mirror of
https://github.com/vercel/flags.git
synced 2026-09-19 03:49:23 +08:00
Dominik Ferber
2532e99ea8
Bumps the vulnerable transitive dependencies flagged by Dependabot via pnpm overrides, and the direct nanoid dependency in the examples. - nanoid >= 4 -> ^5.1.16 (GHSA infinite loop on negative/zero size) - brace-expansion >= 4 -> ^5.0.9 (DoS via unbounded intermediate arrays) - dompurify -> ^3.4.13 (XSS via detached subtree after IN_PLACE hook removal) - fast-uri -> ^3.1.5 (host confusion via backslash authority introducer) - js-yaml 3 -> ^3.15.1, js-yaml 4 -> ^4.3.1 (quadratic CPU in !!omap) - mermaid -> ^11.16.1 (DoS, prototype pollution, CSS injection) - postcss -> ^8.5.23 (arbitrary .map file read via sourceMappingURL) - @sveltejs/kit -> ^2.70.2 (ReDoS in Accept header content negotiation) image-size (alerts #979, #980) has no patched release yet, so it is left as-is. It is only used at build time by the docs site. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
81 lines
2.3 KiB
JSON
81 lines
2.3 KiB
JSON
{
|
|
"name": "vercel-flags",
|
|
"version": "0.0.1",
|
|
"description": "A monorepo for the Flags SDK",
|
|
"homepage": "https://flags-sdk.dev",
|
|
"bugs": {
|
|
"url": "https://github.com/vercel/flags/issues"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/vercel/flags.git"
|
|
},
|
|
"license": "MIT",
|
|
"scripts": {
|
|
"attw": "turbo attw",
|
|
"build": "turbo build",
|
|
"dev": "turbo dev",
|
|
"dev:docs": "pnpm dev -F docs",
|
|
"check": "turbo check",
|
|
"format": "biome check --write .",
|
|
"next-15": "pnpm dev -F next-15",
|
|
"next-16": "pnpm dev -F next-16",
|
|
"prepare": "husky",
|
|
"publint": "turbo publint",
|
|
"registry": "pnpm dev -F registry",
|
|
"release": "turbo build --filter='./packages/*' && changeset publish",
|
|
"shirt-shop": "pnpm dev -F shirt-shop",
|
|
"shirt-shop-api": "pnpm dev -F shirt-shop-api",
|
|
"snippets": "pnpm dev -F snippets",
|
|
"playground": "pnpm dev -F playground",
|
|
"svelte": "pnpm dev -F svelte-example",
|
|
"test": "turbo test",
|
|
"test:e2e": "turbo test:e2e",
|
|
"test:integration": "turbo test:integration",
|
|
"type-check": "turbo type-check",
|
|
"validate-packages": "node scripts/validate-packages.mjs",
|
|
"validate-skills": "node scripts/validate-skills.mjs",
|
|
"version-packages": "changeset version && pnpm i --no-frozen-lockfile && git add ."
|
|
},
|
|
"lint-staged": {
|
|
"*": [
|
|
"biome check --no-errors-on-unmatched --files-ignore-unknown=true"
|
|
]
|
|
},
|
|
"devDependencies": {
|
|
"@biomejs/biome": "^2.4.6",
|
|
"@changesets/changelog-github": "^0.7.0",
|
|
"@changesets/cli": "2.31.0",
|
|
"@types/node": "22.14.0",
|
|
"gray-matter": "4.0.3",
|
|
"husky": "9.0.10",
|
|
"lint-staged": "^16.4.0",
|
|
"next": "16.2.12",
|
|
"playwright": "1.56.1",
|
|
"publint": "0.3.14",
|
|
"react": "canary",
|
|
"turbo": "2.10.6",
|
|
"typescript": "^5.9.3",
|
|
"typescript-eslint": "8.46.1"
|
|
},
|
|
"packageManager": "pnpm@10.19.0",
|
|
"engines": {
|
|
"node": "^20.19.0 || >=22.12.0"
|
|
},
|
|
"pnpm": {
|
|
"overrides": {
|
|
"postcss": "^8.5.23",
|
|
"esbuild": "^0.28.1",
|
|
"uuid": "^11.1.1",
|
|
"brace-expansion@>=4": "^5.0.9",
|
|
"dompurify": "^3.4.13",
|
|
"fast-uri": "^3.1.5",
|
|
"js-yaml@3": "^3.15.1",
|
|
"js-yaml@4": "^4.3.1",
|
|
"mermaid": "^11.16.1",
|
|
"nanoid@>=4": "^5.1.16",
|
|
"@sveltejs/kit": "^2.70.2"
|
|
}
|
|
}
|
|
}
|