Patch vulnerable build and runtime dependencies (Refs #70)

README.md

@@ -58,11 +58,10 @@ doesn't need a Docker socket or direct access to your game-server files.
 ## Development
 
 The controller uses SvelteKit, TypeScript, and SQLite. The host agent uses the
-Python 3 standard library. For local development, install Node.js 22 and Python 3:
+Python 3 standard library. For local development, install Node.js 22.12+ and Python 3:
 
 ```sh
 npm ci
-npm run agent:package
 export EC_SETUP_TOKEN=$(openssl rand -hex 32)
 export BETA_ARCHIVE_DIR=./data/beta-archive
 EC_AUTH_ALLOW_HTTP=true npm run dev
@@ -70,6 +69,7 @@ EC_AUTH_ALLOW_HTTP=true npm run dev
 
 Open `http://localhost:3000` and use the setup token from your shell. The local
 database defaults to `./data/cherry.db`; keep it separate from production data.
+`npm run dev` packages the downloadable agent before starting the server.
 
 ```sh
 npm run check

docs/development/README.md

@@ -10,11 +10,10 @@ does not require a Docker socket or direct access to host filesystems.
 
 ## Run locally
 
-Use Node.js 22 (the container's version), npm and Python 3.
+Use Node.js 22.12+ (the container uses Node.js 22), npm and Python 3.
 
 ```sh
 npm ci
-npm run agent:package
 export EC_SETUP_TOKEN="$(openssl rand -hex 32)"
 export BETA_ARCHIVE_DIR=./data/beta-archive
 EC_AUTH_ALLOW_HTTP=true npm run dev
@@ -83,10 +82,19 @@ npm run test:agent
 npm run build
 ```
 
-Builds regenerate the downloadable agent, standalone updater and checksum
-manifest. They also bundle report workers under `build/reports` and launch
-preparation under `build/launch`. Development and test commands compile those
-workers automatically. Restart `npm run dev` after changing worker code.
+The `package.json` overrides keep SvelteKit 2 on patched `devalue` 5.x (5.9.4 or
+newer) and `cookie` 0.7.x releases until its dependency ranges include those fixes.
+These dependencies ship in the server bundle even though SvelteKit is a
+development dependency.
+Dependency security checks must include development dependencies: use `npm audit`
+without `--omit=dev`.
+
+`npm run dev` and `npm run build` regenerate the downloadable agent, installer,
+standalone updater and checksum manifest. Builds also bundle report workers
+under `build/reports` and launch preparation under `build/launch`. Development
+and test commands compile those workers automatically. Restart `npm run dev`
+after changing agent or worker code, or run `npm run agent:package` to refresh
+only the downloadable agent assets while the development server is running.
 
 Automated tests simulate Docker and game hosts. Real Debian installation and
 T5/T6 server validation use the [host acceptance checklist](../guides/native-hosts.md#development-and-validation).

package.json

@@ -4,6 +4,9 @@
   "description": "T5/T6 Plutonium Zombies fleet manager \u2014 replaces push_scripts.sh with a live web UI",
   "private": true,
   "type": "module",
+  "engines": {
+    "node": "^22.12.0 || >=24.0.0"
+  },
   "scripts": {
     "dev": "vite dev",
     "build": "vite build && npm run build:reports -- --outDir build/reports && npm run build:launch -- --outDir build/launch",
@@ -19,7 +22,7 @@
     "test:agent": "python3 -m unittest discover -s agent/tests -v",
     "build:reports": "vite build --config vite.reports.config.ts",
     "build:launch": "vite build --config vite.launch.config.ts",
-    "predev": "npm run build:reports && npm run build:launch",
+    "predev": "npm run agent:package && npm run build:reports && npm run build:launch",
     "pretest": "npm run build:reports && npm run build:launch",
     "pretest:watch": "npm run build:reports && npm run build:launch",
     "check:styles": "node scripts/check-ui-styles.mjs"
@@ -32,15 +35,21 @@
   },
   "devDependencies": {
     "@sveltejs/adapter-node": "^5.2.9",
-    "@sveltejs/kit": "^2.8.0",
-    "@sveltejs/vite-plugin-svelte": "^4.0.0",
+    "@sveltejs/kit": "^2.70.3",
+    "@sveltejs/vite-plugin-svelte": "^6.2.4",
     "@types/better-sqlite3": "^7.6.11",
     "@types/node": "^22.7.0",
     "svelte": "^5.1.0",
     "svelte-check": "^4.0.0",
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
-    "vite": "^5.4.0",
-    "vitest": "^2.1.0"
+    "vite": "^7.3.7",
+    "vitest": "^4.1.11"
+  },
+  "overrides": {
+    "@sveltejs/kit": {
+      "cookie": "^0.7.2"
+    },
+    "devalue": "^5.9.4"
   }
 }

tmp-dedicated.cfg

@@ -1,16 +0,0 @@
-//////////////////////////////////////////////////
-// GENERAL CONFIGURATION                        //
-//////////////////////////////////////////////////
-
-set g_inactivity "190"                              // Enable or Disable auto kick feature for idle/AFK players.
-set sv_disableClientConsole "0"                     // Enable or Disable players ability to access server commands
-set sv_floodProtect "1"                             // Chat Spam Protection.
-set sv_kickBanTime "300"                            // Kick Ban Duration.
-set sv_voice "1"                                    // Allow Voice Chat?
-set sv_voicequality "3"                             // Voice Quality.
-set sp_minplayers "1"                               // Minimum amount of players.
-set scr_allowFileIo "1"                             // Allow GSC scripts to interact with files?
-set scr_kill_infinite_loops "1"                     // Kill misbehaving threads?
-set sv_wwwBaseURL ""                                // Fast DL URL
-
-set sv_maprotation "map zombie_theater"

tmp-resp.txt

@@ -1,29 +0,0 @@
-Note: Unnecessary use of -X or --request, POST is already inferred.
-* Host localhost:3000 was resolved.
-* IPv6: ::1
-* IPv4: 127.0.0.1
-  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
-                                 Dload  Upload   Total   Spent    Left  Speed
-␍  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying [::1]:3000...
-* Connected to localhost (::1) port 3000
-* using HTTP/1.x
-> POST /api/configs HTTP/1.1␍
-> Host: localhost:3000␍
-> User-Agent: curl/8.15.0␍
-> Accept: */*␍
-> Content-Length: 1832␍
-> Content-Type: multipart/form-data; boundary=------------------------barYWMs19HWi81kFXmt3OX␍
-> ␍
-} [1832 bytes data]
-* upload completely sent off: 1832 bytes
-< HTTP/1.1 200 OK␍
-< Access-Control-Allow-Origin: *␍
-< content-length: 232␍
-< content-type: application/json␍
-< Date: Sat, 12 Sep 2026 23:27:36 GMT␍
-< Connection: keep-alive␍
-< Keep-Alive: timeout=5␍
-< ␍
-{ [232 bytes data]
-␍100  2064  100   232  100  1832  49225   379k --:--:-- --:--:-- --:--:--  503k{"ok":true,"script":{"id":2,"name":"T5 Zombies Baseline","target_rel_path":"dedicated_sp.cfg","scope_type":"game","scope_value":"t5","current_version_id":null,"kind":"baseline","created_at":"2026-09-12T23:27:36.519Z"},"versionId":2}
-* Connection #0 to host localhost left intact

vite.config.ts

@@ -1,5 +1,5 @@
 import { sveltekit } from '@sveltejs/kit/vite';
-import { defineConfig } from 'vite';
+import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
     plugins: [sveltekit()],