CEK v2.0 — Vuetify 4, typed hooks & server module, RPC procedures, question auto-wrap, tsdown

[rkusan00]

Summary

• Migrated all runtimes and the example element to Vuetify 4 (MD3 typography, updated component APIs, theme configuration)
• Question auto-wrap — QuestionCard and QuestionContainer applied automatically by the runtime. Elements must remove manual wrapping
• Added typed hook signatures (ElementHook, BeforeDisplayHook, OnUserInteractionHook, ProcedureHandler)
• Added ServerModule and HookMap types for typed server package default exports
• Added server procedures (RPC) — custom server-side methods callable from Edit components via the injected $rpc function
• Added isEmpty manifest function for required element validation
• Added showFeedback manifest field to control question feedback section visibility
• Added question autosave support in the edit runtime
• mocks.referencesData manifest field for custom mock linked element data
• CEK theme testing support (ThemeDialog in edit and display runtimes)-
• TailorAssetInput global component (consolidated from separate upload components)
• Expanded E2E testing utilities with API helpers and additional page object models
• Accessibility improvements
• Build toolchain migrated from tsup to tsdown with isolatedDeclarations enabled
• Migrated to TypeScript 6, Vite 8
• Bumped all dependencies to latest versions across all packages

Breaking Changes

• Content element packages using Vuetify components need to be updated for Vuetify 4 (MD3 typography classes, component API changes, theme configuration)
• Question auto-wrap — elements must remove manual QuestionContainer wrapping
• isolatedDeclarations — all exported symbols require explicit type annotations
• Build toolchain: tsup → tsdown

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​express@​5.0.3 ⏵ 5.0.6
	typescript-eslint@​8.36.0 ⏵ 8.58.2			+1
	untildify@​5.0.0 ⏵ 6.0.0	+1		+9
	openai@​5.8.2 ⏵ 6.34.0	-23		+1	+1
	@​vueuse/​core@​13.5.0 ⏵ 14.2.1			+1	-2
	lodash-es@​4.17.21 ⏵ 4.18.1		+19	+1
	vite-plugin-lib-inject-css@​2.2.2
	hash-object@​5.0.1 ⏵ 5.1.0	+4		+7	+1
	stringify-object@​5.0.0 ⏵ 6.0.0			+1
	@​types/​node@​24.0.10 ⏵ 24.12.2	+1		+1	-1
	tsx@​4.21.0
	json5@​2.2.3
	open@​10.1.2 ⏵ 11.0.0	+1		+1
	vite@​7.0.3 ⏵ 8.0.8	+3	+21		+1
	fkill@​9.0.0 ⏵ 10.0.3			+3
	concurrently@​9.2.0 ⏵ 9.2.1	+1		+1
	cors@​2.8.5 ⏵ 2.8.6
	eslint-plugin-vuejs-accessibility@​2.4.1 ⏵ 2.5.0	+1		-1	+4
	vitepress@​1.6.3 ⏵ 1.6.4	+1		+1
	vue-eslint-parser@​9.4.3 ⏵ 10.4.0	+3
	vite-plugin-vuetify@​2.1.1 ⏵ 2.1.3	+1
	express@​5.1.0 ⏵ 5.2.1
	neostandard@​0.12.2 ⏵ 0.13.0	+1		+1
	eslint-config-prettier@​10.1.5 ⏵ 10.1.8
	pid-port@​1.0.2 ⏵ 2.1.1			+3	+1
	tsdown@​0.21.9
	sequelize@​6.37.7 ⏵ 6.37.8		+16	+1
	sqlite3@​5.1.7 ⏵ 6.0.1
	eslint@​9.30.1 ⏵ 9.39.4
	eslint-plugin-vue@​10.3.0 ⏵ 10.8.0	+1			-1
	ws@​8.18.3 ⏵ 8.20.0
	typescript@​5.8.3 ⏵ 6.0.3	+1		+1
See 14 more rows in the dashboard

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[rkusan00]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91

Location: Package overview

From: pnpm-lock.yaml → npm/vitepress@1.6.4 → npm/vite@5.4.21

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

_Mark the package as acceptable risk_. To ignore this alert only
in this pull request, reply with the comment
`@SocketSecurity ignore npm/vite@5.4.21`. You can
also ignore all packages with `@SocketSecurity ignore-all`.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the [triage state of this alert](https://socket.dev/dashboard/org/tailor-cms/diff-scan/41e52e9b-dac4-4531-a310-0d427c63c4de/alert/QSQiiSJcUq5l1JaiEsaD9jzpYapFgAWEywB17aSvBKbs).

Warn
Obfuscated code: npm vite is 91.0% likely obfuscated

@SocketSecurity ignore npm/vite@5.4.21