🔒 Fix SDK and build security dependencies

clients/static-site/package.json

@@ -69,7 +69,7 @@
   "dependencies": {
     "fast-xml-parser": "^5.11.2",
     "playwright-core": "^1.64.1",
-    "serve-handler": "^6.1.7",
+    "serve-static": "^2.2.1",
     "zod": "^4.6.7"
   },
   "devDependencies": {

clients/static-site/src/server.js

@@ -1,11 +1,11 @@
 /**
- * HTTP server for serving static site files using serve-handler
+ * HTTP server for serving static site files
  * Needed because file:// protocol doesn't load assets properly
  */
 
 import { createServer } from 'node:http';
 import { resolve } from 'node:path';
-import handler from 'serve-handler';
+import serveStatic from 'serve-static';
 
 /**
  * Start an HTTP server to serve static files
@@ -16,12 +16,16 @@ import handler from 'serve-handler';
 export async function startStaticServer(rootDir, port = 0) {
   let absoluteRoot = resolve(rootDir);
   let sockets = new Set();
+  let serve = serveStatic(absoluteRoot, { fallthrough: false });
 
   let server = createServer((req, res) => {
-    return handler(req, res, {
-      public: absoluteRoot,
-      cleanUrls: false,
-      trailingSlash: false,
+    serve(req, res, error => {
+      if (res.headersSent) {
+        res.destroy();
+        return;
+      }
+      res.writeHead(error?.statusCode || 404, error?.headers);
+      res.end();
     });
   });
 

clients/static-site/tests/server.test.js

@@ -1,36 +1,4 @@
-import assert from 'node:assert/strict';
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, beforeEach, describe, it } from 'node:test';
-
+import { testStaticServer } from '../../../tests/helpers/static-server-contract.js';
 import { startStaticServer, stopStaticServer } from '../src/server.js';
 
-describe('static-site server', () => {
-  let workspace;
-  let serverInfo;
-
-  beforeEach(async () => {
-    workspace = await mkdtemp(join(tmpdir(), 'vizzly-static-server-'));
-    await mkdir(join(workspace, 'site'));
-    await writeFile(join(workspace, 'site', 'index.html'), '<h1>Hello</h1>');
-  });
-
-  afterEach(async () => {
-    await stopStaticServer(serverInfo);
-    await rm(workspace, { recursive: true, force: true });
-  });
-
-  it('serves files and stops accepting requests after shutdown', async () => {
-    serverInfo = await startStaticServer(join(workspace, 'site'));
-
-    let response = await fetch(`${serverInfo.url}/index.html`);
-    assert.equal(response.status, 200);
-    assert.match(await response.text(), /Hello/);
-
-    await stopStaticServer(serverInfo);
-    serverInfo = null;
-
-    await assert.rejects(fetch(response.url));
-  });
-});
+testStaticServer('static-site server', { startStaticServer, stopStaticServer });

clients/storybook/package.json

@@ -64,7 +64,7 @@
   },
   "dependencies": {
     "playwright-core": "^1.64.1",
-    "serve-handler": "^6.1.7"
+    "serve-static": "^2.2.1"
   },
   "devDependencies": {
     "@babel/cli": "^8.0.6",

clients/storybook/src/server.js

@@ -1,11 +1,11 @@
 /**
- * HTTP server for serving static Storybook files using serve-handler
+ * HTTP server for serving static Storybook files
  * Needed because file:// protocol doesn't load assets properly
  */
 
 import { createServer } from 'node:http';
 import { resolve } from 'node:path';
-import handler from 'serve-handler';
+import serveStatic from 'serve-static';
 
 /**
  * Start an HTTP server to serve static files
@@ -16,12 +16,16 @@ import handler from 'serve-handler';
 export async function startStaticServer(rootDir, port = 0) {
   let absoluteRoot = resolve(rootDir);
   let sockets = new Set();
+  let serve = serveStatic(absoluteRoot, { fallthrough: false });
 
   let server = createServer((req, res) => {
-    return handler(req, res, {
-      public: absoluteRoot,
-      cleanUrls: false,
-      trailingSlash: false,
+    serve(req, res, error => {
+      if (res.headersSent) {
+        res.destroy();
+        return;
+      }
+      res.writeHead(error?.statusCode || 404, error?.headers);
+      res.end();
     });
   });
 

clients/storybook/tests/server.test.js

@@ -1,39 +1,7 @@
-import assert from 'node:assert/strict';
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, beforeEach, describe, it } from 'node:test';
-
+import { testStaticServer } from '../../../tests/helpers/static-server-contract.js';
 import { startStaticServer, stopStaticServer } from '../src/server.js';
 
-describe('storybook static server', () => {
-  let workspace;
-  let serverInfo;
-
-  beforeEach(async () => {
-    workspace = await mkdtemp(join(tmpdir(), 'vizzly-storybook-server-'));
-    await mkdir(join(workspace, 'dist'));
-    await writeFile(
-      join(workspace, 'dist', 'index.html'),
-      '<h1>Storybook</h1>'
-    );
-  });
-
-  afterEach(async () => {
-    await stopStaticServer(serverInfo);
-    await rm(workspace, { recursive: true, force: true });
-  });
-
-  it('serves files and stops accepting requests after shutdown', async () => {
-    serverInfo = await startStaticServer(join(workspace, 'dist'));
-
-    let response = await fetch(`${serverInfo.url}/index.html`);
-    assert.equal(response.status, 200);
-    assert.match(await response.text(), /Storybook/);
-
-    await stopStaticServer(serverInfo);
-    serverInfo = null;
-
-    await assert.rejects(fetch(response.url));
-  });
+testStaticServer('storybook static server', {
+  startStaticServer,
+  stopStaticServer,
 });

clients/vitest/package.json

@@ -69,7 +69,7 @@
     "@vitest/browser-playwright": "^5.0.5",
     "@vizzly-testing/cli": "workspace:*",
     "playwright": "^1.64.1",
-    "serve-handler": "^6.1.7",
+    "serve-static": "^2.2.1",
     "vitest": "^5.0.5"
   }
 }

clients/vitest/vitest.e2e.config.js

@@ -2,7 +2,7 @@ import { existsSync } from 'node:fs';
 import { createServer } from 'node:http';
 import { resolve } from 'node:path';
 import { playwright } from '@vitest/browser-playwright';
-import handler from 'serve-handler';
+import serveStatic from 'serve-static';
 import { defineConfig } from 'vitest/config';
 import { vizzlyPlugin } from './src/index.js';
 
@@ -15,10 +15,15 @@ if (!existsSync(resolve(testSitePath, 'index.html'))) {
 }
 
 // Start static server for test-site assets
+let serve = serveStatic(testSitePath, { fallthrough: false });
 let server = createServer((req, res) => {
-  return handler(req, res, {
-    public: testSitePath,
-    cleanUrls: false,
+  serve(req, res, error => {
+    if (res.headersSent) {
+      res.destroy();
+      return;
+    }
+    res.writeHead(error?.statusCode || 404, error?.headers);
+    res.end();
   });
 });