cloud/ocis
1
0
Fork 0
mirror of https://github.com/owncloud/ocis.git synced 2026-10-23 23:29:02 +03:00
Code Activity
Files
test-cli-postprocessing-resume
ocis/web/package.json
Michal Klos b9077d96d8 chore(deps): consolidate dependency and security bumps (#13081) 
* chore(deps): consolidate dependency and security bumps

Dependabot PRs applied:
- #12878 qs 6.15.2 -> 6.16.0 (web/web-runtime)
- #13013 alpine 3.24.1 -> 3.24.2
- #13061 actions/checkout -> v7.0.1 (missed instance in k8s.yml)
- #13062 actions/setup-node -> v7.0.0 (missed instance in k8s.yml)
- #13075 simple-git 3.36.0 -> 4.0.1 (security)
- #13076 katex 0.16.45 -> 0.18.2+ (security)
- #13077 dompurify 3.4.13 -> 3.4.16 (security)
- #13079 go deps minor-and-patch group, 18 updates (opa 1.19.0 -> 1.21.1, otel 1.46 -> 1.47, bleve, govips, grpc-gateway, lico, tablewriter, logrus, gjson, x/exp, x/image, genproto, etc.)

Skipped (already satisfied on master): #12513, #12624, #12625, #12633

Manual security bumps via pnpm.overrides (no dependabot PR existed):
- axios -> 1.20.0
- smol-toml -> 1.9.0
- postcss -> 8.5.23
- postcss-selector-parser -> 7.1.6
- colord -> 2.9.4
- unhead -> 2.1.13
- markdown-it -> 14.3.1
- esbuild -> 0.28.1
- brace-expansion 5.0.11 -> 5.0.12

Not fixable: sprintf-js and elliptic have no patched version released upstream yet; left as-is.

go build and pnpm install verified clean.

* chore(deps): fix residual transitive vulns found by trivy

trivy flagged duplicate/stale resolutions that survived the earlier
override pass: dompurify (3.4.12 -> 3.4.16), qs (6.14.2 -> 6.16.0),
and fast-uri (3.1.7 -> 3.1.8, CVE-2026-86472). Added/bumped pnpm.overrides
accordingly. trivy fs scan of web/pnpm-lock.yaml now clean.

* chore(deps): bump reva to bac0e1ee144ab853a81c6b02142032f102dd245a

Pins github.com/owncloud/reva/v2 to bac0e1ee144ab853a81c6b02142032f102dd245a,
pulling in its go-playground/locales and huandu/xstrings version bumps.
Appends this PR to changelog/unreleased/bump-reva.md.

go build ./... verified clean after go mod vendor resync.

* fix(ci): revert unhead override, breaks web build

* revert: keep k8s.yml actions/checkout and setup-node pinned
2026-10-07 07:56:56 +02:00

152 lines
5.4 KiB
JSON
Raw Permalink Blame History

{
"version": "12.5.0",
"private": true,
"homepage": "https://github.com/owncloud/web",
"license": "Apache-2.0",
"author": "ownCloud GmbH <devops@owncloud.com>",
"type": "module",
"scripts": {
"build": "vue-demi-fix && pnpm build:tokens && pnpm vite build",
"build:w": "pnpm build --watch",
"build:tokens": "pnpm --filter @ownclouders/design-system tokens",
"lint": "eslint vite.config.ts '{packages,tests}/**/*.{js,ts,vue}' --color",
"serve": "SERVER=true pnpm build:w",
"test:e2e:playwright": "NODE_TLS_REJECT_UNAUTHORIZED=0 npx playwright test --config=tests/e2e/",
"docs:screenshots": "NODE_TLS_REJECT_UNAUTHORIZED=0 npx playwright test --config=tests/e2e/docs/playwright.config.ts",
"test:unit": "NODE_OPTIONS=--unhandled-rejections=throw vitest",
"licenses:check": "license-checker-rseidelsohn --summary --relativeLicensePath --onlyAllow 'Python-2.0;Apache*;Apache License, Version 2.0;Apache-2.0;Apache 2.0;Artistic-2.0;BSD;BSD-3-Clause;CC-BY-3.0;CC-BY-4.0;CC0-1.0;ISC;MIT;MPL-2.0;Public Domain;Unicode-TOU;Unlicense;WTFPL;BlueOak-1.0.0' --excludePackages '@ownclouders/babel-preset;@ownclouders/eslint-config;@ownclouders/prettier-config;@ownclouders/tsconfig;@ownclouders/web-client;@ownclouders/web-pkg;external;web-app-files;text-editor;preview;web-app-ocm;@ownclouders/design-system;pdf-viewer;web-app-search;admin-settings;webfinger;web-runtime;@ownclouders/web-test-helpers'",
"licenses:csv": "license-checker-rseidelsohn --relativeLicensePath --csv --out ./third-party-licenses/third-party-licenses.csv",
"licenses:save": "license-checker-rseidelsohn --relativeLicensePath --out /dev/null --files ./third-party-licenses/third-party-licenses",
"vite": "vue-demi-fix && vite",
"check:types": "pnpm build:tokens && vue-tsc --noEmit",
"check:format": "prettier --check \"./**/*.{ts,js,vue}\"",
"check:all": "pnpm check:types && pnpm lint --fix && pnpm check:format && pnpm test:unit",
"format": "prettier --write \"./**/*.{ts,js,vue}\""
},
"browserslist": [
"last 1 year",
"> .2%",
"not dead",
"not Explorer > 0",
"not ExplorerMobile > 0",
"not BlackBerry > 0",
"not OperaMini all",
"not OperaMobile > 0"
],
"devDependencies": {
"@axe-core/playwright": "^4.11.0",
"@babel/core": "7.29.6",
"@babel/preset-env": "7.28.5",
"@babel/register": "7.28.3",
"@noble/hashes": "2.0.1",
"@nx/eslint": "23.2.1",
"@nx/vite": "23.2.1",
"@nx/vitest": "23.2.1",
"@ownclouders/babel-preset": "workspace:*",
"@ownclouders/eslint-config": "workspace:*",
"@ownclouders/prettier-config": "workspace:*",
"@ownclouders/tsconfig": "workspace:*",
"@playwright/test": "1.59.1",
"@types/luxon": "3.7.1",
"@types/mark.js": "8.11.12",
"@types/semver": "7.7.1",
"@types/uuid": "11.0.0",
"@vitejs/plugin-vue": "6.0.1",
"@vitest/coverage-v8": "4.1.5",
"@vitest/web-worker": "4.1.5",
"@vue/compiler-dom": "3.5.43",
"@vue/compiler-sfc": "3.5.43",
"@vue/test-utils": "2.4.6",
"axe-core": "^4.11.0",
"browserslist-to-esbuild": "^2.1.1",
"browserslist-useragent-regexp": "^4.1.3",
"commander": "14.0.2",
"debug": "^4.4.3",
"ejs": "4.0.1",
"eslint": "9.39.1",
"git-repo-info": "2.1.1",
"globals": "^16.5.0",
"happy-dom": "20.8.9",
"jimp": "^1.6.0",
"jsdom": "^27.2.0",
"jsqr": "^1.4.0",
"license-checker-rseidelsohn": "4.4.2",
"node-fetch": "3.3.2",
"nx": "^23.2.1",
"pino": "10.1.0",
"pino-pretty": "13.1.2",
"prettier": "^3.6.2",
"qs": "6.15.2",
"requirejs": "2.3.7",
"rollup-plugin-gzip": "^4.1.1",
"rollup-plugin-visualizer": "6.0.5",
"simple-git": "4.0.1",
"speakeasy": "^2.0.0",
"ts-node": "10.9.2",
"tslib": "2.8.1",
"typescript": "5.9.3",
"vite": "7.3.5",
"vite-plugin-environment": "^1.1.3",
"vite-plugin-node-polyfills": "0.24.0",
"vite-plugin-static-copy": "^3.1.4",
"vite-plugin-treat-umd-as-commonjs": "0.1.4",
"vitest": "^4.1.11",
"vitest-mock-extended": "3.1.0",
"vue": "3.5.43",
"vue-demi": "0.14.10",
"vue-tsc": "3.1.4",
"vue3-gettext": "^4.0.1"
},
"engines": {
"node": ">=24.15.0"
},
"packageManager": "pnpm@10.33.3",
"volta": {
"node": "24.15.0"
},
"pnpm": {
"overrides": {
"typescript": "5.9.3",
"nanoid": "^3.3.17",
"elliptic": "6.6.1",
"sha.js": "2.4.12",
"vitest": "4.1.11",
"@types/node": "24.13.2",
"@xmldom/xmldom": "0.8.15",
"flatted": "3.4.2",
"form-data": "4.0.6",
"immutable": "5.1.8",
"js-cookie": "3.0.7",
"linkify-it": "5.0.2",
"minimatch": "10.2.5",
"source-map-js": "1.2.2",
"brace-expansion": "5.0.12",
"ws": "8.21.0",
"js-yaml": "4.3.2",
"fast-uri": "3.1.8",
"browserslist": "4.28.7",
"axios": "1.20.0",
"smol-toml": "1.9.0",
"postcss": "8.5.23",
"postcss-selector-parser": "7.1.6",
"colord": "2.9.4",
"markdown-it": "14.3.1",
"esbuild": "0.28.1",
"dompurify": "3.4.16",
"qs": "6.16.0"
},
"patchedDependencies": {
"caf@15.0.1": "patches/caf@15.0.1.patch",
"portal-vue@3.0.0": "patches/portal-vue@3.0.0.patch",
"vue-select@4.0.0-beta.6": "patches/vue-select@4.0.0-beta.6.patch"
}
},
"dependencies": {
"@chevrotain/regexp-to-ast": "^11.2.0",
"crelt": "^1.0.6",
"mermaid": "^11.16.1",
"vscode-jsonrpc": "^8.2.1",
"vscode-languageserver-types": "^3.17.5"
}
}
View Git Blame Copy Permalink