From 83e05386552816f4a7b7fa14a82c08cc4541482b Mon Sep 17 00:00:00 2001 From: Paul Derscheid Date: Thu, 6 Nov 2025 16:58:25 +0100 Subject: [PATCH] Bug 40778: Pin Node.js dependencies to exact resolved versions - Replace all caret ranges (^) in package.json with exact versions - 37 dependencies pinned to exact versions - 32 devDependencies pinned to exact versions - 2 resolutions updated to exact versions - This ensures reproducible builds by locking dependencies to their currently resolved versions from yarn.lock - This also ensures that we don't update to a compromised package by accident just by running `yarn install` without `--frozen-lockfile` --- package.json | 140 +++++++++++++++++++++++++-------------------------- 1 file changed, 70 insertions(+), 70 deletions(-) diff --git a/package.json b/package.json index 5dea65c54f9..6bdc9b9ffe4 100644 --- a/package.json +++ b/package.json @@ -7,43 +7,43 @@ "test": "test" }, "dependencies": { - "@cypress/vue": "^3.1.1", - "@cypress/webpack-dev-server": "^1.8.3", - "@cypress/webpack-preprocessor": "^6.0.4", - "@faker-js/faker": "^9.2.0", - "@fortawesome/fontawesome-svg-core": "^6.1.0", - "@fortawesome/free-solid-svg-icons": "^6.0.0", - "@fortawesome/vue-fontawesome": "^3.0.0-5", - "@koha-community/prettier-plugin-template-toolkit": "^2.0.2", - "@popperjs/core": "^2.11.6", - "@redocly/cli": "^1.25.11", - "bootstrap": "^5.3.3", - "css-loader": "^6.6.0", - "cypress": "^12.17.2", - "datatables.net-buttons": "^2.3.4", - "datatables.net-vue3": "^2.0.0", - "gulp": "^4.0.2", - "gulp-autoprefixer": "^4.0.0", - "gulp-concat-po": "^1.0.0", - "gulp-exec": "^4.0.0", - "gulp-rename": "^2.0.0", - "gulp-rtlcss": "^1.4.1", - "gulp-sass": "^5.1.0", - "gulp-sourcemaps": "^2.6.1", - "js-yaml": "^3.13.1", - "lodash": "^4.17.12", - "merge-stream": "^2.0.0", - "minimatch": "^3.0.2", - "minimist": "^1.2.5", - "mysql": "^2.18.1", - "pinia": "^3.0.3", - "sass": "^1.58.1", - "style-loader": "^3.3.1", - "vue": "^3.5.4", - "vue-flatpickr-component": "^9", - "vue-router": "^4.0.14", + "@cypress/vue": "3.1.2", + "@cypress/webpack-dev-server": "1.8.4", + "@cypress/webpack-preprocessor": "6.0.4", + "@faker-js/faker": "9.4.0", + "@fortawesome/fontawesome-svg-core": "6.2.0", + "@fortawesome/free-solid-svg-icons": "6.2.0", + "@fortawesome/vue-fontawesome": "3.0.1", + "@koha-community/prettier-plugin-template-toolkit": "2.0.2", + "@popperjs/core": "2.11.8", + "@redocly/cli": "1.25.11", + "bootstrap": "5.3.3", + "css-loader": "6.7.1", + "cypress": "12.17.4", + "datatables.net-buttons": "2.3.4", + "datatables.net-vue3": "2.0.0", + "gulp": "4.0.2", + "gulp-autoprefixer": "4.1.0", + "gulp-concat-po": "1.0.0", + "gulp-exec": "4.0.0", + "gulp-rename": "2.0.0", + "gulp-rtlcss": "1.4.1", + "gulp-sass": "5.1.0", + "gulp-sourcemaps": "2.6.5", + "js-yaml": "3.14.1", + "lodash": "4.17.21", + "merge-stream": "2.0.0", + "minimatch": "3.0.4", + "minimist": "1.2.8", + "mysql": "2.18.1", + "pinia": "3.0.3", + "sass": "1.58.3", + "style-loader": "3.3.1", + "vue": "3.5.13", + "vue-flatpickr-component": "9.0.8", + "vue-router": "4.1.5", "vue-select": "4.0.0-beta.3", - "yaml": "^2.6.1" + "yaml": "2.7.0" }, "scripts": { "css:build": "gulp css && gulp css --view opac", @@ -64,43 +64,43 @@ "url": "git://git.koha-community.org/koha.git" }, "resolutions": { - "minimatch": "^3.0.2", - "lodash": "^4.17.12" + "minimatch": "3.0.4", + "lodash": "4.17.21" }, "author": "", "license": "GPL-3.0", "devDependencies": { - "@pinia/testing": "^1.0.2", - "@rspack/cli": "^1.0.1", - "@rspack/core": "^1.0.1", - "@vue/compiler-sfc": "^3.2.31", - "browserify": "^17.0.0", - "clean-webpack-plugin": "^4.0.0", - "cypress-rspack-dev-server": "^1.1.0", - "eslint": "^9.12.0", - "eslint-config-prettier": "^9.1.0", - "eslint-plugin-prettier": "^5.1.3", - "eslint-plugin-vue": "^9.29.0", - "globals": "^16.0.0", - "gulp-tap": "^1.0.1", - "html-webpack-plugin": "^5.5.0", - "mysql2": "^3.14.1", - "node-sass-tilde-importer": "^1.0.2", - "postcss": "^8.4.14", - "postcss-selector-parser": "^6.0.10", - "prettier": "^3.4.2", - "stylelint": "^14.9.1", - "stylelint-config-standard-scss": "^5.0.0", - "stylelint-order": "^5.0.0", - "swagger-cli": "^4.0.4", - "ts-loader": "^9.2.7", - "typescript": "^4.6.2", - "typescript-eslint": "^8.9.0", - "vinyl-source-stream": "^2.0.0", - "vue-loader": "^17.0.0", - "watchify": "^4.0.0", - "webpack": "^5.69.1", - "webpack-cli": "^4.9.2", - "webpack-dev-server": "^4.7.4" + "@pinia/testing": "1.0.2", + "@rspack/cli": "1.0.1", + "@rspack/core": "1.0.1", + "@vue/compiler-sfc": "3.5.13", + "browserify": "17.0.0", + "clean-webpack-plugin": "4.0.0", + "cypress-rspack-dev-server": "1.1.1", + "eslint": "9.18.0", + "eslint-config-prettier": "9.1.0", + "eslint-plugin-prettier": "5.1.3", + "eslint-plugin-vue": "9.32.0", + "globals": "11.12.0", + "gulp-tap": "1.0.1", + "html-webpack-plugin": "5.5.0", + "mysql2": "3.14.1", + "node-sass-tilde-importer": "1.0.2", + "postcss": "8.4.18", + "postcss-selector-parser": "6.1.2", + "prettier": "3.4.2", + "stylelint": "14.11.0", + "stylelint-config-standard-scss": "5.0.0", + "stylelint-order": "5.0.0", + "swagger-cli": "4.0.4", + "ts-loader": "9.4.1", + "typescript": "4.8.4", + "typescript-eslint": "8.20.0", + "vinyl-source-stream": "2.0.0", + "vue-loader": "17.0.0", + "watchify": "4.0.0", + "webpack": "5.74.0", + "webpack-cli": "4.10.0", + "webpack-dev-server": "5.2.2" } } -- 2.51.2