bruno/ifcurl
1
0
Fork 0
mirror of https://github.com/brunopostle/ifcurl.git synced 2026-07-12 10:18:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
ifcurl/forgejo/package-lock.json

745 lines
24 KiB
JSON
Raw Normal View History

viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
{
"name": "ifcurl-viewer",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "ifcurl-viewer",
"dependencies": {
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"@thatopen/components": "3.4.2",
forgejo: add @thatopen/components-front, fix click-to-identify and model overview Bundle OBCF (components-front) alongside OBC so Highlighter is sourced from the correct package. Update click handler to use item.getGuid() — GlobalId is no longer in the attributes map in fragments 3.4.x. Fix populateMetaPanel crash (ClassificationGroupData now wraps ids in a .map property, not a plain object). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-28 00:01:19 +01:00
"@thatopen/components-front": "^3.4.2",
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"@thatopen/fragments": "3.4.3",
"camera-controls": "3.1.2",
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
"jszip": "3.10.1",
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"three": "0.184.0",
"web-ifc": "0.0.77"
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
},
"devDependencies": {
"esbuild": "^0.25.0"
}
},
"node_modules/@esbuild/aix-ppc64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
"integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
"cpu": [
"ppc64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"aix"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/android-arm": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
"integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
"cpu": [
"arm"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"android"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/android-arm64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
"integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"android"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/android-x64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
"integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"android"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/darwin-arm64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
"integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/darwin-x64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
"integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/freebsd-arm64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
"integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"freebsd"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/freebsd-x64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
"integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"freebsd"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/linux-arm": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
"integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
"cpu": [
"arm"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/linux-arm64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
"integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/linux-ia32": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
"integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
"cpu": [
"ia32"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/linux-loong64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
"integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
"cpu": [
"loong64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/linux-mips64el": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
"integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
"cpu": [
"mips64el"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/linux-ppc64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
"integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
"cpu": [
"ppc64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/linux-riscv64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
"integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
"cpu": [
"riscv64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/linux-s390x": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
"integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
"cpu": [
"s390x"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/linux-x64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
"integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/netbsd-arm64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
"integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"netbsd"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/netbsd-x64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
"integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"netbsd"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/openbsd-arm64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
"integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"openbsd"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/openbsd-x64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
"integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"openbsd"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/openharmony-arm64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
"integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"openharmony"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/sunos-x64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
"integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"sunos"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/win32-arm64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
"integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/win32-ia32": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
"integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
"cpu": [
"ia32"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@esbuild/win32-x64": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
"integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": ">=18"
}
},
"node_modules/@thatopen/components": {
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"version": "3.4.2",
"resolved": "https://registry.npmjs.org/@thatopen/components/-/components-3.4.2.tgz",
"integrity": "sha512-c+PLlXRoC0gAhqeYLelLAc0dTEHsiv9DSMlBh1THsxC1Y8Pro+E/RlKh3KdgtcZpbThVBJm9JDzgqEt7oXJRbA==",
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
"license": "MIT",
"dependencies": {
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"fast-xml-parser": "5.3.7",
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
"jszip": "3.10.1",
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"three-mesh-bvh": "0.9.9"
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
},
"peerDependencies": {
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"@thatopen/fragments": "~3.4.0",
"camera-controls": ">=3.1.2",
"three": ">=0.182.0",
"web-ifc": ">=0.0.77"
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
}
},
forgejo: add @thatopen/components-front, fix click-to-identify and model overview Bundle OBCF (components-front) alongside OBC so Highlighter is sourced from the correct package. Update click handler to use item.getGuid() — GlobalId is no longer in the attributes map in fragments 3.4.x. Fix populateMetaPanel crash (ClassificationGroupData now wraps ids in a .map property, not a plain object). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-28 00:01:19 +01:00
"node_modules/@thatopen/components-front": {
"version": "3.4.2",
"resolved": "https://registry.npmjs.org/@thatopen/components-front/-/components-front-3.4.2.tgz",
"integrity": "sha512-Mac9dbxFE5fW4KIp9hPfS30+v2ySFtOHUjpl5VORTvgnlv2x9VVEdYsFV/K3xVOTXoxvsCtnU8sGbyTH8noYUA==",
"license": "MIT",
"dependencies": {
"@thatopen/components": "~3.4.0",
"earcut": "^3.0.1"
},
"peerDependencies": {
"@thatopen/fragments": "~3.4.0",
"three": ">=0.182.0",
"web-ifc": ">=0.0.77"
}
},
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
"node_modules/@thatopen/fragments": {
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"version": "3.4.3",
"resolved": "https://registry.npmjs.org/@thatopen/fragments/-/fragments-3.4.3.tgz",
"integrity": "sha512-GKquJNEu5mBQcxrUDE0uGVPpysb6+6ZYIIhTKvYhlciwcKWZMRCYkeMI6OgW8194WQwiStBAGs/bjshj23ivLg==",
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
"license": "MIT",
"dependencies": {
"earcut": "^3.0.1",
"flatbuffers": "25.2.10",
"lru-cache": "11.1.0",
"pako": "2.1.0"
},
"peerDependencies": {
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"three": ">=0.182.0",
"web-ifc": ">=0.0.77"
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
}
},
"node_modules/camera-controls": {
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"version": "3.1.2",
"resolved": "https://registry.npmjs.org/camera-controls/-/camera-controls-3.1.2.tgz",
"integrity": "sha512-xkxfpG2ECZ6Ww5/9+kf4mfg1VEYAoe9aDSY+IwF0UEs7qEzwy0aVRfs2grImIECs/PoBtWFrh7RXsQkwG922JA==",
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
"license": "MIT",
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"engines": {
"node": ">=22.0.0",
"npm": ">=10.5.1"
},
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
"peerDependencies": {
"three": ">=0.126.1"
}
},
"node_modules/core-util-is": {
"version": "1.0.3",
"resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
"integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
"license": "MIT"
},
"node_modules/earcut": {
"version": "3.0.2",
"resolved": "https://registry.npmjs.org/earcut/-/earcut-3.0.2.tgz",
"integrity": "sha512-X7hshQbLyMJ/3RPhyObLARM2sNxxmRALLKx1+NVFFnQ9gKzmCrxm9+uLIAdBcvc8FNLpctqlQ2V6AE92Ol9UDQ==",
"license": "ISC"
},
"node_modules/esbuild": {
"version": "0.25.12",
"resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
"integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
"dev": true,
"hasInstallScript": true,
"license": "MIT",
"bin": {
"esbuild": "bin/esbuild"
},
"engines": {
"node": ">=18"
},
"optionalDependencies": {
"@esbuild/aix-ppc64": "0.25.12",
"@esbuild/android-arm": "0.25.12",
"@esbuild/android-arm64": "0.25.12",
"@esbuild/android-x64": "0.25.12",
"@esbuild/darwin-arm64": "0.25.12",
"@esbuild/darwin-x64": "0.25.12",
"@esbuild/freebsd-arm64": "0.25.12",
"@esbuild/freebsd-x64": "0.25.12",
"@esbuild/linux-arm": "0.25.12",
"@esbuild/linux-arm64": "0.25.12",
"@esbuild/linux-ia32": "0.25.12",
"@esbuild/linux-loong64": "0.25.12",
"@esbuild/linux-mips64el": "0.25.12",
"@esbuild/linux-ppc64": "0.25.12",
"@esbuild/linux-riscv64": "0.25.12",
"@esbuild/linux-s390x": "0.25.12",
"@esbuild/linux-x64": "0.25.12",
"@esbuild/netbsd-arm64": "0.25.12",
"@esbuild/netbsd-x64": "0.25.12",
"@esbuild/openbsd-arm64": "0.25.12",
"@esbuild/openbsd-x64": "0.25.12",
"@esbuild/openharmony-arm64": "0.25.12",
"@esbuild/sunos-x64": "0.25.12",
"@esbuild/win32-arm64": "0.25.12",
"@esbuild/win32-ia32": "0.25.12",
"@esbuild/win32-x64": "0.25.12"
}
},
"node_modules/fast-xml-parser": {
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"version": "5.3.7",
"resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.7.tgz",
"integrity": "sha512-JzVLro9NQv92pOM/jTCR6mHlJh2FGwtomH8ZQjhFj/R29P2Fnj38OgPJVtcvYw6SuKClhgYuwUZf5b3rd8u2mA==",
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/NaturalIntelligence"
}
],
"license": "MIT",
"dependencies": {
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"strnum": "^2.1.2"
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
},
"bin": {
"fxparser": "src/cli/cli.js"
}
},
"node_modules/flatbuffers": {
"version": "25.2.10",
"resolved": "https://registry.npmjs.org/flatbuffers/-/flatbuffers-25.2.10.tgz",
"integrity": "sha512-7JlN9ZvLDG1McO3kbX0k4v+SUAg48L1rIwEvN6ZQl/eCtgJz9UylTMzE9wrmYrcorgxm3CX/3T/w5VAub99UUw==",
"license": "Apache-2.0"
},
"node_modules/immediate": {
"version": "3.0.6",
"resolved": "https://registry.npmjs.org/immediate/-/immediate-3.0.6.tgz",
"integrity": "sha512-XXOFtyqDjNDAQxVfYxuF7g9Il/IbWmmlQg2MYKOH8ExIT1qg6xc4zyS3HaEEATgs1btfzxq15ciUiY7gjSXRGQ==",
"license": "MIT"
},
"node_modules/inherits": {
"version": "2.0.4",
"resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
"integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
"license": "ISC"
},
"node_modules/isarray": {
"version": "1.0.0",
"resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
"integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
"license": "MIT"
},
"node_modules/jszip": {
"version": "3.10.1",
"resolved": "https://registry.npmjs.org/jszip/-/jszip-3.10.1.tgz",
"integrity": "sha512-xXDvecyTpGLrqFrvkrUSoxxfJI5AH7U8zxxtVclpsUtMCq4JQ290LY8AW5c7Ggnr/Y/oK+bQMbqK2qmtk3pN4g==",
"license": "(MIT OR GPL-3.0-or-later)",
"dependencies": {
"lie": "~3.3.0",
"pako": "~1.0.2",
"readable-stream": "~2.3.6",
"setimmediate": "^1.0.5"
}
},
"node_modules/jszip/node_modules/pako": {
"version": "1.0.11",
"resolved": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz",
"integrity": "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw==",
"license": "(MIT AND Zlib)"
},
"node_modules/lie": {
"version": "3.3.0",
"resolved": "https://registry.npmjs.org/lie/-/lie-3.3.0.tgz",
"integrity": "sha512-UaiMJzeWRlEujzAuw5LokY1L5ecNQYZKfmyZ9L7wDHb/p5etKaxXhohBcrw0EYby+G/NA52vRSN4N39dxHAIwQ==",
"license": "MIT",
"dependencies": {
"immediate": "~3.0.5"
}
},
"node_modules/lru-cache": {
"version": "11.1.0",
"resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.1.0.tgz",
"integrity": "sha512-QIXZUBJUx+2zHUdQujWejBkcD9+cs94tLn0+YL8UrCh+D5sCXZ4c7LaEH48pNwRY3MLDgqUFyhlCyjJPf1WP0A==",
"license": "ISC",
"engines": {
"node": "20 || >=22"
}
},
"node_modules/pako": {
"version": "2.1.0",
"resolved": "https://registry.npmjs.org/pako/-/pako-2.1.0.tgz",
"integrity": "sha512-w+eufiZ1WuJYgPXbV/PO3NCMEc3xqylkKHzp8bxp1uW4qaSNQUkwmLLEc3kKsfz8lpV1F8Ht3U1Cm+9Srog2ug==",
"license": "(MIT AND Zlib)"
},
"node_modules/process-nextick-args": {
"version": "2.0.1",
"resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
"integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
"license": "MIT"
},
"node_modules/readable-stream": {
"version": "2.3.8",
"resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
"integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
"license": "MIT",
"dependencies": {
"core-util-is": "~1.0.0",
"inherits": "~2.0.3",
"isarray": "~1.0.0",
"process-nextick-args": "~2.0.0",
"safe-buffer": "~5.1.1",
"string_decoder": "~1.1.1",
"util-deprecate": "~1.0.1"
}
},
"node_modules/safe-buffer": {
"version": "5.1.2",
"resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
"integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
"license": "MIT"
},
"node_modules/setimmediate": {
"version": "1.0.5",
"resolved": "https://registry.npmjs.org/setimmediate/-/setimmediate-1.0.5.tgz",
"integrity": "sha512-MATJdZp8sLqDl/68LfQmbP8zKPLQNV6BIZoIgrscFDQ+RsvK/BxeDQOgyxKKoh0y/8h3BqVFnCqQ/gd+reiIXA==",
"license": "MIT"
},
"node_modules/string_decoder": {
"version": "1.1.1",
"resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
"integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
"license": "MIT",
"dependencies": {
"safe-buffer": "~5.1.0"
}
},
"node_modules/strnum": {
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"version": "2.2.3",
"resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.3.tgz",
"integrity": "sha512-oKx6RUCuHfT3oyVjtnrmn19H1SiCqgJSg+54XqURKp5aCMbrXrhLjRN9TjuwMjiYstZ0MzDrHqkGZ5dFTKd+zg==",
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/NaturalIntelligence"
}
],
"license": "MIT"
},
"node_modules/three": {
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"version": "0.184.0",
"resolved": "https://registry.npmjs.org/three/-/three-0.184.0.tgz",
"integrity": "sha512-wtTRjG92pM5eUg/KuUnHsqSAlPM296brTOcLgMRqEeylYTh/CdtvKUvCyyCQTzFuStieWxvZb8mVTMvdPyUpxg==",
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
"license": "MIT"
},
"node_modules/three-mesh-bvh": {
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"version": "0.9.9",
"resolved": "https://registry.npmjs.org/three-mesh-bvh/-/three-mesh-bvh-0.9.9.tgz",
"integrity": "sha512-FJKitcjvbALmeQRK+Sc+nLGorCpkrZBrbgJZFzhdyWboak37DZikn46hvQkNqSbJPm227ahYmS6k3N/GXaAyXw==",
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
"license": "MIT",
"peerDependencies": {
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"three": ">= 0.159.0"
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
}
},
"node_modules/util-deprecate": {
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
"integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
"license": "MIT"
},
"node_modules/web-ifc": {
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:59:02 +01:00
"version": "0.0.77",
"resolved": "https://registry.npmjs.org/web-ifc/-/web-ifc-0.0.77.tgz",
"integrity": "sha512-VzQ0W/Iiqbidxn1ECUvz6qJ6p2sXBVNcOsUOBCETzy77psAH6yFLKQm74aXabkx3JH4OvFVHe8k1qS6+Z2zl1w==",
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-25 18:24:50 +01:00
"license": "MPL-2.0"
}
}
}
Reference in a new issue Copy permalink