make fmt rewrites vendored static/js/alpine.min.js (missing .prettierignore) #185

New Issue

2026-08-07T18:47:54+02:00

clawbot commented

2026-08-07 18:47:54 +02:00

Found while working #175: running make fmt reformats
static/js/alpine.min.js — script/fmt passes the glob
static/js/*.js to prettier and there is no .prettierignore, so
the vendored minified Alpine.js bundle gets expanded/rewritten.
Vendored artifacts must never be reformatted; a formatter pass
should leave the tree identical unless first-party code changed.

Remediation: add a .prettierignore containing at least
static/js/alpine.min.js (or *.min.js). Verify script/fmt's
explicit file arguments still respect the ignore file (prettier
requires --ignore-path handling to be confirmed when files are
passed explicitly); if not, adjust the glob in script/fmt to
exclude minified files.

Definition of done:

make fmt on a clean tree produces zero modifications
(git status clean afterward)
static/js/alpine.min.js byte-identical before and after
make fmt
first-party JS (dashboard.js, deployment.js, utils.js) is
still formatted
lands via PR from a feature branch off main

Found while working #175: running `make fmt` reformats `static/js/alpine.min.js` — `script/fmt` passes the glob `static/js/*.js` to prettier and there is no `.prettierignore`, so the vendored minified Alpine.js bundle gets expanded/rewritten. Vendored artifacts must never be reformatted; a formatter pass should leave the tree identical unless first-party code changed. Remediation: add a `.prettierignore` containing at least `static/js/alpine.min.js` (or `*.min.js`). Verify `script/fmt`'s explicit file arguments still respect the ignore file (prettier requires `--ignore-path` handling to be confirmed when files are passed explicitly); if not, adjust the glob in `script/fmt` to exclude minified files. Definition of done: - `make fmt` on a clean tree produces zero modifications (`git status` clean afterward) - `static/js/alpine.min.js` byte-identical before and after `make fmt` - first-party JS (`dashboard.js`, `deployment.js`, `utils.js`) is still formatted - lands via PR from a feature branch off `main`

clawbot added this to the 1.1.0 milestone 2026-08-07 18:47:54 +02:00

~~clawbot referenced this issue 2026-09-03 18:29:27 +02:00~~

Tag and publish release 1.1.0 #182

~~clawbot referenced this issue 2026-09-03 18:29:56 +02:00~~

Deploy µPaaS to fsn1app1 and verify end-to-end #181

clawbot referenced this issue from a commit

2026-09-22 09:38:03 +02:00

Add .prettierignore for vendored minified JS (closes #185)

clawbot referenced a pull request that will close this issue

2026-09-22 09:38:17 +02:00

Add .prettierignore for vendored minified JS (closes #185) #195

clawbot commented

2026-09-22 09:38:34 +02:00

Added .prettierignore (*.min.js) so script/fmt's static/js/*.js glob no longer feeds the vendored static/js/alpine.min.js to prettier. Confirmed prettier honors the ignore file even for files named explicitly on the command line, so the glob was left unchanged. make fmt on a clean tree now makes zero changes; alpine.min.js is byte-identical; first-party JS still formats.

PR: #195

Model: opus-4-8

Added `.prettierignore` (`*.min.js`) so `script/fmt`'s `static/js/*.js` glob no longer feeds the vendored `static/js/alpine.min.js` to prettier. Confirmed prettier honors the ignore file even for files named explicitly on the command line, so the glob was left unchanged. `make fmt` on a clean tree now makes zero changes; `alpine.min.js` is byte-identical; first-party JS still formats. PR: https://git.eeqj.de/sneak/upaas/pulls/195 Model: opus-4-8

clawbot closed this issue

2026-09-22 10:00:50 +02:00

clawbot referenced this issue from a commit

2026-09-22 10:00:51 +02:00

Add .prettierignore for vendored minified JS (closes #185)

clawbot referenced this issue

2026-09-22 10:16:14 +02:00

Reject path traversal in deploy log download handler (#177) #194

clawbot referenced this issue

2026-09-22 11:12:59 +02:00

1.1.0 milestone: security, lint, and bootstrap fixes #199

Sign in to join this conversation.