@rm-industries/create-forge 1.0.0 → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/template/.github/actionlint.yaml +5 -0
- package/dist/template/.github/workflows/project.yml +7 -7
- package/dist/template/audit-ci.jsonc +8 -1
- package/dist/template/docs/performance-budget.md +1 -1
- package/dist/template/package-lock.json +560 -549
- package/dist/template/package.json +11 -11
- package/package.json +1 -1
|
@@ -34,7 +34,7 @@ jobs:
|
|
|
34
34
|
persist-credentials: false
|
|
35
35
|
|
|
36
36
|
- name: Setup project
|
|
37
|
-
uses:
|
|
37
|
+
uses: $/.github/actions/setup-project
|
|
38
38
|
with:
|
|
39
39
|
node-version: '26.x'
|
|
40
40
|
|
|
@@ -55,7 +55,7 @@ jobs:
|
|
|
55
55
|
persist-credentials: false
|
|
56
56
|
|
|
57
57
|
- name: Setup project
|
|
58
|
-
uses:
|
|
58
|
+
uses: $/.github/actions/setup-project
|
|
59
59
|
with:
|
|
60
60
|
node-version: '26.x'
|
|
61
61
|
|
|
@@ -76,7 +76,7 @@ jobs:
|
|
|
76
76
|
persist-credentials: false
|
|
77
77
|
|
|
78
78
|
- name: Setup project
|
|
79
|
-
uses:
|
|
79
|
+
uses: $/.github/actions/setup-project
|
|
80
80
|
with:
|
|
81
81
|
node-version: '26.x'
|
|
82
82
|
|
|
@@ -97,7 +97,7 @@ jobs:
|
|
|
97
97
|
persist-credentials: false
|
|
98
98
|
|
|
99
99
|
- name: Setup project
|
|
100
|
-
uses:
|
|
100
|
+
uses: $/.github/actions/setup-project
|
|
101
101
|
with:
|
|
102
102
|
node-version: '26.x'
|
|
103
103
|
|
|
@@ -131,7 +131,7 @@ jobs:
|
|
|
131
131
|
persist-credentials: false
|
|
132
132
|
|
|
133
133
|
- name: Setup project
|
|
134
|
-
uses:
|
|
134
|
+
uses: $/.github/actions/setup-project
|
|
135
135
|
with:
|
|
136
136
|
node-version: '26.x'
|
|
137
137
|
|
|
@@ -169,7 +169,7 @@ jobs:
|
|
|
169
169
|
persist-credentials: false
|
|
170
170
|
|
|
171
171
|
- name: Setup project
|
|
172
|
-
uses:
|
|
172
|
+
uses: $/.github/actions/setup-project
|
|
173
173
|
with:
|
|
174
174
|
node-version: '26.x'
|
|
175
175
|
|
|
@@ -204,7 +204,7 @@ jobs:
|
|
|
204
204
|
persist-credentials: false
|
|
205
205
|
|
|
206
206
|
- name: Setup project
|
|
207
|
-
uses:
|
|
207
|
+
uses: $/.github/actions/setup-project
|
|
208
208
|
with:
|
|
209
209
|
node-version: '26.x'
|
|
210
210
|
|
|
@@ -6,7 +6,14 @@
|
|
|
6
6
|
"GHSA-jmr9-qjv8-65gv": {
|
|
7
7
|
"active": true,
|
|
8
8
|
"expiry": "2026-11-30",
|
|
9
|
-
"notes": "Lighthouse CI development-only browser download path; Forge uses the installed CI browser and does not extract
|
|
9
|
+
"notes": "Lighthouse CI development-only browser download path; Forge uses the installed CI browser and does not extract untrusted archives.",
|
|
10
|
+
},
|
|
11
|
+
},
|
|
12
|
+
{
|
|
13
|
+
"GHSA-7pqw-9j4j-h8q3": {
|
|
14
|
+
"active": true,
|
|
15
|
+
"expiry": "2026-11-30",
|
|
16
|
+
"notes": "Lighthouse CI development-only browser download path; Forge uses the installed CI browser and does not extract untrusted archives.",
|
|
10
17
|
},
|
|
11
18
|
},
|
|
12
19
|
{
|
|
@@ -66,6 +66,6 @@ The pinned graph currently includes high-severity `extract-zip` and `tmp`
|
|
|
66
66
|
advisories. Both are confined to development-only Lighthouse tooling:
|
|
67
67
|
Lighthouse uses the installed browser rather than extracting an
|
|
68
68
|
attacker-provided browser archive, and its temporary paths are tool-controlled.
|
|
69
|
-
`audit-ci.jsonc` records narrow, expiring exceptions for those
|
|
69
|
+
`audit-ci.jsonc` records narrow, expiring exceptions for those advisory IDs.
|
|
70
70
|
All other high or critical advisories still fail `npm run audit`. Review or
|
|
71
71
|
remove the exceptions by 2026-11-30 rather than extending them automatically.
|