diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index df0d00d..41a235b 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -21,6 +21,12 @@ jobs: with: fail-on-severity: high deny-licenses: GPL-3.0, AGPL-3.0, GPL-2.0 + # GHSA-qwww-vcr4-c8h2: react-router CSRF bypass, exploitable only via the + # unstable RSC (Server Components) APIs. Luma is a client-only SPA that + # never enables those APIs, so this is a false positive. The fix ships in + # react-router 8.3.0, which requires React >=19.2.7 (Luma is on React 18) - + # revisit this suppression when that upgrade happens. + allow-ghsas: GHSA-qwww-vcr4-c8h2 frontend: name: Frontend — type-check, lint, test & build @@ -55,7 +61,11 @@ jobs: run: pnpm test - name: Audit dependencies - run: pnpm audit --audit-level high + # GHSA-qwww-vcr4-c8h2: react-router CSRF bypass, exploitable only via the + # unstable RSC (Server Components) APIs, which this client-only SPA never + # enables. Fix ships in react-router 8.3.0, which requires React >=19.2.7 + # (Luma is on React 18) - revisit when that upgrade happens. + run: pnpm audit --audit-level high --ignore GHSA-qwww-vcr4-c8h2 - name: Build run: pnpm build diff --git a/frontend/package.json b/frontend/package.json index 4fb44e5..302233d 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -24,7 +24,7 @@ "react": "18.3.1", "react-dom": "18.3.1", "react-markdown": "10.1.0", - "react-router-dom": "7.17.0", + "react-router-dom": "7.18.1", "recharts": "2.15.0", "remark-gfm": "4.0.1", "tailwind-merge": "2.6.1", @@ -48,7 +48,7 @@ "eslint-plugin-react-hooks": "7.1.1", "eslint-plugin-react-refresh": "0.5.3", "jsdom": "29.1.1", - "postcss": "8.5.15", + "postcss": "8.5.20", "tailwindcss": "4.3.0", "typescript": "5.9.3", "typescript-eslint": "8.60.0", diff --git a/frontend/pnpm-lock.yaml b/frontend/pnpm-lock.yaml index 73f549c..266eea1 100644 --- a/frontend/pnpm-lock.yaml +++ b/frontend/pnpm-lock.yaml @@ -8,6 +8,9 @@ overrides: baseline-browser-mapping: 2.10.32 electron-to-chromium: 1.5.361 side-channel: 1.1.0 + brace-expansion@2: ^2.1.2 + brace-expansion@5: ^5.0.7 + fast-uri@3: ^3.1.4 importers: @@ -50,8 +53,8 @@ importers: specifier: 10.1.0 version: 10.1.0(@types/react@18.3.12)(react@18.3.1) react-router-dom: - specifier: 7.17.0 - version: 7.17.0(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + specifier: 7.18.1 + version: 7.18.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1) recharts: specifier: 2.15.0 version: 2.15.0(react-dom@18.3.1(react@18.3.1))(react@18.3.1) @@ -117,8 +120,8 @@ importers: specifier: 29.1.1 version: 29.1.1 postcss: - specifier: 8.5.15 - version: 8.5.15 + specifier: 8.5.20 + version: 8.5.20 tailwindcss: specifier: 4.3.0 version: 4.3.0 @@ -1771,12 +1774,12 @@ packages: bidi-js@1.0.3: resolution: {integrity: sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==} - brace-expansion@2.1.1: - resolution: {integrity: sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==} + brace-expansion@2.1.2: + resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==} - brace-expansion@5.0.6: - resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.8: + resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} + engines: {node: 20 || >=22} browserslist@4.28.2: resolution: {integrity: sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==} @@ -2132,8 +2135,8 @@ packages: fast-levenshtein@2.0.6: resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==} - fast-uri@3.1.2: - resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} + fast-uri@3.1.4: + resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==} fdir@6.5.0: resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==} @@ -2813,8 +2816,8 @@ packages: ms@2.1.3: resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==} - nanoid@3.3.12: - resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==} + nanoid@3.3.16: + resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -2899,8 +2902,8 @@ packages: resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==} engines: {node: '>= 0.4'} - postcss@8.5.15: - resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==} + postcss@8.5.20: + resolution: {integrity: sha512-lW616l85ucIQL+FocMmL7pQFPqBmwejrCMg+iPxyImlrANNJG9NHq/RkyCZopDhd8C3LA03PHRJDjkbGu8vvug==} engines: {node: ^10 || ^12 || >=14} prelude-ls@1.2.1: @@ -2949,15 +2952,15 @@ packages: '@types/react': '>=18' react: '>=18' - react-router-dom@7.17.0: - resolution: {integrity: sha512-fyU2yjGups/hE6Xz0I5ZYbVL8Gx29eCjgpHaRaTaVU+OOAdfRX05KsvyRm0GO8YQwOkhpU3MurW1jyMUJn+zSw==} + react-router-dom@7.18.1: + resolution: {integrity: sha512-KaZh+X/6UtEp28x51AUYZDMg9NGoz2ja3dNHa+ta/tk40vCzKhQ/RypCWBMLbmDr6//E24Vv5uPsrqXFozdkAg==} engines: {node: '>=20.0.0'} peerDependencies: react: '>=18' react-dom: '>=18' - react-router@7.17.0: - resolution: {integrity: sha512-FDELK7rTMlCHO5+reyXsPlmfr7N1F91lPHsWYfMEGQm/KQ+F4JFM8jGoeQDmDvdTs93Fw9aSilH+uKRb4/jXvQ==} + react-router@7.18.1: + resolution: {integrity: sha512-GDLgg3i3uM0aeJO3Fm+TCS+sDQ7gu12T6x0qdTEzcwqEfleci7JwugVNIF3U//0FWKnJT7ptG+20B2jfDqnZAg==} engines: {node: '>=20.0.0'} peerDependencies: react: '>=18' @@ -4821,7 +4824,7 @@ snapshots: '@alloc/quick-lru': 5.2.0 '@tailwindcss/node': 4.3.0 '@tailwindcss/oxide': 4.3.0 - postcss: 8.5.15 + postcss: 8.5.20 tailwindcss: 4.3.0 '@tanstack/query-core@5.101.0': {} @@ -5215,7 +5218,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.2 + fast-uri: 3.1.4 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -5298,11 +5301,11 @@ snapshots: dependencies: require-from-string: 2.0.2 - brace-expansion@2.1.1: + brace-expansion@2.1.2: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.6: + brace-expansion@5.0.8: dependencies: balanced-match: 4.0.4 @@ -5736,7 +5739,7 @@ snapshots: fast-levenshtein@2.0.6: {} - fast-uri@3.1.2: {} + fast-uri@3.1.4: {} fdir@6.5.0(picomatch@4.0.4): optionalDependencies: @@ -6601,17 +6604,17 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.6 + brace-expansion: 5.0.8 minimatch@5.1.9: dependencies: - brace-expansion: 2.1.1 + brace-expansion: 2.1.2 minipass@7.1.3: {} ms@2.1.3: {} - nanoid@3.3.12: {} + nanoid@3.3.16: {} natural-compare@1.4.0: {} @@ -6692,9 +6695,9 @@ snapshots: possible-typed-array-names@1.1.0: {} - postcss@8.5.15: + postcss@8.5.20: dependencies: - nanoid: 3.3.12 + nanoid: 3.3.16 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -6750,13 +6753,13 @@ snapshots: transitivePeerDependencies: - supports-color - react-router-dom@7.17.0(react-dom@18.3.1(react@18.3.1))(react@18.3.1): + react-router-dom@7.18.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1): dependencies: react: 18.3.1 react-dom: 18.3.1(react@18.3.1) - react-router: 7.17.0(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + react-router: 7.18.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1) - react-router@7.17.0(react-dom@18.3.1(react@18.3.1))(react@18.3.1): + react-router@7.18.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1): dependencies: cookie: 1.1.1 react: 18.3.1 @@ -7372,7 +7375,7 @@ snapshots: dependencies: lightningcss: 1.32.0 picomatch: 4.0.4 - postcss: 8.5.15 + postcss: 8.5.20 rolldown: 1.0.3 tinyglobby: 0.2.17 optionalDependencies: diff --git a/frontend/pnpm-workspace.yaml b/frontend/pnpm-workspace.yaml index fddab75..205423c 100644 --- a/frontend/pnpm-workspace.yaml +++ b/frontend/pnpm-workspace.yaml @@ -3,13 +3,18 @@ packages: allowBuilds: esbuild: true +auditConfig: + ignoreCves: + - GHSA-qwww-vcr4-c8h2 + +minimumReleaseAge: "72 hours" onlyBuiltDependencies: - esbuild overrides: baseline-browser-mapping: "2.10.32" + brace-expansion@2: "^2.1.2" + brace-expansion@5: "^5.0.7" electron-to-chromium: "1.5.361" + fast-uri@3: "^3.1.4" side-channel: "1.1.0" - -policies: - minimumReleaseAge: "72 hours"