ae445097b0
npm audit stays clean (0 vulnerabilities). Checked every new db.prepare()/spawn()/ execFileSync() call added since the last audit for injection risk - none found, all parameterized SQL and array-form process args. Confirmed the CORS/security-header middleware still covers every route added since, including the new ones. One new notable finding: POST /api/update/run unconditionally stops the server before checking whether an update is even available, making it a more direct denial-of-service primitive than the app's other already-documented unauthenticated endpoints. No code change made - tracked alongside the deferred permissions/auth work. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
35 lines
1.2 KiB
JSON
35 lines
1.2 KiB
JSON
{
|
|
"name": "rc-racecore",
|
|
"version": "1.21.1",
|
|
"private": true,
|
|
"description": "RC RaceCore live timing and race control with AMMC ingest and SQLite persistence",
|
|
"engines": {
|
|
"node": ">=22 <27",
|
|
"npm": ">=10"
|
|
},
|
|
"allowScripts": {
|
|
"better-sqlite3": true
|
|
},
|
|
"scripts": {
|
|
"preinstall": "node scripts/preinstall.js",
|
|
"postinstall": "node scripts/verify-install.js",
|
|
"start": "node scripts/serverctl.js start",
|
|
"start:fg": "node server.js",
|
|
"stop": "node scripts/serverctl.js stop",
|
|
"status": "node scripts/serverctl.js status",
|
|
"restart": "node scripts/serverctl.js restart",
|
|
"update": "node scripts/serverctl.js update",
|
|
"verify": "node scripts/verify-install.js",
|
|
"backup:restore": "node scripts/restore-backup.js",
|
|
"audit:prod": "npm audit --omit=dev",
|
|
"test": "node --experimental-default-type=module tests/run.js",
|
|
"test:browser": "node --experimental-default-type=module tests/browser_smoke.js",
|
|
"setup:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File windows/setup.ps1"
|
|
},
|
|
"dependencies": {
|
|
"better-sqlite3": "^12.11.1",
|
|
"express": "5.2.1",
|
|
"qrcode": "^1.5.4"
|
|
}
|
|
}
|