fg-devkit 1.24.3 → 1.25.0

package/configs/dependency-policy.vue-workspace.json

@@ -1,6 +1,6 @@
 {
   "toolchain": {
-    "packageManager": "pnpm@12.11.2",
+    "packageManager": "pnpm@12.14.0",
     "node": {
       "nvmrc": "22",
       "engines": ">=22.13.0",
@@ -17,8 +17,8 @@
       "@lexical/rich-text": "0.52.0",
       "@lexical/link": "0.52.0",
       "@piwikpro/vue-piwik-pro": "2.0.0",
-      "@sentry/vue": "11.7.0",
-      "@tanstack/vue-query": "5.104.3",
+      "@sentry/vue": "11.8.0",
+      "@tanstack/vue-query": "5.104.5",
       "@types/leaflet": "1.9.22",
       "@unhead/vue": "2.0.5",
       "@vue-leaflet/vue-leaflet": "0.10.1",
@@ -30,13 +30,13 @@
       "content-disposition-header": "0.6.0",
       "date-fns": "4.4.0",
       "element-plus": "2.14.7",
-      "fds-vue-core": "8.11.0",
+      "fds-vue-core": "8.11.2",
       "imask": "7.6.1",
       "leaflet": "1.9.4",
       "lexical": "0.52.0",
       "lodash": "4.18.1",
       "lodash-es": "4.18.1",
-      "markdown-it": "15.0.2",
+      "markdown-it": "15.0.3",
       "pinia": "4.1.0",
       "playwright": "1.64.1",
       "quill": "2.0.3",
@@ -45,7 +45,7 @@
       "vega-embed": "7.3.0",
       "vega-lite": "6.5.0",
       "vue-chartjs": "5.3.4",
-      "vue-i18n": "11.4.14",
+      "vue-i18n": "11.4.16",
       "vue-quilly": "1.1.6",
       "vue-router": "5.4.0",
       "vue3-touch-keyboard": "1.3.9",
@@ -54,37 +54,37 @@
       "yup": "1.7.1"
     },
     "devDependencies": {
-      "@chromatic-com/storybook": "5.5.1",
+      "@chromatic-com/storybook": "5.6.0",
       "@eslint/js": "9.39.1",
-      "@intlify/unplugin-vue-i18n": "11.2.6",
+      "@intlify/unplugin-vue-i18n": "11.2.7",
       "@playwright/test": "1.64.1",
-      "@storybook/addon-a11y": "10.6.2",
-      "@storybook/addon-docs": "10.6.2",
-      "@storybook/addon-vitest": "10.6.2",
-      "@storybook/vue3": "10.6.2",
-      "@storybook/vue3-vite": "10.6.2",
-      "@tanstack/vue-query-devtools": "6.3.3",
+      "@storybook/addon-a11y": "10.6.3",
+      "@storybook/addon-docs": "10.6.3",
+      "@storybook/addon-vitest": "10.6.3",
+      "@storybook/vue3": "10.6.3",
+      "@storybook/vue3-vite": "10.6.3",
+      "@tanstack/vue-query-devtools": "6.3.5",
       "@tsconfig/node22": "22.0.6",
       "@types/lodash-es": "4.17.12",
       "@types/node": "22.16.5",
-      "@vitest/browser": "5.0.4",
+      "@vitest/browser": "5.0.5",
       "@vue/compiler-dom": "3.5.44",
       "@vue/eslint-config-standard": "8.0.1",
       "@vue/server-renderer": "3.5.44",
       "@vue/test-utils": "2.5.1",
       "arg": "5.0.2",
       "babel-eslint": "10.1.0",
-      "eslint-plugin-storybook": "10.6.2",
+      "eslint-plugin-storybook": "10.6.3",
       "globals": "15.11.0",
-      "jsdom": "30.1.2",
-      "sass": "1.105.1",
-      "storybook": "10.6.2",
+      "jsdom": "30.1.3",
+      "sass": "1.106.0",
+      "storybook": "10.6.3",
       "tsx": "4.23.15",
       "vega": "6.4.0",
       "vite-plugin-dts": "5.1.2",
       "vite-plugin-vue-devtools": "8.2.1",
       "vite-plugin-vue-inspector": "7.0.0",
-      "vitest": "5.0.4",
+      "vitest": "5.0.5",
       "yaml": "2.9.1"
     }
   },
@@ -95,7 +95,7 @@
     "dotenv": "18.0.8",
     "qrcode.vue": "3.11.0",
     "tailwindcss": "4.3.3",
-    "vite": "8.3.4",
+    "vite": "8.3.5",
     "vue": "3.5.44"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.24.3",
+  "version": "1.25.0",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
@@ -47,20 +47,20 @@
     "vue"
   ],
   "dependencies": {
-    "@inquirer/checkbox": "5.2.6",
-    "@inquirer/confirm": "6.3.3",
-    "@inquirer/input": "5.1.7",
-    "@inquirer/select": "5.2.6",
+    "@inquirer/checkbox": "5.2.7",
+    "@inquirer/confirm": "6.3.4",
+    "@inquirer/input": "5.1.8",
+    "@inquirer/select": "5.2.7",
     "@intlify/eslint-plugin-vue-i18n": "4.5.1",
-    "@typescript-eslint/eslint-plugin": "8.71.2",
-    "@typescript-eslint/parser": "8.71.2",
+    "@typescript-eslint/eslint-plugin": "8.72.0",
+    "@typescript-eslint/parser": "8.72.0",
     "@vitest/eslint-plugin": "1.6.27",
     "@vue/eslint-config-prettier": "10.2.0",
-    "eslint": "10.12.0",
+    "eslint": "10.13.0",
     "eslint-plugin-prettier": "5.5.7",
     "eslint-plugin-vue": "10.11.1",
     "eslint-plugin-vuejs-accessibility": "2.6.2",
-    "fallow": "3.33.1",
+    "fallow": "3.34.1",
     "git-cliff": "2.14.2",
     "lefthook": "2.2.2",
     "npm-check-updates": "23.1.1",

package/scaffold/vue/package.json

@@ -16,30 +16,30 @@
   },
   "dependencies": {
     "@tailwindcss/vite": "4.3.3",
-    "@tanstack/vue-query": "5.104.3",
+    "@tanstack/vue-query": "5.104.5",
     "axios": "1.20.0",
     "content-disposition-header": "0.6.0",
     "date-fns": "4.4.0",
     "dotenv": "18.0.8",
-    "fds-vue-core": "8.11.0",
+    "fds-vue-core": "8.11.2",
     "pinia": "4.1.0",
     "qrcode.vue": "3.11.0",
     "vue": "3.5.44",
-    "vue-i18n": "11.4.14",
+    "vue-i18n": "11.4.16",
     "vue-router": "5.4.0"
   },
   "devDependencies": {
-    "@intlify/unplugin-vue-i18n": "11.2.6",
-    "@tanstack/vue-query-devtools": "6.3.3",
+    "@intlify/unplugin-vue-i18n": "11.2.7",
+    "@tanstack/vue-query-devtools": "6.3.5",
     "@types/node": "22.16.5",
-    "fg-devkit": "1.24.3",
+    "fg-devkit": "1.25.0",
     "@vitejs/plugin-vue": "6.0.10",
     "tailwindcss": "4.3.3",
     "tsx": "4.23.15",
-    "vite": "8.3.4",
+    "vite": "8.3.5",
     "vite-plugin-vue-inspector": "7.0.0"
   },
-  "packageManager": "pnpm@12.11.2",
+  "packageManager": "pnpm@12.14.0",
   "engines": {
     "node": ">=22.13.0"
   }

package/scripts/audit-override-commit.mjs

@@ -195,8 +195,15 @@ function assertCleanGitState() {
   }
 }
 
+let gitPrefix
+
+function repoPath(file) {
+  gitPrefix ??= runOrFail('git', ['rev-parse', '--show-prefix'], { capture: true }).stdout.trim()
+  return `${gitPrefix}${file}`
+}
+
 function headContent(file) {
-  const result = run('git', ['show', `HEAD:${file}`], { capture: true })
+  const result = run('git', ['show', `HEAD:${repoPath(file)}`], { capture: true })
   return result.status === 0 ? result.stdout : undefined
 }
 
@@ -205,11 +212,11 @@ function stageContents(contents) {
   let staged = 0
   for (const [file, content] of Object.entries(contents)) {
     if (content === undefined || content === headContent(file)) continue
-    const sha = runOrFail('git', ['hash-object', '-w', '--stdin', `--path=${file}`], {
+    const sha = runOrFail('git', ['hash-object', '-w', '--stdin', `--path=${repoPath(file)}`], {
       capture: true,
       input: content,
     }).stdout.trim()
-    runOrFail('git', ['update-index', '--add', '--cacheinfo', `100644,${sha},${file}`])
+    runOrFail('git', ['update-index', '--add', '--cacheinfo', `100644,${sha},${repoPath(file)}`])
     staged += 1
   }
   return staged

package/scripts/fleet-vulns.mjs

@@ -43,6 +43,14 @@ function isPnpmProject(pkg) {
   )
 }
 
+const SEVERITY_ORDER = ['critical', 'high', 'moderate', 'low', 'info']
+
+function formatSeverityCounts(severityMap = {}) {
+  return SEVERITY_ORDER.filter((severity) => Number(severityMap[severity] || 0) > 0)
+    .map((severity) => `${severity}=${severityMap[severity]}`)
+    .join(', ')
+}
+
 function countTotal(severityMap = {}) {
   return Object.values(severityMap).reduce((sum, n) => sum + Number(n || 0), 0)
 }
@@ -153,9 +161,11 @@ for (const repoDir of uniqueRepos) {
 
   results.push({
     repoName,
+    repoLabel: path.relative(projectsRoot, repoDir).split(path.sep).join('/') || repoName,
     vulnerabilities,
     total,
     dependencies: report.metadata?.totalDependencies ?? 0,
+    advisories: Object.values(report.advisories ?? {}),
   })
 
   if (delayMs > 0) {
@@ -165,10 +175,38 @@ for (const repoDir of uniqueRepos) {
 
 console.log('\n[fleet-vulns] Summary')
 for (const r of results) {
-  const v = r.vulnerabilities
-  console.log(
-    `- ${r.repoName}: total=${r.total} (critical=${v.critical ?? 0}, high=${v.high ?? 0}, moderate=${v.moderate ?? 0}, low=${v.low ?? 0}, info=${v.info ?? 0}) deps=${r.dependencies}`,
+  const severityCounts = formatSeverityCounts(r.vulnerabilities)
+  console.log(`- ${r.repoName}: total=${r.total}${severityCounts ? ` (${severityCounts})` : ''} deps=${r.dependencies}`)
+}
+
+const advisoriesById = new Map()
+for (const r of results) {
+  for (const advisory of r.advisories) {
+    const key = advisory.github_advisory_id ?? String(advisory.id)
+    const entry = advisoriesById.get(key) ?? { advisory, repos: new Map() }
+    const versions = entry.repos.get(r.repoLabel) ?? new Set()
+    for (const finding of advisory.findings ?? []) versions.add(finding.version)
+    entry.repos.set(r.repoLabel, versions)
+    advisoriesById.set(key, entry)
+  }
+}
+
+if (advisoriesById.size > 0) {
+  console.log('\n[fleet-vulns] Vulnerabilities')
+  const sortedEntries = [...advisoriesById.values()].sort(
+    (a, b) =>
+      SEVERITY_ORDER.indexOf(a.advisory.severity) - SEVERITY_ORDER.indexOf(b.advisory.severity) ||
+      b.repos.size - a.repos.size ||
+      a.advisory.module_name.localeCompare(b.advisory.module_name),
   )
+  for (const { advisory, repos } of sortedEntries) {
+    console.log(`- [${advisory.severity}] ${advisory.module_name}: ${advisory.title}`)
+    console.log(`  ${advisory.url} (patched: ${advisory.patched_versions ?? 'no fix yet'})`)
+    console.log(`  repos (${repos.size}):`)
+    for (const [repoLabel, versions] of repos) {
+      console.log(`    - ${repoLabel} @ ${[...versions].join(', ')}`)
+    }
+  }
 }
 
 if (results.length === 0) {