bf8842e1d7
The notes field is authored as HTML (the form says "HTML supported") but the
detail page interpolated it with {{ }}, so tags like <BR> showed as literal
text. Render via v-html through a DOMPurify sanitizer (utils/sanitizeHtml):
allow-list of formatting tags + links only, forces target=_blank
rel=noopener on links, strips scripts/handlers. Promote dompurify to a direct
dependency (was transitive via jspdf).
41 lines
996 B
JSON
41 lines
996 B
JSON
{
|
|
"name": "shopdb-frontend",
|
|
"version": "0.7.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"stage": "node ../scripts/stage-frontend.mjs",
|
|
"predev": "npm run stage",
|
|
"dev": "vite",
|
|
"prebuild": "npm run stage",
|
|
"build": "vite build",
|
|
"preview": "vite preview",
|
|
"pretest": "npm run stage",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest"
|
|
},
|
|
"dependencies": {
|
|
"@fontsource-variable/inter": "^5.2.8",
|
|
"@fullcalendar/core": "^6.1.20",
|
|
"@fullcalendar/daygrid": "^6.1.20",
|
|
"@fullcalendar/vue3": "^6.1.20",
|
|
"axios": "^1.6.0",
|
|
"dompurify": "^3.4.11",
|
|
"jsbarcode": "^3.12.3",
|
|
"jspdf": "^4.2.1",
|
|
"leaflet": "^1.9.4",
|
|
"lucide-vue-next": "^0.563.0",
|
|
"pinia": "^2.1.0",
|
|
"qrcode": "^1.5.4",
|
|
"vue": "^3.4.0",
|
|
"vue-router": "^4.2.0"
|
|
},
|
|
"devDependencies": {
|
|
"@vitejs/plugin-vue": "^5.2.4",
|
|
"@vue/test-utils": "^2.4.6",
|
|
"jsdom": "^25.0.1",
|
|
"vite": "^6.4.1",
|
|
"vitest": "^2.1.9"
|
|
}
|
|
}
|