-
+ {/*
+ [KRAV K6] Delete-knappen villkorad med isOwner
+ FĂRE:
+ - Synlig för ALLA anvÀndare, oavsett om de Àgde meddelandet
+ EFTER: Visas bara om isOwner === true
+ - Samma mönster som edit-knappen redan anvÀnde
+ OBS: Detta Àr bara UI-skydd. Det riktiga skyddet sitter i backend
+ (authenticateUser + Àgarkontroll). En angripare kan fortfarande
+ skicka ett DELETE-anrop via curl, men backend stoppar det.
+ */}
+ {isOwner && (
+
+ )}
{isOwner && !isEditing && (
From 389583376005cdbc532d73d4c552313df2fc264a Mon Sep 17 00:00:00 2001
From: Malmqvisten
Date: Wed, 3 Jun 2026 11:21:06 +0200
Subject: [PATCH 08/17] Finslip
---
backend/config/db.js | 14 +++----
backend/middleware/auth.js | 4 +-
backend/models/Message.js | 16 ++++----
backend/models/User.js | 13 +++----
backend/package-lock.json | 28 ++++++++++++++
backend/package.json | 1 +
backend/server.js | 45 ++++++++++-------------
frontend/src/components/PostMessage.jsx | 7 ++--
frontend/src/components/SingleMessage.jsx | 10 ++---
9 files changed, 79 insertions(+), 59 deletions(-)
diff --git a/backend/config/db.js b/backend/config/db.js
index 356d94ef7..6f2720acb 100644
--- a/backend/config/db.js
+++ b/backend/config/db.js
@@ -2,15 +2,15 @@ import mongoose from "mongoose"
// [KRAV K4] Skyddade hemligheter (STRIDE: Information Disclosure)
// OWASP A02: Security Misconfiguration
-//
+
// FĂRE: const mongoUrl = process.env.MONGO_URL || "mongodb://localhost/messages"
-// - Om MONGO_URL saknades i .env anslöt servern tyst till en lokal databas
-// utan autentisering â farligt om det sker i produktion av misstag.
-//
+// - Om MONGO_URL saknades i .env anslöt servern tyst till en lokal databas utan autentisering:
+// farligt om det sker i produktion av misstag.
+
// EFTER: Servern kraschar omedelbart om MONGO_URL saknas.
-// - MONGO_URL innehÄller ofta anvÀndarnamn och lösenord för databasen
-// - Den ska ALDRIG hÄrdkodas i koden utan hanteras via .env
-// - .env ligger i .gitignore och checkas aldrig in i Git
+// - MONGO_URL innehÄller ofta anvÀndarnamn och lösenord för databasen
+// - Den ska ALDRIG hÄrdkodas i koden utan hanteras via .env
+// - .env ligger i .gitignore och checkas aldrig in i Git
if (!process.env.MONGO_URL) throw new Error("MONGO_URL is not set in .env")
const mongoUrl = process.env.MONGO_URL
diff --git a/backend/middleware/auth.js b/backend/middleware/auth.js
index c1fe07969..11ac60b60 100644
--- a/backend/middleware/auth.js
+++ b/backend/middleware/auth.js
@@ -3,7 +3,7 @@ import { User } from "../models/User.js"
// [KRAV K6] Autentiseringsmiddleware (STRIDE: Elevation of Privilege)
// OWASP A01: Broken Access Control
-//
+
// Denna middleware verifierar JWT-token och sÀtter req.user.
// KRITISKT: Den MĂ
STE anvÀndas pÄ alla endpoints som Àndrar data (POST, PATCH, DELETE).
// BUGGEN som hittades i Fas 1: DELETE /messages/:id saknade denna middleware helt,
@@ -15,7 +15,7 @@ export const authenticateUser = async (req, res, next) => {
return res.status(401).json({ success: false, message: "No token provided" })
}
try {
- // [KRAV K4] JWT_SECRET hĂ€mtas frĂ„n .env â aldrig hĂ„rdkodat
+ // [KRAV K4] JWT_SECRET hÀmtas frÄn .env aldrig hÄrdkodat
const decoded = jwt.verify(token, process.env.JWT_SECRET)
const user = await User.findById(decoded.userId)
if (!user) {
diff --git a/backend/models/Message.js b/backend/models/Message.js
index dfc409288..ee88c9009 100644
--- a/backend/models/Message.js
+++ b/backend/models/Message.js
@@ -3,16 +3,16 @@ import mongoose from "mongoose"
const messageSchema = new mongoose.Schema({
// [KRAV K2] Strikt indatavalidering (STRIDE: Tampering / OWASP A05: Injection)
- //
+
// FĂRE: { type: String, required: true }
- // - Ingen min- eller maxlĂ€ngd â tomma strĂ€ngar och enorma meddelanden godkĂ€ndes
- // - Ingen trim â whitespace-meddelanden (" ") passerade required-kontrollen
- //
+ // - Ingen min- eller maxlÀngd: tomma strÀngar och enorma meddelanden godkÀndes
+ // - Ingen trim: whitespace-meddelanden (" ") passerade required-kontrollen
+
// EFTER: minlength: 3, maxlength: 140, trim: true
- // - trim tar bort whitespace före/efter â " " blir "" â failar required
- // - minlength 3 förhindrar meningslösa meddelanden
- // - maxlength 140 skyddar mot databasöverbelastning
- // - Valideringen sker i Mongoose (backend) â vi litar ALDRIG pĂ„ frontend
+ // - trim tar bort mellanslag i början och slutet
+ // - minlength 3 förhindrar meningslösa meddelanden
+ // - maxlength 140 skyddar mot databasöverbelastning
+ // - Valideringen sker i Mongoose (backend), vi litar ALDRIG pÄ frontend
message: {
type: String,
diff --git a/backend/models/User.js b/backend/models/User.js
index 90566e884..18e800e80 100644
--- a/backend/models/User.js
+++ b/backend/models/User.js
@@ -14,18 +14,17 @@ const userSchema = new mongoose.Schema({
unique: true,
lowercase: true,
},
- // ============================================================================
+
// [KRAV K1] Lösenordslös inloggning â framtida Ă€ndring
- //
+
// NULĂGE: password-fĂ€ltet lagrar en bcrypt-hash av anvĂ€ndarens lösenord.
- // bcrypt med salt rounds 10 Àr en bra implementation, men lösenord
- // i sig Àr sÄrbara för phishing och brute force.
- //
+ // bcrypt med salt rounds 10 Àr en bra implementation, men lösenord i sig Àr sÄrbara för phishing och brute force.
+
// FRAMTIDA IMPLEMENTATION (Passkeys/WebAuthn):
// - LÀgg till fÀlt: passkeyCredentialId (String) och passkeyPublicKey (Buffer)
// - Gör password-fÀltet valfritt (required: false) för Passkey-anvÀndare
- // - Passkeys binder autentisering kryptografiskt till domĂ€nen â ingen phishing
- // ============================================================================
+ // - Passkeys binder autentisering kryptografiskt till domÀnen
+
password: {
type: String,
required: true,
diff --git a/backend/package-lock.json b/backend/package-lock.json
index d8c4b3cd0..be5649e91 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -13,6 +13,7 @@
"dotenv": "^16.4.5",
"express": "^4.19.2",
"express-list-endpoints": "^6.0.0",
+ "express-rate-limit": "^8.5.2",
"helmet": "^7.1.0",
"jsonwebtoken": "8.5.1",
"mongoose": "^8.4.0",
@@ -619,6 +620,24 @@
"node": ">=10"
}
},
+ "node_modules/express-rate-limit": {
+ "version": "8.5.2",
+ "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.5.2.tgz",
+ "integrity": "sha512-5Kb34ipNX694DH48vN9irak1Qx30nb0PLYHXfJgw4YEjiC3ZEmZJhwOp+VfiCYwFzvFTdB9QkArYS5kXa2cx2A==",
+ "license": "MIT",
+ "dependencies": {
+ "ip-address": "^10.2.0"
+ },
+ "engines": {
+ "node": ">= 16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/express-rate-limit"
+ },
+ "peerDependencies": {
+ "express": ">= 4.11"
+ }
+ },
"node_modules/fill-range": {
"version": "7.1.1",
"resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
@@ -990,6 +1009,15 @@
"integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
"license": "ISC"
},
+ "node_modules/ip-address": {
+ "version": "10.2.0",
+ "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
+ "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 12"
+ }
+ },
"node_modules/ipaddr.js": {
"version": "1.9.1",
"resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
diff --git a/backend/package.json b/backend/package.json
index 1f47ffb62..a3a47f41a 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -14,6 +14,7 @@
"dotenv": "^16.4.5",
"express": "^4.19.2",
"express-list-endpoints": "^6.0.0",
+ "express-rate-limit": "^8.5.2",
"helmet": "^7.1.0",
"jsonwebtoken": "8.5.1",
"mongoose": "^8.4.0",
diff --git a/backend/server.js b/backend/server.js
index 5bd43087b..adda1d703 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -14,7 +14,7 @@ import "./config/db.js"
// [KRAV K4] Borttagen: import listEndpoints from "express-list-endpoints"
// Motivering: Exponerade alla API-endpoints för angripare. Borttagen för att minska attackytan.
-// [KRAV K4] JWT_SECRET hĂ€mtas frĂ„n .env â aldrig hĂ„rdkodat i koden.
+// [KRAV K4] JWT_SECRET hÀmtas frÄn .env, aldrig hÄrdkodat i koden.
// Om .env saknas kraschar servern direkt istÀllet för att köra med en osÀker konfiguration.
if (!process.env.JWT_SECRET) throw new Error("JWT_SECRET is not set in .env")
@@ -23,10 +23,9 @@ const app = express()
app.use(helmet())
// [KRAV K4] CORS â Skyddade hemligheter & sĂ€ker konfiguration
-// FĂRE: cors({ origin: "*" }) â tillĂ€t alla domĂ€ner att anropa vĂ„rt API.
+// FĂRE: cors({ origin: "*" }) tillĂ€t alla domĂ€ner att anropa vĂ„rt API.
// EFTER: BegrÀnsat till specifika origins via miljövariabel CORS_ORIGIN.
-// Motivering (OWASP A02 Security Misconfiguration): Wildcard-CORS lÄter
-// skadliga webbsidor göra API-anrop i inloggade anvÀndares namn.
+// Motivering (OWASP A02 Security Misconfiguration): Wildcard-CORS lÄter skadliga webbsidor göra API-anrop i inloggade anvÀndares namn.
const allowedOrigins = process.env.CORS_ORIGIN
? process.env.CORS_ORIGIN.split(",")
@@ -42,12 +41,10 @@ app.use(express.json())
// [KRAV K5] Rate Limiting â HastighetsbegrĂ€nsning (STRIDE: Denial of Service)
// OWASP A07: Authentication Failures
//
-// FĂRE: Ingen begrĂ€nsning alls â en angripare kunde skicka obegrĂ€nsat antal
-// anrop och antingen brute force:a lösenord eller överbelasta servern.
+// FĂRE: Ingen begrĂ€nsning alls â en angripare kunde skicka obegrĂ€nsat antal anrop och antingen brute force:a lösenord eller överbelasta servern.
// EFTER: TvÄ nivÄer:
-// - Generell: max 100 anrop per 15 min (skyddar hela API:et)
-// - Auth-specifik: max 10 anrop per 15 min pÄ /login och /register
-// (stoppar brute force-attacker mot inloggningen)
+// - Generell: max 100 anrop per 15 min (skyddar hela API:et)
+// - Auth-specifik: max 10 anrop per 15 min pÄ /login och /register (stoppar brute force-attacker mot inloggningen)
const generalLimiter = rateLimit({
windowMs: 15 * 60 * 1000,
@@ -64,26 +61,25 @@ const authLimiter = rateLimit({
app.use(generalLimiter)
// [KRAV K4] Borttagen: app.get("/", (req, res) => res.send(listEndpoints(app)))
-// Motivering: Rot-endpointen listade alla API-endpoints â en komplett attackkarta.
+// Motivering: Rot-endpointen listade alla API-endpoints, en komplett attackkarta.
app.get("/", (req, res) => {
res.json({ message: "YH Message App API" })
})
-// [KRAV K1] Spoofing â Lösenordslös inloggning (Passkeys / WebAuthn)
+// [KRAV K1] Spoofing: Lösenordslös inloggning (Passkeys / WebAuthn)
// OWASP A07: Authentication Failures
-//
+
// NULĂGE: Appen anvĂ€nder lösenordsbaserad autentisering med bcrypt + JWT.
-// Lösenord kan phishas, brute force:as eller lÀcka via dataintrÄng.
-//
+// Lösenord kan phishas, brute force:as eller lÀcka via dataintrÄng.
+
// FRAMTIDA IMPLEMENTATION:
// - Installera paketet @simplewebauthn/server
// - Skapa nya endpoints: POST /auth/passkey/register och POST /auth/passkey/login
// - Spara den publika nyckeln (credentialPublicKey) i User-modellen
-// - Passkeys Ă€r kryptografiskt bundna till domĂ€nen â immuna mot phishing
+// - Passkeys Àr kryptografiskt bundna till domÀnen
// - Befintlig /register och /login behÄlls som fallback under övergÄngsperioden
-//
-// Varför vi inte implementerar det nu: WebAuthn krÀver HTTPS i produktion
-// och en omstrukturering av hela auth-flödet (frontend + backend).
+
+// Varför vi inte implementerar det nu: WebAuthn krÀver HTTPS i produktion och en omstrukturering av hela auth-flödet (frontend + backend).
// Kravet Àr formulerat och redo att implementeras i en framtida sprint.
@@ -264,16 +260,15 @@ app.patch("/messages/:id", authenticateUser, async (req, res) => {
}
})
-// [KRAV K6] DELETE â Kritisk sĂ€kerhetsfix (STRIDE: Elevation of Privilege)
+// [KRAV K6] DELETE - Kritisk sÀkerhetsfix (STRIDE: Elevation of Privilege)
// OWASP A01: Broken Access Control
-//
+
// FĂRE: app.delete("/messages/:id", async (req, res) => { ... })
-// - Ingen authenticateUser-middleware â vem som helst kunde anropa endpointen
-// - Ingen Ă€garkontroll â vilkens meddelande som helst kunde raderas
-// - En angripare behövde bara ett meddelande-ID och ett curl-kommando
+// - Ingen authenticateUser-middleware â vem som helst kunde anropa endpointen
+// - Ingen Ă€garkontroll â vilkens meddelande som helst kunde raderas
+// - En angripare behövde bara ett meddelande-ID och ett curl-kommando
//
-// EFTER: authenticateUser tillagd + Àgarkontroll som jÀmför message.user
-// mot req.user._id (samma mönster som PATCH redan anvÀnde)
+// EFTER: authenticateUser tillagd + Àgarkontroll som jÀmför message.user mot req.user._id (samma mönster som PATCH redan anvÀnde)
app.delete("/messages/:id", authenticateUser, async (req, res) => {
if (!isValidId(req.params.id)) return res.status(400).json({ error: "Invalid message ID" })
diff --git a/frontend/src/components/PostMessage.jsx b/frontend/src/components/PostMessage.jsx
index 4e79a4f66..3102d5b6c 100644
--- a/frontend/src/components/PostMessage.jsx
+++ b/frontend/src/components/PostMessage.jsx
@@ -22,8 +22,7 @@ export const PostMessage = ({ newMessage, fetchPosts, user, onUnauthorized }) =>
// [KRAV K4] Borttagen: console.log("Token being sent:", user?.response?.accessToken)
// Motivering: JWT-token skrevs ut i klartext i webblÀsarens konsol.
- // Vem som helst med DevTools öppna kunde kopiera token och agera som
- // den inloggade anvÀndaren. KÀnslig data ska ALDRIG loggas i frontend.
+ // Vem som helst med DevTools öppna kunde kopiera token och agera som den inloggade anvÀndaren. KÀnslig data ska ALDRIG loggas i frontend.
if (res.status === 401) {
onUnauthorized()
@@ -34,7 +33,7 @@ export const PostMessage = ({ newMessage, fetchPosts, user, onUnauthorized }) =>
const data = await res.json()
if (data.message && !data._id) {
- // [KRAV K4] Borttagen: console.log(data) â lĂ€ckte serverdata
+ // [KRAV K4] Borttagen: console.log(data): lÀckte serverdata
setErrorMessage(data.message)
setSubmitting(false)
return
@@ -70,7 +69,7 @@ export const PostMessage = ({ newMessage, fetchPosts, user, onUnauthorized }) =>
}}
// [KRAV K2] Frontend-validering som komplement till backend.
// maxLength hindrar anvÀndaren frÄn att skriva mer Àn 140 tecken.
- // OBS: Detta Ă€r INTE sĂ€kerhetsskyddet â det sitter i Mongoose-schemat.
+ // OBS: Detta Àr INTE sÀkerhetsskyddet, det sitter i Mongoose-schemat.
maxLength={140}
/>
{errorMessage}
diff --git a/frontend/src/components/SingleMessage.jsx b/frontend/src/components/SingleMessage.jsx
index f6b9d6fe0..7cb75eb99 100644
--- a/frontend/src/components/SingleMessage.jsx
+++ b/frontend/src/components/SingleMessage.jsx
@@ -43,8 +43,7 @@ export const SingleMessage = ({ message, user, onUnauthorized, fetchPosts }) =>
"Content-Type": "application/json",
Authorization: `Bearer ${user?.response?.accessToken}`,
},
- // [KRAV K2] Ăndrat fĂ€ltnamn frĂ„n "editedMessage" till "message"
- // för att matcha backend-endpointen konsekvent.
+ // [KRAV K2] Ăndrat fĂ€ltnamn frĂ„n "editedMessage" till "message" för att matcha backend-endpointen konsekvent.
body: JSON.stringify({ message: editedText }),
})
@@ -56,7 +55,7 @@ export const SingleMessage = ({ message, user, onUnauthorized, fetchPosts }) =>
const data = await res.json()
if (data.error) {
- // [KRAV K4] Borttagen: console.log(data) â lĂ€ckte serverdata till konsolen
+ // [KRAV K4] Borttagen: console.log(data): lÀckte serverdata till konsolen
setEditError(data.error)
return
}
@@ -98,9 +97,8 @@ export const SingleMessage = ({ message, user, onUnauthorized, fetchPosts }) =>
- Synlig för ALLA anvÀndare, oavsett om de Àgde meddelandet
EFTER: Visas bara om isOwner === true
- Samma mönster som edit-knappen redan anvÀnde
- OBS: Detta Àr bara UI-skydd. Det riktiga skyddet sitter i backend
- (authenticateUser + Àgarkontroll). En angripare kan fortfarande
- skicka ett DELETE-anrop via curl, men backend stoppar det.
+ OBS: Detta Àr bara UI-skydd. Det riktiga skyddet sitter i backend (authenticateUser + Àgarkontroll).
+ En angripare kan fortfarande skicka ett DELETE-anrop via curl, men backend stoppar det.
*/}
{isOwner && (
From ecbf73934bdc02f9c047825ef9da0944e72fe95f Mon Sep 17 00:00:00 2001
From: Tripl321 <116004625+Tripl321@users.noreply.github.com>
Date: Wed, 10 Jun 2026 10:12:37 +0200
Subject: [PATCH 09/17] Create SECURITY.md for security policy
Added a security policy document outlining supported versions and vulnerability reporting.
---
SECURITY.md | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
create mode 100644 SECURITY.md
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..034e84803
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+Use this section to tell people about which versions of your project are
+currently being supported with security updates.
+
+| Version | Supported |
+| ------- | ------------------ |
+| 5.1.x | :white_check_mark: |
+| 5.0.x | :x: |
+| 4.0.x | :white_check_mark: |
+| < 4.0 | :x: |
+
+## Reporting a Vulnerability
+
+Use this section to tell people how to report a vulnerability.
+
+Tell them where to go, how often they can expect to get an update on a
+reported vulnerability, what to expect if the vulnerability is accepted or
+declined, etc.
From 49fa828084e455c6e2165ee31326bbeb073bb170 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Jun 2026 08:16:30 +0000
Subject: [PATCH 10/17] Bump jsonwebtoken from 8.5.1 to 9.0.0 in /backend
Bumps [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken) from 8.5.1 to 9.0.0.
- [Changelog](https://github.com/auth0/node-jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](https://github.com/auth0/node-jsonwebtoken/compare/v8.5.1...v9.0.0)
---
updated-dependencies:
- dependency-name: jsonwebtoken
dependency-version: 9.0.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot]
---
backend/package-lock.json | 113 +++++++-------------------------------
backend/package.json | 2 +-
2 files changed, 20 insertions(+), 95 deletions(-)
diff --git a/backend/package-lock.json b/backend/package-lock.json
index be5649e91..a0bf6561f 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -15,7 +15,7 @@
"express-list-endpoints": "^6.0.0",
"express-rate-limit": "^8.5.2",
"helmet": "^7.1.0",
- "jsonwebtoken": "8.5.1",
+ "jsonwebtoken": "9.0.0",
"mongoose": "^8.4.0",
"nodemon": "^3.1.3"
}
@@ -40,18 +40,6 @@
"node-pre-gyp": "bin/node-pre-gyp"
}
},
- "node_modules/@mapbox/node-pre-gyp/node_modules/semver": {
- "version": "7.8.0",
- "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
- "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
- "license": "ISC",
- "bin": {
- "semver": "bin/semver.js"
- },
- "engines": {
- "node": ">=10"
- }
- },
"node_modules/@mongodb-js/saslprep": {
"version": "1.4.11",
"resolved": "https://registry.npmjs.org/@mongodb-js/saslprep/-/saslprep-1.4.11.tgz",
@@ -1079,25 +1067,19 @@
}
},
"node_modules/jsonwebtoken": {
- "version": "8.5.1",
- "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz",
- "integrity": "sha512-XjwVfRS6jTMsqYs0EsuJ4LGxXV14zQybNd4L2r0UvbVnSF9Af8x7p5MzbJ90Ioz/9TI41/hTCvznF/loiSzn8w==",
+ "version": "9.0.0",
+ "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.0.tgz",
+ "integrity": "sha512-tuGfYXxkQGDPnLJ7SibiQgVgeDgfbPq2k2ICcbgqW8WxWLBAxKQM/ZCu/IT8SOSwmaYl4dpTFCW5xZv7YbbWUw==",
"license": "MIT",
"dependencies": {
"jws": "^3.2.2",
- "lodash.includes": "^4.3.0",
- "lodash.isboolean": "^3.0.3",
- "lodash.isinteger": "^4.0.4",
- "lodash.isnumber": "^3.0.3",
- "lodash.isplainobject": "^4.0.6",
- "lodash.isstring": "^4.0.1",
- "lodash.once": "^4.0.0",
+ "lodash": "^4.17.21",
"ms": "^2.1.1",
- "semver": "^5.6.0"
+ "semver": "^7.3.8"
},
"engines": {
- "node": ">=4",
- "npm": ">=1.4.28"
+ "node": ">=12",
+ "npm": ">=6"
}
},
"node_modules/jsonwebtoken/node_modules/ms": {
@@ -1136,46 +1118,10 @@
"node": ">=12.0.0"
}
},
- "node_modules/lodash.includes": {
- "version": "4.3.0",
- "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz",
- "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==",
- "license": "MIT"
- },
- "node_modules/lodash.isboolean": {
- "version": "3.0.3",
- "resolved": "https://registry.npmjs.org/lodash.isboolean/-/lodash.isboolean-3.0.3.tgz",
- "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==",
- "license": "MIT"
- },
- "node_modules/lodash.isinteger": {
- "version": "4.0.4",
- "resolved": "https://registry.npmjs.org/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz",
- "integrity": "sha512-DBwtEWN2caHQ9/imiNeEA5ys1JoRtRfY3d7V9wkqtbycnAmTvRRmbHKDV4a0EYc678/dia0jrte4tjYwVBaZUA==",
- "license": "MIT"
- },
- "node_modules/lodash.isnumber": {
- "version": "3.0.3",
- "resolved": "https://registry.npmjs.org/lodash.isnumber/-/lodash.isnumber-3.0.3.tgz",
- "integrity": "sha512-QYqzpfwO3/CWf3XP+Z+tkQsfaLL/EnUlXWVkIk5FUPc4sBdTehEqZONuyRt2P67PXAk+NXmTBcc97zw9t1FQrw==",
- "license": "MIT"
- },
- "node_modules/lodash.isplainobject": {
- "version": "4.0.6",
- "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz",
- "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==",
- "license": "MIT"
- },
- "node_modules/lodash.isstring": {
- "version": "4.0.1",
- "resolved": "https://registry.npmjs.org/lodash.isstring/-/lodash.isstring-4.0.1.tgz",
- "integrity": "sha512-0wJxfxH1wgO3GrbuP+dTTk7op+6L41QCXbGINEmD+ny/G/eCqGzxyCsh7159S+mgDDcoarnBw6PC1PS5+wUGgw==",
- "license": "MIT"
- },
- "node_modules/lodash.once": {
- "version": "4.1.1",
- "resolved": "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz",
- "integrity": "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==",
+ "node_modules/lodash": {
+ "version": "4.18.1",
+ "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+ "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
"license": "MIT"
},
"node_modules/make-dir": {
@@ -1580,18 +1526,6 @@
"integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
"license": "MIT"
},
- "node_modules/nodemon/node_modules/semver": {
- "version": "7.8.0",
- "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
- "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
- "license": "ISC",
- "bin": {
- "semver": "bin/semver.js"
- },
- "engines": {
- "node": ">=10"
- }
- },
"node_modules/nopt": {
"version": "5.0.0",
"resolved": "https://registry.npmjs.org/nopt/-/nopt-5.0.0.tgz",
@@ -1843,12 +1777,15 @@
"license": "MIT"
},
"node_modules/semver": {
- "version": "5.7.2",
- "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
- "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
+ "version": "7.8.4",
+ "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.4.tgz",
+ "integrity": "sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA==",
"license": "ISC",
"bin": {
- "semver": "bin/semver"
+ "semver": "bin/semver.js"
+ },
+ "engines": {
+ "node": ">=10"
}
},
"node_modules/send": {
@@ -2004,18 +1941,6 @@
"node": ">=10"
}
},
- "node_modules/simple-update-notifier/node_modules/semver": {
- "version": "7.8.0",
- "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
- "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
- "license": "ISC",
- "bin": {
- "semver": "bin/semver.js"
- },
- "engines": {
- "node": ">=10"
- }
- },
"node_modules/sparse-bitfield": {
"version": "3.0.3",
"resolved": "https://registry.npmjs.org/sparse-bitfield/-/sparse-bitfield-3.0.3.tgz",
diff --git a/backend/package.json b/backend/package.json
index a3a47f41a..ca3bbfb36 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -16,7 +16,7 @@
"express-list-endpoints": "^6.0.0",
"express-rate-limit": "^8.5.2",
"helmet": "^7.1.0",
- "jsonwebtoken": "8.5.1",
+ "jsonwebtoken": "9.0.0",
"mongoose": "^8.4.0",
"nodemon": "^3.1.3"
}
From 52681164176a02b7e6b3d80efeda1c0afe2c8820 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Jun 2026 08:16:49 +0000
Subject: [PATCH 11/17] Bump esbuild and vite in /frontend
Removes [esbuild](https://github.com/evanw/esbuild). It's no longer used after updating ancestor dependency [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). These dependencies need to be updated together.
Removes `esbuild`
Updates `vite` from 4.5.14 to 8.0.16
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite)
---
updated-dependencies:
- dependency-name: esbuild
dependency-version:
dependency-type: indirect
- dependency-name: vite
dependency-version: 8.0.16
dependency-type: direct:development
...
Signed-off-by: dependabot[bot]
---
frontend/package-lock.json | 1160 ++++++++++++++++++++++--------------
frontend/package.json | 2 +-
2 files changed, 727 insertions(+), 435 deletions(-)
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index e43d824e8..2210c7f23 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -20,7 +20,7 @@
"eslint-plugin-react": "^7.32.2",
"eslint-plugin-react-hooks": "^4.6.0",
"eslint-plugin-react-refresh": "^0.4.3",
- "vite": "^4.4.5"
+ "vite": "^8.0.16"
}
},
"node_modules/@babel/code-frame": {
@@ -314,378 +314,38 @@
"node": ">=6.9.0"
}
},
- "node_modules/@esbuild/android-arm": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.18.20.tgz",
- "integrity": "sha512-fyi7TDI/ijKKNZTUJAQqiG5T7YjJXgnzkURqmGj13C6dCqckZBLdl4h7bkhHt/t0WP+zO9/zwroDvANaOqO5Sw==",
- "cpu": [
- "arm"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "android"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/android-arm64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.18.20.tgz",
- "integrity": "sha512-Nz4rJcchGDtENV0eMKUNa6L12zz2zBDXuhj/Vjh18zGqB44Bi7MBMSXjgunJgjRhCmKOjnPuZp4Mb6OKqtMHLQ==",
- "cpu": [
- "arm64"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "android"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/android-x64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.18.20.tgz",
- "integrity": "sha512-8GDdlePJA8D6zlZYJV/jnrRAi6rOiNaCC/JclcXpB+KIuvfBN4owLtgzY2bsxnx666XjJx2kDPUmnTtR8qKQUg==",
- "cpu": [
- "x64"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "android"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/darwin-arm64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.18.20.tgz",
- "integrity": "sha512-bxRHW5kHU38zS2lPTPOyuyTm+S+eobPUnTNkdJEfAddYgEcll4xkT8DB9d2008DtTbl7uJag2HuE5NZAZgnNEA==",
- "cpu": [
- "arm64"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "darwin"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/darwin-x64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.18.20.tgz",
- "integrity": "sha512-pc5gxlMDxzm513qPGbCbDukOdsGtKhfxD1zJKXjCCcU7ju50O7MeAZ8c4krSJcOIJGFR+qx21yMMVYwiQvyTyQ==",
- "cpu": [
- "x64"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "darwin"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/freebsd-arm64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.18.20.tgz",
- "integrity": "sha512-yqDQHy4QHevpMAaxhhIwYPMv1NECwOvIpGCZkECn8w2WFHXjEwrBn3CeNIYsibZ/iZEUemj++M26W3cNR5h+Tw==",
- "cpu": [
- "arm64"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "freebsd"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/freebsd-x64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.18.20.tgz",
- "integrity": "sha512-tgWRPPuQsd3RmBZwarGVHZQvtzfEBOreNuxEMKFcd5DaDn2PbBxfwLcj4+aenoh7ctXcbXmOQIn8HI6mCSw5MQ==",
- "cpu": [
- "x64"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "freebsd"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/linux-arm": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.18.20.tgz",
- "integrity": "sha512-/5bHkMWnq1EgKr1V+Ybz3s1hWXok7mDFUMQ4cG10AfW3wL02PSZi5kFpYKrptDsgb2WAJIvRcDm+qIvXf/apvg==",
- "cpu": [
- "arm"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "linux"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/linux-arm64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.18.20.tgz",
- "integrity": "sha512-2YbscF+UL7SQAVIpnWvYwM+3LskyDmPhe31pE7/aoTMFKKzIc9lLbyGUpmmb8a8AixOL61sQ/mFh3jEjHYFvdA==",
- "cpu": [
- "arm64"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "linux"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/linux-ia32": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.18.20.tgz",
- "integrity": "sha512-P4etWwq6IsReT0E1KHU40bOnzMHoH73aXp96Fs8TIT6z9Hu8G6+0SHSw9i2isWrD2nbx2qo5yUqACgdfVGx7TA==",
- "cpu": [
- "ia32"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "linux"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/linux-loong64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.18.20.tgz",
- "integrity": "sha512-nXW8nqBTrOpDLPgPY9uV+/1DjxoQ7DoB2N8eocyq8I9XuqJ7BiAMDMf9n1xZM9TgW0J8zrquIb/A7s3BJv7rjg==",
- "cpu": [
- "loong64"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "linux"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/linux-mips64el": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.18.20.tgz",
- "integrity": "sha512-d5NeaXZcHp8PzYy5VnXV3VSd2D328Zb+9dEq5HE6bw6+N86JVPExrA6O68OPwobntbNJ0pzCpUFZTo3w0GyetQ==",
- "cpu": [
- "mips64el"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "linux"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/linux-ppc64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.18.20.tgz",
- "integrity": "sha512-WHPyeScRNcmANnLQkq6AfyXRFr5D6N2sKgkFo2FqguP44Nw2eyDlbTdZwd9GYk98DZG9QItIiTlFLHJHjxP3FA==",
- "cpu": [
- "ppc64"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "linux"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/linux-riscv64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.18.20.tgz",
- "integrity": "sha512-WSxo6h5ecI5XH34KC7w5veNnKkju3zBRLEQNY7mv5mtBmrP/MjNBCAlsM2u5hDBlS3NGcTQpoBvRzqBcRtpq1A==",
- "cpu": [
- "riscv64"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "linux"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/linux-s390x": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.18.20.tgz",
- "integrity": "sha512-+8231GMs3mAEth6Ja1iK0a1sQ3ohfcpzpRLH8uuc5/KVDFneH6jtAJLFGafpzpMRO6DzJ6AvXKze9LfFMrIHVQ==",
- "cpu": [
- "s390x"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "linux"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/linux-x64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.18.20.tgz",
- "integrity": "sha512-UYqiqemphJcNsFEskc73jQ7B9jgwjWrSayxawS6UVFZGWrAAtkzjxSqnoclCXxWtfwLdzU+vTpcNYhpn43uP1w==",
- "cpu": [
- "x64"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "linux"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/netbsd-x64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.18.20.tgz",
- "integrity": "sha512-iO1c++VP6xUBUmltHZoMtCUdPlnPGdBom6IrO4gyKPFFVBKioIImVooR5I83nTew5UOYrk3gIJhbZh8X44y06A==",
- "cpu": [
- "x64"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "netbsd"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/openbsd-x64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.18.20.tgz",
- "integrity": "sha512-e5e4YSsuQfX4cxcygw/UCPIEP6wbIL+se3sxPdCiMbFLBWu0eiZOJ7WoD+ptCLrmjZBK1Wk7I6D/I3NglUGOxg==",
- "cpu": [
- "x64"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "openbsd"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/sunos-x64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.18.20.tgz",
- "integrity": "sha512-kDbFRFp0YpTQVVrqUd5FTYmWo45zGaXe0X8E1G/LKFC0v8x0vWrhOWSLITcCn63lmZIxfOMXtCfti/RxN/0wnQ==",
- "cpu": [
- "x64"
- ],
- "dev": true,
- "license": "MIT",
- "optional": true,
- "os": [
- "sunos"
- ],
- "engines": {
- "node": ">=12"
- }
- },
- "node_modules/@esbuild/win32-arm64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.18.20.tgz",
- "integrity": "sha512-ddYFR6ItYgoaq4v4JmQQaAI5s7npztfV4Ag6NrhiaW0RrnOXqBkgwZLofVTlq1daVTQNhtI5oieTvkRPfZrePg==",
- "cpu": [
- "arm64"
- ],
+ "node_modules/@emnapi/core": {
+ "version": "1.10.0",
+ "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
+ "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
"dev": true,
"license": "MIT",
"optional": true,
- "os": [
- "win32"
- ],
- "engines": {
- "node": ">=12"
+ "dependencies": {
+ "@emnapi/wasi-threads": "1.2.1",
+ "tslib": "^2.4.0"
}
},
- "node_modules/@esbuild/win32-ia32": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.18.20.tgz",
- "integrity": "sha512-Wv7QBi3ID/rROT08SABTS7eV4hX26sVduqDOTe1MvGMjNd3EjOz4b7zeexIR62GTIEKrfJXKL9LFxTYgkyeu7g==",
- "cpu": [
- "ia32"
- ],
+ "node_modules/@emnapi/runtime": {
+ "version": "1.10.0",
+ "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
+ "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
"dev": true,
"license": "MIT",
"optional": true,
- "os": [
- "win32"
- ],
- "engines": {
- "node": ">=12"
+ "dependencies": {
+ "tslib": "^2.4.0"
}
},
- "node_modules/@esbuild/win32-x64": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.18.20.tgz",
- "integrity": "sha512-kTdfRcSiDfQca/y9QIkng02avJ+NCaQvrMejlsB3RRv5sE9rRoeBPISaZpKxHELzRxZyLvNts1P27W3wV+8geQ==",
- "cpu": [
- "x64"
- ],
+ "node_modules/@emnapi/wasi-threads": {
+ "version": "1.2.1",
+ "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
+ "integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
"dev": true,
"license": "MIT",
"optional": true,
- "os": [
- "win32"
- ],
- "engines": {
- "node": ">=12"
+ "dependencies": {
+ "tslib": "^2.4.0"
}
},
"node_modules/@eslint-community/eslint-utils": {
@@ -839,6 +499,25 @@
"@jridgewell/sourcemap-codec": "^1.4.14"
}
},
+ "node_modules/@napi-rs/wasm-runtime": {
+ "version": "1.1.5",
+ "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.5.tgz",
+ "integrity": "sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q==",
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "dependencies": {
+ "@tybys/wasm-util": "^0.10.2"
+ },
+ "funding": {
+ "type": "github",
+ "url": "https://github.com/sponsors/Brooooooklyn"
+ },
+ "peerDependencies": {
+ "@emnapi/core": "^1.7.1",
+ "@emnapi/runtime": "^1.7.1"
+ }
+ },
"node_modules/@nodelib/fs.scandir": {
"version": "2.1.5",
"resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -860,21 +539,288 @@
"dev": true,
"license": "MIT",
"engines": {
- "node": ">= 8"
+ "node": ">= 8"
+ }
+ },
+ "node_modules/@nodelib/fs.walk": {
+ "version": "1.2.8",
+ "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+ "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+ "dev": true,
+ "license": "MIT",
+ "dependencies": {
+ "@nodelib/fs.scandir": "2.1.5",
+ "fastq": "^1.6.0"
+ },
+ "engines": {
+ "node": ">= 8"
+ }
+ },
+ "node_modules/@oxc-project/types": {
+ "version": "0.133.0",
+ "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.133.0.tgz",
+ "integrity": "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==",
+ "dev": true,
+ "license": "MIT",
+ "funding": {
+ "url": "https://github.com/sponsors/Boshen"
+ }
+ },
+ "node_modules/@rolldown/binding-android-arm64": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
+ "integrity": "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==",
+ "cpu": [
+ "arm64"
+ ],
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "os": [
+ "android"
+ ],
+ "engines": {
+ "node": "^20.19.0 || >=22.12.0"
+ }
+ },
+ "node_modules/@rolldown/binding-darwin-arm64": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.3.tgz",
+ "integrity": "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==",
+ "cpu": [
+ "arm64"
+ ],
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "os": [
+ "darwin"
+ ],
+ "engines": {
+ "node": "^20.19.0 || >=22.12.0"
+ }
+ },
+ "node_modules/@rolldown/binding-darwin-x64": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.3.tgz",
+ "integrity": "sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==",
+ "cpu": [
+ "x64"
+ ],
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "os": [
+ "darwin"
+ ],
+ "engines": {
+ "node": "^20.19.0 || >=22.12.0"
+ }
+ },
+ "node_modules/@rolldown/binding-freebsd-x64": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.3.tgz",
+ "integrity": "sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==",
+ "cpu": [
+ "x64"
+ ],
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "os": [
+ "freebsd"
+ ],
+ "engines": {
+ "node": "^20.19.0 || >=22.12.0"
+ }
+ },
+ "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.3.tgz",
+ "integrity": "sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==",
+ "cpu": [
+ "arm"
+ ],
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "os": [
+ "linux"
+ ],
+ "engines": {
+ "node": "^20.19.0 || >=22.12.0"
+ }
+ },
+ "node_modules/@rolldown/binding-linux-arm64-gnu": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.3.tgz",
+ "integrity": "sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==",
+ "cpu": [
+ "arm64"
+ ],
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "os": [
+ "linux"
+ ],
+ "engines": {
+ "node": "^20.19.0 || >=22.12.0"
+ }
+ },
+ "node_modules/@rolldown/binding-linux-arm64-musl": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.3.tgz",
+ "integrity": "sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==",
+ "cpu": [
+ "arm64"
+ ],
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "os": [
+ "linux"
+ ],
+ "engines": {
+ "node": "^20.19.0 || >=22.12.0"
+ }
+ },
+ "node_modules/@rolldown/binding-linux-ppc64-gnu": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.3.tgz",
+ "integrity": "sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==",
+ "cpu": [
+ "ppc64"
+ ],
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "os": [
+ "linux"
+ ],
+ "engines": {
+ "node": "^20.19.0 || >=22.12.0"
+ }
+ },
+ "node_modules/@rolldown/binding-linux-s390x-gnu": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.3.tgz",
+ "integrity": "sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==",
+ "cpu": [
+ "s390x"
+ ],
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "os": [
+ "linux"
+ ],
+ "engines": {
+ "node": "^20.19.0 || >=22.12.0"
+ }
+ },
+ "node_modules/@rolldown/binding-linux-x64-gnu": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.3.tgz",
+ "integrity": "sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==",
+ "cpu": [
+ "x64"
+ ],
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "os": [
+ "linux"
+ ],
+ "engines": {
+ "node": "^20.19.0 || >=22.12.0"
+ }
+ },
+ "node_modules/@rolldown/binding-linux-x64-musl": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.3.tgz",
+ "integrity": "sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==",
+ "cpu": [
+ "x64"
+ ],
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "os": [
+ "linux"
+ ],
+ "engines": {
+ "node": "^20.19.0 || >=22.12.0"
+ }
+ },
+ "node_modules/@rolldown/binding-openharmony-arm64": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.3.tgz",
+ "integrity": "sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==",
+ "cpu": [
+ "arm64"
+ ],
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "os": [
+ "openharmony"
+ ],
+ "engines": {
+ "node": "^20.19.0 || >=22.12.0"
+ }
+ },
+ "node_modules/@rolldown/binding-wasm32-wasi": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.3.tgz",
+ "integrity": "sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==",
+ "cpu": [
+ "wasm32"
+ ],
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "dependencies": {
+ "@emnapi/core": "1.10.0",
+ "@emnapi/runtime": "1.10.0",
+ "@napi-rs/wasm-runtime": "^1.1.4"
+ },
+ "engines": {
+ "node": "^20.19.0 || >=22.12.0"
+ }
+ },
+ "node_modules/@rolldown/binding-win32-arm64-msvc": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.3.tgz",
+ "integrity": "sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==",
+ "cpu": [
+ "arm64"
+ ],
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "os": [
+ "win32"
+ ],
+ "engines": {
+ "node": "^20.19.0 || >=22.12.0"
}
},
- "node_modules/@nodelib/fs.walk": {
- "version": "1.2.8",
- "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
- "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+ "node_modules/@rolldown/binding-win32-x64-msvc": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.3.tgz",
+ "integrity": "sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==",
+ "cpu": [
+ "x64"
+ ],
"dev": true,
"license": "MIT",
- "dependencies": {
- "@nodelib/fs.scandir": "2.1.5",
- "fastq": "^1.6.0"
- },
+ "optional": true,
+ "os": [
+ "win32"
+ ],
"engines": {
- "node": ">= 8"
+ "node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/pluginutils": {
@@ -884,6 +830,17 @@
"dev": true,
"license": "MIT"
},
+ "node_modules/@tybys/wasm-util": {
+ "version": "0.10.2",
+ "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
+ "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
+ "dev": true,
+ "license": "MIT",
+ "optional": true,
+ "dependencies": {
+ "tslib": "^2.4.0"
+ }
+ },
"node_modules/@types/babel__core": {
"version": "7.20.5",
"resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz",
@@ -1572,6 +1529,16 @@
"url": "https://github.com/sponsors/ljharb"
}
},
+ "node_modules/detect-libc": {
+ "version": "2.1.2",
+ "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+ "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+ "dev": true,
+ "license": "Apache-2.0",
+ "engines": {
+ "node": ">=8"
+ }
+ },
"node_modules/doctrine": {
"version": "3.0.0",
"resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz",
@@ -1784,44 +1751,6 @@
"url": "https://github.com/sponsors/ljharb"
}
},
- "node_modules/esbuild": {
- "version": "0.18.20",
- "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.18.20.tgz",
- "integrity": "sha512-ceqxoedUrcayh7Y7ZX6NdbbDzGROiyVBgC4PriJThBKSVPWnnFHZAkfI1lJT8QFkOwH4qOS2SJkS4wvpGl8BpA==",
- "dev": true,
- "hasInstallScript": true,
- "license": "MIT",
- "bin": {
- "esbuild": "bin/esbuild"
- },
- "engines": {
- "node": ">=12"
- },
- "optionalDependencies": {
- "@esbuild/android-arm": "0.18.20",
- "@esbuild/android-arm64": "0.18.20",
- "@esbuild/android-x64": "0.18.20",
- "@esbuild/darwin-arm64": "0.18.20",
- "@esbuild/darwin-x64": "0.18.20",
- "@esbuild/freebsd-arm64": "0.18.20",
- "@esbuild/freebsd-x64": "0.18.20",
- "@esbuild/linux-arm": "0.18.20",
- "@esbuild/linux-arm64": "0.18.20",
- "@esbuild/linux-ia32": "0.18.20",
- "@esbuild/linux-loong64": "0.18.20",
- "@esbuild/linux-mips64el": "0.18.20",
- "@esbuild/linux-ppc64": "0.18.20",
- "@esbuild/linux-riscv64": "0.18.20",
- "@esbuild/linux-s390x": "0.18.20",
- "@esbuild/linux-x64": "0.18.20",
- "@esbuild/netbsd-x64": "0.18.20",
- "@esbuild/openbsd-x64": "0.18.20",
- "@esbuild/sunos-x64": "0.18.20",
- "@esbuild/win32-arm64": "0.18.20",
- "@esbuild/win32-ia32": "0.18.20",
- "@esbuild/win32-x64": "0.18.20"
- }
- },
"node_modules/escalade": {
"version": "3.2.0",
"resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
@@ -2096,6 +2025,24 @@
"reusify": "^1.0.4"
}
},
+ "node_modules/fdir": {
+ "version": "6.5.0",
+ "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+ "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+ "dev": true,
+ "license": "MIT",
+ "engines": {
+ "node": ">=12.0.0"
+ },
+ "peerDependencies": {
+ "picomatch": "^3 || ^4"
+ },
+ "peerDependenciesMeta": {
+ "picomatch": {
+ "optional": true
+ }
+ }
+ },
"node_modules/file-entry-cache": {
"version": "6.0.1",
"resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
@@ -3087,6 +3034,267 @@
"node": ">= 0.8.0"
}
},
+ "node_modules/lightningcss": {
+ "version": "1.32.0",
+ "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+ "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
+ "dev": true,
+ "license": "MPL-2.0",
+ "dependencies": {
+ "detect-libc": "^2.0.3"
+ },
+ "engines": {
+ "node": ">= 12.0.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/parcel"
+ },
+ "optionalDependencies": {
+ "lightningcss-android-arm64": "1.32.0",
+ "lightningcss-darwin-arm64": "1.32.0",
+ "lightningcss-darwin-x64": "1.32.0",
+ "lightningcss-freebsd-x64": "1.32.0",
+ "lightningcss-linux-arm-gnueabihf": "1.32.0",
+ "lightningcss-linux-arm64-gnu": "1.32.0",
+ "lightningcss-linux-arm64-musl": "1.32.0",
+ "lightningcss-linux-x64-gnu": "1.32.0",
+ "lightningcss-linux-x64-musl": "1.32.0",
+ "lightningcss-win32-arm64-msvc": "1.32.0",
+ "lightningcss-win32-x64-msvc": "1.32.0"
+ }
+ },
+ "node_modules/lightningcss-android-arm64": {
+ "version": "1.32.0",
+ "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+ "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+ "cpu": [
+ "arm64"
+ ],
+ "dev": true,
+ "license": "MPL-2.0",
+ "optional": true,
+ "os": [
+ "android"
+ ],
+ "engines": {
+ "node": ">= 12.0.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/parcel"
+ }
+ },
+ "node_modules/lightningcss-darwin-arm64": {
+ "version": "1.32.0",
+ "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+ "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
+ "cpu": [
+ "arm64"
+ ],
+ "dev": true,
+ "license": "MPL-2.0",
+ "optional": true,
+ "os": [
+ "darwin"
+ ],
+ "engines": {
+ "node": ">= 12.0.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/parcel"
+ }
+ },
+ "node_modules/lightningcss-darwin-x64": {
+ "version": "1.32.0",
+ "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+ "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
+ "cpu": [
+ "x64"
+ ],
+ "dev": true,
+ "license": "MPL-2.0",
+ "optional": true,
+ "os": [
+ "darwin"
+ ],
+ "engines": {
+ "node": ">= 12.0.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/parcel"
+ }
+ },
+ "node_modules/lightningcss-freebsd-x64": {
+ "version": "1.32.0",
+ "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+ "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
+ "cpu": [
+ "x64"
+ ],
+ "dev": true,
+ "license": "MPL-2.0",
+ "optional": true,
+ "os": [
+ "freebsd"
+ ],
+ "engines": {
+ "node": ">= 12.0.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/parcel"
+ }
+ },
+ "node_modules/lightningcss-linux-arm-gnueabihf": {
+ "version": "1.32.0",
+ "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+ "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
+ "cpu": [
+ "arm"
+ ],
+ "dev": true,
+ "license": "MPL-2.0",
+ "optional": true,
+ "os": [
+ "linux"
+ ],
+ "engines": {
+ "node": ">= 12.0.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/parcel"
+ }
+ },
+ "node_modules/lightningcss-linux-arm64-gnu": {
+ "version": "1.32.0",
+ "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+ "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
+ "cpu": [
+ "arm64"
+ ],
+ "dev": true,
+ "license": "MPL-2.0",
+ "optional": true,
+ "os": [
+ "linux"
+ ],
+ "engines": {
+ "node": ">= 12.0.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/parcel"
+ }
+ },
+ "node_modules/lightningcss-linux-arm64-musl": {
+ "version": "1.32.0",
+ "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+ "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
+ "cpu": [
+ "arm64"
+ ],
+ "dev": true,
+ "license": "MPL-2.0",
+ "optional": true,
+ "os": [
+ "linux"
+ ],
+ "engines": {
+ "node": ">= 12.0.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/parcel"
+ }
+ },
+ "node_modules/lightningcss-linux-x64-gnu": {
+ "version": "1.32.0",
+ "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+ "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
+ "cpu": [
+ "x64"
+ ],
+ "dev": true,
+ "license": "MPL-2.0",
+ "optional": true,
+ "os": [
+ "linux"
+ ],
+ "engines": {
+ "node": ">= 12.0.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/parcel"
+ }
+ },
+ "node_modules/lightningcss-linux-x64-musl": {
+ "version": "1.32.0",
+ "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+ "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
+ "cpu": [
+ "x64"
+ ],
+ "dev": true,
+ "license": "MPL-2.0",
+ "optional": true,
+ "os": [
+ "linux"
+ ],
+ "engines": {
+ "node": ">= 12.0.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/parcel"
+ }
+ },
+ "node_modules/lightningcss-win32-arm64-msvc": {
+ "version": "1.32.0",
+ "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+ "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
+ "cpu": [
+ "arm64"
+ ],
+ "dev": true,
+ "license": "MPL-2.0",
+ "optional": true,
+ "os": [
+ "win32"
+ ],
+ "engines": {
+ "node": ">= 12.0.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/parcel"
+ }
+ },
+ "node_modules/lightningcss-win32-x64-msvc": {
+ "version": "1.32.0",
+ "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+ "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
+ "cpu": [
+ "x64"
+ ],
+ "dev": true,
+ "license": "MPL-2.0",
+ "optional": true,
+ "os": [
+ "win32"
+ ],
+ "engines": {
+ "node": ">= 12.0.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/parcel"
+ }
+ },
"node_modules/locate-path": {
"version": "6.0.0",
"resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
@@ -3457,6 +3665,19 @@
"dev": true,
"license": "ISC"
},
+ "node_modules/picomatch": {
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+ "dev": true,
+ "license": "MIT",
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/jonschlinkert"
+ }
+ },
"node_modules/possible-typed-array-names": {
"version": "1.1.0",
"resolved": "https://registry.npmjs.org/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz",
@@ -3697,22 +3918,46 @@
"url": "https://github.com/sponsors/isaacs"
}
},
- "node_modules/rollup": {
- "version": "3.30.0",
- "resolved": "https://registry.npmjs.org/rollup/-/rollup-3.30.0.tgz",
- "integrity": "sha512-kQvGasUgN+AlWGliFn2POSajRQEsULVYFGTvOZmK06d7vCD+YhZztt70kGk3qaeAXeWYL5eO7zx+rAubBc55eA==",
+ "node_modules/rolldown": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.3.tgz",
+ "integrity": "sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==",
"dev": true,
"license": "MIT",
+ "dependencies": {
+ "@oxc-project/types": "=0.133.0",
+ "@rolldown/pluginutils": "^1.0.0"
+ },
"bin": {
- "rollup": "dist/bin/rollup"
+ "rolldown": "bin/cli.mjs"
},
"engines": {
- "node": ">=14.18.0",
- "npm": ">=8.0.0"
+ "node": "^20.19.0 || >=22.12.0"
},
"optionalDependencies": {
- "fsevents": "~2.3.2"
- }
+ "@rolldown/binding-android-arm64": "1.0.3",
+ "@rolldown/binding-darwin-arm64": "1.0.3",
+ "@rolldown/binding-darwin-x64": "1.0.3",
+ "@rolldown/binding-freebsd-x64": "1.0.3",
+ "@rolldown/binding-linux-arm-gnueabihf": "1.0.3",
+ "@rolldown/binding-linux-arm64-gnu": "1.0.3",
+ "@rolldown/binding-linux-arm64-musl": "1.0.3",
+ "@rolldown/binding-linux-ppc64-gnu": "1.0.3",
+ "@rolldown/binding-linux-s390x-gnu": "1.0.3",
+ "@rolldown/binding-linux-x64-gnu": "1.0.3",
+ "@rolldown/binding-linux-x64-musl": "1.0.3",
+ "@rolldown/binding-openharmony-arm64": "1.0.3",
+ "@rolldown/binding-wasm32-wasi": "1.0.3",
+ "@rolldown/binding-win32-arm64-msvc": "1.0.3",
+ "@rolldown/binding-win32-x64-msvc": "1.0.3"
+ }
+ },
+ "node_modules/rolldown/node_modules/@rolldown/pluginutils": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+ "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
+ "dev": true,
+ "license": "MIT"
},
"node_modules/run-parallel": {
"version": "1.2.0",
@@ -4141,6 +4386,31 @@
"dev": true,
"license": "MIT"
},
+ "node_modules/tinyglobby": {
+ "version": "0.2.17",
+ "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+ "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+ "dev": true,
+ "license": "MIT",
+ "dependencies": {
+ "fdir": "^6.5.0",
+ "picomatch": "^4.0.4"
+ },
+ "engines": {
+ "node": ">=12.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/SuperchupuDev"
+ }
+ },
+ "node_modules/tslib": {
+ "version": "2.8.1",
+ "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+ "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+ "dev": true,
+ "license": "0BSD",
+ "optional": true
+ },
"node_modules/type-check": {
"version": "0.4.0",
"resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
@@ -4306,50 +4576,66 @@
}
},
"node_modules/vite": {
- "version": "4.5.14",
- "resolved": "https://registry.npmjs.org/vite/-/vite-4.5.14.tgz",
- "integrity": "sha512-+v57oAaoYNnO3hIu5Z/tJRZjq5aHM2zDve9YZ8HngVHbhk66RStobhb1sqPMIPEleV6cNKYK4eGrAbE9Ulbl2g==",
+ "version": "8.0.16",
+ "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.16.tgz",
+ "integrity": "sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==",
"dev": true,
"license": "MIT",
"dependencies": {
- "esbuild": "^0.18.10",
- "postcss": "^8.4.27",
- "rollup": "^3.27.1"
+ "lightningcss": "^1.32.0",
+ "picomatch": "^4.0.4",
+ "postcss": "^8.5.15",
+ "rolldown": "1.0.3",
+ "tinyglobby": "^0.2.17"
},
"bin": {
"vite": "bin/vite.js"
},
"engines": {
- "node": "^14.18.0 || >=16.0.0"
+ "node": "^20.19.0 || >=22.12.0"
},
"funding": {
"url": "https://github.com/vitejs/vite?sponsor=1"
},
"optionalDependencies": {
- "fsevents": "~2.3.2"
+ "fsevents": "~2.3.3"
},
"peerDependencies": {
- "@types/node": ">= 14",
- "less": "*",
- "lightningcss": "^1.21.0",
- "sass": "*",
- "stylus": "*",
- "sugarss": "*",
- "terser": "^5.4.0"
+ "@types/node": "^20.19.0 || >=22.12.0",
+ "@vitejs/devtools": "^0.1.18",
+ "esbuild": "^0.27.0 || ^0.28.0",
+ "jiti": ">=1.21.0",
+ "less": "^4.0.0",
+ "sass": "^1.70.0",
+ "sass-embedded": "^1.70.0",
+ "stylus": ">=0.54.8",
+ "sugarss": "^5.0.0",
+ "terser": "^5.16.0",
+ "tsx": "^4.8.1",
+ "yaml": "^2.4.2"
},
"peerDependenciesMeta": {
"@types/node": {
"optional": true
},
- "less": {
+ "@vitejs/devtools": {
+ "optional": true
+ },
+ "esbuild": {
+ "optional": true
+ },
+ "jiti": {
"optional": true
},
- "lightningcss": {
+ "less": {
"optional": true
},
"sass": {
"optional": true
},
+ "sass-embedded": {
+ "optional": true
+ },
"stylus": {
"optional": true
},
@@ -4358,6 +4644,12 @@
},
"terser": {
"optional": true
+ },
+ "tsx": {
+ "optional": true
+ },
+ "yaml": {
+ "optional": true
}
}
},
diff --git a/frontend/package.json b/frontend/package.json
index fc417bb3a..c6da3d52d 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -22,6 +22,6 @@
"eslint-plugin-react": "^7.32.2",
"eslint-plugin-react-hooks": "^4.6.0",
"eslint-plugin-react-refresh": "^0.4.3",
- "vite": "^4.4.5"
+ "vite": "^8.0.16"
}
}
\ No newline at end of file
From 2ed5d878e26c10bc31c5901c32364b5ec521c597 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Jun 2026 08:16:52 +0000
Subject: [PATCH 12/17] Bump qs from 6.15.1 to 6.15.2 in /backend
Bumps [qs](https://github.com/ljharb/qs) from 6.15.1 to 6.15.2.
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ljharb/qs/compare/v6.15.1...v6.15.2)
---
updated-dependencies:
- dependency-name: qs
dependency-version: 6.15.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot]
---
backend/package-lock.json | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/backend/package-lock.json b/backend/package-lock.json
index be5649e91..9666f038c 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -1736,9 +1736,9 @@
}
},
"node_modules/qs": {
- "version": "6.15.1",
- "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz",
- "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==",
+ "version": "6.15.2",
+ "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
+ "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
"license": "BSD-3-Clause",
"dependencies": {
"side-channel": "^1.1.0"
From 04b2d8d1f0be2f7298d8dd0dfd2ce1a77016d25d Mon Sep 17 00:00:00 2001
From: Tripl321 <116004625+Tripl321@users.noreply.github.com>
Date: Fri, 12 Jun 2026 09:43:36 +0200
Subject: [PATCH 13/17] Configure Dependabot for npm updates
---
.github/dependabot.yml | 12 ++++++++++++
1 file changed, 12 insertions(+)
create mode 100644 .github/dependabot.yml
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..0348923bb
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+ - package-ecosystem: "npm" # Replace with your ecosystem (e.g., pip, docker, bundler)
+ directory: "/" # Location of package manifests
+ schedule:
+ interval: "weekly"
+ target-branch: "security-fix" # Dependabot will create PRs against this branch
From 702fc6a5e1031827d3eeed8f761f676e2b5f8667 Mon Sep 17 00:00:00 2001
From: Tripl321 <116004625+Tripl321@users.noreply.github.com>
Date: Fri, 12 Jun 2026 09:51:31 +0200
Subject: [PATCH 14/17] Upgrade tar module to version > 7.5.11
Updated tar module version to a more secure version.
---
backend/package-lock.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/backend/package-lock.json b/backend/package-lock.json
index 21bce4d0e..b1e0a0fba 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -2007,7 +2007,7 @@
}
},
"node_modules/tar": {
- "version": "6.2.1",
+ "version": "> 7.5.11",
"resolved": "https://registry.npmjs.org/tar/-/tar-6.2.1.tgz",
"integrity": "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==",
"deprecated": "Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
From 79a528164fc968cb16f20d9450085d05b4e5ffaf Mon Sep 17 00:00:00 2001
From: Malmqvisten
Date: Wed, 17 Jun 2026 11:17:21 +0200
Subject: [PATCH 15/17] Document security review findings and actions
Added detailed analysis of security alerts from Dependabot, focusing on jsonwebtoken vulnerabilities and proposed solutions.
---
granskningsfasen.md | 98 ++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 97 insertions(+), 1 deletion(-)
diff --git a/granskningsfasen.md b/granskningsfasen.md
index 088f97183..520be1286 100644
--- a/granskningsfasen.md
+++ b/granskningsfasen.md
@@ -1 +1,97 @@
-# InlÀmning 3 - Granskningsfasen
\ No newline at end of file
+# InlÀmning 3 - Granskningsfasen[fas 3 - granskning.md](https://github.com/user-attachments/files/29040324/fas.3.-.granskning.md)
+## **Fas 3: Granskning**
+
+---
+
+### 1\. Intro och verktyg
+
+I den hÀr fasen har vi granskat vÄr webbapp med Dependabot. Det gÄr igenom alla beroenden i projektet, alltsÄ de fÀrdiga kodpaket vi hÀmtat in utifrÄn, sÄsom bcrypt och jsonwebtoken och jÀmför dem mot en databas med kÀnda sÄrbarheter. Hittar Dependabot ett paket med en kÀnd brist skapar det en "alert".
+
+Vi fick 16 alerts. Men de fördelar sig pÄ bara fyra paket, flera alerts Àr olika varianter av samma grundproblem i samma paket. SÄ vi har grupperat dem och valt ut det viktigaste att fördjupa oss i.
+
+---
+
+### 2\. Ăverblick: 16 alerts, fyra paket
+
+Kort om vad ett "paket" Àr: nÀr man bygger en webbapp sÄ behöver man inte skriva all kod sjÀlv, utan man kan hÀmta in fÀrdiga moduler via NPM, en pakethanteraren för JavaScript, som en katalog man laddar ner kod ifrÄn. Varje sÄn modul Àr ett paket. VÄr app anvÀnder mÄnga, och det Àr dom Dependabot har granskat och ger oss olika CVE-koder.
+
+De 16 alerts:en fördelar sig sÄ hÀr:
+
+jsonwebtoken: 3st alerts. Paketet som sköter vÄr inloggning.
+Det hÀr Àr det allvarligaste och det vi valt att gÄ djupare in pÄ.
+
+node-tar: 6st alerts, och alla klassade som High. node-tar Àr ett paket som packar ihop och packar upp filarkiv.
+Vi har aldrig installerat det sjÀlva; det Àr ett indirekt beroende, alltsÄ ett paket som nÄgot annat paket drar in i bakgrunden. VÄr egen kod anropar aldrig det. Det betyder att dom
+6 bristerna inte kan utnyttjas mot oss i nulÀget \- vi Äterkommer till varför vi ÀndÄ tar dom pÄ allvar.
+
+Vite, esbuild och launch-editor: har ocksÄ 6st alerts. Det hÀr Àr utvecklingsverktyg \- ett program vi bara anvÀnder lokalt nÀr vi bygger appen. Vite och esbuild bygger ihop koden, launch-editor öppnar filer i editorn. Alerts:en Àr markerade som "Development", vilket betyder att de bara berör utvecklingslÀget. I produktion byggs appen om till vanliga statiska filer och dom hÀr verktygen körs inte, sÄ slutanvÀndaren möts aldrig av dom.
+
+Och qs: har 1 alert. QS Àr paketet som Express anvÀnder för att tolka query-parametrar i en URL, det som stÄr efter frÄgetecknet i en webbadress. SÄrbarheten gör att ett specialformaterat anrop kan överbelasta servern. Men den mildras redan av den rate limit vi byggde i Fas 2, som stoppar en angripare frÄn att skicka tillrÀckligt mÄnga anrop.
+
+Det Àr 16st sÄrbarheter\! Men bara ett paket \- jsonwebtoken \- det pÄverkar vÄra anvÀndare direkt. Och dit gÄr vi nu.
+
+---
+
+### 3\. Fördjupning: jsonwebtoken
+
+NÀr du loggar in skapar vÄr backend en jsonwebtoken Ät dig. Det Àr en liten datastrÀng som fungerar som ett inloggningsbevis: din webblÀsare skickar med den i varje anrop till API:et, sÄ servern vet vem du Àr utan att du mÄste logga in pÄ nytt varje gÄng.
+
+För att denna token inte ska gÄ att förfalska signerar servern den med en hemlig nyckel; en kryptografisk signatur som bara vÄr server kan skapa. NÀr en token kommer in kör backend en verifiering, som kontrollerar att signaturen Àr giltig.
+
+SÄ vad Àr problemet?
+
+Problemet sitter i versionen. I vÄr package.json stÄr "jsonwebtoken": "8.5.1"; en urÄldrig version frÄn 2019\. Alla andra paket har ett tak-tecken framför versionsnumret, vilket tillÄter automatiska uppdateringar till nyare, kompatibla versioner. Den hÀr raden saknar detta tecken, sÄ paketet Àr lÄst och har inte fÄtt nÄgra sÀkerhetsuppdateringar pÄ flera Är. Sedan 2019 har tre sÄrbarheter hittats i just den versionen.
+
+Den allvarligaste sĂ„rbarheten handlar om algoritmkontroll. En jsonwebtoken kan signeras med olika algoritmer. I version 8.5.1 Ă€r denna typ av verifiering inte tillrĂ€ckligt strikt med vilken algoritm den accepterar; den verifierar att signaturen finns och stĂ€mmer, men kontrollerar inte hĂ„rt att rĂ€tt algoritm anvĂ€nts. Det öppnar för en sĂ„ kallad algorithm confusion-attack, dĂ€r angriparen med hjĂ€lp av en annan algoritm kan tvinga systemet att acceptera en âfalskâ token.
+
+---
+
+###
+
+### 4\. Attacken steg för steg, och OWASP-kopplingen
+
+För att förstÄ attacken behöver man veta att det finns tvÄ sÀtt att signera en token. Det ena anvÀnder en enda hemlig nyckel, som servern hÄller för sig sjÀlv och anvÀnder bÄde till att skapa signaturen och kontrollera den. Det andra anvÀnder ett nyckelpar: en privat nyckel som skapar signaturen, och en separat publik nyckel som kontrollerar den. Den publika nyckeln Àr tÀnkt att kunna delas öppet, och det Àr ofarligt, eftersom den bara kan kontrollera signaturer, inte skapa nya.
+
+Och det Àr dÀr bristen kommer in. Den gamla versionen av jwt-token kontrollerar inte tillrÀckligt noga vilket av de hÀr sÀtten som anvÀnts.
+
+SÄ en angripare kan skapa en egen token och skriva in en annan anvÀndares ID i den.
+
+De signerar tokenen med den publika nyckeln och lurar servern att behandla den som om det vore den hemliga nyckeln. Och den gamla versionen mÀrker inte skillnaden.
+
+Sen skickar de tokenen till vÄrt API. JWT-verifieringen godkÀnner den.
+
+Resultatet Àr att angriparen Àr inloggad som nÄgon annan, utan att nÄgonsin ha vetat deras lösenord.
+
+Den hÀr attacken förutsÀtter att servern anvÀnder nyckelpar-metoden, med en publik nyckel. VÄr app gör inte det, vi anvÀnder endast en hemlig nyckel, sÄ ingen publik nyckel finns att missbruka. Men ett autentiseringspaket med tre kÀnda brister Àr en risk oavsett. \- och nÀsta Àndringar i koden kan göra den nÄbar..
+
+I STRIDE Àr det hÀr Spoofing. I OWASP mappar det mot A03, Software Supply Chain Failures. Det handlar om att sÄrbarheter kommer in via tredjepartskod man inte skrivit sjÀlv. Men vi bÀr ansvaret för det ÀndÄ. Och det Àr poÀngen med kategorin: för allt som körs i din app Àr ditt ansvar, Àven det du lÄnat in.
+
+---
+
+### 5\. Ă
tgÀrden \+ övriga fynd
+
+Ă
tgÀrden Àr en rad.
+
+Vi Àndrar "jsonwebtoken": "8.5.1" till "^9.0.0" och kör npm install. Version 9 ÄtgÀrdar alla tre sÄrbarheterna och krÀver dessutom att man explicit anger vilken algoritm som ska accepteras, vilket stÀnger algorithm confusion-attacken. Och tak-tecken framför versionsnumret gör att paketet fÄr framtida sÀkerhetsuppdateringar automatiskt, sÄ samma misstag inte upprepas.
+
+Kort om resten:
+
+node-tar: alla sex Àr path traversal. Det innebÀr att en angripare manipulerar en filsökvÀg för att skriva en fil utanför den avsedda mappen, till exempel skriva över en kÀnslig fil genom att döpa en fil i arkivet till nÄgot som bla bla../../.env. Eftersom vÄr app aldrig packar upp arkiv gÄr det inte att utnyttja idag. Men vi ÄtgÀrdar det ÀndÄ för att minska attack-ytan, skulle appen byggas ut, eller en angripare ta sig in en annan vÀg, ska det inte ligga kvar. Det fixas via versions-styrning av paketet (i vÄr branch med ett overrides-block, alternativt npm audit fix).
+
+Vite-gruppen: ÄtgÀrdas pÄ samma sÀtt och berör ÀndÄ bara utvecklingslÀget.
+
+QS: löser sig genom att uppdatera Express, som dÄ drar in en patchad version.
+
+---
+
+### 6\. Slutsats
+
+Sammanfattningsvis: 16 alerts, fyra paket, och det viktigaste fyndet löstes med en liten Àndring.
+
+En viktig poÀng att notera hÀr: Dependabot granskar bara beroenden, inte vÄr egen kod. VÄr egen kod granskade vi sjÀlva i Fas 2: autentisering pÄ DELETE, Àgarkontroll, indatavalidering och rate limiting. De tvÄ granskningarna tÀcker olika saker; vi tog koden vi skrivit, Dependabot tog koden vi lÄnat in. Tillsammans tÀcker de hela appen.
+
+Och det Àr den centrala lÀrdomen: sÀkerhet Àr inte ett engÄngsarbete. Ett paket som var sÀkert 2019 Àr inte automatiskt sÀkert idag. Att ha verktyg som Dependabot pÄslaget och faktiskt agera pÄ dess fynd i form av brister Àr skillnaden mellan en app som var sÀker och en som förblir sÀker.
+[FAS3.pdf](https://github.com/user-attachments/files/29040497/FAS3.pdf)
+
+
+
From 6e09533cfb2cb94e3eeb6f6cbc30f6d47f22fd0e Mon Sep 17 00:00:00 2001
From: Malmqvisten
Date: Wed, 17 Jun 2026 11:17:55 +0200
Subject: [PATCH 16/17] Update granskningsfasen.md
---
granskningsfasen.md | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/granskningsfasen.md b/granskningsfasen.md
index 520be1286..fb30d4770 100644
--- a/granskningsfasen.md
+++ b/granskningsfasen.md
@@ -90,8 +90,7 @@ Sammanfattningsvis: 16 alerts, fyra paket, och det viktigaste fyndet löstes med
En viktig poÀng att notera hÀr: Dependabot granskar bara beroenden, inte vÄr egen kod. VÄr egen kod granskade vi sjÀlva i Fas 2: autentisering pÄ DELETE, Àgarkontroll, indatavalidering och rate limiting. De tvÄ granskningarna tÀcker olika saker; vi tog koden vi skrivit, Dependabot tog koden vi lÄnat in. Tillsammans tÀcker de hela appen.
-Och det Àr den centrala lÀrdomen: sÀkerhet Àr inte ett engÄngsarbete. Ett paket som var sÀkert 2019 Àr inte automatiskt sÀkert idag. Att ha verktyg som Dependabot pÄslaget och faktiskt agera pÄ dess fynd i form av brister Àr skillnaden mellan en app som var sÀker och en som förblir sÀker.
-[FAS3.pdf](https://github.com/user-attachments/files/29040497/FAS3.pdf)
+lÀnk till vÄr presentation: [FAS3.pdf](https://github.com/user-attachments/files/29040497/FAS3.pdf)
From 692f857a4d817feef9bd2ec381195a7b3eed1ef5 Mon Sep 17 00:00:00 2001
From: Malmqvisten
Date: Wed, 17 Jun 2026 11:19:48 +0200
Subject: [PATCH 17/17] Update granskningsfasen.md
---
granskningsfasen.md | 3 +++
1 file changed, 3 insertions(+)
diff --git a/granskningsfasen.md b/granskningsfasen.md
index fb30d4770..f4f37a5d9 100644
--- a/granskningsfasen.md
+++ b/granskningsfasen.md
@@ -94,3 +94,6 @@ lÀnk till vÄr presentation: [FAS3.pdf](https://github.com/user-attachments/fil
+
+
+