mirror of
https://github.com/bretzel-app/crumbs.git
synced 2026-10-12 20:06:57 +02:00
Claude
0cc64fd8f3
Bumps runtime- and build-reachable dependencies to patched versions and adds pnpm overrides for transitive advisories. Clears all high/critical findings (1 critical + 12 high -> 0); remaining moderates/lows are dev-tooling only and stripped from the production image by pnpm prune. Direct bumps: - drizzle-orm ^0.44.7 -> ^0.45.2 (SQL injection via unescaped identifiers, GHSA-gpj5-g38j-94v9) - @sveltejs/kit ^2.53.4 -> ^2.63.1 (adapter-node BODY_SIZE_LIMIT bypass, GHSA-2crg-3p73-43xp) - vite ^7.3.1 -> ^7.3.5, vitest/@vitest/coverage-v8 ^3.2.4 -> ^3.2.6 (dev-server file read; vitest UI RCE) Transitive overrides: - devalue >=5.8.1 (DoS via sparse-array deserialization, GHSA-77vg-94rm-hx3p) - path-to-regexp@8 >=8.4.0 (ReDoS via express/router under @modelcontextprotocol/sdk, GHSA-j3q9-mxjg-w52f) - fast-uri >=3.1.2 (path traversal / host confusion via ajv, GHSA-q3j6-qgpj-74h6) Verified: pnpm check (0 errors), 264 unit tests pass, production build succeeds.
113 lines
3.5 KiB
JSON
113 lines
3.5 KiB
JSON
{
|
|
"name": "crumbs",
|
|
"private": true,
|
|
"version": "0.28.3",
|
|
"type": "module",
|
|
"packageManager": "pnpm@9.15.9",
|
|
"license": "MIT",
|
|
"author": "Bretzel (https://bretzel.app)",
|
|
"homepage": "https://crumbs.bretzel.app",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/bretzel-app/crumbs.git"
|
|
},
|
|
"scripts": {
|
|
"dev": "vite dev",
|
|
"build": "npx tsx scripts/generate-openapi.ts && vite build",
|
|
"openapi": "npx tsx scripts/generate-openapi.ts",
|
|
"preview": "vite preview",
|
|
"prepare": "svelte-kit sync || echo ''",
|
|
"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
|
|
"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
|
|
"test:unit": "vitest run",
|
|
"test:unit:watch": "vitest",
|
|
"test:unit:coverage": "vitest run --coverage",
|
|
"test:e2e": "playwright test",
|
|
"test:e2e:coverage": "VITE_COVERAGE=true pnpm build && pnpm test:e2e && nyc report",
|
|
"coverage:merge-e2e": "nyc merge coverage/e2e/raw coverage/e2e/merged.json && nyc report",
|
|
"test": "pnpm test:unit && pnpm test:e2e",
|
|
"db:push": "drizzle-kit push",
|
|
"db:generate": "drizzle-kit generate",
|
|
"db:migrate": "drizzle-kit migrate",
|
|
"db:studio": "drizzle-kit studio",
|
|
"lint": "eslint .",
|
|
"docs:api": "tsx scripts/generate-api-docs.ts"
|
|
},
|
|
"dependencies": {
|
|
"@modelcontextprotocol/sdk": "^1.27.1",
|
|
"@sveltejs/adapter-node": "^5.5.4",
|
|
"@tiptap/core": "^3.20.1",
|
|
"@tiptap/extension-link": "^3.20.1",
|
|
"@tiptap/extension-placeholder": "^3.20.1",
|
|
"@tiptap/extension-table": "^3.20.1",
|
|
"@tiptap/extension-table-cell": "^3.20.1",
|
|
"@tiptap/extension-table-header": "^3.20.1",
|
|
"@tiptap/extension-table-row": "^3.20.1",
|
|
"@tiptap/extension-task-item": "^3.20.1",
|
|
"@tiptap/extension-task-list": "^3.20.1",
|
|
"@tiptap/extension-text-align": "^3.20.1",
|
|
"@tiptap/extension-underline": "^3.20.1",
|
|
"@tiptap/pm": "^3.20.1",
|
|
"@tiptap/starter-kit": "^3.20.1",
|
|
"arctic": "^3.7.0",
|
|
"argon2": "^0.43.1",
|
|
"better-sqlite3": "^11.10.0",
|
|
"drizzle-orm": "^0.45.2",
|
|
"idb": "^8.0.3",
|
|
"lucide-svelte": "^0.577.0",
|
|
"markdown-it": "^14.1.1",
|
|
"nanoid": "^5.1.7",
|
|
"node-diff3": "^3.2.0",
|
|
"nodemailer": "^8.0.2",
|
|
"svelte-dnd-action": "^0.9.69",
|
|
"tiptap-markdown": "^0.9.0",
|
|
"uuid": "^11.1.0",
|
|
"zod": "^4.3.6",
|
|
"zxcvbn": "^4.4.2"
|
|
},
|
|
"devDependencies": {
|
|
"@playwright/test": "^1.58.2",
|
|
"@sveltejs/kit": "^2.63.1",
|
|
"@sveltejs/vite-plugin-svelte": "^6.2.4",
|
|
"@tailwindcss/typography": "^0.5.19",
|
|
"@tailwindcss/vite": "^4.2.1",
|
|
"@types/better-sqlite3": "^7.6.13",
|
|
"@types/markdown-it": "^14.1.2",
|
|
"@types/nodemailer": "^7.0.11",
|
|
"@types/uuid": "^10.0.0",
|
|
"@types/zxcvbn": "^4.4.5",
|
|
"@vite-pwa/sveltekit": "^1.1.0",
|
|
"@vitest/coverage-v8": "^3.2.6",
|
|
"drizzle-kit": "^0.31.9",
|
|
"jsdom": "^29.0.1",
|
|
"nyc": "^18.0.0",
|
|
"svelte": "^5.53.7",
|
|
"svelte-check": "^4.4.4",
|
|
"tailwindcss": "^4.2.1",
|
|
"tsx": "^4.21.0",
|
|
"typescript": "^5.9.3",
|
|
"vite": "^7.3.5",
|
|
"vite-plugin-istanbul": "^7.2.1",
|
|
"vite-plugin-pwa": "^1.2.0",
|
|
"vitest": "^3.2.6",
|
|
"workbox-window": "^7.4.0",
|
|
"yaml": "^2.8.2"
|
|
},
|
|
"pnpm": {
|
|
"onlyBuiltDependencies": [
|
|
"argon2",
|
|
"better-sqlite3",
|
|
"esbuild"
|
|
],
|
|
"overrides": {
|
|
"serialize-javascript": ">=7.0.3",
|
|
"esbuild@<0.25.0": "0.25.12",
|
|
"cookie": ">=0.7.0",
|
|
"hono": ">=4.12.7",
|
|
"devalue": ">=5.8.1",
|
|
"path-to-regexp@8": ">=8.4.0",
|
|
"fast-uri": ">=3.1.2"
|
|
}
|
|
}
|
|
}
|