fg-devkit 1.21.5 → 1.23.1

package/README.md

@@ -61,7 +61,9 @@ Or run Fallow directly with custom args:
 pnpm exec fgd fallow dead-code --json
 ```
 
-When you run `fgd sync-tooling-configs` (or `fgd sync-project-configs`), fg-devkit also writes a shared `.fallowrc.json` to the consuming repo.
+Both use fg-devkit's shared [`configs/fallowrc.json`](configs/fallowrc.json), so config changes reach every repo on
+the next fg-devkit bump. A repo that has its own `.fallowrc.json` (or `.fallowrc.jsonc`, `fallow.toml`, `.fallow.toml`)
+uses that instead, and so does an explicit `--config`.
 
 Write the OWASP Dependency-Check suppressions that apply to a consuming repo and commit them:
 
@@ -81,7 +83,7 @@ To sync standard consumer scripts to `fgd` commands:
 pnpm exec fgd sync-consumer-scripts
 ```
 
-To migrate from Husky + lint-staged to Lefthook:
+To set up Lefthook git hooks:
 
 ```bash
 pnpm exec fgd setup-lefthook
@@ -151,7 +153,8 @@ Upgrade one or more package.json dependencies and auto-commit
 pnpm exec fgd policy-upgrade-commit
 ```
 
-Same upgrade, then prune unused workspace overrides in a second commit if any can be dropped:
+Same upgrade, then prune unused workspace overrides in a second commit if any can be dropped
+(this is what the menu's **Upgrade packages [interactive, auto-commit]** runs):
 
 ```bash
 pnpm exec fgd policy-upgrade-commit --prune-overrides
@@ -163,15 +166,21 @@ Fix `pnpm audit` findings with the smallest change, verify, and auto-commit:
 pnpm exec fgd audit-override-commit              # refresh, override, prune, verify, commit
 pnpm exec fgd audit-override-commit --no-verify  # skip lint/typecheck/test/build (git hooks still run)
 pnpm exec fgd audit-override-commit --no-commit  # leave the changes in the working tree
+pnpm exec fgd audit-override-commit --allow-major --allow-young --bump-direct  # force without asking
 ```
 
 1. Runs `pnpm audit` and refreshes the vulnerable packages in the lockfile (`pnpm update <names>`).
    Each moves to the newest version its parents' ranges already allow, so no override is needed.
 2. Audits again. When a patched version exists but a parent's range blocks it, adds a tight override to
    `pnpm-workspace.yaml`: `'name@>=installed <patched': 'patched'` (the lowest patched version).
-3. Reports instead of overriding when the only patch is in a new major (upgrade the parent), when it is
-   younger than `minimumReleaseAge` (re-run later), when the package is a direct dependency (bump it with
-   `policy-upgrade-commit`), or when no patch exists (candidate for `auditConfig.ignoreGhsas`).
+3. Asks, one package at a time, before going further than that:
+   - the only patch is in a new major: override across the major anyway (`--allow-major`)
+   - the patch is younger than `minimumReleaseAge`: allow it by adding `name@version` to
+     `minimumReleaseAgeExclude` (`--allow-young`). Step 5 removes the entry once it is old enough.
+   - the package is a direct dependency: bump it in `package.json`, keeping the `^`/`~` prefix (`--bump-direct`)
+
+   Without a terminal (CI) these are only reported unless the flag is passed. Findings with no patch are always
+   reported (candidate for a suppression, see step 6). Forced changes go through the same checks in step 7.
 4. Prunes overrides that no longer change the audit.
 5. Removes `minimumReleaseAgeExclude` entries that are no longer needed (see `prune-release-age-exclude` below).
    This step also runs when `pnpm audit` is clean.
@@ -182,7 +191,7 @@ pnpm exec fgd audit-override-commit --no-commit  # leave the changes in the work
 7. Installs and runs the repo's `lint-check`, `lint:ts`, `test`, `test:unit` and `build` scripts when present.
    Nothing is committed if a check fails.
 8. Commits the lockfile refresh (`vuln(package): refresh lockfile` / `vuln(): refresh N packages in lockfile`),
-   the override changes (`vuln(package): override version`, `vuln(): override N packages`), the release-age
+   the direct bumps (`vuln(package): bump to version` / `vuln(): bump N dependencies`), the override changes (`vuln(package): override version`, `vuln(): override N packages`), the release-age
    excludes (`chore(repo): prune minimumReleaseAgeExclude`) and the suppressions file
    (`chore(repo): sync dependency-check suppressions`) separately.
 

package/configs/dependency-policy.vue-workspace.json

@@ -1,6 +1,6 @@
 {
   "toolchain": {
-    "packageManager": "pnpm@12.9.1",
+    "packageManager": "pnpm@12.11.2",
     "node": {
       "nvmrc": "22",
       "engines": ">=22.13.0",
@@ -17,8 +17,8 @@
       "@lexical/rich-text": "0.52.0",
       "@lexical/link": "0.52.0",
       "@piwikpro/vue-piwik-pro": "2.0.0",
-      "@sentry/vue": "11.5.0",
-      "@tanstack/vue-query": "5.104.1",
+      "@sentry/vue": "11.7.0",
+      "@tanstack/vue-query": "5.104.2",
       "@types/leaflet": "1.9.22",
       "@unhead/vue": "2.0.5",
       "@vue-leaflet/vue-leaflet": "0.10.1",
@@ -30,72 +30,72 @@
       "content-disposition-header": "0.6.0",
       "date-fns": "4.4.0",
       "element-plus": "2.14.7",
-      "fds-vue-core": "8.10.0",
+      "fds-vue-core": "8.11.0",
       "imask": "7.6.1",
       "leaflet": "1.9.4",
       "lexical": "0.52.0",
       "lodash": "4.18.1",
       "lodash-es": "4.18.1",
       "markdown-it": "15.0.2",
-      "pinia": "4.0.3",
-      "playwright": "1.63.0",
+      "pinia": "4.1.0",
+      "playwright": "1.64.0",
       "quill": "2.0.3",
       "randexp": "0.5.3",
       "register-service-worker": "1.7.2",
       "vega-embed": "7.3.0",
-      "vega-lite": "6.4.3",
+      "vega-lite": "6.5.0",
       "vue-chartjs": "5.3.4",
-      "vue-i18n": "11.4.13",
+      "vue-i18n": "11.4.14",
       "vue-quilly": "1.1.6",
-      "vue-router": "5.3.1",
+      "vue-router": "5.4.0",
       "vue3-touch-keyboard": "1.3.9",
       "vuex": "4.1.0",
       "vuex-persist": "3.1.3",
       "yup": "1.7.1"
     },
     "devDependencies": {
-      "@chromatic-com/storybook": "5.4.0",
+      "@chromatic-com/storybook": "5.5.1",
       "@eslint/js": "9.39.1",
       "@intlify/unplugin-vue-i18n": "11.2.5",
-      "@playwright/test": "1.63.0",
-      "@storybook/addon-a11y": "10.6.1",
-      "@storybook/addon-docs": "10.6.1",
-      "@storybook/addon-vitest": "10.6.1",
-      "@storybook/vue3": "10.6.1",
-      "@storybook/vue3-vite": "10.6.1",
-      "@tanstack/vue-query-devtools": "6.3.1",
+      "@playwright/test": "1.64.0",
+      "@storybook/addon-a11y": "10.6.2",
+      "@storybook/addon-docs": "10.6.2",
+      "@storybook/addon-vitest": "10.6.2",
+      "@storybook/vue3": "10.6.2",
+      "@storybook/vue3-vite": "10.6.2",
+      "@tanstack/vue-query-devtools": "6.3.2",
       "@tsconfig/node22": "22.0.6",
       "@types/lodash-es": "4.17.12",
       "@types/node": "22.16.5",
-      "@vitest/browser": "5.0.3",
-      "@vue/compiler-dom": "3.5.43",
+      "@vitest/browser": "5.0.4",
+      "@vue/compiler-dom": "3.5.44",
       "@vue/eslint-config-standard": "8.0.1",
-      "@vue/server-renderer": "3.5.43",
+      "@vue/server-renderer": "3.5.44",
       "@vue/test-utils": "2.5.1",
       "arg": "5.0.2",
       "babel-eslint": "10.1.0",
-      "eslint-plugin-storybook": "10.6.1",
+      "eslint-plugin-storybook": "10.6.2",
       "globals": "15.11.0",
       "jsdom": "30.1.2",
       "sass": "1.105.1",
-      "storybook": "10.6.1",
+      "storybook": "10.6.2",
       "tsx": "4.23.15",
       "vega": "6.4.0",
       "vite-plugin-dts": "5.1.2",
       "vite-plugin-vue-devtools": "8.2.1",
       "vite-plugin-vue-inspector": "7.0.0",
-      "vitest": "5.0.3",
+      "vitest": "5.0.4",
       "yaml": "2.9.1"
     }
   },
   "managedAnywhere": {
     "@tailwindcss/vite": "4.3.3",
-    "@vitejs/plugin-vue": "6.0.9",
+    "@vitejs/plugin-vue": "6.0.10",
     "axios": "1.20.0",
-    "dotenv": "18.0.6",
+    "dotenv": "18.0.7",
     "qrcode.vue": "3.11.0",
     "tailwindcss": "4.3.3",
-    "vite": "8.3.3",
-    "vue": "3.5.43"
+    "vite": "8.3.4",
+    "vue": "3.5.44"
   }
 }

package/configs/eslint.config.base.d.ts

@@ -7,6 +7,7 @@ export interface CreateBaseConfigOptions {
   extraNonTypeAwareFiles?: string[]
   enablePrettier?: boolean
   enableI18n?: boolean
+  enableA11y?: boolean
   i18nLocaleDir?: string
   additionalRules?: Linter.RulesRecord
   additionalPlugins?: NonNullable<Linter.Config['plugins']>

package/configs/eslint.config.base.js

@@ -8,6 +8,7 @@ import pluginVitest from '@vitest/eslint-plugin'
 import skipFormatting from '@vue/eslint-config-prettier/skip-formatting'
 import pluginPrettier from 'eslint-plugin-prettier'
 import pluginVue from 'eslint-plugin-vue'
+import pluginVueA11y from 'eslint-plugin-vuejs-accessibility'
 import { globalIgnores } from 'eslint/config'
 import vueParser from 'vue-eslint-parser'
 
@@ -19,6 +20,7 @@ export default function createBaseConfig(options = {}) {
     extraNonTypeAwareFiles = [],
     enablePrettier = false,
     enableI18n = false,
+    enableA11y = false,
     i18nLocaleDir = './src/lang/*.json',
     additionalRules = {},
     additionalPlugins = {},
@@ -120,6 +122,7 @@ export default function createBaseConfig(options = {}) {
       ...additionalIgnores,
     ]),
     ...pluginVue.configs['flat/essential'],
+    ...(enableA11y ? pluginVueA11y.configs['flat/recommended'] : []),
     {
       ...pluginVitest.configs.recommended,
       files: ['**/__tests__/**', '**/*.test.*', '**/*.spec.*'],

package/configs/eslint.sync-stub.js

@@ -12,6 +12,7 @@ export default [
     extraNonTypeAwareFiles: ['playwright.config.ts', 'poeditor/**/*.ts'],
     enablePrettier: true,
     enableI18n: true,
+    enableA11y: true,
     i18nLocaleDir: './src/lang/*.json',
   }),
 ]

package/package.json

@@ -1,14 +1,12 @@
 {
   "name": "fg-devkit",
-  "version": "1.21.5",
+  "version": "1.23.1",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
   "bin": {
     "fgd": "./scripts/fg-devkit.mjs",
-    "fg-devkit": "./scripts/fg-devkit.mjs",
-    "fg-vuln-commit": "./scripts/vuln-commit.mjs",
-    "fds-vuln-commit": "./scripts/vuln-commit.mjs"
+    "fg-devkit": "./scripts/fg-devkit.mjs"
   },
   "exports": {
     "./tsconfig.base.json": "./configs/tsconfig.base.json",
@@ -22,70 +20,13 @@
     "./vscode-settings.json": "./configs/vscode-settings.json",
     "./dependency-policy.vue-workspace.json": "./configs/dependency-policy.vue-workspace.json",
     "./dependency-check-suppressions.xml": "./configs/dependency-check-suppressions.xml",
-    "./vuln-commit": "./scripts/vuln-commit.mjs",
-    "./cz-config": "./scripts/cz/.cz-config.cjs",
-    "./scripts/sync-peers-from-dev.mjs": "./scripts/sync-peers-from-dev.mjs",
     "./scripts/sync-vscode-settings.mjs": "./scripts/sync-vscode-settings.mjs",
-    "./scripts/sync-core-coding-standards.mjs": "./scripts/sync-core-coding-standards.mjs",
-    "./scripts/sync-tooling-configs.mjs": "./scripts/sync-tooling-configs.mjs",
-    "./scripts/sync-dependency-check-suppressions-commit.mjs": "./scripts/sync-dependency-check-suppressions-commit.mjs",
-    "./scripts/sync-project-configs.mjs": "./scripts/sync-project-configs.mjs",
-    "./scripts/sync-consumer-scripts.mjs": "./scripts/sync-consumer-scripts.mjs",
-    "./scripts/sync-vite-plugin-vue-inspector.mjs": "./scripts/sync-vite-plugin-vue-inspector.mjs",
-    "./scripts/sync-consumer-lefthook.mjs": "./scripts/sync-consumer-lefthook.mjs",
-    "./scripts/policy-outdated.mjs": "./scripts/policy-outdated.mjs",
-    "./scripts/policy-vulns.mjs": "./scripts/policy-vulns.mjs",
-    "./scripts/repo-vulns.mjs": "./scripts/repo-vulns.mjs",
-    "./scripts/fleet-vulns.mjs": "./scripts/fleet-vulns.mjs",
-    "./scripts/fleet-bump-fg-devkit.mjs": "./scripts/fleet-bump-fg-devkit.mjs",
-    "./scripts/bump-pnpm-toolchain.mjs": "./scripts/bump-pnpm-toolchain.mjs",
-    "./scripts/bump-node-toolchain.mjs": "./scripts/bump-node-toolchain.mjs",
-    "./scripts/sync-node-toolchain.mjs": "./scripts/sync-node-toolchain.mjs",
-    "./scripts/node-toolchain-sync.mjs": "./scripts/node-toolchain-sync.mjs",
-    "./scripts/fleet-project-repos.mjs": "./scripts/fleet-project-repos.mjs",
-    "./scripts/fleet-repo-picker.mjs": "./scripts/fleet-repo-picker.mjs",
-    "./scripts/sync-pnpm-toolchain.mjs": "./scripts/sync-pnpm-toolchain.mjs",
-    "./scripts/pnpm-toolchain-sync.mjs": "./scripts/pnpm-toolchain-sync.mjs",
-    "./scripts/fleet-git-pull.mjs": "./scripts/fleet-git-pull.mjs",
-    "./scripts/fleet-git-pull-scoped.mjs": "./scripts/fleet-git-pull-scoped.mjs",
-    "./scripts/git-pull-fleet-common.mjs": "./scripts/git-pull-fleet-common.mjs",
-    "./scripts/git-fleet-common.mjs": "./scripts/git-fleet-common.mjs",
-    "./scripts/git-commit-push-fleet-common.mjs": "./scripts/git-commit-push-fleet-common.mjs",
-    "./scripts/fleet-git-commit-push.mjs": "./scripts/fleet-git-commit-push.mjs",
-    "./scripts/fleet-git-commit-push-scoped.mjs": "./scripts/fleet-git-commit-push-scoped.mjs",
-    "./scripts/git-discard-fleet-common.mjs": "./scripts/git-discard-fleet-common.mjs",
-    "./scripts/fleet-git-discard.mjs": "./scripts/fleet-git-discard.mjs",
-    "./scripts/fleet-git-discard-scoped.mjs": "./scripts/fleet-git-discard-scoped.mjs",
-    "./scripts/policy-upgrade.mjs": "./scripts/policy-upgrade.mjs",
-    "./scripts/policy-upgrade-commit.mjs": "./scripts/policy-upgrade-commit.mjs",
-    "./scripts/override-changes.mjs": "./scripts/override-changes.mjs",
-    "./scripts/audit-override-commit.mjs": "./scripts/audit-override-commit.mjs",
-    "./scripts/prune-overrides.mjs": "./scripts/prune-overrides.mjs",
-    "./scripts/check-dependency-policy.mjs": "./scripts/check-dependency-policy.mjs",
-    "./scripts/sync-dependency-policy.mjs": "./scripts/sync-dependency-policy.mjs",
-    "./scripts/sync-dependency-policy-commit.mjs": "./scripts/sync-dependency-policy-commit.mjs",
-    "./scripts/resolve-dependency-policy-path.mjs": "./scripts/resolve-dependency-policy-path.mjs",
-    "./scripts/refresh-dependency-policy-from-repos.mjs": "./scripts/refresh-dependency-policy-from-repos.mjs",
-    "./scripts/sync-scaffold-vue-deps.mjs": "./scripts/sync-scaffold-vue-deps.mjs",
-    "./scripts/poeditor-common.mjs": "./scripts/poeditor-common.mjs",
-    "./scripts/piwik.mjs": "./scripts/piwik.mjs",
-    "./scripts/piwik-common.mjs": "./scripts/piwik-common.mjs",
-    "./scripts/piwik-dimensions.mjs": "./scripts/piwik-dimensions.mjs",
-    "./scripts/poeditor-download.mjs": "./scripts/poeditor-download.mjs",
-    "./scripts/poeditor-upload.mjs": "./scripts/poeditor-upload.mjs",
-    "./scripts/scaffold-vue.mjs": "./scripts/scaffold-vue.mjs",
     "./scripts/fg-devkit.mjs": "./scripts/fg-devkit.mjs",
-    "./scripts/resolve-candidate-version.mjs": "./scripts/resolve-candidate-version.mjs",
-    "./scripts/release.sh": "./scripts/release.sh",
-    "./scripts/generate-release-notes.mjs": "./scripts/generate-release-notes.mjs",
-    "./scripts/verify-release-notes.mjs": "./scripts/verify-release-notes.mjs",
-    "./scripts/sync-release-notes-config.mjs": "./scripts/sync-release-notes-config.mjs",
     "./release-notes/parseChangelog": "./release-notes/parseChangelog.ts",
     "./release-notes/format": "./release-notes/format.ts",
     "./release-notes/types": "./release-notes/types.ts",
     "./configs/cliff.toml": "./configs/cliff.toml",
     "./configs/cliff.user.toml": "./configs/cliff.user.toml",
-    "./scripts/cz/.cz-config.cjs": "./scripts/cz/.cz-config.cjs",
     "./cursor-rules/core-coding-standards.mdc": "./.cursor/rules/core-coding-standards.mdc"
   },
   "files": [
@@ -107,40 +48,29 @@
     "typescript",
     "vue"
   ],
-  "config": {
-    "commitizen": {
-      "path": "node_modules/cz-git",
-      "czConfig": "./scripts/cz/.cz-config.cjs"
-    }
-  },
   "dependencies": {
     "@inquirer/checkbox": "5.2.6",
     "@inquirer/confirm": "6.3.3",
     "@inquirer/input": "5.1.7",
     "@inquirer/select": "5.2.6",
     "@intlify/eslint-plugin-vue-i18n": "4.5.1",
-    "@typescript-eslint/eslint-plugin": "8.71.1",
-    "@typescript-eslint/parser": "8.71.1",
+    "@typescript-eslint/eslint-plugin": "8.71.2",
+    "@typescript-eslint/parser": "8.71.2",
     "@vitest/eslint-plugin": "1.6.27",
     "@vue/eslint-config-prettier": "10.2.0",
-    "@vue/eslint-config-typescript": "14.9.0",
-    "@vue/tsconfig": "0.9.1",
     "eslint": "10.12.0",
-    "eslint-plugin-prettier": "5.5.6",
+    "eslint-plugin-prettier": "5.5.7",
     "eslint-plugin-vue": "10.11.1",
-    "fallow": "3.32.0",
+    "eslint-plugin-vuejs-accessibility": "2.6.2",
+    "fallow": "3.33.1",
     "git-cliff": "2.14.2",
-    "lefthook": "2.1.17",
-    "npm-check-updates": "23.1.0",
-    "prettier": "3.9.9",
+    "lefthook": "2.2.2",
+    "npm-check-updates": "23.1.1",
+    "prettier": "3.9.10",
     "tsx": "4.23.15",
     "typescript": "5.9.3",
     "vue-eslint-parser": "10.4.1",
-    "vue-tsc": "3.3.12"
-  },
-  "devDependencies": {
-    "cz-git": "1.14.0",
-    "czg": "1.14.0"
+    "vue-tsc": "3.3.13"
   },
   "scripts": {
     "fgd-ui": "pnpm --dir electron/maintainer-ui start",

package/scaffold/vue/package.json

@@ -16,30 +16,30 @@
   },
   "dependencies": {
     "@tailwindcss/vite": "4.3.3",
-    "@tanstack/vue-query": "5.104.1",
+    "@tanstack/vue-query": "5.104.2",
     "axios": "1.20.0",
     "content-disposition-header": "0.6.0",
     "date-fns": "4.4.0",
-    "dotenv": "18.0.6",
-    "fds-vue-core": "8.10.0",
-    "pinia": "4.0.3",
+    "dotenv": "18.0.7",
+    "fds-vue-core": "8.11.0",
+    "pinia": "4.1.0",
     "qrcode.vue": "3.11.0",
-    "vue": "3.5.43",
-    "vue-i18n": "11.4.13",
-    "vue-router": "5.3.1"
+    "vue": "3.5.44",
+    "vue-i18n": "11.4.14",
+    "vue-router": "5.4.0"
   },
   "devDependencies": {
     "@intlify/unplugin-vue-i18n": "11.2.5",
-    "@tanstack/vue-query-devtools": "6.3.1",
+    "@tanstack/vue-query-devtools": "6.3.2",
     "@types/node": "22.16.5",
-    "fg-devkit": "1.21.5",
-    "@vitejs/plugin-vue": "6.0.9",
+    "fg-devkit": "1.23.1",
+    "@vitejs/plugin-vue": "6.0.10",
     "tailwindcss": "4.3.3",
     "tsx": "4.23.15",
-    "vite": "8.3.3",
+    "vite": "8.3.4",
     "vite-plugin-vue-inspector": "7.0.0"
   },
-  "packageManager": "pnpm@12.9.1",
+  "packageManager": "pnpm@12.11.2",
   "engines": {
     "node": ">=22.13.0"
   }