ngcp-csc-ui

Author SHA1 Message Date

Author	SHA1	Message	Date
Debora Crescenzo	822155ce0c	MT#64579 Reduce npm audit vulnerabilities from 132 to 30 - Removed `crypto-browserify` from package.json and quasar.config.js (unused webpack polyfill that was bundling vulnerable bn.js and elliptic into the production build) Bumped up packages: * glob * globals * jest * @quasar/app-webpack Yarn resolutions added - `serialize-javascript: ^7.0.3` — fixes high-severity RCE vulnerability via RegExp.flags/Date.toISOString() (CVE in terser-webpack-plugin and @quasar/ssr-helpers paths) - `/postcss-svgo/svgo: ^4.0.1` — fixes high-severity Billion Laughs DoS (XML entity expansion) in cssnano's SVG optimization pipeline - `dot-object/minimatch: ^3.1.2` — fixes high-severity ReDoS in dot-object's glob dependency - `/flatted: 3.4.0` — fixes high-severity unbounded recursion DoS in eslint and eslint-webpack-plugin's caching layer What remains (30 vulnerabilities — all upstream-blocked) The remaining vulnerabilities are entirely confined to dev-only tooling and cannot be fixed without upstream releases: - minimatch ReDoS across jest, @vue/test-utils, jest-serializer-vue, @quasar/app-webpack, @quasar/quasar-app-extension-testing-unit-jest - ajv ReDoS across eslint, eslint-webpack-plugin, @quasar/app-webpack - webpack SSRF (buildHttp feature, not used in this project) - qs DoS in webpack-dev-server's express (local dev only) - esbuild dev server CORS issue (local dev only) - vue-template-compiler XSS (no patch available upstream) - tmp symlink issue, @tootallnate/once control flow (test tooling only) Change-Id: I72f34757538f97bb3495a57d7f0263df58102f1e (cherry picked from commit `1ebe3c0683`) (cherry picked from commit `0cb639dc46`)	2 months ago
Debora Crescenzo	72d36d22ab	MT#63046 Update @quasar/app-webpack and relevant libs This update introduced many breaking changes. Listed here the most important ones: * quasar.conf.js file has been renamed quasar.config.js. * Quasar v4 replaced the old /src/index.template.html with a new /index.html at the root of the project. The special comment <!-- quasar:entry-point --> is used to inject scripts/styles automatically. * Use setupMiddlewares instead of onBeforeSetupMiddleware. * proxy is now an array of proxy config objects. * Dropped support for Vuex. We can still use Vuex as any Vue plugin, but we have to manage everything (installing the store, no store parameter in boot files, etc.). We'll migrate to Pinia asap. * Updated postcssrc according to docs Change-Id: I585a3e2d17f666d9ca2773fa446d644f0fc201a2	10 months ago

Debora Crescenzo

MT#64579 Reduce npm audit vulnerabilities from 132 to 30

- Removed `crypto-browserify` from package.json and quasar.config.js
  (unused webpack polyfill that was bundling vulnerable bn.js and
  elliptic into the production build)

Bumped up packages:
* glob
* globals
* jest
* @quasar/app-webpack

Yarn resolutions added
- `serialize-javascript: ^7.0.3` — fixes high-severity RCE vulnerability
  via RegExp.flags/Date.toISOString() (CVE in terser-webpack-plugin and
  @quasar/ssr-helpers paths)
- `**/postcss-svgo/svgo: ^4.0.1` — fixes high-severity Billion Laughs
  DoS (XML entity expansion) in cssnano's SVG optimization pipeline
- `dot-object/minimatch: ^3.1.2` — fixes high-severity ReDoS in
  dot-object's glob dependency
- `**/flatted: 3.4.0` — fixes high-severity unbounded recursion DoS
  in eslint and eslint-webpack-plugin's caching layer

What remains (30 vulnerabilities — all upstream-blocked)
The remaining vulnerabilities are entirely confined to dev-only
tooling and cannot be fixed without upstream releases:
- minimatch ReDoS across jest, @vue/test-utils, jest-serializer-vue,
  @quasar/app-webpack, @quasar/quasar-app-extension-testing-unit-jest
- ajv ReDoS across eslint, eslint-webpack-plugin, @quasar/app-webpack
- webpack SSRF (buildHttp feature, not used in this project)
- qs DoS in webpack-dev-server's express (local dev only)
- esbuild dev server CORS issue (local dev only)
- vue-template-compiler XSS (no patch available upstream)
- tmp symlink issue, @tootallnate/once control flow (test tooling only)

Change-Id: I72f34757538f97bb3495a57d7f0263df58102f1e
(cherry picked from commit 1ebe3c0683)
(cherry picked from commit 0cb639dc46)

Debora Crescenzo

72d36d22ab

MT#63046 Update @quasar/app-webpack and relevant libs

This update introduced many breaking changes.
Listed here the most important ones:
* quasar.conf.js file has been renamed
  quasar.config.js.
* Quasar v4 replaced the old /src/index.template.html
  with a new /index.html at the root of the project.
  The special comment <!-- quasar:entry-point -->
  is used to inject scripts/styles automatically.
* Use setupMiddlewares instead of onBeforeSetupMiddleware.
* proxy is now an array of proxy config objects.
* Dropped support for Vuex. We can still use Vuex as any
  Vue plugin, but we have to manage everything (installing the
  store, no store parameter in boot files, etc.).
  We'll migrate to Pinia asap.
* Updated postcssrc according to docs

Change-Id: I585a3e2d17f666d9ca2773fa446d644f0fc201a2

2 Commits (318df1f5d559ed04b8d6a95d02afad20bb2e7886)