ngcp-csc-ui

Commit Graph

Author	SHA1	Message	Date
Debora Crescenzo	1ebe3c0683	MT#64579 Reduce npm audit vulnerabilities from 132 to 30 - Removed `crypto-browserify` from package.json and quasar.config.js (unused webpack polyfill that was bundling vulnerable bn.js and elliptic into the production build) Bumped up packages: * glob * globals * jest * @quasar/app-webpack Yarn resolutions added - `serialize-javascript: ^7.0.3` — fixes high-severity RCE vulnerability via RegExp.flags/Date.toISOString() (CVE in terser-webpack-plugin and @quasar/ssr-helpers paths) - `/postcss-svgo/svgo: ^4.0.1` — fixes high-severity Billion Laughs DoS (XML entity expansion) in cssnano's SVG optimization pipeline - `dot-object/minimatch: ^3.1.2` — fixes high-severity ReDoS in dot-object's glob dependency - `/flatted: 3.4.0` — fixes high-severity unbounded recursion DoS in eslint and eslint-webpack-plugin's caching layer What remains (30 vulnerabilities — all upstream-blocked) The remaining vulnerabilities are entirely confined to dev-only tooling and cannot be fixed without upstream releases: - minimatch ReDoS across jest, @vue/test-utils, jest-serializer-vue, @quasar/app-webpack, @quasar/quasar-app-extension-testing-unit-jest - ajv ReDoS across eslint, eslint-webpack-plugin, @quasar/app-webpack - webpack SSRF (buildHttp feature, not used in this project) - qs DoS in webpack-dev-server's express (local dev only) - esbuild dev server CORS issue (local dev only) - vue-template-compiler XSS (no patch available upstream) - tmp symlink issue, @tootallnate/once control flow (test tooling only) Change-Id: I72f34757538f97bb3495a57d7f0263df58102f1e	3 months ago
Debora Crescenzo	3f9ebb605d	MT#64044 add Vue 2/3 compatibility layer and migration infrastructure Add composables (useStore, useUser, usePbx, useGlobals) and pure helpers (destination, platform) to support gradual Vue 3 Composition API adoption. - Extract pure functions from mixins to src/helpers/ - Add generic store access composables in src/composables/ - Add store infrastructure helpers (RequestState, API action wrappers) - Export boot file utilities for direct import in services - Add comprehensive tests and migration documentation No breaking changes. Existing Options API code continues to work. New code can use composables and helpers for cleaner patterns. See migration-guide.md for usage examples and migration path. Change-Id: I764a5e6635771e0f95f33f86064d70ee4a746207	6 months ago
Debora Crescenzo	72d36d22ab	MT#63046 Update @quasar/app-webpack and relevant libs This update introduced many breaking changes. Listed here the most important ones: * quasar.conf.js file has been renamed quasar.config.js. * Quasar v4 replaced the old /src/index.template.html with a new /index.html at the root of the project. The special comment <!-- quasar:entry-point --> is used to inject scripts/styles automatically. * Use setupMiddlewares instead of onBeforeSetupMiddleware. * proxy is now an array of proxy config objects. * Dropped support for Vuex. We can still use Vuex as any Vue plugin, but we have to manage everything (installing the store, no store parameter in boot files, etc.). We'll migrate to Pinia asap. * Updated postcssrc according to docs Change-Id: I585a3e2d17f666d9ca2773fa446d644f0fc201a2	10 months ago

Author

SHA1

Message

Date

Debora Crescenzo

1ebe3c0683

MT#64579 Reduce npm audit vulnerabilities from 132 to 30

- Removed `crypto-browserify` from package.json and quasar.config.js
  (unused webpack polyfill that was bundling vulnerable bn.js and
  elliptic into the production build)

Bumped up packages:
* glob
* globals
* jest
* @quasar/app-webpack

Yarn resolutions added
- `serialize-javascript: ^7.0.3` — fixes high-severity RCE vulnerability
  via RegExp.flags/Date.toISOString() (CVE in terser-webpack-plugin and
  @quasar/ssr-helpers paths)
- `**/postcss-svgo/svgo: ^4.0.1` — fixes high-severity Billion Laughs
  DoS (XML entity expansion) in cssnano's SVG optimization pipeline
- `dot-object/minimatch: ^3.1.2` — fixes high-severity ReDoS in
  dot-object's glob dependency
- `**/flatted: 3.4.0` — fixes high-severity unbounded recursion DoS
  in eslint and eslint-webpack-plugin's caching layer

What remains (30 vulnerabilities — all upstream-blocked)
The remaining vulnerabilities are entirely confined to dev-only
tooling and cannot be fixed without upstream releases:
- minimatch ReDoS across jest, @vue/test-utils, jest-serializer-vue,
  @quasar/app-webpack, @quasar/quasar-app-extension-testing-unit-jest
- ajv ReDoS across eslint, eslint-webpack-plugin, @quasar/app-webpack
- webpack SSRF (buildHttp feature, not used in this project)
- qs DoS in webpack-dev-server's express (local dev only)
- esbuild dev server CORS issue (local dev only)
- vue-template-compiler XSS (no patch available upstream)
- tmp symlink issue, @tootallnate/once control flow (test tooling only)

Change-Id: I72f34757538f97bb3495a57d7f0263df58102f1e

Debora Crescenzo

3f9ebb605d

MT#64044 add Vue 2/3 compatibility layer and migration infrastructure

Add composables (useStore, useUser, usePbx, useGlobals) and pure helpers
(destination, platform) to support gradual Vue 3 Composition API adoption.

- Extract pure functions from mixins to src/helpers/
- Add generic store access composables in src/composables/
- Add store infrastructure helpers (RequestState, API action wrappers)
- Export boot file utilities for direct import in services
- Add comprehensive tests and migration documentation

No breaking changes. Existing Options API code continues to work. New code can
use composables and helpers for cleaner patterns.

See migration-guide.md for usage examples and migration path.

Change-Id: I764a5e6635771e0f95f33f86064d70ee4a746207

Debora Crescenzo

72d36d22ab

MT#63046 Update @quasar/app-webpack and relevant libs

This update introduced many breaking changes.
Listed here the most important ones:
* quasar.conf.js file has been renamed
  quasar.config.js.
* Quasar v4 replaced the old /src/index.template.html
  with a new /index.html at the root of the project.
  The special comment <!-- quasar:entry-point -->
  is used to inject scripts/styles automatically.
* Use setupMiddlewares instead of onBeforeSetupMiddleware.
* proxy is now an array of proxy config objects.
* Dropped support for Vuex. We can still use Vuex as any
  Vue plugin, but we have to manage everything (installing the
  store, no store parameter in boot files, etc.).
  We'll migrate to Pinia asap.
* Updated postcssrc according to docs

Change-Id: I585a3e2d17f666d9ca2773fa446d644f0fc201a2

3 Commits (bc231de96fdd0096445108b635ba55df8daaa7c7)