package.json

{
  "name": "@lenne.tech/cli",
  "version": "1.42.0",
  "description": "lenne.Tech CLI: lt",
  "keywords": [
    "lenne.Tech",
    "cli",
    "lt"
  ],
  "author": "Kai Haase",
  "homepage": "https://lenne.tech",
  "license": "MIT",
  "repository": "https://github.com/lenneTech/cli.git",
  "bugs": {
    "url": "https://github.com/lenneTech/cli/issues"
  },
  "bin": {
    "lt": "bin/lt"
  },
  "scripts": {
    "c": "npm run check",
    "cf": "npm run check:fix",
    "check": "bash scripts/check.sh",
    "check:audit": "bash scripts/check.sh --audit-only",
    "check:fix": "npm install && npm audit fix && npm run format && npm run lint:fix && npm run build && npm run check:start",
    "check:start": "bash scripts/check-cli-start.sh",
    "postinstall": "node bin/postinstall.js 2>/dev/null || true",
    "build": "npm run lint && npm run test && npm run clean-build && npm run compile && npm run copy-templates",
    "clean-build": "npx rimraf ./build",
    "compile": "tsc -p .",
    "copy-templates": "npx shx cp -R ./src/templates ./build/templates && npx shx cp -R ./src/config ./build/config",
    "coverage": "jest --coverage",
    "test:vendor-init": "bash scripts/test-vendor-init.sh",
    "test:frontend-vendor-init": "bash scripts/test-frontend-vendor-init.sh",
    "test:incremental-fullstack": "bash scripts/test-incremental-fullstack.sh",
    "test:manual": "jest --testMatch '<rootDir>/*.manual.ts' --testTimeout=60000",
    "test:e2e:service": "jest --testMatch '<rootDir>/dev-service-e2e.manual.ts' --testTimeout=60000",
    "format": "prettier --write 'src/**/*.{js,ts,tsx,json}' '!src/templates/**/*'",
    "lint": "eslint './src/**/*.{ts,js,vue}'",
    "lint:fix": "eslint './src/**/*.{ts,js,vue}' --fix",
    "prepublishOnly": "npm run build",
    "preversion": "npm run lint",
    "reinit": "npx rimraf package-lock.json && npx rimraf node_modules && npm cache clean --force && npm i && npm run build",
    "snapupdate": "jest --updateSnapshot",
    "start": "node bin/lt",
    "start:build": "npm run build && node bin/lt --compiled-build",
    "start:compiled": "node bin/lt --compiled-build",
    "test": "jest --testTimeout=60000",
    "watch": "jest --watch"
  },
  "files": [
    "tsconfig.json",
    "build",
    "LICENSE",
    "README.md",
    "docs",
    "bin"
  ],
  "dependencies": {
    "@aws-sdk/client-s3": "3.1100.0",
    "@lenne.tech/cli-plugin-helper": "0.0.14",
    "axios": "1.19.0",
    "bcrypt": "6.0.0",
    "defuddle": "0.19.2",
    "glob": "13.0.6",
    "gluegun": "5.2.2",
    "js-sha256": "1.0.0",
    "js-yaml": "4.3.0",
    "jsdom": "29.1.1",
    "jsonc-parser": "3.3.1",
    "lodash": "4.18.1",
    "open": "11.0.0",
    "playwright-core": "1.62.1",
    "ts-morph": "28.0.0",
    "ts-node": "10.9.2",
    "turndown": "7.2.4",
    "turndown-plugin-gfm": "1.0.2",
    "typescript": "6.0.3"
  },
  "devDependencies": {
    "@lenne.tech/eslint-config-ts": "2.3.0",
    "@lenne.tech/npm-package-helper": "0.0.12",
    "@types/ejs": "3.1.5",
    "@types/jest": "30.0.0",
    "@types/js-yaml": "4.0.9",
    "@types/jsdom": "28.0.1",
    "@types/lodash": "4.17.24",
    "@types/node": "26.1.2",
    "@types/turndown": "5.0.6",
    "ejs": "6.0.1",
    "eslint": "10.8.0",
    "husky": "9.1.7",
    "jest": "30.4.2",
    "minimatch": "10.2.6",
    "prettier": "3.8.3",
    "rimraf": "6.1.3",
    "ts-jest": "29.4.12"
  },
  "//overrides": {
    "semver@*": "Force latest semver 7.x across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep.",
    "brace-expansion@<1.1.18": "Two DoS advisories: exponential-time expansion of consecutive non-expanding {} groups (GHSA-3jxr-9vmj-r5cp, high) and unbounded expansion length causing an OOM crash (GHSA-mh99-v99m-4gvg, high). Transitive via dotgitignore/eslint/fs-jetpack/glob/test-exclude/ts-morph > minimatch. One bounded key per affected major so each can only raise a vulnerable version, never cap a patched one - remove once minimatch requests the patched ranges.",
    "brace-expansion@>=2.0.0 <2.1.4": "Same advisories, 2.x line.",
    "brace-expansion@>=5.0.0 <5.0.9": "Same advisories, 5.x line. Floored at >=5.0.0 so a future 3.x/4.x dependency is not silently forced across two majors.",
    "//minimatch-note": "brace-expansion 1.x and 2.x are END OF LINE for GHSA-mh99-v99m-4gvg: the advisory range is <=5.0.7 across ALL majors and upstream patched ONLY 5.0.8+. 1.1.18 and 2.1.4 are the newest releases of their majors and remain vulnerable. Forcing brace-expansion 5.x globally is NOT an option: 5.x is ESM/tshy and exports an object ({ expand, ... }) while 1.x/2.x export the function itself, so minimatch 3.x/5.x would die on `expand is not a function`. The only real fix is to raise each CONSUMER off minimatch 3.x/5.x, which is what the scoped entries below do. Each was verified against the consumer's actual call site before being added. The eslint / @eslint/eslintrc / @eslint/config-array entries were REMOVED in 1.42.0: eslint 10 requests minimatch ^10.2.5 itself, config-array ^10.2.4, and eslintrc is no longer in the tree at all.",
    "minimatch@>=4 <10": "Bounded raise of every minimatch 4.x-9.x install to 10.2.6, whose brace-expansion ^5.0.8 is patched. Covers filelist (gluegun > ejs > jake > filelist, PRODUCTION-reachable, minimatch ^5.0.1), @typescript-eslint/typescript-estree (^9.0.4) and jest-config/jest-runtime/@jest/reporters (^9). Verified safe per consumer: filelist calls only the static helper `minimatch.match(files, pat, opts)`; typescript-estree calls the named `minimatch(filePath, pattern, { dot: true })`; the three jest packages declare minimatch but never require it. Floored at >=4 so the 3.x line is NOT swept in: minimatch 3.x is callable while 9.x/10.x export an object with __esModule but no `default` key, so sweeping it would break any consumer that calls the default export. Drop once these consumers request minimatch >=10 themselves.",
    "babel-plugin-istanbul > test-exclude@<8": "test-exclude 6.0.0 pins minimatch ^3.0.4 and glob ^7. test-exclude 8.0.0 uses minimatch ^10.2.2 + glob ^13 (the glob major this project already ships) and is still CJS with the same `module.exports = TestExclude` class shape, so babel-plugin-istanbul's _interopRequireDefault + `new TestExclude(opts)` keeps working. Drop once babel-plugin-istanbul widens its ^6.0.0 range.",
    "fs-jetpack > minimatch@<10": "Same chain, PRODUCTION-reachable (gluegun > fs-jetpack). Safe: lib/utils/matcher.js does `require('minimatch').Minimatch` and uses only `new Minimatch(pattern, { matchBase, nocomment, nocase, dot })`, `.negate` and `.match()` - all verified against 10.x. Not fixable by upgrading fs-jetpack: gluegun@5.2.2 is the latest release and fs-jetpack@5.1.0 still requests minimatch ^5.1.0 (brace-expansion ^2.0.1, also unpatched)."
  },
  "overrides": {
    "semver@*": "7.8.5",
    "brace-expansion@<1.1.18": "1.1.18",
    "brace-expansion@>=2.0.0 <2.1.4": "2.1.4",
    "brace-expansion@>=5.0.0 <5.0.9": "5.0.9",
    "fs-jetpack": {
      "minimatch@<10": "10.2.6"
    },
    "babel-plugin-istanbul": {
      "test-exclude@<8": "8.0.0"
    },
    "minimatch@>=4 <10": "10.2.6"
  },
  "//jest.workerIdleMemoryLimit": "Recycle a ts-jest worker once its heap passes this. Guards against an intermittent `A jest worker process was terminated by another process: signal=SIGSEGV` that kills ONE suite while every other test passes (seen twice in marketplace*, both under `npm run check`, never reproducible on demand - 0 in 9 targeted runs incl. --maxWorkers=16). It is a worker crash, NOT an assertion failure: the signature is `Test suite failed to run` with the remaining count still green. All versions are current and in-range (node 24 / jest 30 / ts-jest 29 / ts 6), so this is a resilience measure against unbounded worker heap growth, not a proven root-cause fix - if it recurs, capture the suite name and re-open.",
  "jest": {
    "testEnvironment": "node",
    "rootDir": "__tests__",
    "testTimeout": 60000,
    "workerIdleMemoryLimit": "512MB",
    "testMatch": [
      "<rootDir>/*.test.ts"
    ],
    "transform": {
      "^.+\\.tsx?$": [
        "ts-jest",
        {
          "tsconfig": "tsconfig.test.json"
        }
      ]
    }
  }
}