mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-08-19 09:30:21 +00:00
chore(ui): upgrade pnpm to 11 and harden supply-chain defaults (#11225)
Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com>
This commit is contained in:
Pablo Fernandez Guerra (PFE)
co-authored by
Pablo F.G
Pablo F.G
parent
81226cd837
commit
8f745cdbe6
+8
-1
@@ -11,7 +11,14 @@ envs = "wt step copy-ignored"
|
||||
[[pre-start]]
|
||||
deps = "uv sync"
|
||||
|
||||
# Block 3: reminder - last visible output before `wt switch` returns.
|
||||
# Block 3: prepare pnpm via corepack.
|
||||
[[pre-start]]
|
||||
corepack-enable = "corepack enable"
|
||||
|
||||
[[pre-start]]
|
||||
corepack-install = "cd ui && corepack install"
|
||||
|
||||
# Block 4: reminder - last visible output before `wt switch` returns.
|
||||
# Hooks can't mutate the parent shell, so venv activation is manual.
|
||||
[[pre-start]]
|
||||
reminder = "echo '>> Reminder: activate the venv in this shell with: source .venv/bin/activate'"
|
||||
|
||||
@@ -172,7 +172,7 @@ jobs:
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
|
||||
with:
|
||||
node-version: '24.13.0'
|
||||
node-version-file: 'ui/.nvmrc'
|
||||
|
||||
- name: Setup pnpm
|
||||
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
|
||||
|
||||
@@ -16,7 +16,6 @@ concurrency:
|
||||
|
||||
env:
|
||||
UI_WORKING_DIR: ./ui
|
||||
NODE_VERSION: "24.13.0"
|
||||
|
||||
permissions: {}
|
||||
|
||||
@@ -93,11 +92,11 @@ jobs:
|
||||
ui/vitest.config.ts
|
||||
ui/vitest.setup.ts
|
||||
|
||||
- name: Setup Node.js ${{ env.NODE_VERSION }}
|
||||
- name: Setup Node.js
|
||||
if: steps.check-changes.outputs.any_changed == 'true'
|
||||
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
node-version-file: 'ui/.nvmrc'
|
||||
|
||||
- name: Setup pnpm
|
||||
if: steps.check-changes.outputs.any_changed == 'true'
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
public-hoist-pattern[]=*@nextui-org/*
|
||||
public-hoist-pattern[]=*@heroui/*
|
||||
save-exact=true
|
||||
+3
-3
@@ -225,9 +225,9 @@ pnpm run test:e2e:ui
|
||||
|
||||
## QA CHECKLIST BEFORE COMMIT
|
||||
|
||||
- [ ] `npm run typecheck` passes
|
||||
- [ ] `npm run lint:fix` passes
|
||||
- [ ] `npm run format:write` passes
|
||||
- [ ] `pnpm run typecheck` passes
|
||||
- [ ] `pnpm run lint:fix` passes
|
||||
- [ ] `pnpm run format:write` passes
|
||||
- [ ] Relevant E2E tests pass
|
||||
- [ ] All UI states handled (loading, error, empty)
|
||||
- [ ] No secrets in code (use `.env.local`)
|
||||
|
||||
@@ -7,12 +7,18 @@ All notable changes to the **Prowler UI** are documented in this file.
|
||||
### 🔄 Changed
|
||||
|
||||
- Dark mode: pure-black canvas, pure-white primary text, and brighter border / input tokens for clearer separation between cards, tables, and inputs [(#11073)](https://github.com/prowler-cloud/prowler/pull/11073)
|
||||
- CI workflows (`ui-tests.yml`, `ui-e2e-tests-v2.yml`) now read the Node version from `ui/.nvmrc` and the pnpm version from `package.json#packageManager` instead of hardcoded values [(#11225)](https://github.com/prowler-cloud/prowler/pull/11225)
|
||||
|
||||
### 🐞 Fixed
|
||||
|
||||
- Compliance page now loads the most recent scan when opened from the sidebar instead of showing the "no compliance data available" alert [(#11374)](https://github.com/prowler-cloud/prowler/pull/11374)
|
||||
- Invitation links now show specific expired, no-longer-valid, and invalid-token messages based on API error responses [(#11376)](https://github.com/prowler-cloud/prowler/pull/11376)
|
||||
|
||||
### 🔐 Security
|
||||
|
||||
- `pnpm` upgraded to 11 with supply-chain defaults consolidated in `pnpm-workspace.yaml` and `trustPolicyExclude` entries pinned to exact versions [(#11225)](https://github.com/prowler-cloud/prowler/pull/11225)
|
||||
- `uuid` pinned to `11.1.1` via `pnpm-workspace.yaml#overrides` to clear `GHSA-w5hq-g745-h8pq` (missing bounds check in `v3`/`v5`/`v6` name-based generators with `buf`) in the transitive tree [(#11225)](https://github.com/prowler-cloud/prowler/pull/11225)
|
||||
|
||||
---
|
||||
|
||||
## [1.28.1] (Prowler v5.28.1)
|
||||
|
||||
+2
-1
@@ -1,3 +1,4 @@
|
||||
# Keep in sync with ui/.nvmrc.
|
||||
FROM node:24.13.0-alpine@sha256:cd6fb7efa6490f039f3471a189214d5f548c11df1ff9e5b181aa49e22c14383e AS base
|
||||
|
||||
LABEL maintainer="https://github.com/prowler-cloud"
|
||||
@@ -13,7 +14,7 @@ RUN apk add --no-cache libc6-compat
|
||||
WORKDIR /app
|
||||
|
||||
# Install dependencies based on the preferred package manager
|
||||
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
|
||||
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
|
||||
COPY scripts ./scripts
|
||||
RUN corepack install && pnpm install --frozen-lockfile
|
||||
|
||||
|
||||
+4
-21
@@ -161,27 +161,10 @@
|
||||
"vitest": "4.0.18",
|
||||
"vitest-browser-react": "2.0.4"
|
||||
},
|
||||
"packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319",
|
||||
"pnpm": {
|
||||
"overrides": {
|
||||
"@hono/node-server": "1.19.14",
|
||||
"@internationalized/date": "3.10.0",
|
||||
"@isaacs/brace-expansion": "5.0.1",
|
||||
"@react-aria/interactions>react": "19.2.6",
|
||||
"@react-aria/ssr>react": "19.2.6",
|
||||
"@react-aria/ssr>react-dom": "19.2.6",
|
||||
"@react-aria/visually-hidden>react": "19.2.6",
|
||||
"fast-xml-parser": "5.8.0",
|
||||
"hono": "4.12.18",
|
||||
"lodash": "4.18.1",
|
||||
"lodash-es": "4.18.1",
|
||||
"minimatch@>=9 <10": "9.0.7",
|
||||
"minimatch@>=10": "10.2.3",
|
||||
"minimatch@<4": "3.1.4",
|
||||
"qs": "6.14.2",
|
||||
"rollup@>=4": "4.59.0",
|
||||
"serialize-javascript": "7.0.5"
|
||||
}
|
||||
"packageManager": "pnpm@11.1.3+sha512.c85357fe17ca12dd23dd7071822666dfd7e3cb76fe214e3370b5ea2fb34f2a231185509b63e717f3cd0acb38dd3f8d82bcd5e8172400ae678b70ea4fbed0896d",
|
||||
"engines": {
|
||||
"node": ">=22.13",
|
||||
"pnpm": ">=11.1.3"
|
||||
},
|
||||
"msw": {
|
||||
"workerDirectory": [
|
||||
|
||||
Generated
+169
-201
File diff suppressed because it is too large
Load Diff
+51
-1
@@ -1,7 +1,49 @@
|
||||
# pnpm 11+ workspace config. .npmrc is auth/registry only; everything else lives here.
|
||||
# Reference: https://pnpm.io/supply-chain-security
|
||||
|
||||
packages: []
|
||||
|
||||
# Refuse to install on Node/pnpm outside the `engines` block in package.json.
|
||||
engineStrict: true
|
||||
|
||||
# Hoist the HeroUI family so its legacy peer-dep pattern resolves.
|
||||
publicHoistPattern:
|
||||
- "*@heroui/*"
|
||||
|
||||
# Default `pnpm add` to exact versions — matches package.json convention.
|
||||
saveExact: true
|
||||
|
||||
# --- Dependency overrides ---
|
||||
overrides:
|
||||
"@react-types/shared": "3.26.0"
|
||||
"@internationalized/date": "3.10.0"
|
||||
"@react-aria/ssr>react": "19.2.6"
|
||||
"@react-aria/ssr>react-dom": "19.2.6"
|
||||
"@react-aria/visually-hidden>react": "19.2.6"
|
||||
"@react-aria/interactions>react": "19.2.6"
|
||||
"lodash": "4.18.1"
|
||||
"lodash-es": "4.18.1"
|
||||
"hono": "4.12.18"
|
||||
"@hono/node-server": "1.19.14"
|
||||
"@isaacs/brace-expansion": "5.0.1"
|
||||
"fast-xml-parser": "5.8.0"
|
||||
"serialize-javascript": "7.0.5"
|
||||
"rollup@>=4": "4.59.0"
|
||||
"minimatch@<4": "3.1.4"
|
||||
"minimatch@>=9 <10": "9.0.7"
|
||||
"minimatch@>=10": "10.2.3"
|
||||
"ajv@<7": "6.14.0"
|
||||
"ajv@>=8": "8.18.0"
|
||||
"qs": "6.14.2"
|
||||
# 8.2.2 dropped provenance attestation; 8.3.1+ restored it. Pinned to skip 8.2.2
|
||||
# under `trustPolicy: no-downgrade`.
|
||||
"express-rate-limit": "8.5.1"
|
||||
# GHSA-w5hq-g745-h8pq: missing bounds check in v3/v5/v6 with buf, fixed in
|
||||
# 11.1.1. Transitive consumers (@sentry/webpack-plugin@9, @langchain/langgraph@10)
|
||||
# use the random v4 generator only, so the bug isn't reachable in practice,
|
||||
# but the override unifies the tree on a patched version.
|
||||
"uuid": "11.1.1"
|
||||
|
||||
# --- Level 1: Minimum Release Age ---
|
||||
# Packages must be published for at least 1 day before they can be installed.
|
||||
# Prevents installing compromised packages during the detection window.
|
||||
@@ -33,7 +75,15 @@ allowBuilds:
|
||||
# --- Level 3: Trust Policy + Exotic Subdeps ---
|
||||
# Fail when a package's trust evidence is downgraded (e.g., new publisher).
|
||||
trustPolicy: no-downgrade
|
||||
trustPolicyExclude: []
|
||||
# False positives — packages that don't publish provenance for real releases.
|
||||
# Pin to the version range that lacks provenance so a bump fails until reviewed.
|
||||
trustPolicyExclude:
|
||||
# next-auth: only one one-off manual test release (`0.0.0-manual.2824fa11`) has
|
||||
# provenance; real beta/stable releases don't. Scoped to current beta line.
|
||||
- "next-auth@5.0.0-beta.30"
|
||||
# semver: legacy major 6.x never had provenance (added in 7.5.1+). Pinned
|
||||
# to the exact 6.x version pulled transitively (via @babel/helper-compilation-targets).
|
||||
- "semver@6.3.1"
|
||||
|
||||
# Block transitive dependencies from using exotic specifiers (git URLs, tarballs).
|
||||
blockExoticSubdeps: true
|
||||
|
||||
Reference in New Issue
Block a user