Ben Stull
21743a08b1
Sweep-the-edges hardening release (roadmap item #4). Audits every write-shaped backend endpoint to confirm each one enforces an explicit auth.require_contributor (or stricter) gate before doing state-changing work; adds a regression test net (test_anon_offlimits_vertical.py, 12 tests, 66 assertions) so future endpoints can't quietly ship without a gate. The only behaviour change: GET /api/rfcs/<slug>/graduate/progress now requires auth.require_user since the step detail (repo name, PR number, rollback steps) isn't part of the v0.3.0 anonymous-read contract. No schema, no env, no dependency changes; operator action is rebuild + restart per CHANGELOG §0.6.0 upgrade steps. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
34 lines
841 B
JSON
34 lines
841 B
JSON
{
|
|
"name": "rfc-app-frontend",
|
|
"private": true,
|
|
"version": "0.6.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "vite build",
|
|
"preview": "vite preview"
|
|
},
|
|
"dependencies": {
|
|
"@codemirror/commands": "^6.10.3",
|
|
"@codemirror/lang-markdown": "^6.5.0",
|
|
"@codemirror/language": "^6.12.3",
|
|
"@codemirror/state": "^6.6.0",
|
|
"@codemirror/view": "^6.43.0",
|
|
"@tiptap/extension-placeholder": "^3.5.0",
|
|
"@tiptap/pm": "^3.5.0",
|
|
"@tiptap/react": "^3.5.0",
|
|
"@tiptap/starter-kit": "^3.5.0",
|
|
"marked": "^18.0.4",
|
|
"mermaid": "^11.15.0",
|
|
"react": "^19.2.6",
|
|
"react-dom": "^19.2.6",
|
|
"react-router-dom": "^7.2.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/react": "^19.2.14",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@vitejs/plugin-react": "^6.0.1",
|
|
"vite": "^8.0.12"
|
|
}
|
|
}
|