Repository navigation
Public-ready: MIT license, security and contributing docs; upgrade web dependencies - #15
Merged
Merged
Conversation
…b dependencies Adds LICENSE (MIT), SECURITY.md (private reporting through GitHub, scope) and CONTRIBUTING.md (setup, the checks CI runs, branch and PR conventions). Upgrades the web app to clear the open Dependabot alerts on main: - astro 5.18 -> 7.4.2 (with @astrojs/react 7), which clears the critical AVIF remote-code-execution and the high XSS and SSRF advisories; - vitest 2.1 -> 4.1.12, which clears the critical file-read advisory and the @vitest/mocker advisories (tinypool, vite and esbuild come in with these); - @playwright/test 1.48 -> 1.64.1, which clears the SSL advisory; - vite is now 8.3.5 and sharp 0.35.5, which clear their advisories. Astro 7 needs Node 22.23 or newer, so the web CI job moves to Node 22. Astro 7's preview runs as a daemon, which Playwright reads as an early exit, so the smoke test serves the built dist/ with a plain static server instead. Checks run locally after the upgrade: typecheck, lint, 4 unit tests, the build, and all 9 Playwright tests.
The runner's latest Node 22 (22.23.3) is below the 22.23.4 that Astro 7 requires, so the typecheck step refused to run.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes the repo ready to be public and clears the open Dependabot alerts on main.
LICENSE(MIT),SECURITY.md(report privately through GitHub's Security tab),CONTRIBUTING.md(setup, the checks CI runs, branch and PR rules).@astrojs/react7), Vitest 2.1 to 4.1.12,@playwright/testto 1.64.1. This clears the critical and high alerts on Astro, Vitest, Tinypool (removed), Vite, Playwright and sharp.dist/with a static server, since Astro 7's preview daemonises and Playwright reads that as an early exit.Checks run locally: typecheck, lint, unit tests, build, and all 9 Playwright tests.