From cbb87b6d539f6893ca7fed710be425c387b6bf6d Mon Sep 17 00:00:00 2001 From: Jerry Date: Wed, 23 Sep 2026 07:55:50 -0600 Subject: [PATCH] fix(deps): close the last high advisories, sanitize rich-text echo, env-scoped amap key - overrides: less <4.9.1 (drops image-size, the only remaining high), hono refreshed to 4.13.5, yaml 2.x and @hono/node-server covered; audit now 0 high / 4 moderate / 3 low, all registered as accepted risks in THIRD-PARTY-NOTICES with per-item rationale - ci audit step leaves observation mode: blocks on --audit-level=high - dompurify declared as a direct dependency and wired into the rich-text echo; verified headless that onerror/javascript: injected into the editor are stripped from the rendered preview - the echo is the pattern downstream projects copy when they persist content - amap key and security code move to AMAP_KEY/AMAP_SECURITY_CODE env defines (window._AMapSecurityConfig set before the loader fetches); unset keeps the loader's shared public key, README documents applying for a dedicated key - lyrics.ts documents that xgplayer-music renders LRC lines via unescaped innerHTML: remote lyrics must be escaped upstream - xgplayer demo media URLs pinned to https (protocol-relative would downgrade on http origins); notices gains the AGPL @stagewise/toolbar entry (inert unless umi stagewise is enabled) --- .env.example | 5 + .github/workflows/ci.yml | 6 +- README.md | 1 + THIRD-PARTY-NOTICES.md | 8 +- config/config.github.ts | 2 + config/config.ts | 4 + package.json | 8 +- pnpm-lock.yaml | 254 +++++++++--------- .../AudioFeature/AudioPlayer/lyrics.ts | 4 + src/pages/Feature/Map/AutonaviMap/index.tsx | 11 +- src/pages/Feature/RichTextEditing/index.tsx | 9 +- .../Feature/VideoPlayer/xgplayer/index.tsx | 4 +- src/typings.d.ts | 8 +- 13 files changed, 185 insertions(+), 139 deletions(-) diff --git a/.env.example b/.env.example index bf7fe9c2..18144ba9 100644 --- a/.env.example +++ b/.env.example @@ -6,5 +6,10 @@ CESIUM_ION_TOKEN=your_cesium_ion_token_here # UMI_APP_API_BASE=https://api.example.com +# 可选：高德 Web 端（JS API）Key 与安全密钥（https://console.amap.com 申请）。 +# 不配置时高德演示页使用组件库自带的公共 key（配额不受控），正式部署建议配置自己的 +# AMAP_KEY= +# AMAP_SECURITY_CODE= + # 可选：Clarity 统计项目 ID（模板默认不含任何统计脚本，配置后按你自己的项目上报） # CLARITY_ID= diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9bcfdfc7..a955ed2f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -34,9 +34,9 @@ jobs: - name: Quality gates（typecheck + 严格 lint + vitest，含 mock 可加载性） run: pnpm check - - name: Dependency audit（非阻断观察期） - # 两段式策略（决策 D7/D30）：先建立可见性，high 存量清零后转强制阻断 - run: pnpm audit --registry=https://registry.npmjs.org/ || true + - name: Dependency audit（high 及以上阻断；moderate/low 登记接受，见 THIRD-PARTY-NOTICES） + # 观察期结束：less 4.9.1 override 后 high 存量已清零（2026-09-22），转为强制阻断 + run: pnpm audit --prod --audit-level=high --registry=https://registry.npmjs.org/ build: needs: check diff --git a/README.md b/README.md index a96c7181..06a920bf 100644 --- a/README.md +++ b/README.md @@ -41,6 +41,7 @@ pnpm start | --- | --- | --- | | `CESIUM_ION_TOKEN` | Cesium 功能需要 | 在 [ion.cesium.com](https://ion.cesium.com/tokens) 获取；缺失时 Cesium Ion 影像/地形不可用（其余功能不受影响） | | `UMI_APP_API_BASE` | 可选 | 真实后端 API 地址；不配置时开发环境走 umi mock、纯静态部署走内置静态演示数据（表格 CRUD 经 localStorage 持久化） | +| `AMAP_KEY` / `AMAP_SECURITY_CODE` | 可选 | 高德 Web 端（JS API）Key 与安全密钥（[控制台申请](https://console.amap.com)）；不配置时高德演示页使用组件库自带公共 key（配额不受控），正式部署建议配置 | | `CLARITY_ID` | 可选 | [Clarity](https://clarity.microsoft.com) 统计项目 ID；**模板默认不含任何统计脚本**，配置后才按你自己的项目上报（含会话回放，正式站点请履行隐私告知义务） | ## 常用脚本 diff --git a/THIRD-PARTY-NOTICES.md b/THIRD-PARTY-NOTICES.md index 6aebcdb1..e867fafd 100644 --- a/THIRD-PARTY-NOTICES.md +++ b/THIRD-PARTY-NOTICES.md @@ -32,6 +32,10 @@ ## 已知接受风险 -以下依赖公告在写作时尚无补丁版本可用，作为已知接受风险登记（随上游发布补丁后升级消解）： +依赖审计策略（2026-09-22 起）：CI 以 `pnpm audit --prod --audit-level=high` 阻断 high 及以上；以下 moderate/low 公告经评估登记接受： -- `image-size`（high）：仅构建链使用，不进入运行产物。 +- `image-size`（high，**已消解**）：仅构建链使用。已通过 `"less@<4.9.1": "4.9.1"` override 升级 less（4.9.1 起改用 probe-image-size）消除。 +- `react-router@6.30.4` ×2（moderate）：反斜杠 open redirect 与 SSR hydration 注入。6.x 无补丁（修复在 7.18.0），受 @umijs/max 4 约束无法升级；本项目所有路由跳转目标均为代码常量、纯 SPA 无 SSR，实际不可利用。umi 升级 5/react-router 7 时一并闭环。 +- `uuid@8.3.2`（moderate）：exceljs 传递依赖，仅 v3/v5/v6 且调用方传自定义 buffer 才触发，exceljs 内部只用 v4，不受影响。 +- `decode-uri-component@0.2.2`（moderate）：@umijs/history 传递依赖，畸形 percent-encoding 的 DoS，需超长构造串，风险低。 +- `postcss-selector-parser` / `elliptic`（low）：构建链与 webpack polyfill 链，无补丁或无运行时暴露。 diff --git a/config/config.github.ts b/config/config.github.ts index 4ba21d7b..2c4cb060 100644 --- a/config/config.github.ts +++ b/config/config.github.ts @@ -16,6 +16,8 @@ export default defineConfig({ CESIUM_ION_TOKEN: process.env.CESIUM_ION_TOKEN, PUBLIC_PATH: '/umi-react-admin/', UMI_APP_API_BASE: process.env.UMI_APP_API_BASE, + AMAP_KEY: process.env.AMAP_KEY, + AMAP_SECURITY_CODE: process.env.AMAP_SECURITY_CODE, }, favicons: ['/umi-react-admin/favicon.ico'], base: '/umi-react-admin/', diff --git a/config/config.ts b/config/config.ts index ac9cda5d..a313187f 100644 --- a/config/config.ts +++ b/config/config.ts @@ -54,6 +54,10 @@ export default defineConfig({ // 以下变量经 define 显式注入（umi 仅自动注入 UMI_APP_* 前缀，未显式声明的 // process.env.X 会原样进入浏览器包并在模块初始化时抛 ReferenceError） UMI_APP_API_BASE: process.env.UMI_APP_API_BASE, + // 高德 Web 端（JS API）Key 与安全密钥（审计 2026-09-22 M-6）： + // 可选——不配置时高德页面回落 @pansy/amap-api-loader 自带的公共 key（配额不受本项目控制） + AMAP_KEY: process.env.AMAP_KEY, + AMAP_SECURITY_CODE: process.env.AMAP_SECURITY_CODE, }, // 覆盖 umi 默认的 viewport（user-scalable=no / maximum-scale=1 禁止缩放，违反 WCAG 1.4.4） metas: [{ name: 'viewport', content: 'width=device-width, initial-scale=1' }], diff --git a/package.json b/package.json index b289d241..aea64d26 100644 --- a/package.json +++ b/package.json @@ -66,6 +66,7 @@ "cesium-navigation-es6": "^3.0.9", "d3": "^7.9.0", "dayjs": "^1.11.11", + "dompurify": "^3.4.15", "exceljs": "^4.4.0", "html2canvas": "^1.4.1", "ol": "^9.2.2", @@ -121,6 +122,7 @@ "send@<0.19.0": "0.19.2", "webpack@<5.104.1": "5.104.1", "yaml@<1.10.3": "1.10.3", + "yaml@>=2.0.0 <2.8.3": "2.8.3", "react-router@>=6.0.0 <6.30.4": "6.30.4", "@remix-run/router@<1.23.3": "1.23.3", "brace-expansion@>=1.0.0 <1.1.21": "1.1.21", @@ -143,8 +145,10 @@ "baseline-browser-mapping@<2.11.0": "2.11.0", "@babel/core@<7.29.6": "7.29.6", "body-parser@>=1.20.0 <1.20.6": "1.20.6", - "hono@>=4.0.0 <4.12.34": "4.12.34", - "tmp@<0.2.6": "0.2.7" + "hono@>=4.0.0 <4.13.5": "4.13.5", + "tmp@<0.2.6": "0.2.7", + "@hono/node-server@<1.19.15": "1.19.15", + "less@<4.9.1": "4.9.1" } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 2e8bc782..311a90d1 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -25,6 +25,7 @@ overrides: send@<0.19.0: 0.19.2 webpack@<5.104.1: 5.104.1 yaml@<1.10.3: 1.10.3 + yaml@>=2.0.0 <2.8.3: 2.8.3 react-router@>=6.0.0 <6.30.4: 6.30.4 '@remix-run/router@<1.23.3': 1.23.3 brace-expansion@>=1.0.0 <1.1.21: 1.1.21 @@ -47,8 +48,10 @@ overrides: baseline-browser-mapping@<2.11.0: 2.11.0 '@babel/core@<7.29.6': 7.29.6 body-parser@>=1.20.0 <1.20.6: 1.20.6 - hono@>=4.0.0 <4.12.34: 4.12.34 + hono@>=4.0.0 <4.13.5: 4.13.5 tmp@<0.2.6: 0.2.7 + '@hono/node-server@<1.19.15': 1.19.15 + less@<4.9.1: 4.9.1 importers: @@ -104,7 +107,7 @@ importers: version: 7.4.0 '@umijs/max': specifier: ^4.7.19 - version: 4.7.19(@babel/core@7.29.6)(@types/node@25.7.0)(@types/react-dom@18.3.7(@types/react@18.3.31))(@types/react@18.3.31)(dva@2.5.0-beta.2(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(jiti@1.21.7)(lightningcss@1.32.0)(prettier@3.0.1)(rc-field-form@2.0.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(rollup@4.63.4)(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) + version: 4.7.19(@babel/core@7.29.6)(@types/node@25.7.0)(@types/react-dom@18.3.7(@types/react@18.3.31))(@types/react@18.3.31)(dva@2.5.0-beta.2(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(jiti@1.21.7)(lightningcss@1.32.0)(prettier@3.0.1)(rc-field-form@2.0.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(rollup@4.63.4)(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23))(yaml@2.8.3) antd: specifier: ^5.17.3 version: 5.17.3(date-fns@2.30.0)(moment@2.30.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) @@ -120,6 +123,9 @@ importers: dayjs: specifier: ^1.11.11 version: 1.11.11 + dompurify: + specifier: ^3.4.15 + version: 3.4.15 exceljs: specifier: ^4.4.0 version: 4.4.0 @@ -192,13 +198,13 @@ importers: version: 2.4.5(prettier@3.0.1) tailwindcss: specifier: ^3.4.19 - version: 3.4.19 + version: 3.4.19(yaml@2.8.3) typescript: specifier: ^5.9.3 version: 5.9.3 vitest: specifier: ^5.0.1 - version: 5.0.1(@types/node@25.7.0)(@vitest/coverage-v8@5.0.1)(jsdom@30.1.0)(vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.1.3)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)) + version: 5.0.1(@types/node@25.7.0)(@vitest/coverage-v8@5.0.1)(jsdom@30.1.0)(vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.9.1)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)(yaml@2.8.3)) packages: @@ -1214,18 +1220,18 @@ packages: peerDependencies: '@fullcalendar/core': ~6.1.8 - '@hono/node-server@1.19.14': - resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==} + '@hono/node-server@1.19.15': + resolution: {integrity: sha512-Za2ai6TLdKjUvnur+eenO6nuYYipVAEhyCAdaV8IRvmU9kK8crOZUSYvIXn72E4f8fJqyAbpcJuTsYYmZp9Deg==} engines: {node: '>=18.14.1'} peerDependencies: - hono: 4.12.34 + hono: 4.13.5 '@hono/node-ws@1.3.1': resolution: {integrity: sha512-vo/MwCnpJAVHBkGzWjCJ28wF45fYHAfbPZcH2rodZODHtch2GHA94KtMfusmVycTUtsLAsaNsHhtY6P8X3RQsA==} engines: {node: '>=18.14.1'} peerDependencies: - '@hono/node-server': ^1.19.11 - hono: 4.12.34 + '@hono/node-server': 1.19.15 + hono: 4.13.5 '@humanwhocodes/config-array@0.11.14': resolution: {integrity: sha512-3T8LkOmg45BV5FICb15QQMsyUSWrQ8AygVfC7ZG32zOalnqrilm018ZVCw0eapXux8FtA33q8PSRSstjee3jSg==} @@ -2530,7 +2536,7 @@ packages: resolution: {integrity: sha512-ilqvsvdmWaZd5ohQzLFg3zY7712g0m8ytZN6a9Rmb6Fc3erQFMM4y7A3r5Xbhoj//up6jdIxiOT/kxYD8mX8uw==} engines: {node: '>= 20'} peerDependencies: - less: ^4.0.0 + less: 4.9.1 less-loader: ^12.0.0 postcss: 8.5.23 resolve-url-loader: ^5.0.0 @@ -3325,9 +3331,6 @@ packages: resolution: {integrity: sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==} engines: {node: '>= 0.6'} - copy-anything@2.0.6: - resolution: {integrity: sha512-1j20GZTsvKNkc4BY3NpMOM8tt///wY3FpIzozTOFO2ffuZcV61nojHXVKIy3WM+7ADCy5FVhdZYHYDdgTU0yJw==} - copy-anything@3.0.5: resolution: {integrity: sha512-yCEafptTtb4bk7GLEQoM8KVJpxAfdBJYaXyzQEgQQQgYrZiDp8SJmGKlYza6CYjEDNstAdNdKA3UuoULlEbS6w==} engines: {node: '>=12.13'} @@ -3898,6 +3901,9 @@ packages: dompurify@3.4.13: resolution: {integrity: sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==} + dompurify@3.4.15: + resolution: {integrity: sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==} + domutils@2.8.0: resolution: {integrity: sha512-w96Cjofp72M5IIhpjgobBimYEfoPjx1Vx0BSX9P30WBdZW2WIKU0T1Bd0kz2eNZ9ikjKgHbEyKx8BB6H1L3h3A==} @@ -4628,8 +4634,8 @@ packages: hoist-non-react-statics@3.3.2: resolution: {integrity: sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==} - hono@4.12.34: - resolution: {integrity: sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==} + hono@4.13.5: + resolution: {integrity: sha512-O6+/eCYRkzzzy0rPWwKLiGBR1nFuUPZynnwjxN1MBA62NNqbT0wQEzQyK2gSO5yDIDB336sXQleAhOHrzlYyKw==} engines: {node: '>=16.9.0'} hosted-git-info@2.8.9: @@ -4730,11 +4736,6 @@ packages: resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==} engines: {node: '>= 4'} - image-size@0.5.5: - resolution: {integrity: sha512-6TDAlDPZxUFCv+fuOkIoXT/V/f3Qbq8e37p+YOiYrUv3v9cc3/6x78VdfPgFVaB9dZYeLUfKgHRebpkm/oP2VQ==} - engines: {node: '>=0.10.0'} - hasBin: true - immediate@3.0.6: resolution: {integrity: sha512-XXOFtyqDjNDAQxVfYxuF7g9Il/IbWmmlQg2MYKOH8ExIT1qg6xc4zyS3HaEEATgs1btfzxq15ciUiY7gjSXRGQ==} @@ -4997,9 +4998,6 @@ packages: resolution: {integrity: sha512-mfcwb6IzQyOKTs84CQMrOwW4gQcaTOAWJ0zzJCl2WSPDrWk/OzDaImWFH3djXhb24g4eudZfLRozAvPGw4d9hQ==} engines: {node: '>= 0.4'} - is-what@3.14.1: - resolution: {integrity: sha512-sNxgpk9793nzSs7bA6JQJGeIuRBQhAaNGG77kzYQgMkrID+lS6SlK07K5LaptscDlSaIgH+GPFzf+d75FVxozA==} - is-what@4.1.16: resolution: {integrity: sha512-ZhMwEosbFJkA0YhFnNDgTM4ZxDRsS6HqTo7qsZM08fehyRYIYa0yHu5R6mgo1n/8MgaPBXiPimPD77baVFYg+A==} engines: {node: '>=12.13'} @@ -5200,7 +5198,7 @@ packages: resolution: {integrity: sha512-C+uDBV7kS7W5fJlUjq5mPBeBVhYpTIm5gB09APT9o3n/ILeaXVsiSFTbZpTJCJwQ/Crczfn3DmfQFwxYusWFug==} engines: {node: '>= 14.15.0'} peerDependencies: - less: ^3.5.0 || ^4.0.0 + less: 4.9.1 webpack: 5.104.1 less-loader@12.3.2: @@ -5208,7 +5206,7 @@ packages: engines: {node: '>= 18.12.0'} peerDependencies: '@rspack/core': 0.x || ^1.0.0 || ^2.0.0-0 - less: ^3.5.0 || ^4.0.0 + less: 4.9.1 webpack: 5.104.1 peerDependenciesMeta: '@rspack/core': @@ -5219,13 +5217,8 @@ packages: less-plugin-resolve@1.0.2: resolution: {integrity: sha512-e1AHq0XNTU8S3d9JCc8CFYajoUBr0EK3pcuLT5PogyBBeE0knzZJL105kKKSZWfq2lQLq3/uEDrMK3JPq+fHaA==} - less@4.1.3: - resolution: {integrity: sha512-w16Xk/Ta9Hhyei0Gpz9m7VS8F28nieJaL/VyShID7cYvP6IL5oHeL6p4TXSDJqZE/lNv0oJ2pGVjJsRkfwm5FA==} - engines: {node: '>=6'} - hasBin: true - - less@4.6.4: - resolution: {integrity: sha512-OJmO5+HxZLLw0RLzkqaNHzcgEAQG7C0y3aMbwtCzIUFZsLMNNq/1IdAdHEycQ58CwUO3jPTHmoN+tE5I7FQxNg==} + less@4.9.1: + resolution: {integrity: sha512-orp15PfJvvNDIqJdVWzMI9Sjpjp3VTiw3sfvbB+67LlISTEn8uVT2EdYSuyl02BLvaftv6sdk9Umnxmm5rckmg==} engines: {node: '>=18'} hasBin: true @@ -5522,9 +5515,9 @@ packages: make-cancellable-promise@2.0.0: resolution: {integrity: sha512-3SEQqTpV9oqVsIWqAcmDuaNeo7yBO3tqPtqGRcKkEo0lrzD3wqbKG9mkxO65KoOgXqj+zH2phJ2LiAsdzlogSw==} - make-dir@2.1.0: - resolution: {integrity: sha512-LS9X+dc8KLxXCb8dni79fLIIUA5VyZoyjSMCwTluaXA0o27cCK0bhXkpgw+sTXVpPy/lSO57ilRixqk0vDmtRA==} - engines: {node: '>=6'} + make-dir@5.1.0: + resolution: {integrity: sha512-IfpFq6UM39dUNiphpA6uDezNx/AvWyhwfICWPR3t1VspkgkMZrL+Rk1RbN1bx+aeNYwOrqGJgEgV3yotk+ZUVw==} + engines: {node: '>=18'} make-event-props@2.0.0: resolution: {integrity: sha512-G/hncXrl4Qt7mauJEXSg3AcdYzmpkIITTNl5I+rH9sog5Yw0kK6vseJjCaPfOXqOqQuPUP89Rkhfz5kPS8ijtw==} @@ -5697,6 +5690,11 @@ packages: natural-compare@1.4.0: resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==} + needle@2.9.1: + resolution: {integrity: sha512-6R9fqJ5Zcmf+uYaFgdIHmLwNldn5HbK8L5ybn7Uz+ylX/rnOsSp1AHcvQSrCaFN+qNM1wpymHqD7mVasEOlHGQ==} + engines: {node: '>= 4.4.x'} + hasBin: true + needle@3.5.0: resolution: {integrity: sha512-jaQyPKKk2YokHrEg+vFDYxXIHTCBgiZwSHOoVx/8V3GIBS8/VN6NdVRmg8q1ERtPkMvmOvebsgga4sAj5hls/w==} engines: {node: '>= 4.4.x'} @@ -6019,10 +6017,6 @@ packages: engines: {node: '>=0.10'} hasBin: true - pify@4.0.1: - resolution: {integrity: sha512-uB80kBFb/tfd68bVleG9T5GGsGPjJrLAUpR5PZIrhBnIaRTQRjqdJSsIKkOP6OAIFbj7GOrcudc5pNjZ+geV2g==} - engines: {node: '>=6'} - pify@5.0.0: resolution: {integrity: sha512-eW/gHNMlxdSP6dmG6uJip6FXN0EQBwm2clYYd8Wul42Cwu/DK8HEftzsapcNdYe2MfLiIwZqsDk2RDEsTE79hA==} engines: {node: '>=10'} @@ -6184,7 +6178,7 @@ packages: jiti: '>=1.21.0' postcss: 8.5.23 tsx: ^4.8.1 - yaml: ^2.4.2 + yaml: 2.8.3 peerDependenciesMeta: jiti: optional: true @@ -6403,6 +6397,9 @@ packages: pretty-error@4.0.0: resolution: {integrity: sha512-AoJ5YMAcXKYxKhuJGdcvse+Voc6v1RgnsR3nWcYU7q4t6z0Q6T86sv5Zq8VIRbOWWFpvdGE83LtdSMNd+6Y0xw==} + probe-image-size@7.4.0: + resolution: {integrity: sha512-cdEprVtZxV+awMde9X+4jILBFYh4CARxVrQaMl4wY4YcPWbul9jntXrIW95NInBDyJwcVUP3U0T6yukN8rMBaQ==} + process-nextick-args@2.0.1: resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==} @@ -7606,6 +7603,9 @@ packages: stream-http@2.8.3: resolution: {integrity: sha512-+TSkfINHDo4J+ZobQLWiMouQYB+UVYFttRA94FpEzzJ7ZdqcL4uUUQ7WkdkI4DSozGmgBUE/a47L+38PenXhUw==} + stream-parser@0.3.1: + resolution: {integrity: sha512-bJ/HgKq41nlKvlhccD5kaCr/P+Hu0wPNKPJOH7en+YrJu/9EgqUF+88w5Jb6KNcjOFMhfX4B2asfeAtIGuHObQ==} + stream-shift@1.0.3: resolution: {integrity: sha512-76ORR0DO1o1hlKwTbi/DM3EXWGf3ZJYO8cXX5RJwnul2DEg2oyoZyjLNoQM8WsvZiFKCRfC1O0J7iCvie3RZmQ==} @@ -8195,7 +8195,7 @@ packages: peerDependencies: '@types/node': ^20.19.0 || >=22.12.0 jiti: '>=1.21.0' - less: ^4.0.0 + less: 4.9.1 lightningcss: ^1.21.0 sass: ^1.70.0 sass-embedded: ^1.70.0 @@ -8203,7 +8203,7 @@ packages: sugarss: ^5.0.0 terser: ^5.16.0 tsx: ^4.8.1 - yaml: ^2.4.2 + yaml: 2.8.3 peerDependenciesMeta: '@types/node': optional: true @@ -8460,9 +8460,10 @@ packages: resolution: {integrity: sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==} engines: {node: '>= 6'} - yaml@2.3.1: - resolution: {integrity: sha512-2eHWfjaoXgTBC2jNM1LRef62VQa0umtvRiDSk6HSzW7RvS5YtkabJrwYLLEKWBc8a5U2PTSCs+dJjUTJdlHsWQ==} - engines: {node: '>= 14'} + yaml@2.8.3: + resolution: {integrity: sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==} + engines: {node: '>= 14.6'} + hasBin: true yargs-parser@18.1.3: resolution: {integrity: sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==} @@ -9839,14 +9840,14 @@ snapshots: '@fullcalendar/core': 6.1.8 '@fullcalendar/daygrid': 6.1.8(@fullcalendar/core@6.1.8) - '@hono/node-server@1.19.14(hono@4.12.34)': + '@hono/node-server@1.19.15(hono@4.13.5)': dependencies: - hono: 4.12.34 + hono: 4.13.5 - '@hono/node-ws@1.3.1(@hono/node-server@1.19.14(hono@4.12.34))(hono@4.12.34)': + '@hono/node-ws@1.3.1(@hono/node-server@1.19.15(hono@4.13.5))(hono@4.13.5)': dependencies: - '@hono/node-server': 1.19.14(hono@4.12.34) - hono: 4.12.34 + '@hono/node-server': 1.19.15(hono@4.13.5) + hono: 4.13.5 ws: 8.21.0 transitivePeerDependencies: - bufferutil @@ -10972,14 +10973,14 @@ snapshots: dependencies: '@umijs/bundler-utils': 4.7.19 '@umijs/bundler-webpack': 4.7.19(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) - '@utoo/pack': 1.5.18(less-loader@11.1.0(less@4.1.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)))(less@4.1.3)(postcss@8.5.23)(resolve-url-loader@5.0.0)(sass-loader@13.2.0(sass@1.54.0)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)))(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1)) + '@utoo/pack': 1.5.18(less-loader@11.1.0(less@4.9.1)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)))(less@4.9.1)(postcss@8.5.23)(resolve-url-loader@5.0.0)(sass-loader@13.2.0(sass@1.54.0)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)))(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1)) compression: 1.8.1 connect-history-api-fallback: 2.0.0 cors: 2.8.6 express: 4.22.2 express-http-proxy: 2.1.2 - less: 4.1.3 - less-loader: 11.1.0(less@4.1.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) + less: 4.9.1 + less-loader: 11.1.0(less@4.9.1)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) postcss: 8.5.23 resolve-url-loader: 5.0.0 sass: 1.54.0 @@ -11001,20 +11002,20 @@ snapshots: - webpack-hot-middleware - webpack-plugin-serve - '@umijs/bundler-vite@4.7.19(@types/node@25.7.0)(jiti@1.21.7)(lightningcss@1.32.0)(postcss@8.5.23)(rollup@4.63.4)(sass@1.54.0)(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23))': + '@umijs/bundler-vite@4.7.19(@types/node@25.7.0)(jiti@1.21.7)(lightningcss@1.32.0)(postcss@8.5.23)(rollup@4.63.4)(sass@1.54.0)(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23))(yaml@2.8.3)': dependencies: '@svgr/core': 6.5.1 '@umijs/bundler-utils': 4.7.19 '@umijs/bundler-webpack': 4.7.19(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) '@umijs/utils': 4.7.19 - '@vitejs/plugin-react': 5.2.0(vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.1.3)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)) + '@vitejs/plugin-react': 5.2.0(vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.9.1)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)(yaml@2.8.3)) core-js: 3.34.0 - less: 4.1.3 + less: 4.9.1 postcss-preset-env: 7.5.0(postcss@8.5.23) rollup-plugin-visualizer: 6.0.11(rollup@4.63.4) systemjs: 6.15.1 terser: 5.49.0 - vite: 7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.1.3)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0) + vite: 7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.9.1)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)(yaml@2.8.3) transitivePeerDependencies: - '@types/node' - '@types/webpack' @@ -11145,8 +11146,8 @@ snapshots: '@types/resolve': 1.20.6 chalk: 4.1.2 enhanced-resolve: 5.21.3 - less: 4.6.4 - less-loader: 12.3.2(less@4.6.4)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) + less: 4.9.1 + less-loader: 12.3.2(less@4.9.1)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) loader-runner: 4.3.2 loader-utils: 3.3.1 lodash: 4.18.1 @@ -11174,17 +11175,18 @@ snapshots: - postcss - sass - sass-embedded + - supports-color - typescript - webpack - '@umijs/max@4.7.19(@babel/core@7.29.6)(@types/node@25.7.0)(@types/react-dom@18.3.7(@types/react@18.3.31))(@types/react@18.3.31)(dva@2.5.0-beta.2(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(jiti@1.21.7)(lightningcss@1.32.0)(prettier@3.0.1)(rc-field-form@2.0.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(rollup@4.63.4)(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23))': + '@umijs/max@4.7.19(@babel/core@7.29.6)(@types/node@25.7.0)(@types/react-dom@18.3.7(@types/react@18.3.31))(@types/react@18.3.31)(dva@2.5.0-beta.2(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(jiti@1.21.7)(lightningcss@1.32.0)(prettier@3.0.1)(rc-field-form@2.0.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(rollup@4.63.4)(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23))(yaml@2.8.3)': dependencies: '@umijs/lint': 4.7.19(eslint@8.35.0)(stylelint@14.8.2)(typescript@5.9.3) '@umijs/plugins': 4.7.19(@babel/core@7.29.6)(@types/react-dom@18.3.7(@types/react@18.3.31))(@types/react@18.3.31)(antd@4.24.16(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(dva@2.5.0-beta.2(encoding@0.1.13)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(rc-field-form@2.0.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) antd: 4.24.16(react-dom@18.3.1(react@18.3.1))(react@18.3.1) eslint: 8.35.0 stylelint: 14.8.2 - umi: 4.7.19(@babel/core@7.29.6)(@types/node@25.7.0)(@types/react@18.3.31)(jiti@1.21.7)(lightningcss@1.32.0)(prettier@3.0.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(rollup@4.63.4)(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) + umi: 4.7.19(@babel/core@7.29.6)(@types/node@25.7.0)(@types/react@18.3.31)(jiti@1.21.7)(lightningcss@1.32.0)(prettier@3.0.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(rollup@4.63.4)(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23))(yaml@2.8.3) transitivePeerDependencies: - '@babel/core' - '@rspack/core' @@ -11294,7 +11296,7 @@ snapshots: - supports-color - webpack - '@umijs/preset-umi@4.7.19(@types/node@25.7.0)(@types/react@18.3.31)(jiti@1.21.7)(lightningcss@1.32.0)(rollup@4.63.4)(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23))': + '@umijs/preset-umi@4.7.19(@types/node@25.7.0)(@types/react@18.3.31)(jiti@1.21.7)(lightningcss@1.32.0)(rollup@4.63.4)(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23))(yaml@2.8.3)': dependencies: '@iconify/utils': 2.1.1 '@stagewise/toolbar': 0.6.2 @@ -11305,7 +11307,7 @@ snapshots: '@umijs/bundler-mako': 0.11.10(postcss@8.5.23)(sass@1.54.0)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) '@umijs/bundler-utils': 4.7.19 '@umijs/bundler-utoopack': 4.7.19(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) - '@umijs/bundler-vite': 4.7.19(@types/node@25.7.0)(jiti@1.21.7)(lightningcss@1.32.0)(postcss@8.5.23)(rollup@4.63.4)(sass@1.54.0)(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) + '@umijs/bundler-vite': 4.7.19(@types/node@25.7.0)(jiti@1.21.7)(lightningcss@1.32.0)(postcss@8.5.23)(rollup@4.63.4)(sass@1.54.0)(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23))(yaml@2.8.3) '@umijs/bundler-webpack': 4.7.19(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) '@umijs/core': 4.7.19 '@umijs/did-you-know': 1.0.4 @@ -11463,11 +11465,11 @@ snapshots: '@utoo/pack-win32-x64-msvc@1.5.18': optional: true - '@utoo/pack@1.5.18(less-loader@11.1.0(less@4.1.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)))(less@4.1.3)(postcss@8.5.23)(resolve-url-loader@5.0.0)(sass-loader@13.2.0(sass@1.54.0)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)))(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))': + '@utoo/pack@1.5.18(less-loader@11.1.0(less@4.9.1)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)))(less@4.9.1)(postcss@8.5.23)(resolve-url-loader@5.0.0)(sass-loader@13.2.0(sass@1.54.0)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)))(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))': dependencies: '@babel/code-frame': 7.22.5 - '@hono/node-server': 1.19.14(hono@4.12.34) - '@hono/node-ws': 1.3.1(@hono/node-server@1.19.14(hono@4.12.34))(hono@4.12.34) + '@hono/node-server': 1.19.15(hono@4.13.5) + '@hono/node-ws': 1.3.1(@hono/node-server@1.19.15(hono@4.13.5))(hono@4.13.5) '@jridgewell/trace-mapping': 0.3.31 '@swc/helpers': 0.5.15 '@utoo/pack-shared': 1.5.18 @@ -11475,9 +11477,9 @@ snapshots: domparser-rs: 0.0.7 find-up: 4.1.0 get-port: 5.1.1 - hono: 4.12.34 - less: 4.1.3 - less-loader: 11.1.0(less@4.1.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) + hono: 4.13.5 + less: 4.9.1 + less-loader: 11.1.0(less@4.9.1)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) nanoid: 3.3.18 picocolors: 1.1.1 postcss: 8.5.23 @@ -11501,7 +11503,7 @@ snapshots: - supports-color - utf-8-validate - '@vitejs/plugin-react@5.2.0(vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.1.3)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0))': + '@vitejs/plugin-react@5.2.0(vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.9.1)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)(yaml@2.8.3))': dependencies: '@babel/core': 7.29.6 '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.29.6) @@ -11509,7 +11511,7 @@ snapshots: '@rolldown/pluginutils': 1.0.0-rc.3 '@types/babel__core': 7.20.5 react-refresh: 0.18.0 - vite: 7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.1.3)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0) + vite: 7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.9.1)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)(yaml@2.8.3) transitivePeerDependencies: - supports-color @@ -11523,7 +11525,7 @@ snapshots: obug: 2.2.1 std-env: 4.2.0 tinyrainbow: 3.1.1 - vitest: 5.0.1(@types/node@25.7.0)(@vitest/coverage-v8@5.0.1)(jsdom@30.1.0)(vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.1.3)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)) + vitest: 5.0.1(@types/node@25.7.0)(@vitest/coverage-v8@5.0.1)(jsdom@30.1.0)(vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.9.1)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)(yaml@2.8.3)) '@vitest/istanbul-lib-coverage@1.0.1': {} @@ -11531,14 +11533,14 @@ snapshots: dependencies: '@vitest/istanbul-lib-coverage': 1.0.1 - '@vitest/mocker@5.0.1(vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.1.3)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0))': + '@vitest/mocker@5.0.1(vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.9.1)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)(yaml@2.8.3))': dependencies: '@jridgewell/trace-mapping': 0.3.31 '@vitest/spy': 5.0.1 estree-walker: 3.0.3 magic-string: 1.4.1 optionalDependencies: - vite: 7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.1.3)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0) + vite: 7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.9.1)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)(yaml@2.8.3) '@vitest/spy@5.0.1': {} @@ -12528,10 +12530,6 @@ snapshots: cookie@0.7.2: {} - copy-anything@2.0.6: - dependencies: - is-what: 3.14.1 - copy-anything@3.0.5: dependencies: is-what: 4.1.16 @@ -13093,6 +13091,10 @@ snapshots: optionalDependencies: '@types/trusted-types': 2.0.7 + dompurify@3.4.15: + optionalDependencies: + '@types/trusted-types': 2.0.7 + domutils@2.8.0: dependencies: dom-serializer: 1.4.1 @@ -14121,7 +14123,7 @@ snapshots: dependencies: react-is: 16.13.1 - hono@4.12.34: {} + hono@4.13.5: {} hosted-git-info@2.8.9: {} @@ -14226,9 +14228,6 @@ snapshots: ignore@5.3.2: {} - image-size@0.5.5: - optional: true - immediate@3.0.6: {} immer@9.0.21: {} @@ -14492,8 +14491,6 @@ snapshots: call-bound: 1.0.4 get-intrinsic: 1.3.0 - is-what@3.14.1: {} - is-what@4.1.16: {} is-wsl@2.2.0: @@ -14720,15 +14717,15 @@ snapshots: lerc@3.0.0: {} - less-loader@11.1.0(less@4.1.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)): + less-loader@11.1.0(less@4.9.1)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)): dependencies: klona: 2.0.6 - less: 4.1.3 + less: 4.9.1 webpack: 5.104.1(lightningcss@1.32.0)(postcss@8.5.23) - less-loader@12.3.2(less@4.6.4)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)): + less-loader@12.3.2(less@4.9.1)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)): dependencies: - less: 4.6.4 + less: 4.9.1 optionalDependencies: webpack: 5.104.1(lightningcss@1.32.0)(postcss@8.5.23) @@ -14736,32 +14733,20 @@ snapshots: dependencies: enhanced-resolve: 5.21.3 - less@4.1.3: - dependencies: - copy-anything: 2.0.6 - parse-node-version: 1.0.1 - tslib: 2.8.1 - optionalDependencies: - errno: 0.1.8 - graceful-fs: 4.2.11 - image-size: 0.5.5 - make-dir: 2.1.0 - mime: 1.6.0 - needle: 3.5.0 - source-map: 0.6.1 - - less@4.6.4: + less@4.9.1: dependencies: copy-anything: 3.0.5 parse-node-version: 1.0.1 optionalDependencies: errno: 0.1.8 graceful-fs: 4.2.11 - image-size: 0.5.5 - make-dir: 2.1.0 + make-dir: 5.1.0 mime: 1.6.0 needle: 3.5.0 + probe-image-size: 7.4.0 source-map: 0.6.1 + transitivePeerDependencies: + - supports-color levn@0.4.1: dependencies: @@ -14882,7 +14867,7 @@ snapshots: object-inspect: 1.12.3 pidtree: 0.6.0 string-argv: 0.3.2 - yaml: 2.3.1 + yaml: 2.8.3 transitivePeerDependencies: - enquirer - supports-color @@ -15003,10 +14988,7 @@ snapshots: make-cancellable-promise@2.0.0: {} - make-dir@2.1.0: - dependencies: - pify: 4.0.1 - semver: 5.7.2 + make-dir@5.1.0: optional: true make-event-props@2.0.0: {} @@ -15152,6 +15134,15 @@ snapshots: natural-compare@1.4.0: {} + needle@2.9.1: + dependencies: + debug: 3.2.7 + iconv-lite: 0.4.24 + sax: 1.6.0 + transitivePeerDependencies: + - supports-color + optional: true + needle@3.5.0: dependencies: iconv-lite: 0.6.3 @@ -15523,9 +15514,6 @@ snapshots: pidtree@0.6.0: {} - pify@4.0.1: - optional: true - pify@5.0.0: {} pino-abstract-transport@0.5.0: @@ -15669,12 +15657,13 @@ snapshots: postcss: 8.5.23 postcss-value-parser: 4.2.0 - postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.23): + postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.23)(yaml@2.8.3): dependencies: lilconfig: 3.1.3 optionalDependencies: jiti: 1.21.7 postcss: 8.5.23 + yaml: 2.8.3 postcss-loader@8.2.1(postcss@8.5.23)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)): dependencies: @@ -15875,6 +15864,15 @@ snapshots: lodash: 4.18.1 renderkid: 3.0.0 + probe-image-size@7.4.0: + dependencies: + lodash.merge: 4.6.2 + needle: 2.9.1 + stream-parser: 0.3.1 + transitivePeerDependencies: + - supports-color + optional: true + process-nextick-args@2.0.1: {} process-okam@0.11.10: {} @@ -17375,6 +17373,13 @@ snapshots: to-arraybuffer: 1.0.1 xtend: 4.0.2 + stream-parser@0.3.1: + dependencies: + debug: 2.6.9 + transitivePeerDependencies: + - supports-color + optional: true + stream-shift@1.0.3: {} strict-uri-encode@2.0.0: {} @@ -17628,7 +17633,7 @@ snapshots: string-width: 4.2.3 strip-ansi: 6.0.1 - tailwindcss@3.4.19: + tailwindcss@3.4.19(yaml@2.8.3): dependencies: '@alloc/quick-lru': 5.3.0 arg: 5.0.2 @@ -17647,7 +17652,7 @@ snapshots: postcss: 8.5.23 postcss-import: 15.1.0(postcss@8.5.23) postcss-js: 4.1.0(postcss@8.5.23) - postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.23) + postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.23)(yaml@2.8.3) postcss-nested: 6.2.0(postcss@8.5.23) postcss-selector-parser: 6.1.2 resolve: 1.22.12 @@ -17873,13 +17878,13 @@ snapshots: typescript@5.9.3: {} - umi@4.7.19(@babel/core@7.29.6)(@types/node@25.7.0)(@types/react@18.3.31)(jiti@1.21.7)(lightningcss@1.32.0)(prettier@3.0.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(rollup@4.63.4)(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)): + umi@4.7.19(@babel/core@7.29.6)(@types/node@25.7.0)(@types/react@18.3.31)(jiti@1.21.7)(lightningcss@1.32.0)(prettier@3.0.1)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(rollup@4.63.4)(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23))(yaml@2.8.3): dependencies: '@babel/runtime': 7.28.4 '@umijs/bundler-utils': 4.7.19 '@umijs/bundler-webpack': 4.7.19(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) '@umijs/core': 4.7.19 - '@umijs/preset-umi': 4.7.19(@types/node@25.7.0)(@types/react@18.3.31)(jiti@1.21.7)(lightningcss@1.32.0)(rollup@4.63.4)(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23)) + '@umijs/preset-umi': 4.7.19(@types/node@25.7.0)(@types/react@18.3.31)(jiti@1.21.7)(lightningcss@1.32.0)(rollup@4.63.4)(sass@1.54.0)(styled-jsx@5.1.7(@babel/core@7.29.6)(react@18.3.1))(type-fest@0.21.3)(typescript@5.9.3)(webpack@5.104.1(lightningcss@1.32.0)(postcss@8.5.23))(yaml@2.8.3) '@umijs/renderer-react': 4.7.19(react-dom@18.3.1(react@18.3.1))(react@18.3.1) '@umijs/server': 4.7.19 '@umijs/test': 4.7.19(@babel/core@7.29.6) @@ -18036,7 +18041,7 @@ snapshots: vary@1.1.2: {} - vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.1.3)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0): + vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.9.1)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)(yaml@2.8.3): dependencies: esbuild: 0.28.2 fdir: 6.5.0(picomatch@4.0.7) @@ -18048,15 +18053,16 @@ snapshots: '@types/node': 25.7.0 fsevents: 2.3.3 jiti: 1.21.7 - less: 4.1.3 + less: 4.9.1 lightningcss: 1.32.0 sass: 1.54.0 terser: 5.49.0 + yaml: 2.8.3 - vitest@5.0.1(@types/node@25.7.0)(@vitest/coverage-v8@5.0.1)(jsdom@30.1.0)(vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.1.3)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)): + vitest@5.0.1(@types/node@25.7.0)(@vitest/coverage-v8@5.0.1)(jsdom@30.1.0)(vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.9.1)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)(yaml@2.8.3)): dependencies: '@types/chai': 5.2.3 - '@vitest/mocker': 5.0.1(vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.1.3)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)) + '@vitest/mocker': 5.0.1(vite@7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.9.1)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)(yaml@2.8.3)) chai: 6.2.2 es-module-lexer: 2.3.2 expect-type: 1.4.0 @@ -18067,7 +18073,7 @@ snapshots: tinybench: 6.1.4 tinyexec: 1.3.0 tinyglobby: 0.2.17 - vite: 7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.1.3)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0) + vite: 7.3.6(@types/node@25.7.0)(jiti@1.21.7)(less@4.9.1)(lightningcss@1.32.0)(sass@1.54.0)(terser@5.49.0)(yaml@2.8.3) why-is-node-running: 2.3.0 optionalDependencies: '@types/node': 25.7.0 @@ -18310,7 +18316,7 @@ snapshots: yaml@1.10.3: {} - yaml@2.3.1: {} + yaml@2.8.3: {} yargs-parser@18.1.3: dependencies: diff --git a/src/pages/Feature/AudioFeature/AudioPlayer/lyrics.ts b/src/pages/Feature/AudioFeature/AudioPlayer/lyrics.ts index a58d62a0..9894d7c4 100644 --- a/src/pages/Feature/AudioFeature/AudioPlayer/lyrics.ts +++ b/src/pages/Feature/AudioFeature/AudioPlayer/lyrics.ts @@ -3,6 +3,10 @@ * 每行一个时间标签，用真实换行拼接：xgplayer-music 按行解析，解析结果为空时会抛 * "Reduce of empty array"（此前歌词 JSON 里是转义后的字面量 \n，整页因此崩溃）。 * 此前内容为商业歌曲的完整歌词，已按演示媒体自制替换的约定移除。 + * + * ⚠️ 库渲染行为（审计 2026-09-22 M-8）：xgplayer-music 的 Lyric 插件把每行歌词经 + * innerHTML 零转义直接拼进 DOM。本文件是本地静态常量所以安全；一旦改成 fetch 远程 LRC， + * 必须先对每行做 HTML 转义再传入 Lyric——否则就是库内部的存储型 XSS，业务侧 review 极难发现。 */ export const demoLyrics = [ '[00:00.00]umi-react-admin 音乐播放器演示', diff --git a/src/pages/Feature/Map/AutonaviMap/index.tsx b/src/pages/Feature/Map/AutonaviMap/index.tsx index 157d6b88..36743a4f 100644 --- a/src/pages/Feature/Map/AutonaviMap/index.tsx +++ b/src/pages/Feature/Map/AutonaviMap/index.tsx @@ -2,7 +2,9 @@ * 参考于: * https://juejin.cn/post/6951328185539624967 * https://github.com/pansyjs/react-amap - * 说明: 未使用高德 Key/安全密钥 + * 说明: Key 经 AMAP_KEY / AMAP_SECURITY_CODE 环境变量注入（见 config/config.ts define）； + * 未配置时回落 @pansy/amap-api-loader 自带的公共 key——其配额与可用性不受本项目控制， + * 正式部署请申请自己的 Web 端（JS API）Key 并配套安全密钥（审计 2026-09-22 M-6）。 */ import { getMessage } from '@/utils/antdMessage'; import { ProCard } from '@ant-design/pro-components'; @@ -12,6 +14,11 @@ import { useState } from 'react'; import { AutonaviMapStyle } from './AutonaviMap.style'; +// AMap JS API 2.0 的安全密钥必须在 JS API 脚本加载前挂到 window（官方约定），loader 异步加载前来得及 +if (typeof window !== 'undefined' && AMAP_SECURITY_CODE && !window._AMapSecurityConfig) { + window._AMapSecurityConfig = { securityJsCode: AMAP_SECURITY_CODE }; +} + type AMapClickEvent = { lnglat: { getLng: () => number; @@ -34,7 +41,7 @@ export default function AutonaviMap() {
- + {position && }
diff --git a/src/pages/Feature/RichTextEditing/index.tsx b/src/pages/Feature/RichTextEditing/index.tsx index 78abe91d..e5b21153 100644 --- a/src/pages/Feature/RichTextEditing/index.tsx +++ b/src/pages/Feature/RichTextEditing/index.tsx @@ -2,6 +2,7 @@ import { ProCard } from '@ant-design/pro-components'; import { Editor } from '@tinymce/tinymce-react'; import { useModel } from '@umijs/max'; import { Button, Typography } from 'antd'; +import DOMPurify from 'dompurify'; import { useRef, useState } from 'react'; import type { Editor as TinyMCEEditor } from 'tinymce'; // 自托管 TinyMCE（必须先于编辑器渲染执行，挂载全局 tinymce 后 Editor 不再走 Tiny Cloud） @@ -65,9 +66,11 @@ export default () => {