mirror of
https://github.com/Unleash/unleash.git
synced 2024-12-22 19:07:54 +01:00
011ebe2f79
This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [vite](https://vitejs.dev) ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`5.4.2` -> `5.4.6`](https://renovatebot.com/diffs/npm/vite/5.4.2/5.4.6) | [![age](https://developer.mend.io/api/mc/badges/age/npm/vite/5.4.6?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/vite/5.4.6?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/vite/5.4.2/5.4.6?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/5.4.2/5.4.6?slim=true)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2024-45811](https://redirect.github.com/vitejs/vite/security/advisories/GHSA-9cwx-2883-4wfx) ### Summary The contents of arbitrary files can be returned to the browser. ### Details `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. ### PoC ```sh $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev $ echo "top secret content" > /tmp/secret.txt # expected behaviour $ curl "http://localhost:5173/@​fs/tmp/secret.txt" <body> <h1>403 Restricted</h1> <p>The request url "/tmp/secret.txt" is outside of Vite serving allow list. # security bypassed $ curl "http://localhost:5173/@​fs/tmp/secret.txt?import&raw" export default "top secret content\n" //# sourceMappingURL=data:application/json;base64,eyJ2... ``` --- ### Release Notes <details> <summary>vitejs/vite (vite)</summary> ### [`v5.4.6`](https://redirect.github.com/vitejs/vite/releases/tag/v5.4.6) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v5.4.5...v5.4.6) Please refer to [CHANGELOG.md](https://redirect.github.com/vitejs/vite/blob/v5.4.6/packages/vite/CHANGELOG.md) for details. ### [`v5.4.5`](https://redirect.github.com/vitejs/vite/releases/tag/v5.4.5) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v5.4.4...v5.4.5) Please refer to [CHANGELOG.md](https://redirect.github.com/vitejs/vite/blob/v5.4.5/packages/vite/CHANGELOG.md) for details. ### [`v5.4.4`](https://redirect.github.com/vitejs/vite/releases/tag/v5.4.4) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v5.4.3...v5.4.4) Please refer to [CHANGELOG.md](https://redirect.github.com/vitejs/vite/blob/v5.4.4/packages/vite/CHANGELOG.md) for details. ### [`v5.4.3`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small543-2024-09-03-small) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v5.4.2...v5.4.3) - fix: allow getting URL of JS files in publicDir ([#​17915](https://redirect.github.com/vitejs/vite/issues/17915)) ([943ece1](943ece177e
)), closes [#​17915](https://redirect.github.com/vitejs/vite/issues/17915) - fix: cjs warning respect the logLevel flag ([#​17993](https://redirect.github.com/vitejs/vite/issues/17993)) ([dc3c14f](dc3c14f39f
)), closes [#​17993](https://redirect.github.com/vitejs/vite/issues/17993) - fix: improve CJS warning trace information ([#​17926](https://redirect.github.com/vitejs/vite/issues/17926)) ([5c5f82c](5c5f82c84b
)), closes [#​17926](https://redirect.github.com/vitejs/vite/issues/17926) - fix: only remove entry assets handled by Vite core ([#​17916](https://redirect.github.com/vitejs/vite/issues/17916)) ([ebfaa7e](ebfaa7e601
)), closes [#​17916](https://redirect.github.com/vitejs/vite/issues/17916) - fix: waitForRequestIdle locked ([#​17982](https://redirect.github.com/vitejs/vite/issues/17982)) ([ad13760](ad1376018a
)), closes [#​17982](https://redirect.github.com/vitejs/vite/issues/17982) - fix(css): fix directory index import in sass modern api ([#​17960](https://redirect.github.com/vitejs/vite/issues/17960)) ([9b001ba](9b001baa70
)), closes [#​17960](https://redirect.github.com/vitejs/vite/issues/17960) - fix(css): fix sass `file://` reference ([#​17909](https://redirect.github.com/vitejs/vite/issues/17909)) ([561b940](561b940f6f
)), closes [#​17909](https://redirect.github.com/vitejs/vite/issues/17909) - fix(css): fix sass modern source map ([#​17938](https://redirect.github.com/vitejs/vite/issues/17938)) ([d428e7e](d428e7e3a0
)), closes [#​17938](https://redirect.github.com/vitejs/vite/issues/17938) - fix(deps): bump tsconfck ([#​17990](https://redirect.github.com/vitejs/vite/issues/17990)) ([8c661b2](8c661b20e9
)), closes [#​17990](https://redirect.github.com/vitejs/vite/issues/17990) - fix(html): rewrite assets url in <template> ([#​17988](https://redirect.github.com/vitejs/vite/issues/17988)) ([413c86a](413c86aa97
)), closes [#​17988](https://redirect.github.com/vitejs/vite/issues/17988) - fix(preload): add crossorigin attribute in CSS link tags ([#​17930](https://redirect.github.com/vitejs/vite/issues/17930)) ([15871c7](15871c75e0
)), closes [#​17930](https://redirect.github.com/vitejs/vite/issues/17930) - chore: reduce diffs with v6 branch ([#​17942](https://redirect.github.com/vitejs/vite/issues/17942)) ([bf9065a](bf9065aa13
)), closes [#​17942](https://redirect.github.com/vitejs/vite/issues/17942) - chore(deps): update all non-major dependencies ([#​17945](https://redirect.github.com/vitejs/vite/issues/17945)) ([cfb621e](cfb621e7a5
)), closes [#​17945](https://redirect.github.com/vitejs/vite/issues/17945) - chore(deps): update all non-major dependencies ([#​17991](https://redirect.github.com/vitejs/vite/issues/17991)) ([0ca53cf](0ca53cff9f
)), closes [#​17991](https://redirect.github.com/vitejs/vite/issues/17991) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Europe/Madrid, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Unleash/unleash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC44MC4wIiwidXBkYXRlZEluVmVyIjoiMzguODAuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
163 lines
6.1 KiB
JSON
163 lines
6.1 KiB
JSON
{
|
|
"name": "unleash-frontend-local",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"files": [
|
|
"index.js",
|
|
"build"
|
|
],
|
|
"engines": {
|
|
"node": ">=18"
|
|
},
|
|
"scripts": {
|
|
"build": "yarn run lint:material:icons && vite build",
|
|
"dev": "vite",
|
|
"start": "vite",
|
|
"start:prod": "vite build && vite preview",
|
|
"start:sandbox": "UNLEASH_API=https://sandbox.getunleash.io/ospro yarn run start",
|
|
"start:sandbox:enterprise": "UNLEASH_API=https://sandbox.getunleash.io/ VITE_TEST_REDIRECT=true UNLEASH_BASE_PATH=/enterprise/ yarn run start",
|
|
"start:demo2": "UNLEASH_API=https://sandbox.getunleash.io/ UNLEASH_BASE_PATH=/demo2/ yarn run start",
|
|
"start:enterprise": "UNLEASH_API=https://unleash.herokuapp.com VITE_TEST_REDIRECT=true yarn run start",
|
|
"start:demo": "UNLEASH_BASE_PATH=/demo/ UNLEASH_API=https://app.unleash-hosted.com/ yarn run start",
|
|
"test": "NODE_OPTIONS=\"${NODE_OPTIONS:-0} --no-experimental-fetch\" vitest run",
|
|
"test:snapshot": "NODE_OPTIONS=\"${NODE_OPTIONS:-0} --no-experimental-fetch\" yarn test -u",
|
|
"test:watch": "NODE_OPTIONS=\"${NODE_OPTIONS:-0} --no-experimental-fetch\" vitest watch",
|
|
"lint:material:icons": "./check-imports.rc",
|
|
"lint": "biome lint src --apply",
|
|
"lint:check": "biome check src",
|
|
"fmt": "biome format src --write",
|
|
"fmt:check": "biome check src",
|
|
"ts:check": "tsc",
|
|
"e2e": "NODE_OPTIONS=\"${NODE_OPTIONS:-} --no-experimental-fetch\" yarn run cypress open --config baseUrl='http://localhost:3000' --env AUTH_USER=admin,AUTH_PASSWORD=unleash4all",
|
|
"e2e:oss": "yarn --cwd frontend run cypress run --spec \"cypress/oss/**/*.spec.ts\" --config baseUrl=\"http://localhost:${EXPOSED_PORT:-4242}\" --env AUTH_USER=admin,AUTH_PASSWORD=unleash4all",
|
|
"e2e:heroku": "NODE_OPTIONS=\"${NODE_OPTIONS:-} --no-experimental-fetch\" yarn run cypress open --config baseUrl='https://unleash.herokuapp.com' --env AUTH_USER=admin,AUTH_PASSWORD=unleash4all",
|
|
"gen:api": "NODE_OPTIONS=\"${NODE_OPTIONS:-} --no-experimental-fetch\" orval --config orval.config.js",
|
|
"gen:api:demo": "NODE_OPTIONS=\"${NODE_OPTIONS:-} --no-experimental-fetch\" UNLEASH_OPENAPI_URL=https://app.unleash-hosted.com/demo/docs/openapi.json yarn run gen:api",
|
|
"gen:api:sandbox": "NODE_OPTIONS=\"${NODE_OPTIONS:-} --no-experimental-fetch\" UNLEASH_OPENAPI_URL=https://sandbox.getunleash.io/demo2/docs/openapi.json yarn run gen:api",
|
|
"gen:api:clean": "yarn gen:api && rm -rf src/openapi/apis && sed -i.bak '1q' src/openapi/index.ts && rm src/openapi/index.ts.bak"
|
|
},
|
|
"devDependencies": {
|
|
"@biomejs/biome": "1.8.3",
|
|
"@codemirror/lang-json": "6.0.1",
|
|
"@emotion/react": "11.11.4",
|
|
"@emotion/styled": "11.11.5",
|
|
"@mui/icons-material": "5.15.3",
|
|
"@mui/lab": "5.0.0-alpha.159",
|
|
"@mui/material": "5.15.3",
|
|
"@mui/x-date-pickers": "^7.0.0",
|
|
"@tanstack/react-table": "^8.10.7",
|
|
"@testing-library/dom": "8.20.1",
|
|
"@testing-library/jest-dom": "6.5.0",
|
|
"@testing-library/react": "13.4.0",
|
|
"@testing-library/user-event": "14.5.2",
|
|
"@types/css-mediaquery": "^0.1.4",
|
|
"@types/debounce": "1.2.4",
|
|
"@types/deep-diff": "1.0.5",
|
|
"@types/jest": "29.5.12",
|
|
"@types/lodash.clonedeep": "4.5.9",
|
|
"@types/lodash.isequal": "^4.5.8",
|
|
"@types/lodash.mapvalues": "^4.6.9",
|
|
"@types/lodash.omit": "4.5.9",
|
|
"@types/node": "^20.12.12",
|
|
"@types/react": "18.3.5",
|
|
"@types/react-dom": "18.3.0",
|
|
"@types/react-router-dom": "5.3.3",
|
|
"@types/react-table": "7.7.20",
|
|
"@types/react-test-renderer": "18.3.0",
|
|
"@types/semver": "7.5.8",
|
|
"@types/uuid": "^9.0.0",
|
|
"@uiw/codemirror-theme-duotone": "4.23.2",
|
|
"@uiw/react-codemirror": "4.23.1",
|
|
"@vitejs/plugin-react": "4.3.1",
|
|
"cartesian": "^1.0.1",
|
|
"chart.js": "3.9.1",
|
|
"chartjs-adapter-date-fns": "3.0.0",
|
|
"chartjs-plugin-annotation": "2.2.1",
|
|
"classnames": "2.5.1",
|
|
"copy-to-clipboard": "3.3.3",
|
|
"countries-and-timezones": "^3.4.0",
|
|
"css-mediaquery": "^0.1.2",
|
|
"cypress": "13.14.2",
|
|
"cypress-vite": "^1.4.0",
|
|
"date-fns": "2.30.0",
|
|
"date-fns-tz": "^2.0.0",
|
|
"debounce": "2.1.0",
|
|
"deep-diff": "1.0.2",
|
|
"dequal": "2.0.3",
|
|
"fast-json-patch": "3.1.1",
|
|
"http-proxy-middleware": "2.0.6",
|
|
"immer": "9.0.21",
|
|
"jsdom": "23.2.0",
|
|
"lodash.clonedeep": "4.5.0",
|
|
"lodash.isequal": "^4.5.0",
|
|
"lodash.mapvalues": "^4.6.0",
|
|
"lodash.omit": "4.5.0",
|
|
"millify": "^6.0.0",
|
|
"msw": "2.4.1",
|
|
"pkginfo": "0.4.1",
|
|
"plausible-tracker": "0.3.9",
|
|
"prop-types": "15.8.1",
|
|
"react": "18.3.1",
|
|
"react-archer": "4.4.0",
|
|
"react-chartjs-2": "4.3.1",
|
|
"react-confetti": "^6.1.0",
|
|
"react-dom": "18.3.1",
|
|
"react-dropzone": "14.2.3",
|
|
"react-error-boundary": "3.1.4",
|
|
"react-hooks-global-state": "2.1.0",
|
|
"react-joyride": "^2.5.3",
|
|
"react-markdown": "^8.0.4",
|
|
"react-router-dom": "6.16.0",
|
|
"react-table": "7.8.0",
|
|
"react-test-renderer": "18.3.1",
|
|
"sass": "1.77.8",
|
|
"semver": "7.6.3",
|
|
"swr": "2.2.5",
|
|
"tss-react": "4.9.12",
|
|
"typescript": "5.4.5",
|
|
"use-query-params": "^2.2.1",
|
|
"vanilla-jsoneditor": "^0.23.0",
|
|
"vite": "5.4.6",
|
|
"vite-plugin-env-compatible": "2.0.1",
|
|
"vite-plugin-svgr": "3.3.0",
|
|
"vite-tsconfig-paths": "4.3.2",
|
|
"vitest": "1.4.0",
|
|
"whatwg-fetch": "3.6.20"
|
|
},
|
|
"optionalDependencies": {
|
|
"orval": "^6.17.0"
|
|
},
|
|
"resolutions": {
|
|
"@codemirror/state": "6.4.1",
|
|
"@xmldom/xmldom": "^0.9.0",
|
|
"json5": "^2.2.2",
|
|
"vite": "5.4.6",
|
|
"semver": "7.6.3",
|
|
"ws": "^8.18.0",
|
|
"@types/react": "18.3.5"
|
|
},
|
|
"jest": {
|
|
"moduleNameMapper": {
|
|
"\\.(jpg|jpeg|png|gif|eot|otf|webp|ttf|woff|woff2|mp4|webm|wav|mp3|m4a|aac|oga)$": "<rootDir>/src/__mocks__/fileMock.js",
|
|
"\\.svg": "<rootDir>/src/__mocks__/svgMock.js",
|
|
"\\.(css|scss)$": "identity-obj-proxy"
|
|
}
|
|
},
|
|
"browserslist": {
|
|
"production": [
|
|
">0.2%",
|
|
"not dead",
|
|
"not op_mini all"
|
|
],
|
|
"development": [
|
|
"last 1 chrome version",
|
|
"last 1 firefox version",
|
|
"last 1 safari version"
|
|
]
|
|
},
|
|
"packageManager": "yarn@4.4.1",
|
|
"dependencies": {
|
|
"json-2-csv": "^5.5.5"
|
|
}
|
|
}
|