Skip to content

Commit e1276d9

Browse files
joanerjoaner
authored
Merge pull request #38 from joaner/chore/deps-security-toolchain
chore(deps): security toolchain cleanup and Vite 8 hygiene (v1.7.8)
2 parents 8e086e5 + 08886f8 commit e1276d9

17 files changed

Lines changed: 1718 additions & 2903 deletions

‎.github/dependabot.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: npm
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
open-pull-requests-limit: 5
8+
groups:
9+
production-deps:
10+
dependency-type: production
11+
development-deps:
12+
dependency-type: development
13+
14+
- package-ecosystem: github-actions
15+
directory: /
16+
schedule:
17+
interval: weekly
18+
open-pull-requests-limit: 3

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ node_modules
1111
dist
1212
dist-ssr
1313
dist-lib
14+
.tmp-dts
15+
.tmp-baseline-dist-lib
1416
*.local
1517

1618
# Track package-lock.json for GitHub Actions (npm ci + setup-node cache: npm).
@@ -38,6 +40,7 @@ yarn.lock
3840
/public/examples/
3941
/test-results/
4042
/playwright-report/
43+
/coverage/
4144
.tmp-urdf-debug-*/
4245

4346
# Python (fixture generator scripts, e.g. gen-test-hdf5.py / gen-test-bag.py)

‎SECURITY.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Security Policy
2+
3+
## Supported versions
4+
5+
Security fixes are applied to the latest published release of `@ioai/rosview` on npm. Older versions may not receive backports; please upgrade when possible.
6+
7+
## Reporting a vulnerability
8+
9+
Please report security issues responsibly:
10+
11+
- Prefer emailing the maintainers at an `@io-ai.tech` address (see `CONTRIBUTING.md` / `LICENSE` for project ownership), **or**
12+
- Use [GitHub Security Advisories](https://github.com/ioai-tech/rosview/security/advisories/new) for private disclosure when available.
13+
14+
Do **not** open a public GitHub issue for vulnerabilities that could be exploited before a fix is released.
15+
16+
Include as much detail as you can: affected version, reproduction steps, impact, and any suggested remediation.
17+
18+
We aim to acknowledge reports within a few business days and will coordinate a fix and disclosure timeline with you.
19+
20+
## Dependency vulnerabilities
21+
22+
This repository uses Dependabot for npm and GitHub Actions updates. Runtime impact of `npm audit` findings in **devDependencies** (lint, test, and library packaging tools) is typically limited to maintainer machines and CI; still, high/critical issues in the toolchain are fixed by upgrading or removing the affected packages when practical.
23+
24+
We avoid broad `npm overrides` for security patches when a direct dependency upgrade or removing unused tooling is sufficient.

‎api-extractor.rosview.json‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
"$schema": "https://developer.microsoft.com/json-schemas/api-extractor/v7/api-extractor.schema.json",
3+
"projectFolder": ".",
4+
"mainEntryPointFilePath": "<projectFolder>/.tmp-dts/entrypoints/index.d.ts",
5+
"compiler": {
6+
"tsconfigFilePath": "<projectFolder>/tsconfig.lib.json",
7+
"overrideTsconfig": {
8+
"compilerOptions": {
9+
"paths": {
10+
"@/*": ["./.tmp-dts/*"]
11+
}
12+
}
13+
}
14+
},
15+
"apiReport": {
16+
"enabled": false
17+
},
18+
"docModel": {
19+
"enabled": false
20+
},
21+
"dtsRollup": {
22+
"enabled": true,
23+
"untrimmedFilePath": "",
24+
"publicTrimmedFilePath": "<projectFolder>/dist-lib/rosview.d.ts"
25+
},
26+
"tsdocMetadata": {
27+
"enabled": false
28+
},
29+
"messages": {
30+
"compilerMessageReporting": {
31+
"default": {
32+
"logLevel": "none"
33+
}
34+
},
35+
"extractorMessageReporting": {
36+
"default": {
37+
"logLevel": "none"
38+
},
39+
"ae-forgotten-export": {
40+
"logLevel": "none"
41+
},
42+
"ae-missing-release-tag": {
43+
"logLevel": "none"
44+
},
45+
"ae-unresolved-link": {
46+
"logLevel": "none"
47+
}
48+
},
49+
"tsdocMessageReporting": {
50+
"default": {
51+
"logLevel": "none"
52+
}
53+
}
54+
}
55+
}

‎api-extractor.urdf-preview.json‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
"$schema": "https://developer.microsoft.com/json-schemas/api-extractor/v7/api-extractor.schema.json",
3+
"projectFolder": ".",
4+
"mainEntryPointFilePath": "<projectFolder>/.tmp-dts/entrypoints/urdf-preview.d.ts",
5+
"compiler": {
6+
"tsconfigFilePath": "<projectFolder>/tsconfig.lib.json",
7+
"overrideTsconfig": {
8+
"compilerOptions": {
9+
"paths": {
10+
"@/*": ["./.tmp-dts/*"]
11+
}
12+
}
13+
}
14+
},
15+
"apiReport": {
16+
"enabled": false
17+
},
18+
"docModel": {
19+
"enabled": false
20+
},
21+
"dtsRollup": {
22+
"enabled": true,
23+
"untrimmedFilePath": "",
24+
"publicTrimmedFilePath": "<projectFolder>/dist-lib/urdf-preview.d.ts"
25+
},
26+
"tsdocMetadata": {
27+
"enabled": false
28+
},
29+
"messages": {
30+
"compilerMessageReporting": {
31+
"default": {
32+
"logLevel": "none"
33+
}
34+
},
35+
"extractorMessageReporting": {
36+
"default": {
37+
"logLevel": "none"
38+
},
39+
"ae-forgotten-export": {
40+
"logLevel": "none"
41+
},
42+
"ae-missing-release-tag": {
43+
"logLevel": "none"
44+
},
45+
"ae-unresolved-link": {
46+
"logLevel": "none"
47+
}
48+
},
49+
"tsdocMessageReporting": {
50+
"default": {
51+
"logLevel": "none"
52+
}
53+
}
54+
}
55+
}

‎docs/ARCHITECTURE.md‎

Lines changed: 25 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -642,16 +642,21 @@ function PlaybackProgressSlider() {
642642
export default defineConfig({
643643
plugins: [react()],
644644
resolve: { alias: { '@': path.resolve(__dirname, './src') } },
645-
worker: { format: 'es', plugins: () => [wasm()] },
645+
// Native Vite `*.wasm?url` + assetsInclude (no vite-plugin-wasm).
646+
assetsInclude: ['**/*.wasm'],
647+
worker: { format: 'es' },
646648
build: {
647649
target: 'esnext',
650+
modulePreload: { polyfill: false },
651+
reportCompressedSize: false,
648652
rolldownOptions: {
649653
output: {
650-
codeSplitting: true,
651-
manualChunks(id) {
652-
if (id.includes('dockview')) return 'vendor-dockview';
653-
if (id.includes('three')) return 'vendor-three';
654-
// ...
654+
codeSplitting: {
655+
groups: [
656+
{ name: 'vendor-dockview', test: /dockview/, priority: 30 },
657+
{ name: 'vendor-three', test: /(?:^|[\\/])three(?:[\\/]|$)/, priority: 30 },
658+
// vendor-uplot, vendor-mcap, vendor-rosbag, vendor-ioai-hdf5, ...
659+
],
655660
},
656661
},
657662
},
@@ -663,41 +668,33 @@ export default defineConfig({
663668
664669
### 7.2 Library Build (Embeddable Component)
665670

666-
`vite.lib.config.ts` — outputs an ESM library bundle for npm. **Type declarations are emitted in the same `vite build` run** via `vite-plugin-dts`. With `rollupTypes: true`, API Extractor rolls declarations up to a single `dist-lib/rosview.d.ts` (no separate post-build script).
671+
`vite.lib.config.ts` — outputs an ESM library bundle for npm (JS/CSS/WASM/workers) via Vite [`build.lib`](https://vite.dev/guide/build.html#library-mode). **Type declarations are not emitted by Vite**; `npm run build:lib` runs a separate types step:
667672

668-
Important: use an **absolute** `build.lib.entry`; in `dts()`, set `compilerOptions.rootDir` and `entryRoot` to `<package>/src` so emitted `.d.ts` mirror as `dist-lib/entrypoints/...` (not `dist-lib/src/...`) and `insertTypesEntry` stays correct when the monorepo is built from a cwd outside this package. See the checked-in `vite.lib.config.ts` for the full config (including `pathsToAliases: false`, worker plugins, and externals).
673+
1. `tsc -p tsconfig.lib.json --emitDeclarationOnly` → intermediate `.tmp-dts/` (gitignored, not published)
674+
2. `@microsoft/api-extractor` (`api-extractor.rosview.json` / `api-extractor.urdf-preview.json`) → single `dist-lib/rosview.d.ts` and `dist-lib/urdf-preview.d.ts`
675+
676+
Important: use an **absolute** `build.lib.entry`. The public entry `src/entrypoints/index.ts` re-exports via relative paths so rolled-up types stay free of fragile `@/` paths for consumers. See the checked-in `vite.lib.config.ts` for `rolldownOptions` externals and worker settings.
669677

670678
```typescript
671-
import dts from 'vite-plugin-dts';
672679
// ...path, fileURLToPath, packageDir as in vite.lib.config.ts
673680

674681
export default defineConfig({
675682
root: packageDir,
676-
plugins: [
677-
react(),
678-
wasm(),
679-
dts({
680-
compilerOptions: { rootDir: path.join(packageDir, 'src') },
681-
include: ['src/**/*.ts', 'src/**/*.tsx'],
682-
outDir: 'dist-lib',
683-
entryRoot: path.join(packageDir, 'src'),
684-
tsconfigPath: './tsconfig.app.json',
685-
pathsToAliases: false,
686-
rollupTypes: true,
687-
insertTypesEntry: true,
688-
copyDtsFiles: false,
689-
}),
690-
],
683+
plugins: [react()],
684+
assetsInclude: ['**/*.wasm'],
691685
build: {
692686
outDir: 'dist-lib',
693687
sourcemap: false,
694688
lib: {
695-
entry: path.join(packageDir, 'src/entrypoints/index.ts'),
689+
entry: {
690+
rosview: path.join(packageDir, 'src/entrypoints/index.ts'),
691+
'urdf-preview': path.join(packageDir, 'src/entrypoints/urdf-preview.ts'),
692+
},
696693
formats: ['es'],
697-
fileName: 'rosview.es',
694+
fileName: (_format, entryName) => `${entryName}.es.js`,
698695
},
699-
rollupOptions: {
700-
external: ['react', 'react-dom', 'react/jsx-runtime'],
696+
rolldownOptions: {
697+
external: ['react', 'react-dom', 'react/jsx-runtime' /* + three / @react-three/* */],
701698
output: {
702699
assetFileNames: (a) =>
703700
a.name?.endsWith('.css') ? 'rosview.css' : (a.name ?? '[name][extname]'),

‎docs/ARCHITECTURE.zh.md‎

Lines changed: 29 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -643,27 +643,30 @@ function PlaybackProgressSlider() {
643643
```typescript
644644
import { defineConfig } from 'vite';
645645
import react from '@vitejs/plugin-react';
646-
import wasm from 'vite-plugin-wasm';
647646
import path from 'path';
648647

649648
export default defineConfig({
650649
plugins: [react()],
651650
resolve: {
652651
alias: { '@': path.resolve(__dirname, './src') },
653652
},
653+
// 原生 Vite `*.wasm?url` + assetsInclude（无需 vite-plugin-wasm）
654+
assetsInclude: ['**/*.wasm'],
654655
worker: {
655656
format: 'es',
656-
plugins: () => [wasm()],
657657
},
658658
build: {
659659
target: 'esnext',
660+
modulePreload: { polyfill: false },
661+
reportCompressedSize: false,
660662
rolldownOptions: {
661663
output: {
662-
codeSplitting: true,
663-
manualChunks(id) {
664-
if (id.includes('dockview')) return 'vendor-dockview';
665-
if (id.includes('three')) return 'vendor-three';
666-
// ...
664+
codeSplitting: {
665+
groups: [
666+
{ name: 'vendor-dockview', test: /dockview/, priority: 30 },
667+
{ name: 'vendor-three', test: /(?:^|[\\/])three(?:[\\/]|$)/, priority: 30 },
668+
// vendor-uplot、vendor-mcap、vendor-rosbag、vendor-ioai-hdf5 …
669+
],
667670
},
668671
},
669672
},
@@ -675,53 +678,43 @@ export default defineConfig({
675678
676679
### 7.2 库构建（嵌入式组件）
677680

678-
`vite.lib.config.ts` — 构建为可被 `app/` 引入的 ESM 库；**类型声明在同一轮 `vite build` 内**由 `vite-plugin-dts` 生成，`rollupTypes: true` 借助 API Extractor 合并为单一 `dist-lib/rosview.d.ts`（无需额外脚本）。
681+
`vite.lib.config.ts` — 用 Vite [`build.lib`](https://cn.vite.dev/guide/build.html#library-mode) 产出可发布的 ESM 库（JS/CSS/WASM/workers）。**类型声明不由 Vite 生成**；`npm run build:lib` 另跑类型步骤：
679682

680-
要点：`build.lib.entry` 使用**绝对路径**；`dts()` 中设置 `compilerOptions.rootDir = <包>/src` 与 `entryRoot: <包>/src`，避免声明镜像落在 `dist-lib/src/...` 或在 monorepo 非包目录 cwd 下出现空的 `insertTypesEntry` / 空 rollup 结果。完整配置以仓库内 `vite.lib.config.ts` 为准。
683+
1. `tsc -p tsconfig.lib.json --emitDeclarationOnly` → 中间产物 `.tmp-dts/`（已 gitignore，不发布）
684+
2. `@microsoft/api-extractor`（`api-extractor.rosview.json` / `api-extractor.urdf-preview.json`）→ 单一 `dist-lib/rosview.d.ts` 与 `dist-lib/urdf-preview.d.ts`
685+
686+
要点：`build.lib.entry` 使用**绝对路径**；公开入口 `src/entrypoints/index.ts` 用相对路径 re-export，避免类型 rollup 后把 `@/` 暴露给消费者。完整配置以仓库内 `vite.lib.config.ts` 的 `rolldownOptions` / external 为准。
681687

682688
```typescript
683689
import { defineConfig } from 'vite';
684690
import react from '@vitejs/plugin-react';
685-
import dts from 'vite-plugin-dts';
686-
import wasm from 'vite-plugin-wasm';
687691
import path from 'path';
688692
import { fileURLToPath } from 'node:url';
689693

690694
const packageDir = path.dirname(fileURLToPath(import.meta.url));
691695

692696
export default defineConfig({
693697
root: packageDir,
694-
plugins: [
695-
react(),
696-
wasm(),
697-
dts({
698-
compilerOptions: { rootDir: path.join(packageDir, 'src') },
699-
include: ['src/**/*.ts', 'src/**/*.tsx'],
700-
outDir: 'dist-lib',
701-
entryRoot: path.join(packageDir, 'src'),
702-
tsconfigPath: './tsconfig.app.json',
703-
pathsToAliases: false,
704-
rollupTypes: true,
705-
insertTypesEntry: true,
706-
copyDtsFiles: false,
707-
}),
708-
],
698+
plugins: [react()],
709699
resolve: {
710700
alias: { '@': path.join(packageDir, 'src') },
711701
},
702+
assetsInclude: ['**/*.wasm'],
712703
worker: {
713704
format: 'es',
714-
plugins: () => [wasm()],
715705
},
716706
build: {
717707
outDir: 'dist-lib',
718708
lib: {
719-
entry: path.join(packageDir, 'src/entrypoints/index.ts'),
709+
entry: {
710+
rosview: path.join(packageDir, 'src/entrypoints/index.ts'),
711+
'urdf-preview': path.join(packageDir, 'src/entrypoints/urdf-preview.ts'),
712+
},
720713
formats: ['es'],
721-
fileName: 'rosview.es',
714+
fileName: (_format, entryName) => `${entryName}.es.js`,
722715
},
723-
rollupOptions: {
724-
external: ['react', 'react-dom', 'react/jsx-runtime'],
716+
rolldownOptions: {
717+
external: ['react', 'react-dom', 'react/jsx-runtime' /* + three / @react-three/* */],
725718
output: {
726719
assetFileNames: (assetInfo) => {
727720
if (assetInfo.name?.endsWith('.css')) return 'rosview.css';
@@ -755,7 +748,7 @@ export default defineConfig({
755748
"scripts": {
756749
"dev": "vite",
757750
"build": "tsc -b && vite build",
758-
"build:lib": "tsc -b && vite build --config vite.lib.config.ts",
751+
"build:lib": "tsc -b && vite build --config vite.lib.config.ts && npm run build:lib:types",
759752
"typecheck": "tsc -b --noEmit",
760753
"lint": "eslint \"src/**/*.{ts,tsx}\" \"tests/**/*.ts\"",
761754
"test": "vitest run",
@@ -917,14 +910,15 @@ rosview/
917910
```json
918911
{
919912
"devDependencies": {
920-
"@eslint/js": "^9.39.0",
913+
"@eslint/js": "^10.0.0",
914+
"@microsoft/api-extractor": "^7.58.12",
921915
"@types/node": "^24.12.0",
922916
"@types/react": "^19.2.14",
923917
"@types/react-dom": "^19.2.3",
924918
"@types/three": "^0.171.0",
925919
"@vitejs/plugin-react": "^6.0.1",
926920
"autoprefixer": "^10.4.23",
927-
"eslint": "^9.39.0",
921+
"eslint": "^10.8.0",
928922
"eslint-plugin-react-hooks": "^7.0.1",
929923
"eslint-plugin-react-refresh": "^0.5.2",
930924
"globals": "^17.4.0",
@@ -933,8 +927,7 @@ rosview/
933927
"typescript": "~6.0.2",
934928
"typescript-eslint": "^8.58.0",
935929
"vite": "^8.0.4",
936-
"vite-plugin-dts": "^4.5.4",
937-
"vite-plugin-wasm": "^3.5.0",
930+
"@vitest/coverage-v8": "^4.1.4",
938931
"vitest": "^4.0.0"
939932
}
940933
}

0 commit comments

Comments
 (0)