1c99768928
- Vite 6.4.1 → 6.4.2: fixes path traversal in optimized deps .map handling (medium) and arbitrary file read via dev server WebSocket (high) - lodash 4.17.23 → 4.18.1 via pnpm override: fixes code injection via _.template (CVE-2026-4800, high) and prototype pollution via _.unset/_.omit (CVE-2026-2950, medium). Transitive dep from @react-router/dev — override needed until they bump it upstream. Skipped 4.18.0 which was marked as a bad release. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
24 lines
477 B
YAML
24 lines
477 B
YAML
packages:
|
|
- "apps/*"
|
|
- "packages/*"
|
|
|
|
catalog:
|
|
react: ^19.1.0
|
|
react-dom: ^19.1.0
|
|
react-router: ^7.14.0
|
|
"@react-router/dev": ^7.14.0
|
|
"@react-router/node": ^7.14.0
|
|
"@react-router/serve": ^7.14.0
|
|
"@types/react": ^19.1.4
|
|
"@types/react-dom": ^19.1.5
|
|
tailwindcss: ^4.1.7
|
|
"@tailwindcss/vite": ^4.1.7
|
|
typescript: ^5.8.3
|
|
vite: ^6.4.2
|
|
drizzle-orm: ^0.45.2
|
|
drizzle-kit: ^0.31.0
|
|
drizzle-postgis: ^1.1.0
|
|
postgres: ^3.4.9
|
|
|
|
overrides:
|
|
esbuild: ">=0.25.0"
|