hanzo-dev
3ab5ae053c
- pnpm overrides pin every vulnerable transitive to its advisory's exact first-patched version, scoped to the advisory's own vulnerable range so no dependency is dragged across a major it didn't need (criticals: form-data 4.0.6, handlebars 4.7.9, protobufjs 7.5.5). - vitest < 3.2.6 is a critical (CVE fix floor) with no 0.x/1.x backport — forced major to ^3.2.6 in every package. Test scripts unify on `vitest run` (aci/ai ran bare watch mode). tools' vscode mock alias becomes absolute (vitest 3 dropped relative alias resolution). - packages/ai otel family 1.x → 2.x (core <2.8.0 advisory covers all 1.x): resourceFromAttributes, ATTR_* semconv, constructor spanProcessors. The previously-uncollectable telemetry suite now runs: ai 31 tests (was 16). - direct bumps: vite ^6.4.3 (site), esbuild ^0.25.8 (mcp), uuid ^11.1.1 (tools). packages/ai/package-lock.json deleted — stray npm lockfile in a pnpm workspace, carried 24 of the alerts. - ci: test step filtered @hanzo/tools but the package is @hanzo/cli-tools — the suite never ran in CI. Fixed; 87 tests now gate (behind the existing continue-on-error). pnpm 9 reads onlyBuiltDependencies from package.json, not pnpm-workspace.yaml — mirrored so native build scripts stay allowlisted. Verified: browser 243/243 + e2e 30/30 + build; aci 29/29; ai 31/31; cli-tools 87/87; site builds on vite 6; mcp builds on esbuild 0.25.
136 lines
4.9 KiB
JSON
136 lines
4.9 KiB
JSON
{
|
|
"name": "@hanzo/extension",
|
|
"version": "1.9.26",
|
|
"private": true,
|
|
"description": "Hanzo AI Extension",
|
|
"license": "MIT",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/hanzoai/extension.git"
|
|
},
|
|
"packageManager": "pnpm@10.12.4",
|
|
"engines": {
|
|
"node": ">=18.0.0"
|
|
},
|
|
"scripts": {
|
|
"compile": "pnpm -r build",
|
|
"build": "pnpm -r build",
|
|
"test": "pnpm -r test",
|
|
"lint": "pnpm -r lint",
|
|
"format": "pnpm -r format",
|
|
"dev:vscode": "pnpm --filter @hanzo/extension run dev",
|
|
"dev:site": "pnpm --filter @hanzo/site run dev",
|
|
"dev:cli": "pnpm --filter @hanzo/dev run dev",
|
|
"build:vscode": "pnpm --filter @hanzo/extension run build",
|
|
"build:browser": "pnpm --filter @hanzo/browser-extension run build",
|
|
"build:dxt": "pnpm --filter @hanzo/dxt run build",
|
|
"build:tools": "pnpm --filter @hanzo/cli-tools run build",
|
|
"build:site": "pnpm --filter @hanzo/site run build",
|
|
"build:jetbrains": "cd packages/jetbrains && ./gradlew build",
|
|
"package:vscode": "pnpm --filter @hanzo/extension run package",
|
|
"package:dxt": "pnpm --filter @hanzo/dxt run package"
|
|
},
|
|
"pnpm": {
|
|
"overrides": {
|
|
"@babel/core@<=7.29.0": "7.29.6",
|
|
"@grpc/grpc-js@<1.9.16": "1.9.16",
|
|
"@isaacs/brace-expansion@<=5.0.0": "5.0.1",
|
|
"@modelcontextprotocol/sdk@<1.24.0": "1.24.0",
|
|
"@modelcontextprotocol/sdk@<1.25.2": "1.25.2",
|
|
"@modelcontextprotocol/sdk@>=1.10.0 <=1.25.3": "1.26.0",
|
|
"@opentelemetry/core@<2.8.0": "2.8.0",
|
|
"@protobufjs/utf8@<=1.1.0": "1.1.1",
|
|
"ajv@<6.14.0": "6.14.0",
|
|
"ajv@>=7.0.0-alpha.0 <8.18.0": "8.18.0",
|
|
"axios@>=1.0.0 <=1.13.4": "1.13.5",
|
|
"axios@>=1.0.0 <1.12.0": "1.12.0",
|
|
"axios@>=1.0.0 <1.15.0": "1.15.0",
|
|
"axios@>=1.0.0 <1.15.1": "1.15.1",
|
|
"axios@>=1.0.0 <1.15.2": "1.15.2",
|
|
"axios@>=1.0.0 <1.16.0": "1.16.0",
|
|
"axios@>=1.7.0 <1.16.0": "1.16.0",
|
|
"body-parser@>=2.2.0 <2.2.1": "2.2.1",
|
|
"brace-expansion@<1.1.13": "1.1.13",
|
|
"brace-expansion@>=2.0.0 <2.0.3": "2.0.3",
|
|
"diff@>=6.0.0 <8.0.3": "8.0.3",
|
|
"esbuild@<=0.24.2": "0.25.0",
|
|
"fast-uri@<=3.1.0": "3.1.1",
|
|
"fast-uri@<=3.1.1": "3.1.2",
|
|
"file-type@>=13.0.0 <21.3.1": "21.3.1",
|
|
"flatted@<=3.4.1": "3.4.2",
|
|
"flatted@<3.4.0": "3.4.0",
|
|
"follow-redirects@<=1.15.11": "1.16.0",
|
|
"form-data@>=4.0.0 <4.0.4": "4.0.4",
|
|
"form-data@>=4.0.0 <4.0.6": "4.0.6",
|
|
"glob@>=10.2.0 <10.5.0": "10.5.0",
|
|
"handlebars@>=4.0.0 <=4.7.8": "4.7.9",
|
|
"handlebars@>=4.0.0 <4.7.9": "4.7.9",
|
|
"handlebars@>=4.6.0 <=4.7.8": "4.7.9",
|
|
"ip-address@<=10.1.0": "10.1.1",
|
|
"js-yaml@<3.15.0": "3.15.0",
|
|
"js-yaml@>=4.0.0 <=4.1.1": "4.2.0",
|
|
"js-yaml@>=4.0.0 <4.1.1": "4.1.1",
|
|
"jws@<3.2.3": "3.2.3",
|
|
"linkify-it@<=5.0.0": "5.0.1",
|
|
"lodash@<=4.17.23": "4.18.0",
|
|
"lodash@>=4.0.0 <=4.17.22": "4.17.23",
|
|
"lodash@>=4.0.0 <=4.17.23": "4.18.0",
|
|
"markdown-it@<=14.1.1": "14.2.0",
|
|
"min-document@<=2.19.0": "2.19.1",
|
|
"minimatch@<3.1.3": "3.1.3",
|
|
"minimatch@<3.1.4": "3.1.4",
|
|
"minimatch@>=10.0.0 <10.2.1": "10.2.1",
|
|
"minimatch@>=10.0.0 <10.2.3": "10.2.3",
|
|
"minimatch@>=5.0.0 <5.1.7": "5.1.7",
|
|
"minimatch@>=5.0.0 <5.1.8": "5.1.8",
|
|
"minimatch@>=9.0.0 <9.0.6": "9.0.6",
|
|
"minimatch@>=9.0.0 <9.0.7": "9.0.7",
|
|
"path-to-regexp@>=8.0.0 <8.4.0": "8.4.0",
|
|
"picomatch@<2.3.2": "2.3.2",
|
|
"picomatch@>=4.0.0 <4.0.4": "4.0.4",
|
|
"playwright@<1.55.1": "1.55.1",
|
|
"postcss@<8.5.10": "8.5.10",
|
|
"protobufjs@<=7.5.5": "7.5.6",
|
|
"protobufjs@<=7.5.7": "7.5.8",
|
|
"protobufjs@<=7.6.0": "7.6.1",
|
|
"protobufjs@<=7.6.2": "7.6.3",
|
|
"protobufjs@<7.5.5": "7.5.5",
|
|
"qs@<6.14.1": "6.14.1",
|
|
"qs@>=6.11.1 <=6.15.1": "6.15.2",
|
|
"qs@>=6.7.0 <=6.14.1": "6.14.2",
|
|
"rollup@>=4.0.0 <4.59.0": "4.59.0",
|
|
"serialize-javascript@<=7.0.2": "7.0.3",
|
|
"serialize-javascript@>=5.0.0 <7.0.5": "7.0.5",
|
|
"tar-fs@>=2.0.0 <2.1.4": "2.1.4",
|
|
"tar-fs@>=3.0.0 <3.1.1": "3.1.1",
|
|
"tar@<=7.5.10": "7.5.11",
|
|
"tar@<=7.5.15": "7.5.16",
|
|
"tar@<=7.5.2": "7.5.3",
|
|
"tar@<=7.5.3": "7.5.4",
|
|
"tar@<=7.5.9": "7.5.10",
|
|
"tar@<7.5.7": "7.5.7",
|
|
"tar@<7.5.8": "7.5.8",
|
|
"tmp@<=0.2.3": "0.2.4",
|
|
"tmp@<0.2.6": "0.2.6",
|
|
"underscore@<=1.13.7": "1.13.8",
|
|
"undici@>=7.0.0 <7.18.2": "7.18.2",
|
|
"undici@>=7.0.0 <7.24.0": "7.24.0",
|
|
"undici@>=7.0.0 <7.28.0": "7.28.0",
|
|
"uuid@<11.1.1": "11.1.1",
|
|
"validator@<13.15.20": "13.15.20",
|
|
"validator@<13.15.22": "13.15.22",
|
|
"vite@<=5.4.19": "5.4.20",
|
|
"vite@<=6.4.1": "6.4.2",
|
|
"vite@<=6.4.2": "6.4.3",
|
|
"vite@>=5.2.6 <=5.4.20": "5.4.21",
|
|
"vitest@<3.2.6": "3.2.6",
|
|
"ws@>=8.0.0 <8.20.1": "8.20.1",
|
|
"ws@>=8.0.0 <8.21.0": "8.21.0",
|
|
"yaml@>=2.0.0 <2.8.3": "2.8.3"
|
|
},
|
|
"onlyBuiltDependencies": [
|
|
"better-sqlite3"
|
|
]
|
|
}
|
|
}
|