* build(deps): remove unused frameworks and clear all advisories
The v0 scaffold declared @remix-run/react, @sveltejs/kit, svelte, vue and
vue-router, none of which are imported anywhere in the app. Removing them
drops react-router, react-router-dom, turbo-stream, cookie, vite and their
trees, clearing 13 advisories outright.
Replace xlsx with write-excel-file. The npm release of xlsx is abandoned at
0.18.5, so its prototype pollution and ReDoS advisories have no registry fix,
and SheetJS only ships newer builds from its own CDN as a tarball with no
integrity hash, which pnpm rejects. write-excel-file is maintained, carries no
advisories, and pulls in only fflate. The export writes the same eight columns
in the same order to a sheet named "Exchange Rates", with every value still
written as a string. It also cuts the route's first-load JS from 264 kB to
163 kB.
Add pnpm overrides forcing the lowest release that closes every advisory
affecting the previously resolved version of each remaining transitive dep.
postcss is pinned exactly because pnpm's minimumReleaseAge policy rejects
releases younger than 24h during CI installs.
* ci: add typecheck and build workflow
The repository had no workflows. Type errors are skipped during builds via
next.config.mjs, so check them here where a regression fails the run.
Installs use --frozen-lockfile so dependency overrides cannot silently stop
applying.
Updated dependencies to fix Next.js and React CVE vulnerabilities.
The fix-react2shell-next tool automatically updated the following packages to their secure versions:
- next
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory.
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
tiennm99
dependabot[bot]