Huang Xin
d6e59cedd7
Resolve transitive Dependabot alerts on the web lockfile. esbuild >= 0.28.1 (GHSA-gv7w-rqvm-qjhr #239, GHSA-g7r4-m6w7-qqqr #238): Deno-module RCE via NPM_CONFIG_REGISTRY and Windows dev-server arbitrary file read. Forced via a pnpm-workspace override (esbuild is a regular dep of vite, so the override applies cleanly); bounded to <0.29 to stay on the verified line. vite 7.3.3 declares ^0.27.0, but the 0.28 JS API is unchanged for vite's usage -- verified by the full test run and web build. @vitest/browser >= 4.1.8 (GHSA-g8mr-85jm-7xhm #240): Browser Mode CDP bridge bypasses allowWrite/allowExec, enabling config overwrite -> RCE. Bumped the vitest devDep family (vitest, @vitest/browser-*, coverage-v8) from ^4.0.18 to ^4.1.8; resolves to 4.1.9. Verified: pnpm test (5685 passed), pnpm lint, pnpm build-web (exit 0). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
54 lines
1.2 KiB
YAML
54 lines
1.2 KiB
YAML
packages:
|
|
- apps/*
|
|
- apps/readest-app/workers/send-email
|
|
- apps/readest-app/extensions/*
|
|
- packages/foliate-js
|
|
|
|
allowBuilds:
|
|
core-js: true
|
|
edgedriver: true
|
|
esbuild: true
|
|
geckodriver: true
|
|
protobufjs: true
|
|
sharp: true
|
|
workerd: true
|
|
|
|
onlyBuiltDependencies:
|
|
- sharp
|
|
|
|
patchedDependencies:
|
|
'@ai-sdk/provider-utils@3.0.25': patches/@ai-sdk__provider-utils@3.0.25.patch
|
|
'@ai-sdk/provider-utils@4.0.27': patches/@ai-sdk__provider-utils@4.0.27.patch
|
|
mdast-util-gfm-autolink-literal@2.0.1: patches/mdast-util-gfm-autolink-literal@2.0.1.patch
|
|
|
|
overrides:
|
|
glob: '>=11.1.0'
|
|
jws: '>=4.0.1'
|
|
vite: '>=7.3.2 <8'
|
|
esbuild: '>=0.28.1 <0.29'
|
|
srvx: '>=0.11.13'
|
|
rollup: '>=4.59.0'
|
|
undici: '>=7.24.0'
|
|
flatted: '>=3.4.2'
|
|
body-parser: '>=2.2.1'
|
|
dompurify: '>=3.4.0'
|
|
i18next-http-backend: '>=3.0.5'
|
|
picomatch: '>=4.0.4'
|
|
path-to-regexp: '>=8.4.0'
|
|
protobufjs: '>=7.5.5'
|
|
serialize-javascript: 7.0.5
|
|
fast-xml-parser: '>=5.7.0'
|
|
lodash: '>=4.18.0'
|
|
lodash-es: '>=4.18.0'
|
|
postcss: 8.5.14
|
|
basic-ftp: '>=5.3.0'
|
|
qs: '>=6.15.2'
|
|
shell-quote: '>=1.8.4'
|
|
'@babel/runtime': '>=7.26.10'
|
|
'@babel/helpers': '>=7.26.10'
|
|
mdast-util-gfm-autolink-literal: 2.0.1
|
|
uuid: '>=14.0.0'
|
|
ws: 8.20.1
|
|
'@emnapi/core': 1.8.1
|
|
'@emnapi/runtime': 1.8.1
|