Dmitry VerkhoturovandGitHub
fb7b6c2cdd
* Serve the build-independent web assets from the backend `privacy.html`, `markdown-help.html` and the `400x400.jpeg` it embeds carry no template variable, link no script or stylesheet, and are imported by nothing in the widget. They now live in `backend/app/webassets/assets`, embedded there, and are served under `/web` alongside the frontend build. `/web` reads the frontend build first and falls back to them, which is what lets an operator replace one by dropping a file into `--web-root`. That is what `privacy.html` needs: it describes remark42.com, while the authorization guide tells operators to hand its URL to Google and Facebook as their own application's privacy policy. Only a missing file falls through. An unreadable file in the web root keeps reporting as unreadable rather than being silently replaced by the embedded copy, and a name the filesystem rejects reports as missing rather than as a server error, both matching what `http.Dir` did. The dev server serves the same directory, so the Markdown help link in the comment form resolves on the dev port as well as in production. The two pages are served as they are written. `markdown-help.html` was minified before, and its formatted inline stylesheet is most of its 8.5 kB; that is 2.4 kB more over the wire, behind the hour-long cache header the file server already sets. Drops `copy-webpack-plugin`, which had no other pattern, and the stylelint entries that only ever matched these files. * Make pnpm dev:app start again The dev server has been failing to start on two counts, so the flow the contributing guide documents does not run at all. `webpack-cli` 4 drives `webpack-dev-server` 5 through the argument order of an older major, handing it the compiler where it expects the options object. It rejects that against its schema and exits, complaining about an unknown `_assetEmittingPreviousFiles` property, which is a field of the compiler. `webpack-cli` 7 is the release that declares `webpack-dev-server` 5 as a peer. Past that, `http-proxy-middleware` resolves to 4.1.1, which no longer accepts the two-argument call `webpack-dev-server` makes, so the `/api` and `/auth` proxies throw on startup. It is pulled in by the security override for CVE-2025-32996, the only override in the file with no upper bound: `>=2.0.10` matches every later major. Bounding it to the 2.x line keeps the fix and the API `webpack-dev-server` calls. With both in place `pnpm dev:app` serves the widget and the pages under `/web` on port 9000.
92 lines
3.5 KiB
JSON
92 lines
3.5 KiB
JSON
{
|
|
"name": "remark42",
|
|
"version": "0.0.0",
|
|
"description": "Frontend related code for Remark42",
|
|
"keywords": [
|
|
"remark42",
|
|
"comments",
|
|
"comment engine",
|
|
"commenting"
|
|
],
|
|
"scripts": {
|
|
"prepare": "if [ -z \"$CI\" ]; then cd .. && husky install frontend/.husky; else echo \"Skip Husky Hooks\"; fi",
|
|
"lint-staged": "lint-staged",
|
|
"dev:app": "pnpm --filter @remark42/app dev"
|
|
},
|
|
"packageManager": "pnpm@10.10.0",
|
|
"devDependencies": {
|
|
"husky": "^8.0.1",
|
|
"lint-staged": "^13.0.3"
|
|
},
|
|
"pnpm": {
|
|
"overrides": {
|
|
"decode-uri-component@<0.2.1": ">=0.2.1",
|
|
"loader-utils@>=2.0.0 <2.0.3": ">=2.0.3 <3.0.0",
|
|
"loader-utils@>=2.0.0 <2.0.4": ">=2.0.4 <3.0.0",
|
|
"json5@<1.0.2": ">=1.0.2",
|
|
"json5@>=2.0.0 <2.2.2": ">=2.2.2",
|
|
"tough-cookie@<4.1.3": ">=4.1.3",
|
|
"micromatch@<4.0.8": ">=4.0.8",
|
|
"esbuild@<=0.24.2": ">=0.25.0",
|
|
"word-wrap@<1.2.4": ">=1.2.4",
|
|
"cookie@<0.7.0": ">=0.7.0",
|
|
"@babel/runtime-corejs3@<7.26.10": ">=7.26.10 <8.0.0",
|
|
"@babel/runtime@<7.26.10": ">=7.26.10 <8.0.0",
|
|
"@babel/helpers@<7.26.10": ">=7.26.10 <8.0.0",
|
|
"cross-spawn@<6.0.6": ">=6.0.6",
|
|
"cross-spawn@>=7.0.0 <7.0.5": ">=7.0.5",
|
|
"tmp@<=0.2.3": ">=0.2.4",
|
|
"form-data@>=4.0.0 <4.0.4": ">=4.0.4",
|
|
"nanoid@>=4.0.0 <5.0.9": ">=5.0.9",
|
|
"glob@>=10.2.0 <10.5.0": ">=10.5.0 <11.0.0",
|
|
"diff@>=4.0.0 <4.0.4": ">=4.0.4",
|
|
"semver@>=2.0.0-alpha <5.7.2": ">=5.7.2",
|
|
"semver@>=7.0.0 <7.5.2": ">=7.5.2",
|
|
"semver@>=6.0.0 <6.3.1": ">=6.3.1",
|
|
"serialize-javascript@<=7.0.2": ">=7.0.3",
|
|
"flatted@<3.4.0": ">=3.4.0",
|
|
"flatted@<=3.4.1": ">=3.4.2",
|
|
"lodash-es@>=4.0.0 <=4.17.23": ">=4.18.0",
|
|
"lodash@>=4.0.0 <=4.17.23": ">=4.18.0",
|
|
"lodash-es@<=4.17.23": ">=4.18.0",
|
|
"lodash@<=4.17.23": ">=4.18.0",
|
|
"serialize-javascript@>=6.0.0 <6.0.2": ">=6.0.2",
|
|
"@xmldom/xmldom@<0.8.12": ">=0.8.12",
|
|
"@babel/traverse@<7.23.2": ">=7.23.2 <8.0.0",
|
|
"@xmldom/xmldom@<0.8.13": ">=0.8.13",
|
|
"@tootallnate/once@<2.0.1": ">=2.0.1",
|
|
"serialize-javascript@>=5.0.0 <7.0.5": ">=7.0.5",
|
|
"uuid@<11.1.1": ">=11.1.1",
|
|
"@babel/plugin-transform-modules-systemjs@>=7.12.0 <=7.29.3": ">=7.29.4 <8.0.0",
|
|
"lodash@>=4.0.0 <=4.17.22": ">=4.17.23",
|
|
"shell-quote@>=1.1.0 <=1.8.3": ">=1.8.4",
|
|
"tmp@<0.2.6": ">=0.2.6",
|
|
"form-data@>=4.0.0 <4.0.6": ">=4.0.6",
|
|
"launch-editor@<=2.14.0": ">=2.14.1",
|
|
"@babel/core@<=7.29.0": ">=7.29.6 <8.0.0",
|
|
"webpack-dev-server@<5.2.6": ">=5.2.6 <6.0.0",
|
|
"http-proxy-middleware@>=0.16.0 <2.0.10": ">=2.0.10 <3.0.0",
|
|
"yaml@>=1.0.0 <2.0.0": ">=1.10.3 <2.0.0",
|
|
"yaml@>=2.0.0 <3.0.0": ">=2.9.0 <3.0.0",
|
|
"js-yaml@>=3.0.0 <4.0.0": ">=3.15.1 <4.0.0",
|
|
"js-yaml@>=4.0.0 <5.0.0": ">=5.2.2 <6.0.0",
|
|
"minimatch@>=3.0.0 <4.0.0": ">=3.1.3 <4.0.0",
|
|
"minimatch@>=9.0.0 <10.0.0": ">=9.0.7 <10.0.0",
|
|
"ajv@>=8.0.0 <9.0.0": ">=8.18.0 <9.0.0",
|
|
"ws@>=7.0.0 <8.0.0": ">=7.5.11 <8.0.0",
|
|
"ws@>=8.0.0 <9.0.0": ">=8.21.0 <9.0.0",
|
|
"brace-expansion@>=1.0.0 <2.0.0": ">=1.1.18 <2.0.0",
|
|
"brace-expansion@>=2.0.0 <3.0.0": ">=2.0.2 <3.0.0",
|
|
"brace-expansion@>=4.0.0 <6.0.0": ">=5.0.9 <6.0.0",
|
|
"fast-uri": ">=4.1.2 <5.0.0",
|
|
"nanoid@>=3.0.0 <4.0.0": ">=3.3.18 <4.0.0",
|
|
"postcss@<8.5.23": ">=8.5.23 <9.0.0",
|
|
"svgo": ">=4.0.2 <5.0.0",
|
|
"undici@>=7.0.0 <8.0.0": ">=7.29.0 <8.0.0",
|
|
"body-parser@<1.20.6": ">=1.20.6 <2.0.0",
|
|
"preact": "10.29.8",
|
|
"@types/minimatch": "5.1.2"
|
|
}
|
|
}
|
|
}
|