mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-07 04:12:04 +00:00
Marc-André Bombeck
f62cd59789
Three overrides had drifted behind the advisories they were written for, and the scan found the packages at versions the pins were supposed to exclude. dompurify moves from <=3.4.10 to <3.4.13. GHSA-55q2-fjhq-7xh7 is fixed in 3.4.13 and the tree carried 3.4.12. The copy is jspdf's optional HTML renderer, an optionalDependency at ^3.3.1, so the raise stays inside the range jspdf declares. postcss moves from <8.5.10 to <8.5.23 for CVE-2026-69153. next declares an exact postcss@8.4.31, so nothing but this bound moves it; the build has run on the 8.5 line since the first bump and stays there. valibot gets a floor it never had, <1.4.2, for CVE-2026-59952. Two copies arrive and neither is ours to call: an optional peer of @hookform/resolvers, which this app does not use because it validates with zod, and prisma's local dev server. 1.4.2 is the same major, so no consumer is moved onto a new one. @hono/node-server moves from <1.19.13 to <1.19.15 for GHSA-frvp-7c67-39w9. The app tree already resolved 1.19.17, so this changes nothing here; it exists so the bound states the real floor and so the Dockerfile mirror has something correct to match. The floor test in ci-determinism asserted the exact key and replacement string, which meant every legitimate raise failed it while a floor gone stale against a newer advisory passed it unchanged. It now reduces each key to a package name and asserts the pin is at or above the fixed version, with a case proving the comparison can return false.
scripts/
One-shot operator and build scripts. These are not part of the running application — they are run by hand during a deploy, a backfill, or a release, or wired into CI. Recurring work belongs on pg-boss (src/lib/jobs/), not here.
How to run them
From a source checkout:
pnpm dlx tsx scripts/<file>.ts
The production image intentionally removes npm, pnpm, and Corepack. Only
container-safe scripts named by an operator runbook use its pinned
healthlog-tsx launcher; scripts that import the full application dependency
graph must run from a source checkout. scripts/ is excluded from the project
typecheck.
What lives here
generate-openapi.ts— emitsdocs/api/openapi.yamlfrom the registered Zod schemas (pnpm openapi:generate).check-openapi.ts— compares a freshly generated spec against the committed YAML; CI fails on drift (pnpm openapi:check).check-env.ts— pre-deploy env-var sanity check againstenv-manifest.json(pnpm check-env); wired into CI.assert-deploy.ts— post-deploy/api/versionassertion.rotate-encryption-key.ts— AES-256-GCM key rotation; seedocs/ops/encryption-key-rotation.md.restore-backup.ts— restore an off-host AES-GCM backup from an S3-compatible bucket.repair-intake-anomalies.ts— repair historic medication-ledger defects (duplicate dose-slot rows, implausibletaken_at); dry-run by default, seedocs/ops/intake-repair.md.backfill-rollups.ts,drain-per-sample-cumulative.ts,backfill-mood-note-column.ts— historical data backfills (note: the boot-timerollup-full-backfillqueue handles new accounts automatically; the CLI is the manual fallback).seed-demo.ts+seed-demo-v15.sql— populate a demo tenant.test-notifications.ts— exercise the notification dispatcher + reminder check.fetch-geolite2.sh— download the MaxMind GeoLite2 MMDBs (needs a licence key) beforedocker build.install-hooks.sh— install the local git hooks.generate-sw-version.mjs,print-bundle-report.mjs— service-worker version stamp and bundle-size report.i18n/— locale tooling;__tests__/— tests for the scripts above.
Conventions
See ../CLAUDE.md "Tests and commands" + "Self-hosting gotchas". Operator runbooks that drive these scripts live in ../docs/ops/.