mirror of
https://github.com/multica-ai/multica.git
synced 2026-06-17 03:38:32 +02:00
83ecad4789
Pin @xmldom/xmldom to ^0.8.13 in `pnpm.overrides` so every transitive resolution (currently @expo/plist@0.5.3 and plist@3.1.0, both pulled through expo) ships a patched build. All four lockfile entries move from 0.8.12 to 0.8.13. Closes the four high-severity advisories pnpm audit reports against the prior 0.8.12 resolution: - GHSA-2v35-w6hq-6mfw — uncontrolled recursion in serialization (DoS) - GHSA-f6ww-3ggp-fr8h — XML injection via DocumentType serialization - GHSA-x6wf-f3px-wcqx — node injection via processing-instruction - GHSA-j759-j44w-7fr8 — node injection via comment serialization Using `pnpm.overrides` (not a root direct dep) keeps the transitive fix scoped to the dependency graph and avoids implying that the multica codebase consumes xmldom directly. Verification: `pnpm audit --prod --audit-level high` no longer lists any @xmldom/xmldom advisories on this branch. Co-authored-by: multica-agent <github@multica.ai>
56 lines
1.9 KiB
JSON
56 lines
1.9 KiB
JSON
{
|
|
"name": "multica",
|
|
"version": "0.2.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev:web": "turbo dev --filter=@multica/web",
|
|
"dev:docs": "turbo dev --filter=@multica/docs",
|
|
"dev:desktop": "turbo dev --filter=@multica/desktop",
|
|
"dev:desktop:staging": "turbo dev:staging --filter=@multica/desktop",
|
|
"dev:mobile": "pnpm -C apps/mobile dev",
|
|
"dev:mobile:staging": "pnpm -C apps/mobile dev:staging",
|
|
"dev:mobile:prod": "pnpm -C apps/mobile dev:prod",
|
|
"ios:mobile": "pnpm -C apps/mobile ios",
|
|
"ios:mobile:staging": "pnpm -C apps/mobile ios:staging",
|
|
"ios:mobile:prod": "pnpm -C apps/mobile ios:prod",
|
|
"ios:mobile:device": "pnpm -C apps/mobile ios:device",
|
|
"ios:mobile:device:staging": "pnpm -C apps/mobile ios:device:staging",
|
|
"ios:mobile:device:staging:release": "pnpm -C apps/mobile ios:device:staging:release",
|
|
"ios:mobile:device:prod": "pnpm -C apps/mobile ios:device:prod",
|
|
"ios:mobile:device:prod:release": "pnpm -C apps/mobile ios:device:prod:release",
|
|
"build": "turbo build --filter=!@multica/mobile",
|
|
"typecheck": "turbo typecheck --filter=!@multica/mobile",
|
|
"test": "turbo test --filter=!@multica/mobile",
|
|
"lint": "turbo lint --filter=!@multica/mobile",
|
|
"clean": "turbo clean && rm -rf node_modules",
|
|
"ui:add": "cd packages/ui && npx shadcn@latest add",
|
|
"generate:reserved-slugs": "node scripts/generate-reserved-slugs.mjs"
|
|
},
|
|
"packageManager": "pnpm@10.28.2",
|
|
"pnpm": {
|
|
"onlyBuiltDependencies": [
|
|
"esbuild",
|
|
"electron"
|
|
],
|
|
"overrides": {
|
|
"@types/react": "catalog:",
|
|
"@types/react-dom": "catalog:",
|
|
"@xmldom/xmldom": "^0.8.13"
|
|
}
|
|
},
|
|
"devDependencies": {
|
|
"@playwright/test": "^1.58.2",
|
|
"@types/node": "catalog:",
|
|
"@types/pg": "^8.20.0",
|
|
"pg": "^8.20.0",
|
|
"turbo": "^2.5.4",
|
|
"typescript": "catalog:"
|
|
},
|
|
"dependencies": {
|
|
"expo": "~55.0.23",
|
|
"react": "19.2.0",
|
|
"react-native": "0.83.6"
|
|
}
|
|
}
|