mirror of
https://github.com/Luchexx/wacrm.git
synced 2026-11-02 09:19:51 +00:00
06ef8f2206
Patches 11 open Dependabot alerts in dependencies pulled in through
the shadcn CLI tree (shadcn → @modelcontextprotocol/sdk →
@hono/node-server, express-rate-limit, ajv-formats, …). These aren't
loaded by the running Next.js app — they only execute when you invoke
the shadcn CLI — but the alerts still surface in GitHub's UI, so it's
cleaner to pin them.
Uses npm `overrides` to force the patched version regardless of what
the upstream MCP SDK happens to request:
postcss ^8.5.10 — XSS via unescaped </style>
(GHSA-qx2v-qp2m-jg93, medium)
ip-address ^10.1.1 — XSS in Address6 HTML-emitting methods
(GHSA-v2v4-37r5-5v8g, medium)
fast-uri ^3.1.2 — path traversal + host confusion via
percent-encoded segments / authority
delimiters (GHSA-q3j6-qgpj-74h6 high,
GHSA-v39h-62p7-jpjc high)
hono ^4.12.18 — JSX HTML injection, bodyLimit bypass,
Cache middleware Vary leak, CSS injection
via style objects, JWT NumericDate
validation (GHSA-69xw-7hcm-h432 / 9vqf-7f2p-gf9v
/ p77w-8qqv-26rm / qp7p-654g-cw7p /
hm8q-7f3q-5f36, low–medium)
After overrides:
postcss 8.5.14 (was nested 8.4.31 inside next + top 8.5.14)
ip-address 10.2.0 (was 10.1.0)
fast-uri 3.1.2 (was 3.1.0)
hono 4.12.19 (was 4.12.14)
Verified locally:
npm run lint — 0 errors (23 pre-existing warnings)
npm run typecheck — clean
npm test — 89/89 passed
npm run build — succeeded
Pair this with #93 (next 16.2.6 bump) to clear all 22 alerts. Each PR
is independently revertible.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
80 lines
2.0 KiB
JSON
80 lines
2.0 KiB
JSON
{
|
|
"name": "wacrm",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"description": "Self-hostable CRM template for WhatsApp built on Next.js and Supabase — shared inbox, contacts, sales pipelines, broadcasts, and no-code automations.",
|
|
"license": "MIT",
|
|
"author": "Arnas Donauskas",
|
|
"homepage": "https://github.com/ArnasDon/wacrm",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/ArnasDon/wacrm.git"
|
|
},
|
|
"bugs": {
|
|
"url": "https://github.com/ArnasDon/wacrm/issues"
|
|
},
|
|
"keywords": [
|
|
"crm",
|
|
"whatsapp",
|
|
"whatsapp-business-api",
|
|
"nextjs",
|
|
"supabase",
|
|
"automation",
|
|
"broadcast",
|
|
"self-hosted",
|
|
"template"
|
|
],
|
|
"engines": {
|
|
"node": ">=20.0.0"
|
|
},
|
|
"scripts": {
|
|
"dev": "next dev",
|
|
"build": "next build",
|
|
"start": "next start",
|
|
"lint": "eslint",
|
|
"typecheck": "tsc --noEmit",
|
|
"format": "prettier --write .",
|
|
"format:check": "prettier --check .",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest"
|
|
},
|
|
"dependencies": {
|
|
"@base-ui/react": "^1.4.1",
|
|
"@dnd-kit/core": "^6.3.1",
|
|
"@dnd-kit/sortable": "^10.0.0",
|
|
"@dnd-kit/utilities": "^3.2.2",
|
|
"@supabase/ssr": "^0.10.3",
|
|
"@supabase/supabase-js": "^2.103.3",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"date-fns": "^4.1.0",
|
|
"lucide-react": "^1.8.0",
|
|
"next": "16.2.4",
|
|
"react": "19.2.4",
|
|
"react-dom": "19.2.4",
|
|
"shadcn": "^4.2.0",
|
|
"sonner": "^2.0.7",
|
|
"tailwind-merge": "^3.5.0",
|
|
"tw-animate-css": "^1.4.0"
|
|
},
|
|
"devDependencies": {
|
|
"@tailwindcss/postcss": "^4",
|
|
"@types/node": "^25",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"eslint": "^9",
|
|
"eslint-config-next": "16.2.4",
|
|
"prettier": "^3.8.3",
|
|
"prettier-plugin-tailwindcss": "^0.7.2",
|
|
"tailwindcss": "^4",
|
|
"typescript": "^6",
|
|
"vitest": "^4.1.6"
|
|
},
|
|
"overrides": {
|
|
"postcss": "^8.5.10",
|
|
"ip-address": "^10.1.1",
|
|
"fast-uri": "^3.1.2",
|
|
"hono": "^4.12.18"
|
|
}
|
|
}
|