james.maesandJames Maes
4f9fcaef0a
* security(deps): resolve high-severity npm audit advisories via minimatch override All 9 high-severity advisories stemmed from a single transitive chain: eslint/eslint-config-next tooling depend on a vulnerable minimatch (<=10.0.2) that pulls in brace-expansion <=5.0.7 (GHSA-mh99-v99m-4gvg, DoS via unbounded expansion). These are dev/build-time only packages, not shipped in the runtime image. Bumping eslint itself would require a semver-major jump (9.x -> 10.x). Instead, pin minimatch to ^10.0.3 via package.json overrides, which drops the vulnerable brace-expansion dependency entirely (newer minimatch uses @isaacs/brace-expansion). Verified npm audit reports 0 vulnerabilities and both npm run lint and npm run build still pass. * ci(app): add non-blocking npm audit step to lint-and-build job Surface high-severity advisories in CI logs without gating merges on build-time dev-dependency findings a solo dev can triage async. --------- Co-authored-by: James Maes <jmaes@dmdbrands.com>
42 lines
914 B
JSON
42 lines
914 B
JSON
{
|
|
"name": "nuncio-website",
|
|
"version": "1.0.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"engines": {
|
|
"node": ">=22"
|
|
},
|
|
"scripts": {
|
|
"dev": "next dev",
|
|
"build": "next build",
|
|
"start": "next start",
|
|
"lint": "eslint src"
|
|
},
|
|
"dependencies": {
|
|
"@headlessui/react": "^2.2.6",
|
|
"@tailwindcss/postcss": "^4.2.0",
|
|
"@tailwindcss/typography": "^0.5.16",
|
|
"clsx": "^2.1.1",
|
|
"lucide-react": "^1.26.0",
|
|
"next": "^16.2.11",
|
|
"next-themes": "^0.4.6",
|
|
"postcss": "^8.5.22",
|
|
"react": "19.2.8",
|
|
"react-dom": "19.2.4",
|
|
"tailwindcss": "^4.2.0",
|
|
"typescript": "^5.8.3"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^24.1.0",
|
|
"@types/react": "19.2.17",
|
|
"@types/react-dom": "19.2.3",
|
|
"eslint": "^9.39.5",
|
|
"eslint-config-next": "16.1.6"
|
|
},
|
|
"overrides": {
|
|
"sharp": "^0.35.0",
|
|
"postcss": "$postcss",
|
|
"minimatch": "^10.0.3"
|
|
}
|
|
}
|