# GitWorkshop upstream

This image packages the GitWorkshop NIP-34 web client from:

- Source: https://github.com/DanConwayDev/gitworkshop
- Pinned commit: `dc36db64f6a2cca29d109829eabaf0a49d4bf4da`
- Upstream project: https://gitworkshop.dev/
- App icon: `public/icons/icon.svg` from the same pinned revision (the artwork
  is only inset onto Archipelago's standard icon safe area).

The Archipelago integration patch only makes the upstream Vite/React
application work below Archipelago's `/app/archipelago-source/` mount, injects
the existing consent-gated Archipelago NIP-07 provider, disables the
development-only `localhost:4869` cache-relay probe, and removes two unreachable
lookup relays from the defaults. It does not replace GitWorkshop's NIP-34,
GRASP, repository browser, issue, pull-request, or review interfaces.

The separate dependency patch refreshes the npm lockfile and moves `fflate` to
0.8.3, `react-router-dom` to 7.18.3, and Vitest to 5.0.0. On 2026-09-30 the lockfile was refreshed again for `brace-expansion`
1.1.21/5.0.12, `fast-uri` 3.1.8 and `ip-address` 10.7.2 after fresh node
installs failed the retained dependency audit. The resulting clean install
reports zero npm advisories; its type-check, 152 unit tests, and Archipelago
subpath production build pass. The complete image also builds on the X250.

On 2026-10-25 the retained audit failed again (19 advisories, 2 critical), and
every node rebuilding this app looped on it. The refresh:
- moves `window.nostrdb.js` to 0.7.0, which drops `@contextvm/sdk` and with it
  the vulnerable `zod` 3 and MCP SDK chain. Its `filters()` is now `query()`,
  the one source change, in `src/services/cache.ts`;
- moves the unused direct `zod` entry to 4.6.7;
- overrides `postcss-selector-parser` to 7.1.x under Tailwind 3. The generated
  CSS is byte-identical to the previous build;
- applies `npm audit fix` for the rest (vite 6.4.5, vitest 5.0.5,
  `@capacitor/android` 8.5.3, `source-map-js`, `proxy-addr`, `body-parser`,
  and others).

After a clean `npm ci` the audit reports zero advisories. `tsc`, eslint
(0 errors), 152 unit tests and the subpath build pass, and the image serves
the app. `prettier --check` reports 16 upstream files, as it did before this
refresh. Keeping this mechanical security
update separate makes both the upstream integration and future dependency
refreshes auditable.

The 2026-11-12 build audit found the new glob and minimatch advisories in
development dependencies. A separate lockfile patch pins glob 14.0.2 and
minimatch 11.0.1 through npm overrides. Keep the audit gate and run the
upstream type, lint, and test checks after this major transitive update.

The pinned revision and current upstream `main` do not contain a license file,
the package metadata declares no license, and GitHub reports no detected
license. Archipelago's owner explicitly accepted the resulting redistribution
risk on 2026-09-11. This is a project risk decision, not a claim that
GitWorkshop is licensed or that downstream recipients receive rights from its
copyright holders. An explicit upstream license remains the preferred,
auditable resolution.