diff --git a/cloud/apps/push/package.json b/cloud/apps/push/package.json index a4ba2462f5b..3d7b7663d1c 100644 --- a/cloud/apps/push/package.json +++ b/cloud/apps/push/package.json @@ -19,7 +19,7 @@ "@orca-cloud/postgres-schema": "workspace:*", "@orca-cloud/push-contract": "workspace:*", "google-auth-library": "^10.5.0", - "hono": "^4.13.10", + "hono": "^4.13.11", "pg": "^8.22.0", "pg-connection-string": "2.14.0", "tweetnacl": "^1.0.3", @@ -30,6 +30,6 @@ "@types/pg": "^8.20.0", "tsx": "^4.23.15", "typescript": "^5.9.3", - "vitest": "^4.1.11" + "vitest": "^4.1.12" } } diff --git a/cloud/apps/relay-fence-broker/package.json b/cloud/apps/relay-fence-broker/package.json index 6e95ece0581..b8d9646962c 100644 --- a/cloud/apps/relay-fence-broker/package.json +++ b/cloud/apps/relay-fence-broker/package.json @@ -15,13 +15,13 @@ }, "dependencies": { "@hono/node-server": "^2.1.2", - "hono": "^4.13.10", + "hono": "^4.13.11", "zod": "^3.25.76" }, "devDependencies": { "@types/node": "^24.19.0", "tsx": "^4.23.15", "typescript": "^5.9.3", - "vitest": "^4.1.11" + "vitest": "^4.1.12" } } diff --git a/cloud/apps/relay-ops/package.json b/cloud/apps/relay-ops/package.json index d3961198665..b86a7e94466 100644 --- a/cloud/apps/relay-ops/package.json +++ b/cloud/apps/relay-ops/package.json @@ -18,13 +18,13 @@ }, "dependencies": { "@hono/node-server": "^2.1.2", - "hono": "^4.13.10", + "hono": "^4.13.11", "zod": "^3.25.76" }, "devDependencies": { "@types/node": "^24.19.0", "tsx": "^4.23.15", "typescript": "^5.9.3", - "vitest": "^4.1.11" + "vitest": "^4.1.12" } } diff --git a/cloud/apps/relay/package.json b/cloud/apps/relay/package.json index 431156103d2..d15d38b6609 100644 --- a/cloud/apps/relay/package.json +++ b/cloud/apps/relay/package.json @@ -18,7 +18,7 @@ "@hono/node-server": "^2.1.2", "@orca-cloud/postgres-schema": "workspace:*", "@orca-cloud/relay-contract": "workspace:*", - "hono": "^4.13.10", + "hono": "^4.13.11", "jose": "^6.2.12", "pg": "^8.22.0", "tweetnacl": "^1.0.3", @@ -31,6 +31,6 @@ "@types/ws": "^8.18.1", "tsx": "^4.23.15", "typescript": "^5.9.3", - "vitest": "^4.1.11" + "vitest": "^4.1.12" } } diff --git a/cloud/package.json b/cloud/package.json index de5daabc60d..b2d86cd167a 100644 --- a/cloud/package.json +++ b/cloud/package.json @@ -26,7 +26,7 @@ "@types/node": "^24.19.0", "tsx": "^4.23.15", "typescript": "^5.9.3", - "vitest": "^4.1.11" + "vitest": "^4.1.12" }, "engines": { "node": ">=24 <27", diff --git a/cloud/packages/postgres-schema/package.json b/cloud/packages/postgres-schema/package.json index 594c799a5b5..b480c1e5633 100644 --- a/cloud/packages/postgres-schema/package.json +++ b/cloud/packages/postgres-schema/package.json @@ -15,6 +15,6 @@ "devDependencies": { "@types/node": "^24.19.0", "typescript": "^5.9.3", - "vitest": "^4.1.11" + "vitest": "^4.1.12" } } diff --git a/cloud/packages/push-contract/package.json b/cloud/packages/push-contract/package.json index 19f4941ba4a..8d677e19850 100644 --- a/cloud/packages/push-contract/package.json +++ b/cloud/packages/push-contract/package.json @@ -18,6 +18,6 @@ "devDependencies": { "@types/node": "^24.19.0", "typescript": "^5.9.3", - "vitest": "^4.1.11" + "vitest": "^4.1.12" } } diff --git a/cloud/packages/relay-contract/package.json b/cloud/packages/relay-contract/package.json index 5aa329a3d81..34fea3e94b6 100644 --- a/cloud/packages/relay-contract/package.json +++ b/cloud/packages/relay-contract/package.json @@ -18,6 +18,6 @@ "devDependencies": { "@types/node": "^24.19.0", "typescript": "^5.9.3", - "vitest": "^4.1.11" + "vitest": "^4.1.12" } } diff --git a/cloud/pnpm-lock.yaml b/cloud/pnpm-lock.yaml index ba788c076b2..c971986ba90 100644 --- a/cloud/pnpm-lock.yaml +++ b/cloud/pnpm-lock.yaml @@ -162,6 +162,9 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + vite@>=8.0.0 <8.1.6: 8.3.4 + importers: .: @@ -179,14 +182,14 @@ importers: specifier: ^5.9.3 version: 5.9.3 vitest: - specifier: ^4.1.11 - version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) + specifier: ^4.1.12 + version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) apps/push: dependencies: '@hono/node-server': specifier: ^2.1.2 - version: 2.1.2(hono@4.13.10) + version: 2.1.2(hono@4.13.13) '@orca-cloud/postgres-schema': specifier: workspace:* version: link:../../packages/postgres-schema @@ -197,8 +200,8 @@ importers: specifier: ^10.5.0 version: 10.9.1 hono: - specifier: ^4.13.10 - version: 4.13.10 + specifier: ^4.13.11 + version: 4.13.13 pg: specifier: ^8.22.0 version: 8.22.0 @@ -225,14 +228,14 @@ importers: specifier: ^5.9.3 version: 5.9.3 vitest: - specifier: ^4.1.11 - version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) + specifier: ^4.1.12 + version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) apps/relay: dependencies: '@hono/node-server': specifier: ^2.1.2 - version: 2.1.2(hono@4.13.10) + version: 2.1.2(hono@4.13.13) '@orca-cloud/postgres-schema': specifier: workspace:* version: link:../../packages/postgres-schema @@ -240,8 +243,8 @@ importers: specifier: workspace:* version: link:../../packages/relay-contract hono: - specifier: ^4.13.10 - version: 4.13.10 + specifier: ^4.13.11 + version: 4.13.13 jose: specifier: ^6.2.12 version: 6.2.12 @@ -274,17 +277,17 @@ importers: specifier: ^5.9.3 version: 5.9.3 vitest: - specifier: ^4.1.11 - version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) + specifier: ^4.1.12 + version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) apps/relay-fence-broker: dependencies: '@hono/node-server': specifier: ^2.1.2 - version: 2.1.2(hono@4.13.10) + version: 2.1.2(hono@4.13.13) hono: - specifier: ^4.13.10 - version: 4.13.10 + specifier: ^4.13.11 + version: 4.13.13 zod: specifier: ^3.25.76 version: 3.25.76 @@ -299,17 +302,17 @@ importers: specifier: ^5.9.3 version: 5.9.3 vitest: - specifier: ^4.1.11 - version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) + specifier: ^4.1.12 + version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) apps/relay-ops: dependencies: '@hono/node-server': specifier: ^2.1.2 - version: 2.1.2(hono@4.13.10) + version: 2.1.2(hono@4.13.13) hono: - specifier: ^4.13.10 - version: 4.13.10 + specifier: ^4.13.11 + version: 4.13.13 zod: specifier: ^3.25.76 version: 3.25.76 @@ -324,8 +327,8 @@ importers: specifier: ^5.9.3 version: 5.9.3 vitest: - specifier: ^4.1.11 - version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) + specifier: ^4.1.12 + version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) packages/postgres-schema: devDependencies: @@ -336,8 +339,8 @@ importers: specifier: ^5.9.3 version: 5.9.3 vitest: - specifier: ^4.1.11 - version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) + specifier: ^4.1.12 + version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) packages/push-contract: dependencies: @@ -352,8 +355,8 @@ importers: specifier: ^5.9.3 version: 5.9.3 vitest: - specifier: ^4.1.11 - version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) + specifier: ^4.1.12 + version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) packages/relay-contract: dependencies: @@ -368,20 +371,11 @@ importers: specifier: ^5.9.3 version: 5.9.3 vitest: - specifier: ^4.1.11 - version: 4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) + specifier: ^4.1.12 + version: 4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) packages: - '@emnapi/core@1.10.0': - resolution: {integrity: sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==} - - '@emnapi/runtime@1.10.0': - resolution: {integrity: sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==} - - '@emnapi/wasi-threads@1.2.1': - resolution: {integrity: sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==} - '@esbuild/aix-ppc64@0.28.2': resolution: {integrity: sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==} engines: {node: '>=18'} @@ -547,107 +541,101 @@ packages: '@jridgewell/sourcemap-codec@1.5.5': resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==} - '@napi-rs/wasm-runtime@1.2.5': - resolution: {integrity: sha512-HshSvXzmBxNzqejd3k/KemgQ3hdREUYFRRrgxOZ+gPljDIsO2SDZrVZMd4Z/HsxudQbE62OVyVFE8z9BCurfjA==} - engines: {node: ^20.19.0 || ^22.13.0 || >=23.5.0} - peerDependencies: - '@emnapi/core': ^1.7.1 || ^2.0.0-alpha.4 - '@emnapi/runtime': ^1.7.1 || ^2.0.0-alpha.4 + '@oxc-project/types@0.154.0': + resolution: {integrity: sha512-KYOUGQFlLWR+s4QMV2Q9ko38TZm7EdO87Qm7rvZLqk/webse/cDjtyxKhg/47l0byCbs/k46LT8qc4PKjAikzA==} - '@oxc-project/types@0.133.0': - resolution: {integrity: sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==} + '@rolldown/binding-android-arm-eabi@1.2.14': + resolution: {integrity: sha512-aWR+XKH9+rW7m5fWq/5360J3mHycrx/o6xZM2DQFdJnTMdyP7/WzxPjhtLbVWdKo2y612/4U1bWqb3HQhiF7vg==} + engines: {node: ^20.19.0 || >=22.12.0} + cpu: [arm] + os: [android] - '@rolldown/binding-android-arm64@1.0.3': - resolution: {integrity: sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==} + '@rolldown/binding-android-arm64@1.2.14': + resolution: {integrity: sha512-QiVxHofl6A8lQU7WAtOUY4QMVZXohxwz7WJJoeh8NBEUyKfIkMRKhYyq8az/1RypNiIXzNTtiS6KwHz0erxYRQ==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [android] - '@rolldown/binding-darwin-arm64@1.0.3': - resolution: {integrity: sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==} + '@rolldown/binding-darwin-arm64@1.2.14': + resolution: {integrity: sha512-lTQOzHuBIooh3jIr5XINQkjPGEuGy+Dsy0meXDr6Sjty0b99kYgGh4uBC/8mJX1T0kC8d6S0aPP1Y+bHkh6aBw==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [darwin] - '@rolldown/binding-darwin-x64@1.0.3': - resolution: {integrity: sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==} + '@rolldown/binding-darwin-x64@1.2.14': + resolution: {integrity: sha512-hyMKEGatjmBYCs/Q4sbIcL/GqpFEqsX3wc+HYVQ/85A4rxc1o7rPm4DUI4GV4k/h0ITddwFSGpqQunI14GXjTA==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [darwin] - '@rolldown/binding-freebsd-x64@1.0.3': - resolution: {integrity: sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==} + '@rolldown/binding-freebsd-x64@1.2.14': + resolution: {integrity: sha512-u371GbXoVXrEgP20PwzoGNOdAOqAMhzo19JzzY+V4YmmnC+DTOoqdbMu+O+54emM59Mik/UdrtWgcuEDKWRPKA==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [freebsd] - '@rolldown/binding-linux-arm-gnueabihf@1.0.3': - resolution: {integrity: sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==} + '@rolldown/binding-linux-arm-gnueabihf@1.2.14': + resolution: {integrity: sha512-BqwKsdZQf6EqVWr8fv2MrDYzAvOZ7+NYFSJESRGs87fkseEhs0TU9TXgRJTkZoRRkxTizyEg1LKUXfU3/78uqg==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm] os: [linux] - '@rolldown/binding-linux-arm64-gnu@1.0.3': - resolution: {integrity: sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==} + '@rolldown/binding-linux-arm64-gnu@1.2.14': + resolution: {integrity: sha512-SD9kY8M009x/7s57Z1dgUVlP5+uYBgKQK0Tkr1WIWngrtUJmRCW1RJFMY7QDla2khXhmg2i5Io7MUjcmZNZ/KQ==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [linux] libc: [glibc] - '@rolldown/binding-linux-arm64-musl@1.0.3': - resolution: {integrity: sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==} + '@rolldown/binding-linux-arm64-musl@1.2.14': + resolution: {integrity: sha512-BJ2CL19M6uuWesMgnqJzgxoI+N+eV7b0A9O9vLV42y+gitC41fNa8KElau1tHVzuLWX5GzEuxMPhAO0tQXQMkg==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [linux] libc: [musl] - '@rolldown/binding-linux-ppc64-gnu@1.0.3': - resolution: {integrity: sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==} + '@rolldown/binding-linux-ppc64-gnu@1.2.14': + resolution: {integrity: sha512-4+Kl8daPV8NDHaD7mfCcc1pRM+Qg7ab8DyMm5FG5WoZgv4h2i3KFN1CybYBNbQqmuYm7ftJLvmMI1eHYJ22S/Q==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [ppc64] os: [linux] libc: [glibc] - '@rolldown/binding-linux-s390x-gnu@1.0.3': - resolution: {integrity: sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==} + '@rolldown/binding-linux-s390x-gnu@1.2.14': + resolution: {integrity: sha512-V/h8ePq1fKDrmtFMz6xcCN3DKvuvMRrwwD1q0PkBeeo4DpK64biaKvqWGVxqCeYKqeRk7gE7/iKPxLCn08O97A==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [s390x] os: [linux] libc: [glibc] - '@rolldown/binding-linux-x64-gnu@1.0.3': - resolution: {integrity: sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==} + '@rolldown/binding-linux-x64-gnu@1.2.14': + resolution: {integrity: sha512-WxalXzgrLVpKC93xfpaJ3gCXUWzeCr+FRCbDVD2mUAy4L6Vo3lNVz0epUEUpxPWJkLNYUwM4OSIikv36OJ9mLg==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [linux] libc: [glibc] - '@rolldown/binding-linux-x64-musl@1.0.3': - resolution: {integrity: sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==} + '@rolldown/binding-linux-x64-musl@1.2.14': + resolution: {integrity: sha512-3G3tnAmTpdk9jO3GQtyHXqeFD2SlecfTws/Y3M2mmj9nMBwwuLT4kur8sZKeu7ENUHSpVO3cIsm5A52LEWWwlg==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [linux] libc: [musl] - '@rolldown/binding-openharmony-arm64@1.0.3': - resolution: {integrity: sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==} + '@rolldown/binding-openharmony-arm64@1.2.14': + resolution: {integrity: sha512-qyr5XiNGxm2ytx17vvtcJ9nXn6v1gENETi503bJx3OGwZ1tSonj7BosxbMa/xeAfSl5iS9X6KjEWYXLu6v1L7Q==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [openharmony] - '@rolldown/binding-wasm32-wasi@1.0.3': - resolution: {integrity: sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==} - engines: {node: ^20.19.0 || >=22.12.0} - cpu: [wasm32] - - '@rolldown/binding-win32-arm64-msvc@1.0.3': - resolution: {integrity: sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==} + '@rolldown/binding-win32-arm64-msvc@1.2.14': + resolution: {integrity: sha512-oA4o5o0S2yB199YyYXDzKUv1Z56Rc+mgOjwm7Z/vJ9Z8igiDPYvoOuDyo6g7AK/ZaF09nPhDKVnGBcYHO11GXA==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [win32] - '@rolldown/binding-win32-x64-msvc@1.0.3': - resolution: {integrity: sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==} + '@rolldown/binding-win32-x64-msvc@1.2.14': + resolution: {integrity: sha512-9mE94bf2GZUaR/fUSXCMpBoWkctu421Mi0ORpm4zqfbkjKep7RxzPFa5etcGs5h+2KApoWBOA/hAJa/7saGgEQ==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [win32] @@ -658,9 +646,6 @@ packages: '@standard-schema/spec@1.1.0': resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==} - '@tybys/wasm-util@0.10.4': - resolution: {integrity: sha512-W3c4gRigFS0T/Ma4qIYF3GDAc5AQdHb1yL5znJT1Zv1YaD9Kitx656wBjvr19qbiosmZT8lWDM5BEMynUqX65A==} - '@types/chai@5.2.3': resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==} @@ -679,34 +664,34 @@ packages: '@types/ws@8.18.1': resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==} - '@vitest/expect@4.1.11': - resolution: {integrity: sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==} + '@vitest/expect@4.1.12': + resolution: {integrity: sha512-vFlTt+YEu9WBpNjdGayNmlMVzrWPi1+sv853/7t2FU7hpO5gAFBKHzQmkCq5Xjpr+evegF2994LQT3hF3mRlqQ==} - '@vitest/mocker@4.1.11': - resolution: {integrity: sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==} + '@vitest/mocker@4.1.12': + resolution: {integrity: sha512-fKShNpKZzupWZuY0z7egydvL0sqW4INEZBEExMBMAa6izlENEVHwoXgdaTCaBZ5fwlr4xf2o1wXC83n9RpO+NA==} peerDependencies: msw: ^2.4.9 - vite: ^6.0.0 || ^7.0.0 || ^8.0.0 + vite: 8.3.4 peerDependenciesMeta: msw: optional: true vite: optional: true - '@vitest/pretty-format@4.1.11': - resolution: {integrity: sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==} + '@vitest/pretty-format@4.1.12': + resolution: {integrity: sha512-XW9O8+Mxx4VpCtkYdMJLZQQwsVryP9wk7cPKDxtXFfwSak6yRh5+2fep/Y0XF/ElBvJHq8bcYdi6aeuai0opZA==} - '@vitest/runner@4.1.11': - resolution: {integrity: sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==} + '@vitest/runner@4.1.12': + resolution: {integrity: sha512-NKlVKCr5QnCe8jijdMnmkpHHU+WTqiLFR6G0pHji9uRjXK9xJl1k1nTw6F3pOOj2PDcsDt2GKQMI7wIsaT491w==} - '@vitest/snapshot@4.1.11': - resolution: {integrity: sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==} + '@vitest/snapshot@4.1.12': + resolution: {integrity: sha512-ko1y1Qgb/slzQ9mr+b89Cuqud8WG1TKtsPD8r7ZUBdvVOGt85Af2HwCqHujrhwJq95hs/9RM7fcAPg57o1vlzw==} - '@vitest/spy@4.1.11': - resolution: {integrity: sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==} + '@vitest/spy@4.1.12': + resolution: {integrity: sha512-RGq9x4JNGNTZHEJxvN0oSiJjeSCExm0n2gZKKJZHY9cX5AVA6M7VJILBT3ZJ/tJ/0J9uWT7fETV9/btoi//vSg==} - '@vitest/utils@4.1.11': - resolution: {integrity: sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==} + '@vitest/utils@4.1.12': + resolution: {integrity: sha512-Q3awXrwOfEV+qc3WmO5ONyE0yO7Q1gQ9/oyHxGLZ/pl7N3NO/ZztqQwKLuwMkV+CA1JYSIeO3gkHnRDIo4AVaA==} agent-base@7.1.4: resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==} @@ -808,8 +793,8 @@ packages: resolution: {integrity: sha512-eAmLkjDjAFCVXg7A1unxHsLf961m6y17QFqXqAXGj/gVkKFrEICfStRfwUlGNfeCEjNRa32JEWOUTlYXPyyKvA==} engines: {node: '>=14'} - hono@4.13.10: - resolution: {integrity: sha512-dQuLsa5oO+47QVMVMaaD9cIv8ctmVtK1iRvwWngkfloFJMeFeuoUFDswIqZGxmGX3hrRzREgEArjkK9OgsQEhA==} + hono@4.13.13: + resolution: {integrity: sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==} engines: {node: '>=16.9.0'} https-proxy-agent@7.0.6: @@ -966,10 +951,6 @@ packages: picocolors@1.1.1: resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==} - picomatch@4.0.4: - resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==} - engines: {node: '>=12'} - picomatch@4.0.7: resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==} engines: {node: '>=12'} @@ -994,8 +975,8 @@ packages: resolution: {integrity: sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==} engines: {node: '>=0.10.0'} - rolldown@1.0.3: - resolution: {integrity: sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==} + rolldown@1.2.14: + resolution: {integrity: sha512-eTBTTqMR6uHKLgcUqpJP8ntzDI6V4LYA8negAMBEI7gkgVvOdrx6VsvS2Ym+83KhOPdLCHWJu0w7UQFJZhHKNw==} engines: {node: ^20.19.0 || >=22.12.0} hasBin: true @@ -1034,9 +1015,6 @@ packages: resolution: {integrity: sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==} engines: {node: '>=14.0.0'} - tslib@2.8.1: - resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==} - tsx@4.23.15: resolution: {integrity: sha512-Yiex1Ovn8z2xPpOWckIiysV1SSyRMY9BkLF++q0yKiDxCqRhosKfMg3janKkiLBwZ5c/YryloKwGZcrEmtwxKw==} engines: {node: '>=18.0.0'} @@ -1053,13 +1031,13 @@ packages: undici-types@7.24.6: resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==} - vite@8.0.16: - resolution: {integrity: sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==} + vite@8.3.4: + resolution: {integrity: sha512-IftLE8phJhdNRIGNEV4JCCvfNScoZQVfcXaN8TQropWGJtOHcu+iAB9pHcuGvmEb/kddw0LBe/jS8ztdC6xdiQ==} engines: {node: ^20.19.0 || >=22.12.0} hasBin: true peerDependencies: '@types/node': ^20.19.0 || >=22.12.0 - '@vitejs/devtools': ^0.1.18 + '@vitejs/devtools': ^0.7.1 esbuild: ^0.27.0 || ^0.28.0 jiti: '>=1.21.0' less: ^4.0.0 @@ -1096,23 +1074,23 @@ packages: yaml: optional: true - vitest@4.1.11: - resolution: {integrity: sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==} + vitest@4.1.12: + resolution: {integrity: sha512-5eWdz2yb3ajxWF3C8C4TjkXl7FGm3n2E/VlazALrQHzK7nYMSGFnCZto0bbPNl77AwkOZVLk0YnBAejUu0NiWA==} engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0} hasBin: true peerDependencies: '@edge-runtime/vm': '*' '@opentelemetry/api': ^1.9.0 '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0 - '@vitest/browser-playwright': 4.1.11 - '@vitest/browser-preview': 4.1.11 - '@vitest/browser-webdriverio': 4.1.11 - '@vitest/coverage-istanbul': 4.1.11 - '@vitest/coverage-v8': 4.1.11 - '@vitest/ui': 4.1.11 + '@vitest/browser-playwright': 4.1.12 + '@vitest/browser-preview': 4.1.12 + '@vitest/browser-webdriverio': ^4.1.11 + '@vitest/coverage-istanbul': 4.1.12 + '@vitest/coverage-v8': 4.1.12 + '@vitest/ui': 4.1.12 happy-dom: '*' jsdom: '*' - vite: ^6.0.0 || ^7.0.0 || ^8.0.0 + vite: 8.3.4 peerDependenciesMeta: '@edge-runtime/vm': optional: true @@ -1167,22 +1145,6 @@ packages: snapshots: - '@emnapi/core@1.10.0': - dependencies: - '@emnapi/wasi-threads': 1.2.1 - tslib: 2.8.1 - optional: true - - '@emnapi/runtime@1.10.0': - dependencies: - tslib: 2.8.1 - optional: true - - '@emnapi/wasi-threads@1.2.1': - dependencies: - tslib: 2.8.1 - optional: true - '@esbuild/aix-ppc64@0.28.2': optional: true @@ -1261,79 +1223,63 @@ snapshots: '@esbuild/win32-x64@0.28.2': optional: true - '@hono/node-server@2.1.2(hono@4.13.10)': + '@hono/node-server@2.1.2(hono@4.13.13)': dependencies: - hono: 4.13.10 + hono: 4.13.13 '@jridgewell/sourcemap-codec@1.5.5': {} - '@napi-rs/wasm-runtime@1.2.5(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)': - dependencies: - '@emnapi/core': 1.10.0 - '@emnapi/runtime': 1.10.0 - '@tybys/wasm-util': 0.10.4 + '@oxc-project/types@0.154.0': {} + + '@rolldown/binding-android-arm-eabi@1.2.14': optional: true - '@oxc-project/types@0.133.0': {} - - '@rolldown/binding-android-arm64@1.0.3': + '@rolldown/binding-android-arm64@1.2.14': optional: true - '@rolldown/binding-darwin-arm64@1.0.3': + '@rolldown/binding-darwin-arm64@1.2.14': optional: true - '@rolldown/binding-darwin-x64@1.0.3': + '@rolldown/binding-darwin-x64@1.2.14': optional: true - '@rolldown/binding-freebsd-x64@1.0.3': + '@rolldown/binding-freebsd-x64@1.2.14': optional: true - '@rolldown/binding-linux-arm-gnueabihf@1.0.3': + '@rolldown/binding-linux-arm-gnueabihf@1.2.14': optional: true - '@rolldown/binding-linux-arm64-gnu@1.0.3': + '@rolldown/binding-linux-arm64-gnu@1.2.14': optional: true - '@rolldown/binding-linux-arm64-musl@1.0.3': + '@rolldown/binding-linux-arm64-musl@1.2.14': optional: true - '@rolldown/binding-linux-ppc64-gnu@1.0.3': + '@rolldown/binding-linux-ppc64-gnu@1.2.14': optional: true - '@rolldown/binding-linux-s390x-gnu@1.0.3': + '@rolldown/binding-linux-s390x-gnu@1.2.14': optional: true - '@rolldown/binding-linux-x64-gnu@1.0.3': + '@rolldown/binding-linux-x64-gnu@1.2.14': optional: true - '@rolldown/binding-linux-x64-musl@1.0.3': + '@rolldown/binding-linux-x64-musl@1.2.14': optional: true - '@rolldown/binding-openharmony-arm64@1.0.3': + '@rolldown/binding-openharmony-arm64@1.2.14': optional: true - '@rolldown/binding-wasm32-wasi@1.0.3': - dependencies: - '@emnapi/core': 1.10.0 - '@emnapi/runtime': 1.10.0 - '@napi-rs/wasm-runtime': 1.2.5(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0) + '@rolldown/binding-win32-arm64-msvc@1.2.14': optional: true - '@rolldown/binding-win32-arm64-msvc@1.0.3': - optional: true - - '@rolldown/binding-win32-x64-msvc@1.0.3': + '@rolldown/binding-win32-x64-msvc@1.2.14': optional: true '@rolldown/pluginutils@1.0.1': {} '@standard-schema/spec@1.1.0': {} - '@tybys/wasm-util@0.10.4': - dependencies: - tslib: 2.8.1 - optional: true - '@types/chai@5.2.3': dependencies: '@types/deep-eql': 4.0.2 @@ -1357,44 +1303,44 @@ snapshots: dependencies: '@types/node': 24.19.0 - '@vitest/expect@4.1.11': + '@vitest/expect@4.1.12': dependencies: '@standard-schema/spec': 1.1.0 '@types/chai': 5.2.3 - '@vitest/spy': 4.1.11 - '@vitest/utils': 4.1.11 + '@vitest/spy': 4.1.12 + '@vitest/utils': 4.1.12 chai: 6.2.2 tinyrainbow: 3.1.0 - '@vitest/mocker@4.1.11(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))': + '@vitest/mocker@4.1.12(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15))': dependencies: - '@vitest/spy': 4.1.11 + '@vitest/spy': 4.1.12 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: - vite: 8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15) + vite: 8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15) - '@vitest/pretty-format@4.1.11': + '@vitest/pretty-format@4.1.12': dependencies: tinyrainbow: 3.1.0 - '@vitest/runner@4.1.11': + '@vitest/runner@4.1.12': dependencies: - '@vitest/utils': 4.1.11 + '@vitest/utils': 4.1.12 pathe: 2.0.3 - '@vitest/snapshot@4.1.11': + '@vitest/snapshot@4.1.12': dependencies: - '@vitest/pretty-format': 4.1.11 - '@vitest/utils': 4.1.11 + '@vitest/pretty-format': 4.1.12 + '@vitest/utils': 4.1.12 magic-string: 0.30.21 pathe: 2.0.3 - '@vitest/spy@4.1.11': {} + '@vitest/spy@4.1.12': {} - '@vitest/utils@4.1.11': + '@vitest/utils@4.1.12': dependencies: - '@vitest/pretty-format': 4.1.11 + '@vitest/pretty-format': 4.1.12 convert-source-map: 2.0.0 tinyrainbow: 3.1.0 @@ -1463,9 +1409,9 @@ snapshots: extend@3.0.2: {} - fdir@6.5.0(picomatch@4.0.4): + fdir@6.5.0(picomatch@4.0.7): optionalDependencies: - picomatch: 4.0.4 + picomatch: 4.0.7 fetch-blob@3.2.0: dependencies: @@ -1508,7 +1454,7 @@ snapshots: google-logging-utils@1.1.3: {} - hono@4.13.10: {} + hono@4.13.13: {} https-proxy-agent@7.0.6: dependencies: @@ -1640,8 +1586,6 @@ snapshots: picocolors@1.1.1: {} - picomatch@4.0.4: {} - picomatch@4.0.7: {} postcss@8.5.30: @@ -1660,26 +1604,26 @@ snapshots: dependencies: xtend: 4.0.2 - rolldown@1.0.3: + rolldown@1.2.14: dependencies: - '@oxc-project/types': 0.133.0 + '@oxc-project/types': 0.154.0 '@rolldown/pluginutils': 1.0.1 optionalDependencies: - '@rolldown/binding-android-arm64': 1.0.3 - '@rolldown/binding-darwin-arm64': 1.0.3 - '@rolldown/binding-darwin-x64': 1.0.3 - '@rolldown/binding-freebsd-x64': 1.0.3 - '@rolldown/binding-linux-arm-gnueabihf': 1.0.3 - '@rolldown/binding-linux-arm64-gnu': 1.0.3 - '@rolldown/binding-linux-arm64-musl': 1.0.3 - '@rolldown/binding-linux-ppc64-gnu': 1.0.3 - '@rolldown/binding-linux-s390x-gnu': 1.0.3 - '@rolldown/binding-linux-x64-gnu': 1.0.3 - '@rolldown/binding-linux-x64-musl': 1.0.3 - '@rolldown/binding-openharmony-arm64': 1.0.3 - '@rolldown/binding-wasm32-wasi': 1.0.3 - '@rolldown/binding-win32-arm64-msvc': 1.0.3 - '@rolldown/binding-win32-x64-msvc': 1.0.3 + '@rolldown/binding-android-arm-eabi': 1.2.14 + '@rolldown/binding-android-arm64': 1.2.14 + '@rolldown/binding-darwin-arm64': 1.2.14 + '@rolldown/binding-darwin-x64': 1.2.14 + '@rolldown/binding-freebsd-x64': 1.2.14 + '@rolldown/binding-linux-arm-gnueabihf': 1.2.14 + '@rolldown/binding-linux-arm64-gnu': 1.2.14 + '@rolldown/binding-linux-arm64-musl': 1.2.14 + '@rolldown/binding-linux-ppc64-gnu': 1.2.14 + '@rolldown/binding-linux-s390x-gnu': 1.2.14 + '@rolldown/binding-linux-x64-gnu': 1.2.14 + '@rolldown/binding-linux-x64-musl': 1.2.14 + '@rolldown/binding-openharmony-arm64': 1.2.14 + '@rolldown/binding-win32-arm64-msvc': 1.2.14 + '@rolldown/binding-win32-x64-msvc': 1.2.14 safe-buffer@5.2.1: {} @@ -1699,14 +1643,11 @@ snapshots: tinyglobby@0.2.17: dependencies: - fdir: 6.5.0(picomatch@4.0.4) - picomatch: 4.0.4 + fdir: 6.5.0(picomatch@4.0.7) + picomatch: 4.0.7 tinyrainbow@3.1.0: {} - tslib@2.8.1: - optional: true - tsx@4.23.15: dependencies: esbuild: 0.28.2 @@ -1719,12 +1660,12 @@ snapshots: undici-types@7.24.6: {} - vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15): + vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15): dependencies: lightningcss: 1.33.0 picomatch: 4.0.7 postcss: 8.5.30 - rolldown: 1.0.3 + rolldown: 1.2.14 tinyglobby: 0.2.17 optionalDependencies: '@types/node': 24.19.0 @@ -1732,27 +1673,27 @@ snapshots: fsevents: 2.3.3 tsx: 4.23.15 - vitest@4.1.11(@types/node@24.19.0)(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)): + vitest@4.1.12(@types/node@24.19.0)(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)): dependencies: - '@vitest/expect': 4.1.11 - '@vitest/mocker': 4.1.11(vite@8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) - '@vitest/pretty-format': 4.1.11 - '@vitest/runner': 4.1.11 - '@vitest/snapshot': 4.1.11 - '@vitest/spy': 4.1.11 - '@vitest/utils': 4.1.11 + '@vitest/expect': 4.1.12 + '@vitest/mocker': 4.1.12(vite@8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15)) + '@vitest/pretty-format': 4.1.12 + '@vitest/runner': 4.1.12 + '@vitest/snapshot': 4.1.12 + '@vitest/spy': 4.1.12 + '@vitest/utils': 4.1.12 es-module-lexer: 2.1.0 expect-type: 1.3.0 magic-string: 0.30.21 obug: 2.1.3 pathe: 2.0.3 - picomatch: 4.0.4 + picomatch: 4.0.7 std-env: 4.1.0 tinybench: 2.9.0 tinyexec: 1.2.4 tinyglobby: 0.2.17 tinyrainbow: 3.1.0 - vite: 8.0.16(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15) + vite: 8.3.4(@types/node@24.19.0)(esbuild@0.28.2)(tsx@4.23.15) why-is-node-running: 2.3.0 optionalDependencies: '@types/node': 24.19.0 diff --git a/cloud/pnpm-workspace.yaml b/cloud/pnpm-workspace.yaml index af76ff32b47..3e18b93fdfa 100644 --- a/cloud/pnpm-workspace.yaml +++ b/cloud/pnpm-workspace.yaml @@ -8,3 +8,6 @@ engineStrict: false # pnpm 10 skipped this unlisted build script; keep the binary-only install it produced. allowBuilds: esbuild: false + +overrides: + vite@>=8.0.0 <8.1.6: 8.3.4 diff --git a/config/audit-tools/pnpm-lock.yaml b/config/audit-tools/pnpm-lock.yaml index 8ad8aa84360..c05616c1588 100644 --- a/config/audit-tools/pnpm-lock.yaml +++ b/config/audit-tools/pnpm-lock.yaml @@ -162,6 +162,9 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +patchedDependencies: + braces@3.0.3: c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd + importers: .: @@ -2044,7 +2047,7 @@ snapshots: dependencies: balanced-match: 4.0.4 - braces@3.0.3: + braces@3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd): dependencies: fill-range: 7.1.1 @@ -2404,7 +2407,7 @@ snapshots: micromatch@4.0.8: dependencies: - braces: 3.0.3 + braces: 3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd) picomatch: 2.3.2 mimic-function@5.0.1: {} diff --git a/config/audit-tools/pnpm-workspace.yaml b/config/audit-tools/pnpm-workspace.yaml index 7362ae525fc..ad6b76d09c5 100644 --- a/config/audit-tools/pnpm-workspace.yaml +++ b/config/audit-tools/pnpm-workspace.yaml @@ -1,3 +1,6 @@ minimumReleaseAge: 4320 ignoreScripts: true allowBuilds: {} + +patchedDependencies: + braces@3.0.3: ../patches/braces@3.0.3.patch diff --git a/config/patches/braces@3.0.3.patch b/config/patches/braces@3.0.3.patch new file mode 100644 index 00000000000..823a8d207a1 --- /dev/null +++ b/config/patches/braces@3.0.3.patch @@ -0,0 +1,99 @@ +diff --git a/lib/compile.js b/lib/compile.js +index dce69beb90ece5c3b0ca234a949418f9f34eedbc..6f63213f5da97c9c9989494c65e0c53a82e19d92 100644 +--- a/lib/compile.js ++++ b/lib/compile.js +@@ -4,7 +4,10 @@ const fill = require('fill-range'); + const utils = require('./utils'); + + const compile = (ast, options = {}) => { +- const walk = (node, parent = {}) => { ++ const walk = (node, parent = {}, depth = 0) => { ++ if (depth > 128) { ++ throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)'); ++ } + const invalidBlock = utils.isInvalidBrace(parent); + const invalidNode = node.invalid === true && options.escapeInvalid === true; + const invalid = invalidBlock === true || invalidNode === true; +@@ -47,7 +50,7 @@ const compile = (ast, options = {}) => { + + if (node.nodes) { + for (const child of node.nodes) { +- output += walk(child, node); ++ output += walk(child, node, depth + 1); + } + } + +diff --git a/lib/expand.js b/lib/expand.js +index 35b2c41d6afdb8f0197959e26079f266e48370d3..342b39e342b0ab0365edde268f2abac378db095a 100644 +--- a/lib/expand.js ++++ b/lib/expand.js +@@ -33,7 +33,10 @@ const append = (queue = '', stash = '', enclose = false) => { + const expand = (ast, options = {}) => { + const rangeLimit = options.rangeLimit === undefined ? 1000 : options.rangeLimit; + +- const walk = (node, parent = {}) => { ++ const walk = (node, parent = {}, depth = 0) => { ++ if (depth > 128) { ++ throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)'); ++ } + node.queue = []; + + let p = parent; +@@ -100,7 +103,7 @@ const expand = (ast, options = {}) => { + } + + if (child.nodes) { +- walk(child, node); ++ walk(child, node, depth + 1); + } + } + +diff --git a/lib/parse.js b/lib/parse.js +index 3a6988e629f52aee6609dc5ec290a5e9ff47cecb..f91b5c272bf7d399b88fed7be553fe1d140da972 100644 +--- a/lib/parse.js ++++ b/lib/parse.js +@@ -143,6 +143,9 @@ const parse = (input, options = {}) => { + */ + + if (value === CHAR_LEFT_PARENTHESES) { ++ if (stack.length > 128) { ++ throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)'); ++ } + block = push({ type: 'paren', nodes: [] }); + stack.push(block); + push({ type: 'text', value }); +@@ -195,6 +198,9 @@ const parse = (input, options = {}) => { + */ + + if (value === CHAR_LEFT_CURLY_BRACE) { ++ if (stack.length > 128) { ++ throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)'); ++ } + depth++; + + const dollar = prev.value && prev.value.slice(-1) === '$' || block.dollar === true; +diff --git a/lib/stringify.js b/lib/stringify.js +index 8bcf872c31894f81a8c64d9202fd607e4fd7ea2b..1f03c5cd154a8443f9b95a824ec4f315e7382e4f 100644 +--- a/lib/stringify.js ++++ b/lib/stringify.js +@@ -3,7 +3,10 @@ + const utils = require('./utils'); + + module.exports = (ast, options = {}) => { +- const stringify = (node, parent = {}) => { ++ const stringify = (node, parent = {}, depth = 0) => { ++ if (depth > 128) { ++ throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)'); ++ } + const invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent); + const invalidNode = node.invalid === true && options.escapeInvalid === true; + let output = ''; +@@ -21,7 +24,7 @@ module.exports = (ast, options = {}) => { + + if (node.nodes) { + for (const child of node.nodes) { +- output += stringify(child); ++ output += stringify(child, {}, depth + 1); + } + } + return output; diff --git a/config/patches/dependency-security.md b/config/patches/dependency-security.md new file mode 100644 index 00000000000..c991556fba0 --- /dev/null +++ b/config/patches/dependency-security.md @@ -0,0 +1,33 @@ +# Dependency security fixes + +These temporary patches cover advisories without a published fixed release. +Replace each patch with an upstream fixed version when available. Raw registry +audits continue to flag the original package versions; the patches do not rewrite +versions or suppress advisories. + +| Package | Advisory | Mitigation | +| ---------------- | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| braces 3.0.3 | GHSA-vfj7-8cjw-p6xm | Bound brace and parenthesis nesting and recursive AST walkers to 128 levels. Reject excessive nesting with a controlled SyntaxError before exhausting the stack. | +| node-forge 1.4.0 | GHSA-86w9-cpqp-85rv | Require exactly the captured OID and optional NULL in the nested DigestAlgorithm sequence, rejecting unconsumed elements during RSA signature verification. | +| sprintf-js 1.1.3 | GHSA-hp3w-g68c-fv3c | Clamp numeric precision to the ECMAScript range before formatting; protect both Node and browser entries. | + +The braces patch applies to desktop, mobile, docs tooling, and isolated audit +tools. The formatting patch applies to desktop and mobile; mobile's older +sprintf-js 1.0.3 is first upgraded to 1.1.3. Mobile carries the RSA patch. +Mobile patch files stay inside its independent workspace for standalone builds. + +`config/scripts/dependency-security-patches.test.mjs` exercises the installed +desktop packages with deeply nested patterns, direct AST inputs, and excessive +precision in both formatting entries. The mobile regression in +`mobile/scripts/dependency-security-patches.test.ts` checks the installed Expo +dependency and rejects a signed malformed DigestInfo while accepting a valid +signature. Both suites use the packages installed from the workspace lockfiles; +they do not run installs or access the registry. Normal patterns and formatting +retain their previous behavior. Excessive brace patterns now fail explicitly; +out-of-range numeric precision is clamped instead of throwing a RangeError. + +Published fixes are used for Hono, Markdown-it, Vite, Vitest, and path-to-regexp. +No development dependency is omitted from the audit. + +The node-forge patch follows [upstream PR #1152](https://github.com/digitalbazaar/forge/pull/1152). +Remove it when an upstream release includes that fix. diff --git a/config/patches/sprintf-js@1.1.3.patch b/config/patches/sprintf-js@1.1.3.patch new file mode 100644 index 00000000000..a841e9c64fa --- /dev/null +++ b/config/patches/sprintf-js@1.1.3.patch @@ -0,0 +1,24 @@ +diff --git a/dist/sprintf.min.js b/dist/sprintf.min.js +--- a/dist/sprintf.min.js ++++ b/dist/sprintf.min.js +@@ -1,3 +1,3 @@ + /*! sprintf-js v1.1.3 | Copyright (c) 2007-present, Alexandru Mărășteanu | BSD-3-Clause */ +-!function(){"use strict";var g={not_string:/[^s]/,not_bool:/[^t]/,not_type:/[^T]/,not_primitive:/[^v]/,number:/[diefg]/,numeric_arg:/[bcdiefguxX]/,json:/[j]/,not_json:/[^j]/,text:/^[^\x25]+/,modulo:/^\x25{2}/,placeholder:/^\x25(?:([1-9]\d*)\$|\(([^)]+)\))?(\+)?(0|'[^$])?(-)?(\d+)?(?:\.(\d+))?([b-gijostTuvxX])/,key:/^([a-z_][a-z_\d]*)/i,key_access:/^\.([a-z_][a-z_\d]*)/i,index_access:/^\[(\d+)\]/,sign:/^[+-]/};function y(e){return function(e,t){var r,n,i,s,a,o,p,c,l,u=1,f=e.length,d="";for(n=0;n>>0).toString(8);break;case"s":r=String(r),r=s.precision?r.substring(0,s.precision):r;break;case"t":r=String(!!r),r=s.precision?r.substring(0,s.precision):r;break;case"T":r=Object.prototype.toString.call(r).slice(8,-1).toLowerCase(),r=s.precision?r.substring(0,s.precision):r;break;case"u":r=parseInt(r,10)>>>0;break;case"v":r=r.valueOf(),r=s.precision?r.substring(0,s.precision):r;break;case"x":r=(parseInt(r,10)>>>0).toString(16);break;case"X":r=(parseInt(r,10)>>>0).toString(16).toUpperCase()}g.json.test(s.type)?d+=r:(!g.number.test(s.type)||c&&!s.sign?l="":(l=c?"+":"-",r=r.toString().replace(g.sign,"")),o=s.pad_char?"0"===s.pad_char?"0":s.pad_char.charAt(1):" ",p=s.width-(l+r).length,a=s.width&&0>>0).toString(8);break;case"s":r=String(r),r=s.precision?r.substring(0,s.precision):r;break;case"t":r=String(!!r),r=s.precision?r.substring(0,s.precision):r;break;case"T":r=Object.prototype.toString.call(r).slice(8,-1).toLowerCase(),r=s.precision?r.substring(0,s.precision):r;break;case"u":r=parseInt(r,10)>>>0;break;case"v":r=r.valueOf(),r=s.precision?r.substring(0,s.precision):r;break;case"x":r=(parseInt(r,10)>>>0).toString(16);break;case"X":r=(parseInt(r,10)>>>0).toString(16).toUpperCase()}g.json.test(s.type)?d+=r:(!g.number.test(s.type)||c&&!s.sign?l="":(l=c?"+":"-",r=r.toString().replace(g.sign,"")),o=s.pad_char?"0"===s.pad_char?"0":s.pad_char.charAt(1):" ",p=s.width-(l+r).length,a=s.width&&0= 0 + } + ++ if (ph.precision && /[efg]/.test(ph.type)) { ++ ph.precision = String(Math.max(ph.type === 'g' ? 1 : 0, Math.min(100, Number(ph.precision)))) ++ } ++ + switch (ph.type) { + case 'b': + arg = parseInt(arg, 10).toString(2) diff --git a/config/scripts/dependency-security-patches.test.mjs b/config/scripts/dependency-security-patches.test.mjs new file mode 100644 index 00000000000..5dc3a099696 --- /dev/null +++ b/config/scripts/dependency-security-patches.test.mjs @@ -0,0 +1,63 @@ +import { createRequire } from 'node:module' +import { describe, expect, it } from 'vitest' + +function dependencyRequire(packages) { + let require = createRequire(import.meta.url) + for (const name of packages) { + require = createRequire(require.resolve(name)) + } + return require +} + +// Resolve through declared consumers so hoisting cannot select another workspace's copy. +const braces = dependencyRequire(['shadcn', 'fast-glob', 'micromatch'])('braces') +const sprintfRequire = dependencyRequire([ + 'electron-builder', + 'app-builder-lib', + '@electron/get', + 'global-agent', + 'roarr' +]) + +describe('installed dependency security patches', () => { + it.each([ + ['braces', '{', '}'], + ['parentheses', '(', ')'], + ['mixed nesting', '{(', ')}'] + ])('bounds %s during parsing', (_name, open, close) => { + expect(() => braces.parse(`${open.repeat(512)}a,b${close.repeat(512)}`)).toThrow( + 'maximum nesting depth' + ) + }) + + it.each(['compile', 'expand', 'stringify'])('bounds nested patterns in braces.%s', (method) => { + const pattern = `${'{'.repeat(4_000)}a,b${'}'.repeat(4_000)}` + expect(() => braces[method](pattern)).toThrow('maximum nesting depth') + expect(braces.expand('src/{main,shared}/*.ts')).toEqual(['src/main/*.ts', 'src/shared/*.ts']) + }) + + it.each(['compile', 'expand', 'stringify'])( + 'bounds directly supplied ASTs in braces.%s', + (method) => { + let ast = { type: 'text', value: 'ok' } + for (let depth = 0; depth < 10_000; depth += 1) { + ast = { type: 'root', nodes: [ast] } + } + expect(() => braces[method](ast)).toThrow('maximum nesting depth') + } + ) + + it.each(['src/sprintf.js', 'dist/sprintf.min.js'])('bounds numeric precision in %s', (entry) => { + const { sprintf } = sprintfRequire(`sprintf-js/${entry}`) + for (const type of ['e', 'f', 'g']) { + expect(() => sprintf(`%.${'9'.repeat(500)}${type}`, 1.234)).not.toThrow() + expect(sprintf(`%.${'9'.repeat(500)}${type}`, 1.234).length).toBeLessThan(110) + } + expect(sprintf('%.2f', 1.234)).toBe('1.23') + expect(sprintf('%.2e', 1.234)).toBe('1.23e+0') + expect(sprintf('%.2g', 1.234)).toBe('1.2') + expect(sprintf('%.3s', 'abcdef')).toBe('abc') + expect(sprintf('%.0f', 1.7)).toBe('2') + expect(sprintf('%.0e', 1.7)).toBe('2e+0') + }) +}) diff --git a/config/scripts/run-audit-tool.test.mjs b/config/scripts/run-audit-tool.test.mjs index 8374d6c7e20..449808de38a 100644 --- a/config/scripts/run-audit-tool.test.mjs +++ b/config/scripts/run-audit-tool.test.mjs @@ -73,7 +73,7 @@ describe('locked audit tool execution', () => { const [policy] = parseAllDocuments( readFileSync(join(root, 'config/audit-tools/pnpm-workspace.yaml'), 'utf8') ).map((document) => document.toJS()) - expect(policy).toEqual({ minimumReleaseAge: 4320, ignoreScripts: true, allowBuilds: {} }) + expect(policy).toMatchObject({ minimumReleaseAge: 4320, ignoreScripts: true, allowBuilds: {} }) const documents = parseAllDocuments( readFileSync(join(root, 'config/audit-tools/pnpm-lock.yaml'), 'utf8') ).map((document) => document.toJS()) diff --git a/config/scripts/verify-locked-audit-tools.mjs b/config/scripts/verify-locked-audit-tools.mjs index ccf0433834e..fdf63ed8787 100644 --- a/config/scripts/verify-locked-audit-tools.mjs +++ b/config/scripts/verify-locked-audit-tools.mjs @@ -89,6 +89,11 @@ try { const stale = join(fixture, 'config', 'audit-tools') mkdirSync(stale, { recursive: true }) + mkdirSync(join(fixture, 'config', 'patches'), { recursive: true }) + copyFileSync( + join(root, 'config', 'patches', 'braces@3.0.3.patch'), + join(fixture, 'config', 'patches', 'braces@3.0.3.patch') + ) for (const file of ['pnpm-lock.yaml', 'pnpm-workspace.yaml']) { copyFileSync(join(root, 'config', 'audit-tools', file), join(stale, file)) } diff --git a/docs/site/pnpm-lock.yaml b/docs/site/pnpm-lock.yaml index 61d34671662..49692fcb2e4 100644 --- a/docs/site/pnpm-lock.yaml +++ b/docs/site/pnpm-lock.yaml @@ -163,6 +163,7 @@ settings: excludeLinksFromLockfile: false overrides: + path-to-regexp@>=4.0.0 <6.3.0: 6.3.0 '@vercel/node>undici': 6.28.1 '@vercel/python-analysis>js-yaml': 4.3.2 '@vercel/python-analysis>minimatch': 10.2.6 @@ -177,6 +178,9 @@ overrides: '@vercel/container>tar': 7.5.22 '@vercel/container>smol-toml': 1.9.1 +patchedDependencies: + braces@3.0.3: c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd + importers: .: @@ -3349,9 +3353,6 @@ packages: resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==} engines: {node: 18 || 20 || >=22} - path-to-regexp@6.1.0: - resolution: {integrity: sha512-h9DqehX3zZZDCEm+xbfU0ZmwCGFCAAraPJWMXJ4+v32NjZJilVg3k1TcKsRgIb8IQ/izZSaydDc1OhJCZvs2Dw==} - path-to-regexp@6.3.0: resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==} @@ -5418,7 +5419,7 @@ snapshots: etag: 1.8.1 mime-types: 2.1.35 node-fetch: 2.6.9 - path-to-regexp: 6.1.0 + path-to-regexp: 6.3.0 path-to-regexp-updated: path-to-regexp@6.3.0 ts-morph: 12.0.0 tsx: 4.21.0 @@ -5476,7 +5477,7 @@ snapshots: '@vercel/error-utils': 2.2.1 '@vercel/nft': 1.10.0 '@vercel/static-config': 3.4.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.11.3) - path-to-regexp: 6.1.0 + path-to-regexp: 6.3.0 path-to-regexp-updated: path-to-regexp@6.3.0 ts-morph: 12.0.0 transitivePeerDependencies: @@ -5624,7 +5625,7 @@ snapshots: dependencies: balanced-match: 4.0.4 - braces@3.0.3: + braces@3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd): dependencies: fill-range: 7.1.1 @@ -6789,7 +6790,7 @@ snapshots: micromatch@4.0.8: dependencies: - braces: 3.0.3 + braces: 3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd) picomatch: 2.3.2 mime-db@1.52.0: {} @@ -7023,8 +7024,6 @@ snapshots: lru-cache: 11.5.2 minipass: 7.1.3 - path-to-regexp@6.1.0: {} - path-to-regexp@6.3.0: {} path-to-regexp@8.4.0: {} diff --git a/docs/site/pnpm-workspace.yaml b/docs/site/pnpm-workspace.yaml index eb2cabbb480..881c422fd11 100644 --- a/docs/site/pnpm-workspace.yaml +++ b/docs/site/pnpm-workspace.yaml @@ -5,6 +5,7 @@ allowBuilds: sharp: true overrides: + path-to-regexp@>=4.0.0 <6.3.0: 6.3.0 '@vercel/node>undici': 6.28.1 '@vercel/python-analysis>js-yaml': 4.3.2 '@vercel/python-analysis>minimatch': 10.2.6 @@ -18,3 +19,6 @@ overrides: '@vercel/hono>path-to-regexp': 8.4.0 '@vercel/container>tar': 7.5.22 '@vercel/container>smol-toml': 1.9.1 + +patchedDependencies: + braces@3.0.3: ../../config/patches/braces@3.0.3.patch diff --git a/mobile/package.json b/mobile/package.json index d97a4e6e74e..90d03e00e84 100644 --- a/mobile/package.json +++ b/mobile/package.json @@ -89,7 +89,7 @@ "tsx": "^4.23.15", "typescript": "6.0.3", "vite": "^8.3.4", - "vitest": "^4.1.11", + "vitest": "^4.1.12", "ws": "^8.22.0" }, "packageManager": "pnpm@12.14.0+sha512.c18ba6d87993d3d164cb5e8948f32b2c06ee854487e06cd8d86781342fb3e5bb4634367034711e86802baa9c37bea906ce1929ad08d70884c97d801df13389a6" diff --git a/mobile/patches/braces@3.0.3.patch b/mobile/patches/braces@3.0.3.patch new file mode 100644 index 00000000000..823a8d207a1 --- /dev/null +++ b/mobile/patches/braces@3.0.3.patch @@ -0,0 +1,99 @@ +diff --git a/lib/compile.js b/lib/compile.js +index dce69beb90ece5c3b0ca234a949418f9f34eedbc..6f63213f5da97c9c9989494c65e0c53a82e19d92 100644 +--- a/lib/compile.js ++++ b/lib/compile.js +@@ -4,7 +4,10 @@ const fill = require('fill-range'); + const utils = require('./utils'); + + const compile = (ast, options = {}) => { +- const walk = (node, parent = {}) => { ++ const walk = (node, parent = {}, depth = 0) => { ++ if (depth > 128) { ++ throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)'); ++ } + const invalidBlock = utils.isInvalidBrace(parent); + const invalidNode = node.invalid === true && options.escapeInvalid === true; + const invalid = invalidBlock === true || invalidNode === true; +@@ -47,7 +50,7 @@ const compile = (ast, options = {}) => { + + if (node.nodes) { + for (const child of node.nodes) { +- output += walk(child, node); ++ output += walk(child, node, depth + 1); + } + } + +diff --git a/lib/expand.js b/lib/expand.js +index 35b2c41d6afdb8f0197959e26079f266e48370d3..342b39e342b0ab0365edde268f2abac378db095a 100644 +--- a/lib/expand.js ++++ b/lib/expand.js +@@ -33,7 +33,10 @@ const append = (queue = '', stash = '', enclose = false) => { + const expand = (ast, options = {}) => { + const rangeLimit = options.rangeLimit === undefined ? 1000 : options.rangeLimit; + +- const walk = (node, parent = {}) => { ++ const walk = (node, parent = {}, depth = 0) => { ++ if (depth > 128) { ++ throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)'); ++ } + node.queue = []; + + let p = parent; +@@ -100,7 +103,7 @@ const expand = (ast, options = {}) => { + } + + if (child.nodes) { +- walk(child, node); ++ walk(child, node, depth + 1); + } + } + +diff --git a/lib/parse.js b/lib/parse.js +index 3a6988e629f52aee6609dc5ec290a5e9ff47cecb..f91b5c272bf7d399b88fed7be553fe1d140da972 100644 +--- a/lib/parse.js ++++ b/lib/parse.js +@@ -143,6 +143,9 @@ const parse = (input, options = {}) => { + */ + + if (value === CHAR_LEFT_PARENTHESES) { ++ if (stack.length > 128) { ++ throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)'); ++ } + block = push({ type: 'paren', nodes: [] }); + stack.push(block); + push({ type: 'text', value }); +@@ -195,6 +198,9 @@ const parse = (input, options = {}) => { + */ + + if (value === CHAR_LEFT_CURLY_BRACE) { ++ if (stack.length > 128) { ++ throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)'); ++ } + depth++; + + const dollar = prev.value && prev.value.slice(-1) === '$' || block.dollar === true; +diff --git a/lib/stringify.js b/lib/stringify.js +index 8bcf872c31894f81a8c64d9202fd607e4fd7ea2b..1f03c5cd154a8443f9b95a824ec4f315e7382e4f 100644 +--- a/lib/stringify.js ++++ b/lib/stringify.js +@@ -3,7 +3,10 @@ + const utils = require('./utils'); + + module.exports = (ast, options = {}) => { +- const stringify = (node, parent = {}) => { ++ const stringify = (node, parent = {}, depth = 0) => { ++ if (depth > 128) { ++ throw new SyntaxError('Brace pattern exceeds maximum nesting depth (128)'); ++ } + const invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent); + const invalidNode = node.invalid === true && options.escapeInvalid === true; + let output = ''; +@@ -21,7 +24,7 @@ module.exports = (ast, options = {}) => { + + if (node.nodes) { + for (const child of node.nodes) { +- output += stringify(child); ++ output += stringify(child, {}, depth + 1); + } + } + return output; diff --git a/mobile/patches/node-forge@1.4.0.patch b/mobile/patches/node-forge@1.4.0.patch new file mode 100644 index 00000000000..10a58e6fa69 --- /dev/null +++ b/mobile/patches/node-forge@1.4.0.patch @@ -0,0 +1,14 @@ +diff --git a/lib/rsa.js b/lib/rsa.js +--- a/lib/rsa.js ++++ b/lib/rsa.js +@@ -1172,7 +1172,9 @@ + var capture = {}; + var errors = []; + if(!asn1.validate(obj, digestInfoValidator, capture, errors) || +- obj.value.length !== 2) { ++ obj.value.length !== 2 || ++ obj.value[0].value.length !== ++ (('parameters' in capture) ? 2 : 1)) { + var error = new Error( + 'ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 ' + + 'DigestInfo value.'); diff --git a/mobile/patches/sprintf-js@1.1.3.patch b/mobile/patches/sprintf-js@1.1.3.patch new file mode 100644 index 00000000000..a841e9c64fa --- /dev/null +++ b/mobile/patches/sprintf-js@1.1.3.patch @@ -0,0 +1,24 @@ +diff --git a/dist/sprintf.min.js b/dist/sprintf.min.js +--- a/dist/sprintf.min.js ++++ b/dist/sprintf.min.js +@@ -1,3 +1,3 @@ + /*! sprintf-js v1.1.3 | Copyright (c) 2007-present, Alexandru Mărășteanu | BSD-3-Clause */ +-!function(){"use strict";var g={not_string:/[^s]/,not_bool:/[^t]/,not_type:/[^T]/,not_primitive:/[^v]/,number:/[diefg]/,numeric_arg:/[bcdiefguxX]/,json:/[j]/,not_json:/[^j]/,text:/^[^\x25]+/,modulo:/^\x25{2}/,placeholder:/^\x25(?:([1-9]\d*)\$|\(([^)]+)\))?(\+)?(0|'[^$])?(-)?(\d+)?(?:\.(\d+))?([b-gijostTuvxX])/,key:/^([a-z_][a-z_\d]*)/i,key_access:/^\.([a-z_][a-z_\d]*)/i,index_access:/^\[(\d+)\]/,sign:/^[+-]/};function y(e){return function(e,t){var r,n,i,s,a,o,p,c,l,u=1,f=e.length,d="";for(n=0;n>>0).toString(8);break;case"s":r=String(r),r=s.precision?r.substring(0,s.precision):r;break;case"t":r=String(!!r),r=s.precision?r.substring(0,s.precision):r;break;case"T":r=Object.prototype.toString.call(r).slice(8,-1).toLowerCase(),r=s.precision?r.substring(0,s.precision):r;break;case"u":r=parseInt(r,10)>>>0;break;case"v":r=r.valueOf(),r=s.precision?r.substring(0,s.precision):r;break;case"x":r=(parseInt(r,10)>>>0).toString(16);break;case"X":r=(parseInt(r,10)>>>0).toString(16).toUpperCase()}g.json.test(s.type)?d+=r:(!g.number.test(s.type)||c&&!s.sign?l="":(l=c?"+":"-",r=r.toString().replace(g.sign,"")),o=s.pad_char?"0"===s.pad_char?"0":s.pad_char.charAt(1):" ",p=s.width-(l+r).length,a=s.width&&0>>0).toString(8);break;case"s":r=String(r),r=s.precision?r.substring(0,s.precision):r;break;case"t":r=String(!!r),r=s.precision?r.substring(0,s.precision):r;break;case"T":r=Object.prototype.toString.call(r).slice(8,-1).toLowerCase(),r=s.precision?r.substring(0,s.precision):r;break;case"u":r=parseInt(r,10)>>>0;break;case"v":r=r.valueOf(),r=s.precision?r.substring(0,s.precision):r;break;case"x":r=(parseInt(r,10)>>>0).toString(16);break;case"X":r=(parseInt(r,10)>>>0).toString(16).toUpperCase()}g.json.test(s.type)?d+=r:(!g.number.test(s.type)||c&&!s.sign?l="":(l=c?"+":"-",r=r.toString().replace(g.sign,"")),o=s.pad_char?"0"===s.pad_char?"0":s.pad_char.charAt(1):" ",p=s.width-(l+r).length,a=s.width&&0= 0 + } + ++ if (ph.precision && /[efg]/.test(ph.type)) { ++ ph.precision = String(Math.max(ph.type === 'g' ? 1 : 0, Math.min(100, Number(ph.precision)))) ++ } ++ + switch (ph.type) { + case 'b': + arg = parseInt(arg, 10).toString(2) diff --git a/mobile/pnpm-lock.yaml b/mobile/pnpm-lock.yaml index 9c08328061d..298b5516d8f 100644 --- a/mobile/pnpm-lock.yaml +++ b/mobile/pnpm-lock.yaml @@ -163,16 +163,21 @@ settings: excludeLinksFromLockfile: false overrides: + sprintf-js@<1.1.3: 1.1.3 + markdown-it@>=14.0.0 <14.3.3: 14.3.3 katex@>=0.11.0 <0.18.2: 0.18.10 xcode>uuid: 11.1.1 query-string: 9.5.1 patchedDependencies: '@xterm/addon-webgl@0.20.0-beta.300': 5349718f2c19d9319a81552580bf9618ded9b00f3707a5c6cdbbae1910849cd9 + braces@3.0.3: c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd expo-notifications@55.0.27: ce20843a3daad4185d7e8571788fa323ba4d11984936188790858650a61749c0 + node-forge@1.4.0: 2798686e4488058ad81c3b8e32eb763c0feff21f4c717ce4d13b6ef2432cd5b8 query-string@9.5.1: 8624f1beedd0705bfdaf287519ed6363662a0c96f01fd594508b34583bf30d8b react-native-webview@13.16.2: 55b7bce35c78ee1a50c4b99ad65b52982f3cfa73da6f61d0853c4d03219eec06 react-native@0.83.10: 22bc31f0a057b1f96d9949b38a7ccde81225f617c0f243820dc8a455c91debfb + sprintf-js@1.1.3: 05316a8b01f155fe19a1e0cb4042c81d43d798a76755c407684e1199a18b1e08 importers: @@ -272,8 +277,8 @@ importers: specifier: ^1.14.0 version: 1.14.0(react-native-svg@15.15.5(react-native@0.83.10(patch_hash=22bc31f0a057b1f96d9949b38a7ccde81225f617c0f243820dc8a455c91debfb)(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.85.2(@babel/core@7.29.7(supports-color@8.1.1))(supports-color@8.1.1))(@types/react@19.2.18)(react@19.2.8)(supports-color@8.1.1))(react@19.2.8))(react-native@0.83.10(patch_hash=22bc31f0a057b1f96d9949b38a7ccde81225f617c0f243820dc8a455c91debfb)(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.85.2(@babel/core@7.29.7(supports-color@8.1.1))(supports-color@8.1.1))(@types/react@19.2.18)(react@19.2.8)(supports-color@8.1.1))(react@19.2.8) markdown-it: - specifier: ^14.3.2 - version: 14.3.2 + specifier: 14.3.3 + version: 14.3.3 markdown-it-footnote: specifier: ^4.0.0 version: 4.0.0 @@ -375,8 +380,8 @@ importers: specifier: ^8.3.4 version: 8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1) vitest: - specifier: ^4.1.11 - version: 4.1.11(@types/node@26.6.2)(happy-dom@20.14.5)(jsdom@20.0.3(supports-color@8.1.1))(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)) + specifier: ^4.1.12 + version: 4.1.12(@types/node@26.6.2)(happy-dom@20.14.5)(jsdom@20.0.3(supports-color@8.1.1))(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)) ws: specifier: ^8.22.0 version: 8.22.0 @@ -3057,11 +3062,11 @@ packages: '@upsetjs/venn.js@2.0.0': resolution: {integrity: sha512-WbBhLrooyePuQ1VZxrJjtLvTc4NVfpOyKx0sKqioq9bX1C1m7Jgykkn8gLrtwumBioXIqam8DLxp88Adbue6Hw==} - '@vitest/expect@4.1.11': - resolution: {integrity: sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==} + '@vitest/expect@4.1.12': + resolution: {integrity: sha512-vFlTt+YEu9WBpNjdGayNmlMVzrWPi1+sv853/7t2FU7hpO5gAFBKHzQmkCq5Xjpr+evegF2994LQT3hF3mRlqQ==} - '@vitest/mocker@4.1.11': - resolution: {integrity: sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==} + '@vitest/mocker@4.1.12': + resolution: {integrity: sha512-fKShNpKZzupWZuY0z7egydvL0sqW4INEZBEExMBMAa6izlENEVHwoXgdaTCaBZ5fwlr4xf2o1wXC83n9RpO+NA==} peerDependencies: msw: ^2.4.9 vite: ^6.0.0 || ^7.0.0 || ^8.0.0 @@ -3071,20 +3076,20 @@ packages: vite: optional: true - '@vitest/pretty-format@4.1.11': - resolution: {integrity: sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==} + '@vitest/pretty-format@4.1.12': + resolution: {integrity: sha512-XW9O8+Mxx4VpCtkYdMJLZQQwsVryP9wk7cPKDxtXFfwSak6yRh5+2fep/Y0XF/ElBvJHq8bcYdi6aeuai0opZA==} - '@vitest/runner@4.1.11': - resolution: {integrity: sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==} + '@vitest/runner@4.1.12': + resolution: {integrity: sha512-NKlVKCr5QnCe8jijdMnmkpHHU+WTqiLFR6G0pHji9uRjXK9xJl1k1nTw6F3pOOj2PDcsDt2GKQMI7wIsaT491w==} - '@vitest/snapshot@4.1.11': - resolution: {integrity: sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==} + '@vitest/snapshot@4.1.12': + resolution: {integrity: sha512-ko1y1Qgb/slzQ9mr+b89Cuqud8WG1TKtsPD8r7ZUBdvVOGt85Af2HwCqHujrhwJq95hs/9RM7fcAPg57o1vlzw==} - '@vitest/spy@4.1.11': - resolution: {integrity: sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==} + '@vitest/spy@4.1.12': + resolution: {integrity: sha512-RGq9x4JNGNTZHEJxvN0oSiJjeSCExm0n2gZKKJZHY9cX5AVA6M7VJILBT3ZJ/tJ/0J9uWT7fETV9/btoi//vSg==} - '@vitest/utils@4.1.11': - resolution: {integrity: sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==} + '@vitest/utils@4.1.12': + resolution: {integrity: sha512-Q3awXrwOfEV+qc3WmO5ONyE0yO7Q1gQ9/oyHxGLZ/pl7N3NO/ZztqQwKLuwMkV+CA1JYSIeO3gkHnRDIo4AVaA==} '@xmldom/xmldom@0.8.15': resolution: {integrity: sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA==} @@ -5541,8 +5546,8 @@ packages: markdown-it-footnote@4.0.0: resolution: {integrity: sha512-WYJ7urf+khJYl3DqofQpYfEYkZKbmXmwxQV8c8mO/hGIhgZ1wOe7R4HLFNwqx7TjILbnC98fuyeSsin19JdFcQ==} - markdown-it@14.3.2: - resolution: {integrity: sha512-sHHjZ5fJKlgrG4qns2YwVcdNep35h5fERrfkD2YNsb9UFk0UIHarbiTaHKVMlPuWAoiilyK8Fv/jAm11slsY7Q==} + markdown-it@14.3.3: + resolution: {integrity: sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg==} hasBin: true marked@16.4.2: @@ -6563,8 +6568,8 @@ packages: resolution: {integrity: sha512-qxQJTx2ryR0Dw0ITYyekNQWpz6f8dGd7vffGNflQQ3Iqj9NJ6qiZ7ELpZsJ/QBhIVAiDfXdag3+Gp8RvWa62AA==} engines: {node: '>=12'} - sprintf-js@1.0.3: - resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==} + sprintf-js@1.1.3: + resolution: {integrity: sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==} stack-generator@2.0.10: resolution: {integrity: sha512-mwnua/hkqM6pF4k8SnmZ2zfETsRUpWXREfA/goT8SLCV4iOFa4bzOX2nDipWAZFPTjLvQB82f5yaodMVhK0yJQ==} @@ -7034,20 +7039,20 @@ packages: yaml: optional: true - vitest@4.1.11: - resolution: {integrity: sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==} + vitest@4.1.12: + resolution: {integrity: sha512-5eWdz2yb3ajxWF3C8C4TjkXl7FGm3n2E/VlazALrQHzK7nYMSGFnCZto0bbPNl77AwkOZVLk0YnBAejUu0NiWA==} engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0} hasBin: true peerDependencies: '@edge-runtime/vm': '*' '@opentelemetry/api': ^1.9.0 '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0 - '@vitest/browser-playwright': 4.1.11 - '@vitest/browser-preview': 4.1.11 - '@vitest/browser-webdriverio': 4.1.11 - '@vitest/coverage-istanbul': 4.1.11 - '@vitest/coverage-v8': 4.1.11 - '@vitest/ui': 4.1.11 + '@vitest/browser-playwright': 4.1.12 + '@vitest/browser-preview': 4.1.12 + '@vitest/browser-webdriverio': ^4.1.11 + '@vitest/coverage-istanbul': 4.1.12 + '@vitest/coverage-v8': 4.1.12 + '@vitest/ui': 4.1.12 happy-dom: '*' jsdom: '*' vite: ^6.0.0 || ^7.0.0 || ^8.0.0 @@ -8712,7 +8717,7 @@ snapshots: glob: 13.0.6 lan-network: 0.2.1 multitars: 1.0.2 - node-forge: 1.4.0 + node-forge: 1.4.0(patch_hash=2798686e4488058ad81c3b8e32eb763c0feff21f4c717ce4d13b6ef2432cd5b8) npm-package-arg: 11.0.3 ora: 3.4.0 picomatch: 4.0.4 @@ -8749,7 +8754,7 @@ snapshots: '@expo/code-signing-certificates@0.0.6': dependencies: - node-forge: 1.4.0 + node-forge: 1.4.0(patch_hash=2798686e4488058ad81c3b8e32eb763c0feff21f4c717ce4d13b6ef2432cd5b8) '@expo/config-plugins@55.0.11(supports-color@8.1.1)': dependencies: @@ -10455,44 +10460,44 @@ snapshots: d3-selection: 3.0.0 d3-transition: 3.0.1(d3-selection@3.0.0) - '@vitest/expect@4.1.11': + '@vitest/expect@4.1.12': dependencies: '@standard-schema/spec': 1.1.0 '@types/chai': 5.2.3 - '@vitest/spy': 4.1.11 - '@vitest/utils': 4.1.11 + '@vitest/spy': 4.1.12 + '@vitest/utils': 4.1.12 chai: 6.2.2 tinyrainbow: 3.1.0 - '@vitest/mocker@4.1.11(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1))': + '@vitest/mocker@4.1.12(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1))': dependencies: - '@vitest/spy': 4.1.11 + '@vitest/spy': 4.1.12 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: vite: 8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1) - '@vitest/pretty-format@4.1.11': + '@vitest/pretty-format@4.1.12': dependencies: tinyrainbow: 3.1.0 - '@vitest/runner@4.1.11': + '@vitest/runner@4.1.12': dependencies: - '@vitest/utils': 4.1.11 + '@vitest/utils': 4.1.12 pathe: 2.0.3 - '@vitest/snapshot@4.1.11': + '@vitest/snapshot@4.1.12': dependencies: - '@vitest/pretty-format': 4.1.11 - '@vitest/utils': 4.1.11 + '@vitest/pretty-format': 4.1.12 + '@vitest/utils': 4.1.12 magic-string: 0.30.21 pathe: 2.0.3 - '@vitest/spy@4.1.11': {} + '@vitest/spy@4.1.12': {} - '@vitest/utils@4.1.11': + '@vitest/utils@4.1.12': dependencies: - '@vitest/pretty-format': 4.1.11 + '@vitest/pretty-format': 4.1.12 convert-source-map: 2.0.0 tinyrainbow: 3.1.0 @@ -10591,7 +10596,7 @@ snapshots: argparse@1.0.10: dependencies: - sprintf-js: 1.0.3 + sprintf-js: 1.1.3(patch_hash=05316a8b01f155fe19a1e0cb4042c81d43d798a76755c407684e1199a18b1e08) argparse@2.0.1: {} @@ -10907,7 +10912,7 @@ snapshots: dependencies: balanced-match: 4.0.4 - braces@3.0.3: + braces@3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd): dependencies: fill-range: 7.1.1 @@ -10990,7 +10995,7 @@ snapshots: chokidar@3.6.0: dependencies: anymatch: 3.1.3 - braces: 3.0.3 + braces: 3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd) glob-parent: 5.1.2 is-binary-path: 2.1.0 is-glob: 4.0.3 @@ -13513,7 +13518,7 @@ snapshots: markdown-it-footnote@4.0.0: {} - markdown-it@14.3.2: + markdown-it@14.3.3: dependencies: argparse: 2.0.1 entities: 4.5.0 @@ -13911,7 +13916,7 @@ snapshots: micromatch@4.0.8: dependencies: - braces: 3.0.3 + braces: 3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd) picomatch: 2.3.2 mime-db@1.52.0: {} @@ -13977,7 +13982,7 @@ snapshots: dependencies: whatwg-url: 5.0.0 - node-forge@1.4.0: {} + node-forge@1.4.0(patch_hash=2798686e4488058ad81c3b8e32eb763c0feff21f4c717ce4d13b6ef2432cd5b8): {} node-int64@0.4.0: {} @@ -14843,7 +14848,7 @@ snapshots: split-on-first@3.0.0: {} - sprintf-js@1.0.3: {} + sprintf-js@1.1.3(patch_hash=05316a8b01f155fe19a1e0cb4042c81d43d798a76755c407684e1199a18b1e08): {} stack-generator@2.0.10: dependencies: @@ -15274,21 +15279,21 @@ snapshots: tsx: 4.23.15 yaml: 2.9.1 - vitest@4.1.11(@types/node@26.6.2)(happy-dom@20.14.5)(jsdom@20.0.3(supports-color@8.1.1))(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)): + vitest@4.1.12(@types/node@26.6.2)(happy-dom@20.14.5)(jsdom@20.0.3(supports-color@8.1.1))(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)): dependencies: - '@vitest/expect': 4.1.11 - '@vitest/mocker': 4.1.11(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)) - '@vitest/pretty-format': 4.1.11 - '@vitest/runner': 4.1.11 - '@vitest/snapshot': 4.1.11 - '@vitest/spy': 4.1.11 - '@vitest/utils': 4.1.11 + '@vitest/expect': 4.1.12 + '@vitest/mocker': 4.1.12(vite@8.3.4(@types/node@26.6.2)(esbuild@0.28.2)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)) + '@vitest/pretty-format': 4.1.12 + '@vitest/runner': 4.1.12 + '@vitest/snapshot': 4.1.12 + '@vitest/spy': 4.1.12 + '@vitest/utils': 4.1.12 es-module-lexer: 2.1.0 expect-type: 1.3.0 magic-string: 0.30.21 obug: 2.1.1 pathe: 2.0.3 - picomatch: 4.0.4 + picomatch: 4.0.7 std-env: 4.1.0 tinybench: 2.9.0 tinyexec: 1.1.2 diff --git a/mobile/pnpm-workspace.yaml b/mobile/pnpm-workspace.yaml index b02092a2a9d..fb9815de283 100644 --- a/mobile/pnpm-workspace.yaml +++ b/mobile/pnpm-workspace.yaml @@ -46,6 +46,8 @@ minimumReleaseAgeExclude: - oxlint@1.88.0 overrides: + sprintf-js@<1.1.3: 1.1.3 + markdown-it@>=14.0.0 <14.3.3: 14.3.3 # Mermaid 11 still requests KaTeX 0.16; the security fix starts at 0.18.2. katex@>=0.11.0 <0.18.2: 0.18.10 # xcode still requests uuid 7; buffer bounds checks were fixed in 11.1.1. @@ -54,8 +56,11 @@ overrides: query-string: 9.5.1 patchedDependencies: + sprintf-js@1.1.3: patches/sprintf-js@1.1.3.patch '@xterm/addon-webgl@0.20.0-beta.300': patches/@xterm__addon-webgl@0.20.0-beta.300.patch expo-notifications@55.0.27: patches/expo-notifications@55.0.27.patch query-string@9.5.1: patches/query-string@9.5.1.patch react-native-webview@13.16.2: patches/react-native-webview@13.16.2.patch react-native@0.83.10: patches/react-native@0.83.10.patch + braces@3.0.3: patches/braces@3.0.3.patch + node-forge@1.4.0: patches/node-forge@1.4.0.patch diff --git a/mobile/scripts/dependency-security-patches.test.ts b/mobile/scripts/dependency-security-patches.test.ts new file mode 100644 index 00000000000..37d6c5a0fa4 --- /dev/null +++ b/mobile/scripts/dependency-security-patches.test.ts @@ -0,0 +1,44 @@ +import { generateKeyPairSync } from 'node:crypto' +import { createRequire } from 'node:module' +import { describe, expect, it } from 'vitest' + +describe('installed mobile dependency security patches', () => { + it.each([true, false])( + 'rejects extra DigestAlgorithm elements with NULL parameters: %s', + (parameters) => { + const require = createRequire(import.meta.url) + const expoRequire = createRequire(require.resolve('expo')) + const cliRequire = createRequire(expoRequire.resolve('@expo/cli')) + const forge = cliRequire('node-forge') + const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 1024, publicExponent: 3 }) + const key = forge.pki.privateKeyFromPem( + privateKey.export({ type: 'pkcs1', format: 'pem' }).toString() + ) + const publicKey = forge.pki.setRsaPublicKey(key.n, key.e) + const md = forge.md.sha256.create().update('release payload') + const digest = md.digest().getBytes() + expect(publicKey.verify(digest, key.sign(md))).toBe(true) + const { asn1 } = forge + const element = (type: number, value: unknown, constructed = false) => + asn1.create(asn1.Class.UNIVERSAL, type, constructed, value) + const algorithm = element( + asn1.Type.SEQUENCE, + [ + element(asn1.Type.OID, asn1.oidToDer(forge.pki.oids.sha256).getBytes()), + ...(parameters ? [element(asn1.Type.NULL, '')] : []) + ], + true + ) + const digestInfo = element( + asn1.Type.SEQUENCE, + [algorithm, element(asn1.Type.OCTETSTRING, digest)], + true + ) + const valid = key.sign(asn1.toDer(digestInfo).getBytes(), 'NONE') + expect(publicKey.verify(digest, valid)).toBe(true) + algorithm.value.push(element(asn1.Type.OCTETSTRING, 'unexpected padding')) + const signature = key.sign(asn1.toDer(digestInfo).getBytes(), 'NONE') + expect(() => publicKey.verify(digest, signature)).toThrow('DigestInfo') + } + ) +}) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index c2a029c1e64..dfe2b969706 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -164,6 +164,7 @@ settings: excludeLinksFromLockfile: false overrides: + hono@>=4.12.4 <4.13.11: 4.13.11 monaco-editor>dompurify: 3.4.16 katex@>=0.11.0 <0.18.2: 0.18.10 @@ -179,11 +180,13 @@ patchedDependencies: '@xterm/addon-serialize@0.15.0-beta.301': b35533fe252e7e45433150170348889f4e08a6c17f7017ac34ea694d831fec7f '@xterm/addon-webgl@0.20.0-beta.300': 5349718f2c19d9319a81552580bf9618ded9b00f3707a5c6cdbbae1910849cd9 '@xterm/xterm@6.1.0-beta.304': 87de83f62154c0f2c31eb17d14b881e139f3368f8be1e9e2951bfeba16d86156 + braces@3.0.3: c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd i18next-cli@1.74.2: 2ee32eef742615cd133e1a6940f027deb3723a8430bb7953bba3a6769b0aac47 lint-staged@16.4.0: 7333b3837f80a7fbd045964db6d76ba4fc118e49134bdbabb00585b6b7b60673 monaco-editor@0.55.1: 53b71f7d8a7c00b76ffdb73ce83d18e31692f193f5fafa6a390e48f5b3fdd636 node-pty@1.1.0: 2aa312c1b29d733bfd3e3ece2fbbb4eed7750384d7d9f91effd27318a75b7a95 oxlint-plugin-anti-slop@0.1.2: c10c871702365a0c2c59e9f1c5fb92df97cae5755d534c0a3d83c6368f6feafe + sprintf-js@1.1.3: 05316a8b01f155fe19a1e0cb4042c81d43d798a76755c407684e1199a18b1e08 ws@8.22.0: 9393e04dd9a90b01eb7aa35fcd5b1431b5038ce999fbbd82651136193ba51f14 importers: @@ -1293,7 +1296,7 @@ packages: engines: {node: '>=20'} peerDependencies: '@types/hono': '*' - hono: ^4 + hono: 4.13.11 peerDependenciesMeta: '@types/hono': optional: true @@ -5912,8 +5915,8 @@ packages: resolution: {integrity: sha512-Xwwo44whKBVCYoliBQwaPvtd/2tYFkRQtXDWj1nackaV2JPXx3L0+Jvd8/qCJ2p+ML0/XVkJ2q+Mr+UVdpJK5w==} engines: {node: '>=12.0.0'} - hono@4.13.7: - resolution: {integrity: sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==} + hono@4.13.11: + resolution: {integrity: sha512-/SMX/RQNJn7oNmFwH6DtwDqcrzZU2otm1FD6OJe2cWF6cfy/F8hq0XVBv7xW3FTJshRQwuBnXHDq2kNsdZnshg==} engines: {node: '>=16.9.0'} hookified@1.15.1: @@ -9139,9 +9142,9 @@ snapshots: dependencies: graphql: 16.14.2 - '@hono/node-server@2.1.0(hono@4.13.7)': + '@hono/node-server@2.1.0(hono@4.13.11)': dependencies: - hono: 4.13.7 + hono: 4.13.11 '@humanfs/core@0.19.2': dependencies: @@ -9378,7 +9381,7 @@ snapshots: '@modelcontextprotocol/sdk@1.32.1(supports-color@7.2.0)(zod@3.25.76)': dependencies: - '@hono/node-server': 2.1.0(hono@4.13.7) + '@hono/node-server': 2.1.0(hono@4.13.11) ajv: 8.20.0 ajv-formats: 3.0.1 content-type: 1.0.5 @@ -9388,7 +9391,7 @@ snapshots: eventsource-parser: 3.0.8 express: 5.2.1(supports-color@7.2.0) express-rate-limit: 8.5.2(express@5.2.1(supports-color@7.2.0)) - hono: 4.13.7 + hono: 4.13.11 jose: 6.2.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -9403,7 +9406,7 @@ snapshots: '@modelcontextprotocol/sdk@1.32.1(supports-color@7.2.0)(zod@4.6.7)': dependencies: - '@hono/node-server': 2.1.0(hono@4.13.7) + '@hono/node-server': 2.1.0(hono@4.13.11) ajv: 8.20.0 ajv-formats: 3.0.1 content-type: 1.0.5 @@ -9413,7 +9416,7 @@ snapshots: eventsource-parser: 3.0.8 express: 5.2.1(supports-color@7.2.0) express-rate-limit: 8.5.2(express@5.2.1(supports-color@7.2.0)) - hono: 4.13.7 + hono: 4.13.11 jose: 6.2.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -11550,7 +11553,7 @@ snapshots: '@types/set-cookie-parser@2.4.10': dependencies: - '@types/node': 18.19.130 + '@types/node': 24.19.2 optional: true '@types/ssh2@1.15.6': @@ -11912,7 +11915,7 @@ snapshots: dependencies: balanced-match: 4.0.4 - braces@3.0.3: + braces@3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd): dependencies: fill-range: 7.1.1 @@ -13366,7 +13369,7 @@ snapshots: highlight.js@11.11.1: {} - hono@4.13.7: {} + hono@4.13.11: {} hookified@1.15.1: optional: true @@ -14346,7 +14349,7 @@ snapshots: micromatch@4.0.8: dependencies: - braces: 3.0.3 + braces: 3.0.3(patch_hash=c07bb14cec04bc891e1fe529720444cc9729a25117f9aaf24253cfe3132a34fd) picomatch: 2.3.2 mime-db@1.52.0: {} @@ -15401,7 +15404,7 @@ snapshots: globalthis: 1.0.4 json-stringify-safe: 5.0.1 semver-compare: 1.0.0 - sprintf-js: 1.1.3 + sprintf-js: 1.1.3(patch_hash=05316a8b01f155fe19a1e0cb4042c81d43d798a76755c407684e1199a18b1e08) optional: true robust-predicates@3.0.3: {} @@ -15695,7 +15698,7 @@ snapshots: space-separated-tokens@2.0.2: {} - sprintf-js@1.1.3: + sprintf-js@1.1.3(patch_hash=05316a8b01f155fe19a1e0cb4042c81d43d798a76755c407684e1199a18b1e08): optional: true ssh2@1.17.0: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index dff3208b30f..4644b22298a 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -165,6 +165,7 @@ packageExtensions: vfile: ^6.0.0 overrides: + hono@>=4.12.4 <4.13.11: 4.13.11 monaco-editor>dompurify: 3.4.16 # Upstream markdown/math packages still require the vulnerable 0.16 line. katex@>=0.11.0 <0.18.2: 0.18.10 @@ -183,3 +184,5 @@ patchedDependencies: ws@8.22.0: config/patches/ws@8.22.0.patch oxlint-plugin-anti-slop@0.1.2: config/patches/oxlint-plugin-anti-slop@0.1.2.patch monaco-editor@0.55.1: config/patches/monaco-editor@0.55.1.patch + braces@3.0.3: config/patches/braces@3.0.3.patch + sprintf-js@1.1.3: config/patches/sprintf-js@1.1.3.patch