fg-devkit 1.8.0 → 1.8.1

package/configs/dependency-policy.vue-workspace.json

@@ -5,33 +5,33 @@
       "@lexical/html": "0.30.0",
       "@lexical/list": "0.30.0",
       "@lexical/rich-text": "0.30.0",
-      "@piwikpro/vue-piwik-pro": "1.4.0",
-      "@sentry/browser": "10.50.0",
+      "@piwikpro/vue-piwik-pro": "1.7.0",
+      "@sentry/browser": "10.52.0",
       "@sentry/tracing": "7.120.4",
-      "@sentry/vue": "10.50.0",
-      "@sentry/wasm": "10.50.0",
-      "@tailwindcss/postcss": "4.2.4",
+      "@sentry/vue": "10.52.0",
+      "@sentry/wasm": "10.52.0",
+      "@tailwindcss/postcss": "4.3.0",
       "@tanstack/vue-query": "5.100.9",
-      "@types/leaflet": "1.5.7",
+      "@types/leaflet": "1.9.21",
       "@unhead/vue": "2.0.5",
       "@vue-leaflet/vue-leaflet": "0.10.1",
       "@vuelidate/core": "2.0.3",
       "@vuelidate/validators": "2.0.4",
       "@vueuse/components": "12.7.0",
-      "@vueuse/core": "14.2.1",
+      "@vueuse/core": "14.3.0",
       "chart.js": "4.5.1",
       "content-disposition-header": "0.6.0",
       "date-fns": "4.1.0",
-      "element-plus": "2.9.7",
-      "fds-vue-core": "7.1.4",
+      "element-plus": "2.14.0",
+      "fds-vue-core": "7.1.6",
       "imask": "7.6.1",
-      "leaflet": "1.8.0",
+      "leaflet": "1.9.4",
       "lexical": "0.30.0",
       "lodash": "4.18.1",
       "lodash-es": "4.18.1",
       "markdown-it": "14.1.1",
       "pinia": "3.0.4",
-      "playwright": "1.57.0",
+      "playwright": "1.59.1",
       "quill": "2.0.3",
       "randexp": "0.5.3",
       "register-service-worker": "1.7.2",
@@ -39,7 +39,7 @@
       "vega-lite": "6.4.3",
       "vue-chartjs": "5.3.3",
       "vue-i18n": "11.4.2",
-      "vue-quilly": "1.0.5",
+      "vue-quilly": "1.1.6",
       "vue-router": "4.6.3",
       "vue3-touch-keyboard": "1.3.9",
       "vuex": "4.1.0",
@@ -47,15 +47,15 @@
       "yup": "1.7.1"
     },
     "devDependencies": {
-      "@chromatic-com/storybook": "5.0.1",
+      "@chromatic-com/storybook": "5.1.2",
       "@eslint/js": "9.39.1",
       "@intlify/unplugin-vue-i18n": "11.1.2",
       "@playwright/test": "1.59.1",
-      "@storybook/addon-a11y": "10.1.10",
-      "@storybook/addon-docs": "10.1.10",
-      "@storybook/addon-vitest": "10.2.12",
-      "@storybook/vue3": "10.2.12",
-      "@storybook/vue3-vite": "10.2.12",
+      "@storybook/addon-a11y": "10.3.6",
+      "@storybook/addon-docs": "10.3.6",
+      "@storybook/addon-vitest": "10.3.6",
+      "@storybook/vue3": "10.3.6",
+      "@storybook/vue3-vite": "10.3.6",
       "@tanstack/vue-query-devtools": "6.1.28",
       "@tsconfig/node22": "22.0.5",
       "@types/lodash-es": "4.17.12",
@@ -68,28 +68,28 @@
       "@vuepic/vue-datepicker": "6.0.3",
       "arg": "5.0.2",
       "babel-eslint": "10.1.0",
-      "eslint-plugin-storybook": "10.1.10",
+      "eslint-plugin-storybook": "10.3.6",
       "globals": "15.11.0",
       "jsdom": "26.1.0",
       "postcss": "8.5.14",
       "sass": "1.99.0",
       "start-server-and-test": "2.1.3",
-      "storybook": "10.2.12",
+      "storybook": "10.3.6",
       "tsx": "4.21.0",
       "vega": "6.2.0",
       "vite-plugin-dts": "4.5.4",
-      "vite-plugin-vue-devtools": "8.1.1",
+      "vite-plugin-vue-devtools": "8.1.2",
       "vitest": "3.2.4",
-      "yaml": "2.8.4"
+      "yaml": "2.9.0"
     }
   },
   "managedAnywhere": {
-    "@tailwindcss/vite": "4.2.4",
+    "@tailwindcss/vite": "4.3.0",
     "@vitejs/plugin-vue": "6.0.6",
     "axios": "1.16.0",
     "dotenv": "16.4.5",
-    "qrcode.vue": "3.8.1",
-    "tailwindcss": "4.2.4",
+    "qrcode.vue": "3.9.0",
+    "tailwindcss": "4.3.0",
     "vite": "7.3.2",
     "vue": "3.5.34"
   },

package/configs/lefthook.yml

@@ -1,7 +1,7 @@
 pre-commit:
   commands:
     audit:
-      run: zsh -lc "pnpm audit"
+      run: zsh -lc "node ./node_modules/fg-devkit/scripts/lefthook-audit-if-enabled.mjs"
     lint-check:
       run: zsh -lc "node ./node_modules/fg-devkit/scripts/fg-devkit.mjs lint ."
     typecheck:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
@@ -45,6 +45,7 @@
     "./scripts/poeditor-upload.mjs": "./scripts/poeditor-upload.mjs",
     "./scripts/scaffold-vue.mjs": "./scripts/scaffold-vue.mjs",
     "./scripts/fg-devkit.mjs": "./scripts/fg-devkit.mjs",
+    "./scripts/lefthook-audit-if-enabled.mjs": "./scripts/lefthook-audit-if-enabled.mjs",
     "./scripts/release.sh": "./scripts/release.sh",
     "./scripts/cz/.cz-config.cjs": "./scripts/cz/.cz-config.cjs",
     "./cursor-rules/core-coding-standards.mdc": "./.cursor/rules/core-coding-standards.mdc"

package/scaffold/vue/package.json

@@ -15,16 +15,16 @@
     "poeditor:upload": "pnpm exec fg-devkit poeditor-upload"
   },
   "dependencies": {
-    "@tailwindcss/postcss": "4.2.4",
-    "@tailwindcss/vite": "4.2.4",
+    "@tailwindcss/postcss": "4.3.0",
+    "@tailwindcss/vite": "4.3.0",
     "@tanstack/vue-query": "5.100.9",
     "axios": "1.16.0",
     "content-disposition-header": "0.6.0",
     "date-fns": "4.1.0",
     "dotenv": "16.4.5",
-    "fds-vue-core": "7.1.4",
+    "fds-vue-core": "7.1.6",
     "pinia": "3.0.4",
-    "qrcode.vue": "3.8.1",
+    "qrcode.vue": "3.9.0",
     "vue": "3.5.34",
     "vue-i18n": "11.4.2",
     "vue-router": "4.6.3"
@@ -34,9 +34,9 @@
     "@tanstack/vue-query-devtools": "6.1.28",
     "@types/node": "22.16.5",
     "@vitejs/plugin-vue": "6.0.6",
-    "fg-devkit": "1.8.0",
+    "fg-devkit": "1.8.1",
     "start-server-and-test": "2.1.3",
-    "tailwindcss": "4.2.4",
+    "tailwindcss": "4.3.0",
     "tsx": "4.21.0",
     "vite": "7.3.2"
   },

package/scripts/cz/.cz-config.cjs

@@ -1,6 +1,9 @@
 /**
  * cz-git config used by fg-devkit commit flows.
  * Keep this in czrc-compatible shape for `czg --config`.
+ *
+ * Note: interactive `fg-devkit commit` asks each dep/vuln commit whether Lefthook should run
+ * `pnpm audit` for that commit only (via env, not persisted).
  */
 module.exports = {
   types: [

package/scripts/fg-devkit.mjs

@@ -273,6 +273,18 @@ async function runCzg(args = [], extraEnv = {}) {
     })
   }
 
+  let runLefthookAuditThisCommit = true
+  if (isDepOrVuln) {
+    runLefthookAuditThisCommit = await selectPrompt({
+      message: 'Run pnpm audit on commit (Lefthook pre-commit)?',
+      choices: [
+        { value: true, name: 'Yes' },
+        { value: false, name: 'No' },
+      ],
+      default: true,
+    })
+  }
+
   if (!isDepOrVuln) {
     shortcutId = await ask('Shortcut ID digits only (optional, e.g. 1234):')
     subject = await ask('Commit subject (imperative, no trailing period):', {
@@ -293,10 +305,16 @@ async function runCzg(args = [], extraEnv = {}) {
   const finalSubject = selectedType === 'dep' ? depSubject : selectedType === 'vuln' ? vulnSubject : subject
   const commitMessage = `${selectedType}${scopePart}: ${finalSubject}${shortcutPart}${bodyPart}`
 
+  const gitEnv = { ...process.env, ...extraEnv }
+  delete gitEnv.FG_DEVKIT_LEFTHOOK_AUDIT
+  if (isDepOrVuln) {
+    gitEnv.FG_DEVKIT_LEFTHOOK_AUDIT = runLefthookAuditThisCommit ? '1' : '0'
+  }
+
   const r = spawnSync('git', ['commit', ...args, '-m', commitMessage], {
     stdio: 'inherit',
     cwd: process.cwd(),
-    env: { ...process.env, ...extraEnv },
+    env: gitEnv,
   })
   if (r.error) {
     console.error('[fg-devkit]', r.error.message)

package/scripts/lefthook-audit-if-enabled.mjs

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+/**
+ * Lefthook pre-commit helper: runs `pnpm audit` unless this commit was started with
+ * `FG_DEVKIT_LEFTHOOK_AUDIT=0` (set only for the current `git commit` by `fg-devkit commit`
+ * when the user chooses "No" on dep/vuln). Unset or `1` runs audit.
+ */
+import { spawnSync } from 'node:child_process'
+
+function shouldRunAudit() {
+  const v = process.env.FG_DEVKIT_LEFTHOOK_AUDIT
+  return v !== '0' && v !== 'false'
+}
+
+if (!shouldRunAudit()) {
+  console.log('[fg-devkit] Skipping pnpm audit (FG_DEVKIT_LEFTHOOK_AUDIT=0 for this commit).')
+  process.exit(0)
+}
+
+const r = spawnSync('pnpm', ['audit'], {
+  stdio: 'inherit',
+  cwd: process.cwd(),
+})
+process.exit(r.status ?? 1)

package/scripts/sync-consumer-lefthook.mjs

@@ -6,6 +6,8 @@
  * - removes legacy lint-staged config block from package.json
  * - removes legacy prepare hook scripts for husky/lefthook bootstrap
  *
+ * Lefthook `audit` skips only when `FG_DEVKIT_LEFTHOOK_AUDIT=0` for that commit (dep/vuln flow).
+ *
  * Usage:
  *   node node_modules/fg-devkit/scripts/sync-consumer-lefthook.mjs
  *   pnpm exec fg-devkit setup-lefthook