coursecode 0.1.53 → 0.1.55

package/lib/proxy-templates/proxy.html

@@ -44,11 +44,15 @@
     </div>
     
     <iframe id="course" style="display:none"></iframe>
-    
+
+    <script src="pipwerks.js"></script>
+    <script>
+        // Injected as a JSON string by the build system before the bridge loads.
+        window.COURSECODE_PROXY_CONFIG = { courseUrl: {{EXTERNAL_URL_JSON}} };
+    </script>
     <script src="scorm-bridge.js"></script>
     <script>
-        // Course URL is injected at build time
-        const COURSE_URL = '{{EXTERNAL_URL}}';
+        const COURSE_URL = window.COURSECODE_PROXY_CONFIG.courseUrl;
         
         const iframe = document.getElementById('course');
         const loading = document.getElementById('loading');

package/lib/proxy-templates/scorm-bridge.js

@@ -22,16 +22,17 @@
     const iframe = document.getElementById('course');
     let initialized = false;
 
-    // Derive expected course origin from build-time URL for postMessage validation
-    // COURSE_URL is injected by the build system (e.g., 'https://cdn.example.com/my-course')
-    let courseOrigin = '*'; // Fallback if URL parsing fails
+    // Derive the exact expected course origin from build-time configuration.
+    // Fail closed: wildcard origins would allow unrelated frames to operate the LMS API.
+    let courseOrigin;
     try {
-        if (typeof COURSE_URL === 'string' && COURSE_URL && !COURSE_URL.startsWith('{{')) {
-            courseOrigin = new URL(COURSE_URL).origin;
-            console.log('SCORM Bridge: Expected course origin:', courseOrigin);
-        }
+        const courseUrl = window.COURSECODE_PROXY_CONFIG?.courseUrl;
+        if (!courseUrl) throw new Error('Missing proxy course URL');
+        courseOrigin = new URL(courseUrl).origin;
+        console.log('SCORM Bridge: Expected course origin:', courseOrigin);
     } catch (e) {
-        console.warn('SCORM Bridge: Could not parse COURSE_URL for origin validation:', e.message);
+        console.error('SCORM Bridge: Invalid course URL; bridge disabled:', e.message);
+        return;
     }
 
     // Disable pipwerks auto-handling - we manage status ourselves
@@ -49,8 +50,13 @@
             return;
         }
 
+        if (!iframe || event.source !== iframe.contentWindow) {
+            console.warn('SCORM Bridge: Rejected message not sent by the course iframe');
+            return;
+        }
+
         // Validate origin when we have a known course origin
-        if (courseOrigin !== '*' && event.origin !== courseOrigin) {
+        if (event.origin !== courseOrigin) {
             console.warn('SCORM Bridge: Rejected message from unexpected origin:', event.origin);
             return;
         }

package/lib/scaffold.js

@@ -34,13 +34,24 @@ const MINIMAL_CONFIG = `export const courseConfig = {
 };
 `;
 
+const DEMO_ASSETS = [
+    'docs/example_md_1.md',
+    'docs/example_md_2.md',
+    'docs/example_pdf_1_thumbnail.png',
+    'docs/example_pdf_2.pdf',
+    'images/course-architecture.svg',
+    'images/logo.svg',
+    'widgets/counter-demo.html',
+    'widgets/gravity-painter.html'
+];
+
 /**
  * Minimal slide template
  */
 function slideTemplate(id) {
     const title = id.replace(/[-_]/g, ' ').replace(/\b\w/g, c => c.toUpperCase());
     return `export const slide = {
-    render(root, context) {
+    render(_root, _context) {
         const container = document.createElement('div');
         container.innerHTML = \`
             <h1>${title}</h1>
@@ -83,9 +94,11 @@ const questions = [
 ];
 
 export const slide = {
-    render(root) {
-        const assessment = AssessmentManager.createAssessment(config, questions);
-        return assessment.render(root);
+    render(_root, context = {}) {
+        const container = document.createElement('div');
+        const assessment = AssessmentManager.createAssessment({ ...config, questions });
+        assessment.render(container, context);
+        return container;
     }
 };
 `;
@@ -128,6 +141,22 @@ export function clean(options = {}) {
         }
     }
 
+    // Remove the known demo documents, images, and widgets without touching
+    // any author-created assets that may already exist in the project.
+    const assetsDir = path.join(coursePath, 'assets');
+    for (const relativePath of DEMO_ASSETS) {
+        const assetPath = path.join(assetsDir, relativePath);
+        if (fs.existsSync(assetPath)) {
+            fs.rmSync(assetPath, { force: true });
+            removed++;
+        }
+    }
+
+    // A freshly blank scaffold must not inherit the example narration cache.
+    if (options.blank) {
+        fs.rmSync(path.join(basePath, '.narration-cache.json'), { force: true });
+    }
+
     // Rewrite course-config.js to minimal starter
     const configPath = path.join(coursePath, 'course-config.js');
     if (fs.existsSync(configPath)) {

package/lib/stub-player.js

@@ -58,7 +58,7 @@ export { escapeHtml };
  * @returns {string} - Complete HTML for the player page
  */
 export function generateStubPlayer(config) {
-    const { title, launchUrl, storageKey, passwordHash, isLive, liveReload, courseContent, startSlide, isDesktop, showHeader = true, skipGating = null, moduleBasePath = '/__stub-player' } = config;
+    const { title, launchUrl, storageKey, passwordHash, isLive, liveReload, courseContent, startSlide, isDesktop, showHeader = true, skipGating = null, moduleBasePath = '/__stub-player', previewToken = null } = config;
     const hasPassword = !!passwordHash;
     const hasContent = !!courseContent;
     const headerVisible = showHeader !== false;
@@ -115,8 +115,25 @@ ${stubPlayerStyles}
         showHeader: ${headerVisible},
         skipGating: ${typeof skipGating === 'boolean' ? skipGating : 'null'},
         isDesktop: ${isDesktop || false},
-        isCI: ${!!process.env.CI}
+        isCI: ${!!process.env.CI},
+        previewToken: ${previewToken ? JSON.stringify(previewToken) : 'null'}
     };
+
+    // Protect source-mutating preview endpoints from cross-site requests. The
+    // token is random for each preview process and is never used by exports.
+    if (window.STUB_CONFIG.previewToken) {
+        const nativeFetch = window.fetch.bind(window);
+        window.fetch = function(input, init = {}) {
+            const requestUrl = typeof input === 'string' ? input : input?.url;
+            const requestMethod = String(init.method || input?.method || 'GET').toUpperCase();
+            if (requestUrl?.startsWith('/__') && !['GET', 'HEAD', 'OPTIONS'].includes(requestMethod)) {
+                const headers = new Headers(init.headers || input?.headers || {});
+                headers.set('X-CourseCode-Preview-Token', window.STUB_CONFIG.previewToken);
+                init = { ...init, headers };
+            }
+            return nativeFetch(input, init);
+        };
+    }
     </script>
     <script type="module" src="${moduleBasePath}/${isLive ? 'app' : 'app-viewer'}.js"></script>
     

package/lib/token.js

@@ -3,7 +3,7 @@
  * 
  * Usage:
  *   coursecode token                    # Generate random token
- *   coursecode token --add client-name  # Add client to course-config
+ *   coursecode token --add client-name  # Add client to gitignored access file
  */
 
 import crypto from 'crypto';
@@ -25,51 +25,48 @@ export function generateToken(length = 24) {
 export async function token(options = {}) {
     const newToken = generateToken();
 
-    // If --add specified, add to course-config
+    // If --add specified, add to the non-published access file. Credentials
+    // must never live in course-config.js because that module is bundled into
+    // learner-facing JavaScript.
     if (options.add) {
         const clientId = options.add;
-        const courseDir = path.join(process.cwd(), 'course');
-        const configPath = path.join(courseDir, 'course-config.js');
+        if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(clientId)) {
+            throw new Error('Client ID must use letters, numbers, dots, underscores, or hyphens');
+        }
+
+        const configPath = path.join(process.cwd(), 'course', 'course-config.js');
 
         if (!fs.existsSync(configPath)) {
             console.error('\n❌ No course-config.js found. Run from a CourseCode project directory.\n');
             process.exit(1);
         }
 
-        let content = fs.readFileSync(configPath, 'utf-8');
+        const accessDir = path.join(process.cwd(), '.coursecode');
+        const accessPath = path.join(accessDir, 'access-control.json');
+        fs.mkdirSync(accessDir, { recursive: true });
 
-        // Check if accessControl already exists
-        if (content.includes('accessControl:')) {
-            // Add to existing clients object
-            const clientsMatch = content.match(/accessControl:\s*\{[\s\S]*?clients:\s*\{/);
-            if (clientsMatch) {
-                const insertPos = clientsMatch.index + clientsMatch[0].length;
-                const newClient = `\n            '${clientId}': { token: '${newToken}' },`;
-                content = content.slice(0, insertPos) + newClient + content.slice(insertPos);
+        let accessConfig = { clients: {} };
+        if (fs.existsSync(accessPath)) {
+            try {
+                accessConfig = JSON.parse(fs.readFileSync(accessPath, 'utf-8'));
+            } catch (error) {
+                throw new Error(`Cannot parse ${accessPath}: ${error.message}`);
             }
-        } else {
-            // Add accessControl section before closing brace
-            const accessControlBlock = `
-    accessControl: {
-        enabled: true,
-        clients: {
-            '${clientId}': { token: '${newToken}' }
         }
-    },`;
-            // Find the last closing brace of courseConfig
-            const lastBrace = content.lastIndexOf('};');
-            if (lastBrace !== -1) {
-                content = content.slice(0, lastBrace) + accessControlBlock + '\n' + content.slice(lastBrace);
-            }
+        if (!accessConfig.clients || typeof accessConfig.clients !== 'object') {
+            accessConfig.clients = {};
         }
-
-        fs.writeFileSync(configPath, content, 'utf-8');
+        accessConfig.clients[clientId] = { token: newToken };
+        fs.writeFileSync(accessPath, JSON.stringify(accessConfig, null, 2) + '\n', { mode: 0o600 });
+        try { fs.chmodSync(accessPath, 0o600); } catch { /* Windows/filesystem may not support chmod */ }
 
         console.log(`
-✅ Added client '${clientId}' to accessControl
+✅ Added client '${clientId}' to .coursecode/access-control.json
 
    Token: ${newToken}
 
+   Keep accessControl.enforcement = 'server' in course-config.js.
+   Your CDN/backend must validate this token before serving course files.
    Build will generate: ${clientId}_proxy.zip
 `);
     } else {

package/lib/upgrade.js

@@ -113,6 +113,46 @@ export function addMissingRuntimeDependencies(projectPkg, templatePkg) {
   return added;
 }
 
+const OBSOLETE_MANAGED_DEV_DEPENDENCIES = ['@vitejs/plugin-legacy'];
+
+/**
+ * Synchronize the build tooling that accompanies a replaced template config.
+ * This only runs with `coursecode upgrade --configs`, keeping the default
+ * framework-only upgrade from changing a project's custom build stack.
+ */
+export function syncManagedBuildTooling(projectPkg, templatePkg) {
+  const projectDevDeps = { ...(projectPkg.devDependencies || {}) };
+  const templateDevDeps = templatePkg.devDependencies || {};
+  const updated = [];
+  const removed = [];
+
+  for (const [name, version] of Object.entries(templateDevDeps)) {
+    if (projectDevDeps[name] !== version) {
+      projectDevDeps[name] = version;
+      updated.push(`${name}@${version}`);
+    }
+  }
+
+  for (const name of OBSOLETE_MANAGED_DEV_DEPENDENCIES) {
+    if (projectDevDeps[name]) {
+      delete projectDevDeps[name];
+      removed.push(name);
+    }
+  }
+
+  projectPkg.devDependencies = Object.fromEntries(
+    Object.entries(projectDevDeps).sort(([a], [b]) => a.localeCompare(b))
+  );
+
+  const nodeEngine = templatePkg.engines?.node;
+  const engineUpdated = Boolean(nodeEngine && projectPkg.engines?.node !== nodeEngine);
+  if (engineUpdated) {
+    projectPkg.engines = { ...(projectPkg.engines || {}), node: nodeEngine };
+  }
+
+  return { updated, removed, engineUpdated };
+}
+
 export async function upgrade(options = {}) {
   const cwd = process.cwd();
   const rcPath = path.join(cwd, '.coursecoderc.json');
@@ -175,7 +215,8 @@ export async function upgrade(options = {}) {
     if (options.configs) {
       dryRunMsg += `
    - vite.config.js (replace, backup original)
-   - eslint.config.js (replace, backup original)`;
+   - eslint.config.js (replace, backup original)
+   - package.json (sync managed Vite/ESLint tooling and remove plugin-legacy)`;
     }
 
     dryRunMsg += `
@@ -266,10 +307,18 @@ export async function upgrade(options = {}) {
   // the project's existing version ranges.
   const pkgPath = path.join(cwd, 'package.json');
   let addedRuntimeDeps = [];
+  let toolingChanges = null;
   if (fs.existsSync(pkgPath)) {
     const projectPkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
     addedRuntimeDeps = addMissingRuntimeDependencies(projectPkg, templatePkg);
-    if (addedRuntimeDeps.length > 0) {
+    if (options.configs) {
+      toolingChanges = syncManagedBuildTooling(projectPkg, templatePkg);
+    }
+    const packageChanged = addedRuntimeDeps.length > 0 ||
+      toolingChanges?.updated.length > 0 ||
+      toolingChanges?.removed.length > 0 ||
+      toolingChanges?.engineUpdated;
+    if (packageChanged) {
       fs.writeFileSync(pkgPath, JSON.stringify(projectPkg, null, 2) + '\n');
     }
   }
@@ -290,6 +339,31 @@ export async function upgrade(options = {}) {
    Run npm install to update node_modules and your lockfile.`;
   }
 
+  if (toolingChanges && (
+    toolingChanges.updated.length > 0 ||
+    toolingChanges.removed.length > 0 ||
+    toolingChanges.engineUpdated
+  )) {
+    successMsg += `
+
+   Managed build tooling synchronized for the new config:`;
+    if (toolingChanges.updated.length > 0) {
+      successMsg += `
+   - Updated: ${toolingChanges.updated.join(', ')}`;
+    }
+    if (toolingChanges.removed.length > 0) {
+      successMsg += `
+   - Removed: ${toolingChanges.removed.join(', ')}`;
+    }
+    if (toolingChanges.engineUpdated) {
+      successMsg += `
+   - Updated Node engine requirement to ${templatePkg.engines.node}`;
+    }
+    successMsg += `
+
+   Run npm install to update node_modules and your lockfile.`;
+  }
+
   if (configUpdates.length > 0) {
     successMsg += `
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coursecode",
-  "version": "0.1.53",
+  "version": "0.1.55",
   "description": "Multi-format course authoring framework with CLI tools (SCORM 2004, SCORM 1.2, cmi5, LTI 1.3)",
   "type": "module",
   "bin": {
@@ -14,7 +14,6 @@
     "!framework/dist/**",
     "schemas",
     "template",
-    "!template/.gitattributes",
     "!template/**/.gitkeep",
     "README.md",
     "THIRD_PARTY_NOTICES.md"
@@ -51,26 +50,28 @@
     "lint:responsive:structure": "node scripts/check-responsive-structure-scoping.mjs",
     "lint:fix": "eslint . --fix",
     "smoke:responsive": "node scripts/responsive-visual-smoke.mjs",
+    "smoke:packed-create": "node scripts/smoke-packed-create.mjs",
     "build": "npx vite build --config vite.framework-dev.config.js",
     "build:dev": "npx vite build --config vite.framework-dev.config.js",
     "build:scorm2004": "LMS_FORMAT=scorm2004 npx vite build --config vite.framework-dev.config.js",
     "build:scorm12": "LMS_FORMAT=scorm1.2 npx vite build --config vite.framework-dev.config.js",
     "build:cmi5": "LMS_FORMAT=cmi5 npx vite build --config vite.framework-dev.config.js",
     "build:lti": "LMS_FORMAT=lti npx vite build --config vite.framework-dev.config.js",
-    "package": "npm run lint && PACKAGE=true npx vite build --config vite.framework-dev.config.js",
-    "package:scorm2004": "npm run lint && LMS_FORMAT=scorm2004 PACKAGE=true npx vite build --config vite.framework-dev.config.js",
-    "package:scorm12": "npm run lint && LMS_FORMAT=scorm1.2 PACKAGE=true npx vite build --config vite.framework-dev.config.js",
-    "package:cmi5": "npm run lint && LMS_FORMAT=cmi5 PACKAGE=true npx vite build --config vite.framework-dev.config.js",
-    "package:lti": "npm run lint && LMS_FORMAT=lti PACKAGE=true npx vite build --config vite.framework-dev.config.js",
+    "package": "npm run lint && npm run test:coverage && PACKAGE=true npx vite build --config vite.framework-dev.config.js",
+    "package:scorm2004": "npm run lint && npm run test:coverage && LMS_FORMAT=scorm2004 PACKAGE=true npx vite build --config vite.framework-dev.config.js",
+    "package:scorm12": "npm run lint && npm run test:coverage && LMS_FORMAT=scorm1.2 PACKAGE=true npx vite build --config vite.framework-dev.config.js",
+    "package:cmi5": "npm run lint && npm run test:coverage && LMS_FORMAT=cmi5 PACKAGE=true npx vite build --config vite.framework-dev.config.js",
+    "package:lti": "npm run lint && npm run test:coverage && LMS_FORMAT=lti PACKAGE=true npx vite build --config vite.framework-dev.config.js",
     "test": "vitest run --config tests/vitest.config.js",
     "test:e2e": "vitest run --config tests/vitest.e2e.config.js",
-    "test:all": "npm test && npm run test:e2e",
+    "test:drivers": "vitest run --config tests/vitest.e2e.scorm2004.config.js && vitest run --config tests/vitest.e2e.scorm12.config.js && vitest run --config tests/vitest.e2e.cmi5.config.js && vitest run --config tests/vitest.e2e.lti.config.js",
+    "test:all": "npm test && npm run test:e2e && npm run test:drivers",
     "test:cloud": "vitest run --config tests/vitest.cloud.config.js",
     "test:watch": "vitest --config tests/vitest.config.js",
     "test:coverage": "vitest run --config tests/vitest.config.js --coverage",
-    "prerelease:check": "npm run lint && npm run lint:responsive && npm run lint:responsive:structure && npm run build",
-    "prerelease:check:full": "npm run prerelease:check && npm run smoke:responsive -- --profile=expanded",
-    "prepublishOnly": "echo '📦 Preparing coursecode for npm...'"
+    "prerelease:check": "npm run lint && npm run lint:responsive && npm run lint:responsive:structure && npm run test:coverage && npm run build && npm run smoke:packed-create",
+    "prerelease:check:full": "npm run prerelease:check && npm run test:e2e && npm run test:drivers && npm run smoke:responsive -- --profile=expanded",
+    "prepublishOnly": "npm run prerelease:check"
   },
   "repository": {
     "type": "git",
@@ -98,34 +99,40 @@
   },
   "homepage": "https://github.com/course-code-framework/coursecode/blob/main/framework/docs/USER_GUIDE.md",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.19.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "acorn": "^8.15.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "acorn": "^8.17.0",
     "archiver": "^7.0.1",
     "commander": "^14.0.3",
     "lz-string": "^1.5.0",
-    "mammoth": "^1.8.0",
+    "mammoth": "^1.12.0",
     "marked": "^17.0.6",
     "marked-gfm-heading-id": "^4.1.4",
     "node-pptx-parser": "^1.0.1",
-    "pdf2json": "^4.0.2",
+    "pdf2json": "^4.0.3",
     "pdf2md": "^1.0.2",
-    "puppeteer-core": "^24.42.0",
+    "puppeteer-core": "^24.43.1",
     "win-ca": "^3.5.1",
-    "ws": "^8.18.0"
+    "ws": "^8.21.0"
   },
   "devDependencies": {
-    "@vitejs/plugin-legacy": "^7.2.1",
-    "@vitest/coverage-v8": "^4.1.5",
+    "@vitest/coverage-v8": "^4.1.10",
     "@xapi/cmi5": "^1.4.0",
-    "eslint": "^10.2.1",
-    "globals": "^17.5.0",
-    "jose": "^6.2.2",
+    "eslint": "^10.6.0",
+    "globals": "^17.7.0",
     "pptxgenjs": "^4.0.1",
-    "vite": "~7.2.2",
-    "vite-plugin-static-copy": "^3.4.0",
-    "vitest": "^4.1.5"
+    "vite": "~8.1.4",
+    "vite-plugin-static-copy": "^4.1.1",
+    "vitest": "^4.1.10"
+  },
+  "overrides": {
+    "uuid": "^11.1.1"
+  },
+  "pnpm": {
+    "overrides": {
+      "uuid": "^11.1.1"
+    }
   }
 }

package/template/course/course-config.js

@@ -92,13 +92,15 @@
  * EXTERNAL HOSTING (CDN deployment with proxy packages):
  *   format: 'scorm1.2-proxy' | 'scorm2004-proxy' | 'cmi5-remote'
  *   externalUrl: 'https://cdn.example.com/courses/my-course'  // Where course is hosted
- *   accessControl: {
- *     clients: {
- *       'acme-corp': { token: 'generated-token-here' },
- *       'globex': { token: 'another-token-here' }
- *     }
- *   }
- *   Generate tokens: coursecode token --add <clientId>
+ *   accessControl: { enforcement: 'server' }
+ *   Client tokens are stored outside course source in the gitignored file
+ *   .coursecode/access-control.json (created by coursecode token --add <clientId>).
+ *   The CDN/backend MUST validate credentials before serving index.html/assets.
+ *
+ * LMS PACKAGE MASTERY (optional):
+ *   lms: { masteryScore: 80 }  // 0-100; omitted by default
+ *   Only set this when the whole package has one LMS-level threshold. Individual
+ *   assessment passing scores remain in their assessment settings.
  *   Build output: One package per client (e.g., acme-corp_proxy.zip)
  *
  * CLOUD DEPLOYMENT:

package/template/gitattributes

@@ -0,0 +1,44 @@
+# Auto detect text files and perform LF normalization
+* text=auto
+
+# Force LF line endings for text files
+*.js text eol=lf
+*.mjs text eol=lf
+*.cjs text eol=lf
+*.json text eol=lf
+*.css text eol=lf
+*.html text eol=lf
+*.htm text eol=lf
+*.xml text eol=lf
+*.xsd text eol=lf
+*.dtd text eol=lf
+*.md text eol=lf
+*.txt text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.env text eol=lf
+
+# Binary files
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.webp binary
+*.svg binary
+*.mp3 binary
+*.mp4 binary
+*.wav binary
+*.ogg binary
+*.webm binary
+*.woff binary
+*.woff2 binary
+*.ttf binary
+*.eot binary
+*.otf binary
+*.pdf binary
+*.zip binary
+
+# Linguist overrides for GitHub stats
+*.css linguist-detectable=false
+*.xsd linguist-detectable=false

package/template/gitignore

@@ -0,0 +1,38 @@
+# Dependencies
+node_modules/
+
+# Build output
+dist/
+*.zip
+
+# Preview export (comment this line to include in repo for GitHub Pages deployment)
+course-preview/
+
+# Environment
+.env
+.env.local
+
+# Google Cloud service account credentials (NEVER commit these!)
+**/service-account*.json
+**/*-credentials.json
+**/*-keyfile.json
+
+# System files
+.DS_Store
+Thumbs.db
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# CourseCode Cloud (project binding)
+.coursecode/
+
+# Narration cache
+.narration-cache.json
+
+# Logs
+*.log
+npm-debug.log*

package/template/package.json

@@ -4,6 +4,9 @@
   "private": true,
   "type": "module",
   "description": "CourseCode project",
+  "engines": {
+    "node": ">=20.19.0"
+  },
   "scripts": {
     "dev": "vite build --mode development --watch",
     "build": "npm run lint && vite build",
@@ -13,16 +16,22 @@
   },
   "dependencies": {
     "@xapi/cmi5": "^1.4.0",
-    "jose": "^6.2.2",
     "lz-string": "^1.5.0",
     "marked": "^17.0.6",
     "marked-gfm-heading-id": "^4.1.4"
   },
   "devDependencies": {
-    "@vitejs/plugin-legacy": "~7.2.1",
     "archiver": "^7.0.1",
     "eslint": "^9.39.4",
-    "vite": "~7.2.2",
-    "vite-plugin-static-copy": "^3.4.0"
+    "vite": "~8.1.4",
+    "vite-plugin-static-copy": "^4.1.1"
+  },
+  "overrides": {
+    "uuid": "^11.1.1"
+  },
+  "pnpm": {
+    "overrides": {
+      "uuid": "^11.1.1"
+    }
   }
 }