From 838033717c35aad522372e4d4169890a93753fa4 Mon Sep 17 00:00:00 2001 From: neon <18559658+neonsolstice@users.noreply.github.com> Date: Fri, 8 May 2026 19:10:03 -0600 Subject: [PATCH] fix(ci,books): resolve GHCR/CVE issues and clean pin/unpin fallbacks - regenerate lockfile after package version alignment - remove useless fallback spreads in pin and unpin column - resolve GHCR push auth and fast-uri CVE - patch fast-xml-builder CVE in image scan --- .github/workflows/container-image.yml | 12 ++++---- .../book/composables/useTableColumns.ts | 4 +-- package.json | 4 ++- pnpm-lock.yaml | 29 ++++++++++--------- 4 files changed, 27 insertions(+), 22 deletions(-) diff --git a/.github/workflows/container-image.yml b/.github/workflows/container-image.yml index 006e0063c..fed0f7ab5 100644 --- a/.github/workflows/container-image.yml +++ b/.github/workflows/container-image.yml @@ -148,8 +148,8 @@ jobs: uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 with: registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + username: ${{ github.repository_owner }} + password: ${{ secrets.GHCR_TOKEN != '' && secrets.GHCR_TOKEN || github.token }} - name: Build image id: build @@ -201,8 +201,8 @@ jobs: uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 with: registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + username: ${{ github.repository_owner }} + password: ${{ secrets.GHCR_TOKEN != '' && secrets.GHCR_TOKEN || github.token }} - name: Build image id: build @@ -247,8 +247,8 @@ jobs: uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 with: registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + username: ${{ github.repository_owner }} + password: ${{ secrets.GHCR_TOKEN != '' && secrets.GHCR_TOKEN || github.token }} - name: Create SHA manifest shell: bash diff --git a/client/src/features/book/composables/useTableColumns.ts b/client/src/features/book/composables/useTableColumns.ts index b8d3713fc..02af9f631 100644 --- a/client/src/features/book/composables/useTableColumns.ts +++ b/client/src/features/book/composables/useTableColumns.ts @@ -149,7 +149,7 @@ export function useTableColumns(viewType: TableViewType) { } function pinColumn(id: ColumnId, side: 'left' | 'right'): void { - const currentPins = { ...(layout.value.pinnedColumns ?? {}) } + const currentPins = { ...layout.value.pinnedColumns } if (currentPins[id] === side) return const MAX_PINNED = 3 const pinnedOnSide = Object.values(currentPins).filter((s) => s === side).length @@ -159,7 +159,7 @@ export function useTableColumns(viewType: TableViewType) { } function unpinColumn(id: ColumnId): void { - const currentPins = { ...(layout.value.pinnedColumns ?? {}) } + const currentPins = { ...layout.value.pinnedColumns } currentPins[id] = null layout.value = { ...layout.value, pinnedColumns: currentPins } } diff --git a/package.json b/package.json index 41593e6aa..f5e425b0e 100644 --- a/package.json +++ b/package.json @@ -72,7 +72,9 @@ "pnpm": { "overrides": { "@esbuild-kit/core-utils>esbuild": "^0.25.12", - "fastify": "^5.8.5" + "fastify": "^5.8.5", + "fast-uri": "^3.1.1", + "fast-xml-builder": "^1.1.7" }, "onlyBuiltDependencies": [ "@nestjs/core", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 5440a5635..90f39d6da 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,6 +7,8 @@ settings: overrides: "@esbuild-kit/core-utils>esbuild": ^0.25.12 fastify: ^5.8.5 + fast-uri: ^3.1.1 + fast-xml-builder: ^1.1.7 importers: .: @@ -328,7 +330,7 @@ importers: specifier: ^8.0.7 version: 8.0.7 opentype.js: - specifier: ^1.3.5 + specifier: ^1.3.4 version: 1.3.5 passport: specifier: ^0.7.0 @@ -361,7 +363,7 @@ importers: specifier: ^0.12.3 version: 0.12.3 zod: - specifier: ^4.4.1 + specifier: ^4.3.6 version: 4.4.1 devDependencies: "@eslint/eslintrc": @@ -404,7 +406,7 @@ importers: specifier: ^4.0.1 version: 4.0.1 "@types/pg": - specifier: ^8.20.0 + specifier: ^8.18.0 version: 8.20.0 "@types/supertest": specifier: ^7.2.0 @@ -6971,16 +6973,16 @@ packages: integrity: sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==, } - fast-uri@3.1.0: + fast-uri@3.1.2: resolution: { - integrity: sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==, + integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==, } - fast-xml-builder@1.1.5: + fast-xml-builder@1.1.7: resolution: { - integrity: sha512-4TJn/8FKLeslLAH3dnohXqE3QSoxkhvaMzepOIZytwJXZO69Bfz0HBdDHzOTOon6G59Zrk6VQ2bEiv1t61rfkA==, + integrity: sha512-Yh7/7rQuMXICNr0oMYDR2yHP6oUvmQsTToFeOWj/kIDhAwQ+c4Ol/lbcwOmEM5OHYQmh6S6EQSQ1sljCKP36bQ==, } fast-xml-parser@5.7.2: @@ -9141,6 +9143,7 @@ packages: { integrity: sha512-thKDiELidAApOvXlncrpwDZKJCa9fXLEKM4+FoEWI+qTLDeNb+h7EkN+8a7KQODsB1GZ+Exz9KknkoPrEdXZDw==, } + deprecated: This version should be ignored, it was meant to be published as 2.0.0 but got published as 1.3.5 by mistake. As of May 6th 2026 the latest v1 release is v1.3.4 hasBin: true optionator@0.9.4: @@ -12484,7 +12487,7 @@ snapshots: dependencies: ajv: 8.18.0 ajv-formats: 3.0.1(ajv@8.18.0) - fast-uri: 3.1.0 + fast-uri: 3.1.2 "@fastify/busboy@3.2.0": {} @@ -14625,7 +14628,7 @@ snapshots: ajv@8.18.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.0 + fast-uri: 3.1.2 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -15747,7 +15750,7 @@ snapshots: "@fastify/merge-json-schemas": 0.2.1 ajv: 8.18.0 ajv-formats: 3.0.1(ajv@8.18.0) - fast-uri: 3.1.0 + fast-uri: 3.1.2 json-schema-ref-resolver: 3.0.0 rfdc: 1.4.1 @@ -15759,16 +15762,16 @@ snapshots: fast-safe-stringify@2.1.1: {} - fast-uri@3.1.0: {} + fast-uri@3.1.2: {} - fast-xml-builder@1.1.5: + fast-xml-builder@1.1.7: dependencies: path-expression-matcher: 1.5.0 fast-xml-parser@5.7.2: dependencies: "@nodable/entities": 2.1.0 - fast-xml-builder: 1.1.5 + fast-xml-builder: 1.1.7 path-expression-matcher: 1.5.0 strnum: 2.2.3