LukasandClaude Opus 5
90eb39b227
pnpm 10.32 stopped reading the "pnpm" field from package.json, so the undici/picomatch overrides and the three GHSA suppressions had silently stopped applying — only the stale lockfile still held undici at 7.24.8. Move the surviving picomatch override to pnpm-workspace.yaml. With the config live again, two high advisories surfaced: - postcss was stuck at 8.5.15 (GHSA-r28c-9q8g-f849, patched in 8.5.18); nothing pinned it, so refresh to 8.5.25 within vite's range. - undici GHSA-4cwx-7wf7-3272 needed >=7.29.0, but our ~7.24.0 pin existed because jsdom 29 crashed on undici 7.28+. jsdom 30 moved to undici ^8.9, so bump jsdom and drop both the pin and all three suppressions. 15 vulnerabilities (5 high, 3 suppressed) down to 1 moderate (smol-toml via knip, below the --audit-level=high gate). Separately, ports.ts declared its members with method shorthand, which TypeScript treats as this-dependent, so oxlint's unbound-method fired wherever a port was passed by reference (use-bestiary.ts:236). The ports are bags of plain module functions, so declare them as readonly function properties instead of suppressing the one call site. This makes parameter types contravariant rather than bivariant; typecheck passes unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
35 lines
822 B
JSON
35 lines
822 B
JSON
{
|
|
"name": "web",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc --build && vite build",
|
|
"preview": "vite preview"
|
|
},
|
|
"dependencies": {
|
|
"@initiative/application": "workspace:*",
|
|
"@initiative/domain": "workspace:*",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"idb": "^8.0.3",
|
|
"lucide-react": "^0.577.0",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0",
|
|
"tailwind-merge": "^3.5.0"
|
|
},
|
|
"devDependencies": {
|
|
"@tailwindcss/vite": "^4.2.2",
|
|
"@testing-library/jest-dom": "^6.9.1",
|
|
"@testing-library/react": "^16.3.2",
|
|
"@testing-library/user-event": "^14.6.1",
|
|
"@types/react": "^19.0.0",
|
|
"@types/react-dom": "^19.0.0",
|
|
"@vitejs/plugin-react": "^6.0.1",
|
|
"jsdom": "^30.0.1",
|
|
"tailwindcss": "^4.2.2",
|
|
"vite": "^8.0.16"
|
|
}
|
|
}
|