package.json

{
  "name": "rrweb-stack",
  "version": "0.0.0",
  "private": true,
  "description": "Two-product OSS initiative: tracelane + peek.",
  "license": "Apache-2.0",
  "packageManager": "pnpm@9.14.4",
  "engines": {
    "node": ">=22.0.0"
  },
  "repository": {
    "type": "git",
    "url": "https://github.com/Cubenest/rrweb-stack"
  },
  "bugs": {
    "url": "https://github.com/Cubenest/rrweb-stack/issues"
  },
  "publishConfig": {
    "access": "public"
  },
  "scripts": {
    "build": "pnpm -r build",
    "test": "pnpm -r test",
    "lint": "biome check .",
    "lint:fix": "biome check --write .",
    "typecheck": "pnpm -r typecheck",
    "verify:plugin": "node packages/docs-shared/scripts/check-plugin.mjs",
    "changeset": "changeset",
    "version": "changeset version && biome check --write . && pnpm install --lockfile-only",
    "release": "pnpm build && changeset publish"
  },
  "devDependencies": {
    "@biomejs/biome": "^1.9.4",
    "@changesets/cli": "^2.27.10",
    "lefthook": "^2.1.9",
    "typescript": "^6.0.3",
    "vitest": "^3.2.6"
  },
  "pnpm": {
    "onlyBuiltDependencies": ["better-sqlite3"],
    "//overrides": "vite-node is pinned to the 3.x line shared by vitest@3 and WXT 0.20. @vitejs/plugin-react is pinned to 5.x but SCOPED to @wxt-dev/module-react — plugin-react 6 imports `vite/internal` (vite 7+ only) while WXT 0.20 stays on the Vite-6 line, so the global pin would break; scoping it leaves the todomvc demo (Vite 8) on plugin-react 6. The serialize-javascript and tmp overrides patch two high-severity dev-only transitive CVEs (GHSA-5c6j-r48x-rmvq via mocha 10.8 → serialize-javascript 6.0.2; GHSA-ph9p-34f9-6g65 via wxt 0.20 → web-ext-run → tmp 0.2.5) (Phase 4a, 2026-05-28). Phase 4b OSV patches (2026-06-27): yaml 2.9.0 (GHSA-48c2-rrv3-qjmp); uuid 11.1.1 (GHSA-w5hq-g745-h8pq, dev-only via wxt→web-ext-run); shell-quote 1.8.4 (GHSA-w7jw-789q-3m8p CRITICAL, dev-only); form-data 4.0.6 (GHSA-hmw2-7cc7-3qxx, dev-only via jsdom); hono 4.12.25 (GHSA-88fw-hqm2-52qc + others; runtime via @modelcontextprotocol/sdk). The astro 5→6 / vitest 2→3 major bump (2026-06-30) folded in the rest: the js-yaml overrides clear GHSA-h67p-54hq-rp68 WITHIN the 3.x line — js-yaml@3 → 3.15.0 keeps `safeLoad` for @changesets/cli's read-yaml-file (no 4.x force, release tooling unaffected), js-yaml@4 → 4.2.0 for the astro markdown-remark copy. vite reaches 6.4.3 (GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3) via peek-extension's direct `vite` dep rather than a `vite@6` override — the override rewrote the vite peer of vitefu / @tailwindcss-vite and broke strict-peer once astro@6 (Vite 7) and the demo (Vite 8) entered the tree. esbuild stays an accepted dev-only residual: a global 0.28.1 pin breaks the WXT MV3 build (esbuild 0.28 cannot lower for-of destructuring to the chrome87/es2020 target), and GHSA-67mh-4wv8-2f99 / GHSA-g7r4-m6w7-qqqr are esbuild-dev-server-only (never invoked in this build-only pipeline).",
    "overrides": {
      "vite-node": "^3.2.4",
      "@wxt-dev/module-react>@vitejs/plugin-react": "^5.0.4",
      "serialize-javascript": "^7.0.3",
      "tmp": "^0.2.6",
      "yaml": "^2.9.0",
      "uuid": "^11.1.1",
      "shell-quote": "^1.8.4",
      "form-data": "^4.0.6",
      "hono": "^4.12.25",
      "js-yaml@3": "^3.15.0",
      "js-yaml@4": "^4.2.0"
    }
  }
}