ifcurl/forgejo/package.json

{
  "name": "ifcurl-viewer",
  "private": true,
  "type": "module",
  "scripts": {
    "build": "node build.js"
  },
  "dependencies": {
    "@thatopen/components": "3.4.2",
    "@thatopen/fragments": "3.4.3",
    "camera-controls": "3.1.2",
    "jszip": "3.10.1",
    "three": "0.184.0",
    "web-ifc": "0.0.77"
  },
  "devDependencies": {
    "esbuild": "^0.25.0"
  }
}
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-04-25 18:24:50 +01:00			`{`
			`"name": "ifcurl-viewer",`
			`"private": true,`
			`"type": "module",`
			`"scripts": {`
			`"build": "node build.js"`
			`},`
			`"dependencies": {`
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-04-25 18:59:02 +01:00			`"@thatopen/components": "3.4.2",`
			`"@thatopen/fragments": "3.4.3",`
			`"camera-controls": "3.1.2",`
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-04-25 18:24:50 +01:00			`"jszip": "3.10.1",`
viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-04-25 18:59:02 +01:00			`"three": "0.184.0",`
			`"web-ifc": "0.0.77"`
viewer: bundle JS deps locally — removes all CDN dependencies Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-04-25 18:24:50 +01:00			`},`
			`"devDependencies": {`
			`"esbuild": "^0.25.0"`
			`}`
			`}`