chris
803ed2a988
Vite 5 pulled esbuild 0.21.5 — the only source of the GHSA-67mh-4wv8-2f99 dev-server advisory. Vite 6.4 (esbuild 0.25) runs on the current Node baseline and clears it: `npm audit` now reports 0 vulnerabilities. - vite 5.4 → 6.4, vite-plugin-pwa 0.21 → 1.3 (needs Vite 6+). - Removed `ws` from devDependencies — it was only used by throwaway test scripts, never the app or build. - Build, all 14 routes, and the service worker verified on Vite 6. - SECURITY.md / AGENTS.md updated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Ve7HLspzeG2xDPtJQ8vmu
979 B
Security Policy
Supported versions
Pocketdex is a rolling static web app — only the current main (and
whatever is deployed from it) is supported. There are no maintenance
branches.
Reporting a vulnerability
Please don't open a public issue for a security problem.
Use GitHub's private vulnerability reporting (the Report a vulnerability button under the repository's Security tab). Include what you found, how to reproduce it, and the impact you think it has. You'll get an acknowledgement as soon as possible.
Since Pocketdex has no backend and stores everything in the visitor's own
browser, the realistic surface is: the service worker / caching, the
save-file parser (src/lib/savedex.js) operating on untrusted binary
input, and the JSON backup import.
Known issues
None currently. npm audit is clean as of the last dependency bump
(Vite 6, esbuild 0.25). CI does not yet gate on npm audit; run it
locally when touching dependencies.