mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 04:32:42 +00:00
Marc-André Bombeck
315ca5e67c
pdfjs-dist 6.1.200 and a transitive 5.6.205 both sit in the affected range of a flaw that lets a crafted PDF run JavaScript inside the renderer. The document vault feeds it every uploaded PDF, so pin the direct dependency to 6.2.108 and add a bounded override so the transitive copy lands there too. The override stops short of pdf-parse's 5.4.296, which predates the flaw and drives the local text-extraction path. The runtime image ships every pdfjs-dist copy in the store, not just the one that gets loaded, so an unused transitive copy still counted. Hoisting in the image picked whichever copy the filesystem listed first, and more than one copy reaches it, so the version named in package.json was not reliably the one the renderer resolved. Carry the resolved version forward from the build stage, select it by name, and fail the build when it is missing rather than leaving another copy in its place.
141 lines
4.3 KiB
JSON
141 lines
4.3 KiB
JSON
{
|
|
"name": "healthlog",
|
|
"version": "1.37.0",
|
|
"description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
|
|
"license": "PolyForm-Noncommercial-1.0.0",
|
|
"homepage": "https://healthlog.dev",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/MBombeck/HealthLog.git"
|
|
},
|
|
"bugs": {
|
|
"url": "https://github.com/MBombeck/HealthLog/issues"
|
|
},
|
|
"keywords": [
|
|
"health-tracking",
|
|
"self-hosted",
|
|
"pwa",
|
|
"blood-pressure",
|
|
"withings",
|
|
"next.js",
|
|
"prisma",
|
|
"passkey"
|
|
],
|
|
"private": true,
|
|
"packageManager": "pnpm@11.15.1",
|
|
"scripts": {
|
|
"prepare": "node scripts/prepare.mjs",
|
|
"dev": "next dev",
|
|
"predev": "node scripts/generate-i18n-boot.mjs",
|
|
"prebuild": "node scripts/generate-sw-version.mjs && node scripts/generate-i18n-boot.mjs",
|
|
"build": "NODE_OPTIONS=--max-old-space-size=8192 next build",
|
|
"analyze": "ANALYZE=1 next build",
|
|
"bundle-report": "node scripts/check-bundle-budget.mjs",
|
|
"bundle-check": "node scripts/check-bundle-budget.mjs --check",
|
|
"start": "next start",
|
|
"lint": "eslint",
|
|
"db:generate": "prisma generate",
|
|
"db:push": "prisma db push",
|
|
"db:migrate": "prisma migrate dev",
|
|
"db:migrate:deploy": "prisma migrate deploy",
|
|
"db:studio": "prisma studio",
|
|
"format": "prettier --write .",
|
|
"format:check": "prettier --check .",
|
|
"typecheck": "NODE_OPTIONS=--max-old-space-size=8192 tsc --noEmit",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:integration": "vitest run --config vitest.integration.config.mts",
|
|
"e2e": "playwright test",
|
|
"e2e:ui": "playwright test --ui",
|
|
"openapi:generate": "npx tsx scripts/generate-openapi.ts",
|
|
"openapi:check": "npx tsx scripts/check-openapi.ts",
|
|
"check-env": "npx tsx scripts/check-env.ts",
|
|
"mcp:stdio": "npx tsx src/cli/mcp-stdio.ts"
|
|
},
|
|
"dependencies": {
|
|
"@aws-sdk/client-s3": "^3.1075.0",
|
|
"@dnd-kit/core": "^6.3.1",
|
|
"@dnd-kit/sortable": "^10.0.0",
|
|
"@dnd-kit/utilities": "^3.2.2",
|
|
"@hookform/resolvers": "^5.4.0",
|
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
"@napi-rs/canvas": "1.0.2",
|
|
"@node-rs/argon2": "^2.0.2",
|
|
"@parse/node-apn": "^8.1.0",
|
|
"@prisma/adapter-pg": "^7.9.1",
|
|
"@prisma/client": "^7.8.0",
|
|
"@simplewebauthn/browser": "^13.3.0",
|
|
"@simplewebauthn/server": "^13.3.2",
|
|
"@tanstack/react-query": "5.101.4",
|
|
"@tanstack/react-virtual": "^3.14.5",
|
|
"@types/sax": "^1.2.7",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"date-fns": "^4.4.0",
|
|
"dotenv": "^17.4.2",
|
|
"fflate": "^0.8.3",
|
|
"jose": "^6.2.3",
|
|
"jspdf": "^4.2.1",
|
|
"jspdf-autotable": "^5.0.8",
|
|
"lucide-react": "^1.27.0",
|
|
"mmdb-lib": "^3.0.2",
|
|
"next": "16.2.11",
|
|
"next-themes": "^0.4.6",
|
|
"nodemailer": "9.0.3",
|
|
"otpauth": "^9.5.1",
|
|
"p-limit": "^7.3.1",
|
|
"pg-boss": "^12.26.0",
|
|
"prisma": "^7.8.0",
|
|
"qrcode": "^1.5.4",
|
|
"radix-ui": "^1.6.2",
|
|
"react": "19.2.7",
|
|
"react-day-picker": "^10.0.1",
|
|
"react-dom": "19.2.7",
|
|
"react-hook-form": "7.83.0",
|
|
"recharts": "^3.10.1",
|
|
"rrule": "^2.8.1",
|
|
"sax": "^1.6.0",
|
|
"sonner": "^2.0.7",
|
|
"tailwind-merge": "^3.6.0",
|
|
"tesseract.js": "^7.0.0",
|
|
"undici": "^8.10.0",
|
|
"web-push": "^3.6.7",
|
|
"yaml": "^2.8.4",
|
|
"zod": "^4.4.3",
|
|
"zod-openapi": "^6.0.0",
|
|
"zxcvbn-typescript": "^5.0.1"
|
|
},
|
|
"devDependencies": {
|
|
"@axe-core/playwright": "^4.12.1",
|
|
"@next/bundle-analyzer": "^16.2.12",
|
|
"@openai/codex-security": "^0.1.1",
|
|
"@playwright/test": "^1.60.0",
|
|
"@tailwindcss/postcss": "^4",
|
|
"@testcontainers/postgresql": "^12.0.3",
|
|
"@types/node": "26.1.1",
|
|
"@types/nodemailer": "^8.0.1",
|
|
"@types/pg": "^8.20.0",
|
|
"@types/qrcode": "^1.5.6",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"@types/web-push": "^3.6.4",
|
|
"@vitejs/plugin-react": "^6.0.4",
|
|
"@vitest/coverage-v8": "^4.1.5",
|
|
"eslint": "^9",
|
|
"eslint-config-next": "16.2.12",
|
|
"knip": "^6.16.1",
|
|
"lefthook": "^2.1.10",
|
|
"pdf-parse": "^2.4.5",
|
|
"pdfjs-dist": "6.2.108",
|
|
"pg": "^8.22.0",
|
|
"prettier": "^3.9.1",
|
|
"prettier-plugin-tailwindcss": "^0.8.1",
|
|
"shadcn": "^4.16.1",
|
|
"tailwindcss": "^4",
|
|
"testcontainers": "^12.0.3",
|
|
"tw-animate-css": "^1.4.0",
|
|
"typescript": "^6",
|
|
"vitest": "^4.1.5"
|
|
}
|
|
}
|