7537de9e74
OSV weekly scan reported 50 known vulnerabilities in pinned deps. This bumps everything with a released, semver-compatible fix: Python (uv.lock): - aiohttp 3.14.1 -> 3.14.3 (GHSA-cq5v-8q36-5273, GHSA-mfx4-hv73-q22v, GHSA-mq44-7p77-q5h7) - h2 4.3.0 -> 4.4.1 (CVE-2026-71554 request smuggling; exclude-newer exception documented in pyproject, remove after 2026-08-17) npm (root workspace): - brace-expansion 5.0.8 -> 5.0.9, undici 6.27->6.28 / 7.28->7.29, js-yaml 4.3.1, nanoid 3.3.17/3.3.18, ip-address 10.4.0, mermaid 11.16.1 + dompurify 3.4.13 (root overrides so the streamdown transitive copy is pinned too) - electron 40.10.2 -> 40.10.6 (GHSA-r4w5-6pfg-jxp5; the 41.x major for GHSA-9f4c-93c8-jc8g is deferred to its own PR) npm (website): mermaid, dompurify, js-yaml, nanoid, fast-uri 3.1.5, postcss 8.5.23, undici 7.29.0 npm (photon sidecar): @opentelemetry/core 2.8.0 via override, undici npm (whatsapp-bridge): body-parser 1.20.6 min-release-age excludes added to .npmrc/website/.npmrc for the sub-2wk CVE-fix releases, each with a removal date. Remaining findings are blocked upstream: cryptography <49 cap (alibabacloud-tea-openapi), image-size (no fixed release), tar 6.x transitive majors, electron 41. Local rescan: 50 -> 19 known vulns, 0 introduced.
46 lines
1.3 KiB
JSON
46 lines
1.3 KiB
JSON
{
|
|
"name": "hermes-tui",
|
|
"version": "0.0.1",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "npm run build:ink && tsx --watch src/entry.tsx",
|
|
"start": "tsx src/entry.tsx",
|
|
"build": "node scripts/build.mjs",
|
|
"build:ink": "npm run build --prefix packages/hermes-ink",
|
|
"visual": "node scripts/visual/run.mjs",
|
|
"typecheck": "tsc --noEmit -p tsconfig.json",
|
|
"lint": "eslint src/ packages/",
|
|
"lint:fix": "eslint src/ packages/ --fix",
|
|
"fmt": "prettier --write 'src/**/*.{ts,tsx}' 'packages/**/*.{ts,tsx}'",
|
|
"fix": "npm run lint:fix && npm run fmt",
|
|
"check": "npm run build:ink && npm run typecheck && npm run test && npm run lint",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest"
|
|
},
|
|
"dependencies": {
|
|
"@hermes/ink": "file:./packages/hermes-ink",
|
|
"@hermes/shared": "file:../apps/shared",
|
|
"@nanostores/react": "1.1.0",
|
|
"ink-text-input": "6.0.0",
|
|
"nanostores": "1.4.0",
|
|
"react": "19.2.7",
|
|
"undici": "6.28.0",
|
|
"unicode-animations": "1.0.3"
|
|
},
|
|
"overrides": {
|
|
"ink-text-input": {
|
|
"ink": "npm:@hermes/ink@0.0.1"
|
|
}
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "22.20.1",
|
|
"@types/react": "19.2.17",
|
|
"esbuild": "0.28.1",
|
|
"prettier": "3.9.5",
|
|
"tsx": "4.23.1",
|
|
"typescript": "6.0.3",
|
|
"vitest": "4.1.10"
|
|
}
|
|
}
|