@askdkc/dsh-lsp-server 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/docs/usage.md +18 -0
- package/package.json +9 -3
package/docs/usage.md
CHANGED
|
@@ -91,4 +91,22 @@ The packed-artifact test extracts the archive into an isolated consumer, supplie
|
|
|
91
91
|
|
|
92
92
|
Integration tests run against the published DSH `0.0.1-rc.1` service/tool packages and Cordis 4.0.2. Contracts were also compared with upstream commit `d347e703908d0406b7a7ef80e3a0e594d86b2215` (`0.1.3-alpha.1`). The full Web UI and a source-built upstream application are not exercised here.
|
|
93
93
|
|
|
94
|
+
### Dependency security
|
|
95
|
+
|
|
96
|
+
This repository pins Vite to 6.4.3 (which uses patched esbuild 0.25.x) and overrides the Svelte Language Server's fallback compiler to Svelte 5.55.7. These versions address [Vite's Windows path bypass](https://github.com/advisories/GHSA-fx2h-pf6j-xcff) and the [Svelte SSR](https://github.com/advisories/GHSA-pr6f-5x2q-rwfp) / [DOM clobbering](https://github.com/advisories/GHSA-rcqx-6q8c-2c42) advisories. Run `pnpm audit` after dependency updates. The Svelte E2E tests exercise fallback compilation with both legacy and rune syntax, including diagnostics after edits.
|
|
97
|
+
|
|
98
|
+
The pinned `svelte-language-server` still declares Svelte 4 as its dependency. Repository overrides and `pnpm-lock.yaml` do **not** propagate when this plugin is installed as a dependency. Until upstream changes that dependency, the host installation must apply its own override to obtain the patched fallback compiler. For npm, merge this into the installation root's `package.json`, reinstall, and run `npm audit`:
|
|
99
|
+
|
|
100
|
+
```json
|
|
101
|
+
{
|
|
102
|
+
"overrides": {
|
|
103
|
+
"svelte-language-server": {
|
|
104
|
+
"svelte": "5.55.7"
|
|
105
|
+
}
|
|
106
|
+
}
|
|
107
|
+
}
|
|
108
|
+
```
|
|
109
|
+
|
|
110
|
+
For pnpm 9, use `"svelte-language-server>svelte": "5.55.7"` in the installation root's `pnpm.overrides`, reinstall, and run `pnpm audit`. See [npm's root-only override rules](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#overrides). The language server can also load a project's own Svelte compiler; project dependencies need separate updates. A clean repository audit does not establish that installed consumers or projects are clean.
|
|
111
|
+
|
|
94
112
|
The provider reads current documents through `ctx.fs`, confines sources to the canonical workspace, and starts/cleans up processes through `ctx.subprocess`. It refuses `workspace/applyEdit` and never applies completion edits. Language servers themselves may read project dependencies, evaluate framework configuration, and write caches; this plugin is not an OS sandbox.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@askdkc/dsh-lsp-server",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.1",
|
|
4
4
|
"description": "Composite read-only LSP provider for DeepSeek Harness web stacks",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./lib/provider.js",
|
|
@@ -96,7 +96,9 @@
|
|
|
96
96
|
"packageManager": "pnpm@9.15.9",
|
|
97
97
|
"pnpm": {
|
|
98
98
|
"overrides": {
|
|
99
|
-
"tsdown>rolldown": "1.0.0-beta.38"
|
|
99
|
+
"tsdown>rolldown": "1.0.0-beta.38",
|
|
100
|
+
"svelte-language-server>svelte": "5.55.7",
|
|
101
|
+
"vite": "6.4.3"
|
|
100
102
|
}
|
|
101
103
|
},
|
|
102
104
|
"license": "MIT",
|
|
@@ -107,7 +109,11 @@
|
|
|
107
109
|
"overrides": {
|
|
108
110
|
"tsdown": {
|
|
109
111
|
"rolldown": "1.0.0-beta.38"
|
|
110
|
-
}
|
|
112
|
+
},
|
|
113
|
+
"svelte-language-server": {
|
|
114
|
+
"svelte": "5.55.7"
|
|
115
|
+
},
|
|
116
|
+
"vite": "6.4.3"
|
|
111
117
|
},
|
|
112
118
|
"peerDependenciesMeta": {
|
|
113
119
|
"@deepseek-ai/cordis": {
|