Paul Nothaft
37bf894412
Closes the open Trivy code-scanning alerts for app-side dependencies. The npm-bundled CVEs in /usr/local/lib/node_modules/npm (picomatch, brace-expansion, ip-address inside the Node image itself) are deferred to a separate Node-base-image PR — they're build-environment-side and need their own compatibility testing. | Package | From | To | CVEs cleared | |---|---|---|---| | axios (backend + frontend) | 1.14.0 | 1.15.2 | CVE-2026-42264 (HIGH), CVE-2026-42043 (HIGH), CVE-2026-42035 (HIGH), CVE-2026-42033 (HIGH), CVE-2026-42044, CVE-2026-42042, CVE-2026-42041, CVE-2026-42040, CVE-2026-42039, CVE-2026-42038, CVE-2026-42037, CVE-2026-42036, CVE-2026-42034, CVE-2026-40175, CVE-2025-62718 | | nodemailer (backend) | ^7.0.13 | ^8.0.5 | GHSA-vvjj-xcjg-gr5g, GHSA-c7w3-x93f-qmm8 | | i18next-http-backend (frontend) | ^3.0.2 | ^3.0.5 | CVE-2026-41691 | | uuid (backend) | ^11.1.0 | ^11.1.1 | CVE-2026-41907 | | postcss (frontend, devDep) | ^8.4.21 | ^8.5.10 | CVE-2026-41305 | For transitives whose direct parents haven't released a version that picks up the patched range, pinned via npm overrides: | Package | Min | CVE | |---|---|---| | follow-redirects (backend + frontend) | >=1.16.0 | GHSA-r4q5-vmmm-2653 | | fast-xml-parser (backend) | >=5.7.0 | CVE-2026-41650 | | @tootallnate/once (backend) | >=3.0.1 | CVE-2026-3449 | | ip-address (backend) | >=10.1.1 | CVE-2026-42338 | PR #268 originally pinned axios to 1.14.0 to avoid a supply-chain attack on a specific compromised version range. The 1.15.x series are post-incident upstream releases — clean. Confirmed with the maintainer before bumping. * `npx tsc --noEmit` (frontend) — clean * `npx vite build` (frontend) — clean (~4s, existing bundle-size warning, not new) * Backend module-load smoke test — all critical modules load (`auth`, `adminAuth` middleware, `emailProcessor`, `recaptcha`, `storage`) with the new axios + nodemailer * Lockfile re-verification — every targeted CVE now resolves to the patched version range * npm-bundled CVEs inside `/usr/local/lib/node_modules/npm/` — picomatch CVE-2026-33671 (HIGH), CVE-2026-33672, brace-expansion CVE-2026-33750, ip-address (npm-internal) CVE-2026-42338. These live in the Node base image and require a Node base image bump with its own compatibility testing — separate PR. Targeting `beta` so the bumps go through the normal release-please flow before promotion to `main`.
86 lines
2.6 KiB
JSON
86 lines
2.6 KiB
JSON
{
|
|
"name": "picpeak-frontend",
|
|
"private": true,
|
|
"version": "3.43.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "node ./scripts/build.js",
|
|
"build:check": "tsc -b && node ./scripts/build.js",
|
|
"lint": "eslint .",
|
|
"preview": "vite preview",
|
|
"test": "vitest run src/components/admin/__tests__/ThemeCustomizerEnhanced.test.tsx"
|
|
},
|
|
"dependencies": {
|
|
"@tanstack/react-query": "^5.0.0",
|
|
"@tiptap/extension-character-count": "^2.26.1",
|
|
"@tiptap/extension-code-block-lowlight": "^2.26.1",
|
|
"@tiptap/extension-hard-break": "^2.26.1",
|
|
"@tiptap/extension-link": "^2.25.0",
|
|
"@tiptap/extension-placeholder": "^2.26.1",
|
|
"@tiptap/extension-text-align": "^2.26.1",
|
|
"@tiptap/react": "^2.25.0",
|
|
"@tiptap/starter-kit": "^2.25.0",
|
|
"@types/dompurify": "^3.0.5",
|
|
"@types/lodash": "^4.17.20",
|
|
"@types/react-google-recaptcha": "^2.1.9",
|
|
"axios": "1.15.2",
|
|
"clsx": "^2.0.0",
|
|
"date-fns": "4.1.0",
|
|
"dompurify": "^3.2.6",
|
|
"framer-motion": "^12.33.0",
|
|
"i18next": "^25.3.1",
|
|
"i18next-browser-languagedetector": "^8.2.0",
|
|
"i18next-http-backend": "^3.0.5",
|
|
"justified-layout": "^4.1.0",
|
|
"linkifyjs": "^4.3.2",
|
|
"lodash": "^4.17.21",
|
|
"lowlight": "^2.9.0",
|
|
"lucide-react": "0.525.0",
|
|
"photoswipe": "^5.4.4",
|
|
"react": "^18.3.1",
|
|
"react-countdown": "^2.3.5",
|
|
"react-dom": "^18.3.1",
|
|
"react-google-recaptcha": "^3.1.0",
|
|
"react-i18next": "^15.6.0",
|
|
"react-image-gallery": "^1.2.11",
|
|
"react-intersection-observer": "^9.4.3",
|
|
"react-photo-album": "^3.4.0",
|
|
"react-router-dom": "^6.8.0",
|
|
"react-toastify": "11.0.5",
|
|
"swiper": "^12.1.0",
|
|
"tailwind-merge": "^3.3.1",
|
|
"yet-another-react-lightbox": "^3.28.0"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^9.29.0",
|
|
"@testing-library/jest-dom": "^6.6.3",
|
|
"@testing-library/react": "^16.1.0",
|
|
"@testing-library/user-event": "^14.6.1",
|
|
"@types/react": "^18.3.12",
|
|
"@types/react-dom": "^18.3.1",
|
|
"@vitejs/plugin-react": "^4.5.3",
|
|
"autoprefixer": "^10.4.13",
|
|
"cross-env": "^10.1.0",
|
|
"eslint": "^9.29.0",
|
|
"eslint-plugin-react-hooks": "^5.2.0",
|
|
"eslint-plugin-react-refresh": "^0.4.20",
|
|
"globals": "^16.2.0",
|
|
"jsdom": "^25.0.1",
|
|
"postcss": "^8.5.10",
|
|
"tailwindcss": "^3.3.0",
|
|
"typescript": "~5.8.3",
|
|
"typescript-eslint": "^8.34.1",
|
|
"vite": "^7.1.12",
|
|
"vitest": "^3.2.4"
|
|
},
|
|
"optionalDependencies": {
|
|
"@rollup/rollup-linux-x64-gnu": "^4.45.1"
|
|
},
|
|
"overrides": {
|
|
"glob": "^11.1.0",
|
|
"js-yaml": "^4.1.1",
|
|
"follow-redirects": ">=1.16.0"
|
|
}
|
|
}
|