mirror of
https://github.com/hyperdxio/hyperdx
synced 2026-04-21 21:37:41 +00:00
c4dcfd75e2
## Summary In response to the recent [axios supply chain attack](https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan), we are tightening package management controls to reduce our exposure to malicious or compromised npm packages. **Changes:** - Updated `yarnPath` in `.yarnrc.yml` to point to Yarn 4.13.0 - Updated `packageManager` in `package.json` to reflect Yarn 4.13.0 - Removed old Yarn releases (4.5.1 and 1.22.18) from the `releases/` directory - Added Yarn 4.13.0 to the `releases/` directory - Set `npmMinimalAgeGate: 7` in `.yarnrc.yml` — Yarn will now block installation of any package version published less than 7 days ago, providing a buffer against freshly-injected malicious releases ### How to test locally or on Vercel 1. Pull this branch and run `yarn --version` — confirm it outputs `4.13.0`. 2. Run `yarn install` and verify it completes without errors. 3. Attempt to add a package version published within the last 7 days (e.g. a freshly released patch) and confirm Yarn rejects it with an age gate error. 4. Add a package version older than 7 days and confirm it installs successfully. 5. Confirm the old Yarn release files (`4.5.1`, `1.22.18`) are no longer present in `releases/`. ### References - Blog post: [axios compromised on npm — malicious versions drop remote access trojan](https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan)
83 lines
3.7 KiB
JSON
83 lines
3.7 KiB
JSON
{
|
|
"name": "hyperdx",
|
|
"private": true,
|
|
"version": "2.0.0",
|
|
"license": "MIT",
|
|
"workspaces": [
|
|
"packages/*"
|
|
],
|
|
"devDependencies": {
|
|
"@changesets/cli": "^2.26.2",
|
|
"@dotenvx/dotenvx": "^1.51.1",
|
|
"@eslint/js": "^9.39.1",
|
|
"@types/ungap__structured-clone": "^1.2.0",
|
|
"@ungap/structured-clone": "^1.3.0",
|
|
"babel-plugin-react-compiler": "^1.0.0",
|
|
"concurrently": "^9.1.2",
|
|
"dotenv": "^16.4.7",
|
|
"dotenv-cli": "^8.0.0",
|
|
"dotenv-expand": "^12.0.1",
|
|
"eslint": "^9.39.1",
|
|
"eslint-config-prettier": "^9.1.0",
|
|
"eslint-plugin-n": "^16.4.0",
|
|
"eslint-plugin-prettier": "^5.2.1",
|
|
"eslint-plugin-security": "^3.0.1",
|
|
"eslint-plugin-simple-import-sort": "^12.1.1",
|
|
"husky": "^8.0.3",
|
|
"knip": "^6.0.1",
|
|
"lint-staged": "^13.1.2",
|
|
"nx": "21.3.11",
|
|
"prettier": "3.3.3",
|
|
"tslib": "^2.6.0",
|
|
"typescript-eslint": "^8.46.0"
|
|
},
|
|
"scripts": {
|
|
"setup": "yarn install && husky install",
|
|
"build:common-utils": "nx run @hyperdx/common-utils:dev:build",
|
|
"app:dev": "concurrently -k -n 'API,APP,ALERTS-TASK,COMMON-UTILS' -c 'green.bold,blue.bold,yellow.bold,magenta' 'nx run @hyperdx/api:dev 2>&1 | tee ${HDX_DEV_LOGS_DIR:+\"$HDX_DEV_LOGS_DIR/api.log\"}' 'nx run @hyperdx/app:dev 2>&1 | tee ${HDX_DEV_LOGS_DIR:+\"$HDX_DEV_LOGS_DIR/app.log\"}' 'nx run @hyperdx/api:dev-task check-alerts 2>&1 | tee ${HDX_DEV_LOGS_DIR:+\"$HDX_DEV_LOGS_DIR/alerts.log\"}' 'nx run @hyperdx/common-utils:dev 2>&1 | tee ${HDX_DEV_LOGS_DIR:+\"$HDX_DEV_LOGS_DIR/common-utils.log\"}'",
|
|
"app:dev:local": "concurrently -k -n 'APP,COMMON-UTILS' -c 'blue.bold,magenta' 'nx run @hyperdx/app:dev:local' 'nx run @hyperdx/common-utils:dev'",
|
|
"app:lint": "nx run @hyperdx/app:ci:lint",
|
|
"app:storybook": "nx run @hyperdx/app:storybook",
|
|
"build:clickhouse": "nx run @hyperdx/common-utils:build && nx run @hyperdx/app:build:clickhouse",
|
|
"run:clickhouse": "nx run @hyperdx/app:run:clickhouse",
|
|
"dev": "sh -c '. ./scripts/dev-env.sh && yarn build:common-utils && dotenvx run --convention=nextjs -- docker compose -p \"$HDX_DEV_PROJECT\" -f docker-compose.dev.yml up -d && yarn app:dev; dotenvx run --convention=nextjs -- docker compose -p \"$HDX_DEV_PROJECT\" -f docker-compose.dev.yml down'",
|
|
"dev:local": "IS_LOCAL_APP_MODE='DANGEROUSLY_is_local_app_mode💀' yarn dev",
|
|
"dev:down": "sh -c '. ./scripts/dev-env.sh && docker compose -p \"$HDX_DEV_PROJECT\" -f docker-compose.dev.yml down && sh ./scripts/dev-kill-ports.sh'",
|
|
"dev:compose": "sh -c '. ./scripts/dev-env.sh && docker compose -p \"$HDX_DEV_PROJECT\" -f docker-compose.dev.yml'",
|
|
"knip": "knip",
|
|
"knip:ci": "knip --reporter json",
|
|
"lint": "npx nx run-many -t ci:lint",
|
|
"version": "make version",
|
|
"release": "npx changeset tag && npx changeset publish"
|
|
},
|
|
"lint-staged": {
|
|
"packages/api/src/routers/external-api/**/*.ts": [
|
|
"prettier --write --ignore-unknown",
|
|
"eslint --flag v10_config_lookup_from_file --fix --quiet",
|
|
"sh -c 'cd packages/api && yarn run lint:openapi && git add openapi.json'"
|
|
],
|
|
"**/*.{ts,tsx}": [
|
|
"prettier --write --ignore-unknown",
|
|
"eslint --flag v10_config_lookup_from_file --fix --quiet"
|
|
],
|
|
"**/*.{mdx,json,yml}": [
|
|
"prettier --write --ignore-unknown"
|
|
]
|
|
},
|
|
"packageManager": "yarn@4.13.0",
|
|
"resolutions": {
|
|
"@types/react": "19.0.7",
|
|
"@types/react-dom": "19.0.3",
|
|
"@types/express": "4.17.21",
|
|
"@types/express-serve-static-core": "4.17.43",
|
|
"express": "^4.20.0",
|
|
"send": "^0.19.0",
|
|
"serve-static": "^1.16.0",
|
|
"cookie": "^0.7.0",
|
|
"brace-expansion": "^2.0.2",
|
|
"diff": "^5.2.2",
|
|
"on-headers": "^1.1.0",
|
|
"fast-xml-parser": "^4.5.4",
|
|
"systeminformation": "^5.24.0"
|
|
}
|
|
}
|