Lucas BergerandClaude Sonnet 4.6 b0b5bceaed fix(12): IN-03 replace private web-push source import with Node.js built-in crypto ...

generate-secrets.mjs was importing from ../apps/api/node_modules/web-push/src/index.js
(a private source path) which breaks if web-push restructures internally or
workspace hoisting moves the package. Replace with Node.js built-in createECDH
('prime256v1') which produces identical base64url-encoded keys, including the
same defensive padding logic as web-push for short key buffers.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-15 16:22:07 -04:00

..

__tests__

style(16): apply prettier formatting to satisfy CI format:check

2026-06-13 09:29:02 -04:00

audit-allowlist.json

chore(16-02): seed audit allowlist (esbuild GHSA waiver) + outdated pin reasons

2026-06-13 05:17:13 -04:00

check-audit.mjs

fix(16): fail closed on unparseable audit-waiver expiry date

2026-06-13 08:51:53 -04:00

check-outdated.mjs

style(16): apply prettier formatting to satisfy CI format:check

2026-06-13 09:29:02 -04:00

generate-secrets.mjs

fix(12): IN-03 replace private web-push source import with Node.js built-in crypto

2026-06-15 16:22:07 -04:00

gitleaks-baseline.json

chore(16-04): commit gitleaks full-history baseline

2026-06-13 08:14:54 -04:00

outdated-pins.json

chore(16-02): seed audit allowlist (esbuild GHSA waiver) + outdated pin reasons

2026-06-13 05:17:13 -04:00