fix(security): vitest >=3.2.6 (GHSA-5xrq-8626-4rwp) + Lockfile + Dep-Bumps (#13)

Behebt kritischen vitest-Alert in allen 7 Manifesten, ergaenzt Lockfile, aktualisiert Actions, Phase-0-Anpassungen an Deploy/CodeQL. CI gruen.

Author: Musiker15

.github/workflows/ci.yml

@@ -17,7 +17,6 @@ permissions:
 
 env:
   NODE_VERSION: "22"
-  PNPM_VERSION: "9"
 
 jobs:
   build-and-test:
@@ -56,15 +55,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: ${{ env.PNPM_VERSION }}
+        # Version wird aus dem "packageManager"-Feld der package.json gelesen.
+        # (action-setup@v6 verbietet zusaetzlich den "version"-Input.)
+        uses: pnpm/action-setup@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: "pnpm"
@@ -88,7 +87,7 @@ jobs:
         run: pnpm run typecheck
 
       - name: Unit & Integration Tests
-        run: pnpm run test --if-present
+        run: pnpm run test
 
       - name: Build
         run: pnpm run build

.github/workflows/codeql.yml

@@ -10,6 +10,7 @@ on:
     - cron: "0 5 * * 1"
 
 permissions:
+  actions: read
   contents: read
   security-events: write
 
@@ -18,25 +19,29 @@ jobs:
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    # Code-Scanning-Upload erfordert GitHub Advanced Security. Auf privaten
+    # Repos ohne GHAS schlägt der Upload fehl → Job überspringen, bis das Repo
+    # public ist oder GHAS aktiviert wird.
+    if: ${{ !github.event.repository.private }}
     strategy:
       fail-fast: false
       matrix:
         language: ["javascript-typescript"]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/deploy.yml

@@ -1,8 +1,11 @@
 name: Deploy (Production)
 
 on:
-  push:
-    branches: ["main"]
+  # Phase 0: Auto-Deploy auf Push deaktiviert, solange Server (/opt/msk-forms)
+  # und Deploy-Secrets noch nicht eingerichtet sind. Sobald die Infra steht,
+  # den folgenden Block wieder aktivieren:
+  # push:
+  #   branches: ["main"]
   workflow_dispatch:
 
 # Nie zwei Deploys gleichzeitig — laufendes Deploy NICHT abbrechen

apps/bot/package.json

@@ -20,6 +20,6 @@
   "devDependencies": {
     "tsx": "^4.19.2",
     "typescript": "^5.7.2",
-    "vitest": "^2.1.8"
+    "vitest": "^3.2.6"
   }
 }

apps/realtime/package.json

@@ -19,6 +19,6 @@
     "@types/ws": "^8.5.13",
     "tsx": "^4.19.2",
     "typescript": "^5.7.2",
-    "vitest": "^2.1.8"
+    "vitest": "^3.2.6"
   }
 }

apps/web/.eslintrc.json

@@ -9,10 +9,8 @@ const nextConfig: NextConfig = {
   experimental: {
     typedRoutes: true,
   },
-  // Lint läuft zentral via Flat-Config (eslint.config.mjs) im Monorepo-Root.
-  eslint: {
-    ignoreDuringBuilds: true,
-  },
+  // Hinweis: Next.js 16 hat `next lint` entfernt — Linting läuft zentral
+  // über die Flat-Config (eslint.config.mjs) im Monorepo-Root.
 };
 
 export default nextConfig;

apps/web/next.config.ts

@@ -26,10 +26,9 @@
     "@types/react": "^19.0.2",
     "@types/react-dom": "^19.0.2",
     "autoprefixer": "^10.4.20",
-    "eslint-config-next": "^16.0.0",
     "postcss": "^8.4.49",
     "tailwindcss": "^3.4.17",
     "typescript": "^5.7.2",
-    "vitest": "^2.1.8"
+    "vitest": "^3.2.6"
   }
 }

apps/web/package.json

@@ -33,7 +33,7 @@
     "@types/node": "^22.10.0",
     "eslint": "^9.17.0",
     "prettier": "^3.4.2",
-    "prettier-plugin-tailwindcss": "^0.6.9",
+    "prettier-plugin-tailwindcss": "^0.8.0",
     "prisma": "^6.2.0",
     "turbo": "^2.3.3",
     "typescript": "^5.7.2",

package.json

@@ -23,6 +23,6 @@
   "devDependencies": {
     "prisma": "^6.2.0",
     "typescript": "^5.7.2",
-    "vitest": "^2.1.8"
+    "vitest": "^3.2.6"
   }
 }