Files
plex-playlist/frontend/package.json

51 lines
1.3 KiB
JSON
Raw Permalink Normal View History

{
"name": "plex-playlist-frontend",
"private": true,
"version": "0.0.0",
"type": "module",
"engines": {
"node": ">=24.6.0"
},
"scripts": {
"dev": "vite",
"build": "vue-tsc && vite build",
"preview": "vite preview",
"lint": "eslint . --fix",
"lint:fix": "eslint . --fix",
"lint:tsdoc": "eslint . --fix",
"format": "prettier --write src/",
"format:check": "prettier --check src/",
"type-check": "vue-tsc --noEmit",
"test": "vitest",
"test:coverage": "vitest run --coverage",
"test:e2e": "playwright test"
},
"dependencies": {
"vue": "^3.4.0",
"zod": "^4.0.0"
},
"devDependencies": {
"@playwright/test": "^1.40.0",
"@types/node": "^24.0.0",
"@typescript-eslint/eslint-plugin": "^8.0.0",
"@typescript-eslint/parser": "^8.0.0",
"@vitejs/plugin-vue": "^6.0.0",
"@vitest/coverage-v8": "^4.0.0",
"@vue/test-utils": "^2.4.0",
"@vue/tsconfig": "^0.9.0",
"eslint": "^10.0.0",
"eslint-plugin-jsdoc": "^63.0.0",
feat: integrate security audits into pre-commit and CI/CD with backend pip-audit migration (#74) ## Summary This PR integrates security-focused checks into the existing quality gates and aligns local workflows with CI/CD execution. ## What changed - Added Bandit to pre-commit backend checks. - Integrated eslint-plugin-security into the existing frontend ESLint setup used by pre-commit. - Added dedicated audit tasks: - backend audit via pip-audit - frontend audit via yarn npm audit - Updated CI/CD workflow to include and gate on frontend/backend audit jobs. - Switched backend vulnerability scanning from Safety to pip-audit to avoid interactive/auth requirements in CI. - Updated backend dependency set and lockfile to resolve test dependency conflicts and keep the environment solvable. - Marked backend integration API tests with the integration marker so marker-based unit/integration separation works consistently. ## Validation - Pre-commit hooks run and pass after formatting/autofixes. - Branch commit created successfully after hook-driven file updates. - Branch pushed to remote and tracking is configured. ## Notes - pip-audit now executes from backend context (for example via uv --directory backend run ...), matching project layout. - Remaining reported vulnerabilities depend on upstream package fix availability/constraints and may require follow-up once publishable fix versions are consumable. ## Follow-ups (optional) - Add a curated pip-audit ignore policy for non-actionable/transient advisories with rationale. - Open a focused follow-up PR for remaining dependency advisories once upstream fixes are practically installable. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: https://dogar.darkhelm.org/DarkHelm.org/plex-playlist/pulls/74
2026-07-13 22:19:57 -04:00
"eslint-plugin-security": "^4.0.1",
"eslint-plugin-tsdoc": "^0.5.0",
"eslint-plugin-vue": "^10.0.0",
"jsdom": "^29.0.0",
"prettier": "3.9.6",
"typescript": "~6.0.0",
"vite": "^8.0.0",
"vitest": "^4.0.0",
"vue-eslint-parser": "^10.0.0",
"vue-tsc": "^3.0.0"
},
"packageManager": "yarn@4.17.1"
}