From 0418762af161d081e348591d0e8af7dc181400d3 Mon Sep 17 00:00:00 2001 From: Christopher Maher Date: Tue, 3 Nov 2026 17:32:12 -0800 Subject: [PATCH] Move the wizard to SvelteKit 3 Dependabot's #300 (kit 3.1.0) failed npm ci: adapter-static 3 accepts only kit 2. This takes kit to 3.1.1 and adapter-static to 4.0.1, and makes the changes SvelteKit 3's migration guide asks of this project: - tsconfig.json extends $app/tsconfig and lists its files; - $lib, no longer generated, becomes #lib, a subpath import declared in package.json, with each TypeScript module's .js extension; - the cookie override (^0.7.2, for GHSA-pxg6-pf52-xh8x under kit 2) is removed: kit 3 depends on cookie ^2.0.1; - version.pollInterval is 0: kit 3 polls for a new deployment hourly by default, and the wizard ships inside the binary that serves it. It clears GHSA-27mw-82g8-phjj and GHSA-pfhg-q3qv-9q6r (fixed in kit 3.0.0). Neither reached the wizard, which sets no headers and has no form actions, but both are counted against the repository. web/osv-scanner.toml records GHSA-gcqx-w48m-w2h4 (deepmerge) as not applying, as tools/socair-sigstore/osv-scanner.toml does for its module: vite-plugin-svelte merges the project's own options with it at build time, nothing from a user or a model reaches it, it is not in the bundle, and there is no patched version. npm run check (0 errors), npm test (76 passed), and npm run build pass. The built wizard, served by socair serve, ran a scan and showed the engine's report. Signed-off-by: Christopher Maher --- web/osv-scanner.toml | 6 ++ web/package-lock.json | 92 +++++++++++-------------- web/package.json | 11 +-- web/src/lib/ReportView.svelte | 4 +- web/src/lib/index.ts | 2 +- web/src/routes/+layout.svelte | 10 +-- web/src/routes/+page.svelte | 2 +- web/src/routes/activity/+page.svelte | 6 +- web/src/routes/approved/+page.svelte | 8 +-- web/src/routes/models/[id]/+page.svelte | 14 ++-- web/src/routes/pending/+page.svelte | 6 +- web/src/routes/scan/+page.svelte | 10 +-- web/tsconfig.json | 11 ++- web/vite.config.ts | 7 +- 14 files changed, 93 insertions(+), 96 deletions(-) create mode 100644 web/osv-scanner.toml diff --git a/web/osv-scanner.toml b/web/osv-scanner.toml new file mode 100644 index 00000000..f01d3a57 --- /dev/null +++ b/web/osv-scanner.toml @@ -0,0 +1,6 @@ +# Advisories that OSV reports against the wizard's dependencies but that do +# not apply to what it builds. Each says why. + +[[IgnoredVulns]] +id = "GHSA-gcqx-w48m-w2h4" +reason = "deepmerge, used only at build time by @sveltejs/vite-plugin-svelte to merge the project's own Svelte options (src/utils/options.js). Nothing from a user or a model reaches it, it is not in the wizard bundle, and no patched version exists." diff --git a/web/package-lock.json b/web/package-lock.json index 6934da11..d3dd4956 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -10,8 +10,8 @@ "devDependencies": { "@fontsource/archivo": "^5.3.0", "@fontsource/jetbrains-mono": "^5.3.0", - "@sveltejs/adapter-static": "^3.0.10", - "@sveltejs/kit": "^2.63.0", + "@sveltejs/adapter-static": "^4.0.1", + "@sveltejs/kit": "^3.1.1", "@sveltejs/vite-plugin-svelte": "^7.1.2", "@types/node": "^22.20.5", "svelte": "^5.57.3", @@ -406,47 +406,43 @@ } }, "node_modules/@sveltejs/adapter-static": { - "version": "3.0.10", - "resolved": "https://registry.npmjs.org/@sveltejs/adapter-static/-/adapter-static-3.0.10.tgz", - "integrity": "sha512-7D9lYFWJmB7zxZyTE/qxjksvMqzMuYrrsyh1f4AlZqeZeACPRySjbC3aFiY55wb1tWUaKOQG9PVbm74JcN2Iew==", + "version": "4.0.1", + "resolved": "https://registry.npmjs.org/@sveltejs/adapter-static/-/adapter-static-4.0.1.tgz", + "integrity": "sha512-svOU1OcBiJ9Kn1cdxHDmJIsBy1/iQe9STPvUFkO2/iinxPFS7r8fc9TiCaWWUgbrE+7ox6Bt4MURv3RPi7sunQ==", "dev": true, "license": "MIT", "peerDependencies": { - "@sveltejs/kit": "^2.0.0" + "@sveltejs/kit": "^3.0.0-next.0" } }, "node_modules/@sveltejs/kit": { - "version": "2.70.3", - "resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.70.3.tgz", - "integrity": "sha512-UDvEYuZqAMbfB/oXIoqKvbKcb7YczK5zYrzmsGV1zRJk03jntwp8dXiYoIJotxAndsKvcPFtx9H1GRSKFdSHgg==", + "version": "3.1.1", + "resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-3.1.1.tgz", + "integrity": "sha512-BiEMvekYXE9Gu/YhWJ/yJ0WDLH1PX/dmjuAeFp5rrtdmgdzkjt7DvimlSP+/U4tgposl7pkE20luHpcnc6BgRw==", "dev": true, "license": "MIT", "dependencies": { - "@standard-schema/spec": "^1.0.0", - "@sveltejs/acorn-typescript": "^1.0.9", - "@types/cookie": "^0.6.0", - "acorn": "^8.16.0", - "cookie": "^0.6.0", - "devalue": "^5.8.1", + "@rolldown/pluginutils": "^1.0.1", + "@standard-schema/spec": "^1.1.0", + "cookie": "^2.0.1", + "devalue": "^5.9.4", "esm-env": "^1.2.2", - "kleur": "^4.1.5", - "magic-string": "^0.30.5", - "mrmime": "^2.0.0", - "set-cookie-parser": "^3.0.0", - "sirv": "^3.0.0" + "magic-string": "^1.2.3", + "mrmime": "^2.0.1", + "sirv": "^3.0.2" }, "bin": { "svelte-kit": "svelte-kit.js" }, "engines": { - "node": ">=18.13" + "node": ">=22.17" }, "peerDependencies": { "@opentelemetry/api": "^1.0.0", - "@sveltejs/vite-plugin-svelte": "^3.0.0 || ^4.0.0-next.1 || ^5.0.0 || ^6.0.0-next.0 || ^7.0.0", - "svelte": "^4.0.0 || ^5.0.0-next.0", - "typescript": "^5.3.3 || ^6.0.0", - "vite": "^5.0.3 || ^6.0.0 || ^7.0.0-beta.0 || ^8.0.0" + "@sveltejs/vite-plugin-svelte": "^7.0.0", + "svelte": "^5.57.1", + "typescript": "^6.0.0", + "vite": "^8.0.12" }, "peerDependenciesMeta": { "@opentelemetry/api": { @@ -457,6 +453,16 @@ } } }, + "node_modules/@sveltejs/kit/node_modules/magic-string": { + "version": "1.4.5", + "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.5.tgz", + "integrity": "sha512-oLLC2+YvQUfAa+vxoufE/yc1icb87M9iXIRqAoR/2EhE/8cb3SF/+Gi0c2By1B+5Vz2e2vQtUvHiu1+63Znh+w==", + "dev": true, + "license": "MIT", + "dependencies": { + "@jridgewell/sourcemap-codec": "^1.6.0" + } + }, "node_modules/@sveltejs/load-config": { "version": "0.2.3", "resolved": "https://registry.npmjs.org/@sveltejs/load-config/-/load-config-0.2.3.tgz", @@ -508,13 +514,6 @@ "assertion-error": "^2.0.1" } }, - "node_modules/@types/cookie": { - "version": "0.6.0", - "resolved": "https://registry.npmjs.org/@types/cookie/-/cookie-0.6.0.tgz", - "integrity": "sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA==", - "dev": true, - "license": "MIT" - }, "node_modules/@types/deep-eql": { "version": "4.0.2", "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz", @@ -667,13 +666,17 @@ } }, "node_modules/cookie": { - "version": "0.7.2", - "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz", - "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==", + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/cookie/-/cookie-2.0.1.tgz", + "integrity": "sha512-yuToqVvRrj6pfDXREyQAAv8SkAEk/8GS3jQRTiUMm66TVtBYmqQeoEjL2Lmq8Rpo6271vH76InTChTitEAm65w==", "dev": true, "license": "MIT", "engines": { - "node": ">= 0.6" + "node": ">=22" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/deepmerge": { @@ -798,16 +801,6 @@ "@types/estree": "^1.0.6" } }, - "node_modules/kleur": { - "version": "4.1.5", - "resolved": "https://registry.npmjs.org/kleur/-/kleur-4.1.5.tgz", - "integrity": "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=6" - } - }, "node_modules/lightningcss": { "version": "1.33.0", "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz", @@ -1261,13 +1254,6 @@ "node": ">=6" } }, - "node_modules/set-cookie-parser": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-3.1.2.tgz", - "integrity": "sha512-5/r/lTwbJ3zQ+qwdUFZYeRNqda7P5HD8zQKqlSjdGt1/S0cjLAphHusj4Y58ahDtWn/g32xrIS58/ikOvwl0Lw==", - "dev": true, - "license": "MIT" - }, "node_modules/sirv": { "version": "3.0.2", "resolved": "https://registry.npmjs.org/sirv/-/sirv-3.0.2.tgz", diff --git a/web/package.json b/web/package.json index ed862db7..216bb41e 100644 --- a/web/package.json +++ b/web/package.json @@ -13,11 +13,15 @@ "test:unit": "vitest", "test": "npm run test:unit -- --run" }, + "imports": { + "#lib": "./src/lib/index.js", + "#lib/*": "./src/lib/*" + }, "devDependencies": { "@fontsource/archivo": "^5.3.0", "@fontsource/jetbrains-mono": "^5.3.0", - "@sveltejs/adapter-static": "^3.0.10", - "@sveltejs/kit": "^2.63.0", + "@sveltejs/adapter-static": "^4.0.1", + "@sveltejs/kit": "^3.1.1", "@sveltejs/vite-plugin-svelte": "^7.1.2", "@types/node": "^22.20.5", "svelte": "^5.57.3", @@ -25,8 +29,5 @@ "typescript": "^6.0.3", "vite": "^8.3.5", "vitest": "^5.0.5" - }, - "overrides": { - "cookie": "^0.7.2" } } diff --git a/web/src/lib/ReportView.svelte b/web/src/lib/ReportView.svelte index 5cf60cd6..13f65483 100644 --- a/web/src/lib/ReportView.svelte +++ b/web/src/lib/ReportView.svelte @@ -1,5 +1,5 @@