2ee2b05d1c
* feat(security): implement CSP * fix(csp): update helmet version to latest * Squashed commit of the following: commit cc6a35e61db07759c1f32716185543bc48bce760 Author: Kalista Payne <kalista@habitica.com> Date: Fri Dec 12 17:27:50 2025 -0600 fix(CSP): more Amazon domains commit 985b86c29af866b2df942c21217d99390a2c6e92 Author: Kalista Payne <kalista@habitica.com> Date: Fri Dec 12 17:18:08 2025 -0600 fix(csp): more loggly allowance commit 166bd315272f9c3a42652f3a026c27a88ed1a549 Author: Kalista Payne <kalista@habitica.com> Date: Fri Dec 12 17:12:00 2025 -0600 fix(csp): data, inline, some refactoring commit 1a0a6c1806a53d43a7199bb2ef72cff610e908be Author: Kalista Payne <kalista@habitica.com> Date: Fri Dec 12 17:05:44 2025 -0600 fix(CSP): override default script-src commit 023d9886c835989da9c5901c168d66b572097dcf Author: Kalista Payne <kalista@habitica.com> Date: Fri Dec 12 16:56:24 2025 -0600 fix(CSP): unsafe-eval in default-src commit f51f0a0c93b60dfec7ce02be0ecd2587fc882fe0 Author: Kalista Payne <kalista@habitica.com> Date: Fri Dec 12 16:52:14 2025 -0600 fix(CSP): move trusted list to default-src commit 83b2ba7688dea38abb651cf5c27482a7a3648374 Author: Kalista Payne <kalista@habitica.com> Date: Fri Dec 12 16:38:05 2025 -0600 fix(CSP): explicit habitica/aws in script-src commit d5ca5172d5ad2fd8cec9402d7d2c9452c6ece7a1 Author: Kalista Payne <kalista@habitica.com> Date: Fri Dec 12 16:31:38 2025 -0600 fix(CSP): need escaped single quotes commit c677a1ffeff5793b6da228924e68d2c2e47794b2 Author: Kalista Payne <kalista@habitica.com> Date: Fri Dec 12 16:27:46 2025 -0600 fix(CSP): unsafe-eval commit 6ef35c3f7281c8426d9c333686be6bb65f00b3a8 Author: Kalista Payne <kalista@habitica.com> Date: Fri Dec 12 16:15:07 2025 -0600 fix(CSP): might need to skip entirely in dev but try no 'self' commit 5759fb37d82fa61b474f01e9ce5e2dc461f6ceba Author: Kalista Payne <kalista@habitica.com> Date: Fri Dec 12 15:51:26 2025 -0600 fix(csp): permit AWS in default-src commit 9f238abf9373bc29715657b945b2247ef23c9224 Author: Kalista Payne <kalista@habitica.com> Date: Fri Dec 5 17:22:25 2025 -0600 fix(csp): update helmet version to latest commit 9462e90f4f3058f4014137b3178b9751c5280e97 Author: Kalista Payne <kalista@habitica.com> Date: Tue Nov 25 09:27:05 2025 -0600 feat(security): implement CSP commit72539f9ba3Author: Kalista Payne <kalista@habitica.com> Date: Wed Dec 10 14:16:53 2025 -0600 5.42.2 commitdabd466719Author: Kalista Payne <kalista@habitica.com> Date: Wed Dec 10 14:16:48 2025 -0600 Revert "Chat optimization (#15545)" This reverts commit2917955ef0. commit8bf2304330Author: Kalista Payne <kalista@habitica.com> Date: Wed Dec 10 14:15:48 2025 -0600 chore(event): G1G1 date tweaks commit6937dc4e4eAuthor: Kalista Payne <kalista@habitica.com> Date: Mon Dec 8 16:37:04 2025 -0600 fix(subscription): couple more layout tweaks * fix(csp): move unsafe-eval to default? ig? * Revert "fix(csp): move unsafe-eval to default? ig?" This reverts commit 90476cbf6c59132024d4fbaeceb7cdb19a876303. * fix(security): no unsafe! yay! * fix(packages): remove webpack * fix(lint): object destructuring * fix(csp): remove Vue-Fragment * wip(i18n): load Moment locale from cache * fix(gulp): remove unneeded cache task * fix(i18n): add Moment weekday abbrevs to translations * fix(lint): destructuring ...why is this happening here and not develop lol * fix(csp): add amplitude to whitelist --------- Co-authored-by: Phillip Thelen <phillip@thelen.space>
134 lines
4.8 KiB
JSON
134 lines
4.8 KiB
JSON
{
|
|
"name": "habitica",
|
|
"description": "A habit tracker app which treats your goals like a Role Playing Game.",
|
|
"version": "5.47.2",
|
|
"main": "./website/server/index.js",
|
|
"dependencies": {
|
|
"@babel/core": "^7.22.10",
|
|
"@babel/preset-env": "^7.22.10",
|
|
"@babel/register": "^7.22.15",
|
|
"@google-cloud/trace-agent": "^7.1.2",
|
|
"@parse/node-apn": "^5.2.3",
|
|
"@slack/webhook": "^6.1.0",
|
|
"accepts": "^1.3.8",
|
|
"amazon-payments": "^0.2.9",
|
|
"amplitude": "^6.0.0",
|
|
"apidoc": "^0.54.0",
|
|
"apple-auth": "^1.0.9",
|
|
"babel-preset-env": "^1.7.0",
|
|
"bcrypt": "^5.1.1",
|
|
"body-parser": "^1.20.3",
|
|
"bootstrap": "^4.6.2",
|
|
"compression": "^1.8.1",
|
|
"cookie-session": "^2.1.1",
|
|
"coupon-code": "^0.4.5",
|
|
"csv-stringify": "^5.6.5",
|
|
"cwait": "^1.1.1",
|
|
"domain-middleware": "~0.1.0",
|
|
"eslint": "^8.55.0",
|
|
"eslint-config-habitrpg": "^6.2.3",
|
|
"eslint-plugin-mocha": "^5.0.0",
|
|
"express": "^4.21.1",
|
|
"express-basic-auth": "^1.2.1",
|
|
"express-validator": "^5.2.0",
|
|
"firebase-admin": "^12.1.1",
|
|
"glob": "^8.1.0",
|
|
"got": "^11.8.6",
|
|
"gulp": "^4.0.0",
|
|
"gulp-babel": "^8.0.0",
|
|
"gulp-filter": "^7.0.0",
|
|
"gulp-imagemin": "^7.1.0",
|
|
"gulp.spritesmith": "^6.13.0",
|
|
"habitica-markdown": "^4.1.0",
|
|
"heapdump": "^0.3.15",
|
|
"helmet": "^8.1.0",
|
|
"in-app-purchase": "^1.11.3",
|
|
"js2xmlparser": "^5.0.0",
|
|
"jsonwebtoken": "^9.0.2",
|
|
"jwks-rsa": "^2.1.5",
|
|
"lodash": "^4.17.21",
|
|
"merge-stream": "^2.0.0",
|
|
"method-override": "^3.0.0",
|
|
"micromustache": "^8.0.3",
|
|
"moment": "^2.29.4",
|
|
"moment-recur": "git://github.com/HabitRPG/moment-recur.git#d3e8e6da0806f13b74dd2e4d7d9053e6a63db119",
|
|
"mongoose": "^8.9.5",
|
|
"morgan": "^1.10.1",
|
|
"nan": "^2.25.0",
|
|
"nconf": "^0.12.1",
|
|
"node-gcm": "^1.0.5",
|
|
"on-headers": "^1.1.0",
|
|
"passport": "^0.5.3",
|
|
"passport-facebook": "^3.0.0",
|
|
"passport-google-oauth2": "^0.2.0",
|
|
"passport-google-oauth20": "2.0.0",
|
|
"paypal-rest-sdk": "^1.8.1",
|
|
"pp-ipn": "^1.1.0",
|
|
"ps-tree": "^1.0.0",
|
|
"rate-limiter-flexible": "^2.4.2",
|
|
"redis": "^3.1.2",
|
|
"remove-markdown": "^0.5.0",
|
|
"rimraf": "^3.0.2",
|
|
"short-uuid": "^4.2.2",
|
|
"sinon": "^15.2.0",
|
|
"stripe": "^12.18.0",
|
|
"superagent": "^8.1.2",
|
|
"useragent": "^2.1.9",
|
|
"uuid": "^9.0.0",
|
|
"validator": "^13.11.0",
|
|
"winston": "^3.10.0",
|
|
"winston-loggly-bulk": "^3.3.0",
|
|
"xml2js": "^0.6.2"
|
|
},
|
|
"private": true,
|
|
"engines": {
|
|
"node": "20",
|
|
"npm": "^10"
|
|
},
|
|
"scripts": {
|
|
"lint": "eslint --ext .js --fix . && cd website/client && npm run lint",
|
|
"lint-no-fix": "eslint --ext .js . && cd website/client && npm run lint-no-fix",
|
|
"test": "npm run lint && gulp test && gulp apidoc",
|
|
"test:build": "gulp test:prepare:build",
|
|
"test:api-v3": "gulp test:api-v3",
|
|
"test:api:unit": "gulp test:api:unit",
|
|
"test:api-v3:integration": "gulp test:api-v3:integration",
|
|
"test:api-v3:integration:separate-server": "NODE_ENV=test gulp test:api-v3:integration:separate-server",
|
|
"test:api-v4:integration": "gulp test:api-v4:integration",
|
|
"test:api-v4:integration:separate-server": "NODE_ENV=test gulp test:api-v4:integration:separate-server",
|
|
"test:sanity": "nyc --silent --no-clean mocha test/sanity --recursive",
|
|
"test:common": "nyc --silent --no-clean mocha test/common --recursive",
|
|
"test:content": "nyc --silent --no-clean mocha test/content --recursive",
|
|
"coverage": "nyc report --reporter=html --report-dir coverage/results; open coverage/results/index.html",
|
|
"sprites": "gulp sprites:compile",
|
|
"client:dev": "cd website/client && npm run serve",
|
|
"client:dev:docker": "cd website/client && npm run serve:docker",
|
|
"client:build": "cd website/client && npm run build",
|
|
"client:unit": "cd website/client && npm run test:unit",
|
|
"start": "node --watch ./website/server/index.js",
|
|
"debug": "node --watch --inspect ./website/server/index.js",
|
|
"docker:aio": "docker compose -f docker-compose.yml up",
|
|
"docker:mongo:dev": "docker compose -f docker-compose.mongo-only.yml up",
|
|
"docker:mongo:dev:down": "docker compose -f docker-compose.mongo-only.yml down",
|
|
"docker:mongo:test": "docker compose -f docker-compose.mongo-test-local.yml up",
|
|
"mongo:test": "node scripts/start-local-mongo.mjs --test-db",
|
|
"postinstall": "git config --global url.\"https://\".insteadOf git:// && gulp build && cd website/client && npm install",
|
|
"apidoc": "gulp apidoc",
|
|
"heroku-postbuild": ".heroku/report_deploy.sh"
|
|
},
|
|
"devDependencies": {
|
|
"axios": "^1.8.2",
|
|
"chai": "^4.3.7",
|
|
"chai-as-promised": "^7.1.1",
|
|
"chai-moment": "^0.1.0",
|
|
"chalk": "^5.3.0",
|
|
"cross-spawn": "^7.0.5",
|
|
"mocha": "^5.1.1",
|
|
"monk": "^7.3.4",
|
|
"nyc": "^15.1.0",
|
|
"require-again": "^2.0.0",
|
|
"sinon-chai": "^3.7.0",
|
|
"sinon-stub-promise": "^4.0.0"
|
|
}
|
|
}
|