mirror of
https://github.com/owncloud/ocis.git
synced 2026-10-23 23:29:02 +03:00
b9077d96d8
* chore(deps): consolidate dependency and security bumps Dependabot PRs applied: - #12878 qs 6.15.2 -> 6.16.0 (web/web-runtime) - #13013 alpine 3.24.1 -> 3.24.2 - #13061 actions/checkout -> v7.0.1 (missed instance in k8s.yml) - #13062 actions/setup-node -> v7.0.0 (missed instance in k8s.yml) - #13075 simple-git 3.36.0 -> 4.0.1 (security) - #13076 katex 0.16.45 -> 0.18.2+ (security) - #13077 dompurify 3.4.13 -> 3.4.16 (security) - #13079 go deps minor-and-patch group, 18 updates (opa 1.19.0 -> 1.21.1, otel 1.46 -> 1.47, bleve, govips, grpc-gateway, lico, tablewriter, logrus, gjson, x/exp, x/image, genproto, etc.) Skipped (already satisfied on master): #12513, #12624, #12625, #12633 Manual security bumps via pnpm.overrides (no dependabot PR existed): - axios -> 1.20.0 - smol-toml -> 1.9.0 - postcss -> 8.5.23 - postcss-selector-parser -> 7.1.6 - colord -> 2.9.4 - unhead -> 2.1.13 - markdown-it -> 14.3.1 - esbuild -> 0.28.1 - brace-expansion 5.0.11 -> 5.0.12 Not fixable: sprintf-js and elliptic have no patched version released upstream yet; left as-is. go build and pnpm install verified clean. * chore(deps): fix residual transitive vulns found by trivy trivy flagged duplicate/stale resolutions that survived the earlier override pass: dompurify (3.4.12 -> 3.4.16), qs (6.14.2 -> 6.16.0), and fast-uri (3.1.7 -> 3.1.8, CVE-2026-86472). Added/bumped pnpm.overrides accordingly. trivy fs scan of web/pnpm-lock.yaml now clean. * chore(deps): bump reva to bac0e1ee144ab853a81c6b02142032f102dd245a Pins github.com/owncloud/reva/v2 to bac0e1ee144ab853a81c6b02142032f102dd245a, pulling in its go-playground/locales and huandu/xstrings version bumps. Appends this PR to changelog/unreleased/bump-reva.md. go build ./... verified clean after go mod vendor resync. * fix(ci): revert unhead override, breaks web build * revert: keep k8s.yml actions/checkout and setup-node pinned
55 lines
1.4 KiB
JSON
55 lines
1.4 KiB
JSON
{
|
|
"name": "web-runtime",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"description": "ownCloud web runtime",
|
|
"license": "Apache-2.0",
|
|
"scripts": {
|
|
"test:unit": "NODE_OPTIONS=--unhandled-rejections=throw vitest"
|
|
},
|
|
"dependencies": {
|
|
"@casl/ability": "6.8.1",
|
|
"@casl/vue": "^2.2.6",
|
|
"@microsoft/fetch-event-source": "2.0.1",
|
|
"@ownclouders/design-system": "workspace:^",
|
|
"@ownclouders/web-client": "workspace:*",
|
|
"@ownclouders/web-pkg": "workspace:*",
|
|
"@sentry/vue": "10.51.0",
|
|
"@uppy/core": "5.2.0",
|
|
"@uppy/drop-target": "4.1.0",
|
|
"@uppy/tus": "5.1.1",
|
|
"@uppy/utils": "7.2.0",
|
|
"@uppy/xhr-upload": "5.2.0",
|
|
"@vueuse/core": "14.3.0",
|
|
"@vueuse/head": "2.0.0",
|
|
"deepmerge": "4.3.1",
|
|
"email-validator": "2.0.4",
|
|
"dompurify": "^3.4.13",
|
|
"focus-trap-vue": "^4.1.0",
|
|
"focus-trap": "8.2.0",
|
|
"fuse.js": "7.3.0",
|
|
"lodash-es": "4.18.1",
|
|
"luxon": "3.7.2",
|
|
"mark.js": "8.11.1",
|
|
"oidc-client-ts": "^3.5.0",
|
|
"p-queue": "9.2.0",
|
|
"pinia": "3.0.4",
|
|
"portal-vue": "3.0.0",
|
|
"promise": "^8.3.0",
|
|
"qs": "6.16.0",
|
|
"semver": "7.7.4",
|
|
"utf8": "^3.0.0",
|
|
"uuid": "14.0.0",
|
|
"vue-concurrency": "5.0.3",
|
|
"vue-router": "5.0.6",
|
|
"vue": "3.5.43",
|
|
"vue3-gettext": "^4.0.1",
|
|
"webdav": "5.9.0",
|
|
"xml-js": "^1.6.11",
|
|
"zod": "4.3.6"
|
|
},
|
|
"devDependencies": {
|
|
"@ownclouders/web-test-helpers": "workspace:*"
|
|
}
|
|
}
|