mirror of
https://github.com/tiennm99/litellm.git
synced 2026-06-27 21:07:31 +00:00
stuxf
7066c895f6
* chore: harden npm supply chain — pin overrides, enforce npm ci, add ignore-scripts Replace open-ended >= version overrides with exact pins matching lockfile versions across all 6 package.json files. Remove dead overrides for packages not present in lockfiles. Switch CI and devcontainer from npm install to npm ci for deterministic lockfile-based installs. Add .npmrc to all 7 JS project directories with ignore-scripts=true (blocks postinstall RAT vectors like the axios@1.14.1 supply chain attack) and min-release-age=3d (refuses packages published <3 days ago, requires npm >=11.10). Remove Yarn-only resolutions field from docs/my-website. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: bump sharp to 0.33.5 in docs, add docs .npmrc sharp 0.32.x uses postinstall to download native binaries, which breaks with ignore-scripts=true. sharp 0.33+ distributes via optionalDependencies instead, making it compatible with the new .npmrc hardening. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: remove docs .npmrc to fix Vercel deploy Vercel's build for docs/my-website uses npm install which needs sharp 0.32.6's postinstall script. Since we don't control Vercel's build process, remove the .npmrc from docs rather than fight it. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: Dockerfile npm ci + nvm checksum verification - Replace npm install with npm ci in Dockerfile.non_root, Dockerfile.custom_ui, and spend-logs/Dockerfile for deterministic lockfile-based installs - Replace curl-pipe-bash nvm install with download-then-verify pattern in build_admin_ui.sh, build_ui.sh, and build_ui_custom_path.sh - Update nvm from v0.38.0 (2021) to v0.40.4 (Jan 2026) with SHA256 checksum verification before execution Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: macOS sha256sum compat + clarify min-release-age scope - Use shasum -a 256 fallback on macOS where sha256sum is unavailable - Clarify in .npmrc comments that min-release-age only protects local npm install, not npm ci (used in CI) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
88 lines
2.1 KiB
JSON
88 lines
2.1 KiB
JSON
{
|
|
"name": "my-website",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"scripts": {
|
|
"docusaurus": "docusaurus",
|
|
"start": "docusaurus start",
|
|
"build": "docusaurus build",
|
|
"swizzle": "docusaurus swizzle",
|
|
"deploy": "docusaurus deploy",
|
|
"clear": "docusaurus clear",
|
|
"serve": "docusaurus serve",
|
|
"write-translations": "docusaurus write-translations",
|
|
"write-heading-ids": "docusaurus write-heading-ids"
|
|
},
|
|
"dependencies": {
|
|
"@docusaurus/core": "3.8.1",
|
|
"@docusaurus/plugin-google-gtag": "3.8.1",
|
|
"@docusaurus/plugin-ideal-image": "3.8.1",
|
|
"@docusaurus/preset-classic": "3.8.1",
|
|
"@docusaurus/theme-mermaid": "3.8.1",
|
|
"@inkeep/cxkit-docusaurus": "^0.5.89",
|
|
"@mdx-js/react": "^3.0.0",
|
|
"clsx": "^1.2.1",
|
|
"prism-react-renderer": "^1.3.5",
|
|
"react": "^18.0.0 || ^19.0.0",
|
|
"react-dom": "^18.0.0 || ^19.0.0",
|
|
"sharp": "^0.32.6",
|
|
"uuid": "^9.0.1"
|
|
},
|
|
"devDependencies": {
|
|
"@docusaurus/module-type-aliases": "3.8.1",
|
|
"dotenv": "^16.4.5"
|
|
},
|
|
"browserslist": {
|
|
"production": [
|
|
">0.5%",
|
|
"not dead",
|
|
"not op_mini all"
|
|
],
|
|
"development": [
|
|
"last 1 chrome version",
|
|
"last 1 firefox version",
|
|
"last 1 safari version"
|
|
]
|
|
},
|
|
"engines": {
|
|
"node": ">=16.14",
|
|
"npm": ">=8.3.0"
|
|
},
|
|
"overrides": {
|
|
"gray-matter": "4.0.3",
|
|
"webpack-dev-server": "5.2.3",
|
|
"form-data": "4.0.5",
|
|
"mermaid": "11.12.1",
|
|
"minimatch": "10.2.4",
|
|
"serialize-javascript": "7.0.3",
|
|
"mdast-util-to-hast": "13.2.1",
|
|
"lodash-es": "4.17.23",
|
|
"@babel/traverse": "7.28.5",
|
|
"ws": "8.19.0",
|
|
"http-proxy-middleware": "3.0.5",
|
|
"tar-fs": "3.1.1",
|
|
"webpack-dev-middleware": "5.3.4",
|
|
"braces": "3.0.3",
|
|
"webpack": "5.105.3",
|
|
"serve-static": "2.2.1",
|
|
"path-to-regexp": "1.9.0",
|
|
"dompurify": "3.3.2",
|
|
"svgo": "4.0.1",
|
|
"schema-utils@3": {
|
|
"ajv": "6.14.0"
|
|
},
|
|
"schema-utils@4": {
|
|
"ajv": "8.18.0"
|
|
},
|
|
"file-loader": {
|
|
"ajv": "6.14.0"
|
|
},
|
|
"null-loader": {
|
|
"ajv": "6.14.0"
|
|
},
|
|
"url-loader": {
|
|
"ajv": "6.14.0"
|
|
}
|
|
}
|
|
}
|