cubejs@1.3.2 declares `npm@^6.0.0` as a runtime dependency (vestigial — the
solver never requires('npm') at runtime). The bundled npm@6 transitively
pulls in 39 vulnerable subpackages (1 critical, 27 high, 10 moderate)
flagged by Dependabot.
Force the override to npm@^11.14.1 which has all CVEs patched. Verified:
solver test still passes (cubejs Kociemba API unchanged), full suite green,
build clean, `npm audit` reports 0 vulnerabilities.
Downgrading cubejs to 1.1.0 was tried and rejected — that version predates
the Kociemba solver (no Cube.initSolver / cube.solve API).
- Solver: cubejs-backed two-phase solver, lazy-loaded chunk so the ~80 KB
table-init cost stays out of the main bundle. New cube-to-facelets
converter (3D model -> 54-char URFDLB string) verified bit-for-bit
against cubejs's own move() output.
- Solve button in ControlsPanel with disabled "Solving..." state, wired
through the CubeView controller; animates each move sequentially.
- Rewrite solved-check to the WCA face-uniformity definition. The old
strict "identity quaternion per cubie" check rejected center spins
(invisible) and whole-cube rotations, both of which are still solved
per WCA / Kociemba.
- Vitest specs under tests/ cover cubie-model, move-definitions,
move-parser, apply-move (4x turns, inverses, sune order=6, R2 == R R),
scrambler, solved-check, algorithm-runner, cube-to-facelets, solver.
39 tests, ~3 s. Adds npm test / npm run test:watch scripts.
tiennm99