Upgrade dependencies and add security audit configuration (#349)
This commit is contained in:
Ben Senescu
GitHub
parent
a3e7bffd5b
commit
7bcd8497a0
@ -8,7 +8,7 @@ WORKDIR /app
|
||||
|
||||
RUN corepack enable && corepack prepare pnpm@10.30.1 --activate
|
||||
|
||||
COPY package.json pnpm-lock.yaml ./
|
||||
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
|
||||
RUN pnpm install --frozen-lockfile
|
||||
|
||||
COPY . .
|
||||
|
||||
40
package.json
40
package.json
@ -72,29 +72,29 @@
|
||||
"@every-app/sdk": "^0.1.14",
|
||||
"@modelcontextprotocol/sdk": "1.29.0",
|
||||
"@openrouter/ai-sdk-provider": "^2.9.0",
|
||||
"@tanstack/query-core": "^5.90.9",
|
||||
"@tanstack/react-form": "^1.25.0",
|
||||
"@tanstack/react-query": "^5.90.9",
|
||||
"@tanstack/react-router": "^1.168.10",
|
||||
"@tanstack/react-router-devtools": "^1.166.11",
|
||||
"@tanstack/react-start": "^1.167.16",
|
||||
"@tanstack/query-core": "^5.101.2",
|
||||
"@tanstack/react-form": "^1.33.0",
|
||||
"@tanstack/react-query": "^5.101.2",
|
||||
"@tanstack/react-router": "^1.170.16",
|
||||
"@tanstack/react-router-devtools": "^1.167.0",
|
||||
"@tanstack/react-start": "^1.168.26",
|
||||
"@tanstack/react-table": "^8.21.3",
|
||||
"agents": "0.17.3",
|
||||
"ai": "^6.0.199",
|
||||
"autumn-js": "^1.1.7",
|
||||
"better-auth": "^1.5.5",
|
||||
"autumn-js": "^1.2.33",
|
||||
"better-auth": "^1.6.22",
|
||||
"cheerio": "^1.2.0",
|
||||
"cloudflare": "^5.2.0",
|
||||
"daisyui": "^5.5.5",
|
||||
"dataforseo-client": "^2.0.19",
|
||||
"drizzle-orm": "^0.44.4",
|
||||
"drizzle-orm": "^0.45.2",
|
||||
"fast-xml-parser": "^5.4.1",
|
||||
"jose": "^6.0.12",
|
||||
"lucide-react": "^0.542.0",
|
||||
"papaparse": "^5.5.3",
|
||||
"postgres": "^3.4.9",
|
||||
"posthog-js": "^1.363.5",
|
||||
"posthog-node": "^5.28.5",
|
||||
"posthog-js": "^1.395.0",
|
||||
"posthog-node": "^5.38.6",
|
||||
"react": "^19.0.0",
|
||||
"react-dom": "^19.0.0",
|
||||
"react-markdown": "^10.1.0",
|
||||
@ -108,29 +108,29 @@
|
||||
"zod": "^4.1.12"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@cloudflare/vite-plugin": "^1.40.2",
|
||||
"@cloudflare/vite-plugin": "^1.42.3",
|
||||
"@cloudflare/workers-types": "^4.20260611.1",
|
||||
"@libsql/client": "^0.15.15",
|
||||
"@playwright/test": "^1.59.1",
|
||||
"@tailwindcss/vite": "^4.1.11",
|
||||
"@tanstack/devtools-vite": "^0.6.0",
|
||||
"@tanstack/react-devtools": "^0.10.1",
|
||||
"@tanstack/devtools-vite": "^0.6.1",
|
||||
"@tanstack/react-devtools": "^0.10.8",
|
||||
"@types/node": "^22.18.13",
|
||||
"@types/papaparse": "^5.5.2",
|
||||
"@types/react": "^19.0.8",
|
||||
"@types/react-dom": "^19.0.3",
|
||||
"@vitejs/plugin-react": "^4.6.0",
|
||||
"drizzle-kit": "^0.31.4",
|
||||
"knip": "^5.66.4",
|
||||
"drizzle-kit": "^0.31.10",
|
||||
"knip": "^5.88.1",
|
||||
"oxlint": "^1.50.0",
|
||||
"oxlint-tsgolint": "^0.15.0",
|
||||
"portless": "^0.5.2",
|
||||
"prettier": "^3.6.2",
|
||||
"tsx": "^4.21.0",
|
||||
"tsx": "^4.22.4",
|
||||
"typescript": "^5.9.3",
|
||||
"vite": "^7.1.2",
|
||||
"vite": "^7.3.6",
|
||||
"vite-tsconfig-paths": "^5.1.4",
|
||||
"vitest": "^3.2.4",
|
||||
"wrangler": "^4.100.0"
|
||||
"vitest": "^3.2.6",
|
||||
"wrangler": "^4.105.0"
|
||||
}
|
||||
}
|
||||
|
||||
2606
pnpm-lock.yaml
generated
2606
pnpm-lock.yaml
generated
File diff suppressed because it is too large
Load Diff
@ -1,3 +1,44 @@
|
||||
minimumReleaseAge: 11520
|
||||
minimumReleaseAgeExclude:
|
||||
- "@every-app/*"
|
||||
|
||||
# Advisories triaged as not applicable. Re-review when the parent updates.
|
||||
# - GHSA-67mh-4wv8-2f99: esbuild <=0.24.2 dev-server CORS. Only reachable via
|
||||
# drizzle-kit's bundled @esbuild-kit loader (dev-time CLI); drizzle-kit never
|
||||
# starts esbuild's serve mode, so the vulnerable path cannot execute.
|
||||
auditConfig:
|
||||
ignoreGhsas:
|
||||
- GHSA-67mh-4wv8-2f99
|
||||
|
||||
# Security floors (added 2026-07) for transitive deps with published advisories
|
||||
# where the parent hasn't shipped a bump yet. Each range sits inside what the
|
||||
# parent already declares, so these are lockfile nudges, not forks. Ranges are
|
||||
# major-bounded (^) on purpose: an override REPLACES the parent's range, so an
|
||||
# open-ended >= floor would let a future major (e.g. hono 5) get forced onto a
|
||||
# parent that only supports the current one.
|
||||
#
|
||||
# To prune once a parent catches up: delete the line, run `pnpm install`, and
|
||||
# keep it deleted if `pnpm audit` stays clean.
|
||||
overrides:
|
||||
# GHSA-4x5r-pxfx-6jf8 — waiting on @tanstack/devtools-vite
|
||||
"@babel/core": "^7.29.6"
|
||||
# GHSA-737v-mqg7-c878 — waiting on better-auth
|
||||
defu: "^6.1.5"
|
||||
# 13 advisories incl. GHSA-x4vx-rjvf-j5p4, GHSA-gvmj-g25r-r7wr — waiting on posthog-js
|
||||
dompurify: "^3.4.11"
|
||||
# GHSA-hmw2-7cc7-3qxx — waiting on cloudflare
|
||||
form-data: "^4.0.6"
|
||||
# 9 advisories incl. GHSA-88fw-hqm2-52qc (CORS) — waiting on @modelcontextprotocol/sdk
|
||||
hono: "^4.12.25"
|
||||
# GHSA-v6wh-96g9-6wx3 — waiting on @tanstack/devtools-vite
|
||||
launch-editor: "^2.14.1"
|
||||
# GHSA-qx2v-qp2m-jg93 — waiting on vite
|
||||
postcss: "^8.5.10"
|
||||
# GHSA-q8mj-m7cp-5q26 — waiting on @modelcontextprotocol/sdk
|
||||
qs: "^6.15.2"
|
||||
# GHSA-w7jw-789q-3m8p — waiting on @tanstack/devtools-vite
|
||||
shell-quote: "^1.8.4"
|
||||
# GHSA-v3rj-xjv7-4jmq — waiting on knip
|
||||
smol-toml: "^1.6.1"
|
||||
# 7 advisories incl. GHSA-vmh5-mc38-953g — waiting on cheerio + miniflare
|
||||
undici: "^7.28.0"
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user