mirror of
https://github.com/simstudioai/sim.git
synced 2026-09-24 15:45:35 +08:00
WaleedandClaude Opus 4.7
7953c56aca
* fix(security): xlsx CVE bump and bundled security hardening * fix(stripe): use configured secret key for SDK init Avoids leaving a recognisable placeholder string in heap dumps and error serialisations. Webhook verification remains a purely local HMAC operation; the SDK's constructor key is unused by it. Addresses Greptile feedback on #4481. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(stripe): use static Stripe.webhooks for verification Avoids instantiating a Stripe client just to access constructEvent. The webhook signing secret is per-trigger (user-provided whsec_…) and unrelated to our billing STRIPE_SECRET_KEY, so coupling them was wrong. Stripe.webhooks is exposed as a static — no client, no API key needed. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(ci): revert client-bundled tools to avoid .server import in client * fix(security): collapse 403 to 404 on v1 detail-by-ID routes * chore(security): remove unused validateAgiloftInstanceUrl helper * fix(security): bump minimatch + clean up scripts/ workspace Resolves CVE-2026-27903 (GHSA-7r86-cg39-jmmj) by adding a root-level minimatch ^10.2.5 override. Also resolves CVE-2026-0969 in next-mdx-remote (bumped to ^6.0.0). Cleanup: - Make scripts/ a proper bun workspace (root workspaces array) - Remove duplicate scripts/package-lock.json (this repo uses bun) - Remove redundant scripts/bun.lock (now hoisted to root) - Remove vestigial scripts/setup-doc-generator.sh - Slim scripts/package.json to its real deps (glob, yaml) - Gitignore stray package-lock.json files - Update scripts/README.md Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
77 lines
3.3 KiB
JSON
77 lines
3.3 KiB
JSON
{
|
|
"name": "simstudio",
|
|
"packageManager": "bun@1.3.13",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"license": "Apache-2.0",
|
|
"workspaces": [
|
|
"apps/*",
|
|
"packages/*",
|
|
"scripts"
|
|
],
|
|
"scripts": {
|
|
"build": "turbo run build",
|
|
"dev": "turbo run dev",
|
|
"dev:sockets": "cd apps/realtime && bun run dev",
|
|
"dev:full": "bunx concurrently -n \"App,Realtime\" -c \"cyan,magenta\" \"cd apps/sim && bun run dev\" \"cd apps/realtime && bun run dev\"",
|
|
"test": "turbo run test",
|
|
"format": "turbo run format",
|
|
"format:check": "turbo run format:check",
|
|
"lint": "turbo run lint",
|
|
"lint:check": "turbo run lint:check",
|
|
"lint:helm": "helm lint ./helm/sim --strict --values ./helm/sim/test/values-lint.yaml",
|
|
"lint:all": "turbo run lint && bun run lint:helm",
|
|
"check": "turbo run format:check",
|
|
"check:boundaries": "bun run scripts/check-monorepo-boundaries.ts",
|
|
"check:api-validation": "bun run scripts/check-api-validation-contracts.ts --check",
|
|
"check:api-validation:strict": "bun run scripts/check-api-validation-contracts.ts --check --enforce-boundary-baseline",
|
|
"check:realtime-prune": "bun run scripts/check-realtime-prune-graph.ts",
|
|
"mship-contracts:generate": "bun run scripts/sync-mothership-stream-contract.ts",
|
|
"mship-contracts:check": "bun run scripts/sync-mothership-stream-contract.ts --check",
|
|
"mship-tools:generate": "bun run scripts/sync-tool-catalog.ts",
|
|
"mship-tools:check": "bun run scripts/sync-tool-catalog.ts --check",
|
|
"trace-contracts:generate": "bun run scripts/sync-request-trace-contract.ts",
|
|
"trace-contracts:check": "bun run scripts/sync-request-trace-contract.ts --check",
|
|
"trace-spans-contract:generate": "bun run scripts/sync-trace-spans-contract.ts",
|
|
"trace-spans-contract:check": "bun run scripts/sync-trace-spans-contract.ts --check",
|
|
"trace-attributes-contract:generate": "bun run scripts/sync-trace-attributes-contract.ts",
|
|
"trace-attributes-contract:check": "bun run scripts/sync-trace-attributes-contract.ts --check",
|
|
"trace-attribute-values-contract:generate": "bun run scripts/sync-trace-attribute-values-contract.ts",
|
|
"trace-attribute-values-contract:check": "bun run scripts/sync-trace-attribute-values-contract.ts --check",
|
|
"trace-events-contract:generate": "bun run scripts/sync-trace-events-contract.ts",
|
|
"trace-events-contract:check": "bun run scripts/sync-trace-events-contract.ts --check",
|
|
"mship:generate": "bun run scripts/generate-mship-contracts.ts",
|
|
"mship:check": "bun run scripts/generate-mship-contracts.ts --check",
|
|
"prepare": "bun husky",
|
|
"type-check": "turbo run type-check",
|
|
"release": "bun run scripts/create-single-release.ts"
|
|
},
|
|
"overrides": {
|
|
"react": "19.2.4",
|
|
"react-dom": "19.2.4",
|
|
"next": "16.2.4",
|
|
"@next/env": "16.2.4",
|
|
"drizzle-orm": "^0.45.2",
|
|
"postgres": "^3.4.5",
|
|
"minimatch": "^10.2.5"
|
|
},
|
|
"devDependencies": {
|
|
"@biomejs/biome": "2.0.0-beta.5",
|
|
"@octokit/rest": "^21.0.0",
|
|
"glob": "13.0.0",
|
|
"husky": "9.1.7",
|
|
"json-schema-to-typescript": "15.0.4",
|
|
"lint-staged": "16.0.0",
|
|
"turbo": "2.9.6",
|
|
"yaml": "^2.8.1"
|
|
},
|
|
"lint-staged": {
|
|
"*.{js,jsx,ts,tsx,json,css,scss}": [
|
|
"biome check --write --no-errors-on-unmatched --files-ignore-unknown=true"
|
|
]
|
|
},
|
|
"trustedDependencies": [
|
|
"sharp"
|
|
]
|
|
}
|