fg-devkit 1.19.2 → 1.20.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/README.md +8 -0
  2. package/configs/dependency-check-suppressions.xml +36 -0
  3. package/configs/dependency-policy.vue-workspace.json +15 -15
  4. package/package.json +10 -8
  5. package/scaffold/vue/package.json +6 -6
  6. package/scripts/fg-devkit.mjs +6 -0
  7. package/scripts/sync-dependency-check-suppressions-commit.mjs +85 -0
package/README.md CHANGED
@@ -63,6 +63,14 @@ pnpm exec fgd fallow dead-code --json
63
63
 
64
64
  When you run `fgd sync-tooling-configs` (or `fgd sync-project-configs`), fg-devkit also writes a shared `.fallowrc.json` to the consuming repo.
65
65
 
66
+ Copy the shared OWASP Dependency-Check suppressions file into a consuming repo and commit it:
67
+
68
+ ```bash
69
+ pnpm exec fgd sync-dependency-check-suppressions-commit
70
+ ```
71
+
72
+ Jenkins `owaspDependencyCheck` reads `dependency-check-suppressions.xml` from the repo root when the file exists. Add another `<suppress>` element in the shared fg-devkit file for each additional accepted finding. The command overwrites the consumer copy.
73
+
66
74
  To sync standard consumer scripts to `fgd` commands:
67
75
 
68
76
  ```bash
package/configs/dependency-check-suppressions.xml ADDED
@@ -0,0 +1,36 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3
+ <suppress until="2026-12-01Z">
4
+ <notes><![CDATA[
5
+ braces <= 3.0.3 — GHSA-vfj7-8cjw-p6xm (stack exhaustion via deeply nested patterns).
6
+ No patched release exists; 3.0.3 is the latest version.
7
+ Transitive devDependency only, via fast-glob and micromatch
8
+ (@intlify/unplugin-vue-i18n and fg-devkit). Not shipped in the app runtime.
9
+ Risk accepted until braces publishes a release after 3.0.3.
10
+
11
+ pnpm audit paths do not equal the module name, so Dependency-Check creates
12
+ a virtual dependency at pnpm-lock.yaml?braces with no package URL version.
13
+ Jenkins shows the id as NPMGHSA-vfj7-8cjw-p6xm (source NPM + GHSA id).
14
+ Older analyzers may use the numeric advisory id 1240992.
15
+ ]]></notes>
16
+ <filePath regex="true">.*pnpm-lock\.yaml\?braces$</filePath>
17
+ <vulnerabilityName regex="true">.*(GHSA-vfj7-8cjw-p6xm|1240992).*</vulnerabilityName>
18
+ </suppress>
19
+ <suppress until="2026-12-01Z">
20
+ <notes><![CDATA[
21
+ sprintf-js <=1.1.3 — GHSA-hp3w-g68c-fv3c / CVE-2026-97058 (denial of service
22
+ through unbounded precision specifiers). No patched release exists; 1.1.3
23
+ is the latest version. Transitive optional devDependency only, via
24
+ vite-plugin-dts > @microsoft/api-extractor > @rushstack/ts-command-line >
25
+ argparse. Not shipped in the library runtime. Risk accepted until
26
+ sprintf-js publishes a release after 1.1.3.
27
+
28
+ pnpm audit paths do not equal the module name, so Dependency-Check creates
29
+ a virtual dependency at pnpm-lock.yaml?sprintf-js with no package URL version.
30
+ Jenkins shows the id as NPMGHSA-hp3w-g68c-fv3c (source NPM + GHSA id).
31
+ Older analyzers may use the numeric advisory id 1241202.
32
+ ]]></notes>
33
+ <filePath regex="true">.*pnpm-lock\.yaml\?sprintf-js$</filePath>
34
+ <vulnerabilityName regex="true">.*(GHSA-hp3w-g68c-fv3c|CVE-2026-97058|1241202).*</vulnerabilityName>
35
+ </suppress>
36
+ </suppressions>
package/configs/dependency-policy.vue-workspace.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "toolchain": {
3
- "packageManager": "pnpm@12.8.1",
3
+ "packageManager": "pnpm@12.9.1",
4
4
  "node": {
5
5
  "nvmrc": "22",
6
6
  "engines": ">=22.13.0",
@@ -12,13 +12,13 @@
12
12
  "dependencies": {
13
13
  "@e965/xlsx": "0.20.3",
14
14
  "@element-plus/icons-vue": "2.3.2",
15
- "@lexical/html": "0.49.0",
16
- "@lexical/list": "0.49.0",
17
- "@lexical/rich-text": "0.49.0",
18
- "@lexical/link": "0.49.0",
15
+ "@lexical/html": "0.52.0",
16
+ "@lexical/list": "0.52.0",
17
+ "@lexical/rich-text": "0.52.0",
18
+ "@lexical/link": "0.52.0",
19
19
  "@piwikpro/vue-piwik-pro": "2.0.0",
20
- "@sentry/vue": "11.1.0",
21
- "@tanstack/vue-query": "5.104.0",
20
+ "@sentry/vue": "11.4.0",
21
+ "@tanstack/vue-query": "5.104.1",
22
22
  "@types/leaflet": "1.9.22",
23
23
  "@unhead/vue": "2.0.5",
24
24
  "@vue-leaflet/vue-leaflet": "0.10.1",
@@ -33,10 +33,10 @@
33
33
  "fds-vue-core": "8.10.0",
34
34
  "imask": "7.6.1",
35
35
  "leaflet": "1.9.4",
36
- "lexical": "0.49.0",
36
+ "lexical": "0.52.0",
37
37
  "lodash": "4.18.1",
38
38
  "lodash-es": "4.18.1",
39
- "markdown-it": "14.3.0",
39
+ "markdown-it": "15.0.2",
40
40
  "pinia": "4.0.3",
41
41
  "playwright": "1.63.0",
42
42
  "quill": "2.0.3",
@@ -45,7 +45,7 @@
45
45
  "vega-embed": "7.3.0",
46
46
  "vega-lite": "6.4.3",
47
47
  "vue-chartjs": "5.3.4",
48
- "vue-i18n": "11.4.12",
48
+ "vue-i18n": "11.4.13",
49
49
  "vue-quilly": "1.1.6",
50
50
  "vue-router": "5.3.1",
51
51
  "vue3-touch-keyboard": "1.3.9",
@@ -54,7 +54,7 @@
54
54
  "yup": "1.7.1"
55
55
  },
56
56
  "devDependencies": {
57
- "@chromatic-com/storybook": "5.3.1",
57
+ "@chromatic-com/storybook": "5.4.0",
58
58
  "@eslint/js": "9.39.1",
59
59
  "@intlify/unplugin-vue-i18n": "11.2.5",
60
60
  "@playwright/test": "1.63.0",
@@ -63,7 +63,7 @@
63
63
  "@storybook/addon-vitest": "10.6.1",
64
64
  "@storybook/vue3": "10.6.1",
65
65
  "@storybook/vue3-vite": "10.6.1",
66
- "@tanstack/vue-query-devtools": "6.3.0",
66
+ "@tanstack/vue-query-devtools": "6.3.1",
67
67
  "@tsconfig/node22": "22.0.6",
68
68
  "@types/lodash-es": "4.17.12",
69
69
  "@types/node": "22.16.5",
@@ -76,12 +76,12 @@
76
76
  "babel-eslint": "10.1.0",
77
77
  "eslint-plugin-storybook": "10.6.1",
78
78
  "globals": "15.11.0",
79
- "jsdom": "30.1.1",
79
+ "jsdom": "30.1.2",
80
80
  "sass": "1.105.1",
81
81
  "storybook": "10.6.1",
82
82
  "tsx": "4.23.15",
83
83
  "vega": "6.4.0",
84
- "vite-plugin-dts": "5.1.1",
84
+ "vite-plugin-dts": "5.1.2",
85
85
  "vite-plugin-vue-devtools": "8.2.1",
86
86
  "vite-plugin-vue-inspector": "7.0.0",
87
87
  "vitest": "5.0.3",
@@ -95,7 +95,7 @@
95
95
  "dotenv": "18.0.5",
96
96
  "qrcode.vue": "3.11.0",
97
97
  "tailwindcss": "4.3.3",
98
- "vite": "8.3.1",
98
+ "vite": "8.3.2",
99
99
  "vue": "3.5.43"
100
100
  }
101
101
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "fg-devkit",
3
- "version": "1.19.2",
3
+ "version": "1.20.2",
4
4
  "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
5
5
  "type": "module",
6
6
  "license": "UNLICENSED",
@@ -18,12 +18,14 @@
18
18
  "./lefthook.yml": "./configs/lefthook.yml",
19
19
  "./vscode-settings.json": "./configs/vscode-settings.json",
20
20
  "./dependency-policy.vue-workspace.json": "./configs/dependency-policy.vue-workspace.json",
21
+ "./dependency-check-suppressions.xml": "./configs/dependency-check-suppressions.xml",
21
22
  "./vuln-commit": "./scripts/vuln-commit.mjs",
22
23
  "./cz-config": "./scripts/cz/.cz-config.cjs",
23
24
  "./scripts/sync-peers-from-dev.mjs": "./scripts/sync-peers-from-dev.mjs",
24
25
  "./scripts/sync-vscode-settings.mjs": "./scripts/sync-vscode-settings.mjs",
25
26
  "./scripts/sync-core-coding-standards.mjs": "./scripts/sync-core-coding-standards.mjs",
26
27
  "./scripts/sync-tooling-configs.mjs": "./scripts/sync-tooling-configs.mjs",
28
+ "./scripts/sync-dependency-check-suppressions-commit.mjs": "./scripts/sync-dependency-check-suppressions-commit.mjs",
27
29
  "./scripts/sync-project-configs.mjs": "./scripts/sync-project-configs.mjs",
28
30
  "./scripts/sync-consumer-scripts.mjs": "./scripts/sync-consumer-scripts.mjs",
29
31
  "./scripts/sync-vite-plugin-vue-inspector.mjs": "./scripts/sync-vite-plugin-vue-inspector.mjs",
@@ -109,10 +111,10 @@
109
111
  }
110
112
  },
111
113
  "dependencies": {
112
- "@inquirer/checkbox": "5.2.5",
113
- "@inquirer/confirm": "6.3.2",
114
- "@inquirer/input": "5.1.6",
115
- "@inquirer/select": "5.2.5",
114
+ "@inquirer/checkbox": "5.2.6",
115
+ "@inquirer/confirm": "6.3.3",
116
+ "@inquirer/input": "5.1.7",
117
+ "@inquirer/select": "5.2.6",
116
118
  "@intlify/eslint-plugin-vue-i18n": "4.5.1",
117
119
  "@typescript-eslint/eslint-plugin": "8.71.0",
118
120
  "@typescript-eslint/parser": "8.71.0",
@@ -120,18 +122,18 @@
120
122
  "@vue/eslint-config-prettier": "10.2.0",
121
123
  "@vue/eslint-config-typescript": "14.9.0",
122
124
  "@vue/tsconfig": "0.9.1",
123
- "eslint": "10.11.0",
125
+ "eslint": "10.12.0",
124
126
  "eslint-plugin-prettier": "5.5.6",
125
127
  "eslint-plugin-vue": "10.11.1",
126
128
  "fallow": "3.31.0",
127
129
  "git-cliff": "2.14.2",
128
- "lefthook": "2.1.15",
130
+ "lefthook": "2.1.17",
129
131
  "npm-check-updates": "23.1.0",
130
132
  "prettier": "3.9.9",
131
133
  "tsx": "4.23.15",
132
134
  "typescript": "5.9.3",
133
135
  "vue-eslint-parser": "10.4.1",
134
- "vue-tsc": "3.3.11"
136
+ "vue-tsc": "3.3.12"
135
137
  },
136
138
  "devDependencies": {
137
139
  "cz-git": "1.14.0",
package/scaffold/vue/package.json CHANGED
@@ -16,7 +16,7 @@
16
16
  },
17
17
  "dependencies": {
18
18
  "@tailwindcss/vite": "4.3.3",
19
- "@tanstack/vue-query": "5.104.0",
19
+ "@tanstack/vue-query": "5.104.1",
20
20
  "axios": "1.20.0",
21
21
  "content-disposition-header": "0.6.0",
22
22
  "date-fns": "4.4.0",
@@ -25,21 +25,21 @@
25
25
  "pinia": "4.0.3",
26
26
  "qrcode.vue": "3.11.0",
27
27
  "vue": "3.5.43",
28
- "vue-i18n": "11.4.12",
28
+ "vue-i18n": "11.4.13",
29
29
  "vue-router": "5.3.1"
30
30
  },
31
31
  "devDependencies": {
32
32
  "@intlify/unplugin-vue-i18n": "11.2.5",
33
- "@tanstack/vue-query-devtools": "6.3.0",
33
+ "@tanstack/vue-query-devtools": "6.3.1",
34
34
  "@types/node": "22.16.5",
35
- "fg-devkit": "1.19.2",
35
+ "fg-devkit": "1.20.2",
36
36
  "@vitejs/plugin-vue": "6.0.9",
37
37
  "tailwindcss": "4.3.3",
38
38
  "tsx": "4.23.15",
39
- "vite": "8.3.1",
39
+ "vite": "8.3.2",
40
40
  "vite-plugin-vue-inspector": "7.0.0"
41
41
  },
42
- "packageManager": "pnpm@12.8.1",
42
+ "packageManager": "pnpm@12.9.1",
43
43
  "engines": {
44
44
  "node": ">=22.13.0"
45
45
  }
package/scripts/fg-devkit.mjs CHANGED
@@ -20,6 +20,7 @@
20
20
  * pnpm exec fg-devkit prune-overrides [--fix] [--commit]
21
21
  * pnpm exec fg-devkit sync-project-configs (VS Code + tooling sync; overwrites config files)
22
22
  * pnpm exec fg-devkit sync-tooling-configs (tooling sync only; overwrites config files)
23
+ * pnpm exec fg-devkit sync-dependency-check-suppressions-commit
23
24
  * pnpm exec fg-devkit sync-vscode-settings
24
25
  * pnpm exec fg-devkit sync-core-coding-standards
25
26
  * pnpm exec fg-devkit sync-consumer-scripts
@@ -446,6 +447,7 @@ function runSyncConfigTarget(target) {
446
447
  if (target === 'prettier') return syncFileFromTemplate('configs/prettier.sync-stub.js', 'prettier.config.js')
447
448
  if (target === 'tsconfig') return syncFileFromTemplate('configs/tsconfig.app.sync.json', 'tsconfig.json')
448
449
  if (target === 'fallow') return syncFileFromTemplate('configs/fallowrc.sync-stub.json', '.fallowrc.json')
450
+ if (target === 'dependency-check') return runNode('sync-dependency-check-suppressions-commit.mjs')
449
451
  if (target === 'cursor') return runNode('sync-core-coding-standards.mjs')
450
452
  if (target === 'vue-inspector') return runNode('sync-vite-plugin-vue-inspector.mjs')
451
453
  if (target === 'all') return runNode('sync-project-configs.mjs')
@@ -479,6 +481,7 @@ const DIRECT_COMMANDS = {
479
481
  'prune-overrides': 'prune-overrides.mjs',
480
482
  'sync-project-configs': 'sync-project-configs.mjs',
481
483
  'sync-tooling-configs': 'sync-tooling-configs.mjs',
484
+ 'sync-dependency-check-suppressions-commit': 'sync-dependency-check-suppressions-commit.mjs',
482
485
  'sync-vscode-settings': 'sync-vscode-settings.mjs',
483
486
  'sync-core-coding-standards': 'sync-core-coding-standards.mjs',
484
487
  'sync-vite-plugin-vue-inspector': 'sync-vite-plugin-vue-inspector.mjs',
@@ -545,6 +548,8 @@ Commands:
545
548
  Report unused workspace overrides; --fix removes them; --commit also auto-commits
546
549
  sync-project-configs VS Code + tooling sync (overwrites config files)
547
550
  sync-tooling-configs Tooling sync only (overwrites config files)
551
+ sync-dependency-check-suppressions-commit
552
+ Copy dependency-check-suppressions.xml and auto-commit
548
553
  sync-vscode-settings Copy shared VS Code settings into .vscode/settings.json
549
554
  sync-core-coding-standards Copy .cursor core coding standards with consumer package name
550
555
  sync-vite-plugin-vue-inspector Add/pin vite-plugin-vue-inspector, wire vite.config, install, commit
@@ -1006,6 +1011,7 @@ async function runInteractiveMenu() {
1006
1011
  { name: 'prettier', value: 'prettier' },
1007
1012
  { name: 'tsconfig', value: 'tsconfig' },
1008
1013
  { name: 'Fallow', value: 'fallow' },
1014
+ { name: 'Dependency-Check suppressions (sync + commit)', value: 'dependency-check' },
1009
1015
  { name: 'Cursor', value: 'cursor' },
1010
1016
  { name: 'Vue inspector (vite-plugin-vue-inspector)', value: 'vue-inspector' },
1011
1017
  { name: 'All', value: 'all' },
package/scripts/sync-dependency-check-suppressions-commit.mjs ADDED
@@ -0,0 +1,85 @@
1
+ #!/usr/bin/env node
2
+ /**
3
+ * Copy dependency-check-suppressions.xml into the consumer repo and auto-commit.
4
+ *
5
+ * Usage:
6
+ * node node_modules/fg-devkit/scripts/sync-dependency-check-suppressions-commit.mjs
7
+ * pnpm exec fg-devkit sync-dependency-check-suppressions-commit
8
+ */
9
+
10
+ import fs from 'node:fs'
11
+ import path from 'node:path'
12
+ import { fileURLToPath } from 'node:url'
13
+ import { spawnSync } from 'node:child_process'
14
+
15
+ const FILE_NAME = 'dependency-check-suppressions.xml'
16
+ const COMMIT_MESSAGE = 'chore(repo): sync dependency-check suppressions'
17
+ const projectRoot = process.cwd()
18
+ const scriptDir = path.dirname(fileURLToPath(import.meta.url))
19
+
20
+ function findFgDevkitPackageRoot() {
21
+ const candidates = [
22
+ path.resolve(scriptDir, '..'),
23
+ path.join(projectRoot, 'node_modules', 'fg-devkit'),
24
+ path.join(projectRoot, 'node_modules', 'fds-vue-core', 'node_modules', 'fg-devkit'),
25
+ ]
26
+ for (const candidate of candidates) {
27
+ if (fs.existsSync(path.join(candidate, 'package.json'))) {
28
+ return candidate
29
+ }
30
+ }
31
+ return null
32
+ }
33
+
34
+ function runGit(args, options = {}) {
35
+ const result = spawnSync('git', args, {
36
+ stdio: options.capture ? 'pipe' : 'inherit',
37
+ encoding: options.capture ? 'utf8' : undefined,
38
+ cwd: projectRoot,
39
+ env: process.env,
40
+ })
41
+ if (result.error) {
42
+ console.error('[sync-dependency-check-suppressions]', result.error.message)
43
+ return { status: 1, stdout: '' }
44
+ }
45
+ return { status: result.status ?? 1, stdout: result.stdout ?? '' }
46
+ }
47
+
48
+ function fileDiffersFromHead(filePath) {
49
+ const absolutePath = path.join(projectRoot, filePath)
50
+ if (!fs.existsSync(absolutePath)) return false
51
+
52
+ const tracked = runGit(['ls-files', '--error-unmatch', '--', filePath], { capture: true })
53
+ if (tracked.status !== 0) return true
54
+
55
+ const diff = runGit(['diff', '--quiet', 'HEAD', '--', filePath], { capture: true })
56
+ return diff.status !== 0
57
+ }
58
+
59
+ const fgRoot = findFgDevkitPackageRoot()
60
+ if (!fgRoot) {
61
+ console.error(
62
+ '[sync-dependency-check-suppressions] Could not find fg-devkit (install fg-devkit or a package that bundles it, e.g. fds-vue-core).',
63
+ )
64
+ process.exit(1)
65
+ }
66
+
67
+ const sourcePath = path.join(fgRoot, 'configs', FILE_NAME)
68
+ if (!fs.existsSync(sourcePath)) {
69
+ console.error(`[sync-dependency-check-suppressions] Missing template: ${sourcePath}`)
70
+ process.exit(1)
71
+ }
72
+
73
+ fs.copyFileSync(sourcePath, path.join(projectRoot, FILE_NAME))
74
+ console.log(`[sync-dependency-check-suppressions] Updated ${FILE_NAME}.`)
75
+
76
+ if (!fileDiffersFromHead(FILE_NAME)) {
77
+ console.log('[sync-dependency-check-suppressions] No changes to commit.')
78
+ process.exit(0)
79
+ }
80
+
81
+ const stage = runGit(['add', '--', FILE_NAME])
82
+ if (stage.status !== 0) process.exit(stage.status)
83
+
84
+ console.log(`[sync-dependency-check-suppressions] Auto-committing: ${COMMIT_MESSAGE}`)
85
+ process.exit(runGit(['commit', '-m', COMMIT_MESSAGE]).status)