From c9432a3c6533431ebefde97b154ed76adacdde27 Mon Sep 17 00:00:00 2001 From: Nixevol Date: Mon, 1 Jun 2026 11:43:46 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E5=8D=87=E7=BA=A7=E5=89=8D=E7=AB=AF?= =?UTF-8?q?=E9=97=B4=E6=8E=A5=E4=BE=9D=E8=B5=96=E6=BC=8F=E6=B4=9E?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/project_context.md | 6 ++++++ frontend/package-lock.json | 6 +++--- frontend/package.json | 3 +++ 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/docs/project_context.md b/docs/project_context.md index 78704e8..c9905d0 100644 --- a/docs/project_context.md +++ b/docs/project_context.md @@ -1,5 +1,11 @@ # 项目上下文记录 +## 2026-06-01：修复前端 npm audit moderate 漏洞 + +- `frontend/package.json` 增加 `overrides.dompurify=3.4.7`，将 `monaco-editor@0.55.1` 间接依赖的 vulnerable `dompurify@3.2.7` 覆盖到安全版本。 +- 未执行 `npm audit fix --force`，因为 npm 建议的自动修复会把 Monaco 降级到 `0.53.0`，属于破坏性方向；override 保持 Monaco 版本不变，风险更小。 +- 已验证 `npm audit --json` 返回 0 漏洞，`npm ls monaco-editor dompurify` 显示 `monaco-editor@0.55.1 -> dompurify@3.4.7 overridden`，`npm run build` 通过。 + ## 2026-06-01：Naive UI 自动按需导入 - `frontend/vite.config.ts` 增加 `unplugin-vue-components`、`unplugin-auto-import` 和 `NaiveUiResolver`，模板中的 `n-*` 组件改为构建期自动按需导入；`dts` 关闭以避免生成额外类型文件。 diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 02227a5..dbef47d 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -1411,9 +1411,9 @@ } }, "node_modules/dompurify": { - "version": "3.2.7", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.2.7.tgz", - "integrity": "sha512-WhL/YuveyGXJaerVlMYGWhvQswa7myDG17P7Vu65EWC05o8vfeNbvNf4d/BOvH99+ZW+LlQsc1GDKMa1vNK6dw==", + "version": "3.4.7", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.7.tgz", + "integrity": "sha512-2jBxDJY4RR06tQNy4w5FlFH7kfxsQZlufd0sbv+chfHCxeJwrFw2baUDsSwvBISD4K4RDbd0PTfy3uNXsR6siA==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" diff --git a/frontend/package.json b/frontend/package.json index 1f43db3..7acc973 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -11,6 +11,9 @@ "scarfSettings": { "enabled": false }, + "overrides": { + "dompurify": "3.4.7" + }, "dependencies": { "@tauri-apps/api": "^2.11.0", "@vicons/ionicons5": "^0.13.0",