Paul Nothaft
7546f104a3
Single PR closing every open code-scanning alert at https://github.com/PicPeak/picpeak/security/code-scanning. Both repos go from 27 open alerts → 0 across direct deps, transitive deps, and build- time bundled deps. ## Backend (`backend/package.json` + overrides) Direct dep bumps: - axios 1.15.2 → 1.16.0 (closes 9 alerts: 7 high + 1 med + 1 low) - nodemailer 8.0.10 → ^9.0.1 (closes 1 high — SSRF + file-read via raw option) - multer 2.1.1 → 2.2.0 (closes 2 alerts: 1 high + 1 med) - form-data 4.0.5 → 4.0.6 (closes 1 high) - tar ≥7.5.13 → ≥7.5.16 (closes 1 med) - postcss 8.5.6 → 8.5.10 (closes 1 med) - i18next-http-backend 3.0.2 → 3.0.5 (closes 1 med — backend lagged frontend) - js-yaml 4.1.1 → ^4.2.0 (closes 1 med) - joi 17.13.3 → ^17.13.4 (closes 1 med) Overrides updated to match deps (npm rejected the install otherwise) + nodemailer ^9.0.1 added as override so imapflow + mailparser transitive bundling of older nodemailer is also fixed. Babel devDep auto-bumped via `npm audit fix` (low-severity arbitrary file read). Backend npm audit: 0 vulnerabilities. ## Frontend (`frontend/package.json`) Direct dep bumps: - axios 1.15.2 → 1.16.0 - postcss 8.5.6 → 8.5.10 - i18next-http-backend 3.0.5 → 3.0.5 (already current — kept for parity) `npm audit fix` swept up 12 transitive issues at the same time: - vitest (1 critical — file read on UI server) - vite (2 high — fs.deny bypass, NTLM hash via launch-editor) - ws (2 high — uninitialized memory + DoS) - dompurify (8 mod — multiple IN_PLACE / hook-pollution XSS vectors) - react-router-dom + react-router (1 mod transitive) - esbuild (1 mod — dev server file read) - @babel/core (1 low) Frontend npm audit: 0 vulnerabilities. ## Frontend Dockerfile - Build stage: `node:20-alpine` → `node:22-alpine` Closes the npm-bundled CVE class (picomatch, ip-address, brace-expansion, @sigstore/core, tar) that came from Node 20's older bundled npm. Matches the backend Dockerfile base. The nginx serving stage stays at `nginx:1.28-alpine` — that tag is rolling, so the next build picks up the fixed 1.28.3-r4 layer that closes the 4 nginx CVEs. ## Verification - Backend: `npm audit` → 0 vulnerabilities ✅ - Frontend: `npm audit` → 0 vulnerabilities ✅ - Backend Jest (workflow engine, rounding, WhatsApp): 47/47 pass ✅ - Frontend Vitest: 84/84 pass ✅ - `frontend npm run build`: succeeds ✅ - nodemailer 9 sanity check: our usage is `createTransport({host,port,secure,auth})` + `sendMail({from,to,subject,html,text})` — we don't touch the `raw` option that 9.x tightened, so the major bump is API-compatible.
101 lines
3.1 KiB
JSON
101 lines
3.1 KiB
JSON
{
|
|
"name": "picpeak-frontend",
|
|
"private": true,
|
|
"version": "3.74.0-beta.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "node ./scripts/build.js",
|
|
"build:check": "tsc -b && node ./scripts/build.js",
|
|
"lint": "eslint .",
|
|
"preview": "vite preview",
|
|
"test": "vitest run",
|
|
"i18n:extract": "i18next-cli extract",
|
|
"i18n:status": "i18next-cli status",
|
|
"i18n:ci": "i18next-cli extract --ci --dry-run"
|
|
},
|
|
"dependencies": {
|
|
"@dagrejs/dagre": "^3.0.0",
|
|
"@fullcalendar/core": "^6.1.20",
|
|
"@fullcalendar/daygrid": "^6.1.20",
|
|
"@fullcalendar/interaction": "^6.1.20",
|
|
"@fullcalendar/react": "^6.1.20",
|
|
"@fullcalendar/timegrid": "^6.1.20",
|
|
"@tanstack/react-query": "^5.0.0",
|
|
"@tiptap/extension-character-count": "^2.26.1",
|
|
"@tiptap/extension-code-block-lowlight": "^2.26.1",
|
|
"@tiptap/extension-hard-break": "^2.26.1",
|
|
"@tiptap/extension-link": "^2.25.0",
|
|
"@tiptap/extension-placeholder": "^2.26.1",
|
|
"@tiptap/extension-text-align": "^2.26.1",
|
|
"@tiptap/react": "^2.25.0",
|
|
"@tiptap/starter-kit": "^2.25.0",
|
|
"@types/dompurify": "^3.0.5",
|
|
"@types/lodash": "^4.17.20",
|
|
"@types/react-google-recaptcha": "^2.1.9",
|
|
"@xyflow/react": "^12.11.1",
|
|
"axios": "^1.16.0",
|
|
"clsx": "^2.0.0",
|
|
"date-fns": "4.1.0",
|
|
"dompurify": "^3.2.6",
|
|
"framer-motion": "^12.33.0",
|
|
"i18next": "^25.3.1",
|
|
"i18next-browser-languagedetector": "^8.2.0",
|
|
"i18next-http-backend": "^3.0.5",
|
|
"justified-layout": "^4.1.0",
|
|
"linkifyjs": "^4.3.2",
|
|
"lodash": "^4.17.21",
|
|
"lowlight": "^2.9.0",
|
|
"lucide-react": "0.525.0",
|
|
"marked": "^15.0.12",
|
|
"photoswipe": "^5.4.4",
|
|
"react": "^18.3.1",
|
|
"react-countdown": "^2.3.5",
|
|
"react-dom": "^18.3.1",
|
|
"react-google-recaptcha": "^3.1.0",
|
|
"react-i18next": "^15.6.0",
|
|
"react-image-gallery": "^1.2.11",
|
|
"react-intersection-observer": "^9.4.3",
|
|
"react-photo-album": "^3.4.0",
|
|
"react-router-dom": "^6.8.0",
|
|
"react-toastify": "11.0.5",
|
|
"signature_pad": "^5.1.3",
|
|
"swiper": "^12.1.0",
|
|
"tailwind-merge": "^3.3.1",
|
|
"yet-another-react-lightbox": "^3.28.0"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^9.29.0",
|
|
"@testing-library/jest-dom": "^6.6.3",
|
|
"@testing-library/react": "^16.1.0",
|
|
"@testing-library/user-event": "^14.6.1",
|
|
"@types/node": "^25.6.2",
|
|
"@types/react": "^18.3.12",
|
|
"@types/react-dom": "^18.3.1",
|
|
"@vitejs/plugin-react": "^4.5.3",
|
|
"autoprefixer": "^10.4.13",
|
|
"cross-env": "^10.1.0",
|
|
"eslint": "^9.29.0",
|
|
"eslint-plugin-react-hooks": "^5.2.0",
|
|
"eslint-plugin-react-refresh": "^0.4.20",
|
|
"globals": "^16.2.0",
|
|
"i18next-cli": "^1.56.11",
|
|
"jsdom": "^25.0.1",
|
|
"memfs": "^4.57.2",
|
|
"postcss": "^8.5.10",
|
|
"tailwindcss": "^3.3.0",
|
|
"typescript": "~5.8.3",
|
|
"typescript-eslint": "^8.34.1",
|
|
"vite": "^7.1.12",
|
|
"vitest": "^3.2.4"
|
|
},
|
|
"optionalDependencies": {
|
|
"@rollup/rollup-linux-x64-gnu": "^4.45.1"
|
|
},
|
|
"overrides": {
|
|
"glob": "^11.1.0",
|
|
"js-yaml": "^4.1.1",
|
|
"follow-redirects": ">=1.16.0"
|
|
}
|
|
}
|