mirror of
https://github.com/agessaman/meshcore-bot.git
synced 2026-11-04 03:52:34 +00:00
agessaman
8d1c5ea9c0
Bootstrap 5.1.3, Font Awesome 6.0.0, Socket.IO 4.7.2 and Chart.js 4.4.0 are now served from static/vendor/ at the versions the CDNs served, so every page works on a LAN with no internet. Only map tiles still need it. The Content-Security-Policy drops jsDelivr and cdnjs. Every vendored package, the map stack and login fonts included, is pinned in scripts/web-vendor/package.json and its lockfile. sync.mjs copies the listed files into static/, strips the source-map comment, empties each directory it owns first, and regenerates the version table in static/vendor/README.md; it reproduces the previously vendored files byte for byte. Font Awesome ships only its woff2 fonts, which every supported browser takes before the .ttf. Dependabot watches that directory: security fixes as advisories land, grouped minor and patch releases monthly, majors one per PR. Dependabot can't regenerate the vendored files, so vendor-refresh.yml adds them to its PRs as a second commit and dispatches the tests, since a GITHUB_TOKEN push doesn't trigger them. It runs on pull_request_target, so it uses the base branch's sync.mjs, spells out its commands instead of running the PR's npm scripts, and installs with install scripts disabled. A new CI job re-runs the sync and fails if anything under static/ changes. Tests now check that no template loads a script, stylesheet or font from another host, that every vendored file a template names exists, and that the CSP allows no CDN host. In Chrome, 12 pages load with no external request, failed load or console error.
22 lines
682 B
JSON
22 lines
682 B
JSON
{
|
|
"name": "meshcore-bot-web-vendor",
|
|
"private": true,
|
|
"description": "Front-end libraries vendored into modules/web_viewer/static/. Run `npm run vendor` after changing a version.",
|
|
"scripts": {
|
|
"vendor": "npm ci --ignore-scripts --no-audit --no-fund && node sync.mjs"
|
|
},
|
|
"dependencies": {
|
|
"@fontsource-variable/dm-sans": "5.3.0",
|
|
"@fontsource-variable/outfit": "5.3.0",
|
|
"@fortawesome/fontawesome-free": "6.0.0",
|
|
"@maplibre/maplibre-gl-leaflet": "0.1.4",
|
|
"bootstrap": "5.1.3",
|
|
"chart.js": "4.4.0",
|
|
"js-sha256": "0.11.0",
|
|
"leaflet": "1.9.4",
|
|
"maplibre-gl": "5.6.0",
|
|
"socket.io-client": "4.7.2",
|
|
"vis-network": "9.1.9"
|
|
}
|
|
}
|