curo/kite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(08-08): PERF-01 packages + Vite 6 upgrade + pin requirements.txt

Browse Source 
- Upgraded vite 5.4.21 → 6.4.3 (fixes CVE-2026-39363, CVE-2026-39364)
- Upgraded @vitejs/plugin-vue 5.2.4 → 6.0.7 (Vite 6 peer dep)
- Installed @vueuse/core@14.3.0, @vueuse/integrations@14.3.0,
  sortablejs@1.15.7, @tailwindcss/forms@0.5.11,
  rollup-plugin-visualizer@7.0.1, @types/sortablejs@1.15.9
- Wired @tailwindcss/forms plugin in tailwind.config.js (VISUAL-02 ready)
- Pinned backend/requirements.txt to exact == versions per D-17 (32 packages)
- Frontend: 136/136 tests pass on Vite 6; 0 npm audit vulnerabilities
- Backend: 408 passed, 4 skipped, 7 xfailed (baseline 405+1)
- Phase 8 complete (8/8 plans)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
curo1305
2026-06-12 10:54:34 +02:00
co-authored by Claude Sonnet 4.6
parent 8828871ecd
commit 6bda133c81
5 changed files with 157 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/STATE.md
+21 -23
View File
@@ -2,37 +2,36 @@
gsd_state_version: 1.0 gsd_state_version: 1.0
milestone: v0.2 milestone: v0.2
milestone_name: Phases milestone_name: Phases
current_phase: 8 current_phase: 9
status: executing status: ready
last_updated: "2026-06-10T16:45:44.535Z" last_updated: "2026-06-12T00:00:00.000Z"
last_activity: 2026-06-10 last_activity: 2026-06-12
progress: progress:
total_phases: 4 total_phases: 17
completed_phases: 0 completed_phases: 14
total_plans: 8 total_plans: 73
completed_plans: 4 completed_plans: 73
percent: 0 percent: 80
--- ---
# Project State # Project State
**Project:** DocuVault **Project:** DocuVault
**Status:** Ready to execute **Status:** Phase 8 complete — ready for Phase 9
**Current Phase:** 8 **Current Phase:** 9
**Last Updated:** 2026-06-08 **Last Updated:** 2026-06-12
## Current Position ## Current Position
Phase: 8 (Stack Upgrade & Backend Decomposition) — EXECUTING Phase: 9 (Admin Panel Rearchitecture) — NOT STARTED
Plan: 2 of 8 Status: Ready to plan
Status: Ready to execute Last activity: 2026-06-12
Last activity: 2026-06-10
## Phase Status ## Phase Status
| Phase | Requirements | Status | | Phase | Requirements | Status |
|-------|-------------|--------| |-------|-------------|--------|
| 8. Stack Upgrade & Backend Decomposition | PERF-01, CODE-01, CODE-02, CODE-03, CODE-04, CODE-08 | Planned (8 plans) | | 8. Stack Upgrade & Backend Decomposition | PERF-01, CODE-01, CODE-02, CODE-03, CODE-04, CODE-08 | **Complete (8/8 plans)** |
| 9. Admin Panel Rearchitecture | ADMIN-08..12, CODE-06, CODE-09 | Not started | | 9. Admin Panel Rearchitecture | ADMIN-08..12, CODE-06, CODE-09 | Not started |
| 10. UX & Interaction | UX-01..14, CODE-05 | Not started | | 10. UX & Interaction | UX-01..14, CODE-05 | Not started |
| 11. Visual Design, Responsive Layout & Cleanup | VISUAL-01..04, RESP-01..05, CODE-07, PERF-02, PERF-03 | Not started | | 11. Visual Design, Responsive Layout & Cleanup | VISUAL-01..04, RESP-01..05, CODE-07, PERF-02, PERF-03 | Not started |
@@ -41,11 +40,10 @@ Last activity: 2026-06-10
| Metric | Value | | Metric | Value |
|---|---| |---|---|
| Phases complete | 0 / 4 | | Phases complete | 1 / 4 |
| Requirements mapped | 40 / 40 | | Requirements mapped | 40 / 40 |
| Plans written | 8 | | Plans written | 8 |
| Plans complete | 0 | | Plans complete | 8 |
| Phase 08-stack-upgrade-backend-decomposition P07 | 5 | 4 tasks | 9 files |
## Accumulated Context ## Accumulated Context
@@ -83,7 +81,7 @@ _Updated at each phase transition._
| Field | Value | | Field | Value |
|---|---| |---|---|
| Last session | 2026-06-08 — Phase 8 planned; 8 plans created | | Last session | 2026-06-12 — Phase 8 complete; all 8 plans executed |
| Next action | /gsd:execute-phase 8 | | Next action | /gsd:discuss-phase 9 then /gsd:plan-phase 9 |
| Pending decisions | None | | Pending decisions | None |
| Resume file | .planning/phases/08-stack-upgrade-backend-decomposition/ | | Resume file | .planning/phases/ (phase 9 not yet created) |
.planning/phases/08-stack-upgrade-backend-decomposition/08-08-SUMMARY.md
+91
View File
@@ -0,0 +1,91 @@
---
phase: 08-stack-upgrade-backend-decomposition
plan: 08
status: complete
completed: 2026-06-12
---
# Plan 08-08 Summary — Dependency Upgrades (Wave 3)
## What Was Done
- Installed all PERF-01 frontend packages; upgraded Vite 5 → 6 resolving 2 moderate CVEs
- Wired `@tailwindcss/forms` plugin in `tailwind.config.js` (required for Phase 11 VISUAL-02)
- Pinned `backend/requirements.txt` from floating `>=` to exact `==` versions per D-17
## Human Checkpoint (Package Legitimacy)
User approved all 8 npm packages after security research instead of manual npmjs.com inspection.
CVE research confirmed:
- **vite 5.4.21 → 6.4.3**: Patched CVE-2026-39363 + CVE-2026-39364 (High, arbitrary file read via dev server). Relevant because `vite.config.js` uses `server.host: '0.0.0.0'`. Vite 8 was evaluated and rejected (breaking Rolldown changes out of phase scope).
- All other packages: no known CVEs in Snyk/OpenCVE as of 2026-06-12.
## Before / After: frontend/package.json
| Package | Before | After |
|---|---|---|
| vite | `^5.2.0` (installed 5.4.21) | `^6.4.3` (installed 6.4.3) |
| @vitejs/plugin-vue | `^5.0.0` (installed 5.2.4) | `^6.0.7` (installed 6.0.7) |
| vue | `^3.4.0` | `^3.5.38` |
| @vueuse/core | — | `^14.3.0` (14.3.0) |
| @vueuse/integrations | — | `^14.3.0` (14.3.0) |
| sortablejs | — | `^1.15.7` (1.15.7) |
| @tailwindcss/forms | — | `^0.5.11` (0.5.11) |
| rollup-plugin-visualizer | — | `^7.0.1` (7.0.1) |
| @types/sortablejs | — | `^1.15.9` (1.15.9) |
## Final backend/requirements.txt (pinned)
```
fastapi==0.128.8
uvicorn[standard]==0.49.0
python-multipart==0.0.32
pydantic-settings==2.14.1
pydantic[email]==2.13.4
anthropic==0.104.0
openai==2.41.0
PyMuPDF==1.27.2.3
python-docx==1.2.0
pytesseract==0.3.13
Pillow==12.2.0
aiofiles==25.1.0
httpx==0.28.1
pytest==9.0.3
pytest-asyncio==1.4.0
sqlalchemy[asyncio]==2.0.49
psycopg[binary]==3.2.13
# alembic pinned to currently-installed 1.16.5 (was >=1.18.4); D-17 mandates pinning to installed
alembic==1.16.5
minio==7.2.20
celery[redis]==5.6.3
redis==6.4.0
aiosqlite==0.22.1
PyJWT==2.13.0
pwdlib[argon2]==0.3.0
pyotp==2.9.0
slowapi==0.1.9
cryptography==48.0.0
google-auth-oauthlib==1.4.0
google-api-python-client==2.197.0
msal==1.37.0
webdavclient3==3.14.7
cachetools==7.1.4
structlog==25.5.0
```
## Test Results
- `cd frontend && npm test` — 136/136 passed on Vite 6 ✅
- `cd frontend && npm run build` — clean production build with Vite 6.4.3 ✅
- `cd frontend && npm audit` — 0 vulnerabilities (was 2 moderate on Vite 5) ✅
- `docker exec backend pytest -v` — 408 passed, 4 skipped, 7 xfailed ✅ (baseline was 405/1)
- `pip install -r requirements.txt --dry-run` — no resolution conflicts ✅
## Acceptance Criteria Met
- [x] All PERF-01 packages installed at correct versions
- [x] `@tailwindcss/forms` wired in `tailwind.config.js` (ready for Phase 11 VISUAL-02)
- [x] Vite 6 production build succeeds
- [x] `backend/requirements.txt` fully `==` pinned per D-17 (0 floating constraints)
- [x] All tests pass
- [x] Human checkpoint approved (CVE-informed, not just npmjs.com visual check)
backend/requirements.txt
+34 -33
View File
@@ -1,37 +1,38 @@
fastapi>=0.111 fastapi==0.128.8
uvicorn[standard]>=0.29 uvicorn[standard]==0.49.0
python-multipart>=0.0.27 python-multipart==0.0.32
pydantic-settings>=2.2 pydantic-settings==2.14.1
pydantic[email]>=2.0 pydantic[email]==2.13.4
anthropic>=0.95.0 anthropic==0.104.0
openai>=1.30 openai==2.41.0
PyMuPDF>=1.26.7 PyMuPDF==1.27.2.3
python-docx>=1.1 python-docx==1.2.0
pytesseract>=0.3 pytesseract==0.3.13
Pillow>=10.3 Pillow==12.2.0
aiofiles>=23.2 aiofiles==25.1.0
httpx>=0.27 httpx==0.28.1
pytest>=8.2 pytest==9.0.3
pytest-asyncio>=1.3.0 pytest-asyncio==1.4.0
sqlalchemy[asyncio]>=2.0.49 sqlalchemy[asyncio]==2.0.49
psycopg[binary]>=3.3.4 psycopg[binary]==3.2.13
alembic>=1.18.4 # alembic pinned to currently-installed 1.16.5 (was >=1.18.4); D-17 mandates pinning to installed
minio>=7.2.20 alembic==1.16.5
celery[redis]>=5.5.0 minio==7.2.20
redis>=4.6.0 celery[redis]==5.6.3
aiosqlite>=0.20.0 redis==6.4.0
PyJWT>=2.8.0 aiosqlite==0.22.1
pwdlib[argon2]>=0.2.1 PyJWT==2.13.0
pyotp>=2.9.0 pwdlib[argon2]==0.3.0
slowapi>=0.1.9 pyotp==2.9.0
slowapi==0.1.9
# Cloud Storage Backends (Phase 5) # Cloud Storage Backends (Phase 5)
cryptography>=41.0.0 cryptography==48.0.0
google-auth-oauthlib>=1.3.1 google-auth-oauthlib==1.4.0
google-api-python-client>=2.196.0 google-api-python-client==2.197.0
msal>=1.36.0 msal==1.37.0
webdavclient3>=3.14.7 webdavclient3==3.14.7
cachetools>=5.3.0 cachetools==7.1.4
# Observability (Phase 6 — D-01) # Observability (Phase 6 — D-01)
structlog>=25.5.0 structlog==25.5.0
frontend/package.json
+9 -3
View File
@@ -9,19 +9,25 @@
"test": "vitest run" "test": "vitest run"
}, },
"dependencies": { "dependencies": {
"@tailwindcss/forms": "^0.5.11",
"@vueuse/core": "^14.3.0",
"@vueuse/integrations": "^14.3.0",
"pinia": "^2.1.0", "pinia": "^2.1.0",
"qrcode": "^1.5.4", "qrcode": "^1.5.4",
"vue": "^3.4.0", "sortablejs": "^1.15.7",
"vue": "^3.5.38",
"vue-router": "^4.3.0" "vue-router": "^4.3.0"
}, },
"devDependencies": { "devDependencies": {
"@vitejs/plugin-vue": "^5.0.0", "@types/sortablejs": "^1.15.9",
"@vitejs/plugin-vue": "^6.0.7",
"@vue/test-utils": "^2.4.10", "@vue/test-utils": "^2.4.10",
"autoprefixer": "^10.4.0", "autoprefixer": "^10.4.0",
"happy-dom": "^20.9.0", "happy-dom": "^20.9.0",
"postcss": "^8.4.0", "postcss": "^8.4.0",
"rollup-plugin-visualizer": "^7.0.1",
"tailwindcss": "^3.4.0", "tailwindcss": "^3.4.0",
"vite": "^5.2.0", "vite": "^6.4.3",
"vitest": "^4.1.7" "vitest": "^4.1.7"
} }
} }
frontend/tailwind.config.js
+2 -1
View File
@@ -1,8 +1,9 @@
/** @type {import('tailwindcss').Config} */ /** @type {import('tailwindcss').Config} */
import forms from '@tailwindcss/forms'
export default { export default {
content: ['./index.html', './src/**/*.{vue,js}'], content: ['./index.html', './src/**/*.{vue,js}'],
theme: { theme: {
extend: {}, extend: {},
}, },
plugins: [], plugins: [forms],
} }