forked from mirror/crumbs-original
Frederic CabassutandClaude Sonnet 5
d4ed358ba3
Bumps deps to clear all 69 pnpm audit findings (nodemailer 8->9 for the raw-option SSRF/arbitrary-file-read CVE; svelte, hono/express/qs chain, linkify-it, and the rest resolved within their existing semver ranges via a lockfile refresh). Caps the previously-unbounded cookie override at <1 so it can't silently jump to the API-incompatible 2.x line again. Hardens the MCP upload_image tool, which fetched an arbitrary caller- supplied URL and stored whatever content-type came back with no checks: - validates every resolved DNS record (not just the first) against private/loopback/link-local/multicast ranges, then pins the actual connection to the validated address so a second, unvalidated lookup at connect time can't be used for DNS-rebinding SSRF - rejects non-image content-types and enforces the same 10MB cap as the manual upload endpoint - adds X-Content-Type-Options: nosniff to both attachment-serving routes as defense in depth Also validates the admin role field server-side (previously trusted the client-supplied string), and fixes two incidental regressions surfaced by the dependency bump: StarterKit now bundles its own Link/Underline extensions (disabled to avoid duplicate registration), and FormattingToolbar could call methods on an already-destroyed editor instance during the markdown-mode toggle race. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
113 lines
3.5 KiB
JSON
113 lines
3.5 KiB
JSON
{
|
|
"name": "crumbs",
|
|
"private": true,
|
|
"version": "0.31.0",
|
|
"type": "module",
|
|
"packageManager": "pnpm@9.15.9",
|
|
"license": "MIT",
|
|
"author": "Bretzel (https://bretzel.app)",
|
|
"homepage": "https://crumbs.bretzel.app",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/bretzel-app/crumbs.git"
|
|
},
|
|
"scripts": {
|
|
"dev": "vite dev",
|
|
"build": "npx tsx scripts/generate-openapi.ts && vite build",
|
|
"openapi": "npx tsx scripts/generate-openapi.ts",
|
|
"preview": "vite preview",
|
|
"prepare": "svelte-kit sync || echo ''",
|
|
"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
|
|
"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
|
|
"test:unit": "vitest run",
|
|
"test:unit:watch": "vitest",
|
|
"test:unit:coverage": "vitest run --coverage",
|
|
"test:e2e": "playwright test",
|
|
"test:e2e:coverage": "VITE_COVERAGE=true pnpm build && pnpm test:e2e && nyc report",
|
|
"coverage:merge-e2e": "nyc merge coverage/e2e/raw coverage/e2e/merged.json && nyc report",
|
|
"test": "pnpm test:unit && pnpm test:e2e",
|
|
"db:push": "drizzle-kit push",
|
|
"db:generate": "drizzle-kit generate",
|
|
"db:migrate": "drizzle-kit migrate",
|
|
"db:studio": "drizzle-kit studio",
|
|
"lint": "eslint .",
|
|
"docs:api": "tsx scripts/generate-api-docs.ts"
|
|
},
|
|
"dependencies": {
|
|
"@modelcontextprotocol/sdk": "^1.30.0",
|
|
"@sveltejs/adapter-node": "^5.5.7",
|
|
"@tiptap/core": "^3.29.2",
|
|
"@tiptap/extension-link": "^3.29.2",
|
|
"@tiptap/extension-placeholder": "^3.29.2",
|
|
"@tiptap/extension-table": "^3.29.2",
|
|
"@tiptap/extension-table-cell": "^3.29.2",
|
|
"@tiptap/extension-table-header": "^3.29.2",
|
|
"@tiptap/extension-table-row": "^3.29.2",
|
|
"@tiptap/extension-task-item": "^3.29.2",
|
|
"@tiptap/extension-task-list": "^3.29.2",
|
|
"@tiptap/extension-text-align": "^3.29.2",
|
|
"@tiptap/extension-underline": "^3.29.2",
|
|
"@tiptap/pm": "^3.29.2",
|
|
"@tiptap/starter-kit": "^3.29.2",
|
|
"arctic": "^3.7.0",
|
|
"argon2": "^0.43.1",
|
|
"better-sqlite3": "^11.10.0",
|
|
"drizzle-orm": "^0.45.2",
|
|
"idb": "^8.0.3",
|
|
"lucide-svelte": "^0.577.0",
|
|
"markdown-it": "^14.3.0",
|
|
"nanoid": "^5.1.16",
|
|
"node-diff3": "^3.2.1",
|
|
"nodemailer": "^9.0.3",
|
|
"svelte-dnd-action": "^0.9.77",
|
|
"tiptap-markdown": "^0.9.0",
|
|
"uuid": "^11.1.1",
|
|
"zod": "^4.4.3",
|
|
"zxcvbn": "^4.4.2"
|
|
},
|
|
"devDependencies": {
|
|
"@playwright/test": "^1.62.1",
|
|
"@sveltejs/kit": "^2.70.2",
|
|
"@sveltejs/vite-plugin-svelte": "^6.2.4",
|
|
"@tailwindcss/typography": "^0.5.20",
|
|
"@tailwindcss/vite": "^4.3.3",
|
|
"@types/better-sqlite3": "^7.6.13",
|
|
"@types/markdown-it": "^14.1.2",
|
|
"@types/nodemailer": "^8.0.1",
|
|
"@types/uuid": "^10.0.0",
|
|
"@types/zxcvbn": "^4.4.5",
|
|
"@vite-pwa/sveltekit": "^1.1.0",
|
|
"@vitest/coverage-v8": "^3.2.7",
|
|
"drizzle-kit": "^0.31.10",
|
|
"jsdom": "^29.1.1",
|
|
"nyc": "^18.0.0",
|
|
"svelte": "^5.56.8",
|
|
"svelte-check": "^4.7.4",
|
|
"tailwindcss": "^4.3.3",
|
|
"tsx": "^4.23.5",
|
|
"typescript": "^5.9.3",
|
|
"vite": "^7.3.6",
|
|
"vite-plugin-istanbul": "^7.2.1",
|
|
"vite-plugin-pwa": "^1.3.0",
|
|
"vitest": "^3.2.7",
|
|
"workbox-window": "^7.4.1",
|
|
"yaml": "^2.9.0"
|
|
},
|
|
"pnpm": {
|
|
"onlyBuiltDependencies": [
|
|
"argon2",
|
|
"better-sqlite3",
|
|
"esbuild"
|
|
],
|
|
"overrides": {
|
|
"serialize-javascript": ">=7.0.3",
|
|
"esbuild@<0.25.0": "0.25.12",
|
|
"cookie": ">=0.7.0 <1",
|
|
"hono": ">=4.12.7",
|
|
"devalue": ">=5.8.1",
|
|
"path-to-regexp@8": ">=8.4.0",
|
|
"fast-uri": ">=3.1.2"
|
|
}
|
|
}
|
|
}
|