fg-devkit 1.19.2 → 1.20.0

package/README.md

@@ -63,6 +63,14 @@ pnpm exec fgd fallow dead-code --json
 
 When you run `fgd sync-tooling-configs` (or `fgd sync-project-configs`), fg-devkit also writes a shared `.fallowrc.json` to the consuming repo.
 
+Copy the shared OWASP Dependency-Check suppressions file into a consuming repo and commit it:
+
+```bash
+pnpm exec fgd sync-dependency-check-suppressions-commit
+```
+
+Jenkins `owaspDependencyCheck` reads `dependency-check-suppressions.xml` from the repo root when the file exists. Add another `<suppress>` element in the shared fg-devkit file for each additional accepted finding. The command overwrites the consumer copy.
+
 To sync standard consumer scripts to `fgd` commands:
 
 ```bash

package/configs/dependency-check-suppressions.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+  <suppress until="2026-12-01Z">
+    <notes><![CDATA[
+      braces <= 3.0.3 — GHSA-vfj7-8cjw-p6xm (stack exhaustion via deeply nested patterns).
+      No patched release exists; 3.0.3 is the latest version.
+      Transitive devDependency only, via fast-glob and micromatch
+      (@intlify/unplugin-vue-i18n and fg-devkit). Not shipped in the app runtime.
+      Risk accepted until braces publishes a release after 3.0.3.
+
+      pnpm audit paths do not equal the module name, so Dependency-Check creates
+      a virtual dependency at pnpm-lock.yaml?braces with no package URL version.
+      Jenkins shows the id as NPMGHSA-vfj7-8cjw-p6xm (source NPM + GHSA id).
+      Older analyzers may use the numeric advisory id 1240992.
+    ]]></notes>
+    <filePath regex="true">.*pnpm-lock\.yaml\?braces$</filePath>
+    <vulnerabilityName regex="true">.*(GHSA-vfj7-8cjw-p6xm|1240992).*</vulnerabilityName>
+  </suppress>
+</suppressions>

package/configs/dependency-policy.vue-workspace.json

@@ -1,6 +1,6 @@
 {
   "toolchain": {
-    "packageManager": "pnpm@12.8.1",
+    "packageManager": "pnpm@12.9.1",
     "node": {
       "nvmrc": "22",
       "engines": ">=22.13.0",
@@ -12,13 +12,13 @@
     "dependencies": {
       "@e965/xlsx": "0.20.3",
       "@element-plus/icons-vue": "2.3.2",
-      "@lexical/html": "0.49.0",
-      "@lexical/list": "0.49.0",
-      "@lexical/rich-text": "0.49.0",
-      "@lexical/link": "0.49.0",
+      "@lexical/html": "0.52.0",
+      "@lexical/list": "0.52.0",
+      "@lexical/rich-text": "0.52.0",
+      "@lexical/link": "0.52.0",
       "@piwikpro/vue-piwik-pro": "2.0.0",
-      "@sentry/vue": "11.1.0",
-      "@tanstack/vue-query": "5.104.0",
+      "@sentry/vue": "11.4.0",
+      "@tanstack/vue-query": "5.104.1",
       "@types/leaflet": "1.9.22",
       "@unhead/vue": "2.0.5",
       "@vue-leaflet/vue-leaflet": "0.10.1",
@@ -33,10 +33,10 @@
       "fds-vue-core": "8.10.0",
       "imask": "7.6.1",
       "leaflet": "1.9.4",
-      "lexical": "0.49.0",
+      "lexical": "0.52.0",
       "lodash": "4.18.1",
       "lodash-es": "4.18.1",
-      "markdown-it": "14.3.0",
+      "markdown-it": "15.0.2",
       "pinia": "4.0.3",
       "playwright": "1.63.0",
       "quill": "2.0.3",
@@ -45,7 +45,7 @@
       "vega-embed": "7.3.0",
       "vega-lite": "6.4.3",
       "vue-chartjs": "5.3.4",
-      "vue-i18n": "11.4.12",
+      "vue-i18n": "11.4.13",
       "vue-quilly": "1.1.6",
       "vue-router": "5.3.1",
       "vue3-touch-keyboard": "1.3.9",
@@ -54,7 +54,7 @@
       "yup": "1.7.1"
     },
     "devDependencies": {
-      "@chromatic-com/storybook": "5.3.1",
+      "@chromatic-com/storybook": "5.4.0",
       "@eslint/js": "9.39.1",
       "@intlify/unplugin-vue-i18n": "11.2.5",
       "@playwright/test": "1.63.0",
@@ -63,7 +63,7 @@
       "@storybook/addon-vitest": "10.6.1",
       "@storybook/vue3": "10.6.1",
       "@storybook/vue3-vite": "10.6.1",
-      "@tanstack/vue-query-devtools": "6.3.0",
+      "@tanstack/vue-query-devtools": "6.3.1",
       "@tsconfig/node22": "22.0.6",
       "@types/lodash-es": "4.17.12",
       "@types/node": "22.16.5",
@@ -76,12 +76,12 @@
       "babel-eslint": "10.1.0",
       "eslint-plugin-storybook": "10.6.1",
       "globals": "15.11.0",
-      "jsdom": "30.1.1",
+      "jsdom": "30.1.2",
       "sass": "1.105.1",
       "storybook": "10.6.1",
       "tsx": "4.23.15",
       "vega": "6.4.0",
-      "vite-plugin-dts": "5.1.1",
+      "vite-plugin-dts": "5.1.2",
       "vite-plugin-vue-devtools": "8.2.1",
       "vite-plugin-vue-inspector": "7.0.0",
       "vitest": "5.0.3",
@@ -95,7 +95,7 @@
     "dotenv": "18.0.5",
     "qrcode.vue": "3.11.0",
     "tailwindcss": "4.3.3",
-    "vite": "8.3.1",
+    "vite": "8.3.2",
     "vue": "3.5.43"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.19.2",
+  "version": "1.20.0",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
@@ -18,12 +18,14 @@
     "./lefthook.yml": "./configs/lefthook.yml",
     "./vscode-settings.json": "./configs/vscode-settings.json",
     "./dependency-policy.vue-workspace.json": "./configs/dependency-policy.vue-workspace.json",
+    "./dependency-check-suppressions.xml": "./configs/dependency-check-suppressions.xml",
     "./vuln-commit": "./scripts/vuln-commit.mjs",
     "./cz-config": "./scripts/cz/.cz-config.cjs",
     "./scripts/sync-peers-from-dev.mjs": "./scripts/sync-peers-from-dev.mjs",
     "./scripts/sync-vscode-settings.mjs": "./scripts/sync-vscode-settings.mjs",
     "./scripts/sync-core-coding-standards.mjs": "./scripts/sync-core-coding-standards.mjs",
     "./scripts/sync-tooling-configs.mjs": "./scripts/sync-tooling-configs.mjs",
+    "./scripts/sync-dependency-check-suppressions-commit.mjs": "./scripts/sync-dependency-check-suppressions-commit.mjs",
     "./scripts/sync-project-configs.mjs": "./scripts/sync-project-configs.mjs",
     "./scripts/sync-consumer-scripts.mjs": "./scripts/sync-consumer-scripts.mjs",
     "./scripts/sync-vite-plugin-vue-inspector.mjs": "./scripts/sync-vite-plugin-vue-inspector.mjs",
@@ -109,10 +111,10 @@
     }
   },
   "dependencies": {
-    "@inquirer/checkbox": "5.2.5",
-    "@inquirer/confirm": "6.3.2",
-    "@inquirer/input": "5.1.6",
-    "@inquirer/select": "5.2.5",
+    "@inquirer/checkbox": "5.2.6",
+    "@inquirer/confirm": "6.3.3",
+    "@inquirer/input": "5.1.7",
+    "@inquirer/select": "5.2.6",
     "@intlify/eslint-plugin-vue-i18n": "4.5.1",
     "@typescript-eslint/eslint-plugin": "8.71.0",
     "@typescript-eslint/parser": "8.71.0",
@@ -120,18 +122,18 @@
     "@vue/eslint-config-prettier": "10.2.0",
     "@vue/eslint-config-typescript": "14.9.0",
     "@vue/tsconfig": "0.9.1",
-    "eslint": "10.11.0",
+    "eslint": "10.12.0",
     "eslint-plugin-prettier": "5.5.6",
     "eslint-plugin-vue": "10.11.1",
     "fallow": "3.31.0",
     "git-cliff": "2.14.2",
-    "lefthook": "2.1.15",
+    "lefthook": "2.1.17",
     "npm-check-updates": "23.1.0",
     "prettier": "3.9.9",
     "tsx": "4.23.15",
     "typescript": "5.9.3",
     "vue-eslint-parser": "10.4.1",
-    "vue-tsc": "3.3.11"
+    "vue-tsc": "3.3.12"
   },
   "devDependencies": {
     "cz-git": "1.14.0",

package/scaffold/vue/package.json

@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "@tailwindcss/vite": "4.3.3",
-    "@tanstack/vue-query": "5.104.0",
+    "@tanstack/vue-query": "5.104.1",
     "axios": "1.20.0",
     "content-disposition-header": "0.6.0",
     "date-fns": "4.4.0",
@@ -25,21 +25,21 @@
     "pinia": "4.0.3",
     "qrcode.vue": "3.11.0",
     "vue": "3.5.43",
-    "vue-i18n": "11.4.12",
+    "vue-i18n": "11.4.13",
     "vue-router": "5.3.1"
   },
   "devDependencies": {
     "@intlify/unplugin-vue-i18n": "11.2.5",
-    "@tanstack/vue-query-devtools": "6.3.0",
+    "@tanstack/vue-query-devtools": "6.3.1",
     "@types/node": "22.16.5",
-    "fg-devkit": "1.19.2",
+    "fg-devkit": "1.20.0",
     "@vitejs/plugin-vue": "6.0.9",
     "tailwindcss": "4.3.3",
     "tsx": "4.23.15",
-    "vite": "8.3.1",
+    "vite": "8.3.2",
     "vite-plugin-vue-inspector": "7.0.0"
   },
-  "packageManager": "pnpm@12.8.1",
+  "packageManager": "pnpm@12.9.1",
   "engines": {
     "node": ">=22.13.0"
   }

package/scripts/fg-devkit.mjs

@@ -20,6 +20,7 @@
  *   pnpm exec fg-devkit prune-overrides [--fix] [--commit]
  *   pnpm exec fg-devkit sync-project-configs   (VS Code + tooling sync; overwrites config files)
  *   pnpm exec fg-devkit sync-tooling-configs   (tooling sync only; overwrites config files)
+ *   pnpm exec fg-devkit sync-dependency-check-suppressions-commit
  *   pnpm exec fg-devkit sync-vscode-settings
  *   pnpm exec fg-devkit sync-core-coding-standards
  *   pnpm exec fg-devkit sync-consumer-scripts
@@ -446,6 +447,7 @@ function runSyncConfigTarget(target) {
   if (target === 'prettier') return syncFileFromTemplate('configs/prettier.sync-stub.js', 'prettier.config.js')
   if (target === 'tsconfig') return syncFileFromTemplate('configs/tsconfig.app.sync.json', 'tsconfig.json')
   if (target === 'fallow') return syncFileFromTemplate('configs/fallowrc.sync-stub.json', '.fallowrc.json')
+  if (target === 'dependency-check') return runNode('sync-dependency-check-suppressions-commit.mjs')
   if (target === 'cursor') return runNode('sync-core-coding-standards.mjs')
   if (target === 'vue-inspector') return runNode('sync-vite-plugin-vue-inspector.mjs')
   if (target === 'all') return runNode('sync-project-configs.mjs')
@@ -479,6 +481,7 @@ const DIRECT_COMMANDS = {
   'prune-overrides': 'prune-overrides.mjs',
   'sync-project-configs': 'sync-project-configs.mjs',
   'sync-tooling-configs': 'sync-tooling-configs.mjs',
+  'sync-dependency-check-suppressions-commit': 'sync-dependency-check-suppressions-commit.mjs',
   'sync-vscode-settings': 'sync-vscode-settings.mjs',
   'sync-core-coding-standards': 'sync-core-coding-standards.mjs',
   'sync-vite-plugin-vue-inspector': 'sync-vite-plugin-vue-inspector.mjs',
@@ -545,6 +548,8 @@ Commands:
                                  Report unused workspace overrides; --fix removes them; --commit also auto-commits
   sync-project-configs            VS Code + tooling sync (overwrites config files)
   sync-tooling-configs            Tooling sync only (overwrites config files)
+  sync-dependency-check-suppressions-commit
+                                 Copy dependency-check-suppressions.xml and auto-commit
   sync-vscode-settings            Copy shared VS Code settings into .vscode/settings.json
   sync-core-coding-standards      Copy .cursor core coding standards with consumer package name
   sync-vite-plugin-vue-inspector  Add/pin vite-plugin-vue-inspector, wire vite.config, install, commit
@@ -1006,6 +1011,7 @@ async function runInteractiveMenu() {
           { name: 'prettier', value: 'prettier' },
           { name: 'tsconfig', value: 'tsconfig' },
           { name: 'Fallow', value: 'fallow' },
+          { name: 'Dependency-Check suppressions (sync + commit)', value: 'dependency-check' },
           { name: 'Cursor', value: 'cursor' },
           { name: 'Vue inspector (vite-plugin-vue-inspector)', value: 'vue-inspector' },
           { name: 'All', value: 'all' },

package/scripts/sync-dependency-check-suppressions-commit.mjs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+/**
+ * Copy dependency-check-suppressions.xml into the consumer repo and auto-commit.
+ *
+ * Usage:
+ *   node node_modules/fg-devkit/scripts/sync-dependency-check-suppressions-commit.mjs
+ *   pnpm exec fg-devkit sync-dependency-check-suppressions-commit
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { spawnSync } from 'node:child_process'
+
+const FILE_NAME = 'dependency-check-suppressions.xml'
+const COMMIT_MESSAGE = 'chore(repo): sync dependency-check suppressions'
+const projectRoot = process.cwd()
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+
+function findFgDevkitPackageRoot() {
+  const candidates = [
+    path.resolve(scriptDir, '..'),
+    path.join(projectRoot, 'node_modules', 'fg-devkit'),
+    path.join(projectRoot, 'node_modules', 'fds-vue-core', 'node_modules', 'fg-devkit'),
+  ]
+  for (const candidate of candidates) {
+    if (fs.existsSync(path.join(candidate, 'package.json'))) {
+      return candidate
+    }
+  }
+  return null
+}
+
+function runGit(args, options = {}) {
+  const result = spawnSync('git', args, {
+    stdio: options.capture ? 'pipe' : 'inherit',
+    encoding: options.capture ? 'utf8' : undefined,
+    cwd: projectRoot,
+    env: process.env,
+  })
+  if (result.error) {
+    console.error('[sync-dependency-check-suppressions]', result.error.message)
+    return { status: 1, stdout: '' }
+  }
+  return { status: result.status ?? 1, stdout: result.stdout ?? '' }
+}
+
+function fileDiffersFromHead(filePath) {
+  const absolutePath = path.join(projectRoot, filePath)
+  if (!fs.existsSync(absolutePath)) return false
+
+  const tracked = runGit(['ls-files', '--error-unmatch', '--', filePath], { capture: true })
+  if (tracked.status !== 0) return true
+
+  const diff = runGit(['diff', '--quiet', 'HEAD', '--', filePath], { capture: true })
+  return diff.status !== 0
+}
+
+const fgRoot = findFgDevkitPackageRoot()
+if (!fgRoot) {
+  console.error(
+    '[sync-dependency-check-suppressions] Could not find fg-devkit (install fg-devkit or a package that bundles it, e.g. fds-vue-core).',
+  )
+  process.exit(1)
+}
+
+const sourcePath = path.join(fgRoot, 'configs', FILE_NAME)
+if (!fs.existsSync(sourcePath)) {
+  console.error(`[sync-dependency-check-suppressions] Missing template: ${sourcePath}`)
+  process.exit(1)
+}
+
+fs.copyFileSync(sourcePath, path.join(projectRoot, FILE_NAME))
+console.log(`[sync-dependency-check-suppressions] Updated ${FILE_NAME}.`)
+
+if (!fileDiffersFromHead(FILE_NAME)) {
+  console.log('[sync-dependency-check-suppressions] No changes to commit.')
+  process.exit(0)
+}
+
+const stage = runGit(['add', '--', FILE_NAME])
+if (stage.status !== 0) process.exit(stage.status)
+
+console.log(`[sync-dependency-check-suppressions] Auto-committing: ${COMMIT_MESSAGE}`)
+process.exit(runGit(['commit', '-m', COMMIT_MESSAGE]).status)