diff --git a/AUDIT.md b/AUDIT.md index e3d26a849..77eb206d2 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -4,6 +4,8 @@ **Scope:** Full application, repository configuration, CI/CD, documentation, release validation **Current version:** **v1.28.6 released** — tag `v1.28.6` and the GitHub Release were published on 2026-09-09 from the validated `main` commit `b5d0eedf`, a recovery release fixing `v1.28.5`'s tag-triggered Tauri desktop build, which failed on every platform with a Rust/npm plugin version mismatch (`tauri-plugin-http`, `tauri-plugin-notification` drifted ahead of their npm counterparts after #661's Rust-only Dependabot bump). PR #678 aligned the npm versions and added `check-tauri-plugin-versions.mjs`, a permanent CI guard against this class of mismatch; PR #679 fixed a CHANGELOG completeness-gate PR-number reference gap that resulting-`main` surfaced right after #678 merged; PR #680 completed the version bump and release-truth reconciliation, converged through 3 correction batches for reviewer/accuracy findings. **7643+ Vitest source-declared tests across 604 test files · 2942 keys × 19 locales**. The `v1.28.5` tag itself is untouched and permanently bound to its original commit as the historical failed/incomplete desktop-release cut (its separate Docker/GHCR publish did succeed — see the release-gate entry below). Historical release sections below remain historical. +**`extract-zip` eliminated from the dependency graph (2026-09-10, Dependabot #86):** **GHSA-7pqw-9j4j-h8q3** (CVSS 8.1, high) and **GHSA-jmr9-qjv8-65gv** (CVSS 8.6) both flagged `extract-zip@2.0.1`, reachable only via `@lhci/cli@0.15.1` → `lighthouse@12.6.1` (hard-pinned exact version) → `puppeteer-core@24.41.0` → `@puppeteer/browsers@2.13.0` → `extract-zip`. No patched `extract-zip` release exists, but `@puppeteer/browsers` 3.x (pulled in by `puppeteer-core` ^25.x, pulled in by `lighthouse` 13.x) replaced `extract-zip` with `modern-tar` entirely. Verified live: `@lhci/cli@0.15.1` is the latest published release and hard-pins `lighthouse: "12.6.1"` exactly, so no parent-package upgrade alone could reach the fix — a `pnpm-workspace.yaml` `overrides.lighthouse: "13.4.1"` entry (exact-pinned, not a `>=` floor, since `@lhci/cli@0.15.1` is untested against later Lighthouse majors) forces the whole chain to the modern, `extract-zip`-free stack instead. Confirmed `@lhci/cli`'s own Lighthouse invocation is CLI-subprocess-based (`path.join(require.resolve('lighthouse'), '../../cli/index.js')`, spawned with the stable `--output json --output-path ` contract, not an internal JS API import), and lighthouse 13.4.1 keeps the identical `main`/`bin` package-layout convention as 12.6.1, de-risking the major-version jump. `pnpm why extract-zip` returns empty and the package has zero occurrences in `pnpm-lock.yaml` post-fix. Functionally validated: `lhci healthcheck --fatal` passes, and a real `lighthouse@13.4.1` CLI audit against a live URL (Chrome launch, navigation, full performance audit, valid JSON output) succeeded end-to-end. `extract-zip` was never Playwright's browser-binary downloader as two historical entries above incorrectly stated (corrected in place) — it was always this repo's separate Lighthouse CI devDependency chain, matching what `src-tauri/osv-scanner.toml` and `docs/DEPENDABOT-TRIAGE.md` already documented correctly. Both `IgnoredVulns` entries for `extract-zip` removed from `src-tauri/osv-scanner.toml`. + **Release gate (2026-09-09 — v1.28.6):** Main CI/CD run `34408072174` (the push-triggered run for the release-prep merge commit) passed all applicable required and advisory jobs (Quality Gate Node 22+24, Tauri Rust Gate, Security Audit, Verified Signatures, Build, E2E Tests, E2E Deep Coverage, Storybook, Browser Quality (VRT + Lighthouse), `CI Success`); Core Rust Gate legitimately skipped (the release-prep commit touches `src-tauri/`, not `crates/`). Main-push CodeQL SAST run `34408072137` passed; 0 open code-scanning alerts. Before tagging, a dedicated exact-SHA `workflow_dispatch` Tauri qualification (run `34410474256`) on this exact commit passed Windows/Ubuntu/macOS — this recovery's own release discipline, on top of the standard tag-triggered qualification below. The tag-triggered `Tauri desktop build` workflow `34411937761` passed all 5 jobs (`Verify release tag`, `Bundle` for windows-latest/ubuntu-22.04/macos-latest, `GitHub Release`); the tag-triggered `CI / CD` run `34411937709` independently passed all applicable jobs including `E2E Tests (Playwright)`. A parallel `Docker` workflow (`34411937646`) built and pushed `ghcr.io/qnbs/worldscript-studio:1.28.6` (digest `sha256:8fbaed94388c2bcce7b0caf182497f711748e490fdc467b0941c8cadcc77f312`). The release publishes the same asset shape as v1.28.4/v1.28.3: Linux x86_64 (rpm/deb/AppImage) and Windows x86_64 (msi/exe) artifacts with corresponding Minisign `.sig` files; macOS arm64 ships an unsigned `.dmg` installer plus a signed `.app.tar.gz` updater bundle (`.sig`) — no separate `.dmg.sig`; `latest.json` present; all 14 release assets uploaded successfully. Platform code-signing and notarization remain separate claims. No macOS x86_64 artifact, matching prior releases — Intel-macOS remains a gated qualification lane (ADR-0021). Landed via PR #678 (Tauri plugin Rust/npm version-parity fix + permanent CI guard), PR #679 (CHANGELOG completeness-gate PR-number reference fix), and PR #680 (version bump + CHANGELOG/TODO/README release truth). **Release gate (2026-09-09 — v1.28.5, desktop release failed):** Tag `v1.28.5` was created on commit `590481189c0f9980f71b4081f4a6f8fccef7388d` via PR #676's release-prep merge; the tag itself is permanently kept as-is (never deleted, moved, or re-tagged) as the historical record of this failure. Main-push CI/CD run `34353928731` and CodeQL SAST run `34353928691` both passed on the release-prep commit. The tag-triggered `Tauri desktop build` workflow `34357232967` ran `Verify release tag` successfully, then **failed on every platform's `Bundle` job individually** (`windows-latest`, `ubuntu-22.04`, `macos-latest` each failed): `tauri-plugin-http` resolved to Rust 2.6.0 vs npm 2.5.9 and `tauri-plugin-notification` resolved to Rust 2.4.0 vs npm 2.3.3, both drifted after #661's Rust-only Dependabot bump, and `tauri build` hard-rejects a Rust/npm major.minor mismatch; the `GitHub Release` job was correctly skipped since no bundle job produced assets — no GitHub Release, installer, or updater artifact was ever published for `v1.28.5`. The tag-triggered `CI / CD` run `34357232902` passed independently (it does not depend on the Tauri bundle jobs). A parallel `Docker` workflow (`34357233022`) succeeded and pushed `ghcr.io/qnbs/worldscript-studio:1.28.5` (digest `sha256:3e5ac677979de21fb45ecb2899fb824302047c114829e54265d090928862f940`) — the desktop-build failure did not affect the separately-triggered container publish. Root-caused and fixed in `v1.28.6` above via PR #678. @@ -26,7 +28,7 @@ **Quality gate (2026-08-12 — encryption lifecycle + desktop reliability + recovery journal):** lint ✅ · typecheck ✅ (tsgo) · i18n:check ✅ (**2904 keys × 19 locales**) · targeted unit tests ✅ (271 across the full affected storage suite post-merge: `protectedStoreMigration`, `encryptionMigrationJournal`, `secondaryPayloadStoreAdapter(s)`, `protectedWriteAdmission`, `idbStoreEncryption`, `dbService*`, `sceneRevisionService`, `aiInferenceCacheService`) · CI Quality Gate (Node 22 + 24) green on #337/#339 · codecov/patch ✅ (73.46% → target after adding secondary-adapter payload-shape coverage). #335 (fail-closed lifecycle), #336 (desktop AI/Python hardening for #332/#333), #337 (durable migration journal + secondary-store adapters), #339 (cross-tab write-admission fixing the migration TOCTOU race) all merged into `main`. PR #310 closed as superseded (`docs/PR-310-RECONCILIATION.md`). Production disable/passphrase-rotation wiring remains open Phase-4 work — [issue #338](https://github.com/qnbs/WorldScript-Studio/issues/338). -- **`extract-zip@2.0.1` OSV ignore (accepted risk, 2026-08-12):** **GHSA-jmr9-qjv8-65gv** / CVE-2026-56876 (CVSS 8.6, unvalidated symlink path traversal when extracting an attacker-controlled zip) flags a transitive devDependency of `@puppeteer/browsers` (Playwright's browser-binary downloader). No fixed version exists (`extract-zip@2.0.1` is the final release), so `pnpm.overrides` cannot remediate it; documented as an `IgnoredVulns` entry in `src-tauri/osv-scanner.toml`, matching the file's existing pattern for unfixable transitive findings. Not exploitable here: only ever extracts Playwright/Chromium's own CDN-hosted zip releases, never a user- or attacker-supplied archive, and ships in no production bundle. +- **`extract-zip@2.0.1` OSV ignore (accepted risk, 2026-08-12; remediated 2026-09-10, see below):** **GHSA-jmr9-qjv8-65gv** / CVE-2026-56876 (CVSS 8.6, unvalidated symlink path traversal when extracting an attacker-controlled zip) flags a transitive devDependency of `@lhci/cli`'s own Lighthouse/Puppeteer stack — corrected here; this was never Playwright's browser-binary downloader despite the similarly-named `@puppeteer/browsers` package (this repo's separate `playwright`/`playwright-core` devDependency never touched `extract-zip`). No fixed version exists (`extract-zip@2.0.1` is the final release), so `pnpm.overrides` cannot remediate it; documented as an `IgnoredVulns` entry in `src-tauri/osv-scanner.toml`, matching the file's existing pattern for unfixable transitive findings. Not exploitable here: only ever extracted Lighthouse/Puppeteer's own CDN-hosted Chrome binary releases, never a user- or attacker-supplied archive, and shipped in no production bundle. **Quality gate (2026-06-17 — language expansion +6 locales):** lint ✅ · typecheck ✅ · i18n:check ✅ (**2716 keys × 17 locales** — fi/sv/hu/is/eu + fa RTL) · placeholder guard ✅ (17 bundles) · targeted unit tests ✅ (LanguageSelector 9 · I18nContext 59 · i18nPlaceholders 33). `LanguageSelector` exonym labels localized via `portal.language.names.*` (native endonym stays hardcoded by design). **Bulk translation completed** for all 10 Beta locales (glossary v2.0, ~44 anchor terms/locale; placeholder-masked, checkpointed): post-run coverage fi 91 % · sv 90 % · hu 91 % · is 92 % · eu 92 % · fa 93 % · ja 99 % · zh 100 % · pt 98 % · el 97 % (Beta MT; human native review tracked). Two bulk-script bugs fixed: (1) `glossaryTranslate` partial-match left ~1,300 strings partially English → now exact-match only; (2) `--all` mangled `help.json` rich HTML → `help.json` excluded from `--all` (`ALL_SKIP`) and kept English fallback for the 6 new langs (tag-dense markup isn't MT-safe; human-review task). New `docs/TRANSLATION-GUIDE.md` + `I18N-GLOSSARY.md` v2.0. @@ -120,7 +122,7 @@ the same root cause in one sprint is itself the finding: **the failure mode is n ## v1.24.0 Dependency Hygiene + Onboarding + Docs Truth-up (2026-06-21, PR F) - **`joi` override (accepted risk, KEPT):** `pnpm-workspace.yaml` `overrides.joi: ^18.2.1` pins the patched `joi` pulled transitively via `wait-on` (Storybook/test-runner wait helper), mitigating **GHSA-q7cg-457f-vx79** (unpublished jsdom exposure in `@hapi/statehood`). Still required — `wait-on@9.x` still depends on `joi`. `pnpm audit --audit-level=high` clean with the override in place; rationale documented inline in `pnpm-workspace.yaml` and here. -- **`extract-zip@2.0.1` OSV ignore (accepted risk, 2026-08-12):** **GHSA-jmr9-qjv8-65gv** / CVE-2026-56876 (CVSS 8.6, unvalidated symlink path traversal when extracting an attacker-controlled zip) was published/GitHub-reviewed 2026-08-12, freshly flagging a transitive devDependency of `@puppeteer/browsers` (Playwright's browser-binary downloader). No fixed version exists (`extract-zip@2.0.1` is the final release — `pnpm.overrides` cannot remediate an unpatched advisory), so `pnpm.overrides` doesn't apply here; documented as an `IgnoredVulns` entry in `src-tauri/osv-scanner.toml` instead, matching the file's existing pattern for unfixable transitive findings. Not exploitable in this project: only ever extracts Playwright/Chromium's own CDN-hosted zip releases, never a user- or attacker-supplied archive, and ships in no production bundle. +- **`extract-zip@2.0.1` OSV ignore (accepted risk, 2026-08-12; remediated 2026-09-10):** **GHSA-jmr9-qjv8-65gv** / CVE-2026-56876 (CVSS 8.6, unvalidated symlink path traversal when extracting an attacker-controlled zip) was published/GitHub-reviewed 2026-08-12, freshly flagging a transitive devDependency of `@lhci/cli`'s own Lighthouse/Puppeteer stack — corrected here; this was never Playwright's browser-binary downloader despite the similarly-named `@puppeteer/browsers` package. No fixed version exists (`extract-zip@2.0.1` is the final release — `pnpm.overrides` cannot remediate an unpatched advisory), so `pnpm.overrides` doesn't apply here; documented as an `IgnoredVulns` entry in `src-tauri/osv-scanner.toml` instead, matching the file's existing pattern for unfixable transitive findings. Not exploitable in this project: only ever extracted Lighthouse/Puppeteer's own CDN-hosted Chrome binary releases, never a user- or attacker-supplied archive, and shipped in no production bundle. - **SBOM — deferred (decision):** evaluated a `@cyclonedx/cyclonedx-npm` generate-on-tag step; **not adopted in 1.24.0** to keep the release scope tight. Socket Security (PR + project report) already runs every CI run and provides dependency-risk + an SBOM dashboard, so the marginal value is low. Revisit when a formal SBOM artifact is required by a downstream consumer. - **README metric drift fixed:** `scripts/sync-readme-metrics.mjs` had its locale count **hard-coded to `11`**, so its regexes stopped matching after the 11→17 expansion and silently froze the key count at a stale value. Locale count is now **dynamic** (counts `locales/` dirs) and the regexes match any digit count; re-run → README reads **2786 keys × 17 locales** with the drift guard green. - **Docs truth-up:** corrected the stale `public/sw.js` "must hand-sync `APP_VERSION`" note in `CLAUDE.md` (it is auto-synced by `scripts/sync-sw-version.mjs` + `sync-tauri-version.mjs` via `predev`/`prebuild`); refreshed the stale 5-locale / `2 594 keys × 11 locales` strings in `CONTRIBUTING.md` + `.github/copilot-instructions.md` to 17 locales. @@ -1860,6 +1862,7 @@ dev/test transitive deps and are never shipped to users. | uuid | >=11.1.1 | preventive pin — no direct advisory | Conservative version floor; no security advisory applies (the prior "collision" note was inaccurate). | | joi (transitive via `wait-on` ← `@storybook/test-runner` → `jest-process-manager`) | ^18.2.1 | transitive hardening (dev-only) | `wait-on@7.2.0` originally pulled an older `joi`; lockfile pins `joi@18.2.1` for both `wait-on@7.2.0` and `wait-on@9.0.10`. Dev/test toolchain only, never shipped. | | fflate | >=0.8.3 | GHSA-px8p-9vwx-vf98 / CVE-2026-45820 | `unzipSync()` infinite loop on a crafted ZIP64 archive missing its required extra field (≤0.8.2; fixed at or above 0.8.3). Transitive via `jspdf@4.2.1` (PDF export), whose own `^0.8.1` range already permits the patched version. Advisory elevated to GitHub-reviewed status 2026-09-03, discovered via a routine Security Audit CI failure the same day. | +| lighthouse | 13.4.1 (exact) | GHSA-jmr9-qjv8-65gv + GHSA-7pqw-9j4j-h8q3 (extract-zip, no fixed version exists) | `@lhci/cli@0.15.1` (latest published release) hard-pins `lighthouse@12.6.1`, whose `puppeteer-core` → `@puppeteer/browsers@2.x` chain pulls the vulnerable `extract-zip`. Lighthouse 13.4.1's `puppeteer-core` (^25.x) moves to `@puppeteer/browsers@3.x`, which replaced `extract-zip` with `modern-tar`, eliminating it from the graph. Exact-pinned rather than a `>=` floor because `@lhci/cli@0.15.1` is untested against later Lighthouse majors — only 13.4.1's CLI-subprocess bridge has been compatibility-verified (`lhci healthcheck` + a real end-to-end Lighthouse audit). Dev-only transitive (Lighthouse CI), never shipped. Remove this override (or raise it) if `@lhci/cli` publishes a release with a non-exact `lighthouse` range, or if `extract-zip` is otherwise fully retired from the ecosystem. | **Dependency hygiene status (2026-06-13):** - `pnpm audit --audit-level=high` → 0 vulnerabilities. diff --git a/CHANGELOG.md b/CHANGELOG.md index 35c64663f..1df2363dc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Fixed + +- **`extract-zip` eliminated from the dependency graph (Dependabot #86, GHSA-7pqw-9j4j-h8q3 / + GHSA-jmr9-qjv8-65gv):** the vulnerable package was reachable only via `@lhci/cli`'s hard-pinned + `lighthouse@12.6.1` → `puppeteer-core` → `@puppeteer/browsers@2.x` chain. A + `pnpm-workspace.yaml` override exact-pins `lighthouse` to `13.4.1`, whose modern + `@puppeteer/browsers@3.x` dependency replaced `extract-zip` with `modern-tar` entirely — the + package now has zero occurrences in the resolved graph. Lighthouse 13.4.1 requires Node + `>=22.19`, so the repository's own `engines.node` floor is raised to match. PR #682. + ### Documentation - **Post-release v1.28.6 truth sync:** removed the now-stale release-candidate markers from diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 897e299a4..99eadc13c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -26,13 +26,13 @@ This project follows the [Contributor Covenant Code of Conduct](.github/CODE_OF_ ### Prerequisites -- **Node.js** ≥ 22 (see [`.nvmrc`](.nvmrc); matches `engines` in [`package.json`](package.json)) +- **Node.js** ≥ 22.19 (see [`.nvmrc`](.nvmrc); matches `engines` in [`package.json`](package.json)) - **pnpm** ≥ 11 (see `packageManager` in `package.json`; recommended via **Corepack**, ships with Node) - A **Gemini API Key** from [Google AI Studio](https://aistudio.google.com/app/apikey) (optional if using **Ollama** in the desktop app only) ### Windows: Node, Corepack, and pnpm -1. Install **Node.js 22+** LTS from [nodejs.org](https://nodejs.org/) (includes Corepack) or use **nvm-windows** and install `22` from [`.nvmrc`](.nvmrc). +1. Install **Node.js ≥22.19** LTS from [nodejs.org](https://nodejs.org/) (includes Corepack; matches `engines` in [`package.json`](package.json)) or use **nvm-windows** and install `22` from [`.nvmrc`](.nvmrc) — pick the latest available 22.x patch, not the first one nvm-windows offers. 2. Open **PowerShell or CMD as Administrator** once and run: `corepack enable` 3. In the repo folder: `corepack prepare pnpm@11.22.0 --activate` (version matches `packageManager` in [`package.json`](package.json); adjust if that field changes). 4. Confirm: `pnpm -v` — then `node scripts/dependency-state.mjs reconcile` (never a bare `pnpm install` — see [Installation](#installation)) and use `pnpm run …` for all scripts (hooks expect `pnpm` on `PATH`). diff --git a/README.md b/README.md index a2a591367..5716aaf1c 100644 --- a/README.md +++ b/README.md @@ -63,7 +63,7 @@ Two always-on hosted builds — open whichever you prefer (identical app, both a > Everything is saved locally in IndexedDB and works offline (PWA). Nothing leaves your device unless you choose a cloud provider. -**Running it yourself?** `node scripts/dependency-state.mjs reconcile && pnpm run dev` (Node ≥ 22, pnpm 11; frozen-lockfile install — never a bare `pnpm install`) → . Full setup, deployment, and AI-provider options — including the new **OpenRouter** free-tier gateway — are in [Getting Started](#getting-started). +**Running it yourself?** `node scripts/dependency-state.mjs reconcile && pnpm run dev` (Node ≥ 22.19, pnpm 11; frozen-lockfile install — never a bare `pnpm install`) → . Full setup, deployment, and AI-provider options — including the new **OpenRouter** free-tier gateway — are in [Getting Started](#getting-started). --- @@ -567,7 +567,7 @@ WorldScript-Studio/ A modern browser (Chrome 90+, Firefox 88+, Safari 14+, Edge 90+) is all you need for the web app — no installation required. -For local development: **Node ≥ 22**, **pnpm 11** (`npm install -g pnpm`). For the desktop app: **Rust + Tauri CLI** (`cargo install tauri-cli`). +For local development: **Node ≥ 22.19**, **pnpm 11** (`npm install -g pnpm`). For the desktop app: **Rust + Tauri CLI** (`cargo install tauri-cli`). ### 🔐 Setting Up AI @@ -631,7 +631,7 @@ Vercel is a **first-class** hosting option alongside Pages: connect the repo, us git clone https://github.com/qnbs/WorldScript-Studio.git cd WorldScript-Studio -# Install dependencies (Node ≥ 22, pnpm 11) — frozen-lockfile install, never a bare `pnpm install` +# Install dependencies (Node ≥ 22.19, pnpm 11) — frozen-lockfile install, never a bare `pnpm install` node scripts/dependency-state.mjs reconcile # Start the development server (http://localhost:3000) diff --git a/TODO.md b/TODO.md index 439df26f9..4b984bfbf 100644 --- a/TODO.md +++ b/TODO.md @@ -10,7 +10,7 @@ Status: 🔄 in progress | ⬜ open | ✅ done ## Current Sprint — v1.28.6 corrected release cut: Tauri desktop release-build recovery (2026-09-09) -> **Status: 🔄 in progress.** The authoritative native sequence remains +> **Status: ✅ done.** The authoritative native sequence remains > [`docs/native/ROADMAP-QT-GPUI-DESKTOP.md`](docs/native/ROADMAP-QT-GPUI-DESKTOP.md), with the > next Rust-Core capability choice recorded in [`docs/native/CORE-MIGRATION-LEDGER.md`](docs/native/CORE-MIGRATION-LEDGER.md). > R-15 implementation stays blocked behind the still-open Wave 2 prerequisite (ledger row 9). No diff --git a/docs/DEPENDABOT-TRIAGE.md b/docs/DEPENDABOT-TRIAGE.md index 2d0c8d4c7..9fbcc5447 100644 --- a/docs/DEPENDABOT-TRIAGE.md +++ b/docs/DEPENDABOT-TRIAGE.md @@ -99,6 +99,14 @@ with no patched release and no production-runtime footprint; it must still be rechecked before expiry and removed as soon as an upstream fix or dependency-path change makes that possible. Review each cluster against current upstream status before changing any deadline. +**2026-09-10 update: both `extract-zip` ignores retired.** A `pnpm-workspace.yaml` +`overrides.lighthouse: ">=13.4.1"` entry forces `@lhci/cli`'s Lighthouse/Puppeteer chain onto a +version whose `@puppeteer/browsers` dependency replaced `extract-zip` with `modern-tar` — +eliminating the package from the resolved graph entirely (`pnpm why extract-zip` now returns +nothing). `GHSA-jmr9-qjv8-65gv` and `GHSA-7pqw-9j4j-h8q3` are removed from +`src-tauri/osv-scanner.toml`; the cluster total drops from 21 to 19. See AUDIT.md's 2026-09-10 +entry for the full verification trail. + ## Special-attention dependencies These need more than a changelog skim because of documented quirks elsewhere in this repo: diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md index d395eb37c..69e3ecb46 100644 --- a/docs/DEPLOYMENT.md +++ b/docs/DEPLOYMENT.md @@ -42,7 +42,7 @@ gh run view --log-failed - **Install:** `node scripts/dependency-state.mjs reconcile` - **Build:** `pnpm run build:edge` - **Output:** `dist` -3. **Node.js** ≥ 22 (Project Settings → General). +3. **Node.js** ≥ 22.19 (Project Settings → General; matches `engines` in `package.json`). 4. **Environment variables (optional):** `DEPLOY_TARGET=edge` — redundant if using `build:edge`; do **not** add AI API keys for end users. 5. SPA routing: `rewrites` in `vercel.json` → `index.html`. 6. **Preview deployments:** enabled per branch/PR by default. diff --git a/infra/low-end-ci/INSTALL.md b/infra/low-end-ci/INSTALL.md index 6e60656d6..7b74519f6 100644 --- a/infra/low-end-ci/INSTALL.md +++ b/infra/low-end-ci/INSTALL.md @@ -226,7 +226,7 @@ restore-ci.sh ~/worldscript-ci/backups/ | act: exec format error | Wrong arch — check release `amd64` vs `arm64` | | OOM during act | Swap ≥6G, `ci-eco-stop.sh`, `--sequential` only, single-axis matrix | | Forgejo won't start | `docker logs worldscript-forgejo`; data directory permissions `chown 1000:1000` | -| Node too old | `fnm use 22` — project requires Node ≥22 | +| Node too old | `fnm install 22 --latest && fnm use 22` — project requires Node ≥22.19 | --- diff --git a/package.json b/package.json index f25df0385..f3a5fe77b 100644 --- a/package.json +++ b/package.json @@ -15,7 +15,7 @@ "type": "module", "packageManager": "pnpm@11.22.0", "engines": { - "node": ">=22.0.0", + "node": ">=22.19.0", "pnpm": "11.22.0" }, "scripts": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index db2d41f4c..fa2d52671 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -35,6 +35,7 @@ overrides: postcss: '>=8.5.18' sharp: '>=0.35.4' body-parser: '>=1.20.6 <2' + lighthouse: 13.4.1 patchedDependencies: zod@4.4.3: 338616f6b312752cd87f1779a712517e6ffff9fc470a3f3e69d1cdc5a8ca0d93 @@ -217,7 +218,7 @@ importers: version: 2.0.1(vite@8.2.1(@types/node@25.9.2)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.50.0)(tsx@4.23.12)(yaml@2.9.0)) '@lhci/cli': specifier: ^0.15.1 - version: 0.15.1(supports-color@10.2.2) + version: 0.15.1(@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1))(supports-color@10.2.2)(yauzl@2.10.0) '@playwright/test': specifier: ^1.62.1 version: 1.62.1 @@ -2119,10 +2120,48 @@ packages: '@octokit/types@17.0.0': resolution: {integrity: sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==} + '@opentelemetry/api-logs@0.220.0': + resolution: {integrity: sha512-CmVa4ImJ+ynfrPMNaAXHET6Bhb44SwzmfyVJFq9ni2jgXJR/l7C6gfVFddNmHP+ZOkP9cf4f9DBe68qVLTHc9w==} + engines: {node: '>=8.0.0'} + '@opentelemetry/api@1.9.1': resolution: {integrity: sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q==} engines: {node: '>=8.0.0'} + '@opentelemetry/core@2.11.0': + resolution: {integrity: sha512-7YP44XH0tV6+Mb54x2YGf84i7yi+31MBZlE8JwvozkxyTvXbSp10X7cI7YE49ChJ3shMJoBmCJF3+1QFBJctGA==} + engines: {node: ^18.19.0 || >=20.6.0} + peerDependencies: + '@opentelemetry/api': '>=1.0.0 <1.10.0' + + '@opentelemetry/instrumentation@0.220.0': + resolution: {integrity: sha512-xQx3E2WxP1mDvKzxLxX+CTCtNLa560YJZ3087qYHerl2YmiKpv7AH+dAy7vmx+eVrZ5BwhfWUAVoKOoxCNHcpw==} + engines: {node: ^18.19.0 || >=20.6.0} + peerDependencies: + '@opentelemetry/api': ^1.3.0 + + '@opentelemetry/resources@2.11.0': + resolution: {integrity: sha512-Ie7+8q8MDF4FAEQCKVMTx3ReUvxiIAgIiiW3c9JdmP8+HMcDy20puT+AHjexnExgnbvBxjQ9fjkFDWrikJ2jQA==} + engines: {node: ^18.19.0 || >=20.6.0} + peerDependencies: + '@opentelemetry/api': '>=1.3.0 <1.10.0' + + '@opentelemetry/sdk-trace-base@2.11.0': + resolution: {integrity: sha512-H19x/TX/LZdqiYOjM7fqtSxwlplC5pgelavqbQdHbhdq0q/AI/TGkM2dfGuuynTXmJPeF2HoZVoPDu+TGoW78A==} + engines: {node: ^18.19.0 || >=20.6.0} + peerDependencies: + '@opentelemetry/api': '>=1.3.0 <1.10.0' + + '@opentelemetry/sdk-trace@2.11.0': + resolution: {integrity: sha512-fFnTqGm8/G73GQVnxYi7LXa1ZVYEUvgL6XI1LpvV0bPC7WQ/ZGgKxCSl8FnlZBKto9JHHEFTO6s6CUpvvtwFrA==} + engines: {node: ^18.19.0 || >=20.6.0} + peerDependencies: + '@opentelemetry/api': '>=1.3.0 <1.10.0' + + '@opentelemetry/semantic-conventions@1.43.0': + resolution: {integrity: sha512-eSYWTm620tTk45EKSedaUL8MFYI8hW164hIXsgIHyxu3VobUB3fFCu5t0hQby6OoWRPsG1KkKUG2M5UadiLiVg==} + engines: {node: '>=14'} + '@oxc-parser/binding-android-arm-eabi@0.127.0': resolution: {integrity: sha512-0LC7ye4hvqbIKxAzThzvswgHLFu2AURKzYLeSVvLdu2TBOYWQDmHnTqPLeA597BcUCxiLqLsS4CJ5uoI5WYWCQ==} engines: {node: ^20.19.0 || >=22.12.0} @@ -2359,8 +2398,8 @@ packages: cpu: [x64] os: [win32] - '@paulirish/trace_engine@0.0.53': - resolution: {integrity: sha512-PUl/vlfo08Oj804VI5nDPeSk9vyslnBlVzDDwFt8SUVxY8+KdGMkra/vrXjEEHe8gb7+RqVTfOIlGw0nyrEelA==} + '@paulirish/trace_engine@0.0.65': + resolution: {integrity: sha512-Qsm6F5C8xf6ZzQXbQc2+wcpe6sggfs/gvc/ytqSurdvYg3kyW0ECHCqE0CWBKZpqgjVfPNX9c7SCS3r2nEIRGg==} '@pkgjs/parseargs@0.11.0': resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==} @@ -2384,10 +2423,18 @@ packages: '@poppinss/exception@1.2.3': resolution: {integrity: sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw==} - '@puppeteer/browsers@2.13.0': - resolution: {integrity: sha512-46BZJYJjc/WwmKjsvDFykHtXrtomsCIrwYQPOP7VfMJoZY2bsDF9oROBABR3paDjDcmkUye1Pb1BqdcdiipaWA==} - engines: {node: '>=18'} + '@puppeteer/browsers@3.2.1': + resolution: {integrity: sha512-KDz+3qDRdBAlRlMjmKyj6dEs33YHTk/xRHEENSXq6TNnhgoU15ruSHtEBeVF6OZ9tBDY55Se4P0nFMNsipzU9A==} + engines: {node: '>=22.12.0'} hasBin: true + peerDependencies: + proxy-agent: '>=8.0.1' + yauzl: ^2.10.0 || ^3.4.0 + peerDependenciesMeta: + proxy-agent: + optional: true + yauzl: + optional: true '@reduxjs/toolkit@2.12.0': resolution: {integrity: sha512-KiT+RzZbp6mQET+Mg+h2c97+9j1sNflUxQkIHI7Yuzf6Peu+OYpmkn6nbHWmLLWj+1ZODUJFwGZ7gx3L9R9EOw==} @@ -2683,29 +2730,50 @@ packages: '@sec-ant/readable-stream@0.4.1': resolution: {integrity: sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg==} - '@sentry-internal/tracing@7.120.4': - resolution: {integrity: sha512-Fz5+4XCg3akeoFK+K7g+d7HqGMjmnLoY2eJlpONJmaeT9pXY7yfUyXKZMmMajdE2LxxKJgQ2YKvSCaGVamTjHw==} - engines: {node: '>=8'} + '@sentry/conventions@0.16.0': + resolution: {integrity: sha512-fO9PLmHdVURcSPUpWCItWAtgKiMwGdJHbovoSEyLplX5sxs2ugvI4CBPTrkkgqhObnZOD0CnWBKDzSVQYBKEyQ==} + engines: {node: '>=14'} - '@sentry/core@7.120.4': - resolution: {integrity: sha512-TXu3Q5kKiq8db9OXGkWyXUbIxMMuttB5vJ031yolOl5T/B69JRyAoKuojLBjRv1XX583gS1rSSoX8YXX7ATFGA==} - engines: {node: '>=8'} + '@sentry/core@10.73.0': + resolution: {integrity: sha512-FLO1UgH19RyasVpofu612WCOgb2nEH0dZy+R72d7p65XU9i0wxlMKm3+sgfwKmiSJp1Qhilaaxs4Jg6BbiM5HA==} + engines: {node: '>=18'} - '@sentry/integrations@7.120.4': - resolution: {integrity: sha512-kkBTLk053XlhDCg7OkBQTIMF4puqFibeRO3E3YiVc4PGLnocXMaVpOSCkMqAc1k1kZ09UgGi8DxfQhnFEjUkpA==} - engines: {node: '>=8'} + '@sentry/node-core@10.73.0': + resolution: {integrity: sha512-GHAGUmZPmm6FKfxfv2maVVJ/A99YAmd7oFOuKMDmITI6O/Msl6JB3vPTEpopVAHLW0LYJQBOjddL9C7o+Jt44g==} + engines: {node: '>=18'} + peerDependencies: + '@opentelemetry/api': ^1.9.0 + '@opentelemetry/core': ^1.30.1 || ^2.1.0 + '@opentelemetry/exporter-trace-otlp-http': '>=0.57.0 <1' + '@opentelemetry/instrumentation': '>=0.57.1 <1' + '@opentelemetry/sdk-trace-base': ^1.30.1 || ^2.1.0 + peerDependenciesMeta: + '@opentelemetry/api': + optional: true + '@opentelemetry/core': + optional: true + '@opentelemetry/exporter-trace-otlp-http': + optional: true + '@opentelemetry/instrumentation': + optional: true + '@opentelemetry/sdk-trace-base': + optional: true - '@sentry/node@7.120.4': - resolution: {integrity: sha512-qq3wZAXXj2SRWhqErnGCSJKUhPSlZ+RGnCZjhfjHpP49KNpcd9YdPTIUsFMgeyjdh6Ew6aVCv23g1hTP0CHpYw==} - engines: {node: '>=8'} + '@sentry/node@10.73.0': + resolution: {integrity: sha512-jiMJ6GgXDw6UMGzJY+o0c8OoeA9OfHqZ/xEpHfDqy75hn+9CEkRkbNGCIdMvsc7wW/Se1Os394hHfTpU+YEskg==} + engines: {node: '>=18'} - '@sentry/types@7.120.4': - resolution: {integrity: sha512-cUq2hSSe6/qrU6oZsEP4InMI5VVdD86aypE+ENrQ6eZEVLTCYm1w6XhW1NvIu3UuWh7gZec4a9J7AFpYxki88Q==} - engines: {node: '>=8'} + '@sentry/opentelemetry@10.73.0': + resolution: {integrity: sha512-fQouPQKsH0CQrw6oAn1k0Z2I+tgyochCovifr5qNS69i0OzjknLa03WJyiZ/IuzXc4AVa5jAKfOeE9slABz8Qw==} + engines: {node: '>=18'} + peerDependencies: + '@opentelemetry/api': ^1.9.0 + '@opentelemetry/core': ^1.30.1 || ^2.1.0 + '@opentelemetry/sdk-trace-base': ^1.30.1 || ^2.1.0 - '@sentry/utils@7.120.4': - resolution: {integrity: sha512-zCKpyDIWKHwtervNK2ZlaK8mMV7gVUijAgFeJStH+CU/imcdquizV3pFLlSQYRswG+Lbyd6CT/LGRh3IbtkCFw==} - engines: {node: '>=8'} + '@sentry/server-utils@10.73.0': + resolution: {integrity: sha512-QskripdKFbM/+gipC6mpa2crLwL7+VbkX84IpHg2z9UlYQ1kNKd3aMT+Qk9NLRSw/zu1rSIAvlbWfx4D3rgNAA==} + engines: {node: '>=18'} '@sinclair/typebox@0.34.49': resolution: {integrity: sha512-brySQQs7Jtn0joV8Xh9ZV/hZb9Ozb0pmazDIASBkYKCjXrXU3mpcFahmK/z4YDhGkQvP9mWJbVyahdtU5wQA+A==} @@ -3342,9 +3410,6 @@ packages: '@types/yargs@17.0.35': resolution: {integrity: sha512-qUHkeCyQFxMXg79wQfTtfndEC+N9ZZg76HJftDJp+qH2tV7Gj4OJi7l+PiWwJ+pWtW8GwSmqsDj/oymhrTWXjg==} - '@types/yauzl@2.10.3': - resolution: {integrity: sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==} - '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260421.2': resolution: {integrity: sha512-fHv1r3ZmVo6zxuAIFmuX3w9QxbcauoG0SsWhmDwm6VmRubLlOJIcmTtlmV3JAb9oOnq8LuzZljzT7Q39fSMQDw==} cpu: [arm64] @@ -3762,6 +3827,9 @@ packages: resolution: {integrity: sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==} engines: {node: '>= 4.0.0'} + atomically@2.1.1: + resolution: {integrity: sha512-P4w9o2dqARji6P7MHprklbfiArZAWvo07yW7qs3pdljb3BWr12FIB7W+p0zJiuiVsUpRO0iZn1kFFcpPegg0tQ==} + available-typed-arrays@1.0.7: resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==} engines: {node: '>= 0.4'} @@ -3773,14 +3841,6 @@ packages: axios@1.19.0: resolution: {integrity: sha512-ht/iuYZXEjFxLH/Hkezgd7m6JKlHHXEUSneaDz8uZe1Gj5QZtCnpyDsckvAiEnT89OEbCLmnte4R4sn7P0EKFw==} - b4a@1.8.0: - resolution: {integrity: sha512-qRuSmNSkGQaHwNbM7J78Wwy+ghLEYF1zNrSeMxj4Kgw6y33O3mXcQ6Ie9fRvfU/YnxWkOchPXbaLb73TkIsfdg==} - peerDependencies: - react-native-b4a: '*' - peerDependenciesMeta: - react-native-b4a: - optional: true - babel-jest@30.4.1: resolution: {integrity: sha512-fATAbM8piYxkiXQp3RBXmZHxZVNJZAVXXfyeyCN2Tida3+qJ8ea9UxhiJ2y4fLO90ZImKt6k9FlcH2+rLkJGhw==} engines: {node: ^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0} @@ -3825,47 +3885,6 @@ packages: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} - bare-events@2.8.2: - resolution: {integrity: sha512-riJjyv1/mHLIPX4RwiK+oW9/4c3TEUeORHKefKAKnZ5kyslbN+HXowtbaVEqt4IMUB7OXlfixcs6gsFeo/jhiQ==} - peerDependencies: - bare-abort-controller: '*' - peerDependenciesMeta: - bare-abort-controller: - optional: true - - bare-fs@4.7.1: - resolution: {integrity: sha512-WDRsyVN52eAx/lBamKD6uyw8H4228h/x0sGGGegOamM2cd7Pag88GfMQalobXI+HaEUxpCkbKQUDOQqt9wawRw==} - engines: {bare: '>=1.16.0'} - peerDependencies: - bare-buffer: '*' - peerDependenciesMeta: - bare-buffer: - optional: true - - bare-os@3.8.7: - resolution: {integrity: sha512-G4Gr1UsGeEy2qtDTZwL7JFLo2wapUarz7iTMcYcMFdS89AIQuBoyjgXZz0Utv7uHs3xA9LckhVbeBi8lEQrC+w==} - engines: {bare: '>=1.14.0'} - - bare-path@3.0.0: - resolution: {integrity: sha512-tyfW2cQcB5NN8Saijrhqn0Zh7AnFNsnczRcuWODH0eYAXBsJ5gVxAUuNr7tsHSC6IZ77cA0SitzT+s47kot8Mw==} - - bare-stream@2.13.0: - resolution: {integrity: sha512-3zAJRZMDFGjdn+RVnNpF9kuELw+0Fl3lpndM4NcEOhb9zwtSo/deETfuIwMSE5BXanA0FrN1qVjffGwAg2Y7EA==} - peerDependencies: - bare-abort-controller: '*' - bare-buffer: '*' - bare-events: '*' - peerDependenciesMeta: - bare-abort-controller: - optional: true - bare-buffer: - optional: true - bare-events: - optional: true - - bare-url@2.4.0: - resolution: {integrity: sha512-NSTU5WN+fy/L0DDenfE8SXQna4voXuW0FHM7wH8i3/q9khUSchfPbPezO4zSFMnDGIf9YE+mt/RWhZgNRKRIXA==} - base64-arraybuffer@1.0.2: resolution: {integrity: sha512-I3yl4r9QB5ZRY3XuJVEPfc2XhZO6YweFPI+UovAzn+8/hb3oJ6lnysaFcjVpkCPfVWFUDvoZ8kmVDP7WyRtYtQ==} engines: {node: '>= 0.6.0'} @@ -4026,8 +4045,9 @@ packages: engines: {node: '>=12.13.0'} hasBin: true - chromium-bidi@14.0.0: - resolution: {integrity: sha512-9gYlLtS6tStdRWzrtXaTMnqcM4dudNegMXJxkR0I/CXObHalYeYcAMPrL19eroNZHtJ8DQmu1E+ZNOYu/IXMXw==} + chromium-bidi@17.0.2: + resolution: {integrity: sha512-5v9GQFhTktFvotn/OFNJBmKLKRAb6n9r0bVCwf7sHgWc3/JryK0bj1nn93L3pHFrfgcsu6Be6EWsDi+1XHTGDg==} + engines: {node: '>=20.19.0 <22.0.0 || >=22.12.0'} peerDependencies: devtools-protocol: '*' @@ -4129,9 +4149,9 @@ packages: resolution: {integrity: sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==} engines: {node: '>= 0.8.0'} - configstore@5.0.1: - resolution: {integrity: sha512-aMKprgk5YhBNyH25hj8wGt2+D52Sw1DRRIzqBwLp2Ya9mFmY8KPvvtvmna8SxVR9JMZ4kzMD68N22vlaRpkeFA==} - engines: {node: '>=8'} + configstore@7.1.0: + resolution: {integrity: sha512-N4oog6YJWbR9kGyXvS7jEykLDXIE2C0ILYqNBZBp9iwiJpoCBWYsuAdW6PPFn6w06jjnC+3JstVvWHO4cZqvRg==} + engines: {node: '>=18'} content-disposition@0.5.4: resolution: {integrity: sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==} @@ -4184,8 +4204,8 @@ packages: resolution: {integrity: sha512-v1plID3y9r/lPhviJ1wrXpLeyUIGAZ2SHNYTEapm7/8A9nLPoyvVp3RK/EPFqn5kEznyWgYZNsRtYYIWbuG8KA==} engines: {node: '>=8'} - csp_evaluator@1.1.5: - resolution: {integrity: sha512-EL/iN9etCTzw/fBnp0/uj0f5BOOGvZut2mzsiiBZ/FdT6gFQCKRO/tmcKOxn5drWZ2Ndm/xBb1SI4zwWbGtmIw==} + csp_evaluator@1.1.8: + resolution: {integrity: sha512-EwOnfYuNbTytvbMKsLixTrRgnjOa0WZCxGy8A9nnSYAicrdwn+T/epU/yjgymmOxlgKnvH+8wXt+7p/8ak5Feg==} css-line-break@2.1.0: resolution: {integrity: sha512-FHcKFCZcAha3LwfVBhCQbW2nCNbkZXn7KVUJcsT5/P8YmfsVja0FMPJr0B903j/E69HUphKiV9iQArX8SDYA4w==} @@ -4421,11 +4441,11 @@ packages: detect-node@2.1.0: resolution: {integrity: sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g==} - devtools-protocol@0.0.1467305: - resolution: {integrity: sha512-LxwMLqBoPPGpMdRL4NkLFRNy3QLp6Uqa7GNp1v6JaBheop2QrB9Q7q0A/q/CYYP9sBfZdHOyszVx4gc9zyk7ow==} + devtools-protocol@0.0.1663043: + resolution: {integrity: sha512-33aOY3ZnBP1dgZsshgaL+/XlsQleiFZgyUaDtdZkEa1nbZhVY1MoDeWjk+wxg25fU924l1ZJfoGNmjjeA/5s1w==} - devtools-protocol@0.0.1595872: - resolution: {integrity: sha512-kRfgp8vWVjBu/fbYCiVFiOqsCk3CrMKEo3WbgGT2NXK2dG7vawWPBljixajVgGK9II8rDO9G0oD0zLt3I1daRg==} + devtools-protocol@0.0.1666840: + resolution: {integrity: sha512-gCcO42XCHKEs7Ag0S7aGYsnJ7hlgrO3qderYqeiY0Eqk+0GFfuvT13IA0hHreJTa2KCdDVyGMeOhdMNmrrTjVg==} diff-match-patch@1.0.5: resolution: {integrity: sha512-IayShXAgj/QMXgB0IWmKx+rOPuGMhqm5w6jvFxmVenXKIzRqTAAsbBPT3kWQeGANj3jGgvcvv4yK6SxqYmikgw==} @@ -4468,9 +4488,9 @@ packages: domutils@1.7.0: resolution: {integrity: sha512-Lgd2XcJ/NjEw+7tFvfKxOzCYKZsdct5lczQ2ZaQY8Djz7pfAD3Gbp8ySJWtreII/vDlMVmxwa6pHmdxIYgttDg==} - dot-prop@5.3.0: - resolution: {integrity: sha512-QM8q3zDe58hqUqjraQOmzZ1LIH9SWQJTlEKCH4kJ2oQvLZk7RbQXvtDM2XEq3fwkV9CCvvH4LA0AV+ogFsBM2Q==} - engines: {node: '>=8'} + dot-prop@9.0.0: + resolution: {integrity: sha512-1gxPBJpI/pcjQhKgIU91II6Wkay+dLcN3M6rf2uwP8hRur3HtQXjVrdAK3sjC0piaEuxzMwjXChcETiJl47lAQ==} + engines: {node: '>=18'} driver.js@1.8.0: resolution: {integrity: sha512-+8/IO7h1v14IzWh2GP60N7T3PFZweXwdn5e5POuxRSBoCYUojsBxzqawPeXh3YZIibRy7EehYNEyxe7slwwtdg==} @@ -4520,9 +4540,6 @@ packages: resolution: {integrity: sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==} engines: {node: '>= 0.8'} - end-of-stream@1.4.5: - resolution: {integrity: sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==} - enhanced-resolve@5.24.5: resolution: {integrity: sha512-L1l8TNvomm6UVW5B253AGxQagSQr+vGwhMlrrfRS2qmhx46AMpMVJKQYLvWYbysTMY8VoicOvzHzoHMbyzB+4A==} engines: {node: '>=10.13.0'} @@ -4653,9 +4670,6 @@ packages: eventemitter3@5.0.4: resolution: {integrity: sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==} - events-universal@1.0.1: - resolution: {integrity: sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw==} - eventsource-parser@3.1.1: resolution: {integrity: sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ==} engines: {node: '>=18.0.0'} @@ -4703,11 +4717,6 @@ packages: resolution: {integrity: sha512-hMQ4CX1p1izmuLYyZqLMO/qGNw10wSv9QDCPfzXfyFrOaCSSoRfqE1Kf1s5an66J5JZC62NewG+mK49jOCtQew==} engines: {node: '>=4'} - extract-zip@2.0.1: - resolution: {integrity: sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg==} - engines: {node: '>= 10.17.0'} - hasBin: true - fake-indexeddb@6.2.5: resolution: {integrity: sha512-CGnyrvbhPlWYMngksqrSSUT1BAVP49dZocrHuK0SvtR0D5TMs5wP0o3j7jexDJW01KSadjBp1M/71o/KR3nD1w==} engines: {node: '>=18'} @@ -4715,9 +4724,6 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-fifo@1.3.2: - resolution: {integrity: sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==} - fast-json-stable-stringify@2.1.0: resolution: {integrity: sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==} @@ -4924,10 +4930,6 @@ packages: resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==} engines: {node: '>= 0.4'} - get-stream@5.2.0: - resolution: {integrity: sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA==} - engines: {node: '>=8'} - get-stream@6.0.1: resolution: {integrity: sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==} engines: {node: '>=10'} @@ -5128,6 +5130,10 @@ packages: immer@11.1.8: resolution: {integrity: sha512-/tbkHMW7y10Lx6i1crLjD4/OhNkRG+Fo7byZHtah0547nIeXYcpIXaUh0IAQY6gO5459qpGGYapcEOHtFXkIuA==} + import-in-the-middle@3.4.0: + resolution: {integrity: sha512-Xfjwfarhe+LGmoaof+sexeNo3sGRysb5x56WrZLwHtmqT0OilSKtVWkv0lrCcMgSKyKP9oBogBAisHZvtJH0aw==} + engines: {node: '>=18'} + import-local@3.2.0: resolution: {integrity: sha512-2SPlun1JUPWoM6t3F0dw0FkCF/jWY8kttcY4f599GLTSjh2OCuuhdTkJQsEcZzBqbXZGKMK2OqW1oZsjtf/gQA==} engines: {node: '>=8'} @@ -5278,10 +5284,6 @@ packages: resolution: {integrity: sha512-l4RyHgRqGN4Y3+9JHVrNqO+tN0rV5My76uW5/nuO4K1b6vw5G8d/cmFjP9tRfEsdhZNt0IFdZuK/c2Vr4Nb+Qg==} engines: {node: '>=0.10.0'} - is-obj@2.0.0: - resolution: {integrity: sha512-drqDG3cbczxxEJRoOXcOjtdp1J/lyp1mNn0xaznRs8+muBhgQcrnbspox5X5fOw0HnMnbfDzvnEMEtqDEJEo8w==} - engines: {node: '>=8'} - is-plain-obj@4.1.0: resolution: {integrity: sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==} engines: {node: '>=12'} @@ -5690,9 +5692,6 @@ packages: engines: {node: '>=16'} hasBin: true - lie@3.1.1: - resolution: {integrity: sha512-RiNhHysUjhrDQntfYSfY4MU24coXXdEOgw9WGcKHNeEwffDYbF//u87M1EWaMGzuFoSbqW0C9C6lEEhDOAswfw==} - lie@3.3.0: resolution: {integrity: sha512-UaiMJzeWRlEujzAuw5LokY1L5ecNQYZKfmyZ9L7wDHb/p5etKaxXhohBcrw0EYby+G/NA52vRSN4N39dxHAIwQ==} @@ -5702,12 +5701,12 @@ packages: lighthouse-logger@2.0.2: resolution: {integrity: sha512-vWl2+u5jgOQuZR55Z1WM0XDdrJT6mzMP8zHUct7xTlWhuQs+eV0g+QL0RQdFjT54zVmbhLCP8vIVpy1wGn/gCg==} - lighthouse-stack-packs@1.12.2: - resolution: {integrity: sha512-Ug8feS/A+92TMTCK6yHYLwaFMuelK/hAKRMdldYkMNwv+d9PtWxjXEg6rwKtsUXTADajhdrhXyuNCJ5/sfmPFw==} + lighthouse-stack-packs@1.12.3: + resolution: {integrity: sha512-d8IsOpE83kbANgnM+Tp8+x6HcMpX9o2ITBiUERssgzAIFdZCQzs/f4k6D0DLQTE59enml9mbAOU52Wu35exWtg==} - lighthouse@12.6.1: - resolution: {integrity: sha512-85WDkjcXAVdlFem9Y6SSxqoKiz/89UsDZhLpeLJIsJ4LlHxw047XTZhlFJmjYCB7K5S1erSBAf5cYLcfyNbH3A==} - engines: {node: '>=18.20'} + lighthouse@13.4.1: + resolution: {integrity: sha512-fDu8lt3QLK/lTqIxtp1HkzQNJ32rsFHhbadYOepcMZFLgA8oINhxutMbMv8XXnpTOvZ0TXCo4JCk1LDTWaRLnA==} + engines: {node: '>=22.19'} hasBin: true lightningcss-android-arm64@1.32.0: @@ -5866,9 +5865,6 @@ packages: engines: {node: '>=22.22.1'} hasBin: true - localforage@1.10.0: - resolution: {integrity: sha512-14/H1aX7hzBBmmh7sGPd+AOMkkIrHM3Z1PAyGgZigA1H1p5O5ANnMyWzvpAETtG68/dC4pC0ncy3+PPGzXZHPg==} - locate-path@5.0.0: resolution: {integrity: sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==} engines: {node: '>=8'} @@ -5979,9 +5975,6 @@ packages: merge-stream@2.0.0: resolution: {integrity: sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==} - metaviewport-parser@0.3.0: - resolution: {integrity: sha512-EoYJ8xfjQ6kpe9VbVHvZTZHiOl4HL1Z18CrZ+qahvLXT7ZO4YTC2JMyt5FaUp9JJp6J4Ybb/z7IsCXZt86/QkQ==} - methods@1.1.2: resolution: {integrity: sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==} engines: {node: '>= 0.6'} @@ -6052,6 +6045,13 @@ packages: engines: {node: '>=10'} hasBin: true + modern-tar@0.8.4: + resolution: {integrity: sha512-gN54ddmyzEg10orwZ2u4OOv+bjpMWdIl5jIkodK97bMq8QBSL5c0D7YX0lT1Ooz+99S7+PvFbnxzdjgHo1r41g==} + engines: {node: '>=18.0.0'} + + module-details-from-path@1.0.4: + resolution: {integrity: sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w==} + ms@2.0.0: resolution: {integrity: sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==} @@ -6295,9 +6295,6 @@ packages: pako@2.1.0: resolution: {integrity: sha512-w+eufiZ1WuJYgPXbV/PO3NCMEc3xqylkKHzp8bxp1uW4qaSNQUkwmLLEc3kKsfz8lpV1F8Ht3U1Cm+9Srog2ug==} - parse-cache-control@1.0.1: - resolution: {integrity: sha512-60zvsJReQPX5/QP0Kzfd/VrpjScIQ7SHBW6bFCYfEP+fp0Eppr1SHhIO5nd1PjZtvclzSzES9D/p5nFJurwfWg==} - parse-json@5.2.0: resolution: {integrity: sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==} engines: {node: '>=8'} @@ -6492,16 +6489,13 @@ packages: resolution: {integrity: sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==} engines: {node: '>=10'} - pump@3.0.4: - resolution: {integrity: sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==} - punycode@2.3.1: resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==} engines: {node: '>=6'} - puppeteer-core@24.41.0: - resolution: {integrity: sha512-rLIUri7E/NQ3APSEYCCozaSJx0u8Tu9wxO6BJwnvXmIgILSK3L0TombaVh3izp1njAGrO6H2ru0hcIrLF+gWLw==} - engines: {node: '>=18'} + puppeteer-core@25.9.0: + resolution: {integrity: sha512-U61rCwSMha62CA/Opy6tCx2Fx+ck7ouiKnbpEApzSoLYMoEu9F71nuFpHL55vmIt33/GYm6eKZVhH2ev0nAIeg==} + engines: {node: '>=22.12.0'} pure-rand@7.0.1: resolution: {integrity: sha512-oTUZM/NAZS8p7ANR3SHh30kXB+zK2r2BPcEn/awJIbOvq82WoMN4p62AWWp3Hhw50G0xMsw1mhIBLqHw64EcNQ==} @@ -6656,6 +6650,10 @@ packages: resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==} engines: {node: '>=0.10.0'} + require-in-the-middle@8.0.1: + resolution: {integrity: sha512-QT7FVMXfWOYFbeRBF6nu+I6tr2Tf3u0q8RIEjNob/heKY/nh7drD/k7eeMFmSQgnTtCzLDcCu/XEnpW2wk4xCQ==} + engines: {node: '>=9.3.0 || >=8.10.0 <9.0.0'} + require-main-filename@2.0.0: resolution: {integrity: sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==} @@ -6783,10 +6781,6 @@ packages: semver-compare@1.0.0: resolution: {integrity: sha512-YM3/ITh2MJ5MtzaM429anh+x2jiLVjqILF4m4oyQB18W7Ggea7BfqdH/wGMK7dDiMghv/6WG7znWMwUDzJiXow==} - semver@5.7.2: - resolution: {integrity: sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==} - hasBin: true - semver@6.3.1: resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==} hasBin: true @@ -6991,9 +6985,6 @@ packages: vite-plus: optional: true - streamx@2.25.0: - resolution: {integrity: sha512-0nQuG6jf1w+wddNEEXCF4nTg3LtufWINB5eFEN+5TNZW7KWJp6x87+JFL43vaAUPyCfH1wID+mNVyW6OHtFamg==} - string-argv@0.3.2: resolution: {integrity: sha512-aqD2Q0144Z+/RqG52NeHEkZauTAUWJO8c6yTftGJKO3Tja5tUgIfmIl6kExvhtxSDP7fXB6DvzkfMpCd/F3G+Q==} engines: {node: '>=0.6.19'} @@ -7096,6 +7087,12 @@ packages: resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==} engines: {node: '>=8'} + stubborn-fs@2.0.0: + resolution: {integrity: sha512-Y0AvSwDw8y+nlSNFXMm2g6L51rBGdAQT20J3YSOqxC53Lo3bjWRtr2BKcfYoAf352WYpsZSTURrA0tqhfgudPA==} + + stubborn-utils@1.0.2: + resolution: {integrity: sha512-zOh9jPYI+xrNOyisSelgym4tolKTJCQd5GBhK0+0xJvcYDcwlOoxF/rnFKQ2KRZknXSG9jWAp66fwP6AxN9STg==} + supports-color@10.2.2: resolution: {integrity: sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==} engines: {node: '>=18'} @@ -7143,15 +7140,6 @@ packages: resolution: {integrity: sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==} engines: {node: '>=6'} - tar-fs@3.1.2: - resolution: {integrity: sha512-QGxxTxxyleAdyM3kpFs14ymbYmNFrfY+pHj7Z8FgtbZ7w2//VAgLMac7sT6nRpIHjppXO2AwwEOg0bPFVRcmXw==} - - tar-stream@3.1.8: - resolution: {integrity: sha512-U6QpVRyCGHva435KoNWy9PRoi2IFYCgtEhq9nmrPPpbRacPs9IH4aJ3gbrFC8dPcXvdSZ4XXfXT5Fshbp2MtlQ==} - - teex@1.0.1: - resolution: {integrity: sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==} - temp-dir@2.0.0: resolution: {integrity: sha512-aoBAniQmmwtcKp/7BzsH8Cxzv8OL736p7v1ihGb5e9DJ9kTwGWHrQrVB5+lfVDzfGrdRzXch+ig7LHaY1JTOrg==} engines: {node: '>=8'} @@ -7169,15 +7157,9 @@ packages: resolution: {integrity: sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==} engines: {node: '>=8'} - text-decoder@1.2.7: - resolution: {integrity: sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==} - text-segmentation@1.0.3: resolution: {integrity: sha512-iOiPUo/BGnZ6+54OsWxZidGCsdU8YbE4PSpdPinp7DeMtUJNJBoJ/ouUSTJjHkh1KntHaltHl/gDs2FC4i5+Nw==} - third-party-web@0.26.7: - resolution: {integrity: sha512-buUzX4sXC4efFX6xg2bw6/eZsCUh8qQwSavC4D9HpONMFlRbcHhD8Je5qwYdCpViR6q0qla2wPP+t91a2vgolg==} - third-party-web@0.29.2: resolution: {integrity: sha512-fegtha91tq2DHphyoiBXVHjVi2YG9zFaRnboT9C28tO1en9Y3wJsfspuy40F+u5wl3hHVbw7cnd1b67kEGHb8g==} @@ -7221,14 +7203,14 @@ packages: resolution: {integrity: sha512-azl+t0z7pw/z958Gy9svOTuzqIk6xq+NSheJzn5MMWtWTFywIacg2wUlzKFGtt3cthx0r2SxMK0yzJOR0IES7Q==} engines: {node: '>=14.0.0'} - tldts-core@6.1.86: - resolution: {integrity: sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==} - tldts-core@7.0.30: resolution: {integrity: sha512-uiHN8PIB1VmWyS98eZYja4xzlYqeFZVjb4OuYlJQnZAuJhMw4PbKQOKgHKhBdJR3FE/t5mUQ1Kd80++B+qhD1Q==} - tldts-icann@6.1.86: - resolution: {integrity: sha512-NFxmRT2lAEMcCOBgeZ0NuM0zsK/xgmNajnY6n4S1mwAKocft2s2ise1O3nQxrH3c+uY6hgHUV9GGNVp7tUE4Sg==} + tldts-core@7.4.11: + resolution: {integrity: sha512-CW3WN2rIIE/Of21mulhgnGOwoDyEFNygyIBOONSdyAuSATgMMUCpLeUlB+E8sAwA5xRV9hYPl+kyZ9citHCaKg==} + + tldts-icann@7.4.11: + resolution: {integrity: sha512-1p+NDJ7FUYCliESmsQl9EW5Um8JIyFheiy6Y6ZoHho27d+TLAGFa0gMf1VOVy02vNY1aQo6xeKiaGj45+7P+PA==} tldts@7.0.30: resolution: {integrity: sha512-ELrFxuqsDdHUwoh0XxDbxuLD3Wnz49Z57IFvTtvWy1hJdcMZjXLIuonjilCiWHlT2GbE4Wlv1wKVTzDFnXH1aw==} @@ -7307,6 +7289,10 @@ packages: resolution: {integrity: sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==} engines: {node: '>=8'} + type-fest@4.41.0: + resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==} + engines: {node: '>=16'} + type-is@1.6.18: resolution: {integrity: sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==} engines: {node: '>= 0.6'} @@ -7331,8 +7317,8 @@ packages: resolution: {integrity: sha512-0Ql2ORqBORLMdAW89TQKZsb1PQkFGImFfVmncXWe7a+AA3+7dh7Se9exxZowH4kbnlvKEFkMxUYdHUpjYWFJaA==} engines: {node: '>=18'} - typed-query-selector@2.12.1: - resolution: {integrity: sha512-uzR+FzI8qrUEIu96oaeBJmd9E7CFEiQ3goA5qCVgc4s5llSubcfGHq9yUstZx/k4s9dXHVKsE35YWoFyvEqEHA==} + typed-query-selector@2.12.2: + resolution: {integrity: sha512-EOPFbyIub4ngnEdqi2yOcNeDLaX/0jcE1JoAXQDDMIthap7FoN795lc/SHfIq2d416VufXpM8z/lD+WRm2gfOQ==} typed-rest-client@2.3.1: resolution: {integrity: sha512-k4kX5Up6qA68D0Cby2AK+6+vM5k3qTxe+/3FqhnHRExjY5cfbOnzjQZbP/LXleF8hVoDvDqxlgk9KK83HoBZlQ==} @@ -7597,12 +7583,15 @@ packages: weapon-regex@1.3.6: resolution: {integrity: sha512-wsf1m1jmMrso5nhwVFJJHSubEBf3+pereGd7+nBKtYJ18KoB/PWJOHS3WRkwS04VrOU0iJr2bZU+l1QaTJ+9nA==} + web-features@3.36.0: + resolution: {integrity: sha512-B5W9HbyXT76soRG7Fn3AELZkuDQpmpSxszSmJZLIPUHYxIGkufNz0vcoEhfqnUF1HAfaducWIBaaKuusq9Am2g==} + web-streams-polyfill@3.3.3: resolution: {integrity: sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==} engines: {node: '>= 8'} - webdriver-bidi-protocol@0.4.1: - resolution: {integrity: sha512-ARrjNjtWRRs2w4Tk7nqrf2gBI0QXWuOmMCx2hU+1jUt6d00MjMxURrhxhGbrsoiZKJrhTSTzbIrc554iKI10qw==} + webdriver-bidi-protocol@0.4.2: + resolution: {integrity: sha512-VSV+fzfChirL3e7jay2yUC7B4HQCGtEWEg/MSSQbK+qWbqeGlRLlXTzPpYr3XGUvbpDHumWZBJxgesg4N7dbtA==} webidl-conversions@3.0.1: resolution: {integrity: sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==} @@ -7633,6 +7622,9 @@ packages: whatwg-url@5.0.0: resolution: {integrity: sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==} + when-exit@2.1.5: + resolution: {integrity: sha512-VGkKJ564kzt6Ms1dbgPP/yuIoQCrsFAnRbptpC5wOEsDaNsbCB2bnfnaA8i/vRs5tjUSEOtIuvl9/MyVsvQZCg==} + which-boxed-primitive@1.1.1: resolution: {integrity: sha512-TbX3mj8n0odCBFVlY8AxkqcHASw3L60jIuF8jFP78az3C2YhmGvqbHBpAjTRH2/xqYunrJ9g1jSyjCjpoWzIAA==} engines: {node: '>= 0.4'} @@ -7792,9 +7784,9 @@ packages: resolution: {integrity: sha512-g/eziiSUNBSsdDJtCLB8bdYEUMj4jR7AGeUo96p/3dTafgjHhpF4RiCFPiRILwjQoDXx5MqkBr4fwWtR3Ky4Wg==} engines: {node: '>=20'} - xdg-basedir@4.0.0: - resolution: {integrity: sha512-PSNhEJDejZYV7h50BohL09Er9VaIefr2LMAf3OEmpCkjOi34eYyQYAXUTjEQtZJTKcF0E2UKTh+osDLsgNim9Q==} - engines: {node: '>=8'} + xdg-basedir@5.1.0: + resolution: {integrity: sha512-GCPAHLvrIH13+c0SuacwvRYj2SxJXQ4kaVTT5xgL3kPrz56XxkF21IGhjSE1+W0aw7gpBWRGXLCPnPby6lSpmQ==} + engines: {node: '>=12'} xml-js@1.6.11: resolution: {integrity: sha512-7rVi2KMfwfWFl+GpPg6m80IVMWXLRjO+PxTq7V2CDhoGak0wzYzFgUY2m4XJ47OGdXd8eLE8EmwfAmdjw7lC1g==} @@ -9694,16 +9686,16 @@ snapshots: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.6.0 - '@lhci/cli@0.15.1(supports-color@10.2.2)': + '@lhci/cli@0.15.1(@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1))(supports-color@10.2.2)(yauzl@2.10.0)': dependencies: - '@lhci/utils': 0.15.1(supports-color@10.2.2) + '@lhci/utils': 0.15.1(@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1))(proxy-agent@6.5.0(supports-color@10.2.2))(supports-color@10.2.2)(yauzl@2.10.0) chrome-launcher: 1.2.1(supports-color@10.2.2) compression: 1.8.1(supports-color@10.2.2) debug: 4.4.3(supports-color@10.2.2) express: 4.22.1(supports-color@10.2.2) inquirer: 6.5.2 isomorphic-fetch: 3.0.0 - lighthouse: 12.6.1(supports-color@10.2.2) + lighthouse: 13.4.1(@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1))(proxy-agent@6.5.0(supports-color@10.2.2))(supports-color@10.2.2)(yauzl@2.10.0) lighthouse-logger: 1.2.0(supports-color@10.2.2) open: 7.4.2 proxy-agent: 6.5.0(supports-color@10.2.2) @@ -9712,29 +9704,30 @@ snapshots: yargs: 15.4.1 yargs-parser: 13.1.2 transitivePeerDependencies: - - bare-abort-controller - - bare-buffer + - '@opentelemetry/core' + - '@opentelemetry/exporter-trace-otlp-http' - bufferutil - encoding - - react-native-b4a - supports-color - utf-8-validate + - yauzl - '@lhci/utils@0.15.1(supports-color@10.2.2)': + '@lhci/utils@0.15.1(@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1))(proxy-agent@6.5.0(supports-color@10.2.2))(supports-color@10.2.2)(yauzl@2.10.0)': dependencies: debug: 4.4.3(supports-color@10.2.2) isomorphic-fetch: 3.0.0 js-yaml: 4.3.2 - lighthouse: 12.6.1(supports-color@10.2.2) + lighthouse: 13.4.1(@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1))(proxy-agent@6.5.0(supports-color@10.2.2))(supports-color@10.2.2)(yauzl@2.10.0) tree-kill: 1.2.2 transitivePeerDependencies: - - bare-abort-controller - - bare-buffer + - '@opentelemetry/core' + - '@opentelemetry/exporter-trace-otlp-http' - bufferutil - encoding - - react-native-b4a + - proxy-agent - supports-color - utf-8-validate + - yauzl '@mlc-ai/web-llm@0.2.84': dependencies: @@ -9823,8 +9816,48 @@ snapshots: dependencies: '@octokit/openapi-types': 28.0.0 - '@opentelemetry/api@1.9.1': - optional: true + '@opentelemetry/api-logs@0.220.0': + dependencies: + '@opentelemetry/api': 1.9.1 + + '@opentelemetry/api@1.9.1': {} + + '@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1)': + dependencies: + '@opentelemetry/api': 1.9.1 + '@opentelemetry/semantic-conventions': 1.43.0 + + '@opentelemetry/instrumentation@0.220.0(@opentelemetry/api@1.9.1)(supports-color@10.2.2)': + dependencies: + '@opentelemetry/api': 1.9.1 + '@opentelemetry/api-logs': 0.220.0 + import-in-the-middle: 3.4.0 + require-in-the-middle: 8.0.1(supports-color@10.2.2) + transitivePeerDependencies: + - supports-color + + '@opentelemetry/resources@2.11.0(@opentelemetry/api@1.9.1)': + dependencies: + '@opentelemetry/api': 1.9.1 + '@opentelemetry/core': 2.11.0(@opentelemetry/api@1.9.1) + '@opentelemetry/semantic-conventions': 1.43.0 + + '@opentelemetry/sdk-trace-base@2.11.0(@opentelemetry/api@1.9.1)': + dependencies: + '@opentelemetry/api': 1.9.1 + '@opentelemetry/core': 2.11.0(@opentelemetry/api@1.9.1) + '@opentelemetry/resources': 2.11.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-trace': 2.11.0(@opentelemetry/api@1.9.1) + '@opentelemetry/semantic-conventions': 1.43.0 + + '@opentelemetry/sdk-trace@2.11.0(@opentelemetry/api@1.9.1)': + dependencies: + '@opentelemetry/api': 1.9.1 + '@opentelemetry/core': 2.11.0(@opentelemetry/api@1.9.1) + '@opentelemetry/resources': 2.11.0(@opentelemetry/api@1.9.1) + '@opentelemetry/semantic-conventions': 1.43.0 + + '@opentelemetry/semantic-conventions@1.43.0': {} '@oxc-parser/binding-android-arm-eabi@0.127.0': optional: true @@ -9955,7 +9988,7 @@ snapshots: '@oxc-resolver/binding-win32-x64-msvc@11.21.2': optional: true - '@paulirish/trace_engine@0.0.53': + '@paulirish/trace_engine@0.0.65': dependencies: legacy-javascript: 0.0.1 third-party-web: 0.29.2 @@ -9981,20 +10014,13 @@ snapshots: '@poppinss/exception@1.2.3': {} - '@puppeteer/browsers@2.13.0(supports-color@10.2.2)': + '@puppeteer/browsers@3.2.1(proxy-agent@6.5.0(supports-color@10.2.2))(yauzl@2.10.0)': dependencies: - debug: 4.4.3(supports-color@10.2.2) - extract-zip: 2.0.1(supports-color@10.2.2) - progress: 2.0.3 + modern-tar: 0.8.4 + yargs: 18.0.0 + optionalDependencies: proxy-agent: 6.5.0(supports-color@10.2.2) - semver: 7.8.5 - tar-fs: 3.1.2 - yargs: 17.7.2 - transitivePeerDependencies: - - bare-abort-controller - - bare-buffer - - react-native-b4a - - supports-color + yauzl: 2.10.0 '@reduxjs/toolkit@2.12.0(react-redux@9.3.0(@types/react@19.2.18)(react@19.2.8)(redux@5.0.1))(react@19.2.8)': dependencies: @@ -10173,37 +10199,52 @@ snapshots: '@sec-ant/readable-stream@0.4.1': {} - '@sentry-internal/tracing@7.120.4': - dependencies: - '@sentry/core': 7.120.4 - '@sentry/types': 7.120.4 - '@sentry/utils': 7.120.4 + '@sentry/conventions@0.16.0': {} - '@sentry/core@7.120.4': + '@sentry/core@10.73.0': dependencies: - '@sentry/types': 7.120.4 - '@sentry/utils': 7.120.4 + '@sentry/conventions': 0.16.0 - '@sentry/integrations@7.120.4': + '@sentry/node-core@10.73.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1))(@opentelemetry/instrumentation@0.220.0(@opentelemetry/api@1.9.1)(supports-color@10.2.2))(@opentelemetry/sdk-trace-base@2.11.0(@opentelemetry/api@1.9.1))': dependencies: - '@sentry/core': 7.120.4 - '@sentry/types': 7.120.4 - '@sentry/utils': 7.120.4 - localforage: 1.10.0 + '@sentry/conventions': 0.16.0 + '@sentry/core': 10.73.0 + '@sentry/opentelemetry': 10.73.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.11.0(@opentelemetry/api@1.9.1)) + import-in-the-middle: 3.4.0 + optionalDependencies: + '@opentelemetry/api': 1.9.1 + '@opentelemetry/core': 2.11.0(@opentelemetry/api@1.9.1) + '@opentelemetry/instrumentation': 0.220.0(@opentelemetry/api@1.9.1)(supports-color@10.2.2) + '@opentelemetry/sdk-trace-base': 2.11.0(@opentelemetry/api@1.9.1) - '@sentry/node@7.120.4': + '@sentry/node@10.73.0(@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1))(supports-color@10.2.2)': dependencies: - '@sentry-internal/tracing': 7.120.4 - '@sentry/core': 7.120.4 - '@sentry/integrations': 7.120.4 - '@sentry/types': 7.120.4 - '@sentry/utils': 7.120.4 + '@opentelemetry/api': 1.9.1 + '@opentelemetry/instrumentation': 0.220.0(@opentelemetry/api@1.9.1)(supports-color@10.2.2) + '@opentelemetry/sdk-trace-base': 2.11.0(@opentelemetry/api@1.9.1) + '@sentry/conventions': 0.16.0 + '@sentry/core': 10.73.0 + '@sentry/node-core': 10.73.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1))(@opentelemetry/instrumentation@0.220.0(@opentelemetry/api@1.9.1)(supports-color@10.2.2))(@opentelemetry/sdk-trace-base@2.11.0(@opentelemetry/api@1.9.1)) + '@sentry/opentelemetry': 10.73.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.11.0(@opentelemetry/api@1.9.1)) + '@sentry/server-utils': 10.73.0 + import-in-the-middle: 3.4.0 + transitivePeerDependencies: + - '@opentelemetry/core' + - '@opentelemetry/exporter-trace-otlp-http' + - supports-color - '@sentry/types@7.120.4': {} + '@sentry/opentelemetry@10.73.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.11.0(@opentelemetry/api@1.9.1))': + dependencies: + '@opentelemetry/api': 1.9.1 + '@opentelemetry/core': 2.11.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-trace-base': 2.11.0(@opentelemetry/api@1.9.1) + '@sentry/conventions': 0.16.0 + '@sentry/core': 10.73.0 - '@sentry/utils@7.120.4': + '@sentry/server-utils@10.73.0': dependencies: - '@sentry/types': 7.120.4 + '@sentry/conventions': 0.16.0 + '@sentry/core': 10.73.0 '@sinclair/typebox@0.34.49': {} @@ -10820,11 +10861,6 @@ snapshots: dependencies: '@types/yargs-parser': 21.0.3 - '@types/yauzl@2.10.3': - dependencies: - '@types/node': 25.9.2 - optional: true - '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260421.2': optional: true @@ -11188,6 +11224,11 @@ snapshots: at-least-node@1.0.0: {} + atomically@2.1.1: + dependencies: + stubborn-fs: 2.0.0 + when-exit: 2.1.5 + available-typed-arrays@1.0.7: dependencies: possible-typed-array-names: 1.1.0 @@ -11204,8 +11245,6 @@ snapshots: - debug - supports-color - b4a@1.8.0: {} - babel-jest@30.4.1(@babel/core@7.29.7(supports-color@10.2.2))(supports-color@10.2.2): dependencies: '@babel/core': 7.29.7(supports-color@10.2.2) @@ -11284,38 +11323,6 @@ snapshots: balanced-match@4.0.4: {} - bare-events@2.8.2: {} - - bare-fs@4.7.1: - dependencies: - bare-events: 2.8.2 - bare-path: 3.0.0 - bare-stream: 2.13.0(bare-events@2.8.2) - bare-url: 2.4.0 - fast-fifo: 1.3.2 - transitivePeerDependencies: - - bare-abort-controller - - react-native-b4a - - bare-os@3.8.7: {} - - bare-path@3.0.0: - dependencies: - bare-os: 3.8.7 - - bare-stream@2.13.0(bare-events@2.8.2): - dependencies: - streamx: 2.25.0 - teex: 1.0.1 - optionalDependencies: - bare-events: 2.8.2 - transitivePeerDependencies: - - react-native-b4a - - bare-url@2.4.0: - dependencies: - bare-path: 3.0.0 - base64-arraybuffer@1.0.2: optional: true @@ -11379,7 +11386,8 @@ snapshots: dependencies: node-int64: 0.4.0 - buffer-crc32@0.2.13: {} + buffer-crc32@0.2.13: + optional: true buffer-equal-constant-time@1.0.1: {} @@ -11488,9 +11496,9 @@ snapshots: transitivePeerDependencies: - supports-color - chromium-bidi@14.0.0(devtools-protocol@0.0.1595872): + chromium-bidi@17.0.2(devtools-protocol@0.0.1666840): dependencies: - devtools-protocol: 0.0.1595872 + devtools-protocol: 0.0.1666840 mitt: 3.0.1 zod: 3.25.76 @@ -11590,14 +11598,12 @@ snapshots: transitivePeerDependencies: - supports-color - configstore@5.0.1: + configstore@7.1.0: dependencies: - dot-prop: 5.3.0 + atomically: 2.1.1 + dot-prop: 9.0.0 graceful-fs: 4.2.11 - make-dir: 3.1.0 - unique-string: 2.0.0 - write-file-atomic: 3.0.3 - xdg-basedir: 4.0.0 + xdg-basedir: 5.1.0 content-disposition@0.5.4: dependencies: @@ -11636,7 +11642,7 @@ snapshots: crypto-random-string@2.0.0: {} - csp_evaluator@1.1.5: {} + csp_evaluator@1.1.8: {} css-line-break@2.1.0: dependencies: @@ -11851,9 +11857,9 @@ snapshots: detect-node@2.1.0: optional: true - devtools-protocol@0.0.1467305: {} + devtools-protocol@0.0.1663043: {} - devtools-protocol@0.0.1595872: {} + devtools-protocol@0.0.1666840: {} diff-match-patch@1.0.5: {} @@ -11902,9 +11908,9 @@ snapshots: dom-serializer: 0.2.2 domelementtype: 1.3.1 - dot-prop@5.3.0: + dot-prop@9.0.0: dependencies: - is-obj: 2.0.0 + type-fest: 4.41.0 driver.js@1.8.0: {} @@ -11944,10 +11950,6 @@ snapshots: encodeurl@2.0.0: {} - end-of-stream@1.4.5: - dependencies: - once: 1.4.0 - enhanced-resolve@5.24.5: dependencies: graceful-fs: 4.2.11 @@ -12135,12 +12137,6 @@ snapshots: eventemitter3@5.0.4: {} - events-universal@1.0.1: - dependencies: - bare-events: 2.8.2 - transitivePeerDependencies: - - bare-abort-controller - eventsource-parser@3.1.1: {} execa@5.1.1: @@ -12235,22 +12231,10 @@ snapshots: iconv-lite: 0.4.24 tmp: 0.2.7 - extract-zip@2.0.1(supports-color@10.2.2): - dependencies: - debug: 4.4.3(supports-color@10.2.2) - get-stream: 5.2.0 - yauzl: 2.10.0 - optionalDependencies: - '@types/yauzl': 2.10.3 - transitivePeerDependencies: - - supports-color - fake-indexeddb@6.2.5: {} fast-deep-equal@3.1.3: {} - fast-fifo@1.3.2: {} - fast-json-stable-stringify@2.1.0: {} fast-png@6.4.0: @@ -12278,6 +12262,7 @@ snapshots: fd-slicer@1.1.0: dependencies: pend: 1.2.0 + optional: true fdir@6.5.0(picomatch@4.0.7): optionalDependencies: @@ -12490,10 +12475,6 @@ snapshots: dunder-proto: 1.0.1 es-object-atoms: 1.1.2 - get-stream@5.2.0: - dependencies: - pump: 3.0.4 - get-stream@6.0.1: {} get-stream@9.0.1: @@ -12748,6 +12729,12 @@ snapshots: immer@11.1.8: {} + import-in-the-middle@3.4.0: + dependencies: + cjs-module-lexer: 2.2.0 + es-module-lexer: 2.3.2 + module-details-from-path: 1.0.4 + import-local@3.2.0: dependencies: pkg-dir: 4.2.0 @@ -12892,8 +12879,6 @@ snapshots: is-obj@1.0.1: {} - is-obj@2.0.0: {} - is-plain-obj@4.1.0: {} is-potential-custom-element-name@1.0.1: {} @@ -13532,10 +13517,6 @@ snapshots: dependencies: isomorphic.js: 0.2.5 - lie@3.1.1: - dependencies: - immediate: 3.0.6 - lie@3.3.0: dependencies: immediate: 3.0.6 @@ -13554,45 +13535,44 @@ snapshots: transitivePeerDependencies: - supports-color - lighthouse-stack-packs@1.12.2: {} + lighthouse-stack-packs@1.12.3: {} - lighthouse@12.6.1(supports-color@10.2.2): + lighthouse@13.4.1(@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1))(proxy-agent@6.5.0(supports-color@10.2.2))(supports-color@10.2.2)(yauzl@2.10.0): dependencies: - '@paulirish/trace_engine': 0.0.53 - '@sentry/node': 7.120.4 + '@paulirish/trace_engine': 0.0.65 + '@sentry/node': 10.73.0(@opentelemetry/core@2.11.0(@opentelemetry/api@1.9.1))(supports-color@10.2.2) axe-core: 4.13.0 chrome-launcher: 1.2.1(supports-color@10.2.2) - configstore: 5.0.1 - csp_evaluator: 1.1.5 - devtools-protocol: 0.0.1467305 + configstore: 7.1.0 + csp_evaluator: 1.1.8 + devtools-protocol: 0.0.1663043 enquirer: 2.4.1 http-link-header: 1.1.3 intl-messageformat: 10.7.18 jpeg-js: 0.4.4 js-library-detector: 6.7.0 lighthouse-logger: 2.0.2(supports-color@10.2.2) - lighthouse-stack-packs: 1.12.2 + lighthouse-stack-packs: 1.12.3 lodash-es: 4.18.1 lookup-closest-locale: 6.2.0 - metaviewport-parser: 0.3.0 open: 8.4.2 - parse-cache-control: 1.0.1 - puppeteer-core: 24.41.0(supports-color@10.2.2) + puppeteer-core: 25.9.0(proxy-agent@6.5.0(supports-color@10.2.2))(yauzl@2.10.0) robots-parser: 3.0.1 - semver: 5.7.2 speedline-core: 1.4.3 - third-party-web: 0.26.7 - tldts-icann: 6.1.86 + third-party-web: 0.29.2 + tldts-icann: 7.4.11 + web-features: 3.36.0 ws: 8.21.3 yargs: 17.7.2 yargs-parser: 21.1.1 transitivePeerDependencies: - - bare-abort-controller - - bare-buffer + - '@opentelemetry/core' + - '@opentelemetry/exporter-trace-otlp-http' - bufferutil - - react-native-b4a + - proxy-agent - supports-color - utf-8-validate + - yauzl lightningcss-android-arm64@1.32.0: optional: true @@ -13702,10 +13682,6 @@ snapshots: optionalDependencies: yaml: 2.9.0 - localforage@1.10.0: - dependencies: - lie: 3.1.1 - locate-path@5.0.0: dependencies: p-locate: 4.1.0 @@ -13806,8 +13782,6 @@ snapshots: merge-stream@2.0.0: {} - metaviewport-parser@0.3.0: {} - methods@1.1.2: {} mime-db@1.52.0: {} @@ -13865,6 +13839,10 @@ snapshots: mkdirp@1.0.4: {} + modern-tar@0.8.4: {} + + module-details-from-path@1.0.4: {} + ms@2.0.0: {} ms@2.1.3: {} @@ -14174,8 +14152,6 @@ snapshots: pako@2.1.0: {} - parse-cache-control@1.0.1: {} - parse-json@5.2.0: dependencies: '@babel/code-frame': 7.29.7 @@ -14221,7 +14197,8 @@ snapshots: pathval@2.0.1: {} - pend@1.2.0: {} + pend@1.2.0: + optional: true performance-now@2.1.0: optional: true @@ -14348,29 +14325,21 @@ snapshots: proxy-from-env@2.1.0: {} - pump@3.0.4: - dependencies: - end-of-stream: 1.4.5 - once: 1.4.0 - punycode@2.3.1: {} - puppeteer-core@24.41.0(supports-color@10.2.2): + puppeteer-core@25.9.0(proxy-agent@6.5.0(supports-color@10.2.2))(yauzl@2.10.0): dependencies: - '@puppeteer/browsers': 2.13.0(supports-color@10.2.2) - chromium-bidi: 14.0.0(devtools-protocol@0.0.1595872) - debug: 4.4.3(supports-color@10.2.2) - devtools-protocol: 0.0.1595872 - typed-query-selector: 2.12.1 - webdriver-bidi-protocol: 0.4.1 + '@puppeteer/browsers': 3.2.1(proxy-agent@6.5.0(supports-color@10.2.2))(yauzl@2.10.0) + chromium-bidi: 17.0.2(devtools-protocol@0.0.1666840) + devtools-protocol: 0.0.1666840 + typed-query-selector: 2.12.2 + webdriver-bidi-protocol: 0.4.2 ws: 8.21.3 transitivePeerDependencies: - - bare-abort-controller - - bare-buffer - bufferutil - - react-native-b4a - - supports-color + - proxy-agent - utf-8-validate + - yauzl pure-rand@7.0.1: {} @@ -14563,6 +14532,13 @@ snapshots: require-from-string@2.0.2: {} + require-in-the-middle@8.0.1(supports-color@10.2.2): + dependencies: + debug: 4.4.3(supports-color@10.2.2) + module-details-from-path: 1.0.4 + transitivePeerDependencies: + - supports-color + require-main-filename@2.0.0: {} requires-port@1.0.0: {} @@ -14725,8 +14701,6 @@ snapshots: semver-compare@1.0.0: optional: true - semver@5.7.2: {} - semver@6.3.1: {} semver@7.7.4: {} @@ -14997,15 +14971,6 @@ snapshots: - react - utf-8-validate - streamx@2.25.0: - dependencies: - events-universal: 1.0.1 - fast-fifo: 1.3.2 - text-decoder: 1.2.7 - transitivePeerDependencies: - - bare-abort-controller - - react-native-b4a - string-argv@0.3.2: {} string-length@4.0.2: @@ -15128,6 +15093,12 @@ snapshots: strip-json-comments@3.1.1: {} + stubborn-fs@2.0.0: + dependencies: + stubborn-utils: 1.0.2 + + stubborn-utils@1.0.2: {} + supports-color@10.2.2: {} supports-color@5.5.0: @@ -15168,36 +15139,6 @@ snapshots: tapable@2.3.3: {} - tar-fs@3.1.2: - dependencies: - pump: 3.0.4 - tar-stream: 3.1.8 - optionalDependencies: - bare-fs: 4.7.1 - bare-path: 3.0.0 - transitivePeerDependencies: - - bare-abort-controller - - bare-buffer - - react-native-b4a - - tar-stream@3.1.8: - dependencies: - b4a: 1.8.0 - bare-fs: 4.7.1 - fast-fifo: 1.3.2 - streamx: 2.25.0 - transitivePeerDependencies: - - bare-abort-controller - - bare-buffer - - react-native-b4a - - teex@1.0.1: - dependencies: - streamx: 2.25.0 - transitivePeerDependencies: - - bare-abort-controller - - react-native-b4a - temp-dir@2.0.0: {} tempy@0.6.0: @@ -15220,19 +15161,11 @@ snapshots: glob: 7.2.3 minimatch: 3.1.5 - text-decoder@1.2.7: - dependencies: - b4a: 1.8.0 - transitivePeerDependencies: - - react-native-b4a - text-segmentation@1.0.3: dependencies: utrie: 1.0.2 optional: true - third-party-web@0.26.7: {} - third-party-web@0.29.2: {} throttleit@2.1.0: {} @@ -15263,13 +15196,13 @@ snapshots: tinyspy@4.0.4: {} - tldts-core@6.1.86: {} - tldts-core@7.0.30: {} - tldts-icann@6.1.86: + tldts-core@7.4.11: {} + + tldts-icann@7.4.11: dependencies: - tldts-core: 6.1.86 + tldts-core: 7.4.11 tldts@7.0.30: dependencies: @@ -15333,6 +15266,8 @@ snapshots: type-fest@0.8.1: {} + type-fest@4.41.0: {} + type-is@1.6.18: dependencies: media-typer: 0.3.0 @@ -15373,7 +15308,7 @@ snapshots: typed-inject@5.0.0: {} - typed-query-selector@2.12.1: {} + typed-query-selector@2.12.2: {} typed-rest-client@2.3.1: dependencies: @@ -15631,9 +15566,11 @@ snapshots: weapon-regex@1.3.6: {} + web-features@3.36.0: {} + web-streams-polyfill@3.3.3: {} - webdriver-bidi-protocol@0.4.1: {} + webdriver-bidi-protocol@0.4.2: {} webidl-conversions@3.0.1: {} @@ -15662,6 +15599,8 @@ snapshots: tr46: 0.0.3 webidl-conversions: 3.0.1 + when-exit@2.1.5: {} + which-boxed-primitive@1.1.1: dependencies: is-bigint: 1.1.0 @@ -15909,7 +15848,7 @@ snapshots: is-wsl: 3.1.1 powershell-utils: 0.1.0 - xdg-basedir@4.0.0: {} + xdg-basedir@5.1.0: {} xml-js@1.6.11: dependencies: @@ -15994,6 +15933,7 @@ snapshots: dependencies: buffer-crc32: 0.2.13 fd-slicer: 1.1.0 + optional: true yjs@13.6.32: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 3ddbe044e..c54e8c5df 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -95,6 +95,13 @@ overrides: postcss: ">=8.5.18" # GHSA — path traversal in previous source map (vite/storybook chain) sharp: ">=0.35.4" # GHSA-rgj7-g3m4-5g8c + inherited libvips vulnerabilities (@huggingface/transformers, miniflare) body-parser: ">=1.20.6 <2" # GHSA-v422-hmwv-36x6 — DoS via empty urlencoded body (express via @lhci/cli, dev-only) + # GHSA-jmr9-qjv8-65gv + GHSA-7pqw-9j4j-h8q3 (extract-zip, no fixed version exists): @lhci/cli + # hard-pins lighthouse@12.6.1, which pulls puppeteer-core -> @puppeteer/browsers@2.x -> + # extract-zip. lighthouse 13.4.1's puppeteer-core (^25.x) uses @puppeteer/browsers 3.x, which + # replaced extract-zip with modern-tar, eliminating the vulnerable package from the graph. + # Exact-pinned, not >=: @lhci/cli@0.15.1 is old and untested against newer Lighthouse majors — + # only 13.4.1's CLI-subprocess bridge has actually been compatibility-verified here. + lighthouse: "13.4.1" peerDependencyRules: allowedVersions: diff --git a/src-tauri/osv-scanner.toml b/src-tauri/osv-scanner.toml index ca344f5f5..44eb71e9e 100644 --- a/src-tauri/osv-scanner.toml +++ b/src-tauri/osv-scanner.toml @@ -123,41 +123,13 @@ reason = "unic-ucd-ident 0.9.0: unmaintained Unicode data crate; final version; # js-yaml→4.3.2, body-parser→1.20.6, joi→18.2.5, sharp→0.35.4, …). (The former # dompurify GHSA-x4vx-rjvf-j5p4 and js-yaml-3.x GHSA-h67p-54hq-rp68 ignores # were dropped: both advisories no longer match the lockfile after the -# overrides.) Three documented ignores remain below — no fixed version exists -# to override to for any of them. - -# extract-zip@2.0.1 (CVE-2026-56876 / GHSA-jmr9-qjv8-65gv, CVSS 8.6): unvalidated -# symlink path traversal when extracting an attacker-controlled zip archive. -# extract-zip@2.0.1 is the latest published release — no patched version exists -# (first_patched_version: null on the advisory) — so pnpm.overrides cannot fix -# this. QNBS-v3 (codex, corrected): the actual lock-graph path (verified via -# `pnpm audit`) is `@lhci/cli` -> `lighthouse` -> `puppeteer-core` -> -# `@puppeteer/browsers` -> `extract-zip` — Lighthouse CI's own headless-Chrome -# automation stack (which itself depends on Puppeteer internally), NOT this -# repo's separate `playwright`/`playwright-core` devDependency despite the -# similarly-named `@puppeteer/browsers` package. It only extracts -# Puppeteer/Lighthouse's own CDN-hosted Chrome binary releases, never a user- -# or attacker-supplied archive, and never ships in the production app bundle. -# No exploitable attack surface here. - -[[IgnoredVulns]] -id = "GHSA-jmr9-qjv8-65gv" -ignoreUntil = "2026-11-30T00:00:00Z" -reason = "extract-zip 2.0.1: unvalidated symlink path traversal; latest release, no fixed version exists; transitive @lhci/cli->lighthouse->puppeteer-core->@puppeteer/browsers devDependency (Lighthouse CI's own Puppeteer stack, not Playwright) only extracting its own CDN-hosted Chrome binaries, never user-supplied zips; no runtime footprint in the shipped app" - -# extract-zip@2.0.1 (GHSA-7pqw-9j4j-h8q3, CVSS 8.1): a second, distinct advisory -# for the same package/version (CWE-22 path traversal via two archive entries -# with identical names — a symlink followed by a regular file — bypassing the -# containment check). Not an alias of GHSA-jmr9-qjv8-65gv above; OSV reports it -# separately. Same "no patched version exists" and same non-exposure reasoning -# applies unchanged: the same @lhci/cli->lighthouse->puppeteer-core-> -# @puppeteer/browsers devDependency chain above, only ever extracting -# Puppeteer/Lighthouse's own CDN-hosted Chrome binaries, never ships in the app. - -[[IgnoredVulns]] -id = "GHSA-7pqw-9j4j-h8q3" -ignoreUntil = "2026-11-30T00:00:00Z" -reason = "extract-zip 2.0.1: second, distinct symlink path-traversal advisory (two-entry name-collision technique); latest release, no fixed version exists; same transitive @lhci/cli->lighthouse->puppeteer-core->@puppeteer/browsers devDependency (Lighthouse CI's own Puppeteer stack, not Playwright), never user-supplied zips, no runtime footprint in the shipped app" +# overrides.) The two extract-zip ignores formerly here (GHSA-jmr9-qjv8-65gv, +# GHSA-7pqw-9j4j-h8q3) were removed 2026-09-10: pnpm-workspace.yaml's +# overrides.lighthouse now forces @lhci/cli's Lighthouse/Puppeteer chain to a +# version whose @puppeteer/browsers dependency replaced extract-zip with +# modern-tar, eliminating the package from the resolved graph entirely — see +# AUDIT.md's 2026-09-10 entry. One documented ignore remains below — no fixed +# version exists to override to for it. # adm-zip@0.6.0 (CVE-2026-76845 / GHSA-vwc7-r8mq-g2x9, CVSS 6.8): symlink-following # path traversal on extraction with overwrite enabled, when an attacker can