2GT-RichandClaude Opus 4.8
4ff5ed805c
The CI Security Audit (npm audit --audit-level=high) started failing on all new PRs after a critical advisory was published against vitest <4.1.0 (GHSA-5xrq-8626-4rwp — Vitest UI server arbitrary file read/exec). The remediation chain also requires vite to move off the vulnerable esbuild range. These are devDependencies (test/build tooling) and do not ship in the production image, so there was no runtime exposure to deployed users — but the audit gate blocks the pipeline, so bump them: - vite ^5.0.11 -> ^8.0.16 - vitest ^3.0.5 -> ^4.1.8 - @vitejs/plugin-react ^4.2.1 -> ^5.2.0 (vite 8 peer compatibility) Vite 8 ships the rolldown bundler, which requires rollupOptions.output .manualChunks to be a function rather than an object — converted accordingly, with explicit precedence so @xyflow/react (whose name contains the substring "react") lands in the `flow` chunk instead of being pulled into `vendor`. Verified locally: npm ci, npm run lint, tsc --noEmit, npm run build, and npm test (vitest 4.1.8, 3/3 passing) all pass; npm audit reports 0 vulnerabilities. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
44 lines
1.2 KiB
TypeScript
44 lines
1.2 KiB
TypeScript
import { defineConfig } from 'vite';
|
|
import react from '@vitejs/plugin-react';
|
|
import path from 'path';
|
|
|
|
export default defineConfig({
|
|
plugins: [react()],
|
|
resolve: {
|
|
alias: {
|
|
'@': path.resolve(__dirname, './src'),
|
|
},
|
|
},
|
|
server: {
|
|
port: 3000,
|
|
proxy: {
|
|
'/api': {
|
|
target: 'http://localhost:3001',
|
|
changeOrigin: true,
|
|
},
|
|
'/socket.io': {
|
|
target: 'http://localhost:3001',
|
|
ws: true,
|
|
},
|
|
},
|
|
},
|
|
build: {
|
|
outDir: 'dist',
|
|
sourcemap: false,
|
|
rollupOptions: {
|
|
output: {
|
|
// Vite 8 (rolldown) requires manualChunks as a function, not an object.
|
|
// Order matters: match the more specific packages (@xyflow/react, recharts)
|
|
// before the generic react match, otherwise '@xyflow/react' — which contains
|
|
// the substring 'react' — would be pulled into the vendor chunk.
|
|
manualChunks(id) {
|
|
if (!id.includes('node_modules')) return;
|
|
if (id.includes('@xyflow/react')) return 'flow';
|
|
if (id.includes('recharts')) return 'charts';
|
|
if (/[\\/]node_modules[\\/]react(-dom|-router|-router-dom)?[\\/]/.test(id)) return 'vendor';
|
|
},
|
|
},
|
|
},
|
|
},
|
|
});
|