Keli GrubbandMadison Grubb
cfac12b699
## Summary Updates all out-of-date dependencies and applies `npm audit fix` to resolve 14 security vulnerabilities (3 critical, 8 high). ### Dependency Updates | Package | Current → Latest | |---|---| | `nuxt` | 4.4.8 → 4.5.2 | | `mediasoup` | 3.20.9 → 3.24.2 | | `mediasoup-client` | 3.21.0 → 3.22.0 | | `hls.js` | 1.6.16 → 1.7.0 | | `vue` | 3.5.38 → 3.5.41 | | `vue-router` | 5.1.0 → 5.2.0 | | `@nuxt/icon` | 2.2.3 → 2.5.0 | | `eslint` | 10.5.0 → 10.8.1 | | `vitest` / `@vitest/coverage-v8` | 4.1.9 → 4.1.10 | | `ws` | 8.21.0 → 8.21.3 | | `openid-client` | 6.8.4 → 6.8.5 | | `fast-xml-parser` | 5.9.3 → 5.10.1 | | `happy-dom` | 20.10.6 → 20.11.2 | | `@playwright/test` | 1.61.1 → 1.62.1 | | `@nuxt/eslint` | 1.16.0 → 1.17.0 | | `@nuxt/test-utils` | 4.0.3 → 4.1.0 | | `@iconify-json/tabler` | 1.2.35 → 1.2.38 | ### Security Audit Fixes (`npm audit fix`) - **`@nuxt/devtools`** (critical): Unauthenticated DevTools RPC allows arbitrary command execution on the developer's host - **`tar`** (critical): Multiple process-crash/DoS vulnerabilities via crafted tar archives - **`esbuild`** (high): Arbitrary file read when running dev server on Windows - **`brace-expansion`** (high): Multiple DoS vectors (memory exhaustion, process hang) - **`flatted`** (high): Prototype pollution via `parse()` - **`svgo`** (high): `removeScripts` plugin leaves executable scripts intact ### Verification - All 406 tests pass (3 skipped) - Lint clean (`eslint . --max-warnings 0`) - `npm audit` reports 0 vulnerabilities --------- Co-authored-by: Madison Grubb <madison@elastiflow.com> Reviewed-on: #44
93 lines
2.3 KiB
YAML
93 lines
2.3 KiB
YAML
name: PR
|
|
|
|
on:
|
|
pull_request:
|
|
|
|
jobs:
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://git.keligrubb.com/actions/checkout@v7
|
|
|
|
- name: Setup Node.js
|
|
uses: https://git.keligrubb.com/actions/setup-node@v7
|
|
with:
|
|
node-version: "24"
|
|
cache: "npm"
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Run lint
|
|
run: npm run lint
|
|
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://git.keligrubb.com/actions/checkout@v7
|
|
|
|
- name: Setup Node.js
|
|
uses: https://git.keligrubb.com/actions/setup-node@v7
|
|
with:
|
|
node-version: "24"
|
|
cache: "npm"
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Run tests
|
|
run: npm run test
|
|
|
|
e2e:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: mcr.microsoft.com/playwright:v1.62.1-noble
|
|
steps:
|
|
- uses: https://git.keligrubb.com/actions/checkout@v7
|
|
|
|
- name: Setup Node.js
|
|
uses: https://git.keligrubb.com/actions/setup-node@v7
|
|
with:
|
|
node-version: "24"
|
|
cache: "npm"
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Generate dev cert
|
|
run: ./scripts/gen-dev-cert.sh
|
|
|
|
- name: Run e2e tests
|
|
run: npm run test:e2e
|
|
env:
|
|
NODE_TLS_REJECT_UNAUTHORIZED: "0"
|
|
|
|
docker-build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://git.keligrubb.com/actions/checkout@v7
|
|
|
|
- name: Set Docker image tag
|
|
id: image
|
|
run: |
|
|
REGISTRY="${GITHUB_SERVER_URL#https://}"
|
|
REGISTRY="${REGISTRY#http://}"
|
|
echo "tag=${REGISTRY}/${{ github.repository }}:latest" >> $GITHUB_OUTPUT
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: https://git.keligrubb.com/actions/docker-setup-buildx-action@v4
|
|
|
|
- name: Build (dry run)
|
|
uses: https://git.keligrubb.com/actions/docker-build-push-action@v7
|
|
env:
|
|
# Keeps GITHUB_OUTPUT small; Gitea act-runner can choke on multiline
|
|
# outputs when PR webhook payloads (e.g. Renovate bodies) are huge.
|
|
DOCKER_BUILD_SUMMARY: "false"
|
|
DOCKER_BUILD_RECORD_UPLOAD: "false"
|
|
with:
|
|
context: .
|
|
push: false
|
|
provenance: false
|
|
sbom: false
|
|
tags: ${{ steps.image.outputs.tag }}
|