Martin Vogel
a3336bf346
- graph-ui: bump vite ^6.4.2 -> ^6.4.3 and add overrides pinning the transitive form-data >=4.0.6 and @babel/core >=7.29.6 (all dev-scope build/test deps, not shipped in the binary). Clears the 4 open Dependabot alerts and Scorecard's VulnerabilitiesID. `npm audit` now reports 0 vulnerabilities. - codeql.yml: move `security-events: write` from the workflow top level to the `analyze` job (top level is now `contents: read`), resolving Scorecard's TokenPermissionsID least-privilege finding. CodeQL still uploads results from the job-scoped token. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
47 lines
1.2 KiB
JSON
47 lines
1.2 KiB
JSON
{
|
|
"name": "graph-ui",
|
|
"private": true,
|
|
"version": "0.1.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc -b && vite build",
|
|
"preview": "vite preview",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:coverage": "vitest run --coverage"
|
|
},
|
|
"dependencies": {
|
|
"@react-three/drei": "^10.7.0",
|
|
"@react-three/fiber": "^9.5.0",
|
|
"@react-three/postprocessing": "^3.0.4",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"lucide-react": "^0.577.0",
|
|
"postprocessing": "^6.38.3",
|
|
"radix-ui": "^1.4.3",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0",
|
|
"tailwind-merge": "^3.5.0",
|
|
"three": "~0.183.0"
|
|
},
|
|
"devDependencies": {
|
|
"@tailwindcss/vite": "^4.2.1",
|
|
"@testing-library/jest-dom": "^6.6.0",
|
|
"@testing-library/react": "^16.1.0",
|
|
"@types/react": "^19.0.0",
|
|
"@types/react-dom": "^19.0.0",
|
|
"@types/three": "~0.183.0",
|
|
"@vitejs/plugin-react": "^4.3.0",
|
|
"jsdom": "^25.0.0",
|
|
"tailwindcss": "^4.1.0",
|
|
"typescript": "^5.7.0",
|
|
"vite": "^6.4.3",
|
|
"vitest": "^4.1.0"
|
|
},
|
|
"overrides": {
|
|
"form-data": ">=4.0.6",
|
|
"@babel/core": ">=7.29.6"
|
|
}
|
|
}
|