fg-devkit 1.24.4 → 1.25.1

package/configs/dependency-policy.vue-workspace.json

@@ -1,6 +1,6 @@
 {
   "toolchain": {
-    "packageManager": "pnpm@12.11.2",
+    "packageManager": "pnpm@12.14.0",
     "node": {
       "nvmrc": "22",
       "engines": ">=22.13.0",
@@ -18,7 +18,7 @@
       "@lexical/link": "0.52.0",
       "@piwikpro/vue-piwik-pro": "2.0.0",
       "@sentry/vue": "11.8.0",
-      "@tanstack/vue-query": "5.104.3",
+      "@tanstack/vue-query": "5.104.5",
       "@types/leaflet": "1.9.22",
       "@unhead/vue": "2.0.5",
       "@vue-leaflet/vue-leaflet": "0.10.1",
@@ -40,12 +40,12 @@
       "pinia": "4.1.0",
       "playwright": "1.64.1",
       "quill": "2.0.3",
-      "randexp": "0.5.3",
+      "randexp": "0.6.1",
       "register-service-worker": "1.7.2",
       "vega-embed": "7.3.0",
       "vega-lite": "6.5.0",
       "vue-chartjs": "5.3.4",
-      "vue-i18n": "11.4.14",
+      "vue-i18n": "11.4.16",
       "vue-quilly": "1.1.6",
       "vue-router": "5.4.0",
       "vue3-touch-keyboard": "1.3.9",
@@ -54,16 +54,16 @@
       "yup": "1.7.1"
     },
     "devDependencies": {
-      "@chromatic-com/storybook": "5.5.1",
+      "@chromatic-com/storybook": "5.6.0",
       "@eslint/js": "9.39.1",
-      "@intlify/unplugin-vue-i18n": "11.2.6",
+      "@intlify/unplugin-vue-i18n": "11.2.7",
       "@playwright/test": "1.64.1",
-      "@storybook/addon-a11y": "10.6.2",
-      "@storybook/addon-docs": "10.6.2",
-      "@storybook/addon-vitest": "10.6.2",
-      "@storybook/vue3": "10.6.2",
-      "@storybook/vue3-vite": "10.6.2",
-      "@tanstack/vue-query-devtools": "6.3.3",
+      "@storybook/addon-a11y": "10.6.3",
+      "@storybook/addon-docs": "10.6.3",
+      "@storybook/addon-vitest": "10.6.3",
+      "@storybook/vue3": "10.6.3",
+      "@storybook/vue3-vite": "10.6.3",
+      "@tanstack/vue-query-devtools": "6.3.5",
       "@tsconfig/node22": "22.0.6",
       "@types/lodash-es": "4.17.12",
       "@types/node": "22.16.5",
@@ -74,11 +74,11 @@
       "@vue/test-utils": "2.5.1",
       "arg": "5.0.2",
       "babel-eslint": "10.1.0",
-      "eslint-plugin-storybook": "10.6.2",
+      "eslint-plugin-storybook": "10.6.3",
       "globals": "15.11.0",
       "jsdom": "30.1.3",
-      "sass": "1.105.2",
-      "storybook": "10.6.2",
+      "sass": "1.106.1",
+      "storybook": "10.6.3",
       "tsx": "4.23.15",
       "vega": "6.4.0",
       "vite-plugin-dts": "5.1.2",
@@ -95,7 +95,7 @@
     "dotenv": "18.0.8",
     "qrcode.vue": "3.11.0",
     "tailwindcss": "4.3.3",
-    "vite": "8.3.4",
+    "vite": "8.3.5",
     "vue": "3.5.44"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.24.4",
+  "version": "1.25.1",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
@@ -47,20 +47,20 @@
     "vue"
   ],
   "dependencies": {
-    "@inquirer/checkbox": "5.2.6",
-    "@inquirer/confirm": "6.3.3",
-    "@inquirer/input": "5.1.7",
-    "@inquirer/select": "5.2.6",
+    "@inquirer/checkbox": "5.2.7",
+    "@inquirer/confirm": "6.3.4",
+    "@inquirer/input": "5.1.8",
+    "@inquirer/select": "5.2.7",
     "@intlify/eslint-plugin-vue-i18n": "4.5.1",
-    "@typescript-eslint/eslint-plugin": "8.71.2",
-    "@typescript-eslint/parser": "8.71.2",
+    "@typescript-eslint/eslint-plugin": "8.72.0",
+    "@typescript-eslint/parser": "8.72.0",
     "@vitest/eslint-plugin": "1.6.27",
     "@vue/eslint-config-prettier": "10.2.0",
-    "eslint": "10.12.0",
+    "eslint": "10.13.0",
     "eslint-plugin-prettier": "5.5.7",
     "eslint-plugin-vue": "10.11.1",
-    "eslint-plugin-vuejs-accessibility": "2.6.2",
-    "fallow": "3.33.1",
+    "eslint-plugin-vuejs-accessibility": "2.6.3",
+    "fallow": "3.34.1",
     "git-cliff": "2.14.2",
     "lefthook": "2.2.2",
     "npm-check-updates": "23.1.1",

package/scaffold/vue/package.json

@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "@tailwindcss/vite": "4.3.3",
-    "@tanstack/vue-query": "5.104.3",
+    "@tanstack/vue-query": "5.104.5",
     "axios": "1.20.0",
     "content-disposition-header": "0.6.0",
     "date-fns": "4.4.0",
@@ -25,21 +25,21 @@
     "pinia": "4.1.0",
     "qrcode.vue": "3.11.0",
     "vue": "3.5.44",
-    "vue-i18n": "11.4.14",
+    "vue-i18n": "11.4.16",
     "vue-router": "5.4.0"
   },
   "devDependencies": {
-    "@intlify/unplugin-vue-i18n": "11.2.6",
-    "@tanstack/vue-query-devtools": "6.3.3",
+    "@intlify/unplugin-vue-i18n": "11.2.7",
+    "@tanstack/vue-query-devtools": "6.3.5",
     "@types/node": "22.16.5",
-    "fg-devkit": "1.24.4",
+    "fg-devkit": "1.25.1",
     "@vitejs/plugin-vue": "6.0.10",
     "tailwindcss": "4.3.3",
     "tsx": "4.23.15",
-    "vite": "8.3.4",
+    "vite": "8.3.5",
     "vite-plugin-vue-inspector": "7.0.0"
   },
-  "packageManager": "pnpm@12.11.2",
+  "packageManager": "pnpm@12.14.0",
   "engines": {
     "node": ">=22.13.0"
   }

package/scripts/fg-devkit.mjs

@@ -57,6 +57,7 @@ import { fileURLToPath } from 'node:url'
 import { createRequire } from 'node:module'
 import { styleText } from 'node:util'
 import { fgDevkitRoot } from './lib/common.mjs'
+import { removeUnconfiguredGhostHook } from './lib/lefthook-ghost-hook.mjs'
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const require = createRequire(import.meta.url)
@@ -1241,6 +1242,8 @@ async function runInteractiveMenu() {
 async function main() {
   const [, , sub, ...rest] = process.argv
 
+  removeUnconfiguredGhostHook(process.cwd())
+
   if (sub === '--help' || sub === '-h') {
     printHelp()
     return

package/scripts/fleet-vulns.mjs

@@ -43,6 +43,14 @@ function isPnpmProject(pkg) {
   )
 }
 
+const SEVERITY_ORDER = ['critical', 'high', 'moderate', 'low', 'info']
+
+function formatSeverityCounts(severityMap = {}) {
+  return SEVERITY_ORDER.filter((severity) => Number(severityMap[severity] || 0) > 0)
+    .map((severity) => `${severity}=${severityMap[severity]}`)
+    .join(', ')
+}
+
 function countTotal(severityMap = {}) {
   return Object.values(severityMap).reduce((sum, n) => sum + Number(n || 0), 0)
 }
@@ -153,9 +161,11 @@ for (const repoDir of uniqueRepos) {
 
   results.push({
     repoName,
+    repoLabel: path.relative(projectsRoot, repoDir).split(path.sep).join('/') || repoName,
     vulnerabilities,
     total,
     dependencies: report.metadata?.totalDependencies ?? 0,
+    advisories: Object.values(report.advisories ?? {}),
   })
 
   if (delayMs > 0) {
@@ -165,10 +175,38 @@ for (const repoDir of uniqueRepos) {
 
 console.log('\n[fleet-vulns] Summary')
 for (const r of results) {
-  const v = r.vulnerabilities
-  console.log(
-    `- ${r.repoName}: total=${r.total} (critical=${v.critical ?? 0}, high=${v.high ?? 0}, moderate=${v.moderate ?? 0}, low=${v.low ?? 0}, info=${v.info ?? 0}) deps=${r.dependencies}`,
+  const severityCounts = formatSeverityCounts(r.vulnerabilities)
+  console.log(`- ${r.repoName}: total=${r.total}${severityCounts ? ` (${severityCounts})` : ''} deps=${r.dependencies}`)
+}
+
+const advisoriesById = new Map()
+for (const r of results) {
+  for (const advisory of r.advisories) {
+    const key = advisory.github_advisory_id ?? String(advisory.id)
+    const entry = advisoriesById.get(key) ?? { advisory, repos: new Map() }
+    const versions = entry.repos.get(r.repoLabel) ?? new Set()
+    for (const finding of advisory.findings ?? []) versions.add(finding.version)
+    entry.repos.set(r.repoLabel, versions)
+    advisoriesById.set(key, entry)
+  }
+}
+
+if (advisoriesById.size > 0) {
+  console.log('\n[fleet-vulns] Vulnerabilities')
+  const sortedEntries = [...advisoriesById.values()].sort(
+    (a, b) =>
+      SEVERITY_ORDER.indexOf(a.advisory.severity) - SEVERITY_ORDER.indexOf(b.advisory.severity) ||
+      b.repos.size - a.repos.size ||
+      a.advisory.module_name.localeCompare(b.advisory.module_name),
   )
+  for (const { advisory, repos } of sortedEntries) {
+    console.log(`- [${advisory.severity}] ${advisory.module_name}: ${advisory.title}`)
+    console.log(`  ${advisory.url} (patched: ${advisory.patched_versions ?? 'no fix yet'})`)
+    console.log(`  repos (${repos.size}):`)
+    for (const [repoLabel, versions] of repos) {
+      console.log(`    - ${repoLabel} @ ${[...versions].join(', ')}`)
+    }
+  }
 }
 
 if (results.length === 0) {

package/scripts/lib/lefthook-ghost-hook.mjs

@@ -0,0 +1,26 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { runGit } from './common.mjs'
+
+const ghostHookName = 'prepare-commit-msg'
+const lefthookConfigFiles = ['lefthook.yml', '.lefthook.yml', 'lefthook-local.yml', '.lefthook-local.yml']
+
+export function removeUnconfiguredGhostHook(cwd) {
+  const options = { cwd, tag: '[fg-devkit]', capture: true }
+  const repositoryRoot = runGit(['rev-parse', '--show-toplevel'], options)
+  const hooksDirectory = runGit(['rev-parse', '--git-path', 'hooks'], options)
+  if (repositoryRoot.status !== 0 || hooksDirectory.status !== 0) return
+
+  const configuresGhostHook = lefthookConfigFiles.some((fileName) => {
+    const configPath = path.join(repositoryRoot.stdout.trim(), fileName)
+    return fs.existsSync(configPath) && fs.readFileSync(configPath, 'utf8').includes(`${ghostHookName}:`)
+  })
+  if (configuresGhostHook) return
+
+  const ghostHookPath = path.resolve(cwd, hooksDirectory.stdout.trim(), ghostHookName)
+  if (!fs.existsSync(ghostHookPath)) return
+  if (!fs.readFileSync(ghostHookPath, 'utf8').includes('call_lefthook')) return
+
+  fs.rmSync(ghostHookPath)
+  console.log(`[fg-devkit] Removed unused lefthook ${ghostHookName} hook.`)
+}