mirror of
https://github.com/getpaseo/paseo.git
synced 2026-07-29 12:01:31 +00:00
9dd5c6e5f3
* Patch production dependency advisories
* ci: harden dependency installs with npm ci --ignore-scripts
- Replace npm install with npm ci --ignore-scripts across all workflows
to enforce lockfile parity and block dependency postinstall scripts.
- Run npm run postinstall explicitly after install so our root patch
script still applies (the only legitimate postinstall use in this
repo); dep lifecycle scripts stay blocked.
- Add lockfile-lint and npm audit signatures to the lint job to catch
registry-host tampering and verify cryptographic signatures.
- Regenerate package-lock.json to match bumped package.json versions.
* ci: drop --ignore-scripts; rely on npm ci + lockfile-lint + audit signatures
Lavamoat allow-scripts only traverses root deps; it can't see workspace
deps like electron, esbuild, sharp. Without proper monorepo support, an
allowlist would be incomplete and electron's binary download breaks.
Keep the rest of the security stack:
- npm ci (strict lockfile parity)
- lockfile-lint (resolved-host check)
- npm audit signatures (cryptographic verification)
Real script-blocking would need pnpm 10+ migration. Tracking separately.
* ci(nix-build): use PR head SHA so fork checkouts work
The previous `ref: ${{ github.head_ref || github.ref }}` made
actions/checkout fetch a branch name that only exists on the fork,
not origin. Use the PR head SHA instead — origin mirrors PR commits
via refs/pull/N/head, so this works for fork PRs without changing
the push-to-main auto-commit behavior.
---------
Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>
41 lines
1.1 KiB
JSON
41 lines
1.1 KiB
JSON
{
|
|
"name": "@getpaseo/website",
|
|
"version": "0.1.71",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "vite build",
|
|
"preview": "vite preview",
|
|
"typecheck": "tsgo --noEmit",
|
|
"deploy": "npm run build && wrangler deploy"
|
|
},
|
|
"dependencies": {
|
|
"@cloudflare/vite-plugin": "^1.29.1",
|
|
"@cloudflare/workers-types": "^4.20260317.1",
|
|
"@tanstack/react-router": "^1.166.4",
|
|
"@tanstack/react-start": "^1.166.4",
|
|
"framer-motion": "^12.35.2",
|
|
"lucide-react": "^1.7.0",
|
|
"react": "^19.1.4",
|
|
"react-dom": "^19.1.4",
|
|
"react-markdown": "^10.1.0",
|
|
"rehype-autolink-headings": "^7.1.0",
|
|
"rehype-pretty-code": "^0.14.3",
|
|
"rehype-slug": "^6.0.0",
|
|
"remark-gfm": "^4.0.1",
|
|
"shiki": "^4.0.2",
|
|
"wrangler": "^4.75.0"
|
|
},
|
|
"devDependencies": {
|
|
"@tailwindcss/vite": "^4.1.8",
|
|
"@types/node": "^22.15.29",
|
|
"@types/react": "^19.1.6",
|
|
"@types/react-dom": "^19.1.5",
|
|
"@vitejs/plugin-react": "^4.5.1",
|
|
"typescript": "^5.9.3",
|
|
"vite": "^7.3.3",
|
|
"vite-tsconfig-paths": "^5.1.4"
|
|
}
|
|
}
|