sharang
cb91109b66
trivy fs scan failed the M0.2 CI gate on the skeleton commit because
next 15.0.3 has 9 known vulns (CRITICAL CVE-2025-29927 auth bypass in
middleware, plus 7 HIGH advisories). 16.2.6 is current latest and
covers every fixed-version range trivy listed.
Side effects of the major bump:
- next 16 dropped 'next lint' — switched the lint script to call eslint
directly ('eslint . --max-warnings 0').
- eslint-config-next 16 ships flat-config exports natively, so
eslint.config.mjs imports core-web-vitals + typescript directly
(no FlatCompat shim, no @eslint/eslintrc dep).
- Typed vi.fn<typeof fetch>() in tenant-registry.test to satisfy
stricter tuple inference under the new types.
All 4 gates green locally:
pnpm lint / typecheck / test --coverage (100% on src/lib) / build
Refs: M5.1 (skeleton)
44 lines
742 B
JSON
44 lines
742 B
JSON
{
|
|
"compilerOptions": {
|
|
"target": "ES2022",
|
|
"lib": [
|
|
"dom",
|
|
"dom.iterable",
|
|
"esnext"
|
|
],
|
|
"allowJs": false,
|
|
"skipLibCheck": true,
|
|
"strict": true,
|
|
"noEmit": true,
|
|
"esModuleInterop": true,
|
|
"module": "esnext",
|
|
"moduleResolution": "bundler",
|
|
"resolveJsonModule": true,
|
|
"isolatedModules": true,
|
|
"jsx": "react-jsx",
|
|
"incremental": true,
|
|
"baseUrl": ".",
|
|
"paths": {
|
|
"@/*": [
|
|
"src/*"
|
|
]
|
|
},
|
|
"plugins": [
|
|
{
|
|
"name": "next"
|
|
}
|
|
]
|
|
},
|
|
"include": [
|
|
"next-env.d.ts",
|
|
"src/**/*.ts",
|
|
"src/**/*.tsx",
|
|
".next/types/**/*.ts",
|
|
".next/dev/types/**/*.ts"
|
|
],
|
|
"exclude": [
|
|
"node_modules",
|
|
".next"
|
|
]
|
|
}
|