* fix: security audit findings from issue #741
CI shell injection (high):
- publish.yml: use env var for inputs.bump in case statement
- nextjs-tracker.yml: use env vars for since_hours and dry_run inputs
- nextjs-tracker.yml: use env var in Skip step echo
Test file false positive (critical flag):
- tests/vite-hmr-websocket.test.ts: add gitleaks:allow for RFC 6455
example WebSocket nonce (dGhlIHNhbXBsZSBub25jZQ==)
innerHTML / XSS (high):
- packages/vinext/src/shims/script.tsx: add security comment documenting
that dangerouslySetInnerHTML is developer-supplied inline script only
- packages/vinext/src/shims/head.ts: document tag is bounded to
RAW_CONTENT_TAGS (script/style), not user input
dangerouslySetInnerHTML in example (medium):
- examples/hackernews/components/comment.jsx: sanitize HN API HTML
with DOMPurify before rendering
- examples/hackernews/package.json: add dompurify dependency
- pnpm-workspace.yaml: add dompurify and @types/dompurify to catalog
Non-literal RegExp (medium): documented as internal config values only,
no user input reaches any of the 6 flagged patterns. See safeRegExp()
in config-matchers.ts which already enforces ReDoS protection.
Deprecation cleanup:
- examples/hackernews/tsconfig.json: remove deprecated baseUrl option
(moduleResolution: bundler handles resolution; all imports are relative)
- examples/hackernews/tsconfig.json: add noEmit: true to prevent TypeScript
from attempting to write over existing .js files in lib/
- examples/hackernews/package.json: add missing @cloudflare/workers-types
devDependency (was referenced in tsconfig types but not installed)
* fix: address bonk review comments
- Switch dompurify → isomorphic-dompurify so sanitize() works during
SSR (DOMPurify is a no-op without window/document; isomorphic-dompurify
bundles jsdom for server-side use)
- Revert package.json whitespace to 2-space indentation (was inadvertently
changed to 4-space, creating noise in the diff)
- Replace dompurify + @types/dompurify catalog entries with
isomorphic-dompurify (ships its own types, no separate @types needed)
- Add missing trailing newline to tsconfig.json
* fix: address bonk review comments on PR #769
- Switch from isomorphic-dompurify to sanitize-html, and move
sanitization to the server-side data boundary (lib/get-comments.js).
isomorphic-dompurify depends on jsdom which is Node.js-specific and
does not work in the Cloudflare Workers runtime. sanitize-html is
pure-JS (htmlparser2-based) with no DOM dependency and works in both
Workers and Node.js. Sanitizing once at the data boundary means both
the SSR'd initial HTML response and client re-renders receive safe text.
- Remove the DOMPurify import from comment.jsx; the client component no
longer needs to sanitize since text is already clean when passed as a prop.
- Replace isomorphic-dompurify with sanitize-html in the workspace catalog.
- Remove inert eslint-disable-next-line comment from script.tsx; the project
uses oxlint which ignores ESLint-specific inline suppression directives.
---------
Co-authored-by: Luke Percy <lpercyagile@gmail.com>
* chore: migrate to vite plus
* Disable typeAware and typeCheck
* Update CI
* Fix CI
* Fix test
* Clean
* Run test with vp
* Try revert
* react: false In test
* Fix test
* Revert "Try revert"
This reverts commit 009da10473.
* Update
* Update
* Try revert ci changes
* revert
* Run vp migrate
* Disable typeAware and typeCheck for now
* Better resolve for test
* Use vp dev instead of vite
* Update expect
* Fix NormalizeManifestModuleId
* Try increase timeout
* Update to use vp
* Try new check
* Bring back npx vp
* Migrate CI
* Make next-intl resolvable
* Update
* Update
* Update
App Router examples were missing react-server-dom-webpack as an explicit
dependency. With pnpm's strict module resolution, this caused the Vite
dev server to fail resolving react-server-dom-webpack/client.browser,
breaking client-side hydration — "use client" components rendered as
static HTML with no interactivity.
The @vitejs/plugin-rsc correctly adds react-server-dom-webpack to
optimizeDeps.include, but the package must be resolvable from the
project root. Without it in package.json, pnpm cannot link it.
James Anderson