mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-07 09:23:50 +01:00
garrytan
e77c5320c5
Raise overrides to fixed releases: ip-address 10.7.3 (our own pin was the vulnerable 10.3.1; reachable through socks in browse's proxy path), fast-uri 3.1.8, hono 4.13.13, proxy-addr 2.0.8, @modelcontextprotocol/sdk 1.31.0, sharp 0.35.5, and in lib/diagram-render dompurify 3.4.16 (bundled by mermaid) and source-map-js 1.2.2; the render page is rebuilt. Three advisories without a usable fix get justified, expiring ignores: braces (build-time only, excalidraw -> sass -> chokidar; a test checks the page carries no chokidar code), sprintf-js (roarr's constant-format logger) and katex (needs pre-existing prototype pollution; fix outside mermaid's range). osv-scanner with the repo config: no issues found.
23 lines
715 B
JSON
23 lines
715 B
JSON
{
|
|
"name": "@gstack/diagram-render",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "Offline diagram-render bundle: mermaid + excalidraw export + mermaid-to-excalidraw, built into a single self-contained HTML page loaded by the browse daemon. Versions are exact-pinned; bump them only via scripts/build.ts (see README.md).",
|
|
"scripts": {
|
|
"build": "bun run scripts/build.ts"
|
|
},
|
|
"dependencies": {
|
|
"@excalidraw/excalidraw": "0.18.1",
|
|
"@excalidraw/mermaid-to-excalidraw": "2.2.2",
|
|
"mermaid": "11.16.1",
|
|
"react": "18.3.1",
|
|
"react-dom": "18.3.1"
|
|
},
|
|
"overrides": {
|
|
"dompurify": "3.4.16",
|
|
"nanoid": "5.1.16",
|
|
"source-map-js": "1.2.2",
|
|
"lodash-es": "4.18.1"
|
|
}
|
|
}
|