fix(security): bump vite/vitest/esbuild to clear all Medium+ CVEs

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,9 @@
+FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2
+WORKDIR /src
+RUN corepack enable && chown -R node:node /src
+USER node
+COPY --chown=node:node . .
+RUN test -f package.json || (echo "::error title=ClusterFuzzLite Docker context::Build with repository root context: docker build -f .clusterfuzzlite/Dockerfile ." && exit 64)
+RUN pnpm install --frozen-lockfile
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD node --version >/dev/null || exit 1
+CMD ["pnpm", "test", "--", "--run"]

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -6,15 +6,18 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
         with:
-          version: 9
-      - uses: actions/setup-node@v4
+          version: 10.34.4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: 22
           cache: pnpm

.github/workflows/codeql.yml

@@ -0,0 +1,29 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '37 3 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze JavaScript and TypeScript
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9
+        with:
+          languages: javascript-typescript
+      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9
+        with:
+          category: /language:javascript-typescript

Dockerfile

@@ -1,15 +1,18 @@
 # Multi-stage build for the standalone static demo.
 # Build:  docker build -t cwl-editor-demo .
-# Run:    docker run --rm -p 8080:80 cwl-editor-demo  ->  http://localhost:8080
-FROM node:22-alpine AS build
+# Run:    docker run --rm -p 8080:8080 cwl-editor-demo  ->  http://localhost:8080
+FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2 AS build
 WORKDIR /app
 RUN corepack enable
-COPY package.json pnpm-lock.yaml* ./
-RUN pnpm install --frozen-lockfile || pnpm install
+COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml ./
+RUN pnpm install --frozen-lockfile
 COPY . .
 RUN pnpm build:demo
 
-FROM nginx:1.27-alpine AS runtime
-COPY --from=build /app/dist-demo /usr/share/nginx/html
-EXPOSE 80
+FROM nginx:1.27-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10 AS runtime
+COPY --from=build --chown=nginx:nginx /app/dist-demo /usr/share/nginx/html
+RUN sed -i 's/listen       80;/listen       8080;/' /etc/nginx/conf.d/default.conf   && chown -R nginx:nginx /usr/share/nginx/html /var/cache/nginx /var/run /var/log/nginx
+USER nginx
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 CMD wget -qO- http://127.0.0.1:8080/ >/dev/null || exit 1
 CMD ["nginx", "-g", "daemon off;"]

README.md

@@ -133,7 +133,7 @@ pnpm build:demo     # static site -> dist-demo/
 
 ```bash
 docker build -t cwl-editor-demo .
-docker run --rm -p 8080:80 cwl-editor-demo   # http://localhost:8080
+docker run --rm -p 8080:8080 cwl-editor-demo   # http://localhost:8080
 ```
 
 ## Scripts

SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are applied to the default branch and the latest published package version. Older snapshots are not supported unless the maintainers explicitly mark a release branch as supported.
+
+## Reporting a Vulnerability
+
+Report suspected vulnerabilities through GitHub private vulnerability reporting or a repository security advisory:
+
+https://github.com/ContextualWisdomLab/inkspan/security/advisories/new
+
+Do not file public issues for exploitable behavior, credential exposure, supply-chain compromise, or denial-of-service findings until a fix is available.
+
+Include the affected version or commit, reproduction steps, impact, and any relevant logs or proof-of-concept material. Maintainers will acknowledge validated reports, coordinate a fix, and publish disclosure notes after the patched version is available.

package.json

@@ -5,6 +5,7 @@
   "license": "MIT",
   "author": "ContextualWisdomLab",
   "type": "module",
+  "packageManager": "pnpm@10.34.4",
   "keywords": [
     "editor",
     "wysiwyg",
@@ -88,17 +89,18 @@
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.2.0",
     "@testing-library/user-event": "^14.5.2",
+    "@types/node": "^22.10.5",
     "@types/react": "^18.3.18",
     "@types/react-dom": "^18.3.5",
     "@types/turndown": "^5.0.5",
     "@vitejs/plugin-react": "^4.3.4",
-    "@vitest/coverage-v8": "^2.1.8",
+    "@vitest/coverage-v8": "^3.2.6",
     "jsdom": "^25.0.1",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "typescript": "^5.7.3",
-    "vite": "^5.4.11",
+    "vite": "^6.4.3",
     "vite-plugin-dts": "^4.5.0",
-    "vitest": "^2.1.8"
+    "vitest": "^3.2.6"
   }
 }