fix(build): make prepare tolerant of missing husky + bump deps (Phase 1a)

Browse Source

Two related changes:

1. package.json `prepare` script: changed from "husky" to "husky || true"
   so the script doesn't fail in --prod installs where husky (a
   devDependency) isn't present. The earlier "ENV HUSKY=0" attempt
   didn't help because HUSKY=0 only skips git-hook install once husky
   is invoked — when the husky binary itself is missing, the prepare
   script fails with "sh: husky: not found" before any HUSKY env var
   is consulted. Reverted that ENV from Dockerfile.worker.

2. Phase 1a deps refresh — `pnpm update` within current semver ranges.
   Notably:
   - @pdfme/common, @pdfme/generator, @pdfme/schemas: 5.5.8 → 5.5.10
     (closes XSS in SVG/Select schemas + SSRF in getB64BasePdf +
     decompression-bomb in FlateDecode)
   - postcss: 8.5.8 → 8.5.14 (XSS via </style> in stringify output)
   - mailparser, openai, postgres, react, react-dom, react-hook-form,
     recharts, zustand, jose, libphonenumber-js, prettier, vitest,
     autoprefixer, dotenv: routine minor/patch.

Tests: 1185/1185 vitest passing locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

...

This commit is contained in:

Matt

2026-05-08 16:15:34 +02:00

parent f74448c287

commit 6c159a8cac

3 changed files with 2036 additions and 1893 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

3814

pnpm-lock.yaml generated

File diff suppressed because it is too large Load Diff