mirror of
https://github.com/tiennm99/loto.git
synced 2026-07-31 02:25:28 +00:00
tiennm99
d94294d83b
`@vite-pwa/sveltekit` pulled in `serialize-javascript@6.0.2` via workbox-build → @rollup/plugin-terser, which is flagged for High RCE (GHSA-5c6j-r48x-rmvq) and Medium DoS (GHSA-qj8w-gfj5-8c6v). Both fix to >=7.0.5. Also opportunistically bump `cookie` past 0.7.0 (Low GHSA-pxg6-pf52-xh8x) via @sveltejs/kit — was the last-remaining Dependabot Low. Build-time tooling only — neither package ships to the browser. Pinned via npm `overrides` rather than `audit fix --force` because the latter would downgrade @vite-pwa/sveltekit to 0.0.1 (breaking). npm audit: 0 vulnerabilities. Tests 115/115. Build clean.
41 lines
1004 B
JSON
41 lines
1004 B
JSON
{
|
|
"name": "loto",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite dev",
|
|
"dev:codeserver": "VITE_DEV_PROFILE=codeserver vite dev --host 0.0.0.0",
|
|
"build": "vite build",
|
|
"build:gh": "BUILD_PROFILE=gh vite build",
|
|
"preview": "vite preview",
|
|
"lint": "eslint .",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest"
|
|
},
|
|
"optionalDependencies": {
|
|
"lightningcss-linux-x64-gnu": "1.32.0"
|
|
},
|
|
"overrides": {
|
|
"serialize-javascript": "^7.0.5",
|
|
"cookie": "^0.7.2"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^9",
|
|
"@fontsource/roboto-condensed": "^5.2.8",
|
|
"@sveltejs/adapter-static": "^3",
|
|
"@sveltejs/kit": "^2",
|
|
"@sveltejs/vite-plugin-svelte": "^6",
|
|
"@tailwindcss/vite": "^4",
|
|
"@vite-pwa/sveltekit": "^1.1.0",
|
|
"eslint": "^9",
|
|
"eslint-plugin-svelte": "^2",
|
|
"globals": "^15",
|
|
"happy-dom": "20.9.0",
|
|
"svelte": "^5",
|
|
"tailwindcss": "^4",
|
|
"vite": "^7",
|
|
"vitest": "4.1.5"
|
|
}
|
|
}
|