chore: upgrade dependencies

.github/workflows/dependency-audit.yml

@@ -0,0 +1,30 @@
+name: Dependency Security Audit
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with:
+          version: 10.33.2
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Run high/critical dependency audit
+        run: pnpm security:audit

.github/workflows/preview.yaml

@@ -15,11 +15,11 @@ jobs:
   Deploy-Preview:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v4
         with:
-          version: 9
+          version: 10.33.2
 
       - run: pnpm add -g vercel
 
@@ -34,7 +34,7 @@ jobs:
 
       # Cache the pnpm store to speed up subsequent runs
       - name: Cache pnpm store
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.pnpm-store
           key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}

.github/workflows/production.yml

@@ -12,11 +12,11 @@ jobs:
   Deploy-Production:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v4
         with:
-          version: 9
+          version: 10.33.2
 
       - run: pnpm add -g vercel
 

.husky/pre-commit

@@ -1,3 +1,2 @@
 echo "Running pre-commit hook..."
-export PATH="./node_modules/.bin:/usr/local/bin:/usr/bin:/bin:$PATH"
 npx lint-staged

.tool-versions

@@ -1,2 +1,2 @@
 nodejs 22.14.0
-pnpm 9.15.9
+pnpm 10.33.2

README.md

@@ -31,7 +31,7 @@ Wraft focuses on efficiency, security, and flexibility, making it ideal for busi
 To run **wraft.co**, you’ll need:
 
 - **Node.js** (Version: >=20.x)
-- **pnpm** (Version: >=9.x)
+- **pnpm** (Version: >=10.x)
 
 ---
 
@@ -87,6 +87,22 @@ After building, run the application in development mode.
 
 The app should now be running locally, and you can access it at http://localhost:3000.
 
+## Dependency Security
+
+- Run a high/critical vulnerability check:
+
+```sh
+pnpm security:audit
+```
+
+- For machine-readable output:
+
+```sh
+pnpm security:audit:json
+```
+
+- CI runs the same high/critical gate on pull requests and pushes to `main` via `.github/workflows/dependency-audit.yml`.
+
 ## 📄 License
 
 Wraft is open-source software licensed under the [AGPLv3](LICENSE).

apps/docs/.storybook/main.ts

@@ -1,8 +1,11 @@
 import type { StorybookConfig } from "@storybook/react-vite";
 import react from "@vitejs/plugin-react";
+import { createRequire } from "module";
 
 import { dirname, join, resolve } from "path";
 
+const require = createRequire(import.meta.url);
+
 function getAbsolutePath(value: string): any {
   return dirname(require.resolve(join(value, "package.json")));
 }

apps/docs/eslint.config.cjs

@@ -0,0 +1,16 @@
+const { FlatCompat } = require("@eslint/eslintrc");
+const js = require("@eslint/js");
+
+const compat = new FlatCompat({
+  baseDirectory: __dirname,
+  recommendedConfig: js.configs.recommended,
+  allConfig: js.configs.all,
+});
+
+module.exports = [
+  { ignores: ["eslint.config.cjs", ".eslintrc.js", ".eslintrc.cjs"] },
+  ...compat.config({
+    root: true,
+    extends: ["@wraft/eslint-config/storybook.js"],
+  }),
+];

apps/docs/package.json

@@ -8,7 +8,7 @@
     "build": "storybook build",
     "preview-storybook": "serve storybook-static",
     "clean": "rm -rf .turbo && rm -rf node_modules",
-    "lint": "eslint . --ext ts,tsx --max-warnings 0",
+    "lint": "eslint \"**/*.{ts,tsx}\" --max-warnings 0",
     "build-storybook": "storybook build"
   },
   "dependencies": {
@@ -21,23 +21,23 @@
     "react-dom": "^18.3.1"
   },
   "devDependencies": {
-    "@storybook/addon-actions": "^8.6.7",
-    "@storybook/addon-docs": "^8.6.7",
-    "@storybook/addon-essentials": "^8.6.7",
-    "@storybook/addon-interactions": "^8.6.7",
-    "@storybook/addon-links": "^8.6.7",
-    "@storybook/addon-onboarding": "^8.6.7",
-    "@storybook/blocks": "^8.6.7",
-    "@storybook/manager-api": "^8.6.7",
-    "@storybook/react": "^8.6.7",
-    "@storybook/react-vite": "^8.6.7",
-    "@storybook/theming": "^8.6.7",
+    "@storybook/addon-actions": "^8.6.14",
+    "@storybook/addon-docs": "^8.6.14",
+    "@storybook/addon-essentials": "^8.6.14",
+    "@storybook/addon-interactions": "^8.6.14",
+    "@storybook/addon-links": "^8.6.14",
+    "@storybook/addon-onboarding": "^8.6.14",
+    "@storybook/blocks": "^8.6.14",
+    "@storybook/manager-api": "^8.6.14",
+    "@storybook/react": "^8.6.14",
+    "@storybook/react-vite": "^8.6.14",
+    "@storybook/theming": "^8.6.14",
     "@vitejs/plugin-react": "^4.3.0",
     "@wraft/eslint-config": "*",
     "@wraft/typescript-config": "*",
-    "eslint": "^8.57.0",
+    "eslint": "^9.39.4",
     "eslint-plugin-storybook": "^0.6.15",
-    "storybook": "^8.6.7",
+    "storybook": "^8.6.14",
     "typescript": "^5.3.3",
     "vite": "^6.3.5"
   }