jcoffey-dev
520de85d12
GHSA-82fw-gwwq-j7x9 -- arbitrary file read through @vitest/mocker's redirect mock -- has no fix in the 3.x line. The patched versions are 4.1.11 and 5.0.0-rc.2, so clearing it means the major. vite stays at 6.4.3: vitest 4 accepts ^6, and nothing outside devDependencies moves. The bump surfaced a bug of ours rather than one of vitest's. vi.spyOn now hands back the spy already installed on a method instead of wrapping it in a fresh one, so a spy installed in beforeEach keeps its call count across tests. compose-from-share expected two uploads and saw three: its own two, plus the one from the test before it. The assertion was only ever passing because each test happened to get a new spy. Both suites now restore between tests, which is what the other five spying suites already do. webpush had the same leak with no assertion close enough to catch it.
35 lines
847 B
JSON
35 lines
847 B
JSON
{
|
|
"name": "@ihasmail/web",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"license": "AGPL-3.0-or-later",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc -p tsconfig.json --noEmit && vite build",
|
|
"preview": "vite preview",
|
|
"typecheck": "tsc -p tsconfig.json --noEmit",
|
|
"test": "vitest run"
|
|
},
|
|
"dependencies": {
|
|
"@tanstack/react-virtual": "^3.13.2",
|
|
"dompurify": "^3.2.4",
|
|
"lucide-react": "^0.477.0",
|
|
"marked": "^18.0.11",
|
|
"qrcode-generator": "^2.0.4",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0",
|
|
"wouter": "^3.6.0",
|
|
"zustand": "^5.0.3"
|
|
},
|
|
"devDependencies": {
|
|
"@types/react": "^19.0.10",
|
|
"@types/react-dom": "^19.0.4",
|
|
"@vitejs/plugin-react": "^4.3.4",
|
|
"jsdom": "^26.0.0",
|
|
"typescript": "^5.7.3",
|
|
"vite": "^6.2.0",
|
|
"vitest": "^4.1.11"
|
|
}
|
|
}
|