From 1c8ca29c55897d097915eaeebd3ae578c3a7377d Mon Sep 17 00:00:00 2001 From: saurabhmaheshwari-obin <242053479+saurabhmaheshwari-obin@users.noreply.github.com> Date: Fri, 23 Oct 2026 17:10:22 +0000 Subject: [PATCH 1/5] fix(deps): the nextjs agent to 0.0.167, which ships a patched Next.js (#1232) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The frontend and marketing services pinned the nextjs agent at 0.0.163. That agent pins the framework EXACTLY in `base/code` and `templates/factory/code`, and its `framework_version_test.go` holds the lockfile's resolved version equal to the declared one, so no service it builds can resolve past the agent's pin. Through 0.0.166 that pin was next 16.3.6, which carries three criticals: - unauthenticated RCE in the Image Optimization API when SVG files are used (GHSA-2464-fhr4-w9xw) - DoS in App Router using Server Actions (GHSA-p3m5-59mp-jv5r) - RCE in `use cache` functions returning typed arrays (GHSA-673q-mjm6-r5xr) 0.0.167 ships next 16.4.1 (service-nextjs#177), and with it Go 1.27.3 for GO-2026-6809 (#178) and typescript back to ^5 — the only major typescript-eslint@8 admits, so the scaffold's own lint runs again (#179). Verified against the release rather than the release notes: v0.0.167 is a published, non-draft GitHub Release with 9 assets (`agent.version` resolves a Release, not a tag — a tag-only version 404s and takes every integration suite with it), and the tag itself carries next 16.4.1, typescript ^5 and go 1.27.3. This is the durable half of the Next.js remediation. The application-side lockfiles were already patched on main by #1027; this moves the agent that builds them, so a future service scaffolded here does not start vulnerable. Classification: fix, at the place that owns the framework version. Co-authored-by: Claude Opus 5 (1M context) (cherry picked from commit 7ed5dedf1299fbf20388ef769cdda5c258c3b376) Co-Authored-By: Claude Opus 5.5 --- module/services/frontend/service.codefly.yaml | 13 ++++++++++++- module/services/marketing/service.codefly.yaml | 5 ++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/module/services/frontend/service.codefly.yaml b/module/services/frontend/service.codefly.yaml index 3d86ff03c..57d6635bb 100644 --- a/module/services/frontend/service.codefly.yaml +++ b/module/services/frontend/service.codefly.yaml @@ -7,7 +7,18 @@ agent: # the release that ships the builder fix the content kit needs. 0.0.163 also # carries core v0.15.1's NewAPI fix (an endpoint keeps its exposure and # location) and the ConfigMap quoting fix. - version: 0.0.163 + # + # 0.0.167 is the security floor. The agent pins the framework EXACTLY in + # `base/code` and `templates/factory/code`, and its framework gate holds the + # lockfile's resolved version equal to the declared one, so no service built + # by it can resolve past the agent's pin. Through 0.0.166 that pin was + # next 16.3.6, which carries three criticals: unauthenticated RCE in the + # Image Optimization API via SVG (GHSA-2464-fhr4-w9xw), DoS in App Router + # Server Actions (GHSA-p3m5-59mp-jv5r), and RCE in `use cache` functions + # returning typed arrays (GHSA-673q-mjm6-r5xr). 0.0.167 ships next 16.4.1 + # (service-nextjs#177), and with it Go 1.27.3 for GO-2026-6809 (#178) and + # typescript back to ^5, the only major typescript-eslint@8 admits (#179). + version: 0.0.167 publisher: codefly.dev service-dependencies: - name: auth-gateway diff --git a/module/services/marketing/service.codefly.yaml b/module/services/marketing/service.codefly.yaml index f81aa4ff8..bf38982f6 100644 --- a/module/services/marketing/service.codefly.yaml +++ b/module/services/marketing/service.codefly.yaml @@ -7,7 +7,10 @@ description: | agent: kind: codefly:service name: nextjs - version: 0.0.163 + # 0.0.167 is the security floor: the agent pinned next 16.3.6 exactly through + # 0.0.166, and no service it builds can resolve past its pin. See frontend's + # manifest for the three advisories that pin cleared (service-nextjs#177). + version: 0.0.167 publisher: codefly.dev endpoints: - name: http From ed564ec60df9909a6ee9f568b4ddbcd66be0a851 Mon Sep 17 00:00:00 2001 From: saurabhmaheshwari-obin <242053479+saurabhmaheshwari-obin@users.noreply.github.com> Date: Sat, 24 Oct 2026 12:43:33 -0400 Subject: [PATCH 2/5] fix(deps): migrate production validation to patched Zod 4 (#1239) Ported to the v0.0.105 line. Beyond #1239, this also takes main's exact pins from #1027 that the first-party audit gate needs on this line: next and eslint-config-next 16.4.1 (frontend and marketing; GHSA-2464-fhr4-w9xw, GHSA-p3m5-59mp-jv5r, GHSA-673q-mjm6-r5xr) and @sentry/nextjs 10.75.2 (GHSA-mchm-gjx6-7h55), and refreshes dompurify to 3.4.17 within its range (GHSA-cg2g-xh64-v4q7). Lockfiles regenerated with npm install --package-lock-only. The kit packages are byte-identical to main's 0.13.0. (cherry picked from commit f3fee4c06cee9f02daa68aff374474065ba37d38) Co-Authored-By: Claude Opus 5.5 --- .../services/frontend/code/package-lock.json | 726 ++++++++++-------- module/services/frontend/code/package.json | 16 +- .../code/packages/codefly-ui/package.json | 2 +- .../frontend/code/packages/saas-ui/README.md | 13 + .../code/packages/saas-ui/package.json | 18 +- .../saas-ui/src/datasources/schema.ts | 8 +- .../code/scripts/test-registry-ui.mjs | 22 +- .../code/src/features/teams/ui/team-form.tsx | 2 +- .../services/marketing/code/package-lock.json | 150 ++-- module/services/marketing/code/package.json | 4 +- .../marketing/code/src/config/environment.ts | 8 +- .../marketing/code/tests/catalog.test.ts | 2 +- 12 files changed, 519 insertions(+), 452 deletions(-) diff --git a/module/services/frontend/code/package-lock.json b/module/services/frontend/code/package-lock.json index b8ba2435b..c706b055c 100644 --- a/module/services/frontend/code/package-lock.json +++ b/module/services/frontend/code/package-lock.json @@ -16,8 +16,8 @@ "@codefly-dev/saas-plugin-contract": "2.4.4", "@codefly-dev/saas-plugin-react": "0.4.5", "@codefly-dev/saas-sdk": "0.3.35", - "@codefly-dev/saas-ui": "0.12.8", - "@codefly-dev/ui": "0.12.8", + "@codefly-dev/saas-ui": "0.13.0", + "@codefly-dev/ui": "0.13.0", "@codefly/saas-plugin-manifest": "0.1.2", "@codefly/saas-settings": "0.1.0", "@connectrpc/connect": "^2.1.1", @@ -28,9 +28,9 @@ "@fontsource/newsreader": "^5.3.0", "@fontsource/roboto": "^5.3.0", "@fontsource/source-serif-4": "^5.3.0", - "@hookform/resolvers": "^3.9.0", + "@hookform/resolvers": "^5.9.2", "@module-federation/runtime": "^2.8.2", - "@sentry/nextjs": "^10.50.0", + "@sentry/nextjs": "10.75.2", "@simplewebauthn/browser": "^13.3.0", "@tanstack/react-query": "^5.60.0", "@tanstack/react-table": "^8.21.3", @@ -38,16 +38,16 @@ "codefly": "https://github.com/codefly-dev/sdk-js/archive/9f3bb78682a0c2b9a70631d35c2ae0094c281ac5.tar.gz", "js-yaml": "^4.3.2", "lucide-react": "^1.8.0", - "next": "^16.2.12", + "next": "16.4.1", "react": "^19.2.8", "react-dom": "^19.2.8", - "react-hook-form": "^7.54.0", + "react-hook-form": "^7.55.0", "server-only": "^0.0.1", "sonner": "^2.0.7", "swagger-ui-react": "^5.32.14", "tailwind-merge": "^3.5.0", "tw-animate-css": "^1.4.0", - "zod": "^3.24.0" + "zod": "^4.6.6" }, "devDependencies": { "@biomejs/biome": "^2.5.4", @@ -64,7 +64,7 @@ "ajv": "^8.17.1", "babel-plugin-react-compiler": "1.0.0", "eslint": "^9.39.5", - "eslint-config-next": "^16.2.12", + "eslint-config-next": "16.4.1", "happy-dom": "^20.8.9", "jsdom": "^29.0.2", "msw": "^2.7.0", @@ -519,9 +519,6 @@ "arm64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT OR Apache-2.0", "optional": true, "os": [ @@ -539,9 +536,6 @@ "arm64" ], "dev": true, - "libc": [ - "musl" - ], "license": "MIT OR Apache-2.0", "optional": true, "os": [ @@ -559,9 +553,6 @@ "x64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT OR Apache-2.0", "optional": true, "os": [ @@ -579,9 +570,6 @@ "x64" ], "dev": true, - "libc": [ - "musl" - ], "license": "MIT OR Apache-2.0", "optional": true, "os": [ @@ -1703,12 +1691,113 @@ } }, "node_modules/@hookform/resolvers": { - "version": "3.10.0", - "resolved": "https://registry.npmjs.org/@hookform/resolvers/-/resolvers-3.10.0.tgz", - "integrity": "sha512-79Dv+3mDF7i+2ajj7SkypSKHhl1cbln1OGavqrsF7p6mbUv11xpqpacPsGDCTRvCSjEEIez2ef1NveSVL3b0Ag==", + "version": "5.9.2", + "resolved": "https://registry.npmjs.org/@hookform/resolvers/-/resolvers-5.9.2.tgz", + "integrity": "sha512-RtjTnZqsC38s4NKp2XO3fD8IA5uyN4tB7McQ5C6uiMPcV+WWO8F+wVa3e+BXUpH2ScgxghAlwFRMVqjT9WChAQ==", "license": "MIT", + "dependencies": { + "@standard-schema/utils": "^0.3.0" + }, "peerDependencies": { - "react-hook-form": "^7.0.0" + "@sinclair/typebox": ">=0.25.24", + "@standard-schema/spec": "^1.0.0", + "@typeschema/main": ">=0.13.7", + "@vinejs/vine": "^2.0.0 || ^3.0.0 || ^4.0.0", + "ajv": "^8.12.0", + "ajv-errors": "^3.0.0", + "ajv-formats": "^2.1.1", + "arktype": "^2.0.0", + "ata-validator": "^1.23.0", + "class-transformer": ">=0.4.0", + "class-validator": ">=0.12.0", + "computed-types": "^1.0.0", + "effect": "^3.10.3", + "fluentvalidation-ts": "^3.0.0", + "fp-ts": "^2.7.0", + "io-ts": "^2.0.0", + "joi": "^17.0.0 || ^18.0.0", + "nope-validator": ">=0.12.0", + "react-hook-form": "^7.55.0", + "superstruct": ">=0.12.0", + "typanion": "^3.3.2", + "valibot": ">=0.31.0 || ^1.0.0-beta.4 || ^1.0.0-rc", + "vest": ">=6.0.0", + "yup": "^1.0.0", + "zod": "^3.25.0 || ^4.0.0" + }, + "peerDependenciesMeta": { + "@sinclair/typebox": { + "optional": true + }, + "@standard-schema/spec": { + "optional": true + }, + "@typeschema/main": { + "optional": true + }, + "@vinejs/vine": { + "optional": true + }, + "ajv": { + "optional": true + }, + "ajv-errors": { + "optional": true + }, + "ajv-formats": { + "optional": true + }, + "arktype": { + "optional": true + }, + "ata-validator": { + "optional": true + }, + "class-transformer": { + "optional": true + }, + "class-validator": { + "optional": true + }, + "computed-types": { + "optional": true + }, + "effect": { + "optional": true + }, + "fluentvalidation-ts": { + "optional": true + }, + "fp-ts": { + "optional": true + }, + "io-ts": { + "optional": true + }, + "joi": { + "optional": true + }, + "nope-validator": { + "optional": true + }, + "superstruct": { + "optional": true + }, + "typanion": { + "optional": true + }, + "valibot": { + "optional": true + }, + "vest": { + "optional": true + }, + "yup": { + "optional": true + }, + "zod": { + "optional": true + } } }, "node_modules/@humanfs/core": { @@ -1889,9 +1978,6 @@ "cpu": [ "arm" ], - "libc": [ - "glibc" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -1908,9 +1994,6 @@ "cpu": [ "arm64" ], - "libc": [ - "glibc" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -1927,9 +2010,6 @@ "cpu": [ "ppc64" ], - "libc": [ - "glibc" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -1946,9 +2026,6 @@ "cpu": [ "riscv64" ], - "libc": [ - "glibc" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -1965,9 +2042,6 @@ "cpu": [ "s390x" ], - "libc": [ - "glibc" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -1984,9 +2058,6 @@ "cpu": [ "x64" ], - "libc": [ - "glibc" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -2003,9 +2074,6 @@ "cpu": [ "arm64" ], - "libc": [ - "musl" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -2022,9 +2090,6 @@ "cpu": [ "x64" ], - "libc": [ - "musl" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -2041,9 +2106,6 @@ "cpu": [ "arm" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2066,9 +2128,6 @@ "cpu": [ "arm64" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2091,9 +2150,6 @@ "cpu": [ "ppc64" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2116,9 +2172,6 @@ "cpu": [ "riscv64" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2141,9 +2194,6 @@ "cpu": [ "s390x" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2166,9 +2216,6 @@ "cpu": [ "x64" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2191,9 +2238,6 @@ "cpu": [ "arm64" ], - "libc": [ - "musl" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2216,9 +2260,6 @@ "cpu": [ "x64" ], - "libc": [ - "musl" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2534,9 +2575,6 @@ "cpu": [ "x64" ], - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -2569,15 +2607,15 @@ } }, "node_modules/@next/env": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/env/-/env-16.3.8.tgz", - "integrity": "sha512-Al9zqHVV7TJv0eFuOU4U7Lvv74PTih4Ch63sk2xCIpSTkE3udFnaOcnzP2lQVymiL7yS9Cj2iClUXlR3EQ5sEw==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/env/-/env-16.4.1.tgz", + "integrity": "sha512-5sUUrrSvs/2/2LnLoesybMGx12EtPB46fdZ6RhAw0XDGSPxU2LFyQBB7yuEiOFFJPKmBY6+q2jTr1/AMbnp0/g==", "license": "MIT" }, "node_modules/@next/eslint-plugin-next": { - "version": "16.3.4", - "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-16.3.4.tgz", - "integrity": "sha512-szW9y2Aumu4z88YXfTzcFsgUAg2k64uzbtcO5L9f1AKS4w/GUKJcbFllRflROVyNPgJtGOnvNxiyp3v6b+prIA==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-16.4.1.tgz", + "integrity": "sha512-2io6M+wAqe7nT5mt2gEVy6FOzye2DmwhjaYCpSvHfrIKL11SXNTwSARxpPHJacRmfgSBSDnNmnEXSp0DaJ23BQ==", "dev": true, "license": "MIT", "dependencies": { @@ -2618,9 +2656,9 @@ } }, "node_modules/@next/swc-darwin-arm64": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.3.8.tgz", - "integrity": "sha512-2JPRMh2nmQG5CiL7cXGL9AGwnPWJQ//cTtAUCT+w511QHk79SYz3LGv/pc5X643B/WEO0rvu3Yww0hqwt3kgeA==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.4.1.tgz", + "integrity": "sha512-U+hQ5Gj3fpzf4fveTIF3dpUFYhaSW8vHhdAnbiIomzXzg7boreYFgBqprepXFtW4sw+aTttiNmg0gew/iFNhbg==", "cpu": [ "arm64" ], @@ -2634,9 +2672,9 @@ } }, "node_modules/@next/swc-darwin-x64": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.3.8.tgz", - "integrity": "sha512-GZtCCOBKJ4leVIT/Th0llWKhD1ca92lzbQiS5R5ON9QkoiFnilFsebDae1JU2a3HWoKMEmEZWGs1AGLavVM72Q==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.4.1.tgz", + "integrity": "sha512-/hqC3V1XLUjhMASf/WridKdO9FXoEgN3HBWmtKbj00MPgnltutfraWJ3bYTpCRIgEIpbjJyOVLpYgAhh/BkdcQ==", "cpu": [ "x64" ], @@ -2650,15 +2688,12 @@ } }, "node_modules/@next/swc-linux-arm64-gnu": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.3.8.tgz", - "integrity": "sha512-O659ygeQYqneJ1fBKMpFxIFqYkYswu8IAS1OCKK/4f3ZgJJm1dRz4fVJZRi/kLLWjnBKnebOePA4WNv+sV1pVA==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.4.1.tgz", + "integrity": "sha512-GHzncHbcaS9g95kcvTNtKQW3aCLoR+xc3Jm7qrkpk1R+D2BjMHIPyvQGRPKCdMX95BsH/421jBUK06q9tEwzjw==", "cpu": [ "arm64" ], - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -2669,15 +2704,12 @@ } }, "node_modules/@next/swc-linux-arm64-musl": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.3.8.tgz", - "integrity": "sha512-dSjKSyWpzxoO1d3DIZZcP4XJcNaKeLmxQMFOiYl5vuBRMmweIqnAhty8tAmRsvTss779cK1FtYnDMj40e4TQlg==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.4.1.tgz", + "integrity": "sha512-1SuJyDxW/PR9dHJat/ZRgcYLhuSZ+1psP4DlKb2tKIuXbjygqpLrJWRSq+onZQBv8LcmU67EIrmb6c3XTaJLjw==", "cpu": [ "arm64" ], - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -2688,15 +2720,12 @@ } }, "node_modules/@next/swc-linux-x64-gnu": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.3.8.tgz", - "integrity": "sha512-lbqOuz3RPRcv+o9msNsJw5x4+Y1ZwPTs6vmL6DCf7i0fZfvng/F59wyeDwqHIvV0mK//RBy/jJkZ+nCKsSMXjQ==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.4.1.tgz", + "integrity": "sha512-Istng1hMGp9TGO4lUqeKLd70MPN/OOkucVTP2Nmj+gLkwBgmPqUw8CJYBCC7nbl/B/23bBCcjCI5Hsh6hazC1A==", "cpu": [ "x64" ], - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -2707,15 +2736,12 @@ } }, "node_modules/@next/swc-linux-x64-musl": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.3.8.tgz", - "integrity": "sha512-+316WswI8ScVgZeUd+1KGaXkHhaYQzCjvH/05TZSpJ8zBizb1a4G7DtO7F12jcBIqMOtsz9ji1t48fmKtzqsGA==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.4.1.tgz", + "integrity": "sha512-aSC9wMNiZRRFVpPkPWBzRwLQxIGm/CiQcXyFF1XNcgodb+uMxdk7aSSGGpDXCbnvZdf4itjHxpOd5h7i7zaiYw==", "cpu": [ "x64" ], - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -2726,9 +2752,9 @@ } }, "node_modules/@next/swc-win32-arm64-msvc": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.3.8.tgz", - "integrity": "sha512-ji0gd4kMYUxO+1fJBIbiBVRCjzG/lloiyCccnlebvb1ZJ5qXCPZqYg4Jl1DrrixnWNMKylzgpmMWx0yNDYXlzw==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.4.1.tgz", + "integrity": "sha512-t/myvwFDlypMUjRvbBf8qLPyuaB0iXYYdBtwMt6DM6f+60wtGr4bSYholdPqNeV5VUXZhrpMwfza829kmhS3iA==", "cpu": [ "arm64" ], @@ -2742,9 +2768,9 @@ } }, "node_modules/@next/swc-win32-x64-msvc": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.3.8.tgz", - "integrity": "sha512-WcTlaKt/TWkh5kUjdJcUmB1XgZ+1c6fz4Y9fDHL73YNSdGaUWjceeWrrlwF0nv19iABYWC4iAq1oX1w4Bn0vfg==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.4.1.tgz", + "integrity": "sha512-6ICqPo9awCkrtYNPhwkx1uU7rlFWrZRrIboDHS2LU+jv088UBYQtmJ25h6pCp27/+FZjF6BQ4Te4ErugyMeuBg==", "cpu": [ "x64" ], @@ -3219,9 +3245,6 @@ "cpu": [ "arm" ], - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -3235,9 +3258,6 @@ "cpu": [ "arm" ], - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -3251,9 +3271,6 @@ "cpu": [ "arm64" ], - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -3267,9 +3284,6 @@ "cpu": [ "arm64" ], - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -3283,9 +3297,6 @@ "cpu": [ "loong64" ], - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -3299,9 +3310,6 @@ "cpu": [ "loong64" ], - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -3315,9 +3323,6 @@ "cpu": [ "ppc64" ], - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -3331,9 +3336,6 @@ "cpu": [ "ppc64" ], - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -3347,9 +3349,6 @@ "cpu": [ "riscv64" ], - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -3363,9 +3362,6 @@ "cpu": [ "riscv64" ], - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -3379,9 +3375,6 @@ "cpu": [ "s390x" ], - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -3395,9 +3388,6 @@ "cpu": [ "x64" ], - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -3411,9 +3401,6 @@ "cpu": [ "x64" ], - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -3522,30 +3509,54 @@ } }, "node_modules/@sentry/browser": { - "version": "10.73.0", - "resolved": "https://registry.npmjs.org/@sentry/browser/-/browser-10.73.0.tgz", - "integrity": "sha512-HqTe1S5RrWLufhX2LaFP3yNoMxfNDroh120bq1zdGHZfFDBMJQ0CDXxHO+L4UJfQ5dWdCCzWbXIAiZuWGa/DFQ==", + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/browser/-/browser-10.75.2.tgz", + "integrity": "sha512-2Q8Bd6aTIHmqWL/rGDZdr1JTGW2fYPXf+lMyhHp4CX6OE7gMaaI5ZUwQWgVelqUOvKkOZHHk0wo6K8+ExdwawQ==", "license": "MIT", "dependencies": { - "@sentry/browser-utils": "10.73.0", + "@sentry/browser-utils": "10.75.2", "@sentry/conventions": "^0.16.0", - "@sentry/core": "10.73.0", - "@sentry/feedback": "10.73.0", - "@sentry/replay": "10.73.0", - "@sentry/replay-canvas": "10.73.0" + "@sentry/core": "10.75.2", + "@sentry/feedback": "10.75.2", + "@sentry/replay": "10.75.2", + "@sentry/replay-canvas": "10.75.2" }, "engines": { "node": ">=18" } }, "node_modules/@sentry/browser-utils": { - "version": "10.73.0", - "resolved": "https://registry.npmjs.org/@sentry/browser-utils/-/browser-utils-10.73.0.tgz", - "integrity": "sha512-qQygxJZ+RV779+iL1+lrJ4f4sZLgbgW0/JWPNp0YlcEAE62yCsdKbqoTEjB/EugdS4mSjBMX0chZC6rblu2Ycw==", + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/browser-utils/-/browser-utils-10.75.2.tgz", + "integrity": "sha512-U9RIJE0vZHWEnfEpJAa/SQ60MsNSUaxww4MVymNLwJ26BrLFz9jLhVIW9bXcx0i1iwK+KQbIv6ebPDOnCfYUPQ==", "license": "MIT", "dependencies": { "@sentry/conventions": "^0.16.0", - "@sentry/core": "10.73.0" + "@sentry/core": "10.75.2" + }, + "engines": { + "node": ">=18" + } + }, + "node_modules/@sentry/browser-utils/node_modules/@sentry/core": { + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.2.tgz", + "integrity": "sha512-KXzNf2c430cJIOMv84+MKpkXgave1DBNMNNwn073olVD773NME5IhDv/9VQyiFM2wIU+6bm4FEBVEVSuzqgjJw==", + "license": "MIT", + "dependencies": { + "@sentry/conventions": "^0.16.0" + }, + "engines": { + "node": ">=18" + } + }, + "node_modules/@sentry/browser/node_modules/@sentry/core": { + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.2.tgz", + "integrity": "sha512-KXzNf2c430cJIOMv84+MKpkXgave1DBNMNNwn073olVD773NME5IhDv/9VQyiFM2wIU+6bm4FEBVEVSuzqgjJw==", + "license": "MIT", + "dependencies": { + "@sentry/conventions": "^0.16.0" }, "engines": { "node": ">=18" @@ -3798,34 +3809,46 @@ } }, "node_modules/@sentry/feedback": { - "version": "10.73.0", - "resolved": "https://registry.npmjs.org/@sentry/feedback/-/feedback-10.73.0.tgz", - "integrity": "sha512-D6nSngX+e46Mae2/oh2bxBvxNK1z2NERbuMAhB5sx9x4xMBWIyGnYYTECehvEqV9+AqGAgxxhOZoYIG3AmRwww==", + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/feedback/-/feedback-10.75.2.tgz", + "integrity": "sha512-/nrtMVSxOqBAigMWxIQS+Y8OqQ27ty+isMh6+X96kfAp/SaGrNZ425SZxKwq0mwHS0WnVkF+rE5dJnbbi56XSA==", + "license": "MIT", + "dependencies": { + "@sentry/core": "10.75.2" + }, + "engines": { + "node": ">=18" + } + }, + "node_modules/@sentry/feedback/node_modules/@sentry/core": { + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.2.tgz", + "integrity": "sha512-KXzNf2c430cJIOMv84+MKpkXgave1DBNMNNwn073olVD773NME5IhDv/9VQyiFM2wIU+6bm4FEBVEVSuzqgjJw==", "license": "MIT", "dependencies": { - "@sentry/core": "10.73.0" + "@sentry/conventions": "^0.16.0" }, "engines": { "node": ">=18" } }, "node_modules/@sentry/nextjs": { - "version": "10.73.0", - "resolved": "https://registry.npmjs.org/@sentry/nextjs/-/nextjs-10.73.0.tgz", - "integrity": "sha512-lZFlQkafIHnYKTo0QCY+VqFC7rEt/SRAVrTCKyM+r1yIAw+iIfU1qM2QT7xn71+t0U520I0xBJ2O+YzqLYXJIQ==", + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/nextjs/-/nextjs-10.75.2.tgz", + "integrity": "sha512-ilzb3E7Kaskx/RQ355kCkxLxrHBtYS67pe6KO+F/O6s53f5t4sVwz4gE2Mz4ScghDXeKM+ccyB5GMq9dlkQ35A==", "license": "MIT", "dependencies": { "@opentelemetry/api": "^1.9.1", "@rollup/plugin-commonjs": "28.0.1", - "@sentry/browser-utils": "10.73.0", + "@sentry/browser-utils": "10.75.2", "@sentry/bundler-plugin-core": "^5.3.0", "@sentry/conventions": "^0.16.0", - "@sentry/core": "10.73.0", - "@sentry/node": "10.73.0", - "@sentry/opentelemetry": "10.73.0", - "@sentry/react": "10.73.0", - "@sentry/server-utils": "10.73.0", - "@sentry/vercel-edge": "10.73.0", + "@sentry/core": "10.75.2", + "@sentry/node": "10.75.2", + "@sentry/opentelemetry": "10.75.2", + "@sentry/react": "10.75.2", + "@sentry/server-utils": "10.75.2", + "@sentry/vercel-edge": "10.75.2", "@sentry/webpack-plugin": "^5.3.0", "rollup": "^4.60.3", "stacktrace-parser": "^0.1.11" @@ -3837,20 +3860,32 @@ "next": "^13.2.0 || ^14.0 || ^15.0.0-rc.0 || ^16.0.0-0" } }, + "node_modules/@sentry/nextjs/node_modules/@sentry/core": { + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.2.tgz", + "integrity": "sha512-KXzNf2c430cJIOMv84+MKpkXgave1DBNMNNwn073olVD773NME5IhDv/9VQyiFM2wIU+6bm4FEBVEVSuzqgjJw==", + "license": "MIT", + "dependencies": { + "@sentry/conventions": "^0.16.0" + }, + "engines": { + "node": ">=18" + } + }, "node_modules/@sentry/node": { - "version": "10.73.0", - "resolved": "https://registry.npmjs.org/@sentry/node/-/node-10.73.0.tgz", - "integrity": "sha512-jiMJ6GgXDw6UMGzJY+o0c8OoeA9OfHqZ/xEpHfDqy75hn+9CEkRkbNGCIdMvsc7wW/Se1Os394hHfTpU+YEskg==", + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/node/-/node-10.75.2.tgz", + "integrity": "sha512-ffdx1i3Fx9Q3Ofdaone2I+HWOj9+Wcu268xgV+Bn8WJYABm8BZIBNvS+PORKBPesWILhQCThWOs+E/8vcV1HuQ==", "license": "MIT", "dependencies": { "@opentelemetry/api": "^1.9.1", "@opentelemetry/instrumentation": "^0.220.0", "@opentelemetry/sdk-trace-base": "^2.9.0", "@sentry/conventions": "^0.16.0", - "@sentry/core": "10.73.0", - "@sentry/node-core": "10.73.0", - "@sentry/opentelemetry": "10.73.0", - "@sentry/server-utils": "10.73.0", + "@sentry/core": "10.75.2", + "@sentry/node-core": "10.75.2", + "@sentry/opentelemetry": "10.75.2", + "@sentry/server-utils": "10.75.2", "import-in-the-middle": "^3.0.0" }, "engines": { @@ -3858,14 +3893,14 @@ } }, "node_modules/@sentry/node-core": { - "version": "10.73.0", - "resolved": "https://registry.npmjs.org/@sentry/node-core/-/node-core-10.73.0.tgz", - "integrity": "sha512-GHAGUmZPmm6FKfxfv2maVVJ/A99YAmd7oFOuKMDmITI6O/Msl6JB3vPTEpopVAHLW0LYJQBOjddL9C7o+Jt44g==", + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/node-core/-/node-core-10.75.2.tgz", + "integrity": "sha512-6sFhrvWVLAPRTOYkwrOOLwgsWINe6Y75oX9xKj11zZcKd2e1K2Y3bcx3uzDU06+cxfVbUQUBulsCr/TD7yx/vw==", "license": "MIT", "dependencies": { "@sentry/conventions": "^0.16.0", - "@sentry/core": "10.73.0", - "@sentry/opentelemetry": "10.73.0", + "@sentry/core": "10.75.2", + "@sentry/opentelemetry": "10.75.2", "import-in-the-middle": "^3.0.0" }, "engines": { @@ -3896,14 +3931,38 @@ } } }, + "node_modules/@sentry/node-core/node_modules/@sentry/core": { + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.2.tgz", + "integrity": "sha512-KXzNf2c430cJIOMv84+MKpkXgave1DBNMNNwn073olVD773NME5IhDv/9VQyiFM2wIU+6bm4FEBVEVSuzqgjJw==", + "license": "MIT", + "dependencies": { + "@sentry/conventions": "^0.16.0" + }, + "engines": { + "node": ">=18" + } + }, + "node_modules/@sentry/node/node_modules/@sentry/core": { + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.2.tgz", + "integrity": "sha512-KXzNf2c430cJIOMv84+MKpkXgave1DBNMNNwn073olVD773NME5IhDv/9VQyiFM2wIU+6bm4FEBVEVSuzqgjJw==", + "license": "MIT", + "dependencies": { + "@sentry/conventions": "^0.16.0" + }, + "engines": { + "node": ">=18" + } + }, "node_modules/@sentry/opentelemetry": { - "version": "10.73.0", - "resolved": "https://registry.npmjs.org/@sentry/opentelemetry/-/opentelemetry-10.73.0.tgz", - "integrity": "sha512-fQouPQKsH0CQrw6oAn1k0Z2I+tgyochCovifr5qNS69i0OzjknLa03WJyiZ/IuzXc4AVa5jAKfOeE9slABz8Qw==", + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/opentelemetry/-/opentelemetry-10.75.2.tgz", + "integrity": "sha512-qoJIdrXiFPPYs7AmdkktB5O4vhHYKzk6EulpQlvROe+ZZeG4/S0yeJApAbg3ThDob/2zEAxYEPEvaHv2epipgA==", "license": "MIT", "dependencies": { "@sentry/conventions": "^0.16.0", - "@sentry/core": "10.73.0" + "@sentry/core": "10.75.2" }, "engines": { "node": ">=18" @@ -3914,15 +3973,27 @@ "@opentelemetry/sdk-trace-base": "^1.30.1 || ^2.1.0" } }, + "node_modules/@sentry/opentelemetry/node_modules/@sentry/core": { + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.2.tgz", + "integrity": "sha512-KXzNf2c430cJIOMv84+MKpkXgave1DBNMNNwn073olVD773NME5IhDv/9VQyiFM2wIU+6bm4FEBVEVSuzqgjJw==", + "license": "MIT", + "dependencies": { + "@sentry/conventions": "^0.16.0" + }, + "engines": { + "node": ">=18" + } + }, "node_modules/@sentry/react": { - "version": "10.73.0", - "resolved": "https://registry.npmjs.org/@sentry/react/-/react-10.73.0.tgz", - "integrity": "sha512-wJrzS98ddPvhGS/MKNHZyE8X7ecd4KwKdz7fHino2qkqBBrF4cxWr+q/uLTIk5PYWMkeJ4oKMjHAjOqmzGR4tg==", + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/react/-/react-10.75.2.tgz", + "integrity": "sha512-4MtB1tSmMHzwTwY7m30UzRbbUx9cP84UK7WIDL9g7RvoGd/aZwxbp6IkUJ46VBNItVoSF+1GM9wtqzkLma252g==", "license": "MIT", "dependencies": { - "@sentry/browser": "10.73.0", + "@sentry/browser": "10.75.2", "@sentry/conventions": "^0.16.0", - "@sentry/core": "10.73.0" + "@sentry/core": "10.75.2" }, "engines": { "node": ">=18" @@ -3931,53 +4002,113 @@ "react": "^16.14.0 || 17.x || 18.x || 19.x" } }, + "node_modules/@sentry/react/node_modules/@sentry/core": { + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.2.tgz", + "integrity": "sha512-KXzNf2c430cJIOMv84+MKpkXgave1DBNMNNwn073olVD773NME5IhDv/9VQyiFM2wIU+6bm4FEBVEVSuzqgjJw==", + "license": "MIT", + "dependencies": { + "@sentry/conventions": "^0.16.0" + }, + "engines": { + "node": ">=18" + } + }, "node_modules/@sentry/replay": { - "version": "10.73.0", - "resolved": "https://registry.npmjs.org/@sentry/replay/-/replay-10.73.0.tgz", - "integrity": "sha512-nN2wjN/Y0J5BOJV5hqRHUEBfxwUsipp1PKjcDHh6Fpxnrtfldu3Y99E8cQInseo5heFdzEvrOHBBrqWZXOHVKQ==", + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/replay/-/replay-10.75.2.tgz", + "integrity": "sha512-cCfdPt892S+rrAFOuUvbwR318/ZPFfBFvVkMlL3goktAnbECAGy6comAxLQEalyp22Ee67bEqYQN7RdNuRHIJw==", "license": "MIT", "dependencies": { - "@sentry/browser-utils": "10.73.0", - "@sentry/core": "10.73.0" + "@sentry/browser-utils": "10.75.2", + "@sentry/core": "10.75.2" }, "engines": { "node": ">=18" } }, "node_modules/@sentry/replay-canvas": { - "version": "10.73.0", - "resolved": "https://registry.npmjs.org/@sentry/replay-canvas/-/replay-canvas-10.73.0.tgz", - "integrity": "sha512-sxa2lKkHPfF/j5xFpW7gocthWXRqyoHz8KCPy6yGc8plT477nl57iGSKhQDYsx1Ny10TLjs7YkIuPP1GY/Ax2Q==", + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/replay-canvas/-/replay-canvas-10.75.2.tgz", + "integrity": "sha512-4GVhCkn+/0QEpXdY8UfXahg8qjF2QTH1+qej/CLketHGfRqxLhdanzHU9ILesplWX5GeuTkPn5ZTmd5CJf+KXg==", "license": "MIT", "dependencies": { - "@sentry/core": "10.73.0", - "@sentry/replay": "10.73.0" + "@sentry/core": "10.75.2", + "@sentry/replay": "10.75.2" + }, + "engines": { + "node": ">=18" + } + }, + "node_modules/@sentry/replay-canvas/node_modules/@sentry/core": { + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.2.tgz", + "integrity": "sha512-KXzNf2c430cJIOMv84+MKpkXgave1DBNMNNwn073olVD773NME5IhDv/9VQyiFM2wIU+6bm4FEBVEVSuzqgjJw==", + "license": "MIT", + "dependencies": { + "@sentry/conventions": "^0.16.0" + }, + "engines": { + "node": ">=18" + } + }, + "node_modules/@sentry/replay/node_modules/@sentry/core": { + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.2.tgz", + "integrity": "sha512-KXzNf2c430cJIOMv84+MKpkXgave1DBNMNNwn073olVD773NME5IhDv/9VQyiFM2wIU+6bm4FEBVEVSuzqgjJw==", + "license": "MIT", + "dependencies": { + "@sentry/conventions": "^0.16.0" }, "engines": { "node": ">=18" } }, "node_modules/@sentry/server-utils": { - "version": "10.73.0", - "resolved": "https://registry.npmjs.org/@sentry/server-utils/-/server-utils-10.73.0.tgz", - "integrity": "sha512-QskripdKFbM/+gipC6mpa2crLwL7+VbkX84IpHg2z9UlYQ1kNKd3aMT+Qk9NLRSw/zu1rSIAvlbWfx4D3rgNAA==", + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/server-utils/-/server-utils-10.75.2.tgz", + "integrity": "sha512-ep8Ntj/vsLHbql1jUMFiRYrleuQ3dENb8oD4Nkjv7hou2j0UKLct1eLbx+TckeVOhYdWmFeO7WJWjRio/a4TOg==", "license": "MIT", "dependencies": { "@sentry/conventions": "^0.16.0", - "@sentry/core": "10.73.0" + "@sentry/core": "10.75.2" + }, + "engines": { + "node": ">=18" + } + }, + "node_modules/@sentry/server-utils/node_modules/@sentry/core": { + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.2.tgz", + "integrity": "sha512-KXzNf2c430cJIOMv84+MKpkXgave1DBNMNNwn073olVD773NME5IhDv/9VQyiFM2wIU+6bm4FEBVEVSuzqgjJw==", + "license": "MIT", + "dependencies": { + "@sentry/conventions": "^0.16.0" }, "engines": { "node": ">=18" } }, "node_modules/@sentry/vercel-edge": { - "version": "10.73.0", - "resolved": "https://registry.npmjs.org/@sentry/vercel-edge/-/vercel-edge-10.73.0.tgz", - "integrity": "sha512-DJLqVzd3ng4IwR+ux/vK1Wth/CSwUrsiwIbNsyneHw79cyhfjYuovFTw1xrjn9zTJoVSE8KkdajLSLwmLbnoTw==", + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/vercel-edge/-/vercel-edge-10.75.2.tgz", + "integrity": "sha512-Ol2kQfob60s4qAeitUt2XXG9of/jUCqhQ3loMx5nASJn9Y1C86XZOqzbVuzBDIoMQVBPV2JGCD8HgWHiN5HPbw==", "license": "MIT", "dependencies": { "@opentelemetry/api": "^1.9.1", - "@sentry/core": "10.73.0" + "@sentry/core": "10.75.2" + }, + "engines": { + "node": ">=18" + } + }, + "node_modules/@sentry/vercel-edge/node_modules/@sentry/core": { + "version": "10.75.2", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.2.tgz", + "integrity": "sha512-KXzNf2c430cJIOMv84+MKpkXgave1DBNMNNwn073olVD773NME5IhDv/9VQyiFM2wIU+6bm4FEBVEVSuzqgjJw==", + "license": "MIT", + "dependencies": { + "@sentry/conventions": "^0.16.0" }, "engines": { "node": ">=18" @@ -4004,6 +4135,12 @@ "integrity": "sha512-BE/UWv6FOToAdVk0EokzkqQQDOWtNydYlY6+OrmiZ5SCNmb41VehttboTetUM3T/fr6EAFYVXjz4My2wg230rQ==", "license": "MIT" }, + "node_modules/@standard-schema/utils": { + "version": "0.3.0", + "resolved": "https://registry.npmjs.org/@standard-schema/utils/-/utils-0.3.0.tgz", + "integrity": "sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==", + "license": "MIT" + }, "node_modules/@swagger-api/apidom-ast": { "version": "1.11.6", "resolved": "https://registry.npmjs.org/@swagger-api/apidom-ast/-/apidom-ast-1.11.6.tgz", @@ -4841,9 +4978,6 @@ "arm64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -4861,9 +4995,6 @@ "arm64" ], "dev": true, - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -4881,9 +5012,6 @@ "x64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -4901,9 +5029,6 @@ "x64" ], "dev": true, - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -5850,9 +5975,6 @@ "arm64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -5867,9 +5989,6 @@ "arm64" ], "dev": true, - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -5884,9 +6003,6 @@ "loong64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -5901,9 +6017,6 @@ "loong64" ], "dev": true, - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -5918,9 +6031,6 @@ "ppc64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -5935,9 +6045,6 @@ "riscv64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -5952,9 +6059,6 @@ "riscv64" ], "dev": true, - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -5969,9 +6073,6 @@ "s390x" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -5986,9 +6087,6 @@ "x64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -6003,9 +6101,6 @@ "x64" ], "dev": true, - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -7147,9 +7242,9 @@ } }, "node_modules/cjs-module-lexer": { - "version": "2.2.1", - "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.2.1.tgz", - "integrity": "sha512-Ca8swihM+/4yKecYHY52kgJd300hi2lADU/a1RxNTRe+RJ9jvqQlESpbz9DnG9mowez8qwXHB8qYdIUw9e+F5Q==", + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.3.0.tgz", + "integrity": "sha512-lmNyBzi6iYiqyrExTctfmjd8tInx+dHu9PBomTfH5RXS53c27JMFJgzNv5TyAnm3PgGf+MLy0+Ws41/HlVxdKQ==", "license": "MIT" }, "node_modules/class-variance-authority": { @@ -7620,9 +7715,9 @@ "peer": true }, "node_modules/dompurify": { - "version": "3.4.16", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz", - "integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==", + "version": "3.4.17", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.17.tgz", + "integrity": "sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" @@ -7840,7 +7935,8 @@ "version": "2.3.2", "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz", "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==", - "license": "MIT" + "license": "MIT", + "peer": true }, "node_modules/es-object-atoms": { "version": "1.1.2", @@ -8029,21 +8125,21 @@ } }, "node_modules/eslint-config-next": { - "version": "16.3.4", - "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-16.3.4.tgz", - "integrity": "sha512-35/8RM10huEL9vlr8hUZMERMENHBrnyHN3ZZkF9efSgzGaqK34jIqry44A956//zriUhUAUW0XSkcolhrryqAA==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-16.4.1.tgz", + "integrity": "sha512-6AsojbCfRdpWkP6BIUnMBv3MH4OvtfmH9p4hSfLh8ZgsW7nfhu7DpUMNBB7leisDyyMz+YYxTc+NAdBOQfovlA==", "dev": true, "license": "MIT", "dependencies": { - "@next/eslint-plugin-next": "16.3.4", + "@next/eslint-plugin-next": "16.4.1", "eslint-import-resolver-node": "^0.3.6", "eslint-import-resolver-typescript": "^3.5.2", "eslint-plugin-import": "^2.32.0", "eslint-plugin-jsx-a11y": "^6.10.0", "eslint-plugin-react": "^7.37.0", - "eslint-plugin-react-hooks": "^7.0.0", + "eslint-plugin-react-hooks": "^7.1.0", "globals": "16.4.0", - "typescript-eslint": "^8.46.0" + "typescript-eslint": "^8.56.0" }, "peerDependencies": { "eslint": ">=9.0.0", @@ -9300,19 +9396,25 @@ } }, "node_modules/import-in-the-middle": { - "version": "3.4.0", - "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.4.0.tgz", - "integrity": "sha512-Xfjwfarhe+LGmoaof+sexeNo3sGRysb5x56WrZLwHtmqT0OilSKtVWkv0lrCcMgSKyKP9oBogBAisHZvtJH0aw==", + "version": "3.5.2", + "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.5.2.tgz", + "integrity": "sha512-WseIA/4o56+GYO3RmlOPvejYi771OFeJEeK/ejROsr9bdjW+E5NXTOD1Di8TL40Qgg3JJX9aa97Hf8iiSVIKZw==", "license": "Apache-2.0", "dependencies": { "cjs-module-lexer": "^2.2.0", - "es-module-lexer": "^2.2.0", + "es-module-lexer": "^3.0.2", "module-details-from-path": "^1.0.4" }, "engines": { "node": ">=18" } }, + "node_modules/import-in-the-middle/node_modules/es-module-lexer": { + "version": "3.0.4", + "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-3.0.4.tgz", + "integrity": "sha512-BldNY5mwkVu+cQ5Ymn3e6hB9Sx8XHx4ZevWbiUyZbfKxJxYO27Hf0wfzkxIaD5CAJMaGl3YspKELj0ff/7nCMA==", + "license": "MIT" + }, "node_modules/imurmurhash": { "version": "0.1.4", "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz", @@ -10300,9 +10402,6 @@ "arm64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MPL-2.0", "optional": true, "os": [ @@ -10324,9 +10423,6 @@ "arm64" ], "dev": true, - "libc": [ - "musl" - ], "license": "MPL-2.0", "optional": true, "os": [ @@ -10348,9 +10444,6 @@ "x64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MPL-2.0", "optional": true, "os": [ @@ -10372,9 +10465,6 @@ "x64" ], "dev": true, - "libc": [ - "musl" - ], "license": "MPL-2.0", "optional": true, "os": [ @@ -11742,12 +11832,12 @@ } }, "node_modules/next": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/next/-/next-16.3.8.tgz", - "integrity": "sha512-U7QEZaTini6wKrb8A8hqLLqYQyCetegKjCpJOyxk642vWoMoU1x5PyZCJFvgYgiptA8xc5j/9xYlZFO7w9Sjmw==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/next/-/next-16.4.1.tgz", + "integrity": "sha512-uc657V62E34fOI6W5NtG9IzwsPcms0Z60grz2MJGtglgD+pTFnNt4Yw2PzaU622tfX4vhrDgLZzicE2YlhI20Q==", "license": "MIT", "dependencies": { - "@next/env": "16.3.8", + "@next/env": "16.4.1", "@swc/helpers": "0.5.23", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", @@ -11761,15 +11851,15 @@ "node": ">=20.9.0" }, "optionalDependencies": { - "@next/swc-darwin-arm64": "16.3.8", - "@next/swc-darwin-x64": "16.3.8", - "@next/swc-linux-arm64-gnu": "16.3.8", - "@next/swc-linux-arm64-musl": "16.3.8", - "@next/swc-linux-x64-gnu": "16.3.8", - "@next/swc-linux-x64-musl": "16.3.8", - "@next/swc-win32-arm64-msvc": "16.3.8", - "@next/swc-win32-x64-msvc": "16.3.8", - "sharp": "^0.35.4" + "@next/swc-darwin-arm64": "16.4.1", + "@next/swc-darwin-x64": "16.4.1", + "@next/swc-linux-arm64-gnu": "16.4.1", + "@next/swc-linux-arm64-musl": "16.4.1", + "@next/swc-linux-x64-gnu": "16.4.1", + "@next/swc-linux-x64-musl": "16.4.1", + "@next/swc-win32-arm64-msvc": "16.4.1", + "@next/swc-win32-x64-msvc": "16.4.1", + "sharp": "^0.35.5" }, "peerDependencies": { "@opentelemetry/api": "^1.1.0", @@ -15336,9 +15426,9 @@ "license": "Unlicense" }, "node_modules/zod": { - "version": "3.25.76", - "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz", - "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==", + "version": "4.6.7", + "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz", + "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==", "license": "MIT", "funding": { "url": "https://github.com/sponsors/colinhacks" @@ -15369,7 +15459,7 @@ }, "packages/codefly-ui": { "name": "@codefly-dev/ui", - "version": "0.12.15", + "version": "0.13.0", "license": "Apache-2.0", "dependencies": { "@base-ui/react": "^1.3.0", @@ -15518,7 +15608,7 @@ }, "packages/saas-ui": { "name": "@codefly-dev/saas-ui", - "version": "0.12.15", + "version": "0.13.0", "license": "Apache-2.0", "dependencies": { "@opentelemetry/api": "1.9.1", @@ -15530,31 +15620,31 @@ "devDependencies": { "@bufbuild/protobuf": "^2.11.0", "@codefly-dev/saas-sdk": "^0.3.35", - "@codefly-dev/ui": "^0.12.0", + "@codefly-dev/ui": "^0.13.0", "@connectrpc/connect": "^2.1.1", "@connectrpc/connect-web": "^2.1.1", - "@hookform/resolvers": "^3.9.0", + "@hookform/resolvers": "^5.9.2", "@tanstack/react-query": "^5.60.0", "@testing-library/react": "^16.1.0", "@types/react": "19.2.17", "happy-dom": "^20.8.9", "react": "^19.2.8", - "react-hook-form": "^7.54.0", + "react-hook-form": "^7.55.0", "typescript": "5.9.3", "vitest": "^3.0.0", - "zod": "^3.24.0" + "zod": "^4.6.6" }, "peerDependencies": { "@bufbuild/protobuf": ">=2", "@codefly-dev/saas-sdk": "^0.3.35", - "@codefly-dev/ui": "^0.12.0", + "@codefly-dev/ui": "^0.13.0", "@connectrpc/connect": ">=2", "@connectrpc/connect-web": ">=2", - "@hookform/resolvers": ">=3", + "@hookform/resolvers": ">=5.1.0", "@tanstack/react-query": ">=5", "react": ">=19.2 <20", - "react-hook-form": ">=7", - "zod": ">=3" + "react-hook-form": ">=7.55.0", + "zod": "^4.6.6" } } } diff --git a/module/services/frontend/code/package.json b/module/services/frontend/code/package.json index f3277d9e8..719e620b9 100644 --- a/module/services/frontend/code/package.json +++ b/module/services/frontend/code/package.json @@ -40,8 +40,8 @@ "@codefly-dev/saas-plugin-contract": "2.4.4", "@codefly-dev/saas-plugin-react": "0.4.5", "@codefly-dev/saas-sdk": "0.3.35", - "@codefly-dev/saas-ui": "0.12.8", - "@codefly-dev/ui": "0.12.8", + "@codefly-dev/saas-ui": "0.13.0", + "@codefly-dev/ui": "0.13.0", "@codefly/saas-plugin-manifest": "0.1.2", "@codefly/saas-settings": "0.1.0", "@connectrpc/connect": "^2.1.1", @@ -52,9 +52,9 @@ "@fontsource/newsreader": "^5.3.0", "@fontsource/roboto": "^5.3.0", "@fontsource/source-serif-4": "^5.3.0", - "@hookform/resolvers": "^3.9.0", + "@hookform/resolvers": "^5.9.2", "@module-federation/runtime": "^2.8.2", - "@sentry/nextjs": "^10.50.0", + "@sentry/nextjs": "10.75.2", "@simplewebauthn/browser": "^13.3.0", "@tanstack/react-query": "^5.60.0", "@tanstack/react-table": "^8.21.3", @@ -62,16 +62,16 @@ "codefly": "https://github.com/codefly-dev/sdk-js/archive/9f3bb78682a0c2b9a70631d35c2ae0094c281ac5.tar.gz", "js-yaml": "^4.3.2", "lucide-react": "^1.8.0", - "next": "^16.2.12", + "next": "16.4.1", "react": "^19.2.8", "react-dom": "^19.2.8", - "react-hook-form": "^7.54.0", + "react-hook-form": "^7.55.0", "server-only": "^0.0.1", "sonner": "^2.0.7", "swagger-ui-react": "^5.32.14", "tailwind-merge": "^3.5.0", "tw-animate-css": "^1.4.0", - "zod": "^3.24.0" + "zod": "^4.6.6" }, "devDependencies": { "@biomejs/biome": "^2.5.4", @@ -88,7 +88,7 @@ "ajv": "^8.17.1", "babel-plugin-react-compiler": "1.0.0", "eslint": "^9.39.5", - "eslint-config-next": "^16.2.12", + "eslint-config-next": "16.4.1", "happy-dom": "^20.8.9", "jsdom": "^29.0.2", "msw": "^2.7.0", diff --git a/module/services/frontend/code/packages/codefly-ui/package.json b/module/services/frontend/code/packages/codefly-ui/package.json index af8fac509..16c35d906 100644 --- a/module/services/frontend/code/packages/codefly-ui/package.json +++ b/module/services/frontend/code/packages/codefly-ui/package.json @@ -1,6 +1,6 @@ { "name": "@codefly-dev/ui", - "version": "0.12.15", + "version": "0.13.0", "description": "The shared, versioned Codefly SaaS frontend kit: the plugin host and the tokens-as-data skin mechanism, standalone so the host and Module-Federation remotes import and dedupe one copy.", "repository": { "type": "git", diff --git a/module/services/frontend/code/packages/saas-ui/README.md b/module/services/frontend/code/packages/saas-ui/README.md index 428c2bcca..529c15a23 100644 --- a/module/services/frontend/code/packages/saas-ui/README.md +++ b/module/services/frontend/code/packages/saas-ui/README.md @@ -583,6 +583,19 @@ elapsed through `Intl.RelativeTimeFormat`, for a consumer's own shell. ## Installing from a solution +Version 0.13 requires Zod `^4.6.6`, `@hookform/resolvers >=5.1.0` and +React Hook Form `>=7.55.0`. The exported source schemas use Zod 4 declarations +and its `check` refinement hook; Zod 3 cannot consume them. Zod 4.6.6 is the +minimum patched release for GHSA-mrhx-c7xc-m3w5. The resolver must understand +Zod 4 errors so invalid form input becomes a field error instead of a thrown +exception. The co-versioned `@codefly-dev/ui` peer is `^0.13.0`. + +The `example-registry-ui` consumer in `scripts/test-registry-ui.mjs` installs +packed packages through a registry fixture, compiles imports of both source +schemas and their inferred value types, and exercises valid, missing-token and +oversized-scope input through the form resolver. Run it from the frontend with +`npm run test:published-ui` after building the workspace packages. + This package is published to GitHub Packages under the org's `@codefly-dev` scope, so a consumer needs that scope routed to the GitHub registry with a read token: diff --git a/module/services/frontend/code/packages/saas-ui/package.json b/module/services/frontend/code/packages/saas-ui/package.json index 89b66f66f..042a71cf1 100644 --- a/module/services/frontend/code/packages/saas-ui/package.json +++ b/module/services/frontend/code/packages/saas-ui/package.json @@ -1,6 +1,6 @@ { "name": "@codefly-dev/saas-ui", - "version": "0.12.15", + "version": "0.13.0", "description": "Reusable SaaS-domain frontend components (datasources, …) the portal and solutions both import, built on @codefly-dev/ui primitives and driven by an injected typed client.", "repository": { "type": "git", @@ -44,29 +44,29 @@ "@codefly-dev/saas-sdk": "^0.3.35", "@connectrpc/connect": ">=2", "@connectrpc/connect-web": ">=2", - "@hookform/resolvers": ">=3", + "@hookform/resolvers": ">=5.1.0", "@tanstack/react-query": ">=5", "react": ">=19.2 <20", - "react-hook-form": ">=7", - "zod": ">=3", - "@codefly-dev/ui": "^0.12.0" + "react-hook-form": ">=7.55.0", + "zod": "^4.6.6", + "@codefly-dev/ui": "^0.13.0" }, "devDependencies": { "@bufbuild/protobuf": "^2.11.0", "@codefly-dev/saas-sdk": "^0.3.35", "@connectrpc/connect": "^2.1.1", "@connectrpc/connect-web": "^2.1.1", - "@hookform/resolvers": "^3.9.0", + "@hookform/resolvers": "^5.9.2", "@tanstack/react-query": "^5.60.0", "@testing-library/react": "^16.1.0", "@types/react": "19.2.17", "happy-dom": "^20.8.9", "react": "^19.2.8", - "react-hook-form": "^7.54.0", + "react-hook-form": "^7.55.0", "typescript": "5.9.3", "vitest": "^3.0.0", - "zod": "^3.24.0", - "@codefly-dev/ui": "^0.12.0" + "zod": "^4.6.6", + "@codefly-dev/ui": "^0.13.0" }, "publishConfig": { "access": "public" diff --git a/module/services/frontend/code/packages/saas-ui/src/datasources/schema.ts b/module/services/frontend/code/packages/saas-ui/src/datasources/schema.ts index ef685af9a..08aaa8c2a 100644 --- a/module/services/frontend/code/packages/saas-ui/src/datasources/schema.ts +++ b/module/services/frontend/code/packages/saas-ui/src/datasources/schema.ts @@ -77,14 +77,16 @@ export const connectGitHubSchema = z accessToken: z.string().max(1024, "Access token too long").optional(), webhookSecret: z.string().max(1024, "Webhook secret too long").optional(), }) - .superRefine((values, ctx) => { + .check((ctx) => { + const values = ctx.value; if ( values.method !== "app" && values.method !== "public" && !values.accessToken ) { - ctx.addIssue({ - code: z.ZodIssueCode.custom, + ctx.issues.push({ + input: values, + code: "custom", path: ["accessToken"], message: "Access token is required", }); diff --git a/module/services/frontend/code/scripts/test-registry-ui.mjs b/module/services/frontend/code/scripts/test-registry-ui.mjs index da913ac49..55d2c4c9e 100644 --- a/module/services/frontend/code/scripts/test-registry-ui.mjs +++ b/module/services/frontend/code/scripts/test-registry-ui.mjs @@ -169,8 +169,28 @@ import { createTaskTracker, mountIsolated } from "@codefly-dev/ui/lifecycle"; import { resolveSkin } from "@codefly-dev/ui/skin"; import { PluginRuntimeProvider, usePluginRuntime } from "@codefly-dev/ui/plugin-host/runtime"; import { PluginRuntimeProvider as DirectProvider, usePluginRuntime as directHook } from "@codefly-dev/saas-plugin-react/runtime"; -import { ConnectGitHubForm } from "@codefly-dev/saas-ui"; +import { ConnectGitHubForm, connectGitHubSchema, editSourceSchema, type ConnectGitHubValues, type EditSourceValues } from "@codefly-dev/saas-ui"; +import { z } from "zod"; +import { zodResolver } from "@hookform/resolvers/zod"; +import type { Resolver } from "react-hook-form"; import { DirectoryService } from "@codefly-dev/saas-sdk"; +const schema: z.ZodType = connectGitHubSchema; +const connection: ConnectGitHubValues = schema.parse({ method: "public", repo: "Acme/example", targetCollection: "example" }); +const scope: EditSourceValues = editSourceSchema.parse({ paths: "docs/", fileExtensions: ".md" }); +if (connection.accessToken !== undefined || scope.paths !== "docs/") throw new Error("Schema output changed"); +const resolveConnection: Resolver = zodResolver(connectGitHubSchema); +const resolveScope: Resolver = zodResolver(editSourceSchema); +async function proveSchemaValidation() { + const options = { fields: {}, shouldUseNativeValidation: false }; + const accepted = await resolveConnection(connection, undefined, options); + if (Object.keys(accepted.errors).length) throw new Error("Public connection rejected"); + const refused = await resolveConnection({ ...connection, method: "pat" }, undefined, options); + if (refused.errors.accessToken?.message !== "Access token is required") throw new Error("Missing token field error"); + const bounded = await resolveScope({ paths: Array.from({ length: 65 }, (_, i) => "path" + i).join(",") }, undefined, options); + if (!bounded.errors.paths) throw new Error("Oversized scope accepted"); + console.log("Registry consumer schema types and form validation passed"); +} +void proveSchemaValidation(); for (const value of [Disclosure, Accordion, Breadcrumb, Tree, RadioGroup, Surface, Timeline, ViewportOverlay, createTaskTracker, mountIsolated, resolveSkin, ConnectGitHubForm, DirectoryService]) { if (!value) throw new Error("Missing public export"); } diff --git a/module/services/frontend/code/src/features/teams/ui/team-form.tsx b/module/services/frontend/code/src/features/teams/ui/team-form.tsx index 5c0ecd08f..0807b5fb5 100644 --- a/module/services/frontend/code/src/features/teams/ui/team-form.tsx +++ b/module/services/frontend/code/src/features/teams/ui/team-form.tsx @@ -37,7 +37,7 @@ export function TeamForm({ error, }: TeamFormProps) { const editing = mode === "edit"; - const form = useForm({ + const form = useForm({ resolver: zodResolver(createTeamSchema), defaultValues: { name: initial?.name ?? "", diff --git a/module/services/marketing/code/package-lock.json b/module/services/marketing/code/package-lock.json index 2bc7701a4..36df53000 100644 --- a/module/services/marketing/code/package-lock.json +++ b/module/services/marketing/code/package-lock.json @@ -8,11 +8,11 @@ "name": "@codefly/marketing", "version": "0.0.1", "dependencies": { - "next": "^16.2.12", + "next": "16.4.1", "react": "^19.2.8", "react-dom": "^19.2.8", "yaml": "^2.8.1", - "zod": "^3.24.0" + "zod": "^4.6.6" }, "devDependencies": { "@types/node": "20.19.39", @@ -586,9 +586,6 @@ "cpu": [ "arm" ], - "libc": [ - "glibc" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -605,9 +602,6 @@ "cpu": [ "arm64" ], - "libc": [ - "glibc" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -624,9 +618,6 @@ "cpu": [ "ppc64" ], - "libc": [ - "glibc" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -643,9 +634,6 @@ "cpu": [ "riscv64" ], - "libc": [ - "glibc" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -662,9 +650,6 @@ "cpu": [ "s390x" ], - "libc": [ - "glibc" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -681,9 +666,6 @@ "cpu": [ "x64" ], - "libc": [ - "glibc" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -700,9 +682,6 @@ "cpu": [ "arm64" ], - "libc": [ - "musl" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -719,9 +698,6 @@ "cpu": [ "x64" ], - "libc": [ - "musl" - ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -738,9 +714,6 @@ "cpu": [ "arm" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -763,9 +736,6 @@ "cpu": [ "arm64" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -788,9 +758,6 @@ "cpu": [ "ppc64" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -813,9 +780,6 @@ "cpu": [ "riscv64" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -838,9 +802,6 @@ "cpu": [ "s390x" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -863,9 +824,6 @@ "cpu": [ "x64" ], - "libc": [ - "glibc" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -888,9 +846,6 @@ "cpu": [ "arm64" ], - "libc": [ - "musl" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -913,9 +868,6 @@ "cpu": [ "x64" ], - "libc": [ - "musl" - ], "license": "Apache-2.0", "optional": true, "os": [ @@ -1024,15 +976,15 @@ } }, "node_modules/@next/env": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/env/-/env-16.3.8.tgz", - "integrity": "sha512-Al9zqHVV7TJv0eFuOU4U7Lvv74PTih4Ch63sk2xCIpSTkE3udFnaOcnzP2lQVymiL7yS9Cj2iClUXlR3EQ5sEw==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/env/-/env-16.4.1.tgz", + "integrity": "sha512-5sUUrrSvs/2/2LnLoesybMGx12EtPB46fdZ6RhAw0XDGSPxU2LFyQBB7yuEiOFFJPKmBY6+q2jTr1/AMbnp0/g==", "license": "MIT" }, "node_modules/@next/swc-darwin-arm64": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.3.8.tgz", - "integrity": "sha512-2JPRMh2nmQG5CiL7cXGL9AGwnPWJQ//cTtAUCT+w511QHk79SYz3LGv/pc5X643B/WEO0rvu3Yww0hqwt3kgeA==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.4.1.tgz", + "integrity": "sha512-U+hQ5Gj3fpzf4fveTIF3dpUFYhaSW8vHhdAnbiIomzXzg7boreYFgBqprepXFtW4sw+aTttiNmg0gew/iFNhbg==", "cpu": [ "arm64" ], @@ -1046,9 +998,9 @@ } }, "node_modules/@next/swc-darwin-x64": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.3.8.tgz", - "integrity": "sha512-GZtCCOBKJ4leVIT/Th0llWKhD1ca92lzbQiS5R5ON9QkoiFnilFsebDae1JU2a3HWoKMEmEZWGs1AGLavVM72Q==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.4.1.tgz", + "integrity": "sha512-/hqC3V1XLUjhMASf/WridKdO9FXoEgN3HBWmtKbj00MPgnltutfraWJ3bYTpCRIgEIpbjJyOVLpYgAhh/BkdcQ==", "cpu": [ "x64" ], @@ -1062,15 +1014,12 @@ } }, "node_modules/@next/swc-linux-arm64-gnu": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.3.8.tgz", - "integrity": "sha512-O659ygeQYqneJ1fBKMpFxIFqYkYswu8IAS1OCKK/4f3ZgJJm1dRz4fVJZRi/kLLWjnBKnebOePA4WNv+sV1pVA==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.4.1.tgz", + "integrity": "sha512-GHzncHbcaS9g95kcvTNtKQW3aCLoR+xc3Jm7qrkpk1R+D2BjMHIPyvQGRPKCdMX95BsH/421jBUK06q9tEwzjw==", "cpu": [ "arm64" ], - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -1081,15 +1030,12 @@ } }, "node_modules/@next/swc-linux-arm64-musl": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.3.8.tgz", - "integrity": "sha512-dSjKSyWpzxoO1d3DIZZcP4XJcNaKeLmxQMFOiYl5vuBRMmweIqnAhty8tAmRsvTss779cK1FtYnDMj40e4TQlg==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.4.1.tgz", + "integrity": "sha512-1SuJyDxW/PR9dHJat/ZRgcYLhuSZ+1psP4DlKb2tKIuXbjygqpLrJWRSq+onZQBv8LcmU67EIrmb6c3XTaJLjw==", "cpu": [ "arm64" ], - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -1100,15 +1046,12 @@ } }, "node_modules/@next/swc-linux-x64-gnu": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.3.8.tgz", - "integrity": "sha512-lbqOuz3RPRcv+o9msNsJw5x4+Y1ZwPTs6vmL6DCf7i0fZfvng/F59wyeDwqHIvV0mK//RBy/jJkZ+nCKsSMXjQ==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.4.1.tgz", + "integrity": "sha512-Istng1hMGp9TGO4lUqeKLd70MPN/OOkucVTP2Nmj+gLkwBgmPqUw8CJYBCC7nbl/B/23bBCcjCI5Hsh6hazC1A==", "cpu": [ "x64" ], - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -1119,15 +1062,12 @@ } }, "node_modules/@next/swc-linux-x64-musl": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.3.8.tgz", - "integrity": "sha512-+316WswI8ScVgZeUd+1KGaXkHhaYQzCjvH/05TZSpJ8zBizb1a4G7DtO7F12jcBIqMOtsz9ji1t48fmKtzqsGA==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.4.1.tgz", + "integrity": "sha512-aSC9wMNiZRRFVpPkPWBzRwLQxIGm/CiQcXyFF1XNcgodb+uMxdk7aSSGGpDXCbnvZdf4itjHxpOd5h7i7zaiYw==", "cpu": [ "x64" ], - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -1138,9 +1078,9 @@ } }, "node_modules/@next/swc-win32-arm64-msvc": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.3.8.tgz", - "integrity": "sha512-ji0gd4kMYUxO+1fJBIbiBVRCjzG/lloiyCccnlebvb1ZJ5qXCPZqYg4Jl1DrrixnWNMKylzgpmMWx0yNDYXlzw==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.4.1.tgz", + "integrity": "sha512-t/myvwFDlypMUjRvbBf8qLPyuaB0iXYYdBtwMt6DM6f+60wtGr4bSYholdPqNeV5VUXZhrpMwfza829kmhS3iA==", "cpu": [ "arm64" ], @@ -1154,9 +1094,9 @@ } }, "node_modules/@next/swc-win32-x64-msvc": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.3.8.tgz", - "integrity": "sha512-WcTlaKt/TWkh5kUjdJcUmB1XgZ+1c6fz4Y9fDHL73YNSdGaUWjceeWrrlwF0nv19iABYWC4iAq1oX1w4Bn0vfg==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.4.1.tgz", + "integrity": "sha512-6ICqPo9awCkrtYNPhwkx1uU7rlFWrZRrIboDHS2LU+jv088UBYQtmJ25h6pCp27/+FZjF6BQ4Te4ErugyMeuBg==", "cpu": [ "x64" ], @@ -1339,12 +1279,12 @@ } }, "node_modules/next": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/next/-/next-16.3.8.tgz", - "integrity": "sha512-U7QEZaTini6wKrb8A8hqLLqYQyCetegKjCpJOyxk642vWoMoU1x5PyZCJFvgYgiptA8xc5j/9xYlZFO7w9Sjmw==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/next/-/next-16.4.1.tgz", + "integrity": "sha512-uc657V62E34fOI6W5NtG9IzwsPcms0Z60grz2MJGtglgD+pTFnNt4Yw2PzaU622tfX4vhrDgLZzicE2YlhI20Q==", "license": "MIT", "dependencies": { - "@next/env": "16.3.8", + "@next/env": "16.4.1", "@swc/helpers": "0.5.23", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", @@ -1358,15 +1298,15 @@ "node": ">=20.9.0" }, "optionalDependencies": { - "@next/swc-darwin-arm64": "16.3.8", - "@next/swc-darwin-x64": "16.3.8", - "@next/swc-linux-arm64-gnu": "16.3.8", - "@next/swc-linux-arm64-musl": "16.3.8", - "@next/swc-linux-x64-gnu": "16.3.8", - "@next/swc-linux-x64-musl": "16.3.8", - "@next/swc-win32-arm64-msvc": "16.3.8", - "@next/swc-win32-x64-msvc": "16.3.8", - "sharp": "^0.35.4" + "@next/swc-darwin-arm64": "16.4.1", + "@next/swc-darwin-x64": "16.4.1", + "@next/swc-linux-arm64-gnu": "16.4.1", + "@next/swc-linux-arm64-musl": "16.4.1", + "@next/swc-linux-x64-gnu": "16.4.1", + "@next/swc-linux-x64-musl": "16.4.1", + "@next/swc-win32-arm64-msvc": "16.4.1", + "@next/swc-win32-x64-msvc": "16.4.1", + "sharp": "^0.35.5" }, "peerDependencies": { "@opentelemetry/api": "^1.1.0", @@ -1609,9 +1549,9 @@ } }, "node_modules/zod": { - "version": "3.25.76", - "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz", - "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==", + "version": "4.6.7", + "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz", + "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==", "license": "MIT", "funding": { "url": "https://github.com/sponsors/colinhacks" diff --git a/module/services/marketing/code/package.json b/module/services/marketing/code/package.json index c15dbbc38..a5a0b456e 100644 --- a/module/services/marketing/code/package.json +++ b/module/services/marketing/code/package.json @@ -18,11 +18,11 @@ "test:smoke": "node scripts/smoke.mjs" }, "dependencies": { - "next": "^16.2.12", + "next": "16.4.1", "react": "^19.2.8", "react-dom": "^19.2.8", "yaml": "^2.8.1", - "zod": "^3.24.0" + "zod": "^4.6.6" }, "devDependencies": { "@types/node": "20.19.39", diff --git a/module/services/marketing/code/src/config/environment.ts b/module/services/marketing/code/src/config/environment.ts index dedb59c30..65578b34f 100644 --- a/module/services/marketing/code/src/config/environment.ts +++ b/module/services/marketing/code/src/config/environment.ts @@ -1,6 +1,7 @@ import { z } from "zod"; -const localOrHTTPSURL = z.string().url().superRefine((value, context) => { +const localOrHTTPSURL = z.string().url().check((context) => { + const value = context.value; const url = new URL(value); if ( url.username || @@ -10,8 +11,9 @@ const localOrHTTPSURL = z.string().url().superRefine((value, context) => { !url.hostname.endsWith(".localhost") && !url.hostname.endsWith(".svc.cluster.local")) ) { - context.addIssue({ - code: z.ZodIssueCode.custom, + context.issues.push({ + input: value, + code: "custom", message: "must be HTTPS outside localhost or an in-cluster service", }); } diff --git a/module/services/marketing/code/tests/catalog.test.ts b/module/services/marketing/code/tests/catalog.test.ts index 329cd97e6..885465a56 100644 --- a/module/services/marketing/code/tests/catalog.test.ts +++ b/module/services/marketing/code/tests/catalog.test.ts @@ -80,7 +80,7 @@ test("rejects checkout secrets and unsupported intervals", () => { revision: "catalog-v1", plans: [{ ...plan, interval: "quarter" }], }), - /invalid enum/i, + /invalid option/i, ); }); From 76edb5d12f29f5e52b6e5073a15d14c7e95b33f9 Mon Sep 17 00:00:00 2001 From: saurabhmaheshwari-obin <242053479+saurabhmaheshwari-obin@users.noreply.github.com> Date: Sat, 24 Oct 2026 13:56:34 -0400 Subject: [PATCH 3/5] fix(deps): take main's lockfiles for the ported versions, which keep libc Regenerating the lockfiles with an older npm dropped every libc field, so npm ci on glibc would also install the musl binaries. Apart from those fields the files equal main's at f3fee4c06. Co-Authored-By: Claude Opus 5.5 --- .../services/frontend/code/package-lock.json | 168 ++++++++++++++++++ .../services/marketing/code/package-lock.json | 60 +++++++ 2 files changed, 228 insertions(+) diff --git a/module/services/frontend/code/package-lock.json b/module/services/frontend/code/package-lock.json index c706b055c..cb7822b6c 100644 --- a/module/services/frontend/code/package-lock.json +++ b/module/services/frontend/code/package-lock.json @@ -519,6 +519,9 @@ "arm64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT OR Apache-2.0", "optional": true, "os": [ @@ -536,6 +539,9 @@ "arm64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT OR Apache-2.0", "optional": true, "os": [ @@ -553,6 +559,9 @@ "x64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT OR Apache-2.0", "optional": true, "os": [ @@ -570,6 +579,9 @@ "x64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT OR Apache-2.0", "optional": true, "os": [ @@ -1978,6 +1990,9 @@ "cpu": [ "arm" ], + "libc": [ + "glibc" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -1994,6 +2009,9 @@ "cpu": [ "arm64" ], + "libc": [ + "glibc" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -2010,6 +2028,9 @@ "cpu": [ "ppc64" ], + "libc": [ + "glibc" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -2026,6 +2047,9 @@ "cpu": [ "riscv64" ], + "libc": [ + "glibc" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -2042,6 +2066,9 @@ "cpu": [ "s390x" ], + "libc": [ + "glibc" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -2058,6 +2085,9 @@ "cpu": [ "x64" ], + "libc": [ + "glibc" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -2074,6 +2104,9 @@ "cpu": [ "arm64" ], + "libc": [ + "musl" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -2090,6 +2123,9 @@ "cpu": [ "x64" ], + "libc": [ + "musl" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -2106,6 +2142,9 @@ "cpu": [ "arm" ], + "libc": [ + "glibc" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2128,6 +2167,9 @@ "cpu": [ "arm64" ], + "libc": [ + "glibc" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2150,6 +2192,9 @@ "cpu": [ "ppc64" ], + "libc": [ + "glibc" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2172,6 +2217,9 @@ "cpu": [ "riscv64" ], + "libc": [ + "glibc" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2194,6 +2242,9 @@ "cpu": [ "s390x" ], + "libc": [ + "glibc" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2216,6 +2267,9 @@ "cpu": [ "x64" ], + "libc": [ + "glibc" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2238,6 +2292,9 @@ "cpu": [ "arm64" ], + "libc": [ + "musl" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2260,6 +2317,9 @@ "cpu": [ "x64" ], + "libc": [ + "musl" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -2575,6 +2635,9 @@ "cpu": [ "x64" ], + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -2694,6 +2757,9 @@ "cpu": [ "arm64" ], + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -2710,6 +2776,9 @@ "cpu": [ "arm64" ], + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -2726,6 +2795,9 @@ "cpu": [ "x64" ], + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -2742,6 +2814,9 @@ "cpu": [ "x64" ], + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -3245,6 +3320,9 @@ "cpu": [ "arm" ], + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -3258,6 +3336,9 @@ "cpu": [ "arm" ], + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -3271,6 +3352,9 @@ "cpu": [ "arm64" ], + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -3284,6 +3368,9 @@ "cpu": [ "arm64" ], + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -3297,6 +3384,9 @@ "cpu": [ "loong64" ], + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -3310,6 +3400,9 @@ "cpu": [ "loong64" ], + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -3323,6 +3416,9 @@ "cpu": [ "ppc64" ], + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -3336,6 +3432,9 @@ "cpu": [ "ppc64" ], + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -3349,6 +3448,9 @@ "cpu": [ "riscv64" ], + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -3362,6 +3464,9 @@ "cpu": [ "riscv64" ], + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -3375,6 +3480,9 @@ "cpu": [ "s390x" ], + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -3388,6 +3496,9 @@ "cpu": [ "x64" ], + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -3401,6 +3512,9 @@ "cpu": [ "x64" ], + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -4978,6 +5092,9 @@ "arm64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -4995,6 +5112,9 @@ "arm64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -5012,6 +5132,9 @@ "x64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -5029,6 +5152,9 @@ "x64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -5975,6 +6101,9 @@ "arm64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -5989,6 +6118,9 @@ "arm64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -6003,6 +6135,9 @@ "loong64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -6017,6 +6152,9 @@ "loong64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -6031,6 +6169,9 @@ "ppc64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -6045,6 +6186,9 @@ "riscv64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -6059,6 +6203,9 @@ "riscv64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -6073,6 +6220,9 @@ "s390x" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -6087,6 +6237,9 @@ "x64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -6101,6 +6254,9 @@ "x64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -10402,6 +10558,9 @@ "arm64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MPL-2.0", "optional": true, "os": [ @@ -10423,6 +10582,9 @@ "arm64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MPL-2.0", "optional": true, "os": [ @@ -10444,6 +10606,9 @@ "x64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MPL-2.0", "optional": true, "os": [ @@ -10465,6 +10630,9 @@ "x64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MPL-2.0", "optional": true, "os": [ diff --git a/module/services/marketing/code/package-lock.json b/module/services/marketing/code/package-lock.json index 36df53000..3a7a728b0 100644 --- a/module/services/marketing/code/package-lock.json +++ b/module/services/marketing/code/package-lock.json @@ -586,6 +586,9 @@ "cpu": [ "arm" ], + "libc": [ + "glibc" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -602,6 +605,9 @@ "cpu": [ "arm64" ], + "libc": [ + "glibc" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -618,6 +624,9 @@ "cpu": [ "ppc64" ], + "libc": [ + "glibc" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -634,6 +643,9 @@ "cpu": [ "riscv64" ], + "libc": [ + "glibc" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -650,6 +662,9 @@ "cpu": [ "s390x" ], + "libc": [ + "glibc" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -666,6 +681,9 @@ "cpu": [ "x64" ], + "libc": [ + "glibc" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -682,6 +700,9 @@ "cpu": [ "arm64" ], + "libc": [ + "musl" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -698,6 +719,9 @@ "cpu": [ "x64" ], + "libc": [ + "musl" + ], "license": "LGPL-3.0-or-later", "optional": true, "os": [ @@ -714,6 +738,9 @@ "cpu": [ "arm" ], + "libc": [ + "glibc" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -736,6 +763,9 @@ "cpu": [ "arm64" ], + "libc": [ + "glibc" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -758,6 +788,9 @@ "cpu": [ "ppc64" ], + "libc": [ + "glibc" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -780,6 +813,9 @@ "cpu": [ "riscv64" ], + "libc": [ + "glibc" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -802,6 +838,9 @@ "cpu": [ "s390x" ], + "libc": [ + "glibc" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -824,6 +863,9 @@ "cpu": [ "x64" ], + "libc": [ + "glibc" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -846,6 +888,9 @@ "cpu": [ "arm64" ], + "libc": [ + "musl" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -868,6 +913,9 @@ "cpu": [ "x64" ], + "libc": [ + "musl" + ], "license": "Apache-2.0", "optional": true, "os": [ @@ -1020,6 +1068,9 @@ "cpu": [ "arm64" ], + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -1036,6 +1087,9 @@ "cpu": [ "arm64" ], + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -1052,6 +1106,9 @@ "cpu": [ "x64" ], + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -1068,6 +1125,9 @@ "cpu": [ "x64" ], + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ From 5a2c45ffbe715f39c6b1bb3c4cf6a6a3969c372c Mon Sep 17 00:00:00 2001 From: saurabhmaheshwari-obin <242053479+saurabhmaheshwari-obin@users.noreply.github.com> Date: Sat, 24 Oct 2026 13:56:34 -0400 Subject: [PATCH 4/5] ci: check pull requests into release/** and announce only tags on main A patch line cut from a deploy-counter tag lives on a release/** branch, and a pull request into it ran no checks because pull_request was scoped to main. release/** now gets the same checks. merge_group carries no branch filter and is unchanged. handbook-surface-bump makes the tagged interface current downstream. A tag push names a commit, not a branch, so the branch a tag was cut from is not in the event and github.ref cannot tell a main tag from a patch-line tag. The job now fetches main and dispatches only when the tagged commit is an ancestor of it (git merge-base --is-ancestor). A tag cut from a release/** branch still runs every release gate and publishes its artifacts; it is just not announced as current, since it lacks whatever main released after its base. main's next tag carries the announcement. A tag moved onto main later is announced by its next run, so the guard can only delay an announcement, never make a wrong one. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 63f5d2f1b..f361b6742 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,7 +7,10 @@ on: # immutable-package release track keyed to module.package.codefly.yaml. tags: ["v*", "module-package/v*"] pull_request: - branches: [main] + # release/** carries a patch line cut from a deploy-counter tag: a pull + # request into one gets the same checks as one into main, or it would merge + # with none. + branches: [main, "release/**"] # The merge queue builds each entry as `main + the PR` and reports the # required checks from THAT ref, which is the guarantee "require branches to # be up to date" was buying by making every author rebase by hand. Every @@ -1398,10 +1401,30 @@ jobs: timeout-minutes: 5 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + # A tag push names a commit, not a branch, so the branch a tag was cut + # from is not in the event. What decides "current" is whether main + # contains the tagged commit: a tag cut from a release/** patch line is + # not on main, and announcing it would make an interface current that + # lacks whatever main released since. Such a tag still passes every gate + # above; only the announcement waits for main's next tag. + - name: Check the tagged commit is on main + id: on-main + run: | + git fetch --no-tags origin main + if git merge-base --is-ancestor "${GITHUB_SHA}" FETCH_HEAD; then + echo "announce=true" >> "${GITHUB_OUTPUT}" + else + echo "::notice::${GITHUB_REF_NAME} is not on main; the release is not announced." + echo "announce=false" >> "${GITHUB_OUTPUT}" + fi - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + if: steps.on-main.outputs.announce == 'true' with: node-version: 24 - name: Dispatch surface-bump + if: steps.on-main.outputs.announce == 'true' env: HANDBOOK_REPOSITORY: ${{ vars.HANDBOOK_REPOSITORY }} GH_TOKEN: ${{ secrets.HANDBOOK_DISPATCH_TOKEN }} From e8a8920cb65ffc2b85970786dbdc3a793d4bd6a2 Mon Sep 17 00:00:00 2001 From: saurabhmaheshwari-obin <242053479+saurabhmaheshwari-obin@users.noreply.github.com> Date: Sat, 24 Oct 2026 13:56:35 -0400 Subject: [PATCH 5/5] ci: compare a patch line against its own base, and fail the announce guard on git errors Three review fixes to the release/** patch-line support: - The authorization no-broadening gate diffed every pull request against main. A pull request into a release/** line now diffs against the branch it merges into (github.event.pull_request.base.ref); a pull request into main fetches and diffs main exactly as before. - The announce guard read every non-zero exit of git merge-base --is-ancestor as "not on main". Exit 1 still means that; any other exit (a missing object, a failed fetch) now fails the step instead of skipping the announcement. - The protobuf breaking-change gate on a tag compared against main as it stands. A tag whose commit is not on main now compares against git merge-base HEAD origin/main. That merge base is where the line forked, which is the release the line patches: comparing against main would report every message main gained since as a deletion, and comparing against the previous tag on the line would depend on tag naming and still reach the fork point for the line's first tag. It needs only the history the job already fetches. A tag on main, a merge ref and every other event keep their baseline, and the ancestry check fails the step on a git error, as above. RELEASE_GATES.md says so: a paragraph on patch lines in the cadence section (pull requests into release/** are checked, tags on a line pass every gate and publish, only tags on main announce, baseline gates compare against the line's base) and one in the surface-bump section on the announce guard. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 47 ++++++++++++++++++++++++++++++++-------- RELEASE_GATES.md | 21 ++++++++++++++++++ 2 files changed, 59 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f361b6742..e1f568bc6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -239,13 +239,18 @@ jobs: # Renders to "false" when the label is absent; the gate requires an # affirmative token, so only the label opens the escape hatch. AUTHZ_ALLOW_BROADENING: ${{ contains(github.event.pull_request.labels.*.name, 'authz-broadening-approved') }} + # The branch the pull request merges into: main, or a release/** patch + # line. Diffing a patch line's pull request against main would report + # everything main gained since the line was cut, or hide a broadening + # main already carries. Outside a pull request it is main, as before. + BASE_REF: ${{ github.event.pull_request.base.ref || 'main' }} run: | - git fetch --no-tags origin refs/heads/main:refs/remotes/origin/main + git fetch --no-tags origin "refs/heads/${BASE_REF}:refs/remotes/origin/${BASE_REF}" base="$(mktemp)" - if git show origin/main:module/services/accounts/generated/authz-methods.json > "${base}" 2>/dev/null; then + if git show "origin/${BASE_REF}:module/services/accounts/generated/authz-methods.json" > "${base}" 2>/dev/null; then node module/tools/authz-coverage-gate.mjs no-broadening --base "${base}" else - echo "no authorization catalog on main yet; nothing to diff" + echo "no authorization catalog on ${BASE_REF} yet; nothing to diff" fi - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: @@ -520,12 +525,26 @@ jobs: # contract once a concurrent change lands is caught where it has to # be: the merge queue builds main + the PR afresh, so there HEAD^1 IS # current main. + # + # A tag whose commit is not on main was cut from a release/** patch + # line. Its baseline is the line's base, where it forked from main + # (the release it patches), not main as it stands: main may have + # gained messages since, which the line lacks and would report as + # deletions. Every tag on main, and every other event, keeps main. if git rev-parse --verify -q HEAD^2 >/dev/null; then baseline_rev="HEAD^1" else git fetch --no-tags origin \ refs/heads/main:refs/remotes/origin/main baseline_rev="origin/main" + if [[ "${GITHUB_REF}" == refs/tags/* ]]; then + if git merge-base --is-ancestor HEAD origin/main; then on_main=0; else on_main=$?; fi + case "${on_main}" in + 0) ;; + 1) baseline_rev="$(git merge-base HEAD origin/main)" ;; + *) echo "::error::cannot tell whether ${GITHUB_REF_NAME} is on main (git exit ${on_main})"; exit 1 ;; + esac + fi fi echo "proto baseline: ${baseline_rev} ($(git rev-parse --short "${baseline_rev}"))" git archive "${baseline_rev}" module/services/accounts/proto | tar -x -C "${baseline}" @@ -1413,12 +1432,22 @@ jobs: id: on-main run: | git fetch --no-tags origin main - if git merge-base --is-ancestor "${GITHUB_SHA}" FETCH_HEAD; then - echo "announce=true" >> "${GITHUB_OUTPUT}" - else - echo "::notice::${GITHUB_REF_NAME} is not on main; the release is not announced." - echo "announce=false" >> "${GITHUB_OUTPUT}" - fi + # 1 is "not an ancestor"; anything else is git failing to answer, + # which must fail the step rather than read as "not on main". + if git merge-base --is-ancestor "${GITHUB_SHA}" FETCH_HEAD; then on_main=0; else on_main=$?; fi + case "${on_main}" in + 0) + echo "announce=true" >> "${GITHUB_OUTPUT}" + ;; + 1) + echo "::notice::${GITHUB_REF_NAME} is not on main; the release is not announced." + echo "announce=false" >> "${GITHUB_OUTPUT}" + ;; + *) + echo "::error::cannot tell whether ${GITHUB_REF_NAME} is on main (git exit ${on_main})" + exit 1 + ;; + esac - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 if: steps.on-main.outputs.announce == 'true' with: diff --git a/RELEASE_GATES.md b/RELEASE_GATES.md index 77740124f..7c2544774 100644 --- a/RELEASE_GATES.md +++ b/RELEASE_GATES.md @@ -148,6 +148,15 @@ With both present, a dispatch the handbook rejects still fails the job. including that an unconfigured run dispatches nothing at all — and runs in `release-contract`. +Only a tag on `main` is announced. A tag push names a commit, not a branch, so +`handbook-surface-bump` first asks whether `main` contains the tagged commit +(`git merge-base --is-ancestor`). A tag cut from a `release/**` patch line is +not on `main`: it passes every gate and publishes every artifact, but it is not +announced as current, because it lacks whatever `main` released after the line +was cut. `main`'s next tag carries the announcement. Exit 1 of that check is +"not on main"; any other failure fails the job rather than skipping the +announcement silently. + ### The contract test `release-contract` runs `scripts/ci/release-gates.mjs check`, which parses every @@ -795,6 +804,18 @@ To cut a deploy-counter tag: 2. Commit it as `release: v0.0.N`. 3. Tag that commit with an annotated `v0.0.N` tag and push the tag. +**Patch lines.** A fix for a deployment pinned to an older deploy-counter tag +goes on a `release/**` branch cut from that tag, through a pull request into +it; pull requests into `release/**` get the same checks as pull requests into +`main`. A tag on the line passes every release gate and publishes its artifacts +like a tag on `main`, with two differences. It is not announced as current +(only a tag on `main` is; see `handbook-surface-bump` above). And the gates that +compare against a baseline compare against the line's base, not against `main` +as it stands: the authorization no-broadening check diffs a pull request +against the branch it merges into, and the protobuf breaking-change check on a +tag that is not on `main` compares against its merge base with `main`, the +release the line patches. + To cut an immutable module-package release: 1. Bump `version:` in `module/module.package.codefly.yaml`.