Andreas Reinhold / reiniandClaude Opus 4.8
084cefe023
Clears the last outstanding advisory (GHSA-395f-4hp3-45gv, quadratic complexity DoS in shell-quote's parse()). npm audit now reports 0 vulnerabilities, down from 3 before this branch. concurrently pins "shell-quote": "1.8.4" exactly, and the maintainers patched only the 9.x line (9.2.4 ships shell-quote 1.9.0) while 10.x still carries 1.8.4. npm's only offered remedy was therefore a downgrade to concurrently@9.2.4. The override keeps concurrently at 10.0.3 and resolves shell-quote to 1.10.0 instead. Overriding a deliberate exact pin warrants checking concurrently still works, so this was verified functionally in node:24-alpine rather than assumed: quoted and escaped arguments parse correctly (the shell-quote code path), named prefixes render, and --kill-others-on-fail still propagates a non-zero exit. npm install, npm ci and npm run build all succeed, build hashes are unchanged, and the PHP suite passes 123 tests. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
30 lines
738 B
JSON
30 lines
738 B
JSON
{
|
|
"$schema": "https://www.schemastore.org/package.json",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"build": "vite build",
|
|
"dev": "vite"
|
|
},
|
|
"dependencies": {
|
|
"@tailwindcss/vite": "^4.3.3",
|
|
"alpinejs": "^3.15.12",
|
|
"autoprefixer": "^10.5.4",
|
|
"concurrently": "^10.0.3",
|
|
"daisyui": "^5.7.0",
|
|
"laravel-vite-plugin": "^3.1.3",
|
|
"tailwindcss": "^4.3.3",
|
|
"vite": "^8.1.5"
|
|
},
|
|
"optionalDependencies": {
|
|
"@tailwindcss/oxide-linux-x64-gnu": "^4.0.1",
|
|
"lightningcss-linux-x64-gnu": "^1.29.1"
|
|
},
|
|
"overrides": {
|
|
"shell-quote": "^1.9.0"
|
|
},
|
|
"devDependencies": {
|
|
"chokidar": "^5.0.0"
|
|
}
|
|
}
|