3 commits

Author	SHA1	Message	Date
Bruno Postle	950349941c	forgejo: add @thatopen/components-front, fix click-to-identify and model overview ... Bundle OBCF (components-front) alongside OBC so Highlighter is sourced from the correct package. Update click handler to use item.getGuid() — GlobalId is no longer in the attributes map in fragments 3.4.x. Fix populateMetaPanel crash (ClassificationGroupData now wraps ids in a .map property, not a plain object). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-28 00:01:19 +01:00
Bruno Postle	fce198580a	viewer: upgrade three/web-ifc/@thatopen to latest — partial CVE fix ... three 0.177→0.184, web-ifc 0.0.75→0.0.77, @thatopen/components 3.3.1→3.4.2, @thatopen/fragments 3.3.1→3.4.3, + new camera-controls 3.1.2 peer dep. Reduces fast-xml-parser findings from 2 critical to 1 high + 1 low; remaining issues are upstream in @thatopen >= 3.3.3 with no fix released yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-25 18:59:02 +01:00
Bruno Postle	4ef7987ad1	viewer: bundle JS deps locally — removes all CDN dependencies ... Replace importmap pointing at esm.sh/unpkg with locally-bundled files built from pinned npm packages (package.json + lockfile). Run `cd forgejo && npm install && npm run build` to regenerate after a version bump. Tracked in ifcurl-dkz: fast-xml-parser CVEs in @thatopen/components 3.3.1 should be addressed in a follow-up upgrade. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-25 18:24:50 +01:00