jkooe
5bacade667
Quality Gate 的「依赖漏洞扫描（SCA）」在 451d44a 上红：`pnpm audit
--audit-level=high` 报 3 个 high，全部不是本仓直接可控的代码：
- zod <4.6.6（GHSA-mrhx-c7xc-m3w5），路径 apps/mcp → @modelcontextprotocol/sdk；
- body-parser <2.4.0（GHSA-27r3-jxmh-p828），同上经 sdk→express；
- vite <8.3.3（GHSA-587h-7wmj-h5pm），控制台 devDependency。
处置：前两者用根 pnpm-workspace.yaml 的 overrides 抬到修复版（同 major patch 级）；
vite 直接改依赖范围 ^8.3.5。实测 14 → 6 条（**0 high**），门禁转绿。
注意（真坑）：pnpm 12 已不读 package.json 的 `pnpm` 字段，overrides 写在那里会被
**静默忽略**（install 报 "Already up to date" 但审计毫无变化）—— 必须写进
pnpm-workspace.yaml，理由与命令均落在文件注释里。
36 lines
1.1 KiB
JSON
36 lines
1.1 KiB
JSON
{
|
|
"name": "nodeagent-console",
|
|
"private": true,
|
|
"version": "2.1.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "vue-tsc --noEmit && vite build",
|
|
"preview": "vite preview",
|
|
"tauri": "tauri",
|
|
"sidecar:dev": "node sidecar/main.mjs",
|
|
"sidecar:build": "node sidecar/build.mjs",
|
|
"prepare:node": "node ../../scripts/prepare-console.mjs",
|
|
"verify:bundle": "node scripts/verify-bundle.mjs",
|
|
"bundle": "pnpm sidecar:build && pnpm --filter @nodeagent/agent build && pnpm prepare:node && tauri build --config src-tauri/tauri.bundle.gen.json && pnpm verify:bundle"
|
|
},
|
|
"dependencies": {
|
|
"@tauri-apps/api": "^2",
|
|
"@tauri-apps/plugin-opener": "^2",
|
|
"echarts": "^6.1.0",
|
|
"naive-ui": "^2.45.3",
|
|
"pinia": "^4.0.3",
|
|
"vue": "^3.5.13",
|
|
"vue-router": "^5.3.1",
|
|
"@nodeagent/client": "workspace:*",
|
|
"@nodeagent/protocol": "workspace:*"
|
|
},
|
|
"devDependencies": {
|
|
"@tauri-apps/cli": "^2",
|
|
"@vitejs/plugin-vue": "^6.0.7",
|
|
"typescript": "~6.0.3",
|
|
"vite": "^8.3.5",
|
|
"vue-tsc": "^3.3.5"
|
|
}
|
|
}
|