mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-09-14 14:01:28 +08:00
rUv
498a238799
* fix(security): make the fast-uri CVE fix actually reach shipped packages (#3222) 3.39.1 bumped fast-uri only in the ROOT package.json. Post-publish validation caught that this never reached users: a fresh `npm install ruflo@3.39.1` still resolved fast-uri@3.1.5, squarely inside the advisory range (GHSA-5jgf-p345-68v8, high, CVSS 7.5, >=3.1.3 <3.1.6). Root cause: v3/@claude-flow/cli/package.json carried its own hard pin "fast-uri": "3.1.5" in dependencies, and that is the package that actually ships. The root bump did not override it -- the #2112 lesson recorded in CLAUDE.md, that root overrides do NOT propagate to the published ruflo wrapper, applies to the CLI package too. - v3/@claude-flow/cli: fast-uri 3.1.5 -> ^3.1.6 (the shipping dependency) - ruflo: add "fast-uri": ">=3.1.6" override so the wrapper cannot regress independently of the CLI Verified by fresh-installing the published tarball rather than trusting the lockfile: that is what surfaced the gap in the first place. Refs #3222, #2112 Co-Authored-By: RuFlo <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01JJnDvpYYk2rTvjkudQUoCk * fix(ci): refresh v3 pnpm lockfile for the fast-uri bump The 3.39.2 fast-uri change touched v3/@claude-flow/cli/package.json but only the npm lockfile was regenerated. v3/ is a separate pnpm workspace and CI runs pnpm install --frozen-lockfile with working-directory: v3, which rejected the mismatch (ERR_PNPM_OUTDATED_LOCKFILE) and cascaded into 34 failing checks -- every one an install failure, not a real regression. Diff is 6 lines, fast-uri only: specifier 3.1.5 -> ^3.1.6, resolved 3.1.7. Verified pnpm install --frozen-lockfile now exits 0. Co-Authored-By: RuFlo <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01JJnDvpYYk2rTvjkudQUoCk
118 lines
3.4 KiB
JSON
118 lines
3.4 KiB
JSON
{
|
|
"name": "ruflo",
|
|
"version": "3.39.2",
|
|
"description": "Ruflo - Enterprise AI agent orchestration platform. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
|
|
"main": "bin/ruflo.js",
|
|
"type": "module",
|
|
"bin": {
|
|
"ruflo": "bin/ruflo.js"
|
|
},
|
|
"homepage": "https://github.com/ruvnet/claude-flow#readme",
|
|
"bugs": {
|
|
"url": "https://github.com/ruvnet/claude-flow/issues",
|
|
"email": "support@ruv.io"
|
|
},
|
|
"funding": {
|
|
"type": "github",
|
|
"url": "https://github.com/sponsors/ruvnet"
|
|
},
|
|
"files": [
|
|
"bin/**",
|
|
"src/**",
|
|
"dist/**",
|
|
"README.md",
|
|
"LICENSE"
|
|
],
|
|
"scripts": {
|
|
"prepublishOnly": "node scripts/prepare-publish.mjs",
|
|
"dev": "node src/mcp-bridge/index.js",
|
|
"dev:bridge": "node --watch src/mcp-bridge/index.js",
|
|
"dev:test": "node src/mcp-bridge/test-harness.js",
|
|
"start": "node src/mcp-bridge/index.js",
|
|
"docker:up": "docker compose up -d",
|
|
"docker:down": "docker compose down",
|
|
"docker:build": "docker compose build",
|
|
"docker:logs": "docker compose logs -f",
|
|
"install:bridge": "cd src/mcp-bridge && npm install",
|
|
"generate:config": "node src/scripts/generate-config.js",
|
|
"generate:welcome": "node src/scripts/generate-welcome.js",
|
|
"deploy": "bash src/scripts/deploy.sh",
|
|
"package:rvf": "bash src/scripts/package-rvf.sh"
|
|
},
|
|
"dependencies": {
|
|
"@claude-flow/cli": "^3.33.0"
|
|
},
|
|
"optionalDependencies": {},
|
|
"overrides": {
|
|
"ruvector": "^0.2.27",
|
|
"better-sqlite3": "12.9.0",
|
|
"@ruvector/rvf-wasm": "0.1.5",
|
|
"@hono/node-server": ">=1.19.10",
|
|
"flatted": ">=3.4.0",
|
|
"tar": ">=7.5.11",
|
|
"picomatch": ">=4.0.3",
|
|
"path-to-regexp": ">=8.2.1",
|
|
"undici": ">=7.18.0",
|
|
"minimatch": ">=10.0.0",
|
|
"@isaacs/brace-expansion": ">=5.0.1",
|
|
"cacache": ">=20.0.0",
|
|
"make-fetch-happen": ">=15.0.0",
|
|
"express-rate-limit": ">=8.4.1",
|
|
"protobufjs": ">=7.5.6",
|
|
"uuid": ">=14.0.0",
|
|
"@opentelemetry/core": ">=2.8.0",
|
|
"@opentelemetry/resources": ">=2.8.0",
|
|
"@opentelemetry/sdk-trace-base": ">=2.8.0",
|
|
"@opentelemetry/sdk-node": ">=0.220.0",
|
|
"@opentelemetry/auto-instrumentations-node": ">=0.75.0",
|
|
"@opentelemetry/exporter-prometheus": ">=0.220.0",
|
|
"@opentelemetry/exporter-trace-otlp-grpc": ">=0.220.0",
|
|
"@opentelemetry/exporter-trace-otlp-http": ">=0.220.0",
|
|
"@opentelemetry/exporter-trace-otlp-proto": ">=0.220.0",
|
|
"@opentelemetry/otlp-exporter-base": ">=0.220.0",
|
|
"@opentelemetry/otlp-grpc-exporter-base": ">=0.220.0",
|
|
"@opentelemetry/otlp-transformer": ">=0.220.0",
|
|
"agentdb": ">=3.0.0-alpha.17",
|
|
"agentic-flow": ">=2.0.14",
|
|
"@ruvector/ruvllm": ">=2.6.0",
|
|
"fast-uri": ">=3.1.6"
|
|
},
|
|
"engines": {
|
|
"node": ">=20.0.0"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/ruvnet/claude-flow.git",
|
|
"directory": "ruflo"
|
|
},
|
|
"keywords": [
|
|
"ruflo",
|
|
"claude-flow",
|
|
"claude",
|
|
"claude-code",
|
|
"anthropic",
|
|
"ai",
|
|
"ai-agents",
|
|
"multi-agent",
|
|
"agent-orchestration",
|
|
"swarm-intelligence",
|
|
"swarm",
|
|
"mcp",
|
|
"model-context-protocol",
|
|
"cli",
|
|
"developer-tools",
|
|
"enterprise",
|
|
"self-learning"
|
|
],
|
|
"author": {
|
|
"name": "RuvNet",
|
|
"email": "ruv@ruv.io",
|
|
"url": "https://ruv.io"
|
|
},
|
|
"license": "MIT",
|
|
"publishConfig": {
|
|
"access": "public",
|
|
"tag": "latest"
|
|
}
|
|
}
|