@liujitcn/kratos-admin-cli 0.0.86 → 0.0.87

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@liujitcn/kratos-admin-cli",
-  "version": "0.0.86",
+  "version": "0.0.87",
   "type": "module",
   "description": "Create pnpm workspace projects for kratos-admin business modules",
   "license": "MIT",
@@ -13,7 +13,7 @@
     "kratos-admin": "./dist/index.js"
   },
   "engines": {
-    "node": "^20.19.0 || >=22.12.0"
+    "node": "^24.0.0"
   },
   "files": [
     "dist/index.d.ts",

package/templates/business-workspace/.gitattributes

@@ -0,0 +1,2 @@
+# pnpm 生成的 unified diff 以单个空格表示空行上下文。
+patches/*.patch whitespace=-blank-at-eol

package/templates/business-workspace/.nvmrc

@@ -0,0 +1 @@
+24

package/templates/business-workspace/.stylelintignore

@@ -2,3 +2,7 @@
 /public/*
 public/*
 stats.html
+
+# 模板占位符尚未渲染，不能作为独立工程解析。
+packages/cli/templates/**
+**/dist/**

package/templates/business-workspace/README.en-US.md

@@ -38,6 +38,10 @@ Each directory containing a `package.json` has its own README with details about
 
 ## Development
 
+Use Node.js 24 and pnpm 10.33.4. Run `nvm install && nvm use` first. After dependency upgrades, regenerate the lockfile with `pnpm install --no-frozen-lockfile` and verify it with `pnpm install --frozen-lockfile`.
+
+`patches/braces@3.0.3.patch` bounds parser and AST traversal depth for CVE-2026-93687, which has no upstream fixed release. The audit exception applies only to this patch. Run `pnpm test:dependency-security` before `pnpm audit --audit-level high`; remove the patch, this exception and its regression tests together when an upstream fix becomes available.
+
 ```bash
 pnpm install
 pnpm dev

package/templates/business-workspace/README.md

@@ -39,6 +39,10 @@ __MODULE_TABLE_ROWS__
 
 ## 开发
 
+使用 Node.js 24 和 pnpm 10.33.4，先执行 `nvm install && nvm use`。依赖升级后通过 `pnpm install --no-frozen-lockfile` 生成锁文件，再用 `pnpm install --frozen-lockfile` 验证。
+
+`patches/braces@3.0.3.patch` 限制括号解析与 AST 遍历深度，处理尚无上游修复版本的 `CVE-2026-93687`；审计豁免仅针对此补丁。执行 `pnpm test:dependency-security` 验证实际安装的依赖后再运行 `pnpm audit --audit-level high`，上游发布修复版本后同时删除补丁、该豁免和对应测试。
+
 ```bash
 pnpm install
 pnpm dev

package/templates/business-workspace/package.json

@@ -12,20 +12,21 @@
     "lint:oxlint": "oxlint --fix --vue-plugin --config ./internal/lint-config/oxlint.json --ignore-path .oxlintignore ./apps ./packages ./internal ./scripts",
     "lint:lint-staged": "lint-staged",
     "lint:prettier": "prettier --write \"{apps,packages,internal,scripts}/**/*.{js,mjs,ts,json,tsx,css,less,scss,vue,html,md,yaml}\"",
-    "lint:stylelint": "stylelint --cache --fix \"{apps,packages}/**/*.{vue,less,postcss,css,scss}\" --cache-location node_modules/.cache/stylelint/",
+    "lint:stylelint": "stylelint --config .stylelintrc.cjs --cache --fix \"{apps,packages}/**/*.{vue,less,postcss,css,scss}\" --cache-location node_modules/.cache/stylelint/",
     "generate:auto-import-types": "node scripts/generate-auto-import-types.mjs",
     "i18n:sync": "node scripts/sync-locales.mjs --write",
-    "i18n:check": "node scripts/sync-locales.mjs"
+    "i18n:check": "node scripts/sync-locales.mjs",
+    "test:dependency-security": "node --test scripts/dependency-security.test.mjs"
   },
   "devDependencies": {
-    "@types/node": "^25.9.1",
+    "@types/node": "26.5.1",
     "sass": "^1.100.0",
     "turbo": "^2.5.6",
     "typescript": "6.0.3",
     "vite": "^8.0.14",
     "vue-tsc": "^3.3.2",
-    "@commitlint/cli": "^18.4.3",
-    "@commitlint/config-conventional": "^18.4.3",
+    "@commitlint/cli": "21.2.2",
+    "@commitlint/config-conventional": "21.2.2",
     "@types/md5": "^2.3.5",
     "@types/nprogress": "^0.2.3",
     "@types/qs": "^6.9.15",
@@ -39,7 +40,7 @@
     "postcss-html": "^1.8.1",
     "prettier": "^3.3.2",
     "standard-version": "^9.5.0",
-    "stylelint": "^17.12.0",
+    "stylelint": "^17.15.0",
     "stylelint-config-html": "^1.1.0",
     "stylelint-config-recess-order": "^7.7.0",
     "stylelint-config-recommended-scss": "^17.0.1",
@@ -50,7 +51,7 @@
     "ts-proto": "^2.11.8"
   },
   "engines": {
-    "node": "^20.19.0 || >=22.12.0"
+    "node": "^24.0.0"
   },
   "packageManager": "pnpm@10.33.4",
   "pnpm": {
@@ -61,7 +62,11 @@
       "svg-baker>micromatch": "4.0.8",
       "svg-baker>postcss": "8.5.26",
       "vue": "3.5.42",
-      "vue-router": "5.3.1"
+      "vue-router": "5.3.1",
+      "brace-expansion@<2.0.0": "1.1.20",
+      "brace-expansion@>=2.0.0 <3.0.0": "2.1.6",
+      "handlebars@<4.7.10": "4.7.10",
+      "source-map-js@<1.2.2": "1.2.2"
     },
     "onlyBuiltDependencies": [
       "@parcel/watcher",
@@ -76,8 +81,12 @@
     "auditConfig": {
       "ignoreCves": [
         "CVE-2025-71330",
-        "CVE-2025-71329"
+        "CVE-2025-71329",
+        "CVE-2026-93687"
       ]
+    },
+    "patchedDependencies": {
+      "braces@3.0.3": "patches/braces@3.0.3.patch"
     }
   }
 }

package/templates/business-workspace/patches/braces@3.0.3.patch

@@ -0,0 +1,135 @@
+diff --git a/lib/compile.js b/lib/compile.js
+index dce69beb90ece5c3b0ca234a949418f9f34eedbc..2f9fd0e732e0e1f90f71ce3f7681505002ad3290 100644
+--- a/lib/compile.js
++++ b/lib/compile.js
+@@ -2,9 +2,14 @@
+ 
+ const fill = require('fill-range');
+ const utils = require('./utils');
++const { MAX_DEPTH } = require('./constants');
+ 
+ const compile = (ast, options = {}) => {
+-  const walk = (node, parent = {}) => {
++  const walk = (node, parent = {}, depth = 0) => {
++    // 调用方也能直接传入 AST，因此遍历入口独立限制深度。
++    if (node.nodes && depth > MAX_DEPTH) {
++      throw new SyntaxError('Pattern nesting exceeds maximum depth');
++    }
+     const invalidBlock = utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+     const invalid = invalidBlock === true || invalidNode === true;
+@@ -47,7 +52,7 @@ const compile = (ast, options = {}) => {
+ 
+     if (node.nodes) {
+       for (const child of node.nodes) {
+-        output += walk(child, node);
++        output += walk(child, node, depth + 1);
+       }
+     }
+ 
+diff --git a/lib/constants.js b/lib/constants.js
+index 2bb3b8840382c56700869b3a9e1f958fcce01efd..3289d5650833bbbe39882f833bce71612d661c12 100644
+--- a/lib/constants.js
++++ b/lib/constants.js
+@@ -2,6 +2,7 @@
+ 
+ module.exports = {
+   MAX_LENGTH: 10000,
++  MAX_DEPTH: 128,
+ 
+   // Digits
+   CHAR_0: '0', /* 0 */
+diff --git a/lib/expand.js b/lib/expand.js
+index 35b2c41d6afdb8f0197959e26079f266e48370d3..2c4a5ee11e882a172c2654b985b1447b53b1d204 100644
+--- a/lib/expand.js
++++ b/lib/expand.js
+@@ -3,6 +3,7 @@
+ const fill = require('fill-range');
+ const stringify = require('./stringify');
+ const utils = require('./utils');
++const { MAX_DEPTH } = require('./constants');
+ 
+ const append = (queue = '', stash = '', enclose = false) => {
+   const result = [];
+@@ -33,7 +34,10 @@ const append = (queue = '', stash = '', enclose = false) => {
+ const expand = (ast, options = {}) => {
+   const rangeLimit = options.rangeLimit === undefined ? 1000 : options.rangeLimit;
+ 
+-  const walk = (node, parent = {}) => {
++  const walk = (node, parent = {}, depth = 0) => {
++    if (node.nodes && depth > MAX_DEPTH) {
++      throw new SyntaxError('Pattern nesting exceeds maximum depth');
++    }
+     node.queue = [];
+ 
+     let p = parent;
+@@ -100,7 +104,7 @@ const expand = (ast, options = {}) => {
+       }
+ 
+       if (child.nodes) {
+-        walk(child, node);
++        walk(child, node, depth + 1);
+       }
+     }
+ 
+diff --git a/lib/parse.js b/lib/parse.js
+index 3a6988e629f52aee6609dc5ec290a5e9ff47cecb..ec76ce445e89d8cf78b23596296f19f1832a8057 100644
+--- a/lib/parse.js
++++ b/lib/parse.js
+@@ -8,6 +8,7 @@ const stringify = require('./stringify');
+ 
+ const {
+   MAX_LENGTH,
++  MAX_DEPTH,
+   CHAR_BACKSLASH, /* \ */
+   CHAR_BACKTICK, /* ` */
+   CHAR_COMMA, /* , */
+@@ -143,6 +144,10 @@ const parse = (input, options = {}) => {
+      */
+ 
+     if (value === CHAR_LEFT_PARENTHESES) {
++      // 限制 AST 深度，避免后续递归遍历耗尽调用栈。
++      if (stack.length > MAX_DEPTH) {
++        throw new SyntaxError('Pattern nesting exceeds maximum depth');
++      }
+       block = push({ type: 'paren', nodes: [] });
+       stack.push(block);
+       push({ type: 'text', value });
+@@ -195,6 +200,9 @@ const parse = (input, options = {}) => {
+      */
+ 
+     if (value === CHAR_LEFT_CURLY_BRACE) {
++      if (stack.length > MAX_DEPTH) {
++        throw new SyntaxError('Pattern nesting exceeds maximum depth');
++      }
+       depth++;
+ 
+       const dollar = prev.value && prev.value.slice(-1) === '$' || block.dollar === true;
+diff --git a/lib/stringify.js b/lib/stringify.js
+index 8bcf872c31894f81a8c64d9202fd607e4fd7ea2b..a88fa77189d01ec08a8084ab6275be7a33d5efbd 100644
+--- a/lib/stringify.js
++++ b/lib/stringify.js
+@@ -1,9 +1,13 @@
+ 'use strict';
+ 
+ const utils = require('./utils');
++const { MAX_DEPTH } = require('./constants');
+ 
+ module.exports = (ast, options = {}) => {
+-  const stringify = (node, parent = {}) => {
++  const stringify = (node, parent = {}, depth = 0) => {
++    if (node.nodes && depth > MAX_DEPTH) {
++      throw new SyntaxError('Pattern nesting exceeds maximum depth');
++    }
+     const invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+     let output = '';
+@@ -21,7 +25,7 @@ module.exports = (ast, options = {}) => {
+ 
+     if (node.nodes) {
+       for (const child of node.nodes) {
+-        output += stringify(child);
++        output += stringify(child, {}, depth + 1);
+       }
+     }
+     return output;

package/templates/business-workspace/scripts/dependency-security.test.mjs

@@ -0,0 +1,50 @@
+import assert from "node:assert/strict";
+import { createRequire } from "node:module";
+import test from "node:test";
+
+const require = createRequire(import.meta.url);
+
+for (const consumer of ["stylelint", "lint-staged"]) {
+  const consumerRequire = createRequire(require.resolve(consumer));
+  const micromatchRequire = createRequire(consumerRequire.resolve("micromatch"));
+  const braces = micromatchRequire("braces");
+
+  test(`${consumer} 保留常规嵌套 glob 的编译与展开结果`, () => {
+    const pattern = "src/{core,modules}/{a,b}.vue";
+    assert.equal(braces.compile(pattern), "src/(core|modules)/(a|b).vue");
+    assert.deepEqual(braces.expand(pattern), ["src/core/a.vue", "src/core/b.vue", "src/modules/a.vue", "src/modules/b.vue"]);
+    assert.equal(braces.stringify(pattern), pattern);
+    assert.deepEqual(braces.expand("{1..3}"), ["1", "2", "3"]);
+  });
+
+  for (const [name, pattern] of [
+    ["花括号", "{".repeat(4000) + "a,b" + "}".repeat(4000)],
+    ["圆括号", "(".repeat(4000) + "a" + ")".repeat(4000)],
+    ["未闭合括号", "{".repeat(4000) + "a"]
+  ]) {
+    test(`${consumer} 在递归前拒绝过深${name}`, () => {
+      for (const method of ["parse", "compile", "expand", "stringify"]) {
+        assert.throws(() => braces[method](pattern), { name: "SyntaxError", message: "Pattern nesting exceeds maximum depth" });
+      }
+    });
+  }
+
+  test(`${consumer} 直接接收 AST 时仍限制遍历深度`, () => {
+    for (const method of ["compile", "expand", "stringify"]) {
+      let node = { type: "text", value: "a" };
+      for (let depth = 0; depth < 2000; depth++) {
+        const parent = { type: "paren", nodes: [node] };
+        node.parent = parent;
+        node = parent;
+      }
+      const ast = { type: "root", nodes: [node] };
+      node.parent = ast;
+      assert.throws(() => braces[method](ast), { name: "SyntaxError", message: "Pattern nesting exceeds maximum depth" });
+    }
+  });
+
+  test(`${consumer} 不把转义字符或引号中的括号计入深度`, () => {
+    assert.doesNotThrow(() => braces.compile("\\{".repeat(1000)));
+    assert.doesNotThrow(() => braces.compile('"' + "{".repeat(1000) + '"'));
+  });
+}