Repository navigation
Add Vite client types, fix duplicate license key, update advisory status - #8
Merged
Merged
Conversation
- Declare Vite client types so TypeScript 7 accepts side-effect CSS imports (unblocks Dependabot #3). - Remove duplicate license key from package.json. - Mark GHSA-27r3-jxmh-p828 as fixed once body-parser 2.4.0 (#7) lands. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
SECURITY.md inaccurately describes the dependency fix as complete while the lockfile still resolves body-parser to 2.3.0; the upgrade must land or be documented as pending.
1 open issue
What changed in this PR
Prepares the web app for the TypeScript upgrade in Dependabot #3, removes duplicate package metadata, and updates security documentation in coordination with #7.
Changes:
- Adds Vite client types for side-effect CSS imports.
- Removes the duplicate
licensekey frompackage.json. - Marks the body-parser advisory as fixed, contingent on merging #7, while documenting the retained mitigation.
| File | Description |
|---|---|
SECURITY.md |
Updates the body-parser advisory status and defense-in-depth notes. |
package.json |
Removes the duplicate license entry. |
apps/web/vite-env.d.ts |
Includes Vite client type declarations. |
Review effort: Balanced
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
apps/web/vite-env.d.ts(/// <reference types="vite/client" />). TypeScript 7 requires type declarations for side-effect CSS imports (TS2882onimport './style.css'), which is why Dependabot Bump the development group with 4 updates #3 fails CI. After this merges, ask Dependabot to rebase Bump the development group with 4 updates #3."license"key frompackage.json, which caused an esbuildduplicate-object-keywarning.SECURITY.md: marks GHSA-27r3-jxmh-p828 as fixed by body-parser 2.4.0 (Dependabot Bump body-parser from 2.3.0 to 2.4.0 #7). Theinflate: falsesetting stays as defense in depth. Merge Bump body-parser from 2.3.0 to 2.4.0 #7 together with this PR so the docs stay accurate.Metric, source, or privacy impact
None
Checks
npm run checkpasses (locally: typecheck, 84/84 tests, build).localfiles, exports, or real enterprise data are included