curo/kite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(milestone): close v0.2 audit gaps

Browse Source
This commit is contained in:
curo1305
2026-06-17 12:42:20 +02:00
parent b9e2fc1803
commit aaf57eae80
10 changed files with 373 additions and 186 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/perf/phase11-final-summary.md
+26 -20
View File
@@ -1,7 +1,7 @@
# Phase 11 Bundle Final Summary — Baseline vs. Final Comparison
**Captured:** 2026-06-17
**Vite version:** 6.4.3
**Vite version:** 8.0.16
**Node environment:** production
## Command
@@ -15,37 +15,43 @@ cd frontend && ANALYZE=true npm run build # generates stats.html → .planning
| Metric | Baseline (pre-11-02) | Final (post-Phase-11) | Delta |
|--------|---------------------|----------------------|-------|
| Main bundle — raw | 264.63 kB | 183.62 kB | **-81.01 kB (-30.6%)** |
| Main bundle — gzip | 89.34 kB | 64.83 kB | **-24.51 kB (-27.4%)** |
| CSS main — raw | 98.74 kB | 102.35 kB | +3.61 kB |
| CSS main — gzip | 17.12 kB | 17.69 kB | +0.57 kB |
| JS chunk count | 15 chunks | 21 chunks | **+6 chunks** |
| Total output files | 15 | 23 | +8 |
| Main entry chunk — raw | 264.63 kB | 30.31 kB | **-234.32 kB (-88.5%)** |
| Main entry chunk — gzip | 89.34 kB | 9.59 kB | **-79.75 kB (-89.3%)** |
| CSS main — raw | 98.74 kB | 100.39 kB | +1.65 kB |
| CSS main — gzip | 17.12 kB | 17.83 kB | +0.71 kB |
| JS chunk count | 15 chunks | 37 chunks | **+22 chunks** |
| Total output files | 15 | 39 | +24 |
> Note: The final measurement was refreshed after the Vite 8 security bump that closed the esbuild high-severity audit finding. Vite 8 performs more shared/runtime chunk splitting than the earlier Vite 6 final measurement, so the "main entry chunk" is no longer directly equivalent to the old single large app chunk.
## What Changed
### Main bundle reduction (−81 kB raw)
### Main entry reduction
Plan 11-02 lazy-loaded 5 user routes that were previously synchronous imports. This split their code out of the main bundle and into dedicated chunks:
Plan 11-02 lazy-loaded 5 user routes that were previously synchronous imports. The later Vite 8 security bump also split shared runtime/vendor code into smaller chunks, leaving the main entry chunk at 30.31 kB raw / 9.59 kB gzip.
| New lazy chunk | Size (raw) | Size (gzip) | Route |
|----------------|-----------|------------|-------|
| `SettingsView-*.js` | 62.72 kB | 20.08 kB | `/settings` |
| `TopicsView-*.js` | 12.31 kB | 3.96 kB | `/topics`, `/topics/:name` |
| `DocumentView-*.js` | 10.17 kB | 3.77 kB | `/document/:id` |
| `CloudStorageView-*.js` | 2.32 kB | 1.24 kB | `/cloud` |
| `CloudFolderView-*.js` | 1.99 kB | 1.06 kB | `/cloud/:provider/:folderId` |
| `AppSpinner-*.js` | 0.51 kB | 0.37 kB | (shared sub-chunk for spinner) |
| `SettingsView-*.js` | 60.95 kB | 19.27 kB | `/settings` |
| `TopicsView-*.js` | 12.46 kB | 4.02 kB | `/topics`, `/topics/:name` |
| `DocumentView-*.js` | 10.29 kB | 3.88 kB | `/document/:id` |
| `CloudStorageView-*.js` | 2.53 kB | 1.32 kB | `/cloud` |
| `CloudFolderView-*.js` | 2.14 kB | 1.13 kB | `/cloud/:provider/:folderId` |
| `AppSpinner-*.js` | 0.54 kB | 0.39 kB | (shared sub-chunk for spinner) |
`SettingsView` contains the TotpEnrollment, PasswordStrengthBar, and cloud-connection components — it alone accounts for ~62 kB of the reduction.
`SettingsView` contains the TotpEnrollment, PasswordStrengthBar, and cloud-connection components, so keeping it lazy remains the largest route-level win.
### CSS slight increase (+3.6 kB raw)
### CSS slight increase (+1.65 kB raw)
The responsive layout additions in Plans 11-03/11-04/11-05 added new Tailwind utility classes (`translate-x-0`, `-translate-x-full`, `max-h-[90vh]`, `overflow-y-auto`, `focus-visible:ring-*`, `min-h-[36px]`, `min-w-[36px]`) that were not in the purged baseline. The modest increase confirms these classes are in active use.
### AdminLayout now includes drawer JS (+1.44 kB)
### AdminLayout now includes drawer JS
AdminLayout grew from 2.71 kB to 4.15 kB due to the responsive hamburger drawer state added in Plan 11-03. The drawer logic lives in AdminLayout.vue per the D-04/D-05 sidebar-state rule.
AdminLayout is 4.23 kB raw / 1.72 kB gzip due to the responsive hamburger drawer state added in Plan 11-03. The drawer logic lives in AdminLayout.vue per the D-04/D-05 sidebar-state rule.
### Vite 8 security remediation
During milestone audit remediation, `npm audit --audit-level=high` reported GHSA-gv7w-rqvm-qjhr through the Vite 6 esbuild dependency. Vite was upgraded to `^8.0.16`; the current final analyzer artifact and this summary reflect the post-remediation build.
## New Lazy Route Chunks (Plan 11-02)
@@ -65,7 +71,7 @@ After Plan 11-02, each of these routes is a separate chunk loaded only when the
## Interpretation
A **30.6% reduction** in the main bundle raw size (−81 kB) means first-load JS for authenticated users drops from 264 kB to 183 kB. At an average mobile 4G connection (~1 Mbps effective throughput), this saves approximately **640 ms of download time** before decompression, and about **195 ms after gzip** decompression savings are factored in.
A large reduction in the main entry chunk remains after the Vite 8 refresh: the entry is 30.31 kB raw / 9.59 kB gzip, with route and shared code split into on-demand chunks. The exact first-load byte count now depends on the browser's module graph preloading behavior, but the critical path no longer forces Settings, Topics, Document detail, or Cloud views into the initial application entry.
The chunk-splitting strategy is correct: the 6 new chunks are only fetched on demand, adding zero latency to the critical `/` home path.
.planning/perf/phase11-final.html
+1 -1
View File
File diff suppressed because one or more lines are too long