rastack 0.0.59 → 0.0.60
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +7 -0
- package/dist/rastack-dev.js +6 -1
- package/dist/wasm/rastack_wasm_bg.wasm +0 -0
- package/package.json +1 -1
- package/src/rastack-dev.ts +6 -1
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,13 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
|
|
4
4
|
|
|
5
|
+
### [0.0.60](https://github.com/theserverkid/reactapistack/compare/v0.0.59...v0.0.60) (2026-07-18)
|
|
6
|
+
|
|
7
|
+
|
|
8
|
+
### Bug Fixes
|
|
9
|
+
|
|
10
|
+
* repair perf bench + SAST breakage from the root refactor ([396994b](https://github.com/theserverkid/reactapistack/commit/396994b29f66034b108493a90f561179387c6ce3))
|
|
11
|
+
|
|
5
12
|
### [0.0.59](https://github.com/theserverkid/reactapistack/compare/v0.0.58...v0.0.59) (2026-07-18)
|
|
6
13
|
|
|
7
14
|
|
package/dist/rastack-dev.js
CHANGED
|
@@ -205,7 +205,12 @@ function startMetro(cwd, port) {
|
|
|
205
205
|
EXPO_NO_TELEMETRY: "1",
|
|
206
206
|
};
|
|
207
207
|
delete env.CI;
|
|
208
|
-
//
|
|
208
|
+
// `shell:true` is deliberate: it keeps the npx / npx.cmd split portable across
|
|
209
|
+
// POSIX and Windows. The only interpolated value is `port`, a number resolved
|
|
210
|
+
// by findFreePort (never user-controlled), so there is no shell-injection
|
|
211
|
+
// surface — suppress the spawn-shell-true audit rule (and its child-process
|
|
212
|
+
// sibling) here rather than break Windows portability.
|
|
213
|
+
// nosemgrep: javascript.lang.security.detect-child-process.detect-child-process, javascript.lang.security.audit.spawn-shell-true.spawn-shell-true
|
|
209
214
|
const child = (0, child_process_1.spawn)(`npx expo start --web --port ${port}`, {
|
|
210
215
|
cwd,
|
|
211
216
|
env,
|
|
Binary file
|
package/package.json
CHANGED
package/src/rastack-dev.ts
CHANGED
|
@@ -193,7 +193,12 @@ function startMetro(cwd: string, port: number): ChildProcess {
|
|
|
193
193
|
EXPO_NO_TELEMETRY: "1",
|
|
194
194
|
};
|
|
195
195
|
delete env.CI;
|
|
196
|
-
//
|
|
196
|
+
// `shell:true` is deliberate: it keeps the npx / npx.cmd split portable across
|
|
197
|
+
// POSIX and Windows. The only interpolated value is `port`, a number resolved
|
|
198
|
+
// by findFreePort (never user-controlled), so there is no shell-injection
|
|
199
|
+
// surface — suppress the spawn-shell-true audit rule (and its child-process
|
|
200
|
+
// sibling) here rather than break Windows portability.
|
|
201
|
+
// nosemgrep: javascript.lang.security.detect-child-process.detect-child-process, javascript.lang.security.audit.spawn-shell-true.spawn-shell-true
|
|
197
202
|
const child = spawn(`npx expo start --web --port ${port}`, {
|
|
198
203
|
cwd,
|
|
199
204
|
env,
|