From 18555204fe89a86bb24eb9e68308d55629ef78bb Mon Sep 17 00:00:00 2001 From: OrcaWin Date: Fri, 23 Oct 2026 15:14:57 -0700 Subject: [PATCH] chore(deps): apply reviewed maintenance updates and record full audit (#32349) * chore(deps): refresh reviewed maintenance releases * docs(deps): record complete inventory and upstream review --------- Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com> --- cloud/apps/relay/package.json | 2 +- cloud/pnpm-lock.yaml | 10 +- docs/audits/dependencies-2026-10-23/README.md | 69 +++++ .../native-and-ci-inventory.md | 176 +++++++++++ .../dependencies-2026-10-23/npm-inventory.md | 215 +++++++++++++ mobile/package.json | 4 +- mobile/pnpm-lock.yaml | 188 ++++++------ mobile/pnpm-workspace.yaml | 42 --- package.json | 14 +- pnpm-lock.yaml | 286 +++++++++--------- pnpm-workspace.yaml | 64 +--- 11 files changed, 706 insertions(+), 364 deletions(-) create mode 100644 docs/audits/dependencies-2026-10-23/README.md create mode 100644 docs/audits/dependencies-2026-10-23/native-and-ci-inventory.md create mode 100644 docs/audits/dependencies-2026-10-23/npm-inventory.md diff --git a/cloud/apps/relay/package.json b/cloud/apps/relay/package.json index cec2369a577..ff18d5ea368 100644 --- a/cloud/apps/relay/package.json +++ b/cloud/apps/relay/package.json @@ -19,7 +19,7 @@ "@orca-cloud/postgres-schema": "workspace:*", "@orca-cloud/relay-contract": "workspace:*", "hono": "^4.13.13", - "jose": "^6.2.12", + "jose": "^6.2.13", "pg": "^8.23.1", "tweetnacl": "^1.0.3", "ws": "^8.22.0", diff --git a/cloud/pnpm-lock.yaml b/cloud/pnpm-lock.yaml index c51f851cdf9..caba9e84b9a 100644 --- a/cloud/pnpm-lock.yaml +++ b/cloud/pnpm-lock.yaml @@ -246,8 +246,8 @@ importers: specifier: ^4.13.13 version: 4.13.13 jose: - specifier: ^6.2.12 - version: 6.2.12 + specifier: ^6.2.13 + version: 6.2.13 pg: specifier: ^8.23.1 version: 8.23.1 @@ -888,8 +888,8 @@ packages: resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==} engines: {node: '>= 14'} - jose@6.2.12: - resolution: {integrity: sha512-9NiFmJEex0sy2Dk58j2UGBSHgUs2ypF9eZSu4L6vjOX3Dp96Sw1F3uL+H+D1sx02jZZdzUT0HgvCy59CuvXcWw==} + jose@6.2.13: + resolution: {integrity: sha512-7TIg10ZE1x82YediN+lcrPNvGMKge9yFHQD+Qho/b8y2adfugU3AsvvHfxV0fzyFllT6l9xCjf4RWY9g/Z9PJQ==} json-bigint@1.0.0: resolution: {integrity: sha512-SiPv/8VpZuWbvLSMtTDU8hEfrZWg/mH/nV/b4o0CYbSxu1UIQPLdwKOCIyLQX+VIPO5vrLX3i8qtqFyhdPSUSQ==} @@ -1581,7 +1581,7 @@ snapshots: transitivePeerDependencies: - supports-color - jose@6.2.12: {} + jose@6.2.13: {} json-bigint@1.0.0: dependencies: diff --git a/docs/audits/dependencies-2026-10-23/README.md b/docs/audits/dependencies-2026-10-23/README.md new file mode 100644 index 00000000000..52b16b311ce --- /dev/null +++ b/docs/audits/dependencies-2026-10-23/README.md @@ -0,0 +1,69 @@ +# Dependency review — 2026-10-23 + +This review selects eight maintenance dependencies with concrete benefits and keeps migrations with unresolved compatibility or regression risks separate. Security remediation is in [PR #32326](https://github.com/stablyai/orca/pull/32326); this maintenance PR builds on it. + +## Coverage and method + +- Inventoried all **19 npm manifests**, **298 external direct declarations**, and **209 distinct package names**. Queried npm metadata for every name: latest tags, publication dates, repository, engines, peers, deprecations, integrity and available provenance. [Every package and decision](npm-inventory.md) is recorded, including packages left unchanged. +- Audited all five pnpm lockfiles using the repository's `check:dependencies` gate. The initial graph contained **4,136 package entries** across desktop, mobile, cloud, docs and audit tools; these are lockfile entries, not distinct packages. The gate also verifies the existing advisory exceptions against their committed patch hashes. +- Read upstream releases, relevant source changes, compatibility notes and issue reports for proposed updates and higher-risk alternatives. Registry coverage is exhaustive for direct npm dependencies; upstream source/issue review is focused on update candidates, rather than every commit of every transitive repository. +- Queried OSV for **167 locked non-JavaScript entries**: 34 Rust, 131 Ruby/platform entries and 2 Python requirements. No advisories were returned. Requeried platform-suffixed ffi entries using upstream version 1.17.4. Reviewed native manifests, Android test/WebView pins, release tooling and all **15 external GitHub Action repositories**. [Native and CI inventory](native-and-ci-inventory.md). +- Began at `8d94ed06570`. Main advanced to `d9dc87b2fb0` during the review and independently upgraded Bun, tsrs, DOMPurify and Next. The final branch incorporates that main and the security prerequisite; the inventory distinguishes initial and selected versions. + +## Selected changes + +| Dependency | Update | Value and review | +| ------------------------------------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `@playwright/test`, `playwright-core` | 1.63.0 / 1.64.0 → **1.64.1** | Align the two browser automation installations. [Release](https://github.com/microsoft/playwright/releases/tag/v1.64.1) fixes packaged Electron launch when the hidden first window is lost (#43247) and CORS redirects producing `net::ERR_ABORTED` (#43242). Reviewed Electron and Chromium implementation changes and 1.64 migration notes. | +| `@testing-library/user-event` | 14.6.7 → **14.6.8** | [Fixes programmatically null-valued input interaction](https://github.com/testing-library/user-event/releases/tag/v14.6.8) (#1329). Existing renderer consumers exercise real input interactions. | +| `@types/ws` | 8.18.1 → **8.18.2** | [Adds fragmentation limit option types](https://github.com/DefinitelyTyped/DefinitelyTyped/pull/75590) for the already-updated ws runtime. Desktop and mobile move together; cloud already uses this version. | +| `devalue` | 6.0.2 → **6.0.3** | [Improves escaping performance and explicit module types](https://github.com/sveltejs/devalue/releases/tag/v6.0.3). Reviewed escaping of `<`, line separators and lone surrogates. Orca's existing Node Vitest worker transport exercises serialization. | +| `oxfmt` | 0.73.0 → **0.74.0** | [Preserves comments after imports and fixes Markdown/YAML formatting](https://github.com/oxc-project/oxc/releases/tag/oxfmt_v0.74.0). Desktop/mobile formatter versions remain aligned. Format only changed files. | +| `tldts` | 7.4.16 → **7.4.18** | [Refreshes the public suffix list](https://github.com/remusao/tldts/releases/tag/v7.4.18) (#2708), used by cookie domain boundaries and URL classification. Keep 7.4.19 behind the existing three-day release delay. | +| `jose` | 6.2.12 → **6.2.13** | [Preserves provider error causes](https://github.com/panva/jose/releases/tag/v6.2.13) (#908). Reviewed token verification failure behavior; relay token/JWKS/assignment tests validate existing authentication contracts. | + +Selected versions retain the supported Node 24 runtime. Oxfmt is a development tool with the same Node requirement as the existing version; devalue supports Node 18+, user-event Node 12+, and Playwright Node 20+. No application protocol, persisted schema, API, shortcut or platform process implementation changes. + +Remove **102 obsolete release-age exemptions**: 62 desktop and 40 mobile entries. Preserve the existing explicit Bun 1.4.4 exceptions introduced by main. The three-day delay, strict build approvals, native optional-package restrictions, patches and security exception policy remain enforced. No new exception is introduced. + +## Updates deliberately deferred + +| Dependency family | Evidence and decision | +| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Tiptap | Keep all 13 packages at 3.31.3. [Markdown round-trip regression #8519](https://github.com/ueberdosis/tiptap/issues/8519) and [input-rule duplicate characters #8513](https://github.com/ueberdosis/tiptap/issues/8513) make a family-wide update unsuitable without focused editor validation. | +| Parcel watcher | Keep 2.5.6. Upstream reports [Linux worker unload crashes #264](https://github.com/parcel-bundler/watcher/issues/264), [macOS double-stop lifecycle problems #271](https://github.com/parcel-bundler/watcher/issues/271), and lost events. The new ignore features are not required here. | +| Claude Agent SDK | Keep the exact 0.3.284 pin. Read the [changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md): newer permission defaults, fork/subagent behavior, hook sanitization and CLI argument changes need validation against independently updated user CLIs and remote hosts. | +| Agent Browser | Retain the current integration. [0.39.2](https://github.com/vercel-labs/agent-browser/releases/tag/v0.39.2) changes policy, CDP attachment and command validation; open reports include [Windows close/open hangs #1407](https://github.com/vercel-labs/agent-browser/issues/1407) and [policy bypass behavior #2172](https://github.com/vercel-labs/agent-browser/issues/2172). A dedicated integration/security review is needed; no claim that the pinned version fixes these reports. | +| React, Expo, React Native | Preserve the Expo 55 / RN 0.83 / React 19.2 family and matching test renderer. React 19.2.9 primarily fixes RSC transport behavior; Expo 58/RN 0.88 and native screens/worklets/reanimated require coordinated device builds and local patch rebasing. RN Web 0.21.4's [AssetRegistry changes](https://github.com/necolas/react-native-web/releases/tag/0.21.4) do not solve an identified current issue. | +| Radix and TanStack Virtual | [Stacked-dialog dismissal #4143](https://github.com/radix-ui/primitives/issues/4143) and [popup dismissal #4219](https://github.com/radix-ui/primitives/issues/4219) need desktop focus coverage. Virtual's new [scroll compensation/anchor behavior](https://github.com/TanStack/virtual/releases/tag/%40tanstack/virtual-core%403.19.7) needs large-list, touch and performance checks. | +| PDF.js | 6.4.299 includes useful font/rendering work, but [reported rendering/text-layer regressions](https://github.com/mozilla/pdf.js/issues/22258) warrant a dedicated PDF browser fixture suite before adoption. | +| Localization | i18next [26.5.5](https://github.com/i18next/i18next/releases/tag/v26.5.5) changes interpolation semantics and [26.5.6](https://github.com/i18next/i18next/releases/tag/v26.5.6) changes nested resource-store cloning; latest releases are also younger than the delay. Keep react-i18next and the locally patched extraction CLI coordinated. | +| Zod / Fumadocs | Keep shared runtime Zod aligned. Newer docs-only Zod changes JSON-schema behavior ([#6648](https://github.com/colinhacks/zod/issues/6648)); [4.6.6 notes](https://github.com/colinhacks/zod/releases/tag/v4.6.6) describe an upstream Git credential compromise and explicitly say the malicious commits were never published to npm. Fumadocs core/UI/MDX need a coordinated docs migration. No evidence that the installed packages are compromised. | +| Linear / analytics | [Linear SDK 99](https://github.com/linear/linear/releases/tag/%40linear/sdk%4099.0.0) removes schema fields and adds a required argument; no new API is needed. PostHog's newer behavior has no demonstrated benefit for Orca's current capture path. | +| React Doctor | Keep CLI/plugin at 0.9.14. Reviewed [0.9.18](https://github.com/millionco/react-doctor/releases/tag/react-doctor%400.9.18), including Git worktree and false-positive fixes. Existing `verify-locked-audit-tools.mjs` fails its changed-file finding assertion on both 0.9.14 and 0.9.18 locally; dynamic/reorderable input fixtures did not establish reliable candidate coverage. Retain the original fixture and versions pending separate diagnosis. This is not evidence of a new regression unique to 0.9.18. | +| Patched/native/build tooling | Preserve xterm beta family, node-pty, Monaco, ws, lint-staged and i18next CLI patch registrations. Keep sherpa native speech binaries and signing/build toolchains until multi-OS validation is available. Oxlint 1.89 changes recommended rules/AST behavior; Knip 6, Node-gyp 13, TypeScript and related tooling need separate migration reviews. | +| Remaining majors / cosmetic additions | Noble Hashes 2 changes ESM/module paths; React Grab 0.2 removes its style panel; Jest DOM 7 changes peers/Node support. React Colorful's new Shadow DOM support and new Lucide icons are not currently needed. Hold Mermaid 12, Marked 18, KaTeX 0.19, Diff 9 and emoji-family majors for their own compatibility work. | +| Fresh releases | Vite 8.3.5, Zustand 5.0.16 and several other latest tags were inside the three-day delay. Do not bypass that policy for routine maintenance. | +| Non-JavaScript / CI | CocoaPods and Python requirements are current at review time. Fastlane 2.241.1 and winresource 0.1.34 do not justify changing release/native tooling without macOS/Windows builds. Retain older action majors pending self-hosted runner/runtime compatibility review; patch-following major tags continue to receive upstream patches. | + +## Security result and boundaries + +The combined branches clear all unexcepted findings from the five-lockfile gate. The only accepted findings remain the existing hash-verified `braces@3.0.3` and `node-forge@1.4.0` patches. Upstream has not published replacements for those patched versions. Keep the reviewed patches and exceptions. + +PR #32326 also fixes Electron's compromised-intermediate certificate advisory, which was absent from the npm audit response. It preserves the separately verified Node runtime assets and hashes. A clean registry scan alone therefore does not establish runtime security. + +The OSV checks cover the committed Rust/Ruby/Python versions, not downloaded tool binaries, container OS packages or a newly resolved CocoaPods/Maven graph. Android WebView 1.14.0 is deliberately synchronized with the patched React Native WebView package. Container base/runtime digests and release signing pins stay unchanged. Native device builds, macOS/Windows packaging and complete Electron application integration are CI/platform validation responsibilities. + +## Validation + +Run with `ORCA_BACKGROUND_LAUNCH=1`, Node 24 and pinned Bun 1.4.4 on Linux. No user desktop windows are shown or focused. + +- All four desktop typecheck projects pass; mobile typecheck passes after the existing generated-engine postinstall; cloud build and all cloud typechecks pass. +- Relay suite: **1,279 passed**, 201 skipped (database/service-dependent cases). +- Selected renderer, cookie policy, URL classification and Vitest Node worker transport tests: **954 passed across 88 files**. Cookie suite on the isolated virtual display: **248 passed across 30 files**. An earlier parallel virtual-display cleanup failure passed on retry and the full serial rerun. +- Actual mobile Mermaid rendering in Chromium: **4 passed**; 4 WebKit cases excluded because WebKit is not installed locally. +- Shared mobile/desktop dependency versions, Node runtime pins, frozen installs, dependency security and changed-file formatting/lint checks are checked before publication. +- The security prerequisite also ran the complete mobile suite (**11,489 passed**, 6 skipped), docs tests (**18 passed**), the production docs build (**121 pages**) and Chromium hydration/navigation/search checks. +- React Doctor's real changed-file smoke remains a baseline limitation described above; neither its version nor its fixture is changed here. Native-focus and visible-window checks stay on isolated displays or CI. + +These checks reduce regression risk; they do not guarantee zero regressions. Package registry and advisory results are a dated snapshot and should be refreshed when merging materially later. diff --git a/docs/audits/dependencies-2026-10-23/native-and-ci-inventory.md b/docs/audits/dependencies-2026-10-23/native-and-ci-inventory.md new file mode 100644 index 00000000000..3c47d184172 --- /dev/null +++ b/docs/audits/dependencies-2026-10-23/native-and-ci-inventory.md @@ -0,0 +1,176 @@ +# Native and build dependency inventory + +167 locked entries were queried against OSV: 34 crates.io, 131 RubyGems including platform variants, and 2 PyPI. No advisories were returned. Ruby ffi platform suffixes were also queried as upstream version 1.17.4. Entries shared by both Rust locks appear once below. Versions remain unchanged; native/release tooling updates require platform build validation. + +| Ecosystem / package | Locked | Latest stable | Manifests | OSV result | +| ------------------------------------------------------------------------------------------------------- | ---------------- | ---------------- | -------------------------------------------------------------------------------- | ---------------------- | +| PyPI / [certifi](https://pypi.org/project/certifi) | 2026.10.19 | 2026.10.19 | `cloud/apps/relay-fence-broker/requirements.txt` | No advisories returned | +| PyPI / [urllib3](https://pypi.org/project/urllib3) | 2.8.0 | 2.8.0 | `cloud/apps/relay-fence-broker/requirements.txt` | No advisories returned | +| RubyGems / [CFPropertyList](https://rubygems.org/gems/CFPropertyList) | 3.0.8 | 4.0.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [abbrev](https://rubygems.org/gems/abbrev) | 0.1.2 | 0.1.2 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [activesupport](https://rubygems.org/gems/activesupport) | 7.2.4 | 8.1.4 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [addressable](https://rubygems.org/gems/addressable) | 2.9.0 | 2.9.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [algoliasearch](https://rubygems.org/gems/algoliasearch) | 1.27.5 | 1.27.5 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [artifactory](https://rubygems.org/gems/artifactory) | 3.0.17 | 3.0.17 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [atomos](https://rubygems.org/gems/atomos) | 0.1.3 | 1.0.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [aws-eventstream](https://rubygems.org/gems/aws-eventstream) | 1.4.0 | 1.4.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [aws-partitions](https://rubygems.org/gems/aws-partitions) | 1.1281.0 | 1.1298.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [aws-sdk-core](https://rubygems.org/gems/aws-sdk-core) | 3.254.1 | 3.260.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [aws-sdk-kms](https://rubygems.org/gems/aws-sdk-kms) | 1.130.0 | 1.135.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [aws-sdk-s3](https://rubygems.org/gems/aws-sdk-s3) | 1.229.0 | 1.235.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [aws-sigv4](https://rubygems.org/gems/aws-sigv4) | 1.12.1 | 1.12.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [babosa](https://rubygems.org/gems/babosa) | 1.0.4 | 2.1.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [base64](https://rubygems.org/gems/base64) | 0.3.0 | 0.3.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [benchmark](https://rubygems.org/gems/benchmark) | 0.5.0 | 0.5.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [bigdecimal](https://rubygems.org/gems/bigdecimal) | 4.1.2 | 4.1.3 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [cgi](https://rubygems.org/gems/cgi) | 0.5.2 | 0.5.2 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [claide](https://rubygems.org/gems/claide) | 1.1.0 | 1.1.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [cocoapods](https://rubygems.org/gems/cocoapods) | 1.17.0 | 1.17.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [cocoapods-core](https://rubygems.org/gems/cocoapods-core) | 1.17.0 | 1.17.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [cocoapods-deintegrate](https://rubygems.org/gems/cocoapods-deintegrate) | 1.0.5 | 1.0.5 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [cocoapods-downloader](https://rubygems.org/gems/cocoapods-downloader) | 2.1 | 2.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [cocoapods-plugins](https://rubygems.org/gems/cocoapods-plugins) | 1.0.0 | 1.0.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [cocoapods-search](https://rubygems.org/gems/cocoapods-search) | 1.0.1 | 1.0.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [cocoapods-trunk](https://rubygems.org/gems/cocoapods-trunk) | 1.6.0 | 1.6.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [cocoapods-try](https://rubygems.org/gems/cocoapods-try) | 1.2.0 | 1.2.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [colored](https://rubygems.org/gems/colored) | 1.2 | 1.2 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [colored2](https://rubygems.org/gems/colored2) | 3.1.2 | 4.0.3 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [commander](https://rubygems.org/gems/commander) | 4.6.0 | 6.0.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [concurrent-ruby](https://rubygems.org/gems/concurrent-ruby) | 1.3.8 | 1.3.8 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [connection_pool](https://rubygems.org/gems/connection_pool) | 2.5.5 | 3.0.2 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [csv](https://rubygems.org/gems/csv) | 3.3.6 | 3.3.6 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [declarative](https://rubygems.org/gems/declarative) | 0.0.20 | 0.0.20 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [digest-crc](https://rubygems.org/gems/digest-crc) | 0.7.0 | 0.7.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [domain_name](https://rubygems.org/gems/domain_name) | 0.6.20240107 | 0.7.20261007 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [dotenv](https://rubygems.org/gems/dotenv) | 2.8.1 | 3.2.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [drb](https://rubygems.org/gems/drb) | 2.2.3 | 2.2.3 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [emoji_regex](https://rubygems.org/gems/emoji_regex) | 3.2.3 | 15.0.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [erb](https://rubygems.org/gems/erb) | 6.0.7 | 6.0.7 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [ethon](https://rubygems.org/gems/ethon) | 0.18.0 | 0.18.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [excon](https://rubygems.org/gems/excon) | 1.7.0 | 1.8.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [faraday](https://rubygems.org/gems/faraday) | 2.14.3 | 2.15.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [faraday-cookie_jar](https://rubygems.org/gems/faraday-cookie_jar) | 0.0.8 | 0.0.8 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [faraday-follow_redirects](https://rubygems.org/gems/faraday-follow_redirects) | 0.5.0 | 0.5.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [faraday-multipart](https://rubygems.org/gems/faraday-multipart) | 1.2.0 | 1.2.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [faraday-net_http](https://rubygems.org/gems/faraday-net_http) | 3.4.4 | 3.5.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [faraday-retry](https://rubygems.org/gems/faraday-retry) | 2.4.0 | 2.4.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [fastimage](https://rubygems.org/gems/fastimage) | 2.4.1 | 2.4.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [fastlane](https://rubygems.org/gems/fastlane) | 2.240.1 | 2.241.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [fastlane-sirp](https://rubygems.org/gems/fastlane-sirp) | 1.1.0 | 1.1.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [ffi](https://rubygems.org/gems/ffi) | 1.17.4 | 1.17.4 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [fourflusher](https://rubygems.org/gems/fourflusher) | 2.3.1 | 2.3.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [fuzzy_match](https://rubygems.org/gems/fuzzy_match) | 2.0.4 | 2.1.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [gh_inspector](https://rubygems.org/gems/gh_inspector) | 1.1.3 | 1.1.3 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [google-apis-androidpublisher_v3](https://rubygems.org/gems/google-apis-androidpublisher_v3) | 0.106.0 | 0.110.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [google-apis-core](https://rubygems.org/gems/google-apis-core) | 1.2.5 | 1.4.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [google-apis-iamcredentials_v1](https://rubygems.org/gems/google-apis-iamcredentials_v1) | 0.28.0 | 0.28.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [google-apis-playcustomapp_v1](https://rubygems.org/gems/google-apis-playcustomapp_v1) | 0.18.0 | 0.18.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [google-apis-storage_v1](https://rubygems.org/gems/google-apis-storage_v1) | 0.66.0 | 0.69.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [google-cloud-core](https://rubygems.org/gems/google-cloud-core) | 1.9.0 | 1.9.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [google-cloud-env](https://rubygems.org/gems/google-cloud-env) | 2.2.2 | 2.4.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [google-cloud-errors](https://rubygems.org/gems/google-cloud-errors) | 1.7.0 | 1.7.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [google-cloud-storage](https://rubygems.org/gems/google-cloud-storage) | 1.62.0 | 1.62.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [google-logging-utils](https://rubygems.org/gems/google-logging-utils) | 0.2.0 | 0.2.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [googleauth](https://rubygems.org/gems/googleauth) | 1.17.3 | 1.17.6 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [highline](https://rubygems.org/gems/highline) | 2.0.3 | 3.1.2 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [http-cookie](https://rubygems.org/gems/http-cookie) | 1.0.8 | 1.1.6 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [httpclient](https://rubygems.org/gems/httpclient) | 2.9.0 | 2.9.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [i18n](https://rubygems.org/gems/i18n) | 1.15.2 | 1.15.2 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [io-console](https://rubygems.org/gems/io-console) | 0.9.2 | 0.9.4 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [irb](https://rubygems.org/gems/irb) | 1.18.0 | 1.18.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [jmespath](https://rubygems.org/gems/jmespath) | 1.6.2 | 1.6.2 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [json](https://rubygems.org/gems/json) | 2.21.2 | 3.1.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [jwt](https://rubygems.org/gems/jwt) | 3.2.0 | 3.3.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [logger](https://rubygems.org/gems/logger) | 1.7.0 | 1.7.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [mini_magick](https://rubygems.org/gems/mini_magick) | 4.13.2 | 5.4.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [mini_mime](https://rubygems.org/gems/mini_mime) | 1.1.5 | 1.1.5 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [minitest](https://rubygems.org/gems/minitest) | 5.27.0 | 6.0.6 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [molinillo](https://rubygems.org/gems/molinillo) | 0.8.0 | 0.8.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [multi_json](https://rubygems.org/gems/multi_json) | 1.21.1 | 1.21.2 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [multipart-post](https://rubygems.org/gems/multipart-post) | 2.4.1 | 2.4.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [mutex_m](https://rubygems.org/gems/mutex_m) | 0.3.0 | 0.3.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [nanaimo](https://rubygems.org/gems/nanaimo) | 0.4.0 | 0.4.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [nap](https://rubygems.org/gems/nap) | 1.1.0 | 1.1.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [naturally](https://rubygems.org/gems/naturally) | 2.3.0 | 2.3.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [net-http](https://rubygems.org/gems/net-http) | 0.9.1 | 0.10.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [netrc](https://rubygems.org/gems/netrc) | 0.11.0 | 0.11.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [nkf](https://rubygems.org/gems/nkf) | 0.3.0 | 0.3.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [optparse](https://rubygems.org/gems/optparse) | 0.8.1 | 0.8.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [os](https://rubygems.org/gems/os) | 1.1.4 | 1.1.4 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [ostruct](https://rubygems.org/gems/ostruct) | 0.6.3 | 0.6.3 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [plist](https://rubygems.org/gems/plist) | 3.7.2 | 3.7.2 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [pp](https://rubygems.org/gems/pp) | 0.6.4 | 0.6.4 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [prettyprint](https://rubygems.org/gems/prettyprint) | 0.2.0 | 0.2.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [prism](https://rubygems.org/gems/prism) | 1.9.0 | 2.0.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [pstore](https://rubygems.org/gems/pstore) | 0.2.1 | 0.2.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [public_suffix](https://rubygems.org/gems/public_suffix) | 4.0.7 | 7.0.5 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [rake](https://rubygems.org/gems/rake) | 13.4.2 | 13.4.2 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [rbs](https://rubygems.org/gems/rbs) | 4.1.3 | 4.2.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [rdoc](https://rubygems.org/gems/rdoc) | 8.0.0 | 8.1.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [reline](https://rubygems.org/gems/reline) | 0.7.0 | 0.7.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [representable](https://rubygems.org/gems/representable) | 3.2.0 | 3.3.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [retriable](https://rubygems.org/gems/retriable) | 4.2.0 | 5.0.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [rexml](https://rubygems.org/gems/rexml) | 3.4.4 | 3.4.4 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [rouge](https://rubygems.org/gems/rouge) | 3.28.0 | 5.1.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [ruby-macho](https://rubygems.org/gems/ruby-macho) | 4.1.0 | 7.0.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [rubyzip](https://rubygems.org/gems/rubyzip) | 3.7.0 | 3.7.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [securerandom](https://rubygems.org/gems/securerandom) | 0.4.1 | 0.4.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [security](https://rubygems.org/gems/security) | 0.3.0 | 0.3.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [signet](https://rubygems.org/gems/signet) | 0.22.0 | 0.22.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [simctl](https://rubygems.org/gems/simctl) | 1.6.10 | 1.6.10 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [terminal-notifier](https://rubygems.org/gems/terminal-notifier) | 2.0.0 | 3.1.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [terminal-table](https://rubygems.org/gems/terminal-table) | 4.0.0 | 4.0.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [trailblazer-option](https://rubygems.org/gems/trailblazer-option) | 0.1.2 | 0.1.2 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [tsort](https://rubygems.org/gems/tsort) | 0.2.0 | 0.2.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [tty-cursor](https://rubygems.org/gems/tty-cursor) | 0.7.1 | 0.7.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [tty-screen](https://rubygems.org/gems/tty-screen) | 0.8.2 | 0.8.2 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [tty-spinner](https://rubygems.org/gems/tty-spinner) | 0.9.3 | 0.9.3 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [typhoeus](https://rubygems.org/gems/typhoeus) | 1.6.0 | 1.6.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [tzinfo](https://rubygems.org/gems/tzinfo) | 2.0.6 | 2.0.6 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [uber](https://rubygems.org/gems/uber) | 0.1.0 | 0.1.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [unicode-display_width](https://rubygems.org/gems/unicode-display_width) | 3.2.0 | 3.3.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [unicode-emoji](https://rubygems.org/gems/unicode-emoji) | 4.2.0 | 4.3.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [uri](https://rubygems.org/gems/uri) | 1.1.1 | 1.1.2 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [word_wrap](https://rubygems.org/gems/word_wrap) | 1.0.0 | 1.0.0 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [xcodeproj](https://rubygems.org/gems/xcodeproj) | 1.28.1 | 1.28.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [xcpretty](https://rubygems.org/gems/xcpretty) | 0.4.1 | 0.4.1 | `mobile/Gemfile.lock` | No advisories returned | +| RubyGems / [xcpretty-travis-formatter](https://rubygems.org/gems/xcpretty-travis-formatter) | 1.0.1 | 1.0.1 | `mobile/Gemfile.lock` | No advisories returned | +| crates.io / [equivalent](https://crates.io/crates/equivalent) | 1.0.2 | 1.0.3 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [hashbrown](https://crates.io/crates/hashbrown) | 0.17.1 | 0.17.1 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [indexmap](https://crates.io/crates/indexmap) | 2.14.2 | 2.14.2 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [proc-macro2](https://crates.io/crates/proc-macro2) | 1.0.107 | 1.0.107 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [quote](https://crates.io/crates/quote) | 1.0.47 | 1.0.47 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [serde_core](https://crates.io/crates/serde_core) | 1.0.229 | 1.0.229 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [serde_derive](https://crates.io/crates/serde_derive) | 1.0.229 | 1.0.229 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [serde_spanned](https://crates.io/crates/serde_spanned) | 1.1.1 | 1.1.2 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [syn](https://crates.io/crates/syn) | 3.0.6 | 3.0.9 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [toml](https://crates.io/crates/toml) | 1.1.6+spec-1.1.0 | 1.1.8+spec-1.1.0 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [toml_datetime](https://crates.io/crates/toml_datetime) | 1.1.1+spec-1.1.0 | 1.1.2+spec-1.1.0 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [toml_parser](https://crates.io/crates/toml_parser) | 1.1.3+spec-1.1.0 | 1.1.5+spec-1.1.0 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [toml_writer](https://crates.io/crates/toml_writer) | 1.1.2+spec-1.1.0 | 1.1.3+spec-1.1.0 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [unicode-ident](https://crates.io/crates/unicode-ident) | 1.0.26 | 1.0.27 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [version_check](https://crates.io/crates/version_check) | 0.9.5 | 0.9.5 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [winnow](https://crates.io/crates/winnow) | 1.0.4 | 1.0.4 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | +| crates.io / [winresource](https://crates.io/crates/winresource) | 0.1.31 | 0.1.34 | `native/windows-agent-hook/Cargo.lock`, `native/windows-cli-launcher/Cargo.lock` | No advisories returned | + +## GitHub Actions + +All 15 external action repositories referenced by workflows/composite actions were inventoried. Major-tag actions receive upstream patches without a source edit; older majors are retained pending hosted/self-hosted runner and credential/runtime compatibility validation. The Bun setup action remains SHA-pinned. + +| Action | Referenced tags / SHA | Latest release at scan | Decision | +| ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------ | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | +| [actions/checkout](https://github.com/actions/checkout) | `v4`, `v6` | [v7.0.1](https://github.com/actions/checkout/releases/tag/v7.0.1) | Retain; validate runtime/runner requirements before major or SHA changes. | +| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `v2`, `v3` | [v3.3.0](https://github.com/actions/create-github-app-token/releases/tag/v3.3.0) | Retain; validate runtime/runner requirements before major or SHA changes. | +| [actions/setup-node](https://github.com/actions/setup-node) | `v4`, `v6` | [v7.1.0](https://github.com/actions/setup-node/releases/tag/v7.1.0) | Retain; validate runtime/runner requirements before major or SHA changes. | +| [pnpm/setup](https://github.com/pnpm/setup) | `v2` | [v3.1.1](https://github.com/pnpm/setup/releases/tag/v3.1.1) | Retain; validate runtime/runner requirements before major or SHA changes. | +| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `v4`, `v7` | [v7.0.2](https://github.com/actions/upload-artifact/releases/tag/v7.0.2) | Retain; validate runtime/runner requirements before major or SHA changes. | +| [actions/cache](https://github.com/actions/cache) | `v4`, `v5` | [v6.1.0](https://github.com/actions/cache/releases/tag/v6.1.0) | Retain; validate runtime/runner requirements before major or SHA changes. | +| [actions/download-artifact](https://github.com/actions/download-artifact) | `v8` | [v8.0.2](https://github.com/actions/download-artifact/releases/tag/v8.0.2) | Retain; validate runtime/runner requirements before major or SHA changes. | +| [actions/github-script](https://github.com/actions/github-script) | `v8` | [v9.0.0](https://github.com/actions/github-script/releases/tag/v9.0.0) | Retain; validate runtime/runner requirements before major or SHA changes. | +| [nick-fields/retry](https://github.com/nick-fields/retry) | `v4` | [v4.0.0](https://github.com/nick-fields/retry/releases/tag/v4.0.0) | Retain; validate runtime/runner requirements before major or SHA changes. | +| [oven-sh/setup-bun](https://github.com/oven-sh/setup-bun) | `0c5077e51419868618aeaa5fe8019c62421857d6` | [v2.2.0](https://github.com/oven-sh/setup-bun/releases/tag/v2.2.0) | Retain; validate runtime/runner requirements before major or SHA changes. | +| [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `v1` | [v1.334.0](https://github.com/ruby/setup-ruby/releases/tag/v1.334.0) | Retain; validate runtime/runner requirements before major or SHA changes. | +| [maxim-lobanov/setup-xcode](https://github.com/maxim-lobanov/setup-xcode) | `v1` | [v1.7.0](https://github.com/maxim-lobanov/setup-xcode/releases/tag/v1.7.0) | Retain; validate runtime/runner requirements before major or SHA changes. | +| [actions/setup-java](https://github.com/actions/setup-java) | `v5` | [v6.1.0](https://github.com/actions/setup-java/releases/tag/v6.1.0) | Retain; validate runtime/runner requirements before major or SHA changes. | +| [signpath/github-action-submit-signing-request](https://github.com/signpath/github-action-submit-signing-request) | `v2` | [v2](https://github.com/SignPath/github-action-submit-signing-request/releases/tag/v2) | Retain; validate runtime/runner requirements before major or SHA changes. | +| [pullfrog/pullfrog](https://github.com/pullfrog/pullfrog) | `v0` | [v0.1.101](https://github.com/pullfrog/pullfrog/releases/tag/v0.1.101) | Retain; validate runtime/runner requirements before major or SHA changes. | diff --git a/docs/audits/dependencies-2026-10-23/npm-inventory.md b/docs/audits/dependencies-2026-10-23/npm-inventory.md new file mode 100644 index 00000000000..e635d74117a --- /dev/null +++ b/docs/audits/dependencies-2026-10-23/npm-inventory.md @@ -0,0 +1,215 @@ +# npm dependency inventory + +Registry snapshot: 2026-10-23. Initial scan: `8d94ed06570`; final selections include main `d9dc87b2fb0` and security PR #32326. Every external direct dependency from all 19 package manifests is represented. “Latest” is the registry latest tag, not an assertion of compatibility. Registry/engine/peer/deprecation checks cover every name; source/release/issue review concentrates on candidates described in [the report](README.md). + +| Package / upstream | Initial locked → selected | Latest | Locations | Decision | +| -------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | +| [@actions/expressions](https://github.com/actions/languageservices) | 0.3.61 → 0.3.61 | 0.3.61 | `package.json` | Retain: registry latest already selected. | +| [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | 0.3.284 → 0.3.284 | 0.3.309 | `package.json` | Hold: CLI permission, hook and subagent behavior needs mixed-version contract validation. | +| [@dnd-kit/core](https://github.com/clauderic/dnd-kit) | 6.3.1 → 6.3.1 | 6.3.1 | `package.json` | Retain: registry latest already selected. | +| [@dnd-kit/sortable](https://github.com/clauderic/dnd-kit) | 10.0.0 → 10.0.0 | 10.0.0 | `package.json` | Retain: registry latest already selected. | +| [@electron-toolkit/tsconfig](https://github.com/alex8088/electron-toolkit) | 2.0.0 → 2.0.0 | 2.0.0 | `package.json` | Retain: registry latest already selected. | +| [@electron/osx-sign](https://github.com/electron/osx-sign) | 2.7.0 → 2.7.0 | 2.7.1 | `package.json` | Hold: recent signing release requires macOS signing validation. | +| [@electron/rebuild](https://github.com/electron/rebuild) | 4.2.1 → 4.2.1 | 4.2.1 | `package.json` | Retain: registry latest already selected. | +| [@floating-ui/dom](https://github.com/floating-ui/floating-ui) | 1.8.0 → 1.8.0 | 1.8.0 | `package.json` | Retain: registry latest already selected. | +| [@hono/node-server](https://github.com/honojs/node-server) | 2.1.5 → 2.1.5 | 2.1.5 | `cloud/apps/push/package.json`, `cloud/apps/relay-fence-broker/package.json`, `cloud/apps/relay/package.json` | Retain: registry latest already selected. | +| [@linear/sdk](https://github.com/linear/linear) | 97.0.0 → 97.0.0 | 99.0.0 | `package.json` | Hold: schema-major breaking changes; no needed new API. | +| [@monaco-editor/react](https://github.com/suren-atoyan/monaco-react) | 4.7.0 → 4.7.0 | 4.7.0 | `package.json` | Retain: registry latest already selected. | +| [@noble/hashes](https://github.com/paulmillr/noble-hashes) | 1.8.0 → 1.8.0 | 2.4.0 | `mobile/package.json`, `package.json` | Hold: v2 ESM/module-path migration across shared desktop/mobile code. | +| [@oxlint/plugins](https://github.com/oxc-project/oxc) | 1.88.0 → 1.88.0 | 1.89.0 | `package.json` | Hold with Oxlint and type-aware lint toolchain. | +| [@parcel/watcher](https://github.com/parcel-bundler/watcher) | 2.5.6 → 2.5.6 | 2.6.0 | `package.json` | Hold: native lifecycle/crash and lost-event reports; multi-OS watcher validation required. | +| [@playwright/test](https://github.com/microsoft/playwright) | 1.63.0 → 1.64.1 | 1.64.1 | `package.json` | Electron launch and CORS fixes; align with playwright-core. | +| [@react-native-async-storage/async-storage](https://github.com/react-native-async-storage/async-storage) | 2.2.0 → 2.2.0 | 3.1.1 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [@sanity/diff-match-patch](https://github.com/sanity-io/diff-match-patch) | 3.2.1 → 3.2.1 | 3.2.1 | `package.json` | Retain: registry latest already selected. | +| [@shadcn/lint](https://github.com/shadcn-ui/lint) | 0.1.5 → 0.1.5 | 0.2.3 | `package.json` | Hold: pre-1.0 lint rule migration has no required benefit. | +| `@stablyai/playwright-test` | 2.1.16 → 2.1.16 | 2.1.16 | `package.json` | Retain: registry latest already selected. | +| [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss) | 4.3.3 → 4.3.3 | 4.3.3 | `docs/site/package.json` | Retain: registry latest already selected. | +| [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss) | 4.3.3 → 4.3.3 | 4.3.3 | `package.json` | Retain: registry latest already selected. | +| [@tanstack/react-virtual](https://github.com/TanStack/virtual) | 3.14.13 → 3.14.13 | 3.14.22 | `package.json` | Hold: scroll anchoring and touch behavior changes need renderer scroll/performance validation. | +| [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | 6.9.1 → 6.9.1 | 7.0.1 | `package.json` | Hold: new matchers not used; v7 changes peers and Node floor. | +| [@testing-library/react](https://github.com/testing-library/react-testing-library) | 16.3.3 → 16.3.3 | 16.3.3 | `package.json` | Retain: registry latest already selected. | +| [@testing-library/user-event](https://github.com/testing-library/user-event) | 14.6.7 → 14.6.8 | 14.6.8 | `package.json` | Fix null-valued input interaction. | +| [@tiptap/extension-code-block](https://github.com/ueberdosis/tiptap) | 3.31.3 → 3.31.3 | 3.32.0 | `package.json` | Hold family at 3.31.3: upstream Markdown/input-rule regressions. | +| [@tiptap/extension-code-block-lowlight](https://github.com/ueberdosis/tiptap) | 3.31.3 → 3.31.3 | 3.32.0 | `package.json` | Hold family at 3.31.3: upstream Markdown/input-rule regressions. | +| [@tiptap/extension-details](https://github.com/ueberdosis/tiptap) | 3.31.3 → 3.31.3 | 3.32.0 | `package.json` | Hold family at 3.31.3: upstream Markdown/input-rule regressions. | +| [@tiptap/extension-image](https://github.com/ueberdosis/tiptap) | 3.31.3 → 3.31.3 | 3.32.0 | `package.json` | Hold family at 3.31.3: upstream Markdown/input-rule regressions. | +| [@tiptap/extension-link](https://github.com/ueberdosis/tiptap) | 3.31.3 → 3.31.3 | 3.32.0 | `package.json` | Hold family at 3.31.3: upstream Markdown/input-rule regressions. | +| [@tiptap/extension-list](https://github.com/ueberdosis/tiptap) | 3.31.3 → 3.31.3 | 3.32.0 | `package.json` | Hold family at 3.31.3: upstream Markdown/input-rule regressions. | +| [@tiptap/extension-mathematics](https://github.com/ueberdosis/tiptap) | 3.31.3 → 3.31.3 | 3.32.0 | `package.json` | Hold family at 3.31.3: upstream Markdown/input-rule regressions. | +| [@tiptap/extension-placeholder](https://github.com/ueberdosis/tiptap) | 3.31.3 → 3.31.3 | 3.32.0 | `package.json` | Hold family at 3.31.3: upstream Markdown/input-rule regressions. | +| [@tiptap/extension-table](https://github.com/ueberdosis/tiptap) | 3.31.3 → 3.31.3 | 3.32.0 | `package.json` | Hold family at 3.31.3: upstream Markdown/input-rule regressions. | +| [@tiptap/markdown](https://github.com/ueberdosis/tiptap) | 3.31.3 → 3.31.3 | 3.32.0 | `package.json` | Hold family at 3.31.3: upstream Markdown/input-rule regressions. | +| [@tiptap/pm](https://github.com/ueberdosis/tiptap) | 3.31.3 → 3.31.3 | 3.32.0 | `package.json` | Hold family at 3.31.3: upstream Markdown/input-rule regressions. | +| [@tiptap/react](https://github.com/ueberdosis/tiptap) | 3.31.3 → 3.31.3 | 3.32.0 | `package.json` | Hold family at 3.31.3: upstream Markdown/input-rule regressions. | +| [@tiptap/starter-kit](https://github.com/ueberdosis/tiptap) | 3.31.3 → 3.31.3 | 3.32.0 | `package.json` | Hold family at 3.31.3: upstream Markdown/input-rule regressions. | +| [@types/hast](https://github.com/DefinitelyTyped/DefinitelyTyped) | 3.0.5 → 3.0.5 | 3.0.5 | `package.json` | Retain: registry latest already selected. | +| [@types/markdown-it](https://github.com/DefinitelyTyped/DefinitelyTyped) | 14.1.2 → 14.1.2 | 14.2.0 | `mobile/package.json` | Hold: no required benefit established; retain current compatible release. | +| [@types/markdown-it-footnote](https://github.com/DefinitelyTyped/DefinitelyTyped) | 3.0.4 → 3.0.4 | 3.0.4 | `mobile/package.json` | Retain: registry latest already selected. | +| [@types/mdast](https://github.com/DefinitelyTyped/DefinitelyTyped) | 4.0.4 → 4.0.4 | 4.0.4 | `mobile/package.json`, `package.json` | Retain: registry latest already selected. | +| [@types/mdx](https://github.com/DefinitelyTyped/DefinitelyTyped) | 2.0.14 → 2.0.14 | 2.0.14 | `docs/site/package.json` | Retain: registry latest already selected. | +| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped) | 18.19.130, 24.19.2 → 18.19.130, 24.19.2 | 26.6.5 | `cloud/apps/push/package.json`, `cloud/apps/relay-fence-broker/package.json`, `cloud/apps/relay/package.json`, `cloud/package.json`, `cloud/packages/postgres-schema/package.json`, `cloud/packages/push-contract/package.json`, `cloud/packages/relay-contract/package.json`, `docs/site/package.json`, `package.json`, `src/packages/process-host/package.json` | Hold: match supported Node 24 runtime. | +| [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped) | 8.23.1 → 8.23.1 | 8.23.1 | `cloud/apps/push/package.json`, `cloud/apps/relay/package.json` | Retain: registry latest already selected. | +| [@types/proper-lockfile](https://github.com/DefinitelyTyped/DefinitelyTyped) | 4.1.4 → 4.1.4 | 4.1.4 | `package.json` | Retain: registry latest already selected. | +| [@types/qrcode](https://github.com/DefinitelyTyped/DefinitelyTyped) | 1.5.6 → 1.5.6 | 1.5.6 | `package.json` | Retain: registry latest already selected. | +| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped) | 19.2.18, ~19.2.18 → 19.2.18, ~19.2.18 | 19.3.0 | `docs/site/package.json`, `mobile/package.json`, `mobile/packages/expo-two-way-audio/package.json`, `package.json` | Hold with runtime React version. | +| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped) | 19.2.7 → 19.2.7 | 19.3.0 | `docs/site/package.json`, `package.json` | Hold with runtime React version. | +| [@types/react-test-renderer](https://github.com/DefinitelyTyped/DefinitelyTyped) | 19.1.0 → 19.1.0 | 19.3.0 | `mobile/package.json` | Hold with Expo/test-renderer version. | +| [@types/ssh2](https://github.com/DefinitelyTyped/DefinitelyTyped) | 1.15.6 → 1.15.6 | 1.15.6 | `package.json` | Retain: registry latest already selected. | +| [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped) | 8.18.1, 8.18.2 → 8.18.2 | 8.18.2 | `cloud/apps/relay/package.json`, `mobile/package.json`, `package.json` | Match fragmentation security option types; desktop/mobile parity. | +| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react) | 6.1.2 → 6.1.2 | 6.1.2 | `package.json` | Retain: registry latest already selected. | +| [@vscode/ripgrep-universal](https://github.com/microsoft/vscode-ripgrep) | 1.18.0 → 1.18.0 | 1.18.0 | `package.json` | Retain: registry latest already selected. | +| [@vscode/windows-process-tree](https://github.com/microsoft/vscode-windows-process-tree) | 0.8.0 → 0.8.0 | 0.8.0 | `package.json` | Retain: registry latest already selected. | +| [@xterm/addon-fit](https://github.com/xtermjs/xterm.js.git#master) | 0.12.0-beta.301 → 0.12.0-beta.301 | 0.11.0 | `package.json` | Retain: registry latest already selected. | +| [@xterm/addon-image](https://github.com/xtermjs/xterm.js.git#master) | 0.10.0-beta.301 → 0.10.0-beta.301 | 0.9.0 | `package.json` | Retain: registry latest already selected. | +| [@xterm/addon-ligatures](https://github.com/xtermjs/xterm.js.git#master) | 0.11.0-beta.301 → 0.11.0-beta.301 | 0.10.0 | `package.json` | Retain: registry latest already selected. | +| [@xterm/addon-search](https://github.com/xtermjs/xterm.js.git#master) | 0.17.0-beta.301 → 0.17.0-beta.301 | 0.16.0 | `package.json` | Retain: registry latest already selected. | +| [@xterm/addon-serialize](https://github.com/xtermjs/xterm.js.git#master) | 0.15.0-beta.301 → 0.15.0-beta.301 | 0.14.0 | `package.json` | Retain: registry latest already selected. | +| [@xterm/addon-unicode11](https://github.com/xtermjs/xterm.js.git#master) | 0.10.0-beta.301 → 0.10.0-beta.301 | 0.9.0 | `mobile/package.json`, `package.json` | Retain: registry latest already selected. | +| [@xterm/addon-web-links](https://github.com/xtermjs/xterm.js.git#master) | 0.13.0-beta.301 → 0.13.0-beta.301 | 0.12.0 | `package.json` | Retain: registry latest already selected. | +| [@xterm/addon-webgl](https://github.com/xtermjs/xterm.js.git#master) | 0.20.0-beta.300 → 0.20.0-beta.300 | 0.19.0 | `mobile/package.json`, `package.json` | Retain: registry latest already selected. | +| [@xterm/headless](https://github.com/xtermjs/xterm.js) | 6.1.0-beta.303 → 6.1.0-beta.303 | 6.0.0 | `package.json` | Retain: registry latest already selected. | +| [@xterm/xterm](https://github.com/xtermjs/xterm.js) | 6.1.0-beta.304 → 6.1.0-beta.304 | 6.0.0 | `mobile/package.json`, `package.json` | Retain: registry latest already selected. | +| [acorn](https://github.com/acornjs/acorn) | 8.18.0 → 8.18.0 | 8.19.0 | `mobile/package.json` | Hold: no required benefit established; retain current compatible release. | +| [agent-browser](https://github.com/vercel-labs/agent-browser) | 0.27.0 → 0.27.0 | 0.39.2 | `package.json` | Hold: daemon, policy and Windows regressions; coupled integration migration. | +| [buffer](https://github.com/feross/buffer) | 6.0.3 → 6.0.3 | 6.0.3 | `mobile/package.json` | Retain: registry latest already selected. | +| [bun](https://github.com/oven-sh/bun) | 1.4.3 → 1.4.4 | 1.4.4 | `package.json` | Main independently updated to 1.4.4 during review; preserve its explicit release-age exception. | +| [class-variance-authority](https://github.com/joe-bell/cva) | 0.7.1 → 0.7.1 | 0.7.1 | `package.json` | Retain: registry latest already selected. | +| [clsx](https://github.com/lukeed/clsx) | 2.1.1 → 2.1.1 | 2.1.1 | `docs/site/package.json`, `package.json` | Retain: registry latest already selected. | +| [cmdk](https://github.com/pacocoursey/cmdk) | 1.1.1 → 1.1.1 | 1.1.1 | `package.json` | Retain: registry latest already selected. | +| [devalue](https://github.com/sveltejs/devalue) | 6.0.2 → 6.0.3 | 6.0.3 | `package.json` | Escaping performance and explicit module types; Node worker transport tested. | +| [diff](https://github.com/kpdecker/jsdiff) | 8.0.4 → 8.0.4 | 9.0.0 | `package.json` | Hold: major API/toolchain migration; no required benefit established for this update. | +| [dompurify](https://github.com/cure53/DOMPurify) | 3.4.16 → 3.4.17 | 3.4.17 | `package.json` | Main/security PR select 3.4.17, including transitive copies. | +| [electron](https://github.com/electron/electron) | 43.7.8 → 43.8.1 | 45.0.0 | `package.json` | Security PR selects patched 43.8.1; defer Chromium/Node major upgrade. | +| [electron-builder](https://github.com/electron-userland/electron-builder) | 26.15.3 → 26.15.3 | 26.15.3 | `package.json` | Retain: registry latest already selected. | +| [electron-updater](https://github.com/electron-userland/electron-builder) | 6.8.10 → 6.8.10 | 6.8.9 | `package.json` | Retain: registry latest already selected. | +| [electron-vite](https://github.com/alex8088/electron-vite) | 6.0.0 → 6.0.0 | 6.0.0 | `package.json` | Retain: registry latest already selected. | +| [emoji-picker-react](https://github.com/ealush/emoji-picker-react) | 4.22.3 → 4.22.3 | 5.1.0 | `package.json` | Hold: major API/toolchain migration; no required benefit established for this update. | +| [emojibase-data](git@github.com:milesj/emojibase) | 17.0.0 → 17.0.0 | 18.0.0 | `package.json` | Hold: major API/toolchain migration; no required benefit established for this update. | +| [esbuild](https://github.com/evanw/esbuild) | 0.28.2 → 0.28.2 | 0.28.2 | `mobile/package.json`, `package.json` | Retain: registry latest already selected. | +| [expo](https://github.com/expo/expo) | *, 55.0.31 → *, 55.0.31 | 58.0.17 | `mobile/package.json`, `mobile/packages/expo-two-way-audio/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-build-properties](https://github.com/expo/expo) | 55.0.18 → 55.0.18 | 58.0.11 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-camera](https://github.com/expo/expo) | 55.0.23 → 55.0.23 | 58.0.12 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-clipboard](https://github.com/expo/expo) | 55.0.17 → 55.0.17 | 58.0.4 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-constants](https://github.com/expo/expo) | 55.0.17 → 55.0.17 | 58.0.13 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-crypto](https://github.com/expo/expo) | 55.0.19 → 55.0.19 | 58.0.7 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-dev-client](https://github.com/expo/expo) | 55.0.40 → 55.0.40 | 58.0.14 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-document-picker](https://github.com/expo/expo) | 55.0.17 → 55.0.17 | 58.0.4 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-file-system](https://github.com/expo/expo) | 55.0.26 → 55.0.26 | 58.0.10 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-haptics](https://github.com/expo/expo) | 55.0.18 → 55.0.18 | 58.0.7 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-image-picker](https://github.com/expo/expo) | 55.0.24 → 55.0.24 | 58.0.10 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-keep-awake](https://github.com/expo/expo) | 55.0.8 → 55.0.8 | 58.0.3 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-linking](https://github.com/expo/expo) | 55.0.17 → 55.0.17 | 58.0.14 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-module-scripts](https://github.com/expo/expo) | 55.0.2, ^55.0.2 → 55.0.2, ^55.0.2 | 56.0.3 | `mobile/package.json`, `mobile/packages/expo-two-way-audio/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-modules-core](https://github.com/expo/expo) | 55.0.26, ~55.0.26 → 55.0.26, ~55.0.26 | 58.0.24 | `mobile/package.json`, `mobile/packages/expo-two-way-audio/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-network](https://github.com/expo/expo) | 55.0.18 → 55.0.18 | 58.0.4 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-notifications](https://github.com/expo/expo) | 55.0.27 → 55.0.27 | 58.1.6 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-router](https://github.com/expo/expo) | 55.0.18 → 55.0.18 | 58.0.25 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-secure-store](https://github.com/expo/expo) | 55.0.18 → 55.0.18 | 58.0.2 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-splash-screen](https://github.com/expo/expo) | 55.0.25 → 55.0.25 | 58.0.11 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-status-bar](https://github.com/expo/expo) | 55.0.6 → 55.0.6 | 58.0.4 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [expo-task-manager](https://github.com/expo/expo) | 55.0.20 → 55.0.20 | 58.0.12 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [fflate](https://github.com/101arrowz/fflate) | 0.8.3 → 0.8.3 | 0.8.3 | `mobile/package.json`, `package.json` | Retain: registry latest already selected. | +| [fumadocs-core](https://github.com/fuma-nama/fumadocs) | 16.12.1 → 16.12.1 | 16.17.7 | `docs/site/package.json` | Hold: update docs core/UI/MDX together with search/navigation compatibility. | +| [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | 14.3.2 → 14.3.2 | 15.4.9 | `docs/site/package.json` | Hold: MDX major migration coordinated with Fumadocs. | +| [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | 16.12.1 → 16.12.1 | 16.17.7 | `docs/site/package.json` | Hold with Fumadocs core and MDX. | +| [google-auth-library](https://github.com/googleapis/google-cloud-node) | 11.3.1 → 11.3.1 | 11.3.1 | `cloud/apps/push/package.json` | Retain: registry latest already selected. | +| [happy-dom](https://github.com/capricorn86/happy-dom) | 20.14.5 → 20.14.6 | 21.0.4 | `mobile/package.json`, `package.json` | Security PR selects 20.14.6; defer v21 DOM behavior migration. | +| [hast-util-to-jsx-runtime](https://github.com/syntax-tree/hast-util-to-jsx-runtime) | 2.3.6 → 2.3.6 | 2.3.6 | `package.json` | Retain: registry latest already selected. | +| [hono](https://github.com/honojs/hono) | 4.13.13 → 4.13.13 | 4.13.13 | `cloud/apps/push/package.json`, `cloud/apps/relay-fence-broker/package.json`, `cloud/apps/relay/package.json` | Retain: registry latest already selected. | +| [html-to-image](https://github.com/bubkoo/html-to-image) | 1.11.13 → 1.11.13 | 1.11.13 | `package.json` | Retain: registry latest already selected. | +| [husky](https://github.com/typicode/husky) | 9.1.7 → 9.1.7 | 9.1.7 | `package.json` | Retain: registry latest already selected. | +| [i18next](https://github.com/i18next/i18next) | 26.4.2 → 26.4.2 | 26.5.6 | `package.json` | Hold: interpolation and resource-store behavior changes; localization needs focused review. | +| [i18next-cli](https://github.com/i18next/i18next-cli) | 1.74.2 → 1.74.2 | 1.80.0 | `package.json` | Hold: locally patched extraction tool; rebase patch and localization gates separately. | +| [jose](https://github.com/panva/jose) | 6.2.12 → 6.2.13 | 6.2.13 | `cloud/apps/relay/package.json` | Preserve provider failure causes for token verification. | +| [jsonc-parser](https://github.com/microsoft/node-jsonc-parser) | 3.3.1 → 3.3.1 | 3.3.1 | `package.json` | Retain: registry latest already selected. | +| [katex](https://github.com/KaTeX/KaTeX) | 0.18.10 → 0.18.10 | 0.19.0 | `package.json` | Hold: major API/toolchain migration; no required benefit established for this update. | +| [knip](https://github.com/webpro-nl/knip) | 5.88.1 → 5.88.1 | 6.42.1 | `config/audit-tools/package.json` | Hold: v6 dead-code analysis migration needs separate rule/baseline review. | +| [lint-staged](https://github.com/lint-staged/lint-staged) | 16.4.0 → 16.4.0 | 17.6.0 | `package.json` | Hold: locally patched major upgrade requires hook compatibility validation. | +| [lowlight](https://github.com/wooorm/lowlight) | 3.3.0 → 3.3.0 | 3.3.0 | `mobile/package.json`, `package.json` | Retain: registry latest already selected. | +| [lucide-react](https://github.com/lucide-icons/lucide) | 0.577.0, 1.26.0 → 0.577.0, 1.26.0 | 1.61.0 | `docs/site/package.json`, `package.json` | Hold: major API/toolchain migration; no required benefit established for this update. | +| [lucide-react-native](https://github.com/lucide-icons/lucide) | 1.14.0 → 1.14.0 | 1.61.0 | `mobile/package.json` | Hold: icon additions do not justify changing native icon family. | +| [markdown-it](https://github.com/markdown-it/markdown-it) | 14.3.3 → 14.3.3 | 15.0.3 | `mobile/package.json` | Hold: major API/toolchain migration; no required benefit established for this update. | +| [markdown-it-footnote](https://github.com/markdown-it/markdown-it-footnote) | 4.0.0 → 4.0.0 | 4.0.0 | `mobile/package.json` | Retain: registry latest already selected. | +| [marked](https://github.com/markedjs/marked) | 17.0.6 → 17.0.6 | 18.1.1 | `package.json` | Hold: major API/toolchain migration; no required benefit established for this update. | +| [mermaid](https://github.com/mermaid-js/mermaid) | 11.17.2 → 11.17.2 | 12.2.0 | `mobile/package.json`, `package.json` | Hold: major API/toolchain migration; no required benefit established for this update. | +| [monaco-editor](https://github.com/microsoft/monaco-editor) | 0.55.1 → 0.55.1 | 0.57.0 | `package.json` | Hold: local patch and editor integration require migration validation. | +| [next](https://github.com/vercel/next.js) | 16.3.8 → 16.4.2 | 16.4.2 | `docs/site/package.json` | Security PR selects 16.4.2; keep framework changes in security review. | +| [node-addon-api](https://github.com/nodejs/node-addon-api) | 8.9.2 → 8.9.2 | 8.9.2 | `native/windows-registry/package.json`, `native/windows-security/package.json` | Retain: registry latest already selected. | +| [node-gyp](https://github.com/nodejs/node-gyp) | 12.3.0 → 12.3.0 | 13.1.0 | `package.json` | Hold: major native toolchain migration requires packaging on all supported OSes. | +| [node-pty](https://github.com/microsoft/node-pty) | 1.1.0 → 1.1.0 | 1.1.0 | `package.json` | Retain: registry latest already selected. | +| [oxfmt](https://github.com/oxc-project/oxc) | 0.73.0 → 0.74.0 | 0.74.0 | `mobile/package.json`, `package.json` | Import comments and Markdown/YAML correctness; desktop/mobile parity. | +| [oxlint](https://github.com/oxc-project/oxc) | 1.88.0 → 1.88.0 | 1.89.0 | `docs/site/package.json`, `mobile/package.json`, `package.json` | Hold: new recommended rules/AST changes need paired plugin and baseline review. | +| `oxlint-plugin-anti-slop` | https://codeload.github.com/dmmulroy/anti-slop/tar.gz/c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b → https://codeload.github.com/dmmulroy/anti-slop/tar.gz/c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b | 0.0.0 | `package.json` | Retain immutable Git commit; local lint integration. | +| [oxlint-plugin-react-doctor](https://github.com/millionco/react-doctor) | 0.9.14 → 0.9.14 | 0.9.18 | `package.json` | Hold: real changed-line smoke could not validate findings on current or candidate versions. | +| [oxlint-tsgolint](https://github.com/oxc-project/tsgolint) | 7.0.2004 → 7.0.2004 | 7.0.2005 | `package.json` | Hold: pinned type-aware lint toolchain is coordinated with Oxlint. | +| [pdfjs-dist](https://github.com/mozilla/pdf.js) | 6.3.289 → 6.3.289 | 6.4.299 | `package.json` | Hold: text/font/rendering changes and reported regressions need PDF browser fixtures. | +| [pg](https://github.com/brianc/node-postgres) | 8.23.1 → 8.23.1 | 8.23.1 | `cloud/apps/push/package.json`, `cloud/apps/relay/package.json` | Retain: registry latest already selected. | +| [pg-connection-string](https://github.com/brianc/node-postgres) | 2.14.1 → 2.14.1 | 2.14.1 | `cloud/apps/push/package.json` | Retain: registry latest already selected. | +| [playwright-core](https://github.com/microsoft/playwright) | 1.64.0 → 1.64.1 | 1.64.1 | `package.json` | Align browser automation at 1.64.1. | +| [pngjs](https://github.com/pngjs/pngjs) | 7.0.0 → 7.0.0 | 7.0.0 | `package.json` | Retain: registry latest already selected. | +| [posthog-node](https://github.com/PostHog/posthog-js) | 5.52.5 → 5.52.5 | 5.57.0 | `package.json` | Hold: analytics behavior changes provide no demonstrated benefit to current capture path. | +| [proper-lockfile](ssh://git@github.com/moxystudio/node-proper-lockfile) | 4.1.2 → 4.1.2 | 4.1.2 | `package.json`, `src/packages/process-host/package.json` | Retain: registry latest already selected. | +| [qrcode](https://github.com/soldair/node-qrcode) | 1.5.4 → 1.5.4 | 1.5.4 | `package.json` | Retain: registry latest already selected. | +| [radix-ui](https://github.com/radix-ui/primitives) | 1.6.7 → 1.6.7 | 1.8.1 | `package.json` | Hold: focus/dismissal/stacked-dialog regressions need full desktop UI validation. | +| [react](https://github.com/react/react) | *, 19.2.8 → *, 19.2.8 | 19.3.1 | `docs/site/package.json`, `mobile/package.json`, `mobile/packages/expo-two-way-audio/package.json`, `package.json` | Hold: retain Expo/test-renderer family alignment; 19.2.9 benefit concerns RSC. | +| [react-colorful](https://github.com/omgovich/react-colorful) | 5.7.0 → 5.7.0 | 5.8.1 | `package.json` | Hold: Shadow DOM support is not used here. | +| [react-doctor](https://github.com/millionco/react-doctor) | 0.9.14 → 0.9.14 | 0.9.18 | `config/audit-tools/package.json` | Hold with plugin; real smoke fails on both baseline and candidate. | +| [react-dom](https://github.com/react/react) | 19.2.8 → 19.2.8 | 19.3.1 | `docs/site/package.json`, `mobile/package.json`, `package.json` | Hold with React/Expo family. | +| [react-grab](https://github.com/aidenybai/react-grab) | 0.1.34 → 0.1.34 | 0.2.0 | `package.json` | Hold: 0.2 removes style tools; prior patch line needs integration-specific review. | +| [react-i18next](https://github.com/i18next/react-i18next) | 17.0.15 → 17.0.15 | 17.1.3 | `package.json` | Hold with i18next; recent release and coordinated localization validation. | +| [react-markdown](https://github.com/remarkjs/react-markdown) | 10.1.0 → 10.1.0 | 10.1.0 | `package.json` | Retain: registry latest already selected. | +| [react-native](https://github.com/react/react-native) | *, 0.83.10 → *, 0.83.10 | 0.88.0 | `mobile/package.json`, `mobile/packages/expo-two-way-audio/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [react-native-gesture-handler](https://github.com/software-mansion/react-native-gesture-handler) | 2.31.2 → 2.31.2 | 3.4.0 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [react-native-libsodium](https://github.com/serenity-kit/react-native-libsodium) | 1.7.0 → 1.7.0 | 1.7.0 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [react-native-reanimated](https://github.com/software-mansion/react-native-reanimated) | 4.3.4 → 4.3.4 | 4.7.1 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [react-native-safe-area-context](https://github.com/appandflow/react-native-safe-area-context) | 5.7.0 → 5.7.0 | 5.10.1 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [react-native-screens](https://github.com/software-mansion/react-native-screens) | 4.24.0 → 4.24.0 | 4.30.0 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [react-native-svg](https://github.com/software-mansion/react-native-svg) | 15.15.5 → 15.15.5 | 15.16.0 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [react-native-web](https://github.com/necolas/react-native-web) | 0.21.3 → 0.21.3 | 0.21.4 | `mobile/package.json` | Hold with Expo: AssetRegistry changes have no identified current need. | +| [react-native-webview](https://github.com/react-native-webview/react-native-webview) | 13.16.2 → 13.16.2 | 14.0.1 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [react-native-worklets](https://github.com/software-mansion/react-native-reanimated) | 0.8.3 → 0.8.3 | 0.13.0 | `mobile/package.json` | Hold with Expo SDK/native dependency matrix and local patches; device builds required. | +| [react-test-renderer](https://github.com/react/react) | 19.2.8 → 19.2.8 | 19.3.1 | `mobile/package.json` | Hold with Expo/runtime React version. | +| [rehype-highlight](https://github.com/rehypejs/rehype-highlight) | 7.0.2 → 7.0.2 | 7.0.2 | `package.json` | Retain: registry latest already selected. | +| [rehype-katex](https://github.com/remarkjs/remark-math.git#main) | 7.0.1 → 7.0.1 | 7.0.1 | `package.json` | Retain: registry latest already selected. | +| [rehype-raw](https://github.com/rehypejs/rehype-raw) | 7.0.0 → 7.0.0 | 7.0.0 | `package.json` | Retain: registry latest already selected. | +| [rehype-sanitize](https://github.com/rehypejs/rehype-sanitize) | 6.0.0 → 6.0.0 | 6.0.0 | `package.json` | Retain: registry latest already selected. | +| [rehype-slug](https://github.com/rehypejs/rehype-slug) | 6.0.0 → 6.0.0 | 6.0.0 | `package.json` | Retain: registry latest already selected. | +| [remark-breaks](https://github.com/remarkjs/remark-breaks) | 4.0.0 → 4.0.0 | 4.0.0 | `package.json` | Retain: registry latest already selected. | +| [remark-cjk-friendly](https://github.com/tats-u/markdown-cjk-friendly) | 2.3.1 → 2.3.1 | 2.3.3 | `package.json` | Hold: serialization/dependency changes; current shared Markdown behavior already covered. | +| [remark-frontmatter](https://github.com/remarkjs/remark-frontmatter) | 5.0.0 → 5.0.0 | 5.0.0 | `package.json` | Retain: registry latest already selected. | +| [remark-gfm](https://github.com/remarkjs/remark-gfm) | 4.0.1 → 4.0.1 | 4.0.1 | `package.json` | Retain: registry latest already selected. | +| [remark-math](https://github.com/remarkjs/remark-math.git#main) | 6.0.0 → 6.0.0 | 6.0.0 | `package.json` | Retain: registry latest already selected. | +| [remark-parse](https://github.com/remarkjs/remark.git#main) | 11.0.0 → 11.0.0 | 11.0.0 | `package.json` | Retain: registry latest already selected. | +| [remark-rehype](https://github.com/remarkjs/remark-rehype) | 11.1.2 → 11.1.2 | 11.1.2 | `package.json` | Retain: registry latest already selected. | +| [remend](https://github.com/vercel/streamdown) | 1.4.0 → 1.4.0 | 1.4.0 | `mobile/package.json`, `package.json` | Retain: registry latest already selected. | +| [serve-sim](https://github.com/EvanBacon/serve-sim) | 0.1.47 → 0.1.47 | 0.1.48 | `package.json` | Hold: release younger than the three-day policy at review cutoff. | +| [sherpa-onnx-darwin-arm64](https://github.com/csukuangfj/sherpa-onnx) | 1.12.37 → 1.12.37 | 1.13.8 | `package.json` | Hold native binary family: speech/model validation and cross-platform packaging required. | +| [sherpa-onnx-darwin-x64](https://github.com/csukuangfj/sherpa-onnx) | 1.12.37 → 1.12.37 | 1.13.8 | `package.json` | Hold native binary family: speech/model validation and cross-platform packaging required. | +| [sherpa-onnx-linux-arm64](https://github.com/csukuangfj/sherpa-onnx) | 1.12.37 → 1.12.37 | 1.13.8 | `package.json` | Hold native binary family: speech/model validation and cross-platform packaging required. | +| [sherpa-onnx-linux-x64](https://github.com/csukuangfj/sherpa-onnx) | 1.12.37 → 1.12.37 | 1.13.8 | `package.json` | Hold native binary family: speech/model validation and cross-platform packaging required. | +| [sherpa-onnx-win-x64](https://github.com/csukuangfj/sherpa-onnx) | 1.12.37 → 1.12.37 | 1.13.8 | `package.json` | Hold native binary family: speech/model validation and cross-platform packaging required. | +| [shiki](https://github.com/shikijs/shiki) | 4.5.0 → 4.5.0 | 4.5.0 | `package.json` | Retain: registry latest already selected. | +| [smol-toml](https://github.com/squirrelchat/smol-toml) | 1.9.1 → 1.9.1 | 1.9.1 | `package.json` | Retain: registry latest already selected. | +| [sonner](https://github.com/emilkowalski/sonner) | 2.0.7 → 2.0.7 | 2.0.8 | `package.json` | Hold: latest younger than the three-day release-age policy. | +| [ssh2](ssh://git@github.com/mscdex/ssh2) | 1.17.0 → 1.17.0 | 1.17.0 | `package.json` | Retain: registry latest already selected. | +| [stream-chain](https://github.com/uhop/stream-chain) | 4.2.6 → 4.2.6 | 4.2.6 | `package.json` | Retain: registry latest already selected. | +| [stream-json](https://github.com/uhop/stream-json) | 3.7.0 → 3.7.0 | 3.7.0 | `package.json` | Retain: registry latest already selected. | +| [tailwind-merge](https://github.com/dcastil/tailwind-merge) | 3.7.0 → 3.7.0 | 3.7.0 | `docs/site/package.json`, `package.json` | Retain: registry latest already selected. | +| [tailwindcss](https://github.com/tailwindlabs/tailwindcss) | 4.3.3 → 4.3.3 | 4.3.3 | `docs/site/package.json`, `package.json` | Retain: registry latest already selected. | +| [tar](https://github.com/isaacs/node-tar) | 7.5.22 → 7.5.22 | 7.5.22 | `package.json` | Retain: registry latest already selected. | +| [tldts](ssh://git@github.com/remusao/tldts) | 7.4.16 → 7.4.18 | 7.4.19 | `package.json` | Refresh public suffix data used for cookie family boundaries. | +| [tsrs](https://github.com/oxc-project/tsrs) | 0.16.0-ts7.1.0-dev.20260929 → 0.18.0-ts7.1.0-dev.20260929 | 0.18.0-ts7.1.0-dev.20260929 | `package.json` | Main independently updated to 0.18 during review; no additional compiler migration. | +| [tsx](https://github.com/privatenumber/tsx) | 4.23.15 → 4.23.15 | 4.23.15 | `cloud/apps/push/package.json`, `cloud/apps/relay-fence-broker/package.json`, `cloud/apps/relay/package.json`, `cloud/package.json`, `mobile/package.json`, `src/packages/process-host/package.json` | Retain: registry latest already selected. | +| [tw-animate-css](https://github.com/Wombosvideo/tw-animate-css) | 1.4.0 → 1.4.0 | 1.4.0 | `docs/site/package.json`, `package.json` | Retain: registry latest already selected. | +| [tweetnacl](https://github.com/dchest/tweetnacl-js) | 1.0.3 → 1.0.3 | 1.0.3 | `cloud/apps/push/package.json`, `cloud/apps/relay/package.json`, `mobile/package.json`, `package.json` | Retain: registry latest already selected. | +| [typescript](https://github.com/microsoft/TypeScript) | 5.9.3, 6.0.3, 7.0.2 → 5.9.3, 6.0.3, 7.0.2 | 7.0.2 | `cloud/apps/push/package.json`, `cloud/apps/relay-fence-broker/package.json`, `cloud/apps/relay/package.json`, `cloud/package.json`, `cloud/packages/postgres-schema/package.json`, `cloud/packages/push-contract/package.json`, `cloud/packages/relay-contract/package.json`, `docs/site/package.json`, `mobile/package.json`, `package.json`, `src/packages/process-host/package.json` | Hold: major API/toolchain migration; no required benefit established for this update. | +| [typescript-api](https://github.com/jedmao/typescript-api) | typescript@6.0.3 → typescript@6.0.3 | 1.0.0 | `cloud/apps/relay/package.json`, `package.json` | Retain: registry latest already selected. | +| [unified](https://github.com/unifiedjs/unified) | 11.0.5 → 11.0.5 | 11.0.5 | `package.json` | Retain: registry latest already selected. | +| [vercel](https://github.com/vercel/vercel) | 64.0.2 → 64.0.2 | 65.2.0 | `docs/site/package.json` | Hold: major API/toolchain migration; no required benefit established for this update. | +| [vite](https://github.com/vitejs/vite) | 8.3.4 → 8.3.4 | 8.3.5 | `mobile/package.json`, `package.json` | Hold: latest younger than the three-day release-age policy. | +| [vitest](https://github.com/vitest-dev/vitest) | 4.1.12, 5.0.5 → 4.1.12, 5.0.5 | 5.0.5 | `cloud/apps/push/package.json`, `cloud/apps/relay-fence-broker/package.json`, `cloud/apps/relay/package.json`, `cloud/package.json`, `cloud/packages/postgres-schema/package.json`, `cloud/packages/push-contract/package.json`, `cloud/packages/relay-contract/package.json`, `mobile/package.json`, `package.json`, `src/packages/process-host/package.json` | Hold mobile at v4; v5 needs separate native test-pool migration (desktop already v5). | +| [vscode-oniguruma](https://github.com/microsoft/vscode-oniguruma) | 2.0.1 → 2.0.1 | 2.0.1 | `package.json` | Retain: registry latest already selected. | +| [ws](https://github.com/websockets/ws) | 8.22.0 → 8.22.0 | 8.22.0 | `cloud/apps/relay/package.json`, `mobile/package.json`, `package.json` | Retain: registry latest already selected. | +| [yaml](https://github.com/eemeli/yaml) | 2.9.1 → 2.9.1 | 2.9.1 | `package.json` | Retain: registry latest already selected. | +| [zod](https://github.com/colinhacks/zod) | 4.4.3, 4.6.7 → 4.4.3, 4.6.7 | 4.6.7 | `cloud/apps/push/package.json`, `cloud/apps/relay-fence-broker/package.json`, `cloud/apps/relay/package.json`, `cloud/packages/push-contract/package.json`, `cloud/packages/relay-contract/package.json`, `docs/site/package.json`, `mobile/package.json`, `package.json` | Hold: schema/JSON-schema semantics and upstream credential incident require a focused migration. | +| [zustand](https://github.com/pmndrs/zustand) | 5.0.15 → 5.0.15 | 5.0.16 | `package.json` | Hold: latest younger than the three-day release-age policy. | diff --git a/mobile/package.json b/mobile/package.json index fb0412fe621..d69f9ff97bc 100644 --- a/mobile/package.json +++ b/mobile/package.json @@ -80,12 +80,12 @@ "@types/mdast": "^4.0.4", "@types/react": "~19.2.18", "@types/react-test-renderer": "19.1.0", - "@types/ws": "^8.18.1", + "@types/ws": "^8.18.2", "acorn": "8.18.0", "esbuild": "0.28.2", "expo-module-scripts": "^55.0.2", "happy-dom": "^20.14.6", - "oxfmt": "^0.73.0", + "oxfmt": "^0.74.0", "oxlint": "^1.88.0", "react-test-renderer": "19.2.8", "tsx": "^4.23.15", diff --git a/mobile/pnpm-lock.yaml b/mobile/pnpm-lock.yaml index 319260a54ce..1d8e557c264 100644 --- a/mobile/pnpm-lock.yaml +++ b/mobile/pnpm-lock.yaml @@ -354,8 +354,8 @@ importers: specifier: 19.1.0 version: 19.1.0 '@types/ws': - specifier: ^8.18.1 - version: 8.18.1 + specifier: ^8.18.2 + version: 8.18.2 acorn: specifier: 8.18.0 version: 8.18.0 @@ -369,8 +369,8 @@ importers: specifier: ^20.14.6 version: 20.14.6 oxfmt: - specifier: ^0.73.0 - version: 0.73.0 + specifier: ^0.74.0 + version: 0.74.0 oxlint: specifier: ^1.88.0 version: 1.88.0 @@ -1977,124 +1977,124 @@ packages: '@oxc-project/types@0.153.0': resolution: {integrity: sha512-jSNrRIyvPVLL5E1z/tS5zLAprosGz/FuI1PWwEOz59j3E4TTTzSpqKb/RDGqJhhW0QHYISGXxq582wGx6T11Tw==} - '@oxfmt/binding-android-arm-eabi@0.73.0': - resolution: {integrity: sha512-dhunAdMbi/4o0Y66/+Wl6rpsNqpvE4i26Qw6bB77A97L2lJoktWg6m+X9QOon8iOEEqzD9rEZqFi5uZ4oIzhCA==} + '@oxfmt/binding-android-arm-eabi@0.74.0': + resolution: {integrity: sha512-xxQwrf5EPI5zxvuCTW8r6tzCTjPQ+h6+HqJ0iRKRy2zS1yBllt/xLVjoIyUc+FnR7g0a5g1SZv2yyDYhTItLbA==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm] os: [android] - '@oxfmt/binding-android-arm64@0.73.0': - resolution: {integrity: sha512-dBoypjC2/xeyKyIhN2waX0/XeoccH9k0lVVe+sGRc4X8HSJVRtqyZDoXdr7bGY9A75c51dX0z0dLDpGQKwCdCg==} + '@oxfmt/binding-android-arm64@0.74.0': + resolution: {integrity: sha512-FJW3sATVvrWbV64al8xofCPZj4500Z/1W0ad7Tg1rcCUyh0EMbuSrsf3jsZS7CEbwQ5fQ0mRhmkc129GFgofSQ==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [android] - '@oxfmt/binding-darwin-arm64@0.73.0': - resolution: {integrity: sha512-Tn7Y+qWIpCQK+qdYwBcn6YvqeBuPiuG3tcNlYg16a5QL2o3rSmrgBB1nCyYqo0uvc1LNrfQW9/CK2tzFuID/Fg==} + '@oxfmt/binding-darwin-arm64@0.74.0': + resolution: {integrity: sha512-TfmNKBD30dGyMu9GCLiaw2rt/z7fms9LS+5cKcNOyWst0QgAs8oZs6wPxMbVaaDVE0/PCdCosgWM1vbu6f5NUg==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [darwin] - '@oxfmt/binding-darwin-x64@0.73.0': - resolution: {integrity: sha512-yVb0E0tg/+9Xc9YJCBq66qF1DC/aN5mhb5nnHz0k4ikwkMANtSul2VPDSwjYdXR6/DFimc+pPUgLBqkIa5Ctuw==} + '@oxfmt/binding-darwin-x64@0.74.0': + resolution: {integrity: sha512-5Usf8+DfC4Q3o/MD8FkN47GrI6y0KbhQ4KhZ2HGzMZcXjcW1AeldwbUn51aKih+1TVuJFF9qkNm6X1nzm6NYng==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [darwin] - '@oxfmt/binding-freebsd-x64@0.73.0': - resolution: {integrity: sha512-IKR4lFnBkYNL9Uqdxa5GMTQLvnLj+3sDwTvh2atHCzah0xeo+1xR5bigRU8uyXlOsA4VpXUn0UAimq4E4RBGmQ==} + '@oxfmt/binding-freebsd-x64@0.74.0': + resolution: {integrity: sha512-eL+1O3gykw1XihbZh2MRAciQvU2988LByrnjhyo/dmNG74X4oZ7XzigRoWPRFLfJCp8hzRkp/LbEhwe7uuT2eA==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [freebsd] - '@oxfmt/binding-linux-arm-gnueabihf@0.73.0': - resolution: {integrity: sha512-7qnZ4g0ZCO3aZevOOQpZIABYwwXJW1lLDo2elviGdPQ0i11255xKEMFsi97fC1/nauQFseCJfELUy/k2JoOP+g==} + '@oxfmt/binding-linux-arm-gnueabihf@0.74.0': + resolution: {integrity: sha512-Xt0QtO2hJ4stnul8IL4LJGVLyp0xnc6ccN9fZ30yuubv8FWSRYxWwd1Za62KsEqAfmPSazoS/cLSUUJpja6npA==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm] os: [linux] - '@oxfmt/binding-linux-arm-musleabihf@0.73.0': - resolution: {integrity: sha512-36eBico2j/WPB84gb4FYd/jjqGCKOwU4M+TWLBUIqlnzTozQueLy0joA5BwsSp2OZFVkOlpCwvA3ndPamdiyLw==} + '@oxfmt/binding-linux-arm-musleabihf@0.74.0': + resolution: {integrity: sha512-/4wYQ0gZl4vUR0QoBTGaay73FmQ1GAjUa9z9101TR2xbGNrg4a+grazlR0yzEOe3/E+PJr5BGfj66MMzm/54vg==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm] os: [linux] - '@oxfmt/binding-linux-arm64-gnu@0.73.0': - resolution: {integrity: sha512-VZ3cSgCAT18knKo52DcACmAuIoqG6qVEyeZRFbJd0xmYQ8GyYjuBc6IAh6MZHijT6q7p4/HPI+6ZWsCuhdV6iw==} + '@oxfmt/binding-linux-arm64-gnu@0.74.0': + resolution: {integrity: sha512-846bKzF+HJd+JkOFh3rxzmYvSq4Cm+GMT+p+mW7S13ZYo6GAAGv8bL8cAOi/XcdeMqxEJDCIMTVQLVBXHMCdig==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [linux] libc: [glibc] - '@oxfmt/binding-linux-arm64-musl@0.73.0': - resolution: {integrity: sha512-8YVzH59XSHcqwXNgc5qK851zCqwpmBgOifARXEPPe5/xTsIbHceYoPZAyqfpYV0CfKmzSaEDBgYHFza4rhx+Zw==} + '@oxfmt/binding-linux-arm64-musl@0.74.0': + resolution: {integrity: sha512-nI5FJwZ4Flo6CBdscpwxymZXxO3m3IErQJX55ZS6h+ObfGXu8FostL85L/RWPFaCLnIVE4/WfLw+2q8XvVEeUA==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [linux] libc: [musl] - '@oxfmt/binding-linux-ppc64-gnu@0.73.0': - resolution: {integrity: sha512-MqRJnmCys0rwOgpWyEidSA7v/bvOqfNDJhPkQoR9mPVYrvSmMaW2Xhdpl28cbTA+brOM1is62GjIvJplVlUVpw==} + '@oxfmt/binding-linux-ppc64-gnu@0.74.0': + resolution: {integrity: sha512-BoQYKuqUdsKAFAkK6DLBvkdv4+t0hppSm79sB0wIcE2o/eOwNj+6Z3OlKY4q3Eta/tlssP65FaS9vHn8TeF7vQ==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [ppc64] os: [linux] libc: [glibc] - '@oxfmt/binding-linux-riscv64-gnu@0.73.0': - resolution: {integrity: sha512-4t2F3SWJSK/O/kRRFnL0elJzn75fJGGu71gs1HtiWcS80SmJOpkHiwwLnTp9suGdns8VHEPxYS0GTcyVwHKWBA==} + '@oxfmt/binding-linux-riscv64-gnu@0.74.0': + resolution: {integrity: sha512-FSroRrM12+jCdSQklF9aOxsKpI6wFs4ZCo/1cSYG80RWZS6z4LV+l9tXRMT8lDGu+yohIZBwi9M76FzGPFDE2A==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [riscv64] os: [linux] libc: [glibc] - '@oxfmt/binding-linux-riscv64-musl@0.73.0': - resolution: {integrity: sha512-D8b4I8I1kLdJQFwdFXNV+cwh3xWSiNKofjdGUk0nDpc0AHOds8T+poGbP9RWQMvgsvMb9OMgp/aV7ahBR37TbQ==} + '@oxfmt/binding-linux-riscv64-musl@0.74.0': + resolution: {integrity: sha512-0VLQD0dhGBLY9Ik/w+otMvD81D0YXi4VDwql65macV+O9UzmSWmUr6CKf+dMtysDeC0PnG3y6kBkRO08BJx52g==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [riscv64] os: [linux] libc: [musl] - '@oxfmt/binding-linux-s390x-gnu@0.73.0': - resolution: {integrity: sha512-QrC1S5VL1+N5rvorB15jH7CPvjVHA7GyUI5oVEd8Bd9m5605RDBQYTxDQ920DuylRoZOh2V7/xXpfCtFUrojUQ==} + '@oxfmt/binding-linux-s390x-gnu@0.74.0': + resolution: {integrity: sha512-6X7BbZNz34+OHM6Oqjf6TRcUyRn6aRcB4VtIDZAF/uQRyeVhg+G2hv6MlMvmnRekVSyTJ/8rG/u8W2dRFW6glg==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [s390x] os: [linux] libc: [glibc] - '@oxfmt/binding-linux-x64-gnu@0.73.0': - resolution: {integrity: sha512-dFcUKQPltCEPa+YlkF3zqufn6nJPZdG73LpnjBvZFFsU3laCMssDXSYB99mVaj43FqdEgjpz5TO6gbYXcczd9g==} + '@oxfmt/binding-linux-x64-gnu@0.74.0': + resolution: {integrity: sha512-4kYIQK53yJXrxwxSzx8H2bojlf6/KezLGYLRXzV9QCCkoiCsvBTCid9Bg83dUPTLPa3g9K0730f6MKDbck1+OA==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [linux] libc: [glibc] - '@oxfmt/binding-linux-x64-musl@0.73.0': - resolution: {integrity: sha512-LmQe+nV8e+eUwfPNCxDF+owbsg88toBiR/8rZRgVOeKQP3MaGefXZRvBoc1UG37iWEQ/9JlCXG9Mc4nf4N3agw==} + '@oxfmt/binding-linux-x64-musl@0.74.0': + resolution: {integrity: sha512-MfWz4wDREjp/JQDmuxtKieix4FHGa1z5rBvB3betdcPwZvf5fqeQrlCm1mmoyuUVQOh9Pt3M61HwN94kJCxw7Q==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [linux] libc: [musl] - '@oxfmt/binding-openharmony-arm64@0.73.0': - resolution: {integrity: sha512-8weOr1OKknE0G2DbR6ejJUT9AOsoBU6cXlsetmbihHv1K+bK7qP61T6lJxY0k/aAO7GyOJiRGNlL+04r4eH8Xg==} + '@oxfmt/binding-openharmony-arm64@0.74.0': + resolution: {integrity: sha512-6rmAApkq5s1kbDjvNI6Nl5A+JqQkLORb2sR941pf5HWsrd01WGKyagK/B4vX9+kh1FfvRkNgEu59FHvVk4H8cQ==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [openharmony] - '@oxfmt/binding-win32-arm64-msvc@0.73.0': - resolution: {integrity: sha512-mZV+QxXYgb8E18gzAFItb937VIsE4dqWdStrD3tRRC52UubOYEuU+e7NaIqUsGdB5YsJqNeuck3Ue/af2r9wyA==} + '@oxfmt/binding-win32-arm64-msvc@0.74.0': + resolution: {integrity: sha512-+5SpRUnZNGeXTyumHnpHa791tQtt04qZs076WT8eTcGF2OJ631VLnf7S0kQSPuDG+PtJM0phadEB2WAr5n1w9g==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [win32] - '@oxfmt/binding-win32-ia32-msvc@0.73.0': - resolution: {integrity: sha512-QJPUsbgUb97ZPPMkFUq6VQq0fLhC4Np19KL9aB/qKVwXnpKE6MIiILXqzhKnQ/UbnEDjKJ7Xv1d6zH4bYPCUdQ==} + '@oxfmt/binding-win32-ia32-msvc@0.74.0': + resolution: {integrity: sha512-1Fg+wYBO3Dsti1QX+/6EYHjeQzLC84tLOAqPu/r7ah3UJlUs9C/DB703Ay9Vcg+8VMzqZA2P5VGhzJraVUD4OQ==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [ia32] os: [win32] - '@oxfmt/binding-win32-x64-msvc@0.73.0': - resolution: {integrity: sha512-cGcze2fu+ykIaFtkEvZlkZ3HvnCLk+WISthtq99zWTWn0x13t5L9TxvGdLZMUMvtfYR+ICkiCwKnguVubdcw0w==} + '@oxfmt/binding-win32-x64-msvc@0.74.0': + resolution: {integrity: sha512-y9jXUgPBm2TZIWbQhMYRRYAQM57+r4fbykgc+j24ICIIZl+pcuoNhnq1CRGm3oFiHnEUnZO00qOtSPGQdJ2ziQ==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [win32] @@ -2921,9 +2921,6 @@ packages: '@types/mdurl@2.0.0': resolution: {integrity: sha512-RGdgjQUZba5p6QEFAVx2OGb8rQDL/cPRG7GiedRzMcJ1tYnUANBncjbSB1NRGwbvjcPeikRABz2nshyPk1bhWg==} - '@types/node@25.6.0': - resolution: {integrity: sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==} - '@types/node@26.6.2': resolution: {integrity: sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==} @@ -2948,8 +2945,8 @@ packages: '@types/whatwg-mimetype@3.0.2': resolution: {integrity: sha512-c2AKvDT8ToxLIOUlN51gTiHXflsfIFisS4pO7pDPoKouJCESkhZnEy623gwP9laCy5lnLDAw1vAzu2vM2YLOrA==} - '@types/ws@8.18.1': - resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==} + '@types/ws@8.18.2': + resolution: {integrity: sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==} '@types/yargs-parser@21.0.3': resolution: {integrity: sha512-I4q9QU9MQv4oEOz4tAHJtNz1cwuLxn2F3xcc2iV5WdqLPpUnj30aUuxt1mAxYTG+oe8CZMV/+6rU4S4gRDzqtQ==} @@ -5954,8 +5951,8 @@ packages: resolution: {integrity: sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg==} engines: {node: '>= 0.4'} - oxfmt@0.73.0: - resolution: {integrity: sha512-Ke4xbpuzqIBP4bkd48q815RhqWNJqOBzxVA9199M4qcF0y0LtpUv7UTg1dJ5ea6jw0RBUDZvX3qOUMNmmxfxbw==} + oxfmt@0.74.0: + resolution: {integrity: sha512-G4OP7FgwGYZR5ttRpCOOfJdyRsSyvtn34vSXnjDq6Oqed5Dufg5mB44mank+51nAdHOKuTJ0lj0mksY7L+N61A==} engines: {node: ^20.19.0 || >=22.12.0} hasBin: true peerDependencies: @@ -6935,9 +6932,6 @@ packages: resolution: {integrity: sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==} engines: {node: '>= 0.4'} - undici-types@7.19.2: - resolution: {integrity: sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==} - undici-types@8.9.0: resolution: {integrity: sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==} @@ -9395,61 +9389,61 @@ snapshots: '@oxc-project/types@0.153.0': {} - '@oxfmt/binding-android-arm-eabi@0.73.0': + '@oxfmt/binding-android-arm-eabi@0.74.0': optional: true - '@oxfmt/binding-android-arm64@0.73.0': + '@oxfmt/binding-android-arm64@0.74.0': optional: true - '@oxfmt/binding-darwin-arm64@0.73.0': + '@oxfmt/binding-darwin-arm64@0.74.0': optional: true - '@oxfmt/binding-darwin-x64@0.73.0': + '@oxfmt/binding-darwin-x64@0.74.0': optional: true - '@oxfmt/binding-freebsd-x64@0.73.0': + '@oxfmt/binding-freebsd-x64@0.74.0': optional: true - '@oxfmt/binding-linux-arm-gnueabihf@0.73.0': + '@oxfmt/binding-linux-arm-gnueabihf@0.74.0': optional: true - '@oxfmt/binding-linux-arm-musleabihf@0.73.0': + '@oxfmt/binding-linux-arm-musleabihf@0.74.0': optional: true - '@oxfmt/binding-linux-arm64-gnu@0.73.0': + '@oxfmt/binding-linux-arm64-gnu@0.74.0': optional: true - '@oxfmt/binding-linux-arm64-musl@0.73.0': + '@oxfmt/binding-linux-arm64-musl@0.74.0': optional: true - '@oxfmt/binding-linux-ppc64-gnu@0.73.0': + '@oxfmt/binding-linux-ppc64-gnu@0.74.0': optional: true - '@oxfmt/binding-linux-riscv64-gnu@0.73.0': + '@oxfmt/binding-linux-riscv64-gnu@0.74.0': optional: true - '@oxfmt/binding-linux-riscv64-musl@0.73.0': + '@oxfmt/binding-linux-riscv64-musl@0.74.0': optional: true - '@oxfmt/binding-linux-s390x-gnu@0.73.0': + '@oxfmt/binding-linux-s390x-gnu@0.74.0': optional: true - '@oxfmt/binding-linux-x64-gnu@0.73.0': + '@oxfmt/binding-linux-x64-gnu@0.74.0': optional: true - '@oxfmt/binding-linux-x64-musl@0.73.0': + '@oxfmt/binding-linux-x64-musl@0.74.0': optional: true - '@oxfmt/binding-openharmony-arm64@0.73.0': + '@oxfmt/binding-openharmony-arm64@0.74.0': optional: true - '@oxfmt/binding-win32-arm64-msvc@0.73.0': + '@oxfmt/binding-win32-arm64-msvc@0.74.0': optional: true - '@oxfmt/binding-win32-ia32-msvc@0.73.0': + '@oxfmt/binding-win32-ia32-msvc@0.74.0': optional: true - '@oxfmt/binding-win32-x64-msvc@0.73.0': + '@oxfmt/binding-win32-x64-msvc@0.74.0': optional: true '@oxlint/binding-android-arm-eabi@1.88.0': @@ -10334,10 +10328,6 @@ snapshots: '@types/mdurl@2.0.0': {} - '@types/node@25.6.0': - dependencies: - undici-types: 7.19.2 - '@types/node@26.6.2': dependencies: undici-types: 8.9.0 @@ -10361,9 +10351,9 @@ snapshots: '@types/whatwg-mimetype@3.0.2': {} - '@types/ws@8.18.1': + '@types/ws@8.18.2': dependencies: - '@types/node': 25.6.0 + '@types/node': 26.6.2 '@types/yargs-parser@21.0.3': {} @@ -12551,7 +12541,7 @@ snapshots: dependencies: '@types/node': 26.6.2 '@types/whatwg-mimetype': 3.0.2 - '@types/ws': 8.18.1 + '@types/ws': 8.18.2 buffer-image-size: 0.6.4 entities: 7.0.1 whatwg-mimetype: 3.0.0 @@ -14179,29 +14169,29 @@ snapshots: object-keys: 1.1.1 safe-push-apply: 1.0.0 - oxfmt@0.73.0: + oxfmt@0.74.0: dependencies: tinypool: 2.2.0 optionalDependencies: - '@oxfmt/binding-android-arm-eabi': 0.73.0 - '@oxfmt/binding-android-arm64': 0.73.0 - '@oxfmt/binding-darwin-arm64': 0.73.0 - '@oxfmt/binding-darwin-x64': 0.73.0 - '@oxfmt/binding-freebsd-x64': 0.73.0 - '@oxfmt/binding-linux-arm-gnueabihf': 0.73.0 - '@oxfmt/binding-linux-arm-musleabihf': 0.73.0 - '@oxfmt/binding-linux-arm64-gnu': 0.73.0 - '@oxfmt/binding-linux-arm64-musl': 0.73.0 - '@oxfmt/binding-linux-ppc64-gnu': 0.73.0 - '@oxfmt/binding-linux-riscv64-gnu': 0.73.0 - '@oxfmt/binding-linux-riscv64-musl': 0.73.0 - '@oxfmt/binding-linux-s390x-gnu': 0.73.0 - '@oxfmt/binding-linux-x64-gnu': 0.73.0 - '@oxfmt/binding-linux-x64-musl': 0.73.0 - '@oxfmt/binding-openharmony-arm64': 0.73.0 - '@oxfmt/binding-win32-arm64-msvc': 0.73.0 - '@oxfmt/binding-win32-ia32-msvc': 0.73.0 - '@oxfmt/binding-win32-x64-msvc': 0.73.0 + '@oxfmt/binding-android-arm-eabi': 0.74.0 + '@oxfmt/binding-android-arm64': 0.74.0 + '@oxfmt/binding-darwin-arm64': 0.74.0 + '@oxfmt/binding-darwin-x64': 0.74.0 + '@oxfmt/binding-freebsd-x64': 0.74.0 + '@oxfmt/binding-linux-arm-gnueabihf': 0.74.0 + '@oxfmt/binding-linux-arm-musleabihf': 0.74.0 + '@oxfmt/binding-linux-arm64-gnu': 0.74.0 + '@oxfmt/binding-linux-arm64-musl': 0.74.0 + '@oxfmt/binding-linux-ppc64-gnu': 0.74.0 + '@oxfmt/binding-linux-riscv64-gnu': 0.74.0 + '@oxfmt/binding-linux-riscv64-musl': 0.74.0 + '@oxfmt/binding-linux-s390x-gnu': 0.74.0 + '@oxfmt/binding-linux-x64-gnu': 0.74.0 + '@oxfmt/binding-linux-x64-musl': 0.74.0 + '@oxfmt/binding-openharmony-arm64': 0.74.0 + '@oxfmt/binding-win32-arm64-msvc': 0.74.0 + '@oxfmt/binding-win32-ia32-msvc': 0.74.0 + '@oxfmt/binding-win32-x64-msvc': 0.74.0 oxlint@1.88.0: optionalDependencies: @@ -15251,8 +15241,6 @@ snapshots: has-symbols: 1.1.0 which-boxed-primitive: 1.1.1 - undici-types@7.19.2: {} - undici-types@8.9.0: {} unicode-canonical-property-names-ecmascript@2.0.1: {} diff --git a/mobile/pnpm-workspace.yaml b/mobile/pnpm-workspace.yaml index eb35e1a3f8d..2e5c1615e5d 100644 --- a/mobile/pnpm-workspace.yaml +++ b/mobile/pnpm-workspace.yaml @@ -4,48 +4,6 @@ allowBuilds: react-native-libsodium: true minimumReleaseAge: 4320 -# Latest requested releases are still within the three-day delay; exempt only these versions. -minimumReleaseAgeExclude: - - '@oxfmt/binding-android-arm-eabi@0.73.0' - - '@oxfmt/binding-android-arm64@0.73.0' - - '@oxfmt/binding-darwin-arm64@0.73.0' - - '@oxfmt/binding-darwin-x64@0.73.0' - - '@oxfmt/binding-freebsd-x64@0.73.0' - - '@oxfmt/binding-linux-arm-gnueabihf@0.73.0' - - '@oxfmt/binding-linux-arm-musleabihf@0.73.0' - - '@oxfmt/binding-linux-arm64-gnu@0.73.0' - - '@oxfmt/binding-linux-arm64-musl@0.73.0' - - '@oxfmt/binding-linux-ppc64-gnu@0.73.0' - - '@oxfmt/binding-linux-riscv64-gnu@0.73.0' - - '@oxfmt/binding-linux-riscv64-musl@0.73.0' - - '@oxfmt/binding-linux-s390x-gnu@0.73.0' - - '@oxfmt/binding-linux-x64-gnu@0.73.0' - - '@oxfmt/binding-linux-x64-musl@0.73.0' - - '@oxfmt/binding-openharmony-arm64@0.73.0' - - '@oxfmt/binding-win32-arm64-msvc@0.73.0' - - '@oxfmt/binding-win32-ia32-msvc@0.73.0' - - '@oxfmt/binding-win32-x64-msvc@0.73.0' - - '@oxlint/binding-android-arm-eabi@1.88.0' - - '@oxlint/binding-android-arm64@1.88.0' - - '@oxlint/binding-darwin-arm64@1.88.0' - - '@oxlint/binding-darwin-x64@1.88.0' - - '@oxlint/binding-freebsd-x64@1.88.0' - - '@oxlint/binding-linux-arm-gnueabihf@1.88.0' - - '@oxlint/binding-linux-arm-musleabihf@1.88.0' - - '@oxlint/binding-linux-arm64-gnu@1.88.0' - - '@oxlint/binding-linux-arm64-musl@1.88.0' - - '@oxlint/binding-linux-ppc64-gnu@1.88.0' - - '@oxlint/binding-linux-riscv64-gnu@1.88.0' - - '@oxlint/binding-linux-riscv64-musl@1.88.0' - - '@oxlint/binding-linux-s390x-gnu@1.88.0' - - '@oxlint/binding-linux-x64-gnu@1.88.0' - - '@oxlint/binding-linux-x64-musl@1.88.0' - - '@oxlint/binding-openharmony-arm64@1.88.0' - - '@oxlint/binding-win32-arm64-msvc@1.88.0' - - '@oxlint/binding-win32-ia32-msvc@1.88.0' - - '@oxlint/binding-win32-x64-msvc@1.88.0' - - oxfmt@0.73.0 - - oxlint@1.88.0 overrides: dompurify@<3.4.17: 3.4.17 diff --git a/package.json b/package.json index c35a298fc79..159ee0bb81d 100644 --- a/package.json +++ b/package.json @@ -218,7 +218,7 @@ "ssh2": "^1.17.0", "stream-chain": "4.2.6", "stream-json": "3.7.0", - "tldts": "7.4.16", + "tldts": "7.4.18", "tweetnacl": "^1.0.3", "ws": "^8.22.0", "yaml": "^2.9.1", @@ -234,7 +234,7 @@ "@monaco-editor/react": "^4.7.0", "@noble/hashes": "1.8.0", "@oxlint/plugins": "1.88.0", - "@playwright/test": "^1.63.0", + "@playwright/test": "^1.64.1", "@sanity/diff-match-patch": "^3.2.1", "@shadcn/lint": "~0.1.5", "@stablyai/playwright-test": "^2.1.16", @@ -242,7 +242,7 @@ "@tanstack/react-virtual": "^3.14.13", "@testing-library/jest-dom": "^6.9.1", "@testing-library/react": "^16.3.3", - "@testing-library/user-event": "^14.6.7", + "@testing-library/user-event": "^14.6.8", "@tiptap/extension-code-block": "3.31.3", "@tiptap/extension-code-block-lowlight": "3.31.3", "@tiptap/extension-details": "3.31.3", @@ -264,7 +264,7 @@ "@types/react": "~19.2.18", "@types/react-dom": "~19.2.7", "@types/ssh2": "^1.15.6", - "@types/ws": "^8.18.1", + "@types/ws": "^8.18.2", "@vitejs/plugin-react": "^6.1.2", "@vscode/ripgrep-universal": "1.18.0", "@xterm/addon-fit": "0.12.0-beta.301", @@ -279,7 +279,7 @@ "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", "cmdk": "^1.1.1", - "devalue": "6.0.2", + "devalue": "6.0.3", "diff": "8.0.4", "dompurify": "3.4.17", "electron": "43.8.1", @@ -301,13 +301,13 @@ "mermaid": "^11.17.2", "monaco-editor": "^0.55.1", "node-gyp": "12.3.0", - "oxfmt": "^0.73.0", + "oxfmt": "^0.74.0", "oxlint": "^1.88.0", "oxlint-plugin-anti-slop": "github:dmmulroy/anti-slop#c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b", "oxlint-plugin-react-doctor": "0.9.14", "oxlint-tsgolint": "7.0.2004", "pdfjs-dist": "^6.3.289", - "playwright-core": "1.64.0", + "playwright-core": "1.64.1", "pngjs": "^7.0.0", "radix-ui": "^1.6.7", "react": "~19.2.8", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index aefb39b9ac5..8a23d9eb85d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -259,8 +259,8 @@ importers: specifier: 3.7.0 version: 3.7.0 tldts: - specifier: 7.4.16 - version: 7.4.16 + specifier: 7.4.18 + version: 7.4.18 tweetnacl: specifier: ^1.0.3 version: 1.0.3 @@ -302,8 +302,8 @@ importers: specifier: 1.88.0 version: 1.88.0 '@playwright/test': - specifier: ^1.63.0 - version: 1.63.0(electron@43.8.1(supports-color@7.2.0)) + specifier: ^1.64.1 + version: 1.64.1(electron@43.8.1(supports-color@7.2.0)) '@sanity/diff-match-patch': specifier: ^3.2.1 version: 3.2.1 @@ -312,7 +312,7 @@ importers: version: 0.1.5(eslint@10.10.0(@types/keyv@3.1.4)(jiti@2.7.0)(supports-color@7.2.0)) '@stablyai/playwright-test': specifier: ^2.1.16 - version: 2.1.16(@playwright/test@1.63.0(electron@43.8.1(supports-color@7.2.0)))(zod@4.6.7) + version: 2.1.16(@playwright/test@1.64.1(electron@43.8.1(supports-color@7.2.0)))(zod@4.6.7) '@tailwindcss/vite': specifier: ^4.3.3 version: 4.3.3(vite@8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) @@ -326,8 +326,8 @@ importers: specifier: ^16.3.3 version: 16.3.3(@testing-library/dom@10.4.1)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(@types/react@19.2.18)(react@19.2.8))(react@19.2.8) '@testing-library/user-event': - specifier: ^14.6.7 - version: 14.6.7(@testing-library/dom@10.4.1) + specifier: ^14.6.8 + version: 14.6.8(@testing-library/dom@10.4.1) '@tiptap/extension-code-block': specifier: 3.31.3 version: 3.31.3(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3) @@ -392,8 +392,8 @@ importers: specifier: ^1.15.6 version: 1.15.6 '@types/ws': - specifier: ^8.18.1 - version: 8.18.1 + specifier: ^8.18.2 + version: 8.18.2 '@vitejs/plugin-react': specifier: ^6.1.2 version: 6.1.2(vite@8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) @@ -437,8 +437,8 @@ importers: specifier: ^1.1.1 version: 1.1.1(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(@types/react@19.2.18)(react@19.2.8))(react@19.2.8) devalue: - specifier: 6.0.2 - version: 6.0.2 + specifier: 6.0.3 + version: 6.0.3 diff: specifier: 8.0.4 version: 8.0.4 @@ -503,8 +503,8 @@ importers: specifier: 12.3.0 version: 12.3.0 oxfmt: - specifier: ^0.73.0 - version: 0.73.0 + specifier: ^0.74.0 + version: 0.74.0 oxlint: specifier: ^1.88.0 version: 1.88.0(oxlint-tsgolint@7.0.2004) @@ -521,8 +521,8 @@ importers: specifier: ^6.3.289 version: 6.3.289 playwright-core: - specifier: 1.64.0 - version: 1.64.0(electron@43.8.1(supports-color@7.2.0)) + specifier: 1.64.1 + version: 1.64.1(electron@43.8.1(supports-color@7.2.0)) pngjs: specifier: ^7.0.0 version: 7.0.0 @@ -1706,124 +1706,124 @@ packages: '@oxc-project/types@0.154.0': resolution: {integrity: sha512-KYOUGQFlLWR+s4QMV2Q9ko38TZm7EdO87Qm7rvZLqk/webse/cDjtyxKhg/47l0byCbs/k46LT8qc4PKjAikzA==} - '@oxfmt/binding-android-arm-eabi@0.73.0': - resolution: {integrity: sha512-dhunAdMbi/4o0Y66/+Wl6rpsNqpvE4i26Qw6bB77A97L2lJoktWg6m+X9QOon8iOEEqzD9rEZqFi5uZ4oIzhCA==} + '@oxfmt/binding-android-arm-eabi@0.74.0': + resolution: {integrity: sha512-xxQwrf5EPI5zxvuCTW8r6tzCTjPQ+h6+HqJ0iRKRy2zS1yBllt/xLVjoIyUc+FnR7g0a5g1SZv2yyDYhTItLbA==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm] os: [android] - '@oxfmt/binding-android-arm64@0.73.0': - resolution: {integrity: sha512-dBoypjC2/xeyKyIhN2waX0/XeoccH9k0lVVe+sGRc4X8HSJVRtqyZDoXdr7bGY9A75c51dX0z0dLDpGQKwCdCg==} + '@oxfmt/binding-android-arm64@0.74.0': + resolution: {integrity: sha512-FJW3sATVvrWbV64al8xofCPZj4500Z/1W0ad7Tg1rcCUyh0EMbuSrsf3jsZS7CEbwQ5fQ0mRhmkc129GFgofSQ==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [android] - '@oxfmt/binding-darwin-arm64@0.73.0': - resolution: {integrity: sha512-Tn7Y+qWIpCQK+qdYwBcn6YvqeBuPiuG3tcNlYg16a5QL2o3rSmrgBB1nCyYqo0uvc1LNrfQW9/CK2tzFuID/Fg==} + '@oxfmt/binding-darwin-arm64@0.74.0': + resolution: {integrity: sha512-TfmNKBD30dGyMu9GCLiaw2rt/z7fms9LS+5cKcNOyWst0QgAs8oZs6wPxMbVaaDVE0/PCdCosgWM1vbu6f5NUg==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [darwin] - '@oxfmt/binding-darwin-x64@0.73.0': - resolution: {integrity: sha512-yVb0E0tg/+9Xc9YJCBq66qF1DC/aN5mhb5nnHz0k4ikwkMANtSul2VPDSwjYdXR6/DFimc+pPUgLBqkIa5Ctuw==} + '@oxfmt/binding-darwin-x64@0.74.0': + resolution: {integrity: sha512-5Usf8+DfC4Q3o/MD8FkN47GrI6y0KbhQ4KhZ2HGzMZcXjcW1AeldwbUn51aKih+1TVuJFF9qkNm6X1nzm6NYng==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [darwin] - '@oxfmt/binding-freebsd-x64@0.73.0': - resolution: {integrity: sha512-IKR4lFnBkYNL9Uqdxa5GMTQLvnLj+3sDwTvh2atHCzah0xeo+1xR5bigRU8uyXlOsA4VpXUn0UAimq4E4RBGmQ==} + '@oxfmt/binding-freebsd-x64@0.74.0': + resolution: {integrity: sha512-eL+1O3gykw1XihbZh2MRAciQvU2988LByrnjhyo/dmNG74X4oZ7XzigRoWPRFLfJCp8hzRkp/LbEhwe7uuT2eA==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [freebsd] - '@oxfmt/binding-linux-arm-gnueabihf@0.73.0': - resolution: {integrity: sha512-7qnZ4g0ZCO3aZevOOQpZIABYwwXJW1lLDo2elviGdPQ0i11255xKEMFsi97fC1/nauQFseCJfELUy/k2JoOP+g==} + '@oxfmt/binding-linux-arm-gnueabihf@0.74.0': + resolution: {integrity: sha512-Xt0QtO2hJ4stnul8IL4LJGVLyp0xnc6ccN9fZ30yuubv8FWSRYxWwd1Za62KsEqAfmPSazoS/cLSUUJpja6npA==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm] os: [linux] - '@oxfmt/binding-linux-arm-musleabihf@0.73.0': - resolution: {integrity: sha512-36eBico2j/WPB84gb4FYd/jjqGCKOwU4M+TWLBUIqlnzTozQueLy0joA5BwsSp2OZFVkOlpCwvA3ndPamdiyLw==} + '@oxfmt/binding-linux-arm-musleabihf@0.74.0': + resolution: {integrity: sha512-/4wYQ0gZl4vUR0QoBTGaay73FmQ1GAjUa9z9101TR2xbGNrg4a+grazlR0yzEOe3/E+PJr5BGfj66MMzm/54vg==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm] os: [linux] - '@oxfmt/binding-linux-arm64-gnu@0.73.0': - resolution: {integrity: sha512-VZ3cSgCAT18knKo52DcACmAuIoqG6qVEyeZRFbJd0xmYQ8GyYjuBc6IAh6MZHijT6q7p4/HPI+6ZWsCuhdV6iw==} + '@oxfmt/binding-linux-arm64-gnu@0.74.0': + resolution: {integrity: sha512-846bKzF+HJd+JkOFh3rxzmYvSq4Cm+GMT+p+mW7S13ZYo6GAAGv8bL8cAOi/XcdeMqxEJDCIMTVQLVBXHMCdig==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [linux] libc: [glibc] - '@oxfmt/binding-linux-arm64-musl@0.73.0': - resolution: {integrity: sha512-8YVzH59XSHcqwXNgc5qK851zCqwpmBgOifARXEPPe5/xTsIbHceYoPZAyqfpYV0CfKmzSaEDBgYHFza4rhx+Zw==} + '@oxfmt/binding-linux-arm64-musl@0.74.0': + resolution: {integrity: sha512-nI5FJwZ4Flo6CBdscpwxymZXxO3m3IErQJX55ZS6h+ObfGXu8FostL85L/RWPFaCLnIVE4/WfLw+2q8XvVEeUA==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [linux] libc: [musl] - '@oxfmt/binding-linux-ppc64-gnu@0.73.0': - resolution: {integrity: sha512-MqRJnmCys0rwOgpWyEidSA7v/bvOqfNDJhPkQoR9mPVYrvSmMaW2Xhdpl28cbTA+brOM1is62GjIvJplVlUVpw==} + '@oxfmt/binding-linux-ppc64-gnu@0.74.0': + resolution: {integrity: sha512-BoQYKuqUdsKAFAkK6DLBvkdv4+t0hppSm79sB0wIcE2o/eOwNj+6Z3OlKY4q3Eta/tlssP65FaS9vHn8TeF7vQ==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [ppc64] os: [linux] libc: [glibc] - '@oxfmt/binding-linux-riscv64-gnu@0.73.0': - resolution: {integrity: sha512-4t2F3SWJSK/O/kRRFnL0elJzn75fJGGu71gs1HtiWcS80SmJOpkHiwwLnTp9suGdns8VHEPxYS0GTcyVwHKWBA==} + '@oxfmt/binding-linux-riscv64-gnu@0.74.0': + resolution: {integrity: sha512-FSroRrM12+jCdSQklF9aOxsKpI6wFs4ZCo/1cSYG80RWZS6z4LV+l9tXRMT8lDGu+yohIZBwi9M76FzGPFDE2A==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [riscv64] os: [linux] libc: [glibc] - '@oxfmt/binding-linux-riscv64-musl@0.73.0': - resolution: {integrity: sha512-D8b4I8I1kLdJQFwdFXNV+cwh3xWSiNKofjdGUk0nDpc0AHOds8T+poGbP9RWQMvgsvMb9OMgp/aV7ahBR37TbQ==} + '@oxfmt/binding-linux-riscv64-musl@0.74.0': + resolution: {integrity: sha512-0VLQD0dhGBLY9Ik/w+otMvD81D0YXi4VDwql65macV+O9UzmSWmUr6CKf+dMtysDeC0PnG3y6kBkRO08BJx52g==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [riscv64] os: [linux] libc: [musl] - '@oxfmt/binding-linux-s390x-gnu@0.73.0': - resolution: {integrity: sha512-QrC1S5VL1+N5rvorB15jH7CPvjVHA7GyUI5oVEd8Bd9m5605RDBQYTxDQ920DuylRoZOh2V7/xXpfCtFUrojUQ==} + '@oxfmt/binding-linux-s390x-gnu@0.74.0': + resolution: {integrity: sha512-6X7BbZNz34+OHM6Oqjf6TRcUyRn6aRcB4VtIDZAF/uQRyeVhg+G2hv6MlMvmnRekVSyTJ/8rG/u8W2dRFW6glg==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [s390x] os: [linux] libc: [glibc] - '@oxfmt/binding-linux-x64-gnu@0.73.0': - resolution: {integrity: sha512-dFcUKQPltCEPa+YlkF3zqufn6nJPZdG73LpnjBvZFFsU3laCMssDXSYB99mVaj43FqdEgjpz5TO6gbYXcczd9g==} + '@oxfmt/binding-linux-x64-gnu@0.74.0': + resolution: {integrity: sha512-4kYIQK53yJXrxwxSzx8H2bojlf6/KezLGYLRXzV9QCCkoiCsvBTCid9Bg83dUPTLPa3g9K0730f6MKDbck1+OA==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [linux] libc: [glibc] - '@oxfmt/binding-linux-x64-musl@0.73.0': - resolution: {integrity: sha512-LmQe+nV8e+eUwfPNCxDF+owbsg88toBiR/8rZRgVOeKQP3MaGefXZRvBoc1UG37iWEQ/9JlCXG9Mc4nf4N3agw==} + '@oxfmt/binding-linux-x64-musl@0.74.0': + resolution: {integrity: sha512-MfWz4wDREjp/JQDmuxtKieix4FHGa1z5rBvB3betdcPwZvf5fqeQrlCm1mmoyuUVQOh9Pt3M61HwN94kJCxw7Q==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [linux] libc: [musl] - '@oxfmt/binding-openharmony-arm64@0.73.0': - resolution: {integrity: sha512-8weOr1OKknE0G2DbR6ejJUT9AOsoBU6cXlsetmbihHv1K+bK7qP61T6lJxY0k/aAO7GyOJiRGNlL+04r4eH8Xg==} + '@oxfmt/binding-openharmony-arm64@0.74.0': + resolution: {integrity: sha512-6rmAApkq5s1kbDjvNI6Nl5A+JqQkLORb2sR941pf5HWsrd01WGKyagK/B4vX9+kh1FfvRkNgEu59FHvVk4H8cQ==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [openharmony] - '@oxfmt/binding-win32-arm64-msvc@0.73.0': - resolution: {integrity: sha512-mZV+QxXYgb8E18gzAFItb937VIsE4dqWdStrD3tRRC52UubOYEuU+e7NaIqUsGdB5YsJqNeuck3Ue/af2r9wyA==} + '@oxfmt/binding-win32-arm64-msvc@0.74.0': + resolution: {integrity: sha512-+5SpRUnZNGeXTyumHnpHa791tQtt04qZs076WT8eTcGF2OJ631VLnf7S0kQSPuDG+PtJM0phadEB2WAr5n1w9g==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [win32] - '@oxfmt/binding-win32-ia32-msvc@0.73.0': - resolution: {integrity: sha512-QJPUsbgUb97ZPPMkFUq6VQq0fLhC4Np19KL9aB/qKVwXnpKE6MIiILXqzhKnQ/UbnEDjKJ7Xv1d6zH4bYPCUdQ==} + '@oxfmt/binding-win32-ia32-msvc@0.74.0': + resolution: {integrity: sha512-1Fg+wYBO3Dsti1QX+/6EYHjeQzLC84tLOAqPu/r7ah3UJlUs9C/DB703Ay9Vcg+8VMzqZA2P5VGhzJraVUD4OQ==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [ia32] os: [win32] - '@oxfmt/binding-win32-x64-msvc@0.73.0': - resolution: {integrity: sha512-cGcze2fu+ykIaFtkEvZlkZ3HvnCLk+WISthtq99zWTWn0x13t5L9TxvGdLZMUMvtfYR+ICkiCwKnguVubdcw0w==} + '@oxfmt/binding-win32-x64-msvc@0.74.0': + resolution: {integrity: sha512-y9jXUgPBm2TZIWbQhMYRRYAQM57+r4fbykgc+j24ICIIZl+pcuoNhnq1CRGm3oFiHnEUnZO00qOtSPGQdJ2ziQ==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [win32] @@ -2090,8 +2090,8 @@ packages: resolution: {integrity: sha512-ODOov0sGMJMf3jPonOkgGqPknTsu+DdQ7kD++gz8aI+aFMOMHFbWAA2taqXXVTdP+OTOQR/znGvSpmkeI0WTYQ==} engines: {node: '>=14.18.0'} - '@playwright/test@1.63.0': - resolution: {integrity: sha512-oxMK4vllB9RK5NQ2l1pq1IfOf2AvnEuj/vYGDj0H2nMtmtZpKtCwt/l00GEO6xjGfpBNAvjovvYdCm50dRQkpQ==} + '@playwright/test@1.64.1': + resolution: {integrity: sha512-IaYGml/nSOiZWROfPtuIL7neuu9qDOZ3TNvNljUIrhDMxiGTgPjzj/g9p9RxpS2tSepPDRY+UwAaEeiKtUvIAg==} engines: {node: '>=20'} hasBin: true @@ -3409,8 +3409,8 @@ packages: '@types/testing-library__dom': optional: true - '@testing-library/user-event@14.6.7': - resolution: {integrity: sha512-MPCpX8bxe8zS+JmmTwLp8jd0dy1rAm60Te/SL8JrQM3qvQJcBOs1d7IefJMyZzqM3EWBrDn/LWDt1BCGu4ASfg==} + '@testing-library/user-event@14.6.8': + resolution: {integrity: sha512-vgSSqnANMnkcYR/vUNDbwS7aM3OErRLNUG8vCVVlj4oc6cKffUrccX7UAS5AmJQQNZTSibi9z5GvvRZ0aYgUCQ==} engines: {node: '>=12', npm: '>=6'} peerDependencies: '@testing-library/dom': '>=7.21.4' @@ -4046,8 +4046,8 @@ packages: '@types/whatwg-mimetype@3.0.2': resolution: {integrity: sha512-c2AKvDT8ToxLIOUlN51gTiHXflsfIFisS4pO7pDPoKouJCESkhZnEy623gwP9laCy5lnLDAw1vAzu2vM2YLOrA==} - '@types/ws@8.18.1': - resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==} + '@types/ws@8.18.2': + resolution: {integrity: sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==} '@typescript-eslint/types@8.70.0': resolution: {integrity: sha512-asTOIYhDg4zdzOScCyaytrsV3cR6B4ecPQlXw/dJIm7J/MZTtCtfVII9JD8Geh4jTCrK/Xe6cg5UevoleMcoJQ==} @@ -4990,9 +4990,9 @@ packages: detect-node@2.1.0: resolution: {integrity: sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g==} - devalue@6.0.2: - resolution: {integrity: sha512-6V1HzU4to74skg//ScZR2mp9bdz+rESC9jQzVIIG/ha0HYgymHcXIQQCjH0+ivRaSuY82fa9fZ7Ro6QZT4s4uw==} - engines: {node: '>=22.17'} + devalue@6.0.3: + resolution: {integrity: sha512-3woMEITftG1wKeO/4d/QXH1DVKctTSZg3jNGPpjp9hNr5Hos8MCFF5McTML5ZtgKDObm2R591B0spRp2IVernA==} + engines: {node: '>=18'} devlop@1.1.0: resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==} @@ -6553,8 +6553,8 @@ packages: resolution: {integrity: sha512-syxUKHeUll89RIABQADcI7sikYrwyssvA6gj4phSSIPezKVM8yMaLAiLLSc7fmzVvrwybfFGFbW5zme9sX87rg==} engines: {node: ^20.19.0 || >=22.12.0} - oxfmt@0.73.0: - resolution: {integrity: sha512-Ke4xbpuzqIBP4bkd48q815RhqWNJqOBzxVA9199M4qcF0y0LtpUv7UTg1dJ5ea6jw0RBUDZvX3qOUMNmmxfxbw==} + oxfmt@0.74.0: + resolution: {integrity: sha512-G4OP7FgwGYZR5ttRpCOOfJdyRsSyvtn34vSXnjDq6Oqed5Dufg5mB44mank+51nAdHOKuTJ0lj0mksY7L+N61A==} engines: {node: ^20.19.0 || >=22.12.0} hasBin: true peerDependencies: @@ -6716,8 +6716,8 @@ packages: resolution: {integrity: sha512-emEcLuomt2j03vxD54giVB4SxTjnsqkU692xZOZXHDVoYyypEm+b3jpiTcc+Cf+myooc+/Ly0z01jqeNHVgJGw==} engines: {node: '>=16.0.0'} - playwright-core@1.63.0: - resolution: {integrity: sha512-rYCsBF/M5HjUch52bbtVONEFjv6Xu8sm8h72dNlR5bzIE1fvC/bxgspzkjSfU+MweEMmPM8KJebG6nnyxo5mCg==} + playwright-core@1.64.1: + resolution: {integrity: sha512-BC4s8y6SEVA6Q1rSxZTto8hI1KUI3xXlHGZgvGqP4IqPdI/a6FX9H29IDNz7vKo9l21b6LfYosScPL6M3xxyDQ==} engines: {node: '>=20'} hasBin: true peerDependencies: @@ -6729,21 +6729,8 @@ packages: electron: optional: true - playwright-core@1.64.0: - resolution: {integrity: sha512-T9r+MZkTECl2+oUcZ26YgZzTrYidTsIhYYkJix+6iDOymOb1FB2RLLSOxRGnZGv5DStt+aduIVbt+E8WygXYpg==} - engines: {node: '>=20'} - hasBin: true - peerDependencies: - '@types/electron': '*' - electron: '*' - peerDependenciesMeta: - '@types/electron': - optional: true - electron: - optional: true - - playwright@1.63.0: - resolution: {integrity: sha512-+7ziBLidS4NaNCdt57SUDT+wYmmd5fmiQejUic/kb+YsYSCPyOOE9sebzMjNmQrsnNpDJqd4WHvV/8lfKfUDUg==} + playwright@1.64.1: + resolution: {integrity: sha512-HCrVhHr5QQuwYoswEUGTb7gGp522yflbv/ST8nF4sFWGuLjQCt17Q/EubpGGSNKYn1tsTCPZxqHhHCfVURu7UA==} engines: {node: '>=20'} hasBin: true @@ -7503,10 +7490,17 @@ packages: tldts-core@7.4.16: resolution: {integrity: sha512-MDolfaSJtlSK5Y0A1xl3277ekubZwobpBjugknDizI9O5Rm60a1m8k4ICK+MRsCDzPygT81mp3BBf5RKDlFRfA==} + tldts-core@7.4.18: + resolution: {integrity: sha512-KI2PKvCmvQI/xD6ypPqkU0i7oxNXR/O58RLRaHR4svsgVUQ2JE/XC8BtMbG6PSehD27I8sZJRcC1ASnCy6lp3g==} + tldts@7.4.16: resolution: {integrity: sha512-QwBER5KMR86IIjpIiO7H/Z3IMJPsZ1A6RKPAqzTTgOyUQUSt9FdnKcqhTaJmkY6HVrgouZHZR0ncK5QxvmnQeg==} hasBin: true + tldts@7.4.18: + resolution: {integrity: sha512-somxA8xKAUzlAxl0TX/jMSYIbRNFIVGnI96pVGJPeMc5BsHmfVXn6mOJT6U++ELnl04eGfzpfcEuZe8WiASkXg==} + hasBin: true + tmp-promise@3.0.3: resolution: {integrity: sha512-RwM7MoPojPxsOBYnyd2hy0bxtIlVrihNs9pj5SUvY8Zz1sQcQG2tG1hSr8PDxfgEB8RNKDhqbIlroIarSNDNsQ==} @@ -8947,61 +8941,61 @@ snapshots: '@oxc-project/types@0.154.0': {} - '@oxfmt/binding-android-arm-eabi@0.73.0': + '@oxfmt/binding-android-arm-eabi@0.74.0': optional: true - '@oxfmt/binding-android-arm64@0.73.0': + '@oxfmt/binding-android-arm64@0.74.0': optional: true - '@oxfmt/binding-darwin-arm64@0.73.0': + '@oxfmt/binding-darwin-arm64@0.74.0': optional: true - '@oxfmt/binding-darwin-x64@0.73.0': + '@oxfmt/binding-darwin-x64@0.74.0': optional: true - '@oxfmt/binding-freebsd-x64@0.73.0': + '@oxfmt/binding-freebsd-x64@0.74.0': optional: true - '@oxfmt/binding-linux-arm-gnueabihf@0.73.0': + '@oxfmt/binding-linux-arm-gnueabihf@0.74.0': optional: true - '@oxfmt/binding-linux-arm-musleabihf@0.73.0': + '@oxfmt/binding-linux-arm-musleabihf@0.74.0': optional: true - '@oxfmt/binding-linux-arm64-gnu@0.73.0': + '@oxfmt/binding-linux-arm64-gnu@0.74.0': optional: true - '@oxfmt/binding-linux-arm64-musl@0.73.0': + '@oxfmt/binding-linux-arm64-musl@0.74.0': optional: true - '@oxfmt/binding-linux-ppc64-gnu@0.73.0': + '@oxfmt/binding-linux-ppc64-gnu@0.74.0': optional: true - '@oxfmt/binding-linux-riscv64-gnu@0.73.0': + '@oxfmt/binding-linux-riscv64-gnu@0.74.0': optional: true - '@oxfmt/binding-linux-riscv64-musl@0.73.0': + '@oxfmt/binding-linux-riscv64-musl@0.74.0': optional: true - '@oxfmt/binding-linux-s390x-gnu@0.73.0': + '@oxfmt/binding-linux-s390x-gnu@0.74.0': optional: true - '@oxfmt/binding-linux-x64-gnu@0.73.0': + '@oxfmt/binding-linux-x64-gnu@0.74.0': optional: true - '@oxfmt/binding-linux-x64-musl@0.73.0': + '@oxfmt/binding-linux-x64-musl@0.74.0': optional: true - '@oxfmt/binding-openharmony-arm64@0.73.0': + '@oxfmt/binding-openharmony-arm64@0.74.0': optional: true - '@oxfmt/binding-win32-arm64-msvc@0.73.0': + '@oxfmt/binding-win32-arm64-msvc@0.74.0': optional: true - '@oxfmt/binding-win32-ia32-msvc@0.73.0': + '@oxfmt/binding-win32-ia32-msvc@0.74.0': optional: true - '@oxfmt/binding-win32-x64-msvc@0.73.0': + '@oxfmt/binding-win32-x64-msvc@0.74.0': optional: true '@oxlint-tsgolint/darwin-arm64@7.0.2004': @@ -9165,9 +9159,9 @@ snapshots: tslib: 2.8.1 webcrypto-core: 1.9.2 - '@playwright/test@1.63.0(electron@43.8.1(supports-color@7.2.0))': + '@playwright/test@1.64.1(electron@43.8.1(supports-color@7.2.0))': dependencies: - playwright: 1.63.0(electron@43.8.1(supports-color@7.2.0)) + playwright: 1.64.1(electron@43.8.1(supports-color@7.2.0)) transitivePeerDependencies: - '@types/electron' - electron @@ -10179,28 +10173,28 @@ snapshots: '@stablelib/base64@1.0.1': {} - '@stablyai/playwright-base@2.1.16(@playwright/test@1.63.0(electron@43.8.1(supports-color@7.2.0)))(zod@4.6.7)': + '@stablyai/playwright-base@2.1.16(@playwright/test@1.64.1(electron@43.8.1(supports-color@7.2.0)))(zod@4.6.7)': dependencies: - '@playwright/test': 1.63.0(electron@43.8.1(supports-color@7.2.0)) + '@playwright/test': 1.64.1(electron@43.8.1(supports-color@7.2.0)) jpeg-js: 0.4.4 p-retry: 4.6.2 pngjs: 7.0.0 optionalDependencies: zod: 4.6.7 - '@stablyai/playwright-test@2.1.16(@playwright/test@1.63.0(electron@43.8.1(supports-color@7.2.0)))(zod@4.6.7)': + '@stablyai/playwright-test@2.1.16(@playwright/test@1.64.1(electron@43.8.1(supports-color@7.2.0)))(zod@4.6.7)': dependencies: - '@playwright/test': 1.63.0(electron@43.8.1(supports-color@7.2.0)) - '@stablyai/playwright': 2.1.16(@playwright/test@1.63.0(electron@43.8.1(supports-color@7.2.0)))(zod@4.6.7) - '@stablyai/playwright-base': 2.1.16(@playwright/test@1.63.0(electron@43.8.1(supports-color@7.2.0)))(zod@4.6.7) + '@playwright/test': 1.64.1(electron@43.8.1(supports-color@7.2.0)) + '@stablyai/playwright': 2.1.16(@playwright/test@1.64.1(electron@43.8.1(supports-color@7.2.0)))(zod@4.6.7) + '@stablyai/playwright-base': 2.1.16(@playwright/test@1.64.1(electron@43.8.1(supports-color@7.2.0)))(zod@4.6.7) transitivePeerDependencies: - '@types/zod' - zod - '@stablyai/playwright@2.1.16(@playwright/test@1.63.0(electron@43.8.1(supports-color@7.2.0)))(zod@4.6.7)': + '@stablyai/playwright@2.1.16(@playwright/test@1.64.1(electron@43.8.1(supports-color@7.2.0)))(zod@4.6.7)': dependencies: - '@playwright/test': 1.63.0(electron@43.8.1(supports-color@7.2.0)) - '@stablyai/playwright-base': 2.1.16(@playwright/test@1.63.0(electron@43.8.1(supports-color@7.2.0)))(zod@4.6.7) + '@playwright/test': 1.64.1(electron@43.8.1(supports-color@7.2.0)) + '@stablyai/playwright-base': 2.1.16(@playwright/test@1.64.1(electron@43.8.1(supports-color@7.2.0)))(zod@4.6.7) transitivePeerDependencies: - '@types/zod' - zod @@ -10381,7 +10375,7 @@ snapshots: '@types/react': 19.2.18 '@types/react-dom': 19.2.7(@types/react@19.2.18) - '@testing-library/user-event@14.6.7(@testing-library/dom@10.4.1)': + '@testing-library/user-event@14.6.8(@testing-library/dom@10.4.1)': dependencies: '@testing-library/dom': 10.4.1 @@ -10853,9 +10847,9 @@ snapshots: '@types/whatwg-mimetype@3.0.2': {} - '@types/ws@8.18.1': + '@types/ws@8.18.2': dependencies: - '@types/node': 25.9.5 + '@types/node': 24.19.2 '@typescript-eslint/types@8.70.0': {} @@ -11701,7 +11695,7 @@ snapshots: detect-node@2.1.0: optional: true - devalue@6.0.2: {} + devalue@6.0.3: {} devlop@1.1.0: dependencies: @@ -12353,7 +12347,7 @@ snapshots: dependencies: '@types/node': 25.9.5 '@types/whatwg-mimetype': 3.0.2 - '@types/ws': 8.18.1 + '@types/ws': 8.18.2 buffer-image-size: 0.6.4 entities: 7.0.1 whatwg-mimetype: 3.0.0 @@ -13734,29 +13728,29 @@ snapshots: '@oxc-parser/binding-win32-ia32-msvc': 0.148.0 '@oxc-parser/binding-win32-x64-msvc': 0.148.0 - oxfmt@0.73.0: + oxfmt@0.74.0: dependencies: tinypool: 2.2.0 optionalDependencies: - '@oxfmt/binding-android-arm-eabi': 0.73.0 - '@oxfmt/binding-android-arm64': 0.73.0 - '@oxfmt/binding-darwin-arm64': 0.73.0 - '@oxfmt/binding-darwin-x64': 0.73.0 - '@oxfmt/binding-freebsd-x64': 0.73.0 - '@oxfmt/binding-linux-arm-gnueabihf': 0.73.0 - '@oxfmt/binding-linux-arm-musleabihf': 0.73.0 - '@oxfmt/binding-linux-arm64-gnu': 0.73.0 - '@oxfmt/binding-linux-arm64-musl': 0.73.0 - '@oxfmt/binding-linux-ppc64-gnu': 0.73.0 - '@oxfmt/binding-linux-riscv64-gnu': 0.73.0 - '@oxfmt/binding-linux-riscv64-musl': 0.73.0 - '@oxfmt/binding-linux-s390x-gnu': 0.73.0 - '@oxfmt/binding-linux-x64-gnu': 0.73.0 - '@oxfmt/binding-linux-x64-musl': 0.73.0 - '@oxfmt/binding-openharmony-arm64': 0.73.0 - '@oxfmt/binding-win32-arm64-msvc': 0.73.0 - '@oxfmt/binding-win32-ia32-msvc': 0.73.0 - '@oxfmt/binding-win32-x64-msvc': 0.73.0 + '@oxfmt/binding-android-arm-eabi': 0.74.0 + '@oxfmt/binding-android-arm64': 0.74.0 + '@oxfmt/binding-darwin-arm64': 0.74.0 + '@oxfmt/binding-darwin-x64': 0.74.0 + '@oxfmt/binding-freebsd-x64': 0.74.0 + '@oxfmt/binding-linux-arm-gnueabihf': 0.74.0 + '@oxfmt/binding-linux-arm-musleabihf': 0.74.0 + '@oxfmt/binding-linux-arm64-gnu': 0.74.0 + '@oxfmt/binding-linux-arm64-musl': 0.74.0 + '@oxfmt/binding-linux-ppc64-gnu': 0.74.0 + '@oxfmt/binding-linux-riscv64-gnu': 0.74.0 + '@oxfmt/binding-linux-riscv64-musl': 0.74.0 + '@oxfmt/binding-linux-s390x-gnu': 0.74.0 + '@oxfmt/binding-linux-x64-gnu': 0.74.0 + '@oxfmt/binding-linux-x64-musl': 0.74.0 + '@oxfmt/binding-openharmony-arm64': 0.74.0 + '@oxfmt/binding-win32-arm64-msvc': 0.74.0 + '@oxfmt/binding-win32-ia32-msvc': 0.74.0 + '@oxfmt/binding-win32-x64-msvc': 0.74.0 oxlint-plugin-anti-slop@https://codeload.github.com/dmmulroy/anti-slop/tar.gz/c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b(patch_hash=c10c871702365a0c2c59e9f1c5fb92df97cae5755d534c0a3d83c6368f6feafe): dependencies: @@ -13900,17 +13894,13 @@ snapshots: pvutils: 1.1.5 tslib: 2.8.1 - playwright-core@1.63.0(electron@43.8.1(supports-color@7.2.0)): + playwright-core@1.64.1(electron@43.8.1(supports-color@7.2.0)): optionalDependencies: electron: 43.8.1(supports-color@7.2.0) - playwright-core@1.64.0(electron@43.8.1(supports-color@7.2.0)): - optionalDependencies: - electron: 43.8.1(supports-color@7.2.0) - - playwright@1.63.0(electron@43.8.1(supports-color@7.2.0)): + playwright@1.64.1(electron@43.8.1(supports-color@7.2.0)): dependencies: - playwright-core: 1.63.0(electron@43.8.1(supports-color@7.2.0)) + playwright-core: 1.64.1(electron@43.8.1(supports-color@7.2.0)) transitivePeerDependencies: - '@types/electron' - electron @@ -14819,11 +14809,19 @@ snapshots: tinypool@2.2.0: {} - tldts-core@7.4.16: {} + tldts-core@7.4.16: + optional: true + + tldts-core@7.4.18: {} tldts@7.4.16: dependencies: tldts-core: 7.4.16 + optional: true + + tldts@7.4.18: + dependencies: + tldts-core: 7.4.18 tmp-promise@3.0.3: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index ccf4a7d79f0..d9e70d16421 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -13,7 +13,7 @@ packages: - src/packages/* minimumReleaseAge: 4320 -# Latest requested releases are still within the three-day delay; exempt only these versions. +# Preserve the existing exception for the explicitly selected Bun 1.4.4 release. minimumReleaseAgeExclude: - 'bun@1.4.4' - '@oven/bun-darwin-aarch64@1.4.4' @@ -28,68 +28,6 @@ minimumReleaseAgeExclude: - '@oven/bun-linux-x64@1.4.4' - '@oven/bun-windows-aarch64@1.4.4' - '@oven/bun-windows-x64@1.4.4' - - '@oxc-project/types@0.154.0' - - '@rolldown/binding-android-arm-eabi@1.2.14' - - '@rolldown/binding-android-arm64@1.2.14' - - '@rolldown/binding-darwin-arm64@1.2.14' - - '@rolldown/binding-darwin-x64@1.2.14' - - '@rolldown/binding-freebsd-x64@1.2.14' - - '@rolldown/binding-linux-arm-gnueabihf@1.2.14' - - '@rolldown/binding-linux-arm64-gnu@1.2.14' - - '@rolldown/binding-linux-arm64-musl@1.2.14' - - '@rolldown/binding-linux-ppc64-gnu@1.2.14' - - '@rolldown/binding-linux-s390x-gnu@1.2.14' - - '@rolldown/binding-linux-x64-gnu@1.2.14' - - '@rolldown/binding-linux-x64-musl@1.2.14' - - '@rolldown/binding-openharmony-arm64@1.2.14' - - '@rolldown/binding-win32-arm64-msvc@1.2.14' - - '@rolldown/binding-win32-x64-msvc@1.2.14' - - '@vitest/mocker@5.0.5' - - '@vitest/spy@5.0.5' - - 'electron-vite@6.0.0' - - 'rolldown@1.2.14' - - 'vitest@5.0.5' - - '@oxfmt/binding-android-arm-eabi@0.73.0' - - '@oxfmt/binding-android-arm64@0.73.0' - - '@oxfmt/binding-darwin-arm64@0.73.0' - - '@oxfmt/binding-darwin-x64@0.73.0' - - '@oxfmt/binding-freebsd-x64@0.73.0' - - '@oxfmt/binding-linux-arm-gnueabihf@0.73.0' - - '@oxfmt/binding-linux-arm-musleabihf@0.73.0' - - '@oxfmt/binding-linux-arm64-gnu@0.73.0' - - '@oxfmt/binding-linux-arm64-musl@0.73.0' - - '@oxfmt/binding-linux-ppc64-gnu@0.73.0' - - '@oxfmt/binding-linux-riscv64-gnu@0.73.0' - - '@oxfmt/binding-linux-riscv64-musl@0.73.0' - - '@oxfmt/binding-linux-s390x-gnu@0.73.0' - - '@oxfmt/binding-linux-x64-gnu@0.73.0' - - '@oxfmt/binding-linux-x64-musl@0.73.0' - - '@oxfmt/binding-openharmony-arm64@0.73.0' - - '@oxfmt/binding-win32-arm64-msvc@0.73.0' - - '@oxfmt/binding-win32-ia32-msvc@0.73.0' - - '@oxfmt/binding-win32-x64-msvc@0.73.0' - - '@oxlint/binding-android-arm-eabi@1.88.0' - - '@oxlint/binding-android-arm64@1.88.0' - - '@oxlint/binding-darwin-arm64@1.88.0' - - '@oxlint/binding-darwin-x64@1.88.0' - - '@oxlint/binding-freebsd-x64@1.88.0' - - '@oxlint/binding-linux-arm-gnueabihf@1.88.0' - - '@oxlint/binding-linux-arm-musleabihf@1.88.0' - - '@oxlint/binding-linux-arm64-gnu@1.88.0' - - '@oxlint/binding-linux-arm64-musl@1.88.0' - - '@oxlint/binding-linux-ppc64-gnu@1.88.0' - - '@oxlint/binding-linux-riscv64-gnu@1.88.0' - - '@oxlint/binding-linux-riscv64-musl@1.88.0' - - '@oxlint/binding-linux-s390x-gnu@1.88.0' - - '@oxlint/binding-linux-x64-gnu@1.88.0' - - '@oxlint/binding-linux-x64-musl@1.88.0' - - '@oxlint/binding-openharmony-arm64@1.88.0' - - '@oxlint/binding-win32-arm64-msvc@1.88.0' - - '@oxlint/binding-win32-ia32-msvc@1.88.0' - - '@oxlint/binding-win32-x64-msvc@1.88.0' - - '@oxlint/plugins@1.88.0' - - oxfmt@0.73.0 - - oxlint@1.88.0 shamefullyHoist: true # Enables pnpm's global virtual store outside CI; under config/ because the repo root only admits