@nuxtjp/local-runtime 0.1.3 → 0.1.4

package/README.ja.md

@@ -9,7 +9,7 @@
 `0.1.1`はnpmで公開済みです。Node `^22.19.0`または`^24.11.0`、Nuxt `^4.5.1`、Vue `^3.5.40`を使用してください。
 
 ```sh
-npm install @nuxtjp/local-runtime@0.1.0
+npm install @nuxtjp/local-runtime@0.1.4
 ```
 
 ```ts

package/README.md

@@ -6,10 +6,10 @@ Connect a browser interface to one explicitly configured local Rust runtime, aft
 
 ## Install and use
 
-Version `0.1.1` is published on npm. Use Node `^22.19.0` or `^24.11.0`, Nuxt `^4.5.1` and Vue `^3.5.40`.
+Install the package version `0.1.4` after it is available on npm. Use Node `^22.19.0` or `^24.11.0`, Nuxt `^4.5.1` and Vue `^3.5.40`.
 
 ```sh
-npm install @nuxtjp/local-runtime@0.1.0
+npm install @nuxtjp/local-runtime@0.1.4
 ```
 
 ```ts

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": "^4.5.1"
   },
-  "version": "0.1.3",
+  "version": "0.1.4",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxtjp/local-runtime",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Fail-closed Nuxt client for a loopback local runtime",
   "type": "module",
   "license": "Apache-2.0",
@@ -89,7 +89,8 @@
     },
     "patchedDependencies": {
       "braces@3.0.3": "patches/braces@3.0.3.patch",
-      "node-forge@1.4.0": "patches/node-forge@1.4.0.patch"
+      "node-forge@1.4.0": "patches/node-forge@1.4.0.patch",
+      "simple-git@4.0.2": "security/patches/simple-git@4.0.2.patch"
     }
   }
 }

package/security/LICENSE-simple-git

@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2025 Steve King
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/security/README.md

@@ -19,3 +19,5 @@ The RSA test creates an ephemeral key in memory and never reads a user key. Patc
 Run `pnpm audit --json` on the installed application and retain the report. Only the two backported braces/node-forge advisories may remain; any other advisory, including simple-git, its argument parser, or esbuild, blocks validation. Run the dependency regression command on each install to reject missing or older active versions.
 
 The code patch inputs retain third-party notices in `LICENSE-braces` (MIT) and `LICENSE-node-forge`. The original dependencies remain registry packages; the shipped files configure and test the consumer rather than silently replacing its package manager.
+
+The simple-git 4.0.2 compatibility patch restores only the legacy ESM default factory used by Nuxt devtools. It aliases the existing, fixed `simpleGit` factory and does not change argument validation, executable selection, or Git execution. The named factory remains identical. `LICENSE-simple-git` retains its upstream MIT notice. A fresh consumer build and type check with devtools enabled are mandatory release checks.

package/security/dependency-security.check.cjs

@@ -57,3 +57,14 @@ test('active dependency graph uses every required upstream security version', ()
     for (const manifest of matches) assert.equal(JSON.parse(fs.readFileSync(manifest, 'utf8')).version, version, name);
   }
 });
+
+// Preserve the ESM entry point expected by current Nuxt devtools without downgrading Git protections.
+test('fixed simple-git retains named and legacy ESM factory exports', async () => {
+  const { pathToFileURL } = require('node:url');
+  const { installedDependencies } = require('./resolved-dependency.cjs');
+  for (const manifest of installedDependencies(process.cwd(), 'simple-git', '4.0.2')) {
+    const module = await import(pathToFileURL(path.join(path.dirname(manifest), 'dist/index.mjs')).href);
+    assert.equal(typeof module.simpleGit, 'function');
+    assert.equal(module.default, module.simpleGit);
+  }
+});

package/security/patches/simple-git@4.0.2.patch

@@ -0,0 +1,11 @@
+--- a/dist/index.mjs
++++ b/dist/index.mjs
+@@ -2890,6 +2890,7 @@
+   xe as TaskConfigurationError,
+   Sn as grepQueryBuilder,
+   ko as pathspec,
+-  wo as simpleGit
++  wo as simpleGit,
++  wo as default
+ };
+ //# sourceMappingURL=index.mjs.map

package/security/project.mjs

@@ -3,7 +3,7 @@ import { existsSync, lstatSync, readFileSync, mkdirSync, writeFileSync, renameSy
 import { join, resolve } from 'node:path'
 import { randomUUID } from 'node:crypto'
 
-const patches = ['braces@3.0.3', 'node-forge@1.4.0']
+const patches = ['braces@3.0.3', 'node-forge@1.4.0', 'simple-git@4.0.2']
 function regular(path) {
   const stat = lstatSync(path)
   if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 1024 * 1024) {