Fix Announcement Banner Dismissed & Add secrets in gitignore#3
Merged
Conversation
…istence - Wrap announcement banner in ClientOnly to prevent SSR/client hydration mismatch - Add hash-based dismissal tracking to persist state per unique announcement message - Add announcementReady flag with nextTick to ensure proper transition rendering - Replace simple boolean dismissal key with message-specific hash key in sessionStorage
florianjs
reviewed
Jan 5, 2026
Dim145
added a commit
to Dim145/opentracker
that referenced
this pull request
May 10, 2026
Six open Dependabot alerts, all transitive — five in doc/package-lock.json (florianjs#1–florianjs#5) and one in pnpm-lock.yaml (florianjs#6). Patched in two manifests: doc/ (vitepress / vite-based docs site): - Bump direct deps to latest minor: @tailwindcss/vite + tailwindcss 4.0 → 4.3.0, vitepress 1.5 → 1.6.4, vue 3.5 → 3.5.34. - Pin npm `overrides`: "esbuild": "^0.25.0" # CVE: dev-server CORS leak (florianjs#1, florianjs#6) "vite": "^7.3.3" # CVE: optimized-deps path traversal (florianjs#4) Vite 8 was tested but removes `transformWithEsbuild` which VitePress 1.x still imports — sticking on 7.3.x until the upstream migration to oxc lands. - The bump also pulls patched versions of preact (florianjs#2, JSON VNode injection), rollup (florianjs#3, arbitrary file write), and postcss (florianjs#5, XSS via stringify) transitively — all four cleared by the rebuild. Workspace root (pnpm): - Add `esbuild: "^0.25.0"` to `pnpm.overrides`. The vulnerable esbuild@0.18.20 was pinned by `@esbuild-kit/core-utils`, the legacy ESM loader pulled in by drizzle-kit; the override collapses every chain (drizzle-kit, vite, nitropack, tsx, vitest) onto esbuild@0.25.12 and drops 0.18.x from the lockfile entirely (florianjs#6). Verified: - `cd doc && npm audit` → "found 0 vulnerabilities" - `cd doc && npm run build` → builds in ~3s, all routes render - `docker build -f doc/Dockerfile doc` → image rebuilds clean - API rebuild + boot → drizzle-kit schema push still works (it was the heaviest user of @esbuild-kit/* on the workspace) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Before:
After:
