",
|
|
"dev": "vite dev --port 47992",
|
|
"prebuild": "orval --config orval.config.ts",
|
|
"build": "vite build",
|
|
"start": "bun run .output/server/index.mjs",
|
|
"api:gen": "orval --config orval.config.ts",
|
|
"lint": "tsc --noEmit",
|
|
"storybook": "storybook dev -p 6006",
|
|
"build-storybook": "storybook build",
|
|
"screenshots": "node tools/screenshots.mjs",
|
|
"screenshots:build": "bun run build-storybook && node tools/screenshots.mjs"
|
|
},
|
|
"dependencies": {
|
|
"@fontsource-variable/geist": "^5.3.0",
|
|
"@tanstack/react-query": "^5.101.4",
|
|
"@tanstack/react-router": "^1.170.18",
|
|
"@tanstack/react-start": "^1.168.32",
|
|
"@unom/style": "^0.4.4",
|
|
"@unom/ui": "^0.8.16",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"lucide-react": "^0.469.0",
|
|
"motion": "^12.42.2",
|
|
"radix-ui": "^1.6.4",
|
|
"react": "^19.2.8",
|
|
"react-dom": "^19.2.8",
|
|
"recharts": "^3.10.0",
|
|
"tailwind-merge": "^2.6.1",
|
|
"zod": "^4.4.3"
|
|
},
|
|
"devDependencies": {
|
|
"@biomejs/biome": "^2.5.5",
|
|
"@inlang/paraglide-js": "^2.22.0",
|
|
"@inlang/plugin-message-format": "^4.4.0",
|
|
"@storybook/react-vite": "^10.5.3",
|
|
"@tailwindcss/vite": "^4.3.3",
|
|
"@tanstack/nitro-v2-vite-plugin": "^1.155.0",
|
|
"@types/node": "^22.20.1",
|
|
"@types/react": "^19.2.17",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@vitejs/plugin-react": "^5.2.0",
|
|
"orval": "^8.22.0",
|
|
"playwright": "^1.61.1",
|
|
"storybook": "^10.5.3",
|
|
"tailwindcss": "^4.3.3",
|
|
"tw-animate-css": "^1.4.0",
|
|
"typescript": "^5.9.3",
|
|
"vite": "^7.3.6",
|
|
"vite-tsconfig-paths": "^5.1.4"
|
|
},
|
|
"overrides": {
|
|
"tar": "^7.5.21",
|
|
"dompurify": "^3.4.12",
|
|
"linkify-it": "^5.0.2",
|
|
"sharp": "^0.35.3",
|
|
"fast-uri": "^3.1.4",
|
|
"immutable": "^4.3.9",
|
|
"undici": "^7.28.0",
|
|
"postcss": "^8.5.10",
|
|
"js-yaml": "^4.3.0",
|
|
"brace-expansion": "^5.0.8"
|
|
}
|
|
}
|