Ben Stull
bc60ad97be
Clears Patchwatch advisories #36–#40 on the OHM deployment (affecting ohm-rfc-app + rfc-app-ppe) by forcing the vulnerable dependencies to patched versions: - backend/requirements.txt: floor-pin tqdm>=4.66.3 (#37/#39/#40, resolves 4.68.2) and idna>=3.15 (#38, resolves 3.18) — both arrive transitively with no lockfile, so a floor-pin is the robust fix. - frontend/package.json: vitest ^3.0.0 -> ^4.1.0 (#36, resolves 4.1.8; dev/test-only, GHSA-5xrq-8626-4rwp UI-server file read/exec). Lockfile regenerated. No behavior change; backend (685), frontend (66), and localhost E2E (5) suites pass. Issues are closed after the change is deployed and re-scanned, not on merge. Patchwatch Phase 2 remediation, session ohm/0095. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
42 lines
1.1 KiB
JSON
42 lines
1.1 KiB
JSON
{
|
|
"name": "rfc-app-frontend",
|
|
"private": true,
|
|
"version": "0.55.1",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "vite build",
|
|
"preview": "vite preview",
|
|
"test": "vitest",
|
|
"test:run": "vitest run"
|
|
},
|
|
"dependencies": {
|
|
"@amplitude/unified": "^1.1.9",
|
|
"@codemirror/commands": "^6.10.3",
|
|
"@codemirror/lang-markdown": "^6.5.0",
|
|
"@codemirror/language": "^6.12.3",
|
|
"@codemirror/state": "^6.6.0",
|
|
"@codemirror/view": "^6.43.0",
|
|
"@tiptap/extension-placeholder": "^3.5.0",
|
|
"@tiptap/pm": "^3.5.0",
|
|
"@tiptap/react": "^3.5.0",
|
|
"@tiptap/starter-kit": "^3.5.0",
|
|
"dompurify": "^3.2.4",
|
|
"marked": "^18.0.4",
|
|
"mermaid": "^11.15.0",
|
|
"react": "^19.2.6",
|
|
"react-dom": "^19.2.6",
|
|
"react-router-dom": "^7.2.0"
|
|
},
|
|
"devDependencies": {
|
|
"@testing-library/jest-dom": "^6.6.0",
|
|
"@testing-library/react": "^16.1.0",
|
|
"@types/react": "^19.2.14",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@vitejs/plugin-react": "^6.0.1",
|
|
"jsdom": "^25.0.0",
|
|
"vite": "^8.0.12",
|
|
"vitest": "^4.1.0"
|
|
}
|
|
}
|