lywsvip/eSIM-Tools
1
0
Fork 0
mirror of https://github.com/Silentely/eSIM-Tools.git synced 2026-09-03 06:24:20 +08:00
Code Issues Packages Projects Releases Wiki Activity
510 Commits 2 Branches 0 Tags
2bbe2f9bc47cbcff3ec3b26e3583d5e01e2dc53e
Commit Graph

64 Commits

Author SHA1 Message Date
Abner
71ca8538f7 🔒 security: 通过 overrides 升级 js-yaml 修复 Dependabot 告警 
将传递依赖 js-yaml@3 固定到 3.15.0、js-yaml@4 固定到 4.3.0，
消除 YAML merge-key 二次方复杂度 DoS（#106/#107）。
 2026-07-22 18:03:39 +08:00
Neo Vern
cd23cea87c Merge pull request #98 from Silentely/dependabot/npm_and_yarn/svgo-3.3.4 
build(deps-dev): bump svgo from 3.3.3 to 3.3.4
 2026-07-22 18:02:06 +08:00
Neo Vern
78c64989f9 Merge pull request #97 from Silentely/dependabot/npm_and_yarn/fast-uri-3.1.4 
build(deps-dev): bump fast-uri from 3.1.2 to 3.1.4
 2026-07-22 18:02:02 +08:00
Neo Vern
bf81262434 Merge pull request #96 from Silentely/dependabot/npm_and_yarn/body-parser-1.20.6 
build(deps): bump body-parser from 1.20.5 to 1.20.6
 2026-07-22 18:01:56 +08:00
dependabot[bot]
3243a89011 build(deps-dev): bump svgo from 3.3.3 to 3.3.4 
Bumps [svgo](https://github.com/svg/svgo) from 3.3.3 to 3.3.4.
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](https://github.com/svg/svgo/compare/v3.3.3...v3.3.4)

---
updated-dependencies:
- dependency-name: svgo
  dependency-version: 3.3.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-22 09:46:07 +00:00
dependabot[bot]
cac7733946 build(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.4)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-22 09:46:06 +00:00
dependabot[bot]
7b7b1aedf6 build(deps): bump body-parser from 1.20.5 to 1.20.6 
Bumps [body-parser](https://github.com/expressjs/body-parser) from 1.20.5 to 1.20.6.
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](https://github.com/expressjs/body-parser/compare/1.20.5...1.20.6)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 1.20.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-22 09:46:05 +00:00
dependabot[bot]
cfd4413a5e build(deps-dev): bump sharp from 0.34.5 to 0.35.0 
Bumps [sharp](https://github.com/lovell/sharp) from 0.34.5 to 0.35.0.
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](https://github.com/lovell/sharp/compare/v0.34.5...v0.35.0)

---
updated-dependencies:
- dependency-name: sharp
  dependency-version: 0.35.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-22 09:45:57 +00:00
Neo Vern
b884cbd659 Merge pull request #93 from Silentely/dependabot/npm_and_yarn/brace-expansion-5.0.7 
build(deps): bump brace-expansion from 5.0.6 to 5.0.7
 2026-07-22 17:44:58 +08:00
dependabot[bot]
0d13254438 build(deps): bump brace-expansion from 5.0.6 to 5.0.7 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.6 to 5.0.7.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.6...v5.0.7)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-21 14:23:58 +00:00
dependabot[bot]
9b122e0e7c build(deps): bump axios from 1.16.0 to 1.18.0 
Bumps [axios](https://github.com/axios/axios) from 1.16.0 to 1.18.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.16.0...v1.18.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-20 18:20:47 +00:00
Abner
41ec3a91b7 🔒 security: 通过 overrides 升级 ws 至 8.21.0 
修复 GHSA-96hv-2xvq-fx4p：小分片导致内存耗尽 DoS（jsdom 传递依赖）。
 2026-07-11 13:11:52 +08:00
Abner
5e55f0a569 🔒 security: 升级 morgan 至 1.11.0 修复 Dependabot 告警 
修复 GHSA-4vj7-5mj6-jm8m：:remote-user 日志伪造（控制字符未中和）。
 2026-07-11 13:09:06 +08:00
Abner
5a5c3d9722 🐛 fix: 添加 Sentry 错误过滤规则屏蔽第三方扩展 i18n 噪音 
- 在 Sentry 的 denyUrls 过滤列表中添加 `/getInitLang/` 正则，拦截第三方脚本/扩展注入的 i18n 相关错误
- 减少因浏览器扩展注入的 `getInitLang` 未定义错误导致的误报，提升错误上报的有效性
- 同步更新依赖锁定文件 package-lock.json，确保依赖版本一致性
 2026-07-05 16:15:01 +08:00
Neo Vern
7298ae4a0d ✨ feat: QR 码本地打包 + Edge Function 直接生成 (#86) 
* ✨ feat: 打包 qrcode-generator@1.4.4 到本地 ES 模块

* ♻️ refactor(qrcode): 移除 CDN 加载逻辑，改用本地 import 引入 qrcode-generator

* 🔧 chore: 移除 CDN preconnect 提示，QR 码库已内联

* 🔧 chore: 清理 CSP 配置，移除不再需要的 CDN 域名

* ✨ feat: 将 QR 码生成迁移到 Edge Function，消除后端冷启动延迟

- 在 Edge Function 中内联 qrcode-generator 库（~20KB），直接生成 QR 码
- 删除废弃的 Netlify Function (qrcode-generate.js)
- 更新 server.js 移除对已删除函数的引用
- 更新测试文件适配新的 Edge 内联架构

* ♻️ refactor: 代码质量修复 — 移除死代码、消除变量遮蔽、添加交叉引用注释

* 🔧 chore: 修复非阻塞风险 — 补充 strict 模式、移除废弃 qrcode 依赖

- Edge Function qrcode-lib.js 补充 'use strict' 声明，与浏览器版保持一致
- 移除已废弃的 qrcode npm 依赖（原用于已删除的 Netlify Function）

* ♻️ refactor: 消除魔法数字、补充脆耦合和 async 技术债注释

- Edge Function 中 QR margin 魔法数字 8 替换为 QR_MARGIN_MODULES 常量
- generateQRCodeLocal 补充 async 无 await 的技术债说明
- error.message.startsWith 条件补充校验函数耦合关系注释

* 🐛 fix: 修复边界条件 — null JSON body、vendor 字符串异常、CDN preconnect 残留

- Edge Function: null JSON body 解构移到 try/catch 内，添加 null/非对象检查
- qrcode-generator: 库 throw 字符串时统一转换为 Error 对象，避免 .startsWith 崩溃
- index.html: 移除不再需要的 CDN preconnect 提示（jsdelivr/cdnjs）

* ♻️ refactor: 修复 CSP 恢复、异常归一化、自定义 Error 类、负面路径测试

- netlify.toml: 恢复 script-src 中 cdn.jsdelivr.net（Bootstrap JS 仍依赖）
- Edge Function catch: 归一化非 Error 异常（库可能 throw 字符串）
- Edge Function QR margin: createDataURL(cellSize, 2) → createDataURL(cellSize, cellSize * 2) 对齐模块边距
- Edge Function: 补充认证模型和 QR 格式变更注释
- qrcode-generator.js: 引入 QRCodeValidationError 替代 error.message.startsWith 脆耦合
- tests/bff-proxy: 添加 6 个 Edge QR 负面路径测试（无效 JSON、空/超长/非字符串 data、超范围 size）
- tests/qrcode-generator: 添加库 throw 字符串异常的测试
- scripts/sync-qrcode-lib.js: 新增库代码同步验证脚本

* 🐛 fix: 修复 server.js CSP 缺少 jsdelivr、同步脚本 CRLF 归一化、fallback 拦截校验错误

- server.js: 恢复 script-src 中 cdn.jsdelivr.net（本地开发 Bootstrap JS 依赖）
- sync-qrcode-lib.js: 归一化 CRLF 换行符避免跨平台误报
- qrcode-generator.js: generateQRCodeWithFallback 入口处拦截 QRCodeValidationError，避免无效输入触发无意义的后端降级
 2026-06-25 22:15:17 +08:00
dependabot[bot]
04b77f59b8 build(deps-dev): bump @babel/core from 7.29.0 to 7.29.6 (#82) 
Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.29.0 to 7.29.6.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-version: 7.29.6
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-23 12:32:02 +08:00
Neo Vern
e506906f75 Merge pull request #78 from Silentely/dependabot/npm_and_yarn/multi-a23dd1c932 
build(deps): bump @opentelemetry/core and @sentry/node
 2026-06-23 12:29:07 +08:00
dependabot[bot]
30f5def8b2 build(deps): bump undici from 7.24.1 to 7.28.0 (#80) 
Bumps [undici](https://github.com/nodejs/undici) from 7.24.1 to 7.28.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v7.24.1...v7.28.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.28.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-23 12:28:28 +08:00
Neo Vern
f2f80359c3 Merge pull request #79 from Silentely/dependabot/npm_and_yarn/http-proxy-middleware-3.0.7 
build(deps-dev): bump http-proxy-middleware from 3.0.5 to 3.0.7
 2026-06-23 12:27:32 +08:00
dependabot[bot]
3019c0e89f build(deps): bump form-data from 4.0.5 to 4.0.6 (#81) 
Bumps [form-data](https://github.com/form-data/form-data) from 4.0.5 to 4.0.6.
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6)

---
updated-dependencies:
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-23 12:26:57 +08:00
dependabot[bot]
f94269ecd3 build(deps-dev): bump http-proxy-middleware from 3.0.5 to 3.0.7 
Bumps [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) from 3.0.5 to 3.0.7.
- [Release notes](https://github.com/chimurai/http-proxy-middleware/releases)
- [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v3.0.7/CHANGELOG.md)
- [Commits](https://github.com/chimurai/http-proxy-middleware/compare/v3.0.5...v3.0.7)

---
updated-dependencies:
- dependency-name: http-proxy-middleware
  dependency-version: 3.0.7
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-20 10:31:01 +00:00
dependabot[bot]
943901a567 build(deps): bump @opentelemetry/core and @sentry/node 
Bumps [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) to 2.8.0 and updates ancestor dependency [@sentry/node](https://github.com/getsentry/sentry-javascript). These dependencies need to be updated together.


Updates `@opentelemetry/core` from 2.5.1 to 2.8.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-js/compare/v2.5.1...v2.8.0)

Updates `@sentry/node` from 10.39.0 to 10.58.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-javascript/compare/10.39.0...10.58.0)

---
updated-dependencies:
- dependency-name: "@opentelemetry/core"
  dependency-version: 2.8.0
  dependency-type: indirect
- dependency-name: "@sentry/node"
  dependency-version: 10.58.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-17 16:02:37 +00:00
dependabot[bot]
8c779bbc03 build(deps-dev): bump esbuild from 0.25.12 to 0.28.1 
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.25.12 to 0.28.1.
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](https://github.com/evanw/esbuild/compare/v0.25.12...v0.28.1)

---
updated-dependencies:
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-13 12:35:27 +00:00
Abner
f5c5dee5ab 🐛 fix: 修复 Session 恢复后二维码和 LPA 不显示的问题 
问题：
- 用户完成 eSIM 激活后，因外部二维码服务不可用导致页面空白
- Session 恢复时未调用 showESimResult() 显示二维码和 LPA 信息

解决方案：
1. 新增通用二维码生成模块 (src/js/modules/qrcode-generator.js)
   - 实现三层降级策略：本地 CDN → 后端 Function → 文本提示
   - 消除对外部服务的依赖，提升隐私保护

2. 新增后端 Function (netlify/functions/qrcode-generate.js)
   - POST /bff/qrcode-generate 接口
   - 返回 base64 编码的 PNG 二维码
   - withAuth 中间件保护 + 输入验证

3. 重构前端二维码生成逻辑
   - Giffgaff/Simyo 统一使用 generateQRCodeWithFallback()
   - 保留并发调用防护和 tooltip 交互
   - 使用 i18n 翻译替代硬编码错误提示

4. 修复 Session 恢复逻辑
   - 在 handleSessionRestore() 中调用 showESimResult()
   - 确保刷新页面后二维码和 LPA 正常显示

技术改进：
- 懒加载 qrcode.js（~13KB gzip），仅在首次调用时加载
- 完整的测试覆盖（前端单元测试 + 后端安全测试）
- 更新 BFF 路由配置（Edge Function + 本地开发服务器）

Closes #75
 2026-06-13 19:20:22 +08:00
dependabot[bot]
31098270d2 build(deps): bump axios from 1.15.2 to 1.16.0 
Bumps [axios](https://github.com/axios/axios) from 1.15.2 to 1.16.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.15.2...v1.16.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.16.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-29 16:23:07 +00:00
dependabot[bot]
67aa52db0e build(deps): bump qs and express 
Bumps [qs](https://github.com/ljharb/qs) to 6.15.2 and updates ancestor dependency [express](https://github.com/expressjs/express). These dependencies need to be updated together.


Updates `qs` from 6.14.2 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ljharb/qs/compare/v6.14.2...v6.15.2)

Updates `express` from 4.22.1 to 4.22.2
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/v4.22.2/History.md)
- [Commits](https://github.com/expressjs/express/compare/v4.22.1...v4.22.2)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.15.2
  dependency-type: indirect
- dependency-name: express
  dependency-version: 4.22.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-23 12:46:21 +00:00
dependabot[bot]
f638b4c59b build(deps): bump brace-expansion from 5.0.5 to 5.0.6 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.5 to 5.0.6.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.5...v5.0.6)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-18 18:47:38 +00:00
Abner
63997e4bcb ♻️ refactor: 使用可选链和空值合并运算符优化代码安全性 
- 在 cookie-handler.js 中使用 `err?.message` 替代 `err && err.message`，提升错误信息获取的代码简洁性和安全性
- 在 giffgaff-app.js 中将多个 `(error && error.message) || ''` 形式的表达式替换为 `error?.message ?? ''`，统一代码风格并增强空值处理
- 在 esim-service.js 中多处使用可选链操作符（`?.`）替代多层属性访问的条件判断，防止因对象为 null 或 undefined 导致的运行时错误
- 在 giffgaff-app.js 和 esim-service.js 中将逻辑或（`||`）默认值替换为空值合并运算符（`??`），确保只有 null 或 undefined 时使用默认值，保留空字符串等有效 falsy 值
- 更新 package-lock.json 文件以反映依赖关系的变化
 2026-05-16 21:15:48 +08:00
Abner
d3c418f9f3 Merge pull request #46 from Silentely/dependabot/npm_and_yarn/fast-uri-3.1.2 
build(deps-dev): bump fast-uri from 3.1.0 to 3.1.2
 2026-05-11 09:04:44 +08:00
dependabot[bot]
60e7470a4c build(deps): bump @babel/plugin-transform-modules-systemjs 
Bumps [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) from 7.29.0 to 7.29.4.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs)

---
updated-dependencies:
- dependency-name: "@babel/plugin-transform-modules-systemjs"
  dependency-version: 7.29.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-09 17:55:47 +00:00
dependabot[bot]
527e4fab49 build(deps-dev): bump fast-uri from 3.1.0 to 3.1.2 
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.0 to 3.1.2.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.2)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-09 02:29:50 +00:00
dependabot[bot]
63fa2bf3d6 build(deps): bump axios from 1.15.0 to 1.15.2 (#43) 
Bumps [axios](https://github.com/axios/axios) from 1.15.0 to 1.15.2.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.15.0...v1.15.2)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.15.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-06 18:40:59 +08:00
Abner
9cfa35adb3 🔧 chore: 修复 Dependabot 安全告警 
- postcss 升级至 8.5.10 (修复 XSS via unescaped </style>)
- uuid 升级至 14.0.0 (修复 buffer bounds check 缺失)
 2026-04-25 16:35:41 +08:00
Abner
8cb4d32419 🔧 chore: 更新 Jest 版本至 30.3.0 
- 将 package.json 中的 Jest 依赖版本从 ^30.2.0 升级至 ^30.3.0
- 自动更新 package-lock.json 以反映新的依赖锁定文件
- 保留其他开发依赖版本不变，仅针对 Jest 进行指定版本升级
 2026-04-23 18:06:52 +08:00
dependabot[bot]
e2991494a4 build(deps): bump follow-redirects from 1.15.11 to 1.16.0 (#40) 
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.11 to 1.16.0.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.15.11...v1.16.0)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-16 18:11:42 +08:00
dependabot[bot]
b631dbe356 build(deps): bump axios from 1.13.5 to 1.15.0 (#39) 
Bumps [axios](https://github.com/axios/axios) from 1.13.5 to 1.15.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.13.5...v1.15.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.15.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-13 18:17:12 +08:00
dependabot[bot]
dcd616525c build(deps-dev): bump lodash from 4.17.23 to 4.18.1 (#37) 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-06 18:16:18 +08:00
Abner
1db402a372 chore: 更新依赖版本并添加新依赖 
- 将 serialize-javascript 依赖版本从 ^7.0.3 更新到 ^7.0.5
- 新增 path-to-regexp 依赖，版本为 ^0.1.13
- 同步更新 package-lock.json 文件以反映依赖变更
 2026-03-29 22:03:32 +08:00
dependabot[bot]
c06208f987 build(deps): bump brace-expansion from 5.0.2 to 5.0.5 (#32) 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.2 to 5.0.5.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.2...v5.0.5)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-29 21:43:58 +08:00
dependabot[bot]
7eaac6faa2 build(deps): bump picomatch (#31) 
Bumps  and [picomatch](https://github.com/micromatch/picomatch). These dependencies needed to be updated together.

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2)

Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-26 21:48:20 +08:00
Abner
63320090bd chore: 更新 package-lock.json 
- 自动更新了 npm 依赖，导致 package-lock.json 文件发生变化。
- 这通常是由于运行 `npm install` 或 `npm update` 命令引起的。
 2026-03-19 19:22:42 +08:00
dependabot[bot]
5d8de92d9c build(deps-dev): bump svgo from 3.3.2 to 3.3.3 (#26) 
Bumps [svgo](https://github.com/svg/svgo) from 3.3.2 to 3.3.3.
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](https://github.com/svg/svgo/compare/v3.3.2...v3.3.3)

---
updated-dependencies:
- dependency-name: svgo
  dependency-version: 3.3.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-05 17:38:35 +08:00
Abner
7869a729c9 fix(deps): 修复 Dependabot 安全漏洞 
- serialize-javascript: 6.0.2 → ^7.0.3 (RCE 漏洞, GHSA #39)
- minimatch: ^10.2.2 → ^10.2.3 (ReDoS 漏洞, GHSA-7r86/GHSA-23c5)
- rollup: 2.79.2 → ^2.80.0 (路径遍历漏洞, GHSA-mw96)

通过 package.json overrides 强制版本提升，npm audit 0 漏洞
 2026-03-01 15:42:58 +08:00
dependabot[bot]
1e4f263dfe build(deps): bump minimatch from 10.2.2 to 10.2.4 (#24) 
Bumps [minimatch](https://github.com/isaacs/minimatch) from 10.2.2 to 10.2.4.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v10.2.2...v10.2.4)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 10.2.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-01 12:43:46 +08:00
dependabot[bot]
76ff22ac31 build(deps-dev): bump rollup from 2.79.2 to 2.80.0 (#25) 
Bumps [rollup](https://github.com/rollup/rollup) from 2.79.2 to 2.80.0.
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/v2.80.0/CHANGELOG.md)
- [Commits](https://github.com/rollup/rollup/compare/v2.79.2...v2.80.0)

---
updated-dependencies:
- dependency-name: rollup
  dependency-version: 2.80.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-01 12:43:34 +08:00
Abner
ea0d187acd fix(deps): 修复 Dependabot 安全漏洞 
- 添加 npm overrides 强制使用安全版本
  - minimatch: ^10.2.2 (修复 ReDoS 漏洞 CVE-2026-26996)
  - glob: ^11.1.0
- 更新 Jest 到 v30.2.0
- 漏洞数量: 31 → 0
 2026-02-21 17:14:45 +08:00
dependabot[bot]
4670e67360 build(deps): bump qs from 6.14.1 to 6.14.2 (#22) 
Bumps [qs](https://github.com/ljharb/qs) from 6.14.1 to 6.14.2.
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ljharb/qs/compare/v6.14.1...v6.14.2)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.14.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-21 16:29:16 +08:00
dependabot[bot]
3e159f4079 build(deps): bump axios from 1.13.2 to 1.13.5 (#21) 
Bumps [axios](https://github.com/axios/axios) from 1.13.2 to 1.13.5.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.13.2...v1.13.5)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.13.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-12 08:08:57 +08:00
dependabot[bot]
2698bb0acb build(deps-dev): bump webpack from 5.103.0 to 5.105.0 
升级 webpack 及相关依赖以修复已知问题并提升性能

主要变更：
- webpack: 5.103.0 → 5.105.0
- browserslist: 4.28.0 → 4.28.1
- enhanced-resolve: 5.18.3 → 5.19.0
- es-module-lexer: 1.7.0 → 2.0.0
- terser-webpack-plugin: 5.3.14 → 5.3.16
- watchpack: 2.4.4 → 2.5.1

改进内容：
- 修复 ESM 模块处理 bug
- 优化 import.meta.env 性能
- 改进 Worker 模块解析
- 更新 TypeScript 类型定义

安全审查：✅ 已通过所有安全检查
 2026-02-08 09:38:29 +08:00
dependabot[bot]
578cdc6076 build(deps): bump lodash from 4.17.21 to 4.17.23 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.21...4.17.23)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-23 21:36:44 +00:00