Repository navigation
build: remove vulnerable glob dependency from UI bundling - #54
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The UI build included the unpatched high-severity
bracesadvisory through an unusedvite-plugin-singlefile→micromatchpath. Replace that plugin with a small fixed-entry Vite inliner and remove the vulnerable dependency closure. It rejects incomplete or extra output, preserves script/link attributes and raw-text safety, and keeps both production HTML and server bundles byte-identical to main.Validation: two real Vite build regression tests; 172 unit tests; 7 product evals; 32 browser tests plus five reliability repeats of the unit suite and 160 browser cases; complete dev+production npm audit reports zero advisories. Both hosted checks are green on
54dd06802231fc7b95fbbb4d1ed4d986341c7f28. Independent source review passed.Native self-tests, build, validator, and local bundle-readiness passed. The broader local gauntlet retains separate failed native UI/full-screen receipts: this host's global accessibility hit lookup returns the desktop beneath the visible launcher, and a separate synthetic pointer diagnostic did not open the card. Native source is unchanged by this PR; temporary diagnostics were restored. This dependency-only merge does not claim a full native gauntlet pass, installed-native acceptance, or binary release readiness.