fix: remediate dependency security advisories across workspaces (#31681)

* fix: remediate dependency security advisories across workspaces * test: verify security patches without ad hoc dependency installs
2026-10-30 16:47:34 +00:00 · 2026-10-21 16:31:17 -07:00
parent bc7c15469b
commit 5f50b95c9c
29 changed files with 700 additions and 326 deletions
@@ -19,7 +19,7 @@
    "@orca-cloud/postgres-schema": "workspace:*",
    "@orca-cloud/push-contract": "workspace:*",
    "google-auth-library": "^10.5.0",
-    "hono": "^4.13.10",
+    "hono": "^4.13.11",
    "pg": "^8.22.0",
    "pg-connection-string": "2.14.0",
    "tweetnacl": "^1.0.3",
@@ -30,6 +30,6 @@
    "@types/pg": "^8.20.0",
    "tsx": "^4.23.15",
    "typescript": "^5.9.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
  }
 }
@@ -15,13 +15,13 @@
  },
  "dependencies": {
    "@hono/node-server": "^2.1.2",
-    "hono": "^4.13.10",
+    "hono": "^4.13.11",
    "zod": "^3.25.76"
  },
  "devDependencies": {
    "@types/node": "^24.19.0",
    "tsx": "^4.23.15",
    "typescript": "^5.9.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
  }
 }
@@ -18,13 +18,13 @@
  },
  "dependencies": {
    "@hono/node-server": "^2.1.2",
-    "hono": "^4.13.10",
+    "hono": "^4.13.11",
    "zod": "^3.25.76"
  },
  "devDependencies": {
    "@types/node": "^24.19.0",
    "tsx": "^4.23.15",
    "typescript": "^5.9.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
  }
 }
@@ -18,7 +18,7 @@
    "@hono/node-server": "^2.1.2",
    "@orca-cloud/postgres-schema": "workspace:*",
    "@orca-cloud/relay-contract": "workspace:*",
-    "hono": "^4.13.10",
+    "hono": "^4.13.11",
    "jose": "^6.2.12",
    "pg": "^8.22.0",
    "tweetnacl": "^1.0.3",
@@ -31,6 +31,6 @@
    "@types/ws": "^8.18.1",
    "tsx": "^4.23.15",
    "typescript": "^5.9.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
  }
 }
@@ -26,7 +26,7 @@
    "@types/node": "^24.19.0",
    "tsx": "^4.23.15",
    "typescript": "^5.9.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
  },
  "engines": {
    "node": ">=24 <27",
@@ -15,6 +15,6 @@
  "devDependencies": {
    "@types/node": "^24.19.0",
    "typescript": "^5.9.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
  }
 }
@@ -18,6 +18,6 @@
  "devDependencies": {
    "@types/node": "^24.19.0",
    "typescript": "^5.9.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
  }
 }
@@ -18,6 +18,6 @@
  "devDependencies": {
    "@types/node": "^24.19.0",
    "typescript": "^5.9.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
  }
 }
@@ -162,6 +162,9 @@ settings:
  autoInstallPeers: true
  excludeLinksFromLockfile: false

+overrides:
+  vite@>=8.0.0 <8.1.6: 8.3.4
+
 importers:

  .:
@@ -179,14 +182,14 @@ importers:
        specifier: ^5.9.3
        version: 5.9.3
      vitest:
-        specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))
+        specifier: ^4.1.12
+        version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))

  apps/push:
    dependencies:
      '@hono/node-server':
        specifier: ^2.1.2
-        version: 2.1.2(hono@4.13.10)
+        version: 2.1.2(hono@4.13.13)
      '@orca-cloud/postgres-schema':
        specifier: workspace:*
        version: link:../../packages/postgres-schema
@@ -197,8 +200,8 @@ importers:
        specifier: ^10.5.0
        version: 10.9.1
      hono:
-        specifier: ^4.13.10
-        version: 4.13.10
+        specifier: ^4.13.11
+        version: 4.13.13
      pg:
        specifier: ^8.22.0
        version: 8.22.0
@@ -225,14 +228,14 @@ importers:
        specifier: ^5.9.3
        version: 5.9.3
      vitest:
-        specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))
+        specifier: ^4.1.12
+        version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))

  apps/relay:
    dependencies:
      '@hono/node-server':
        specifier: ^2.1.2
-        version: 2.1.2(hono@4.13.10)
+        version: 2.1.2(hono@4.13.13)
      '@orca-cloud/postgres-schema':
        specifier: workspace:*
        version: link:../../packages/postgres-schema
@@ -240,8 +243,8 @@ importers:
        specifier: workspace:*
        version: link:../../packages/relay-contract
      hono:
-        specifier: ^4.13.10
-        version: 4.13.10
+        specifier: ^4.13.11
+        version: 4.13.13
      jose:
        specifier: ^6.2.12
        version: 6.2.12
@@ -274,17 +277,17 @@ importers:
        specifier: ^5.9.3
        version: 5.9.3
      vitest:
-        specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))
+        specifier: ^4.1.12
+        version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))

  apps/relay-fence-broker:
    dependencies:
      '@hono/node-server':
        specifier: ^2.1.2
-        version: 2.1.2(hono@4.13.10)
+        version: 2.1.2(hono@4.13.13)
      hono:
-        specifier: ^4.13.10
-        version: 4.13.10
+        specifier: ^4.13.11
+        version: 4.13.13
      zod:
        specifier: ^3.25.76
        version: 3.25.76
@@ -299,17 +302,17 @@ importers:
        specifier: ^5.9.3
        version: 5.9.3
      vitest:
-        specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))
+        specifier: ^4.1.12
+        version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))

  apps/relay-ops:
    dependencies:
      '@hono/node-server':
        specifier: ^2.1.2
-        version: 2.1.2(hono@4.13.10)
+        version: 2.1.2(hono@4.13.13)
      hono:
-        specifier: ^4.13.10
-        version: 4.13.10
+        specifier: ^4.13.11
+        version: 4.13.13
      zod:
        specifier: ^3.25.76
        version: 3.25.76
@@ -324,8 +327,8 @@ importers:
        specifier: ^5.9.3
        version: 5.9.3
      vitest:
-        specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))
+        specifier: ^4.1.12
+        version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))

  packages/postgres-schema:
    devDependencies:
@@ -336,8 +339,8 @@ importers:
        specifier: ^5.9.3
        version: 5.9.3
      vitest:
-        specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))
+        specifier: ^4.1.12
+        version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))

  packages/push-contract:
    dependencies:
@@ -352,8 +355,8 @@ importers:
        specifier: ^5.9.3
        version: 5.9.3
      vitest:
-        specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))
+        specifier: ^4.1.12
+        version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))

  packages/relay-contract:
    dependencies:
@@ -368,20 +371,11 @@ importers:
        specifier: ^5.9.3
        version: 5.9.3
      vitest:
-        specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))
+        specifier: ^4.1.12
+        version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))

 packages:

-  '@emnapi/core@1.10.0':
-    resolution: {integrity: sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==}
-
-  '@emnapi/runtime@1.10.0':
-    resolution: {integrity: sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==}
-
-  '@emnapi/wasi-threads@1.2.1':
-    resolution: {integrity: sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==}
-
  '@esbuild/aix-ppc64@0.28.2':
    resolution: {integrity: sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==}
    engines: {node: '>=18'}
@@ -547,107 +541,101 @@ packages:
  '@jridgewell/sourcemap-codec@1.5.5':
    resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}

-  '@napi-rs/wasm-runtime@1.2.5':
-    resolution: {integrity: sha512-HshSvXzmBxNzqejd3k/KemgQ3hdREUYFRRrgxOZ+gPljDIsO2SDZrVZMd4Z/HsxudQbE62OVyVFE8z9BCurfjA==}
-    engines: {node: ^20.19.0 || ^22.13.0 || >=23.5.0}
-    peerDependencies:
-      '@emnapi/core': ^1.7.1 || ^2.0.0-alpha.4
-      '@emnapi/runtime': ^1.7.1 || ^2.0.0-alpha.4
+  '@oxc-project/types@0.154.0':
+    resolution: {integrity: sha512-KYOUGQFlLWR+s4QMV2Q9ko38TZm7EdO87Qm7rvZLqk/webse/cDjtyxKhg/47l0byCbs/k46LT8qc4PKjAikzA==}

-  '@oxc-project/types@0.133.0':
-    resolution: {integrity: sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==}
+  '@rolldown/binding-android-arm-eabi@1.2.14':
+    resolution: {integrity: sha512-aWR+XKH9+rW7m5fWq/5360J3mHycrx/o6xZM2DQFdJnTMdyP7/WzxPjhtLbVWdKo2y612/4U1bWqb3HQhiF7vg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm]
+    os: [android]

-  '@rolldown/binding-android-arm64@1.0.3':
-    resolution: {integrity: sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==}
+  '@rolldown/binding-android-arm64@1.2.14':
+    resolution: {integrity: sha512-QiVxHofl6A8lQU7WAtOUY4QMVZXohxwz7WJJoeh8NBEUyKfIkMRKhYyq8az/1RypNiIXzNTtiS6KwHz0erxYRQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm64]
    os: [android]

-  '@rolldown/binding-darwin-arm64@1.0.3':
-    resolution: {integrity: sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==}
+  '@rolldown/binding-darwin-arm64@1.2.14':
+    resolution: {integrity: sha512-lTQOzHuBIooh3jIr5XINQkjPGEuGy+Dsy0meXDr6Sjty0b99kYgGh4uBC/8mJX1T0kC8d6S0aPP1Y+bHkh6aBw==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm64]
    os: [darwin]

-  '@rolldown/binding-darwin-x64@1.0.3':
-    resolution: {integrity: sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==}
+  '@rolldown/binding-darwin-x64@1.2.14':
+    resolution: {integrity: sha512-hyMKEGatjmBYCs/Q4sbIcL/GqpFEqsX3wc+HYVQ/85A4rxc1o7rPm4DUI4GV4k/h0ITddwFSGpqQunI14GXjTA==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [x64]
    os: [darwin]

-  '@rolldown/binding-freebsd-x64@1.0.3':
-    resolution: {integrity: sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==}
+  '@rolldown/binding-freebsd-x64@1.2.14':
+    resolution: {integrity: sha512-u371GbXoVXrEgP20PwzoGNOdAOqAMhzo19JzzY+V4YmmnC+DTOoqdbMu+O+54emM59Mik/UdrtWgcuEDKWRPKA==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [x64]
    os: [freebsd]

-  '@rolldown/binding-linux-arm-gnueabihf@1.0.3':
-    resolution: {integrity: sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==}
+  '@rolldown/binding-linux-arm-gnueabihf@1.2.14':
+    resolution: {integrity: sha512-BqwKsdZQf6EqVWr8fv2MrDYzAvOZ7+NYFSJESRGs87fkseEhs0TU9TXgRJTkZoRRkxTizyEg1LKUXfU3/78uqg==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm]
    os: [linux]

-  '@rolldown/binding-linux-arm64-gnu@1.0.3':
-    resolution: {integrity: sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==}
+  '@rolldown/binding-linux-arm64-gnu@1.2.14':
+    resolution: {integrity: sha512-SD9kY8M009x/7s57Z1dgUVlP5+uYBgKQK0Tkr1WIWngrtUJmRCW1RJFMY7QDla2khXhmg2i5Io7MUjcmZNZ/KQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm64]
    os: [linux]
    libc: [glibc]

-  '@rolldown/binding-linux-arm64-musl@1.0.3':
-    resolution: {integrity: sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==}
+  '@rolldown/binding-linux-arm64-musl@1.2.14':
+    resolution: {integrity: sha512-BJ2CL19M6uuWesMgnqJzgxoI+N+eV7b0A9O9vLV42y+gitC41fNa8KElau1tHVzuLWX5GzEuxMPhAO0tQXQMkg==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm64]
    os: [linux]
    libc: [musl]

-  '@rolldown/binding-linux-ppc64-gnu@1.0.3':
-    resolution: {integrity: sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==}
+  '@rolldown/binding-linux-ppc64-gnu@1.2.14':
+    resolution: {integrity: sha512-4+Kl8daPV8NDHaD7mfCcc1pRM+Qg7ab8DyMm5FG5WoZgv4h2i3KFN1CybYBNbQqmuYm7ftJLvmMI1eHYJ22S/Q==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [ppc64]
    os: [linux]
    libc: [glibc]

-  '@rolldown/binding-linux-s390x-gnu@1.0.3':
-    resolution: {integrity: sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==}
+  '@rolldown/binding-linux-s390x-gnu@1.2.14':
+    resolution: {integrity: sha512-V/h8ePq1fKDrmtFMz6xcCN3DKvuvMRrwwD1q0PkBeeo4DpK64biaKvqWGVxqCeYKqeRk7gE7/iKPxLCn08O97A==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [s390x]
    os: [linux]
    libc: [glibc]

-  '@rolldown/binding-linux-x64-gnu@1.0.3':
-    resolution: {integrity: sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==}
+  '@rolldown/binding-linux-x64-gnu@1.2.14':
+    resolution: {integrity: sha512-WxalXzgrLVpKC93xfpaJ3gCXUWzeCr+FRCbDVD2mUAy4L6Vo3lNVz0epUEUpxPWJkLNYUwM4OSIikv36OJ9mLg==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [x64]
    os: [linux]
    libc: [glibc]

-  '@rolldown/binding-linux-x64-musl@1.0.3':
-    resolution: {integrity: sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==}
+  '@rolldown/binding-linux-x64-musl@1.2.14':
+    resolution: {integrity: sha512-3G3tnAmTpdk9jO3GQtyHXqeFD2SlecfTws/Y3M2mmj9nMBwwuLT4kur8sZKeu7ENUHSpVO3cIsm5A52LEWWwlg==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [x64]
    os: [linux]
    libc: [musl]

-  '@rolldown/binding-openharmony-arm64@1.0.3':
-    resolution: {integrity: sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==}
+  '@rolldown/binding-openharmony-arm64@1.2.14':
+    resolution: {integrity: sha512-qyr5XiNGxm2ytx17vvtcJ9nXn6v1gENETi503bJx3OGwZ1tSonj7BosxbMa/xeAfSl5iS9X6KjEWYXLu6v1L7Q==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm64]
    os: [openharmony]

-  '@rolldown/binding-wasm32-wasi@1.0.3':
-    resolution: {integrity: sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    cpu: [wasm32]
-
-  '@rolldown/binding-win32-arm64-msvc@1.0.3':
-    resolution: {integrity: sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==}
+  '@rolldown/binding-win32-arm64-msvc@1.2.14':
+    resolution: {integrity: sha512-oA4o5o0S2yB199YyYXDzKUv1Z56Rc+mgOjwm7Z/vJ9Z8igiDPYvoOuDyo6g7AK/ZaF09nPhDKVnGBcYHO11GXA==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [arm64]
    os: [win32]

-  '@rolldown/binding-win32-x64-msvc@1.0.3':
-    resolution: {integrity: sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==}
+  '@rolldown/binding-win32-x64-msvc@1.2.14':
+    resolution: {integrity: sha512-9mE94bf2GZUaR/fUSXCMpBoWkctu421Mi0ORpm4zqfbkjKep7RxzPFa5etcGs5h+2KApoWBOA/hAJa/7saGgEQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
    cpu: [x64]
    os: [win32]
@@ -658,9 +646,6 @@ packages:
  '@standard-schema/spec@1.1.0':
    resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}

-  '@tybys/wasm-util@0.10.4':
-    resolution: {integrity: sha512-W3c4gRigFS0T/Ma4qIYF3GDAc5AQdHb1yL5znJT1Zv1YaD9Kitx656wBjvr19qbiosmZT8lWDM5BEMynUqX65A==}
-
  '@types/chai@5.2.3':
    resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}

@@ -679,34 +664,34 @@ packages:
  '@types/ws@8.18.1':
    resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==}

-  '@vitest/expect@4.1.11':
-    resolution: {integrity: sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==}
+  '@vitest/expect@4.1.12':
+    resolution: {integrity: sha512-vFlTt+YEu9WBpNjdGayNmlMVzrWPi1+sv853/7t2FU7hpO5gAFBKHzQmkCq5Xjpr+evegF2994LQT3hF3mRlqQ==}

-  '@vitest/mocker@4.1.11':
-    resolution: {integrity: sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==}
+  '@vitest/mocker@4.1.12':
+    resolution: {integrity: sha512-fKShNpKZzupWZuY0z7egydvL0sqW4INEZBEExMBMAa6izlENEVHwoXgdaTCaBZ5fwlr4xf2o1wXC83n9RpO+NA==}
    peerDependencies:
      msw: ^2.4.9
-      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+      vite: 8.3.4
    peerDependenciesMeta:
      msw:
        optional: true
      vite:
        optional: true

-  '@vitest/pretty-format@4.1.11':
-    resolution: {integrity: sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==}
+  '@vitest/pretty-format@4.1.12':
+    resolution: {integrity: sha512-XW9O8+Mxx4VpCtkYdMJLZQQwsVryP9wk7cPKDxtXFfwSak6yRh5+2fep/Y0XF/ElBvJHq8bcYdi6aeuai0opZA==}

-  '@vitest/runner@4.1.11':
-    resolution: {integrity: sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==}
+  '@vitest/runner@4.1.12':
+    resolution: {integrity: sha512-NKlVKCr5QnCe8jijdMnmkpHHU+WTqiLFR6G0pHji9uRjXK9xJl1k1nTw6F3pOOj2PDcsDt2GKQMI7wIsaT491w==}

-  '@vitest/snapshot@4.1.11':
-    resolution: {integrity: sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==}
+  '@vitest/snapshot@4.1.12':
+    resolution: {integrity: sha512-ko1y1Qgb/slzQ9mr+b89Cuqud8WG1TKtsPD8r7ZUBdvVOGt85Af2HwCqHujrhwJq95hs/9RM7fcAPg57o1vlzw==}

-  '@vitest/spy@4.1.11':
-    resolution: {integrity: sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==}
+  '@vitest/spy@4.1.12':
+    resolution: {integrity: sha512-RGq9x4JNGNTZHEJxvN0oSiJjeSCExm0n2gZKKJZHY9cX5AVA6M7VJILBT3ZJ/tJ/0J9uWT7fETV9/btoi//vSg==}

-  '@vitest/utils@4.1.11':
-    resolution: {integrity: sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==}
+  '@vitest/utils@4.1.12':
+    resolution: {integrity: sha512-Q3awXrwOfEV+qc3WmO5ONyE0yO7Q1gQ9/oyHxGLZ/pl7N3NO/ZztqQwKLuwMkV+CA1JYSIeO3gkHnRDIo4AVaA==}

  agent-base@7.1.4:
    resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==}
@@ -808,8 +793,8 @@ packages:
    resolution: {integrity: sha512-eAmLkjDjAFCVXg7A1unxHsLf961m6y17QFqXqAXGj/gVkKFrEICfStRfwUlGNfeCEjNRa32JEWOUTlYXPyyKvA==}
    engines: {node: '>=14'}

-  hono@4.13.10:
-    resolution: {integrity: sha512-dQuLsa5oO+47QVMVMaaD9cIv8ctmVtK1iRvwWngkfloFJMeFeuoUFDswIqZGxmGX3hrRzREgEArjkK9OgsQEhA==}
+  hono@4.13.13:
+    resolution: {integrity: sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==}
    engines: {node: '>=16.9.0'}

  https-proxy-agent@7.0.6:
@@ -966,10 +951,6 @@ packages:
  picocolors@1.1.1:
    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}

-  picomatch@4.0.4:
-    resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
-    engines: {node: '>=12'}
-
  picomatch@4.0.7:
    resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==}
    engines: {node: '>=12'}
@@ -994,8 +975,8 @@ packages:
    resolution: {integrity: sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==}
    engines: {node: '>=0.10.0'}

-  rolldown@1.0.3:
-    resolution: {integrity: sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==}
+  rolldown@1.2.14:
+    resolution: {integrity: sha512-eTBTTqMR6uHKLgcUqpJP8ntzDI6V4LYA8negAMBEI7gkgVvOdrx6VsvS2Ym+83KhOPdLCHWJu0w7UQFJZhHKNw==}
    engines: {node: ^20.19.0 || >=22.12.0}
    hasBin: true

@@ -1034,9 +1015,6 @@ packages:
    resolution: {integrity: sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==}
    engines: {node: '>=14.0.0'}

-  tslib@2.8.1:
-    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
-
  tsx@4.23.15:
    resolution: {integrity: sha512-Yiex1Ovn8z2xPpOWckIiysV1SSyRMY9BkLF++q0yKiDxCqRhosKfMg3janKkiLBwZ5c/YryloKwGZcrEmtwxKw==}
    engines: {node: '>=18.0.0'}
@@ -1053,13 +1031,13 @@ packages:
  undici-types@7.24.6:
    resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}

-  vite@8.0.16:
-    resolution: {integrity: sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==}
+  vite@8.3.4:
+    resolution: {integrity: sha512-IftLE8phJhdNRIGNEV4JCCvfNScoZQVfcXaN8TQropWGJtOHcu+iAB9pHcuGvmEb/kddw0LBe/jS8ztdC6xdiQ==}
    engines: {node: ^20.19.0 || >=22.12.0}
    hasBin: true
    peerDependencies:
      '@types/node': ^20.19.0 || >=22.12.0
-      '@vitejs/devtools': ^0.1.18
+      '@vitejs/devtools': ^0.7.1
      esbuild: ^0.27.0 || ^0.28.0
      jiti: '>=1.21.0'
      less: ^4.0.0
@@ -1096,23 +1074,23 @@ packages:
      yaml:
        optional: true

-  vitest@4.1.11:
-    resolution: {integrity: sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==}
+  vitest@4.1.12:
+    resolution: {integrity: sha512-5eWdz2yb3ajxWF3C8C4TjkXl7FGm3n2E/VlazALrQHzK7nYMSGFnCZto0bbPNl77AwkOZVLk0YnBAejUu0NiWA==}
    engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
    hasBin: true
    peerDependencies:
      '@edge-runtime/vm': '*'
      '@opentelemetry/api': ^1.9.0
      '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
-      '@vitest/browser-playwright': 4.1.11
-      '@vitest/browser-preview': 4.1.11
-      '@vitest/browser-webdriverio': 4.1.11
-      '@vitest/coverage-istanbul': 4.1.11
-      '@vitest/coverage-v8': 4.1.11
-      '@vitest/ui': 4.1.11
+      '@vitest/browser-playwright': 4.1.12
+      '@vitest/browser-preview': 4.1.12
+      '@vitest/browser-webdriverio': ^4.1.11
+      '@vitest/coverage-istanbul': 4.1.12
+      '@vitest/coverage-v8': 4.1.12
+      '@vitest/ui': 4.1.12
      happy-dom: '*'
      jsdom: '*'
-      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+      vite: 8.3.4
    peerDependenciesMeta:
      '@edge-runtime/vm':
        optional: true
@@ -1167,22 +1145,6 @@ packages:

 snapshots:

-  '@emnapi/core@1.10.0':
-    dependencies:
-      '@emnapi/wasi-threads': 1.2.1
-      tslib: 2.8.1
-    optional: true
-
-  '@emnapi/runtime@1.10.0':
-    dependencies:
-      tslib: 2.8.1
-    optional: true
-
-  '@emnapi/wasi-threads@1.2.1':
-    dependencies:
-      tslib: 2.8.1
-    optional: true
-
  '@esbuild/aix-ppc64@0.28.2':
    optional: true

@@ -1261,79 +1223,63 @@ snapshots:
  '@esbuild/win32-x64@0.28.2':
    optional: true

-  '@hono/node-server@2.1.2(hono@4.13.10)':
+  '@hono/node-server@2.1.2(hono@4.13.13)':
    dependencies:
-      hono: 4.13.10
+      hono: 4.13.13

  '@jridgewell/sourcemap-codec@1.5.5': {}

-  '@napi-rs/wasm-runtime@1.2.5(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)':
-    dependencies:
-      '@emnapi/core': 1.10.0
-      '@emnapi/runtime': 1.10.0
-      '@tybys/wasm-util': 0.10.4
+  '@oxc-project/types@0.154.0': {}
+
+  '@rolldown/binding-android-arm-eabi@1.2.14':
    optional: true

-  '@oxc-project/types@0.133.0': {}
-
-  '@rolldown/binding-android-arm64@1.0.3':
+  '@rolldown/binding-android-arm64@1.2.14':
    optional: true

-  '@rolldown/binding-darwin-arm64@1.0.3':
+  '@rolldown/binding-darwin-arm64@1.2.14':
    optional: true

-  '@rolldown/binding-darwin-x64@1.0.3':
+  '@rolldown/binding-darwin-x64@1.2.14':
    optional: true

-  '@rolldown/binding-freebsd-x64@1.0.3':
+  '@rolldown/binding-freebsd-x64@1.2.14':
    optional: true

-  '@rolldown/binding-linux-arm-gnueabihf@1.0.3':
+  '@rolldown/binding-linux-arm-gnueabihf@1.2.14':
    optional: true

-  '@rolldown/binding-linux-arm64-gnu@1.0.3':
+  '@rolldown/binding-linux-arm64-gnu@1.2.14':
    optional: true

-  '@rolldown/binding-linux-arm64-musl@1.0.3':
+  '@rolldown/binding-linux-arm64-musl@1.2.14':
    optional: true

-  '@rolldown/binding-linux-ppc64-gnu@1.0.3':
+  '@rolldown/binding-linux-ppc64-gnu@1.2.14':
    optional: true

-  '@rolldown/binding-linux-s390x-gnu@1.0.3':
+  '@rolldown/binding-linux-s390x-gnu@1.2.14':
    optional: true

-  '@rolldown/binding-linux-x64-gnu@1.0.3':
+  '@rolldown/binding-linux-x64-gnu@1.2.14':
    optional: true

-  '@rolldown/binding-linux-x64-musl@1.0.3':
+  '@rolldown/binding-linux-x64-musl@1.2.14':
    optional: true

-  '@rolldown/binding-openharmony-arm64@1.0.3':
+  '@rolldown/binding-openharmony-arm64@1.2.14':
    optional: true

-  '@rolldown/binding-wasm32-wasi@1.0.3':
-    dependencies:
-      '@emnapi/core': 1.10.0
-      '@emnapi/runtime': 1.10.0
-      '@napi-rs/wasm-runtime': 1.2.5(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+  '@rolldown/binding-win32-arm64-msvc@1.2.14':
    optional: true

-  '@rolldown/binding-win32-arm64-msvc@1.0.3':
-    optional: true
-
-  '@rolldown/binding-win32-x64-msvc@1.0.3':
+  '@rolldown/binding-win32-x64-msvc@1.2.14':
    optional: true

  '@rolldown/pluginutils@1.0.1': {}

  '@standard-schema/spec@1.1.0': {}

-  '@tybys/wasm-util@0.10.4':
-    dependencies:
-      tslib: 2.8.1
-    optional: true
-
  '@types/chai@5.2.3':
    dependencies:
      '@types/deep-eql': 4.0.2
@@ -1357,44 +1303,44 @@ snapshots:
    dependencies:
      '@types/node': 24.19.0

-  '@vitest/expect@4.1.11':
+  '@vitest/expect@4.1.12':
    dependencies:
      '@standard-schema/spec': 1.1.0
      '@types/chai': 5.2.3
-      '@vitest/spy': 4.1.11
-      '@vitest/utils': 4.1.11
+      '@vitest/spy': 4.1.12
+      '@vitest/utils': 4.1.12
      chai: 6.2.2
      tinyrainbow: 3.1.0

-  '@vitest/mocker@4.1.11(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))':
+  '@vitest/mocker@4.1.12(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))':
    dependencies:
-      '@vitest/spy': 4.1.11
+      '@vitest/spy': 4.1.12
      estree-walker: 3.0.3
      magic-string: 0.30.21
    optionalDependencies:
-      vite: 8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)
+      vite: 8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)

-  '@vitest/pretty-format@4.1.11':
+  '@vitest/pretty-format@4.1.12':
    dependencies:
      tinyrainbow: 3.1.0

-  '@vitest/runner@4.1.11':
+  '@vitest/runner@4.1.12':
    dependencies:
-      '@vitest/utils': 4.1.11
+      '@vitest/utils': 4.1.12
      pathe: 2.0.3

-  '@vitest/snapshot@4.1.11':
+  '@vitest/snapshot@4.1.12':
    dependencies:
-      '@vitest/pretty-format': 4.1.11
-      '@vitest/utils': 4.1.11
+      '@vitest/pretty-format': 4.1.12
+      '@vitest/utils': 4.1.12
      magic-string: 0.30.21
      pathe: 2.0.3

-  '@vitest/spy@4.1.11': {}
+  '@vitest/spy@4.1.12': {}

-  '@vitest/utils@4.1.11':
+  '@vitest/utils@4.1.12':
    dependencies:
-      '@vitest/pretty-format': 4.1.11
+      '@vitest/pretty-format': 4.1.12
      convert-source-map: 2.0.0
      tinyrainbow: 3.1.0

@@ -1463,9 +1409,9 @@ snapshots:

  extend@3.0.2: {}

-  fdir@6.5.0(picomatch@4.0.4):
+  fdir@6.5.0(picomatch@4.0.7):
    optionalDependencies:
-      picomatch: 4.0.4
+      picomatch: 4.0.7

  fetch-blob@3.2.0:
    dependencies:
@@ -1508,7 +1454,7 @@ snapshots:

  google-logging-utils@1.1.3: {}

-  hono@4.13.10: {}
+  hono@4.13.13: {}

  https-proxy-agent@7.0.6:
    dependencies:
@@ -1640,8 +1586,6 @@ snapshots:

  picocolors@1.1.1: {}

-  picomatch@4.0.4: {}
-
  picomatch@4.0.7: {}

  postcss@8.5.30:
@@ -1660,26 +1604,26 @@ snapshots:
    dependencies:
      xtend: 4.0.2

-  rolldown@1.0.3:
+  rolldown@1.2.14:
    dependencies:
-      '@oxc-project/types': 0.133.0
+      '@oxc-project/types': 0.154.0
      '@rolldown/pluginutils': 1.0.1
    optionalDependencies:
-      '@rolldown/binding-android-arm64': 1.0.3
-      '@rolldown/binding-darwin-arm64': 1.0.3
-      '@rolldown/binding-darwin-x64': 1.0.3
-      '@rolldown/binding-freebsd-x64': 1.0.3
-      '@rolldown/binding-linux-arm-gnueabihf': 1.0.3
-      '@rolldown/binding-linux-arm64-gnu': 1.0.3
-      '@rolldown/binding-linux-arm64-musl': 1.0.3
-      '@rolldown/binding-linux-ppc64-gnu': 1.0.3
-      '@rolldown/binding-linux-s390x-gnu': 1.0.3
-      '@rolldown/binding-linux-x64-gnu': 1.0.3
-      '@rolldown/binding-linux-x64-musl': 1.0.3
-      '@rolldown/binding-openharmony-arm64': 1.0.3
-      '@rolldown/binding-wasm32-wasi': 1.0.3
-      '@rolldown/binding-win32-arm64-msvc': 1.0.3
-      '@rolldown/binding-win32-x64-msvc': 1.0.3
+      '@rolldown/binding-android-arm-eabi': 1.2.14
+      '@rolldown/binding-android-arm64': 1.2.14
+      '@rolldown/binding-darwin-arm64': 1.2.14
+      '@rolldown/binding-darwin-x64': 1.2.14
+      '@rolldown/binding-freebsd-x64': 1.2.14
+      '@rolldown/binding-linux-arm-gnueabihf': 1.2.14
+      '@rolldown/binding-linux-arm64-gnu': 1.2.14
+      '@rolldown/binding-linux-arm64-musl': 1.2.14
+      '@rolldown/binding-linux-ppc64-gnu': 1.2.14
+      '@rolldown/binding-linux-s390x-gnu': 1.2.14
+      '@rolldown/binding-linux-x64-gnu': 1.2.14
+      '@rolldown/binding-linux-x64-musl': 1.2.14
+      '@rolldown/binding-openharmony-arm64': 1.2.14
+      '@rolldown/binding-win32-arm64-msvc': 1.2.14
+      '@rolldown/binding-win32-x64-msvc': 1.2.14

  safe-buffer@5.2.1: {}

@@ -1699,14 +1643,11 @@ snapshots:

  tinyglobby@0.2.17:
    dependencies:
-      fdir: 6.5.0(picomatch@4.0.4)
-      picomatch: 4.0.4
+      fdir: 6.5.0(picomatch@4.0.7)
+      picomatch: 4.0.7

  tinyrainbow@3.1.0: {}

-  tslib@2.8.1:
-    optional: true
-
  tsx@4.23.15:
    dependencies:
      esbuild: 0.28.2
@@ -1719,12 +1660,12 @@ snapshots:

  undici-types@7.24.6: {}

-  vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15):
+  vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15):
    dependencies:
      lightningcss: 1.33.0
      picomatch: 4.0.7
      postcss: 8.5.30
-      rolldown: 1.0.3
+      rolldown: 1.2.14
      tinyglobby: 0.2.17
    optionalDependencies:
      '@types/node': 24.19.0
@@ -1732,27 +1673,27 @@ snapshots:
      fsevents: 2.3.3
      tsx: 4.23.15

-  vitest@4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)):
+  vitest@4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)):
    dependencies:
-      '@vitest/expect': 4.1.11
-      '@vitest/mocker': 4.1.11(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))
-      '@vitest/pretty-format': 4.1.11
-      '@vitest/runner': 4.1.11
-      '@vitest/snapshot': 4.1.11
-      '@vitest/spy': 4.1.11
-      '@vitest/utils': 4.1.11
+      '@vitest/expect': 4.1.12
+      '@vitest/mocker': 4.1.12(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))
+      '@vitest/pretty-format': 4.1.12
+      '@vitest/runner': 4.1.12
+      '@vitest/snapshot': 4.1.12
+      '@vitest/spy': 4.1.12
+      '@vitest/utils': 4.1.12
      es-module-lexer: 2.1.0
      expect-type: 1.3.0
      magic-string: 0.30.21
      obug: 2.1.3
      pathe: 2.0.3
-      picomatch: 4.0.4
+      picomatch: 4.0.7
      std-env: 4.1.0
      tinybench: 2.9.0
      tinyexec: 1.2.4
      tinyglobby: 0.2.17
      tinyrainbow: 3.1.0
-      vite: 8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)
+      vite: 8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)
      why-is-node-running: 2.3.0
    optionalDependencies:
      '@types/node': 24.19.0
@@ -8,3 +8,6 @@ engineStrict: false
 # pnpm 10 skipped this unlisted build script; keep the binary-only install it produced.
 allowBuilds:
  esbuild: false
+
+overrides:
+  vite@>=8.0.0 <8.1.6: 8.3.4
@@ -162,6 +162,9 @@ settings:
  autoInstallPeers: true
  excludeLinksFromLockfile: false

+patchedDependencies:
+  braces@3.0.3: c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd
+
 importers:

  .:
@@ -2044,7 +2047,7 @@ snapshots:
    dependencies:
      balanced-match: 4.0.4

-  braces@3.0.3:
+  braces@3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd):
    dependencies:
      fill-range: 7.1.1

@@ -2404,7 +2407,7 @@ snapshots:

  micromatch@4.0.8:
    dependencies:
-      braces: 3.0.3
+      braces: 3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd)
      picomatch: 2.3.2

  mimic-function@5.0.1: {}
@@ -1,3 +1,6 @@
 minimumReleaseAge: 4320
 ignoreScripts: true
 allowBuilds: {}
+
+patchedDependencies:
+  braces@3.0.3: ../patches/braces@3.0.3.patch
@@ -0,0 +1,99 @@
+diff --git a/lib/compile.js b/lib/compile.js
+index dce69beb90ece5c3b0ca234a949418f9f34eedbc..6f63213f5da97c9c9989494c65e0c53a82e19d92 100644
+--- a/lib/compile.js
+++ b/lib/compile.js
+@@ -4,7 +4,10 @@ const fill = require('fill-range');
+ const utils = require('./utils');
+ 
+ const compile = (ast, options = {}) => {
+-  const walk = (node, parent = {}) => {
+  const walk = (node, parent = {}, depth = 0) => {
+    if (depth > 128) {
+      throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)');
+    }
+     const invalidBlock = utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+     const invalid = invalidBlock === true || invalidNode === true;
+@@ -47,7 +50,7 @@ const compile = (ast, options = {}) => {
+ 
+     if (node.nodes) {
+       for (const child of node.nodes) {
+-        output += walk(child, node);
+        output += walk(child, node, depth + 1);
+       }
+     }
+ 
+diff --git a/lib/expand.js b/lib/expand.js
+index 35b2c41d6afdb8f0197959e26079f266e48370d3..342b39e342b0ab0365edde268f2abac378db095a 100644
+--- a/lib/expand.js
+++ b/lib/expand.js
+@@ -33,7 +33,10 @@ const append = (queue = '', stash = '', enclose = false) => {
+ const expand = (ast, options = {}) => {
+   const rangeLimit = options.rangeLimit === undefined ? 1000 : options.rangeLimit;
+ 
+-  const walk = (node, parent = {}) => {
+  const walk = (node, parent = {}, depth = 0) => {
+    if (depth > 128) {
+      throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)');
+    }
+     node.queue = [];
+ 
+     let p = parent;
+@@ -100,7 +103,7 @@ const expand = (ast, options = {}) => {
+       }
+ 
+       if (child.nodes) {
+-        walk(child, node);
+        walk(child, node, depth + 1);
+       }
+     }
+ 
+diff --git a/lib/parse.js b/lib/parse.js
+index 3a6988e629f52aee6609dc5ec290a5e9ff47cecb..f91b5c272bf7d399b88fed7be553fe1d140da972 100644
+--- a/lib/parse.js
+++ b/lib/parse.js
+@@ -143,6 +143,9 @@ const parse = (input, options = {}) => {
+      */
+ 
+     if (value === CHAR_LEFT_PARENTHESES) {
+      if (stack.length > 128) {
+        throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)');
+      }
+       block = push({ type: 'paren', nodes: [] });
+       stack.push(block);
+       push({ type: 'text', value });
+@@ -195,6 +198,9 @@ const parse = (input, options = {}) => {
+      */
+ 
+     if (value === CHAR_LEFT_CURLY_BRACE) {
+      if (stack.length > 128) {
+        throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)');
+      }
+       depth++;
+ 
+       const dollar = prev.value && prev.value.slice(-1) === '$' || block.dollar === true;
+diff --git a/lib/stringify.js b/lib/stringify.js
+index 8bcf872c31894f81a8c64d9202fd607e4fd7ea2b..1f03c5cd154a8443f9b95a824ec4f315e7382e4f 100644
+--- a/lib/stringify.js
+++ b/lib/stringify.js
+@@ -3,7 +3,10 @@
+ const utils = require('./utils');
+ 
+ module.exports = (ast, options = {}) => {
+-  const stringify = (node, parent = {}) => {
+  const stringify = (node, parent = {}, depth = 0) => {
+    if (depth > 128) {
+      throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)');
+    }
+     const invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+     let output = '';
+@@ -21,7 +24,7 @@ module.exports = (ast, options = {}) => {
+ 
+     if (node.nodes) {
+       for (const child of node.nodes) {
+-        output += stringify(child);
+        output += stringify(child, {}, depth + 1);
+       }
+     }
+     return output;
@@ -0,0 +1,33 @@
+# Dependency security fixes
+
+These temporary patches cover advisories without a published fixed release.
+Replace each patch with an upstream fixed version when available. Raw registry
+audits continue to flag the original package versions; the patches do not rewrite
+versions or suppress advisories.
+
+| Package          | Advisory            | Mitigation                                                                                                                                                       |
+| ---------------- | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| braces 3.0.3     | GHSA-vfj7-8cjw-p6xm | Bound brace and parenthesis nesting and recursive AST walkers to 128 levels. Reject excessive nesting with a controlled SyntaxError before exhausting the stack. |
+| node-forge 1.4.0 | GHSA-86w9-cpqp-85rv | Require exactly the captured OID and optional NULL in the nested DigestAlgorithm sequence, rejecting unconsumed elements during RSA signature verification.      |
+| sprintf-js 1.1.3 | GHSA-hp3w-g68c-fv3c | Clamp numeric precision to the ECMAScript range before formatting; protect both Node and browser entries.                                                        |
+
+The braces patch applies to desktop, mobile, docs tooling, and isolated audit
+tools. The formatting patch applies to desktop and mobile; mobile's older
+sprintf-js 1.0.3 is first upgraded to 1.1.3. Mobile carries the RSA patch.
+Mobile patch files stay inside its independent workspace for standalone builds.
+
+`config/scripts/dependency-security-patches.test.mjs` exercises the installed
+desktop packages with deeply nested patterns, direct AST inputs, and excessive
+precision in both formatting entries. The mobile regression in
+`mobile/scripts/dependency-security-patches.test.ts` checks the installed Expo
+dependency and rejects a signed malformed DigestInfo while accepting a valid
+signature. Both suites use the packages installed from the workspace lockfiles;
+they do not run installs or access the registry. Normal patterns and formatting
+retain their previous behavior. Excessive brace patterns now fail explicitly;
+out-of-range numeric precision is clamped instead of throwing a RangeError.
+
+Published fixes are used for Hono, Markdown-it, Vite, Vitest, and path-to-regexp.
+No development dependency is omitted from the audit.
+
+The node-forge patch follows [upstream PR #1152](https://github.com/digitalbazaar/forge/pull/1152).
+Remove it when an upstream release includes that fix.
@@ -0,0 +1,24 @@
+diff --git a/dist/sprintf.min.js b/dist/sprintf.min.js
+--- a/dist/sprintf.min.js
+++ b/dist/sprintf.min.js
+@@ -1,3 +1,3 @@
+ /*! sprintf-js v1.1.3 | Copyright (c) 2007-present, Alexandru Mărășteanu <hello@alexei.ro> | BSD-3-Clause */
+-!function(){"use strict";var g={not_string:/[^s]/,not_bool:/[^t]/,not_type:/[^T]/,not_primitive:/[^v]/,number:/[diefg]/,numeric_arg:/[bcdiefguxX]/,json:/[j]/,not_json:/[^j]/,text:/^[^\x25]+/,modulo:/^\x25{2}/,placeholder:/^\x25(?:([1-9]\d*)\$|\(([^)]+)\))?(\+)?(0|'[^$])?(-)?(\d+)?(?:\.(\d+))?([b-gijostTuvxX])/,key:/^([a-z_][a-z_\d]*)/i,key_access:/^\.([a-z_][a-z_\d]*)/i,index_access:/^\[(\d+)\]/,sign:/^[+-]/};function y(e){return function(e,t){var r,n,i,s,a,o,p,c,l,u=1,f=e.length,d="";for(n=0;n<f;n++)if("string"==typeof e[n])d+=e[n];else if("object"==typeof e[n]){if((s=e[n]).keys)for(r=t[u],i=0;i<s.keys.length;i++){if(null==r)throw new Error(y('[sprintf] Cannot access property "%s" of undefined value "%s"',s.keys[i],s.keys[i-1]));r=r[s.keys[i]]}else r=s.param_no?t[s.param_no]:t[u++];if(g.not_type.test(s.type)&&g.not_primitive.test(s.type)&&r instanceof Function&&(r=r()),g.numeric_arg.test(s.type)&&"number"!=typeof r&&isNaN(r))throw new TypeError(y("[sprintf] expecting number but found %T",r));switch(g.number.test(s.type)&&(c=0<=r),s.type){case"b":r=parseInt(r,10).toString(2);break;case"c":r=String.fromCharCode(parseInt(r,10));break;case"d":case"i":r=parseInt(r,10);break;case"j":r=JSON.stringify(r,null,s.width?parseInt(s.width):0);break;case"e":r=s.precision?parseFloat(r).toExponential(s.precision):parseFloat(r).toExponential();break;case"f":r=s.precision?parseFloat(r).toFixed(s.precision):parseFloat(r);break;case"g":r=s.precision?String(Number(r.toPrecision(s.precision))):parseFloat(r);break;case"o":r=(parseInt(r,10)>>>0).toString(8);break;case"s":r=String(r),r=s.precision?r.substring(0,s.precision):r;break;case"t":r=String(!!r),r=s.precision?r.substring(0,s.precision):r;break;case"T":r=Object.prototype.toString.call(r).slice(8,-1).toLowerCase(),r=s.precision?r.substring(0,s.precision):r;break;case"u":r=parseInt(r,10)>>>0;break;case"v":r=r.valueOf(),r=s.precision?r.substring(0,s.precision):r;break;case"x":r=(parseInt(r,10)>>>0).toString(16);break;case"X":r=(parseInt(r,10)>>>0).toString(16).toUpperCase()}g.json.test(s.type)?d+=r:(!g.number.test(s.type)||c&&!s.sign?l="":(l=c?"+":"-",r=r.toString().replace(g.sign,"")),o=s.pad_char?"0"===s.pad_char?"0":s.pad_char.charAt(1):" ",p=s.width-(l+r).length,a=s.width&&0<p?o.repeat(p):"",d+=s.align?l+r+a:"0"===o?l+a+r:a+l+r)}return d}(function(e){if(p[e])return p[e];var t,r=e,n=[],i=0;for(;r;){if(null!==(t=g.text.exec(r)))n.push(t[0]);else if(null!==(t=g.modulo.exec(r)))n.push("%");else{if(null===(t=g.placeholder.exec(r)))throw new SyntaxError("[sprintf] unexpected placeholder");if(t[2]){i|=1;var s=[],a=t[2],o=[];if(null===(o=g.key.exec(a)))throw new SyntaxError("[sprintf] failed to parse named argument key");for(s.push(o[1]);""!==(a=a.substring(o[0].length));)if(null!==(o=g.key_access.exec(a)))s.push(o[1]);else{if(null===(o=g.index_access.exec(a)))throw new SyntaxError("[sprintf] failed to parse named argument key");s.push(o[1])}t[2]=s}else i|=2;if(3===i)throw new Error("[sprintf] mixing positional and named placeholders is not (yet) supported");n.push({placeholder:t[0],param_no:t[1],keys:t[2],sign:t[3],pad_char:t[4],align:t[5],width:t[6],precision:t[7],type:t[8]})}r=r.substring(t[0].length)}return p[e]=n}(e),arguments)}function e(e,t){return y.apply(null,[e].concat(t||[]))}var p=Object.create(null);"undefined"!=typeof exports&&(exports.sprintf=y,exports.vsprintf=e),"undefined"!=typeof window&&(window.sprintf=y,window.vsprintf=e,"function"==typeof define&&define.amd&&define(function(){return{sprintf:y,vsprintf:e}}))}();
+-//# sourceMappingURL=sprintf.min.js.map
+!function(){"use strict";var g={not_string:/[^s]/,not_bool:/[^t]/,not_type:/[^T]/,not_primitive:/[^v]/,number:/[diefg]/,numeric_arg:/[bcdiefguxX]/,json:/[j]/,not_json:/[^j]/,text:/^[^\x25]+/,modulo:/^\x25{2}/,placeholder:/^\x25(?:([1-9]\d*)\$|\(([^)]+)\))?(\+)?(0|'[^$])?(-)?(\d+)?(?:\.(\d+))?([b-gijostTuvxX])/,key:/^([a-z_][a-z_\d]*)/i,key_access:/^\.([a-z_][a-z_\d]*)/i,index_access:/^\[(\d+)\]/,sign:/^[+-]/};function y(e){return function(e,t){var r,n,i,s,a,o,p,c,l,u=1,f=e.length,d="";for(n=0;n<f;n++)if("string"==typeof e[n])d+=e[n];else if("object"==typeof e[n]){if((s=e[n]).keys)for(r=t[u],i=0;i<s.keys.length;i++){if(null==r)throw new Error(y('[sprintf] Cannot access property "%s" of undefined value "%s"',s.keys[i],s.keys[i-1]));r=r[s.keys[i]]}else r=s.param_no?t[s.param_no]:t[u++];if(g.not_type.test(s.type)&&g.not_primitive.test(s.type)&&r instanceof Function&&(r=r()),g.numeric_arg.test(s.type)&&"number"!=typeof r&&isNaN(r))throw new TypeError(y("[sprintf] expecting number but found %T",r));switch(g.number.test(s.type)&&(c=0<=r),s.precision&&/[efg]/.test(s.type)&&(s.precision=String(Math.max(s.type==='g'?1:0,Math.min(100,Number(s.precision))))),s.type){case"b":r=parseInt(r,10).toString(2);break;case"c":r=String.fromCharCode(parseInt(r,10));break;case"d":case"i":r=parseInt(r,10);break;case"j":r=JSON.stringify(r,null,s.width?parseInt(s.width):0);break;case"e":r=s.precision?parseFloat(r).toExponential(s.precision):parseFloat(r).toExponential();break;case"f":r=s.precision?parseFloat(r).toFixed(s.precision):parseFloat(r);break;case"g":r=s.precision?String(Number(r.toPrecision(s.precision))):parseFloat(r);break;case"o":r=(parseInt(r,10)>>>0).toString(8);break;case"s":r=String(r),r=s.precision?r.substring(0,s.precision):r;break;case"t":r=String(!!r),r=s.precision?r.substring(0,s.precision):r;break;case"T":r=Object.prototype.toString.call(r).slice(8,-1).toLowerCase(),r=s.precision?r.substring(0,s.precision):r;break;case"u":r=parseInt(r,10)>>>0;break;case"v":r=r.valueOf(),r=s.precision?r.substring(0,s.precision):r;break;case"x":r=(parseInt(r,10)>>>0).toString(16);break;case"X":r=(parseInt(r,10)>>>0).toString(16).toUpperCase()}g.json.test(s.type)?d+=r:(!g.number.test(s.type)||c&&!s.sign?l="":(l=c?"+":"-",r=r.toString().replace(g.sign,"")),o=s.pad_char?"0"===s.pad_char?"0":s.pad_char.charAt(1):" ",p=s.width-(l+r).length,a=s.width&&0<p?o.repeat(p):"",d+=s.align?l+r+a:"0"===o?l+a+r:a+l+r)}return d}(function(e){if(p[e])return p[e];var t,r=e,n=[],i=0;for(;r;){if(null!==(t=g.text.exec(r)))n.push(t[0]);else if(null!==(t=g.modulo.exec(r)))n.push("%");else{if(null===(t=g.placeholder.exec(r)))throw new SyntaxError("[sprintf] unexpected placeholder");if(t[2]){i|=1;var s=[],a=t[2],o=[];if(null===(o=g.key.exec(a)))throw new SyntaxError("[sprintf] failed to parse named argument key");for(s.push(o[1]);""!==(a=a.substring(o[0].length));)if(null!==(o=g.key_access.exec(a)))s.push(o[1]);else{if(null===(o=g.index_access.exec(a)))throw new SyntaxError("[sprintf] failed to parse named argument key");s.push(o[1])}t[2]=s}else i|=2;if(3===i)throw new Error("[sprintf] mixing positional and named placeholders is not (yet) supported");n.push({placeholder:t[0],param_no:t[1],keys:t[2],sign:t[3],pad_char:t[4],align:t[5],width:t[6],precision:t[7],type:t[8]})}r=r.substring(t[0].length)}return p[e]=n}(e),arguments)}function e(e,t){return y.apply(null,[e].concat(t||[]))}var p=Object.create(null);"undefined"!=typeof exports&&(exports.sprintf=y,exports.vsprintf=e),"undefined"!=typeof window&&(window.sprintf=y,window.vsprintf=e,"function"==typeof define&&define.amd&&define(function(){return{sprintf:y,vsprintf:e}}))}();
+
+diff --git a/src/sprintf.js b/src/sprintf.js
+index 65d6324645ef1d0133614a71497751009dc5c912..5fffc12a327e403d198c7b4a718a04446849ed6f 100644
+--- a/src/sprintf.js
+++ b/src/sprintf.js
+@@ -66,6 +66,10 @@
+                     is_positive = arg >= 0
+                 }
+ 
+                if (ph.precision && /[efg]/.test(ph.type)) {
+                    ph.precision = String(Math.max(ph.type === 'g' ? 1 : 0, Math.min(100, Number(ph.precision))))
+                }
+
+                 switch (ph.type) {
+                     case 'b':
+                         arg = parseInt(arg, 10).toString(2)
@@ -0,0 +1,63 @@
+import { createRequire } from 'node:module'
+import { describe, expect, it } from 'vitest'
+
+function dependencyRequire(packages) {
+  let require = createRequire(import.meta.url)
+  for (const name of packages) {
+    require = createRequire(require.resolve(name))
+  }
+  return require
+}
+
+// Resolve through declared consumers so hoisting cannot select another workspace's copy.
+const braces = dependencyRequire(['shadcn', 'fast-glob', 'micromatch'])('braces')
+const sprintfRequire = dependencyRequire([
+  'electron-builder',
+  'app-builder-lib',
+  '@electron/get',
+  'global-agent',
+  'roarr'
+])
+
+describe('installed dependency security patches', () => {
+  it.each([
+    ['braces', '{', '}'],
+    ['parentheses', '(', ')'],
+    ['mixed nesting', '{(', ')}']
+  ])('bounds %s during parsing', (_name, open, close) => {
+    expect(() => braces.parse(`${open.repeat(512)}a,b${close.repeat(512)}`)).toThrow(
+      'maximum nesting depth'
+    )
+  })
+
+  it.each(['compile', 'expand', 'stringify'])('bounds nested patterns in braces.%s', (method) => {
+    const pattern = `${'{'.repeat(4_000)}a,b${'}'.repeat(4_000)}`
+    expect(() => braces[method](pattern)).toThrow('maximum nesting depth')
+    expect(braces.expand('src/{main,shared}/*.ts')).toEqual(['src/main/*.ts', 'src/shared/*.ts'])
+  })
+
+  it.each(['compile', 'expand', 'stringify'])(
+    'bounds directly supplied ASTs in braces.%s',
+    (method) => {
+      let ast = { type: 'text', value: 'ok' }
+      for (let depth = 0; depth < 10_000; depth += 1) {
+        ast = { type: 'root', nodes: [ast] }
+      }
+      expect(() => braces[method](ast)).toThrow('maximum nesting depth')
+    }
+  )
+
+  it.each(['src/sprintf.js', 'dist/sprintf.min.js'])('bounds numeric precision in %s', (entry) => {
+    const { sprintf } = sprintfRequire(`sprintf-js/${entry}`)
+    for (const type of ['e', 'f', 'g']) {
+      expect(() => sprintf(`%.${'9'.repeat(500)}${type}`, 1.234)).not.toThrow()
+      expect(sprintf(`%.${'9'.repeat(500)}${type}`, 1.234).length).toBeLessThan(110)
+    }
+    expect(sprintf('%.2f', 1.234)).toBe('1.23')
+    expect(sprintf('%.2e', 1.234)).toBe('1.23e+0')
+    expect(sprintf('%.2g', 1.234)).toBe('1.2')
+    expect(sprintf('%.3s', 'abcdef')).toBe('abc')
+    expect(sprintf('%.0f', 1.7)).toBe('2')
+    expect(sprintf('%.0e', 1.7)).toBe('2e+0')
+  })
+})
@@ -73,7 +73,7 @@ describe('locked audit tool execution', () => {
    const [policy] = parseAllDocuments(
      readFileSync(join(root, 'config/audit-tools/pnpm-workspace.yaml'), 'utf8')
    ).map((document) => document.toJS())
-    expect(policy).toEqual({ minimumReleaseAge: 4320, ignoreScripts: true, allowBuilds: {} })
+    expect(policy).toMatchObject({ minimumReleaseAge: 4320, ignoreScripts: true, allowBuilds: {} })
    const documents = parseAllDocuments(
      readFileSync(join(root, 'config/audit-tools/pnpm-lock.yaml'), 'utf8')
    ).map((document) => document.toJS())
@@ -89,6 +89,11 @@ try {

  const stale = join(fixture, 'config', 'audit-tools')
  mkdirSync(stale, { recursive: true })
+  mkdirSync(join(fixture, 'config', 'patches'), { recursive: true })
+  copyFileSync(
+    join(root, 'config', 'patches', 'braces@3.0.3.patch'),
+    join(fixture, 'config', 'patches', 'braces@3.0.3.patch')
+  )
  for (const file of ['pnpm-lock.yaml', 'pnpm-workspace.yaml']) {
    copyFileSync(join(root, 'config', 'audit-tools', file), join(stale, file))
  }
@@ -163,6 +163,7 @@ settings:
  excludeLinksFromLockfile: false

 overrides:
+  path-to-regexp@>=4.0.0 <6.3.0: 6.3.0
  '@vercel/node>undici': 6.28.1
  '@vercel/python-analysis>js-yaml': 4.3.2
  '@vercel/python-analysis>minimatch': 10.2.6
@@ -177,6 +178,9 @@ overrides:
  '@vercel/container>tar': 7.5.22
  '@vercel/container>smol-toml': 1.9.1

+patchedDependencies:
+  braces@3.0.3: c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd
+
 importers:

  .:
@@ -3349,9 +3353,6 @@ packages:
    resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==}
    engines: {node: 18 || 20 || >=22}

-  path-to-regexp@6.1.0:
-    resolution: {integrity: sha512-h9DqehX3zZZDCEm+xbfU0ZmwCGFCAAraPJWMXJ4+v32NjZJilVg3k1TcKsRgIb8IQ/izZSaydDc1OhJCZvs2Dw==}
-
  path-to-regexp@6.3.0:
    resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==}

@@ -5418,7 +5419,7 @@ snapshots:
      etag: 1.8.1
      mime-types: 2.1.35
      node-fetch: 2.6.9
-      path-to-regexp: 6.1.0
+      path-to-regexp: 6.3.0
      path-to-regexp-updated: path-to-regexp@6.3.0
      ts-morph: 12.0.0
      tsx: 4.21.0
@@ -5476,7 +5477,7 @@ snapshots:
      '@vercel/error-utils': 2.2.1
      '@vercel/nft': 1.10.0
      '@vercel/static-config': 3.4.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.11.3)
-      path-to-regexp: 6.1.0
+      path-to-regexp: 6.3.0
      path-to-regexp-updated: path-to-regexp@6.3.0
      ts-morph: 12.0.0
    transitivePeerDependencies:
@@ -5624,7 +5625,7 @@ snapshots:
    dependencies:
      balanced-match: 4.0.4

-  braces@3.0.3:
+  braces@3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd):
    dependencies:
      fill-range: 7.1.1

@@ -6789,7 +6790,7 @@ snapshots:

  micromatch@4.0.8:
    dependencies:
-      braces: 3.0.3
+      braces: 3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd)
      picomatch: 2.3.2

  mime-db@1.52.0: {}
@@ -7023,8 +7024,6 @@ snapshots:
      lru-cache: 11.5.2
      minipass: 7.1.3

-  path-to-regexp@6.1.0: {}
-
  path-to-regexp@6.3.0: {}

  path-to-regexp@8.4.0: {}
@@ -5,6 +5,7 @@ allowBuilds:
  sharp: true

 overrides:
+  path-to-regexp@>=4.0.0 <6.3.0: 6.3.0
  '@vercel/node>undici': 6.28.1
  '@vercel/python-analysis>js-yaml': 4.3.2
  '@vercel/python-analysis>minimatch': 10.2.6
@@ -18,3 +19,6 @@ overrides:
  '@vercel/hono>path-to-regexp': 8.4.0
  '@vercel/container>tar': 7.5.22
  '@vercel/container>smol-toml': 1.9.1
+
+patchedDependencies:
+  braces@3.0.3: ../../config/patches/braces@3.0.3.patch
@@ -89,7 +89,7 @@
    "tsx": "^4.23.15",
    "typescript": "6.0.3",
    "vite": "^8.3.4",
-    "vitest": "^4.1.11",
+    "vitest": "^4.1.12",
    "ws": "^8.22.0"
  },
  "packageManager": "pnpm@12.14.0+sha512.c18ba6d87993d3d164cb5e8948f32b2c06ee854487e06cd8d86781342fb3e5bb4634367034711e86802baa9c37bea906ce1929ad08d70884c97d801df13389a6"
@@ -0,0 +1,99 @@
+diff --git a/lib/compile.js b/lib/compile.js
+index dce69beb90ece5c3b0ca234a949418f9f34eedbc..6f63213f5da97c9c9989494c65e0c53a82e19d92 100644
+--- a/lib/compile.js
+++ b/lib/compile.js
+@@ -4,7 +4,10 @@ const fill = require('fill-range');
+ const utils = require('./utils');
+ 
+ const compile = (ast, options = {}) => {
+-  const walk = (node, parent = {}) => {
+  const walk = (node, parent = {}, depth = 0) => {
+    if (depth > 128) {
+      throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)');
+    }
+     const invalidBlock = utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+     const invalid = invalidBlock === true || invalidNode === true;
+@@ -47,7 +50,7 @@ const compile = (ast, options = {}) => {
+ 
+     if (node.nodes) {
+       for (const child of node.nodes) {
+-        output += walk(child, node);
+        output += walk(child, node, depth + 1);
+       }
+     }
+ 
+diff --git a/lib/expand.js b/lib/expand.js
+index 35b2c41d6afdb8f0197959e26079f266e48370d3..342b39e342b0ab0365edde268f2abac378db095a 100644
+--- a/lib/expand.js
+++ b/lib/expand.js
+@@ -33,7 +33,10 @@ const append = (queue = '', stash = '', enclose = false) => {
+ const expand = (ast, options = {}) => {
+   const rangeLimit = options.rangeLimit === undefined ? 1000 : options.rangeLimit;
+ 
+-  const walk = (node, parent = {}) => {
+  const walk = (node, parent = {}, depth = 0) => {
+    if (depth > 128) {
+      throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)');
+    }
+     node.queue = [];
+ 
+     let p = parent;
+@@ -100,7 +103,7 @@ const expand = (ast, options = {}) => {
+       }
+ 
+       if (child.nodes) {
+-        walk(child, node);
+        walk(child, node, depth + 1);
+       }
+     }
+ 
+diff --git a/lib/parse.js b/lib/parse.js
+index 3a6988e629f52aee6609dc5ec290a5e9ff47cecb..f91b5c272bf7d399b88fed7be553fe1d140da972 100644
+--- a/lib/parse.js
+++ b/lib/parse.js
+@@ -143,6 +143,9 @@ const parse = (input, options = {}) => {
+      */
+ 
+     if (value === CHAR_LEFT_PARENTHESES) {
+      if (stack.length > 128) {
+        throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)');
+      }
+       block = push({ type: 'paren', nodes: [] });
+       stack.push(block);
+       push({ type: 'text', value });
+@@ -195,6 +198,9 @@ const parse = (input, options = {}) => {
+      */
+ 
+     if (value === CHAR_LEFT_CURLY_BRACE) {
+      if (stack.length > 128) {
+        throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)');
+      }
+       depth++;
+ 
+       const dollar = prev.value && prev.value.slice(-1) === '$' || block.dollar === true;
+diff --git a/lib/stringify.js b/lib/stringify.js
+index 8bcf872c31894f81a8c64d9202fd607e4fd7ea2b..1f03c5cd154a8443f9b95a824ec4f315e7382e4f 100644
+--- a/lib/stringify.js
+++ b/lib/stringify.js
+@@ -3,7 +3,10 @@
+ const utils = require('./utils');
+ 
+ module.exports = (ast, options = {}) => {
+-  const stringify = (node, parent = {}) => {
+  const stringify = (node, parent = {}, depth = 0) => {
+    if (depth > 128) {
+      throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)');
+    }
+     const invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+     let output = '';
+@@ -21,7 +24,7 @@ module.exports = (ast, options = {}) => {
+ 
+     if (node.nodes) {
+       for (const child of node.nodes) {
+-        output += stringify(child);
+        output += stringify(child, {}, depth + 1);
+       }
+     }
+     return output;
@@ -0,0 +1,14 @@
+diff --git a/lib/rsa.js b/lib/rsa.js
+--- a/lib/rsa.js
+++ b/lib/rsa.js
+@@ -1172,7 +1172,9 @@
+           var capture = {};
+           var errors = [];
+           if(!asn1.validate(obj, digestInfoValidator, capture, errors) ||
+-            obj.value.length !== 2) {
+            obj.value.length !== 2 ||
+            obj.value[0].value.length !==
+              (('parameters' in capture) ? 2 : 1)) {
+             var error = new Error(
+               'ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 ' +
+               'DigestInfo value.');
@@ -0,0 +1,24 @@
+diff --git a/dist/sprintf.min.js b/dist/sprintf.min.js
+--- a/dist/sprintf.min.js
+++ b/dist/sprintf.min.js
+@@ -1,3 +1,3 @@
+ /*! sprintf-js v1.1.3 | Copyright (c) 2007-present, Alexandru Mărășteanu <hello@alexei.ro> | BSD-3-Clause */
+-!function(){"use strict";var g={not_string:/[^s]/,not_bool:/[^t]/,not_type:/[^T]/,not_primitive:/[^v]/,number:/[diefg]/,numeric_arg:/[bcdiefguxX]/,json:/[j]/,not_json:/[^j]/,text:/^[^\x25]+/,modulo:/^\x25{2}/,placeholder:/^\x25(?:([1-9]\d*)\$|\(([^)]+)\))?(\+)?(0|'[^$])?(-)?(\d+)?(?:\.(\d+))?([b-gijostTuvxX])/,key:/^([a-z_][a-z_\d]*)/i,key_access:/^\.([a-z_][a-z_\d]*)/i,index_access:/^\[(\d+)\]/,sign:/^[+-]/};function y(e){return function(e,t){var r,n,i,s,a,o,p,c,l,u=1,f=e.length,d="";for(n=0;n<f;n++)if("string"==typeof e[n])d+=e[n];else if("object"==typeof e[n]){if((s=e[n]).keys)for(r=t[u],i=0;i<s.keys.length;i++){if(null==r)throw new Error(y('[sprintf] Cannot access property "%s" of undefined value "%s"',s.keys[i],s.keys[i-1]));r=r[s.keys[i]]}else r=s.param_no?t[s.param_no]:t[u++];if(g.not_type.test(s.type)&&g.not_primitive.test(s.type)&&r instanceof Function&&(r=r()),g.numeric_arg.test(s.type)&&"number"!=typeof r&&isNaN(r))throw new TypeError(y("[sprintf] expecting number but found %T",r));switch(g.number.test(s.type)&&(c=0<=r),s.type){case"b":r=parseInt(r,10).toString(2);break;case"c":r=String.fromCharCode(parseInt(r,10));break;case"d":case"i":r=parseInt(r,10);break;case"j":r=JSON.stringify(r,null,s.width?parseInt(s.width):0);break;case"e":r=s.precision?parseFloat(r).toExponential(s.precision):parseFloat(r).toExponential();break;case"f":r=s.precision?parseFloat(r).toFixed(s.precision):parseFloat(r);break;case"g":r=s.precision?String(Number(r.toPrecision(s.precision))):parseFloat(r);break;case"o":r=(parseInt(r,10)>>>0).toString(8);break;case"s":r=String(r),r=s.precision?r.substring(0,s.precision):r;break;case"t":r=String(!!r),r=s.precision?r.substring(0,s.precision):r;break;case"T":r=Object.prototype.toString.call(r).slice(8,-1).toLowerCase(),r=s.precision?r.substring(0,s.precision):r;break;case"u":r=parseInt(r,10)>>>0;break;case"v":r=r.valueOf(),r=s.precision?r.substring(0,s.precision):r;break;case"x":r=(parseInt(r,10)>>>0).toString(16);break;case"X":r=(parseInt(r,10)>>>0).toString(16).toUpperCase()}g.json.test(s.type)?d+=r:(!g.number.test(s.type)||c&&!s.sign?l="":(l=c?"+":"-",r=r.toString().replace(g.sign,"")),o=s.pad_char?"0"===s.pad_char?"0":s.pad_char.charAt(1):" ",p=s.width-(l+r).length,a=s.width&&0<p?o.repeat(p):"",d+=s.align?l+r+a:"0"===o?l+a+r:a+l+r)}return d}(function(e){if(p[e])return p[e];var t,r=e,n=[],i=0;for(;r;){if(null!==(t=g.text.exec(r)))n.push(t[0]);else if(null!==(t=g.modulo.exec(r)))n.push("%");else{if(null===(t=g.placeholder.exec(r)))throw new SyntaxError("[sprintf] unexpected placeholder");if(t[2]){i|=1;var s=[],a=t[2],o=[];if(null===(o=g.key.exec(a)))throw new SyntaxError("[sprintf] failed to parse named argument key");for(s.push(o[1]);""!==(a=a.substring(o[0].length));)if(null!==(o=g.key_access.exec(a)))s.push(o[1]);else{if(null===(o=g.index_access.exec(a)))throw new SyntaxError("[sprintf] failed to parse named argument key");s.push(o[1])}t[2]=s}else i|=2;if(3===i)throw new Error("[sprintf] mixing positional and named placeholders is not (yet) supported");n.push({placeholder:t[0],param_no:t[1],keys:t[2],sign:t[3],pad_char:t[4],align:t[5],width:t[6],precision:t[7],type:t[8]})}r=r.substring(t[0].length)}return p[e]=n}(e),arguments)}function e(e,t){return y.apply(null,[e].concat(t||[]))}var p=Object.create(null);"undefined"!=typeof exports&&(exports.sprintf=y,exports.vsprintf=e),"undefined"!=typeof window&&(window.sprintf=y,window.vsprintf=e,"function"==typeof define&&define.amd&&define(function(){return{sprintf:y,vsprintf:e}}))}();
+-//# sourceMappingURL=sprintf.min.js.map
+!function(){"use strict";var g={not_string:/[^s]/,not_bool:/[^t]/,not_type:/[^T]/,not_primitive:/[^v]/,number:/[diefg]/,numeric_arg:/[bcdiefguxX]/,json:/[j]/,not_json:/[^j]/,text:/^[^\x25]+/,modulo:/^\x25{2}/,placeholder:/^\x25(?:([1-9]\d*)\$|\(([^)]+)\))?(\+)?(0|'[^$])?(-)?(\d+)?(?:\.(\d+))?([b-gijostTuvxX])/,key:/^([a-z_][a-z_\d]*)/i,key_access:/^\.([a-z_][a-z_\d]*)/i,index_access:/^\[(\d+)\]/,sign:/^[+-]/};function y(e){return function(e,t){var r,n,i,s,a,o,p,c,l,u=1,f=e.length,d="";for(n=0;n<f;n++)if("string"==typeof e[n])d+=e[n];else if("object"==typeof e[n]){if((s=e[n]).keys)for(r=t[u],i=0;i<s.keys.length;i++){if(null==r)throw new Error(y('[sprintf] Cannot access property "%s" of undefined value "%s"',s.keys[i],s.keys[i-1]));r=r[s.keys[i]]}else r=s.param_no?t[s.param_no]:t[u++];if(g.not_type.test(s.type)&&g.not_primitive.test(s.type)&&r instanceof Function&&(r=r()),g.numeric_arg.test(s.type)&&"number"!=typeof r&&isNaN(r))throw new TypeError(y("[sprintf] expecting number but found %T",r));switch(g.number.test(s.type)&&(c=0<=r),s.precision&&/[efg]/.test(s.type)&&(s.precision=String(Math.max(s.type==='g'?1:0,Math.min(100,Number(s.precision))))),s.type){case"b":r=parseInt(r,10).toString(2);break;case"c":r=String.fromCharCode(parseInt(r,10));break;case"d":case"i":r=parseInt(r,10);break;case"j":r=JSON.stringify(r,null,s.width?parseInt(s.width):0);break;case"e":r=s.precision?parseFloat(r).toExponential(s.precision):parseFloat(r).toExponential();break;case"f":r=s.precision?parseFloat(r).toFixed(s.precision):parseFloat(r);break;case"g":r=s.precision?String(Number(r.toPrecision(s.precision))):parseFloat(r);break;case"o":r=(parseInt(r,10)>>>0).toString(8);break;case"s":r=String(r),r=s.precision?r.substring(0,s.precision):r;break;case"t":r=String(!!r),r=s.precision?r.substring(0,s.precision):r;break;case"T":r=Object.prototype.toString.call(r).slice(8,-1).toLowerCase(),r=s.precision?r.substring(0,s.precision):r;break;case"u":r=parseInt(r,10)>>>0;break;case"v":r=r.valueOf(),r=s.precision?r.substring(0,s.precision):r;break;case"x":r=(parseInt(r,10)>>>0).toString(16);break;case"X":r=(parseInt(r,10)>>>0).toString(16).toUpperCase()}g.json.test(s.type)?d+=r:(!g.number.test(s.type)||c&&!s.sign?l="":(l=c?"+":"-",r=r.toString().replace(g.sign,"")),o=s.pad_char?"0"===s.pad_char?"0":s.pad_char.charAt(1):" ",p=s.width-(l+r).length,a=s.width&&0<p?o.repeat(p):"",d+=s.align?l+r+a:"0"===o?l+a+r:a+l+r)}return d}(function(e){if(p[e])return p[e];var t,r=e,n=[],i=0;for(;r;){if(null!==(t=g.text.exec(r)))n.push(t[0]);else if(null!==(t=g.modulo.exec(r)))n.push("%");else{if(null===(t=g.placeholder.exec(r)))throw new SyntaxError("[sprintf] unexpected placeholder");if(t[2]){i|=1;var s=[],a=t[2],o=[];if(null===(o=g.key.exec(a)))throw new SyntaxError("[sprintf] failed to parse named argument key");for(s.push(o[1]);""!==(a=a.substring(o[0].length));)if(null!==(o=g.key_access.exec(a)))s.push(o[1]);else{if(null===(o=g.index_access.exec(a)))throw new SyntaxError("[sprintf] failed to parse named argument key");s.push(o[1])}t[2]=s}else i|=2;if(3===i)throw new Error("[sprintf] mixing positional and named placeholders is not (yet) supported");n.push({placeholder:t[0],param_no:t[1],keys:t[2],sign:t[3],pad_char:t[4],align:t[5],width:t[6],precision:t[7],type:t[8]})}r=r.substring(t[0].length)}return p[e]=n}(e),arguments)}function e(e,t){return y.apply(null,[e].concat(t||[]))}var p=Object.create(null);"undefined"!=typeof exports&&(exports.sprintf=y,exports.vsprintf=e),"undefined"!=typeof window&&(window.sprintf=y,window.vsprintf=e,"function"==typeof define&&define.amd&&define(function(){return{sprintf:y,vsprintf:e}}))}();
+
+diff --git a/src/sprintf.js b/src/sprintf.js
+index 65d6324645ef1d0133614a71497751009dc5c912..5fffc12a327e403d198c7b4a718a04446849ed6f 100644
+--- a/src/sprintf.js
+++ b/src/sprintf.js
+@@ -66,6 +66,10 @@
+                     is_positive = arg >= 0
+                 }
+ 
+                if (ph.precision && /[efg]/.test(ph.type)) {
+                    ph.precision = String(Math.max(ph.type === 'g' ? 1 : 0, Math.min(100, Number(ph.precision))))
+                }
+
+                 switch (ph.type) {
+                     case 'b':
+                         arg = parseInt(arg, 10).toString(2)
@@ -163,16 +163,21 @@ settings:
  excludeLinksFromLockfile: false

 overrides:
+  sprintf-js@<1.1.3: 1.1.3
+  markdown-it@>=14.0.0 <14.3.3: 14.3.3
  katex@>=0.11.0 <0.18.2: 0.18.10
  xcode>uuid: 11.1.1
  query-string: 9.5.1

 patchedDependencies:
  '@xterm/addon-webgl@0.20.0-beta.300': 5349718f2c19d9319a81552580bf9618ded9b00f3707a5c6cdbbae1910849cd9
+  braces@3.0.3: c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd
  expo-notifications@55.0.27: ce20843a3daad4185d7e8571788fa323ba4d11984936188790858650a61749c0
+  node-forge@1.4.0: 2798686e4488058ad81c3b8e32eb763c0feff21f4c717ce4d13b6ef2432cd5b8
  query-string@9.5.1: 8624f1beedd0705bfdaf287519ed6363662a0c96f01fd594508b34583bf30d8b
  react-native-webview@13.16.2: 55b7bce35c78ee1a50c4b99ad65b52982f3cfa73da6f61d0853c4d03219eec06
  react-native@0.83.10: 22bc31f0a057b1f96d9949b38a7ccde81225f617c0f243820dc8a455c91debfb
+  sprintf-js@1.1.3: 05316a8b01f155fe19a1e0cb4042c81d43d798a76755c407684e1199a18b1e08

 importers:

@@ -272,8 +277,8 @@ importers:
        specifier: ^1.14.0
        version: 1.14.0(react-native-svg@15.15.5(react-native@0.83.10(patch_hash=22bc31f0a057b1f96d9949b38a7ccde81225f617c0f243820dc8a455c91debfb)(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.85.2(@babel/core@7.29.7(supports-color@8.1.1))(supports-color@8.1.1))(@types/react@19.2.18)(react@19.2.8)(supports-color@8.1.1))(react@19.2.8))(react-native@0.83.10(patch_hash=22bc31f0a057b1f96d9949b38a7ccde81225f617c0f243820dc8a455c91debfb)(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.85.2(@babel/core@7.29.7(supports-color@8.1.1))(supports-color@8.1.1))(@types/react@19.2.18)(react@19.2.8)(supports-color@8.1.1))(react@19.2.8)
      markdown-it:
-        specifier: ^14.3.2
-        version: 14.3.2
+        specifier: 14.3.3
+        version: 14.3.3
      markdown-it-footnote:
        specifier: ^4.0.0
        version: 4.0.0
@@ -375,8 +380,8 @@ importers:
        specifier: ^8.3.4
        version: 8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)
      vitest:
-        specifier: ^4.1.11
-        version: 4.1.11(@types/node@26.6.2)(happy-dom@20.14.5)(jsdom@20.0.3(supports-color@8.1.1))(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1))
+        specifier: ^4.1.12
+        version: 4.1.12(@types/node@26.6.2)(happy-dom@20.14.5)(jsdom@20.0.3(supports-color@8.1.1))(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1))
      ws:
        specifier: ^8.22.0
        version: 8.22.0
@@ -3057,11 +3062,11 @@ packages:
  '@upsetjs/venn.js@2.0.0':
    resolution: {integrity: sha512-WbBhLrooyePuQ1VZxrJjtLvTc4NVfpOyKx0sKqioq9bX1C1m7Jgykkn8gLrtwumBioXIqam8DLxp88Adbue6Hw==}

-  '@vitest/expect@4.1.11':
-    resolution: {integrity: sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==}
+  '@vitest/expect@4.1.12':
+    resolution: {integrity: sha512-vFlTt+YEu9WBpNjdGayNmlMVzrWPi1+sv853/7t2FU7hpO5gAFBKHzQmkCq5Xjpr+evegF2994LQT3hF3mRlqQ==}

-  '@vitest/mocker@4.1.11':
-    resolution: {integrity: sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==}
+  '@vitest/mocker@4.1.12':
+    resolution: {integrity: sha512-fKShNpKZzupWZuY0z7egydvL0sqW4INEZBEExMBMAa6izlENEVHwoXgdaTCaBZ5fwlr4xf2o1wXC83n9RpO+NA==}
    peerDependencies:
      msw: ^2.4.9
      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -3071,20 +3076,20 @@ packages:
      vite:
        optional: true

-  '@vitest/pretty-format@4.1.11':
-    resolution: {integrity: sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==}
+  '@vitest/pretty-format@4.1.12':
+    resolution: {integrity: sha512-XW9O8+Mxx4VpCtkYdMJLZQQwsVryP9wk7cPKDxtXFfwSak6yRh5+2fep/Y0XF/ElBvJHq8bcYdi6aeuai0opZA==}

-  '@vitest/runner@4.1.11':
-    resolution: {integrity: sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==}
+  '@vitest/runner@4.1.12':
+    resolution: {integrity: sha512-NKlVKCr5QnCe8jijdMnmkpHHU+WTqiLFR6G0pHji9uRjXK9xJl1k1nTw6F3pOOj2PDcsDt2GKQMI7wIsaT491w==}

-  '@vitest/snapshot@4.1.11':
-    resolution: {integrity: sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==}
+  '@vitest/snapshot@4.1.12':
+    resolution: {integrity: sha512-ko1y1Qgb/slzQ9mr+b89Cuqud8WG1TKtsPD8r7ZUBdvVOGt85Af2HwCqHujrhwJq95hs/9RM7fcAPg57o1vlzw==}

-  '@vitest/spy@4.1.11':
-    resolution: {integrity: sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==}
+  '@vitest/spy@4.1.12':
+    resolution: {integrity: sha512-RGq9x4JNGNTZHEJxvN0oSiJjeSCExm0n2gZKKJZHY9cX5AVA6M7VJILBT3ZJ/tJ/0J9uWT7fETV9/btoi//vSg==}

-  '@vitest/utils@4.1.11':
-    resolution: {integrity: sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==}
+  '@vitest/utils@4.1.12':
+    resolution: {integrity: sha512-Q3awXrwOfEV+qc3WmO5ONyE0yO7Q1gQ9/oyHxGLZ/pl7N3NO/ZztqQwKLuwMkV+CA1JYSIeO3gkHnRDIo4AVaA==}

  '@xmldom/xmldom@0.8.15':
    resolution: {integrity: sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA==}
@@ -5541,8 +5546,8 @@ packages:
  markdown-it-footnote@4.0.0:
    resolution: {integrity: sha512-WYJ7urf+khJYl3DqofQpYfEYkZKbmXmwxQV8c8mO/hGIhgZ1wOe7R4HLFNwqx7TjILbnC98fuyeSsin19JdFcQ==}

-  markdown-it@14.3.2:
-    resolution: {integrity: sha512-sHHjZ5fJKlgrG4qns2YwVcdNep35h5fERrfkD2YNsb9UFk0UIHarbiTaHKVMlPuWAoiilyK8Fv/jAm11slsY7Q==}
+  markdown-it@14.3.3:
+    resolution: {integrity: sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg==}
    hasBin: true

  marked@16.4.2:
@@ -6563,8 +6568,8 @@ packages:
    resolution: {integrity: sha512-qxQJTx2ryR0Dw0ITYyekNQWpz6f8dGd7vffGNflQQ3Iqj9NJ6qiZ7ELpZsJ/QBhIVAiDfXdag3+Gp8RvWa62AA==}
    engines: {node: '>=12'}

-  sprintf-js@1.0.3:
-    resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==}
+  sprintf-js@1.1.3:
+    resolution: {integrity: sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==}

  stack-generator@2.0.10:
    resolution: {integrity: sha512-mwnua/hkqM6pF4k8SnmZ2zfETsRUpWXREfA/goT8SLCV4iOFa4bzOX2nDipWAZFPTjLvQB82f5yaodMVhK0yJQ==}
@@ -7034,20 +7039,20 @@ packages:
      yaml:
        optional: true

-  vitest@4.1.11:
-    resolution: {integrity: sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==}
+  vitest@4.1.12:
+    resolution: {integrity: sha512-5eWdz2yb3ajxWF3C8C4TjkXl7FGm3n2E/VlazALrQHzK7nYMSGFnCZto0bbPNl77AwkOZVLk0YnBAejUu0NiWA==}
    engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
    hasBin: true
    peerDependencies:
      '@edge-runtime/vm': '*'
      '@opentelemetry/api': ^1.9.0
      '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
-      '@vitest/browser-playwright': 4.1.11
-      '@vitest/browser-preview': 4.1.11
-      '@vitest/browser-webdriverio': 4.1.11
-      '@vitest/coverage-istanbul': 4.1.11
-      '@vitest/coverage-v8': 4.1.11
-      '@vitest/ui': 4.1.11
+      '@vitest/browser-playwright': 4.1.12
+      '@vitest/browser-preview': 4.1.12
+      '@vitest/browser-webdriverio': ^4.1.11
+      '@vitest/coverage-istanbul': 4.1.12
+      '@vitest/coverage-v8': 4.1.12
+      '@vitest/ui': 4.1.12
      happy-dom: '*'
      jsdom: '*'
      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -8712,7 +8717,7 @@ snapshots:
      glob: 13.0.6
      lan-network: 0.2.1
      multitars: 1.0.2
-      node-forge: 1.4.0
+      node-forge: 1.4.0(patch_hash=2798686e4488058ad81c3b8e32eb763c0feff21f4c717ce4d13b6ef2432cd5b8)
      npm-package-arg: 11.0.3
      ora: 3.4.0
      picomatch: 4.0.4
@@ -8749,7 +8754,7 @@ snapshots:

  '@expo/code-signing-certificates@0.0.6':
    dependencies:
-      node-forge: 1.4.0
+      node-forge: 1.4.0(patch_hash=2798686e4488058ad81c3b8e32eb763c0feff21f4c717ce4d13b6ef2432cd5b8)

  '@expo/config-plugins@55.0.11(supports-color@8.1.1)':
    dependencies:
@@ -10455,44 +10460,44 @@ snapshots:
      d3-selection: 3.0.0
      d3-transition: 3.0.1(d3-selection@3.0.0)

-  '@vitest/expect@4.1.11':
+  '@vitest/expect@4.1.12':
    dependencies:
      '@standard-schema/spec': 1.1.0
      '@types/chai': 5.2.3
-      '@vitest/spy': 4.1.11
-      '@vitest/utils': 4.1.11
+      '@vitest/spy': 4.1.12
+      '@vitest/utils': 4.1.12
      chai: 6.2.2
      tinyrainbow: 3.1.0

-  '@vitest/mocker@4.1.11(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1))':
+  '@vitest/mocker@4.1.12(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1))':
    dependencies:
-      '@vitest/spy': 4.1.11
+      '@vitest/spy': 4.1.12
      estree-walker: 3.0.3
      magic-string: 0.30.21
    optionalDependencies:
      vite: 8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)

-  '@vitest/pretty-format@4.1.11':
+  '@vitest/pretty-format@4.1.12':
    dependencies:
      tinyrainbow: 3.1.0

-  '@vitest/runner@4.1.11':
+  '@vitest/runner@4.1.12':
    dependencies:
-      '@vitest/utils': 4.1.11
+      '@vitest/utils': 4.1.12
      pathe: 2.0.3

-  '@vitest/snapshot@4.1.11':
+  '@vitest/snapshot@4.1.12':
    dependencies:
-      '@vitest/pretty-format': 4.1.11
-      '@vitest/utils': 4.1.11
+      '@vitest/pretty-format': 4.1.12
+      '@vitest/utils': 4.1.12
      magic-string: 0.30.21
      pathe: 2.0.3

-  '@vitest/spy@4.1.11': {}
+  '@vitest/spy@4.1.12': {}

-  '@vitest/utils@4.1.11':
+  '@vitest/utils@4.1.12':
    dependencies:
-      '@vitest/pretty-format': 4.1.11
+      '@vitest/pretty-format': 4.1.12
      convert-source-map: 2.0.0
      tinyrainbow: 3.1.0

@@ -10591,7 +10596,7 @@ snapshots:

  argparse@1.0.10:
    dependencies:
-      sprintf-js: 1.0.3
+      sprintf-js: 1.1.3(patch_hash=05316a8b01f155fe19a1e0cb4042c81d43d798a76755c407684e1199a18b1e08)

  argparse@2.0.1: {}

@@ -10907,7 +10912,7 @@ snapshots:
    dependencies:
      balanced-match: 4.0.4

-  braces@3.0.3:
+  braces@3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd):
    dependencies:
      fill-range: 7.1.1

@@ -10990,7 +10995,7 @@ snapshots:
  chokidar@3.6.0:
    dependencies:
      anymatch: 3.1.3
-      braces: 3.0.3
+      braces: 3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd)
      glob-parent: 5.1.2
      is-binary-path: 2.1.0
      is-glob: 4.0.3
@@ -13513,7 +13518,7 @@ snapshots:

  markdown-it-footnote@4.0.0: {}

-  markdown-it@14.3.2:
+  markdown-it@14.3.3:
    dependencies:
      argparse: 2.0.1
      entities: 4.5.0
@@ -13911,7 +13916,7 @@ snapshots:

  micromatch@4.0.8:
    dependencies:
-      braces: 3.0.3
+      braces: 3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd)
      picomatch: 2.3.2

  mime-db@1.52.0: {}
@@ -13977,7 +13982,7 @@ snapshots:
    dependencies:
      whatwg-url: 5.0.0

-  node-forge@1.4.0: {}
+  node-forge@1.4.0(patch_hash=2798686e4488058ad81c3b8e32eb763c0feff21f4c717ce4d13b6ef2432cd5b8): {}

  node-int64@0.4.0: {}

@@ -14843,7 +14848,7 @@ snapshots:

  split-on-first@3.0.0: {}

-  sprintf-js@1.0.3: {}
+  sprintf-js@1.1.3(patch_hash=05316a8b01f155fe19a1e0cb4042c81d43d798a76755c407684e1199a18b1e08): {}

  stack-generator@2.0.10:
    dependencies:
@@ -15274,21 +15279,21 @@ snapshots:
      tsx: 4.23.15
      yaml: 2.9.1

-  vitest@4.1.11(@types/node@26.6.2)(happy-dom@20.14.5)(jsdom@20.0.3(supports-color@8.1.1))(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)):
+  vitest@4.1.12(@types/node@26.6.2)(happy-dom@20.14.5)(jsdom@20.0.3(supports-color@8.1.1))(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)):
    dependencies:
-      '@vitest/expect': 4.1.11
-      '@vitest/mocker': 4.1.11(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1))
-      '@vitest/pretty-format': 4.1.11
-      '@vitest/runner': 4.1.11
-      '@vitest/snapshot': 4.1.11
-      '@vitest/spy': 4.1.11
-      '@vitest/utils': 4.1.11
+      '@vitest/expect': 4.1.12
+      '@vitest/mocker': 4.1.12(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1))
+      '@vitest/pretty-format': 4.1.12
+      '@vitest/runner': 4.1.12
+      '@vitest/snapshot': 4.1.12
+      '@vitest/spy': 4.1.12
+      '@vitest/utils': 4.1.12
      es-module-lexer: 2.1.0
      expect-type: 1.3.0
      magic-string: 0.30.21
      obug: 2.1.1
      pathe: 2.0.3
-      picomatch: 4.0.4
+      picomatch: 4.0.7
      std-env: 4.1.0
      tinybench: 2.9.0
      tinyexec: 1.1.2
@@ -46,6 +46,8 @@ minimumReleaseAgeExclude:
  - oxlint@1.88.0

 overrides:
+  sprintf-js@<1.1.3: 1.1.3
+  markdown-it@>=14.0.0 <14.3.3: 14.3.3
  # Mermaid 11 still requests KaTeX 0.16; the security fix starts at 0.18.2.
  katex@>=0.11.0 <0.18.2: 0.18.10
  # xcode still requests uuid 7; buffer bounds checks were fixed in 11.1.1.
@@ -54,8 +56,11 @@ overrides:
  query-string: 9.5.1

 patchedDependencies:
+  sprintf-js@1.1.3: patches/sprintf-js@1.1.3.patch
  '@xterm/addon-webgl@0.20.0-beta.300': patches/@xterm__addon-webgl@0.20.0-beta.300.patch
  expo-notifications@55.0.27: patches/expo-notifications@55.0.27.patch
  query-string@9.5.1: patches/query-string@9.5.1.patch
  react-native-webview@13.16.2: patches/react-native-webview@13.16.2.patch
  react-native@0.83.10: patches/react-native@0.83.10.patch
+  braces@3.0.3: patches/braces@3.0.3.patch
+  node-forge@1.4.0: patches/node-forge@1.4.0.patch
@@ -0,0 +1,44 @@
+import { generateKeyPairSync } from 'node:crypto'
+import { createRequire } from 'node:module'
+import { describe, expect, it } from 'vitest'
+
+describe('installed mobile dependency security patches', () => {
+  it.each([true, false])(
+    'rejects extra DigestAlgorithm elements with NULL parameters: %s',
+    (parameters) => {
+      const require = createRequire(import.meta.url)
+      const expoRequire = createRequire(require.resolve('expo'))
+      const cliRequire = createRequire(expoRequire.resolve('@expo/cli'))
+      const forge = cliRequire('node-forge')
+      const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 1024, publicExponent: 3 })
+      const key = forge.pki.privateKeyFromPem(
+        privateKey.export({ type: 'pkcs1', format: 'pem' }).toString()
+      )
+      const publicKey = forge.pki.setRsaPublicKey(key.n, key.e)
+      const md = forge.md.sha256.create().update('release payload')
+      const digest = md.digest().getBytes()
+      expect(publicKey.verify(digest, key.sign(md))).toBe(true)
+      const { asn1 } = forge
+      const element = (type: number, value: unknown, constructed = false) =>
+        asn1.create(asn1.Class.UNIVERSAL, type, constructed, value)
+      const algorithm = element(
+        asn1.Type.SEQUENCE,
+        [
+          element(asn1.Type.OID, asn1.oidToDer(forge.pki.oids.sha256).getBytes()),
+          ...(parameters ? [element(asn1.Type.NULL, '')] : [])
+        ],
+        true
+      )
+      const digestInfo = element(
+        asn1.Type.SEQUENCE,
+        [algorithm, element(asn1.Type.OCTETSTRING, digest)],
+        true
+      )
+      const valid = key.sign(asn1.toDer(digestInfo).getBytes(), 'NONE')
+      expect(publicKey.verify(digest, valid)).toBe(true)
+      algorithm.value.push(element(asn1.Type.OCTETSTRING, 'unexpected padding'))
+      const signature = key.sign(asn1.toDer(digestInfo).getBytes(), 'NONE')
+      expect(() => publicKey.verify(digest, signature)).toThrow('DigestInfo')
+    }
+  )
+})
@@ -164,6 +164,7 @@ settings:
  excludeLinksFromLockfile: false

 overrides:
+  hono@>=4.12.4 <4.13.11: 4.13.11
  monaco-editor>dompurify: 3.4.16
  katex@>=0.11.0 <0.18.2: 0.18.10

@@ -179,11 +180,13 @@ patchedDependencies:
  '@xterm/addon-serialize@0.15.0-beta.301': b35533fe252e7e45433150170348889f4e08a6c17f7017ac34ea694d831fec7f
  '@xterm/addon-webgl@0.20.0-beta.300': 5349718f2c19d9319a81552580bf9618ded9b00f3707a5c6cdbbae1910849cd9
  '@xterm/xterm@6.1.0-beta.304': 87de83f62154c0f2c31eb17d14b881e139f3368f8be1e9e2951bfeba16d86156
+  braces@3.0.3: c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd
  i18next-cli@1.74.2: 2ee32eef742615cd133e1a6940f027deb3723a8430bb7953bba3a6769b0aac47
  lint-staged@16.4.0: 7333b3837f80a7fbd045964db6d76ba4fc118e49134bdbabb00585b6b7b60673
  monaco-editor@0.55.1: 53b71f7d8a7c00b76ffdb73ce83d18e31692f193f5fafa6a390e48f5b3fdd636
  node-pty@1.1.0: 2aa312c1b29d733bfd3e3ece2fbbb4eed7750384d7d9f91effd27318a75b7a95
  oxlint-plugin-anti-slop@0.1.2: c10c871702365a0c2c59e9f1c5fb92df97cae5755d534c0a3d83c6368f6feafe
+  sprintf-js@1.1.3: 05316a8b01f155fe19a1e0cb4042c81d43d798a76755c407684e1199a18b1e08
  ws@8.22.0: 9393e04dd9a90b01eb7aa35fcd5b1431b5038ce999fbbd82651136193ba51f14

 importers:
@@ -1293,7 +1296,7 @@ packages:
    engines: {node: '>=20'}
    peerDependencies:
      '@types/hono': '*'
-      hono: ^4
+      hono: 4.13.11
    peerDependenciesMeta:
      '@types/hono':
        optional: true
@@ -5912,8 +5915,8 @@ packages:
    resolution: {integrity: sha512-Xwwo44whKBVCYoliBQwaPvtd/2tYFkRQtXDWj1nackaV2JPXx3L0+Jvd8/qCJ2p+ML0/XVkJ2q+Mr+UVdpJK5w==}
    engines: {node: '>=12.0.0'}

-  hono@4.13.7:
-    resolution: {integrity: sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==}
+  hono@4.13.11:
+    resolution: {integrity: sha512-/SMX/RQNJn7oNmFwH6DtwDqcrzZU2otm1FD6OJe2cWF6cfy/F8hq0XVBv7xW3FTJshRQwuBnXHDq2kNsdZnshg==}
    engines: {node: '>=16.9.0'}

  hookified@1.15.1:
@@ -9139,9 +9142,9 @@ snapshots:
    dependencies:
      graphql: 16.14.2

-  '@hono/node-server@2.1.0(hono@4.13.7)':
+  '@hono/node-server@2.1.0(hono@4.13.11)':
    dependencies:
-      hono: 4.13.7
+      hono: 4.13.11

  '@humanfs/core@0.19.2':
    dependencies:
@@ -9378,7 +9381,7 @@ snapshots:

  '@modelcontextprotocol/sdk@1.32.1(supports-color@7.2.0)(zod@3.25.76)':
    dependencies:
-      '@hono/node-server': 2.1.0(hono@4.13.7)
+      '@hono/node-server': 2.1.0(hono@4.13.11)
      ajv: 8.20.0
      ajv-formats: 3.0.1
      content-type: 1.0.5
@@ -9388,7 +9391,7 @@ snapshots:
      eventsource-parser: 3.0.8
      express: 5.2.1(supports-color@7.2.0)
      express-rate-limit: 8.5.2(express@5.2.1(supports-color@7.2.0))
-      hono: 4.13.7
+      hono: 4.13.11
      jose: 6.2.3
      json-schema-typed: 8.0.2
      pkce-challenge: 5.0.1
@@ -9403,7 +9406,7 @@ snapshots:

  '@modelcontextprotocol/sdk@1.32.1(supports-color@7.2.0)(zod@4.6.7)':
    dependencies:
-      '@hono/node-server': 2.1.0(hono@4.13.7)
+      '@hono/node-server': 2.1.0(hono@4.13.11)
      ajv: 8.20.0
      ajv-formats: 3.0.1
      content-type: 1.0.5
@@ -9413,7 +9416,7 @@ snapshots:
      eventsource-parser: 3.0.8
      express: 5.2.1(supports-color@7.2.0)
      express-rate-limit: 8.5.2(express@5.2.1(supports-color@7.2.0))
-      hono: 4.13.7
+      hono: 4.13.11
      jose: 6.2.3
      json-schema-typed: 8.0.2
      pkce-challenge: 5.0.1
@@ -11550,7 +11553,7 @@ snapshots:

  '@types/set-cookie-parser@2.4.10':
    dependencies:
-      '@types/node': 18.19.130
+      '@types/node': 24.19.2
    optional: true

  '@types/ssh2@1.15.6':
@@ -11912,7 +11915,7 @@ snapshots:
    dependencies:
      balanced-match: 4.0.4

-  braces@3.0.3:
+  braces@3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd):
    dependencies:
      fill-range: 7.1.1

@@ -13366,7 +13369,7 @@ snapshots:

  highlight.js@11.11.1: {}

-  hono@4.13.7: {}
+  hono@4.13.11: {}

  hookified@1.15.1:
    optional: true
@@ -14346,7 +14349,7 @@ snapshots:

  micromatch@4.0.8:
    dependencies:
-      braces: 3.0.3
+      braces: 3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd)
      picomatch: 2.3.2

  mime-db@1.52.0: {}
@@ -15401,7 +15404,7 @@ snapshots:
      globalthis: 1.0.4
      json-stringify-safe: 5.0.1
      semver-compare: 1.0.0
-      sprintf-js: 1.1.3
+      sprintf-js: 1.1.3(patch_hash=05316a8b01f155fe19a1e0cb4042c81d43d798a76755c407684e1199a18b1e08)
    optional: true

  robust-predicates@3.0.3: {}
@@ -15695,7 +15698,7 @@ snapshots:

  space-separated-tokens@2.0.2: {}

-  sprintf-js@1.1.3:
+  sprintf-js@1.1.3(patch_hash=05316a8b01f155fe19a1e0cb4042c81d43d798a76755c407684e1199a18b1e08):
    optional: true

  ssh2@1.17.0:
@@ -165,6 +165,7 @@ packageExtensions:
      vfile: ^6.0.0

 overrides:
+  hono@>=4.12.4 <4.13.11: 4.13.11
  monaco-editor>dompurify: 3.4.16
  # Upstream markdown/math packages still require the vulnerable 0.16 line.
  katex@>=0.11.0 <0.18.2: 0.18.10
@@ -183,3 +184,5 @@ patchedDependencies:
  ws@8.22.0: config/patches/ws@8.22.0.patch
  oxlint-plugin-anti-slop@0.1.2: config/patches/oxlint-plugin-anti-slop@0.1.2.patch
  monaco-editor@0.55.1: config/patches/monaco-editor@0.55.1.patch
+  braces@3.0.3: config/patches/braces@3.0.3.patch
+  sprintf-js@1.1.3: config/patches/sprintf-js@1.1.3.patch