Patch vulnerable build and runtime dependencies (Refs #70)

2026-10-08 17:53:52 -04:00
parent e9be3f7177
commit 4f5725ee74
5 changed files with 274 additions and 696 deletions
@@ -10,7 +10,7 @@ does not require a Docker socket or direct access to host filesystems.

 ## Run locally

-Use Node.js 22 (the container's version), npm and Python 3.
+Use Node.js 22.12+ (the container uses Node.js 22), npm and Python 3.

 ```sh
 npm ci
@@ -82,6 +82,13 @@ npm run test:agent
 npm run build
 ```

+The `package.json` overrides keep SvelteKit 2 on patched `devalue` 5.x (5.9.4 or
+newer) and `cookie` 0.7.x releases until its dependency ranges include those fixes.
+These dependencies ship in the server bundle even though SvelteKit is a
+development dependency.
+Dependency security checks must include development dependencies: use `npm audit`
+without `--omit=dev`.
+
 `npm run dev` and `npm run build` regenerate the downloadable agent, installer,
 standalone updater and checksum manifest. Builds also bundle report workers
 under `build/reports` and launch preparation under `build/launch`. Development