mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-09-30 03:01:21 +02:00
maziggy
60bf1bbab2
- postcss 8.5.15 -> 8.5.23 (GHSA-r28c-9q8g-f849, source-map path traversal) - brace-expansion override ^5.0.7 -> ^5.0.8 (GHSA-mh99-v99m-4gvg, DoS) react-router: pin react-router-dom to exact 7.18.1 (direct dep) and react-router to 7.18.1 via overrides (transitive). 7.18.1 is the most-patched 7.x -- it clears 14 advisories that older 7.x releases carry, several reachable from a SPA (open- redirect XSS in Link/useNavigate, route-matching DoS). The one remaining advisory, GHSA-qwww-vcr4-c8h2, is RSC-mode-only; Bambuddy is a Vite SPA using BrowserRouter with no RSC runtime (@react-router/server not installed), so the path is unreachable. The only version that fully clears npm audit is the 8.3.0 major (no react-router-dom 8.x exists; it needs migrating 50 import sites plus a React peer bump), deferred as its own change. Because a version pin can't stop npm from reporting the theoretical 7.11.0 downgrade as fixAvailable, the ci.yml (hard) and security.yml (nightly issue) audit gates gain a narrow, documented allowlist keyed on the GHSA id. It resolves the react-router-dom -> react-router advisory chain and stays fail-closed: a different advisory on react-router still fails the gate, and an isSemVerMajor guard drops the exemption the moment a non-major fix ships, forcing us to take it.
React + TypeScript + Vite
This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
Currently, two official plugins are available:
- @vitejs/plugin-react uses Babel (or oxc when used in rolldown-vite) for Fast Refresh
- @vitejs/plugin-react-swc uses SWC for Fast Refresh
React Compiler
The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see this documentation.
Expanding the ESLint configuration
If you are developing a production application, we recommend updating the configuration to enable type-aware lint rules:
export default defineConfig([
globalIgnores(['dist']),
{
files: ['**/*.{ts,tsx}'],
extends: [
// Other configs...
// Remove tseslint.configs.recommended and replace with this
tseslint.configs.recommendedTypeChecked,
// Alternatively, use this for stricter rules
tseslint.configs.strictTypeChecked,
// Optionally, add this for stylistic rules
tseslint.configs.stylisticTypeChecked,
// Other configs...
],
languageOptions: {
parserOptions: {
project: ['./tsconfig.node.json', './tsconfig.app.json'],
tsconfigRootDir: import.meta.dirname,
},
// other options...
},
},
])
You can also install eslint-plugin-react-x and eslint-plugin-react-dom for React-specific lint rules:
// eslint.config.js
import reactX from 'eslint-plugin-react-x'
import reactDom from 'eslint-plugin-react-dom'
export default defineConfig([
globalIgnores(['dist']),
{
files: ['**/*.{ts,tsx}'],
extends: [
// Other configs...
// Enable lint rules for React
reactX.configs['recommended-typescript'],
// Enable lint rules for React DOM
reactDom.configs.recommended,
],
languageOptions: {
parserOptions: {
project: ['./tsconfig.node.json', './tsconfig.app.json'],
tsconfigRootDir: import.meta.dirname,
},
// other options...
},
},
])