From 5f314e44f8ead8f6de95407bfaf3deefb03cec7e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Rzepecki?= Date: Mon, 17 Aug 2026 11:18:23 +0200 Subject: [PATCH 01/11] chore(deps): bump body-parser to 2.3.0 Fixes GHSA-v422-hmwv-36x6 (denial of service when an invalid limit value silently disables size enforcement). Pulled in transitively by express 5.2.1, whose `^2.2.1` range already admits the fix, so only the lockfile changes. Assisted-by: Claude:claude-opus-5[1m] --- yarn.lock | 67 ++++++++++++++++++++++++++++--------------------------- 1 file changed, 34 insertions(+), 33 deletions(-) diff --git a/yarn.lock b/yarn.lock index d3c7274..57f4840 100644 --- a/yarn.lock +++ b/yarn.lock @@ -4250,19 +4250,19 @@ __metadata: linkType: hard "body-parser@npm:^2.2.1": - version: 2.2.2 - resolution: "body-parser@npm:2.2.2" + version: 2.3.0 + resolution: "body-parser@npm:2.3.0" dependencies: bytes: "npm:^3.1.2" - content-type: "npm:^1.0.5" + content-type: "npm:^2.0.0" debug: "npm:^4.4.3" - http-errors: "npm:^2.0.0" - iconv-lite: "npm:^0.7.0" + http-errors: "npm:^2.0.1" + iconv-lite: "npm:^0.7.2" on-finished: "npm:^2.4.1" - qs: "npm:^6.14.1" - raw-body: "npm:^3.0.1" - type-is: "npm:^2.0.1" - checksum: 10/69671f67d4d5ae5974593901a92d639757231da1725ed6de4d35e86cde9ce7650afdf1cd28df9b6f7892ea7f9eb03ccb30c70fe27d679275ae4cb4aae5ce1b21 + qs: "npm:^6.15.2" + raw-body: "npm:^3.0.2" + type-is: "npm:^2.1.0" + checksum: 10/94f741ff525358dd0d47f0a042936dc61b9d2e348ff1228c5ffd79f1902c673a317bbb9495b3f7d1db4483befe6ffed1c42bc4cdd8da8f41690530810cfe4dad languageName: node linkType: hard @@ -6730,7 +6730,7 @@ __metadata: languageName: node linkType: hard -"iconv-lite@npm:^0.7.0, iconv-lite@npm:^0.7.2, iconv-lite@npm:~0.7.0": +"iconv-lite@npm:^0.7.2, iconv-lite@npm:~0.7.0": version: 0.7.3 resolution: "iconv-lite@npm:0.7.3" dependencies: @@ -9291,7 +9291,7 @@ __metadata: languageName: node linkType: hard -"object-inspect@npm:^1.13.3": +"object-inspect@npm:^1.13.3, object-inspect@npm:^1.13.4": version: 1.13.4 resolution: "object-inspect@npm:1.13.4" checksum: 10/aa13b1190ad3e366f6c83ad8a16ed37a19ed57d267385aa4bfdccda833d7b90465c057ff6c55d035a6b2e52c1a2295582b294217a0a3a1ae7abdd6877ef781fb @@ -10219,12 +10219,13 @@ __metadata: languageName: node linkType: hard -"qs@npm:^6.14.0, qs@npm:^6.14.1": - version: 6.15.2 - resolution: "qs@npm:6.15.2" +"qs@npm:^6.14.0, qs@npm:^6.15.2": + version: 6.15.3 + resolution: "qs@npm:6.15.3" dependencies: - side-channel: "npm:^1.1.0" - checksum: 10/7a934b2dba40654cf9878dab7c1e7ad56c6186265509727fbece67dadc38fd5d67715b61b6ef938e5a0475faeee701d18ec0a7ce420ad64367caad7f1bdb66e2 + es-define-property: "npm:^1.0.1" + side-channel: "npm:^1.1.1" + checksum: 10/1cbb4b050872a19ba8a311445be29babb8f66ea5d6462b3c48c6efb2c95187cd286b69734cd4caea1878cca3b9d1f0e9b49335336be9e999a7d8d7cf137ba60d languageName: node linkType: hard @@ -10251,7 +10252,7 @@ __metadata: languageName: node linkType: hard -"raw-body@npm:^3.0.1": +"raw-body@npm:^3.0.2": version: 3.0.2 resolution: "raw-body@npm:3.0.2" dependencies: @@ -10900,13 +10901,13 @@ __metadata: languageName: node linkType: hard -"side-channel-list@npm:^1.0.0": - version: 1.0.0 - resolution: "side-channel-list@npm:1.0.0" +"side-channel-list@npm:^1.0.1": + version: 1.0.1 + resolution: "side-channel-list@npm:1.0.1" dependencies: es-errors: "npm:^1.3.0" - object-inspect: "npm:^1.13.3" - checksum: 10/603b928997abd21c5a5f02ae6b9cc36b72e3176ad6827fab0417ead74580cc4fb4d5c7d0a8a2ff4ead34d0f9e35701ed7a41853dac8a6d1a664fcce1a044f86f + object-inspect: "npm:^1.13.4" + checksum: 10/3499671cd52adaee739eac1e14d07530b8e3530192741aeb05e7fe4ad1b51d1368ceea2cd3c21b0f62b05410a5c70a7c4d997ba4b143303ef73d0c65dfd1c252 languageName: node linkType: hard @@ -10935,16 +10936,16 @@ __metadata: languageName: node linkType: hard -"side-channel@npm:^1.1.0": - version: 1.1.0 - resolution: "side-channel@npm:1.1.0" +"side-channel@npm:^1.1.1": + version: 1.1.1 + resolution: "side-channel@npm:1.1.1" dependencies: es-errors: "npm:^1.3.0" - object-inspect: "npm:^1.13.3" - side-channel-list: "npm:^1.0.0" + object-inspect: "npm:^1.13.4" + side-channel-list: "npm:^1.0.1" side-channel-map: "npm:^1.0.1" side-channel-weakmap: "npm:^1.0.2" - checksum: 10/7d53b9db292c6262f326b6ff3bc1611db84ece36c2c7dc0e937954c13c73185b0406c56589e2bb8d071d6fee468e14c39fb5d203ee39be66b7b8174f179afaba + checksum: 10/5fa6393ff6ad25d8b4a38e9ba095481e498c8ebe5ab78481c1455146255a3d18ca37a6f936595cc671a6149134cdc295bbd2fa017620bdc73cbc7380634fa2fc languageName: node linkType: hard @@ -11949,14 +11950,14 @@ __metadata: languageName: node linkType: hard -"type-is@npm:^2.0.1": - version: 2.0.1 - resolution: "type-is@npm:2.0.1" +"type-is@npm:^2.0.1, type-is@npm:^2.1.0": + version: 2.1.0 + resolution: "type-is@npm:2.1.0" dependencies: - content-type: "npm:^1.0.5" + content-type: "npm:^2.0.0" media-typer: "npm:^1.1.0" mime-types: "npm:^3.0.0" - checksum: 10/bacdb23c872dacb7bd40fbd9095e6b2fca2895eedbb689160c05534d7d4810a7f4b3fd1ae87e96133c505958f6d602967a68db5ff577b85dd6be76eaa75d58af + checksum: 10/f011885fefb6c6882f36fab89cc596596b96eab1d208a3774628537cad7ce1f91232a6d758115e1a6ed03f0f8c21e9654bb6d280a5c6827ff72a35f6df0fa182 languageName: node linkType: hard From 1986b65b834ef711a743341f1d43a681be91624d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Rzepecki?= Date: Mon, 17 Aug 2026 11:19:58 +0200 Subject: [PATCH 02/11] chore(deps): bump vitest to 3.2.7 in test/vitest3 Fixes GHSA-5xrq-8626-4rwp (critical: arbitrary file read and execution while the Vitest UI server is listening), fixed in 3.2.6. Raise the declared range from `^3.0.0` to `^3.2.6` so the security floor is recorded in the manifest rather than only in the lockfile; the workspace still exercises the vitest v3 line as intended. Assisted-by: Claude:claude-opus-5[1m] --- test/vitest3/package.json | 2 +- yarn.lock | 98 +++++++++++++++++++-------------------- 2 files changed, 50 insertions(+), 50 deletions(-) diff --git a/test/vitest3/package.json b/test/vitest3/package.json index c240eb0..afca23b 100644 --- a/test/vitest3/package.json +++ b/test/vitest3/package.json @@ -2,7 +2,7 @@ "name": "vitest3-appmap-node-test", "packageManager": "yarn@4.13.0", "dependencies": { - "vitest": "^3.0.0" + "vitest": "^3.2.6" }, "private": true } diff --git a/yarn.lock b/yarn.lock index 57f4840..a8bc075 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3403,16 +3403,16 @@ __metadata: languageName: node linkType: hard -"@vitest/expect@npm:3.2.4": - version: 3.2.4 - resolution: "@vitest/expect@npm:3.2.4" +"@vitest/expect@npm:3.2.7": + version: 3.2.7 + resolution: "@vitest/expect@npm:3.2.7" dependencies: "@types/chai": "npm:^5.2.2" - "@vitest/spy": "npm:3.2.4" - "@vitest/utils": "npm:3.2.4" + "@vitest/spy": "npm:3.2.7" + "@vitest/utils": "npm:3.2.7" chai: "npm:^5.2.0" tinyrainbow: "npm:^2.0.0" - checksum: 10/dc69ce886c13714dfbbff78f2d2cb7eb536017e82301a73c42d573a9e9d2bf91005ac7abd9b977adf0a3bd431209f45a8ac2418029b68b0a377e092607c843ce + checksum: 10/2621cf1e90880b6c35de0aebc4a429380036b51b66f8ba7cab8643a7476f6fc2b23bb25a7db0e05ad2fb2fb196e2070ba35b671e3bc9adb967b7549b055a6514 languageName: node linkType: hard @@ -3449,11 +3449,11 @@ __metadata: languageName: node linkType: hard -"@vitest/mocker@npm:3.2.4": - version: 3.2.4 - resolution: "@vitest/mocker@npm:3.2.4" +"@vitest/mocker@npm:3.2.7": + version: 3.2.7 + resolution: "@vitest/mocker@npm:3.2.7" dependencies: - "@vitest/spy": "npm:3.2.4" + "@vitest/spy": "npm:3.2.7" estree-walker: "npm:^3.0.3" magic-string: "npm:^0.30.17" peerDependencies: @@ -3464,7 +3464,7 @@ __metadata: optional: true vite: optional: true - checksum: 10/5e92431b6ed9fc1679060e4caef3e4623f4750542a5d7cd944774f8217c4d231e273202e8aea00bab33260a5a9222ecb7005d80da0348c3c829bd37d123071a8 + checksum: 10/fccb77857ad4ba424e9298eac0c61e95592cf594244291c20fde68a40bca970aa5ba7193cc339aea5e0378ccd01f73feb56d34742c087a220202feb53fdc31f7 languageName: node linkType: hard @@ -3496,12 +3496,12 @@ __metadata: languageName: node linkType: hard -"@vitest/pretty-format@npm:3.2.4, @vitest/pretty-format@npm:^3.2.4": - version: 3.2.4 - resolution: "@vitest/pretty-format@npm:3.2.4" +"@vitest/pretty-format@npm:3.2.7, @vitest/pretty-format@npm:^3.2.7": + version: 3.2.7 + resolution: "@vitest/pretty-format@npm:3.2.7" dependencies: tinyrainbow: "npm:^2.0.0" - checksum: 10/8dd30cbf956e01fbab042fe651fb5175d9f0cd00b7b569a46cd98df89c4fec47dab12916201ad6e09a4f25f2a2ec8927a4bfdc61118593097f759c90b18a51d4 + checksum: 10/81286f667f799a11d8c6e2d16344b96baa502fb3fa9a54ef8c2e40d13d4db24277a717d5a30892614b5f9d1d4c7de4b8b1e7557d0dcd0ed5fff753fda139fa43 languageName: node linkType: hard @@ -3546,14 +3546,14 @@ __metadata: languageName: node linkType: hard -"@vitest/runner@npm:3.2.4": - version: 3.2.4 - resolution: "@vitest/runner@npm:3.2.4" +"@vitest/runner@npm:3.2.7": + version: 3.2.7 + resolution: "@vitest/runner@npm:3.2.7" dependencies: - "@vitest/utils": "npm:3.2.4" + "@vitest/utils": "npm:3.2.7" pathe: "npm:^2.0.3" strip-literal: "npm:^3.0.0" - checksum: 10/197bd55def519ef202f990b7c1618c212380831827c116240871033e4973decb780503c705ba9245a12bd8121f3ac4086ffcb3e302148b62d9bd77fd18dd1deb + checksum: 10/ff7c14726c3e3c3d88a8952f54cf56c82f3de96d1421d1ba21291a4fbe37f1bb94ed091a032a26b2b4acf9b0ce7fa6e4993191a6ada82775dfe32fa5527f88a4 languageName: node linkType: hard @@ -3600,14 +3600,14 @@ __metadata: languageName: node linkType: hard -"@vitest/snapshot@npm:3.2.4": - version: 3.2.4 - resolution: "@vitest/snapshot@npm:3.2.4" +"@vitest/snapshot@npm:3.2.7": + version: 3.2.7 + resolution: "@vitest/snapshot@npm:3.2.7" dependencies: - "@vitest/pretty-format": "npm:3.2.4" + "@vitest/pretty-format": "npm:3.2.7" magic-string: "npm:^0.30.17" pathe: "npm:^2.0.3" - checksum: 10/acfb682491b9ca9345bf9fed02c2779dec43e0455a380c1966b0aad8dd81c79960902cf34621ab48fe80a0eaf8c61cc42dec186a1321dc3c9897ef2ebd5f1bc4 + checksum: 10/8d1bc49c1d517a1112d03d244dbb9b8e81e47ef0f6b99267624fc936fcb699c920f3ba56236f69895d34b036014efea4277fce3bc46492452c7ed0df4944aeeb languageName: node linkType: hard @@ -3649,12 +3649,12 @@ __metadata: languageName: node linkType: hard -"@vitest/spy@npm:3.2.4": - version: 3.2.4 - resolution: "@vitest/spy@npm:3.2.4" +"@vitest/spy@npm:3.2.7": + version: 3.2.7 + resolution: "@vitest/spy@npm:3.2.7" dependencies: tinyspy: "npm:^4.0.3" - checksum: 10/7d38c299f42a8c7e5e41652b203af98ca54e63df69c3b072d0e401d5a57fbbba3e39d8538ac1b3022c26718a6388d0bcc222bc2f07faab75942543b9247c007d + checksum: 10/a125bff0eca23b4e4bf73fde0742879d1e68010e0c0bcb5865f20675cba4aa8b929b437e47c280e0e59d18d289f986b087f937d3374221ccaf5a3d82e278cb8c languageName: node linkType: hard @@ -3699,14 +3699,14 @@ __metadata: languageName: node linkType: hard -"@vitest/utils@npm:3.2.4": - version: 3.2.4 - resolution: "@vitest/utils@npm:3.2.4" +"@vitest/utils@npm:3.2.7": + version: 3.2.7 + resolution: "@vitest/utils@npm:3.2.7" dependencies: - "@vitest/pretty-format": "npm:3.2.4" + "@vitest/pretty-format": "npm:3.2.7" loupe: "npm:^3.1.4" tinyrainbow: "npm:^2.0.0" - checksum: 10/7f12ef63bd8ee13957744d1f336b0405f164ade4358bf9dfa531f75bbb58ffac02bf61aba65724311ddbc50b12ba54853a169e59c6b837c16086173b9a480710 + checksum: 10/d17fda64b608d06026627eaa062893215a96f61ad2b6fda6441e367d6fb41993600fa6199295ac9b171b90e53e4634efcbe0899230aa87fadcf7846b0e2cfe74 languageName: node linkType: hard @@ -12393,7 +12393,7 @@ __metadata: version: 0.0.0-use.local resolution: "vitest3-appmap-node-test@workspace:test/vitest3" dependencies: - vitest: "npm:^3.0.0" + vitest: "npm:^3.2.6" languageName: unknown linkType: soft @@ -12565,18 +12565,18 @@ __metadata: languageName: node linkType: hard -"vitest@npm:^3.0.0": - version: 3.2.4 - resolution: "vitest@npm:3.2.4" +"vitest@npm:^3.2.6": + version: 3.2.7 + resolution: "vitest@npm:3.2.7" dependencies: "@types/chai": "npm:^5.2.2" - "@vitest/expect": "npm:3.2.4" - "@vitest/mocker": "npm:3.2.4" - "@vitest/pretty-format": "npm:^3.2.4" - "@vitest/runner": "npm:3.2.4" - "@vitest/snapshot": "npm:3.2.4" - "@vitest/spy": "npm:3.2.4" - "@vitest/utils": "npm:3.2.4" + "@vitest/expect": "npm:3.2.7" + "@vitest/mocker": "npm:3.2.7" + "@vitest/pretty-format": "npm:^3.2.7" + "@vitest/runner": "npm:3.2.7" + "@vitest/snapshot": "npm:3.2.7" + "@vitest/spy": "npm:3.2.7" + "@vitest/utils": "npm:3.2.7" chai: "npm:^5.2.0" debug: "npm:^4.4.1" expect-type: "npm:^1.2.1" @@ -12596,8 +12596,8 @@ __metadata: "@edge-runtime/vm": "*" "@types/debug": ^4.1.12 "@types/node": ^18.0.0 || ^20.0.0 || >=22.0.0 - "@vitest/browser": 3.2.4 - "@vitest/ui": 3.2.4 + "@vitest/browser": 3.2.7 + "@vitest/ui": 3.2.7 happy-dom: "*" jsdom: "*" peerDependenciesMeta: @@ -12616,8 +12616,8 @@ __metadata: jsdom: optional: true bin: - vitest: vitest.mjs - checksum: 10/f10bbce093ecab310ecbe484536ef4496fb9151510b2be0c5907c65f6d31482d9c851f3182531d1d27d558054aa78e8efd9d4702ba6c82058657e8b6a52507ee + vitest: ./vitest.mjs + checksum: 10/b54cba8bbb78450dcc78f84df08417ee6daf86450836cd3e5770e7f375596f7b2f756f587b712ebdf28b41c7768747ae3854407372cd95fe6dbaa8410647b273 languageName: node linkType: hard From 65560bef2ad05c1fd26f7d79ee0576fc55a87cdb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Rzepecki?= Date: Mon, 17 Aug 2026 11:25:59 +0200 Subject: [PATCH 03/11] fix(vitest): support vitest 4.1, which moved runTest to chunk-artifact.js vitest 4.1 rebundled @vitest/runner: the `runTest` function declaration we wrap to intercept test before/afters relocated from `dist/chunk-hooks.js` to `dist/chunk-artifact.js`. Without a matching hook point the wrap never applies and vitest runs fall back to process recording, losing per-test AppMaps and their metadata. Register the new chunk as an instrumentation target alongside the existing `index.js` (v0-v2) and `chunk-hooks.js` (v3) names. This is required to bump the test/vitest4 workspace to vitest 4.1.10, which fixes GHSA-5xrq-8626-4rwp (critical: arbitrary file read and execution while the Vitest UI server is listening, fixed in 4.1.0). The bump also pulls vite 8.x, clearing GHSA-4w7w-66w2-5vf9, GHSA-v2wj-q39q-566r, GHSA-p9ff-h696-f583, GHSA-v6wh-96g9-6wx3 and GHSA-fx2h-pf6j-xcff for that workspace. Assisted-by: Claude:claude-opus-5[1m] --- src/hooks/vitest.ts | 12 +- test/vitest4/package.json | 2 +- yarn.lock | 541 ++++++++++++++++++++++++++++++++------ 3 files changed, 464 insertions(+), 91 deletions(-) diff --git a/src/hooks/vitest.ts b/src/hooks/vitest.ts index efe8aed..0eae7c4 100644 --- a/src/hooks/vitest.ts +++ b/src/hooks/vitest.ts @@ -68,18 +68,21 @@ export function shouldInstrument(url: URL): boolean { // 1. …/vite-node/dist/client.mjs ViteNodeRunner.runModule (vitest v0-v3) // or …/vite/dist/node/module-runner.js ESModulesEvaluator.runInlinedModule (vitest v4) // is the place to transform test and user files - // 2. @vitest/runner/dist/index.js (or chunk-hooks.js for v3) runTest - // is the place to intercept test before and afters + // 2. @vitest/runner runTest is the place to intercept test before and afters. + // It moves between bundles as vitest rebundles the runner, so all three + // known locations are instrumented: dist/index.js (v0-v2), + // dist/chunk-hooks.js (v3) and dist/chunk-artifact.js (v4.1+). return ( matchesPackageFile(url.pathname, "@vitest/runner", "dist/index.js") || matchesPackageFile(url.pathname, "@vitest/runner", "dist/chunk-hooks.js") || + matchesPackageFile(url.pathname, "@vitest/runner", "dist/chunk-artifact.js") || matchesPackageFile(url.pathname, "vite-node", "dist/client.mjs") || matchesPackageFile(url.pathname, "vite", "dist/node/module-runner.js") || matchesPackageFile(url.pathname, "vitest", "dist/module-evaluator.js") ); } -// Wraps @vitest/runner/dist/index.js runTest +// Wraps @vitest/runner runTest, wherever it is bundled -- see shouldInstrument export async function wrapRunTest( fun: (test: Test, runner: VitestRunner) => unknown, args: [Test, VitestRunner], @@ -190,7 +193,8 @@ export function transform(program: ESTree.Program): ESTree.Program { if ( source && (matchesPackageFile(source, "@vitest/runner", "dist/index.js") || - matchesPackageFile(source, "@vitest/runner", "dist/chunk-hooks.js")) + matchesPackageFile(source, "@vitest/runner", "dist/chunk-hooks.js") || + matchesPackageFile(source, "@vitest/runner", "dist/chunk-artifact.js")) ) walk(program, { FunctionDeclaration(fd: ESTree.FunctionDeclaration) { diff --git a/test/vitest4/package.json b/test/vitest4/package.json index bb2bd22..5e7fa4a 100644 --- a/test/vitest4/package.json +++ b/test/vitest4/package.json @@ -2,7 +2,7 @@ "name": "vitest4-appmap-node-test", "packageManager": "yarn@4.13.0", "dependencies": { - "vitest": "^4.0.0" + "vitest": "^4.1.0" }, "private": true } diff --git a/yarn.lock b/yarn.lock index a8bc075..d9da553 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2193,6 +2193,13 @@ __metadata: languageName: node linkType: hard +"@oxc-project/types@npm:=0.144.0": + version: 0.144.0 + resolution: "@oxc-project/types@npm:0.144.0" + checksum: 10/e440aa06572a3dedc1c9f4f25cae2a6132761deb2ead8d0c5f139a51c343db054c2b4f0c26cc1b1f3e857b2add2821c5b268ea4321291b30a6589bb33201d5f8 + languageName: node + linkType: hard + "@pkgjs/parseargs@npm:^0.11.0": version: 0.11.0 resolution: "@pkgjs/parseargs@npm:0.11.0" @@ -2292,6 +2299,111 @@ __metadata: languageName: node linkType: hard +"@rolldown/binding-android-arm64@npm:1.2.4": + version: 1.2.4 + resolution: "@rolldown/binding-android-arm64@npm:1.2.4" + conditions: os=android & cpu=arm64 + languageName: node + linkType: hard + +"@rolldown/binding-darwin-arm64@npm:1.2.4": + version: 1.2.4 + resolution: "@rolldown/binding-darwin-arm64@npm:1.2.4" + conditions: os=darwin & cpu=arm64 + languageName: node + linkType: hard + +"@rolldown/binding-darwin-x64@npm:1.2.4": + version: 1.2.4 + resolution: "@rolldown/binding-darwin-x64@npm:1.2.4" + conditions: os=darwin & cpu=x64 + languageName: node + linkType: hard + +"@rolldown/binding-freebsd-x64@npm:1.2.4": + version: 1.2.4 + resolution: "@rolldown/binding-freebsd-x64@npm:1.2.4" + conditions: os=freebsd & cpu=x64 + languageName: node + linkType: hard + +"@rolldown/binding-linux-arm-gnueabihf@npm:1.2.4": + version: 1.2.4 + resolution: "@rolldown/binding-linux-arm-gnueabihf@npm:1.2.4" + conditions: os=linux & cpu=arm + languageName: node + linkType: hard + +"@rolldown/binding-linux-arm64-gnu@npm:1.2.4": + version: 1.2.4 + resolution: "@rolldown/binding-linux-arm64-gnu@npm:1.2.4" + conditions: os=linux & cpu=arm64 & libc=glibc + languageName: node + linkType: hard + +"@rolldown/binding-linux-arm64-musl@npm:1.2.4": + version: 1.2.4 + resolution: "@rolldown/binding-linux-arm64-musl@npm:1.2.4" + conditions: os=linux & cpu=arm64 & libc=musl + languageName: node + linkType: hard + +"@rolldown/binding-linux-ppc64-gnu@npm:1.2.4": + version: 1.2.4 + resolution: "@rolldown/binding-linux-ppc64-gnu@npm:1.2.4" + conditions: os=linux & cpu=ppc64 & libc=glibc + languageName: node + linkType: hard + +"@rolldown/binding-linux-s390x-gnu@npm:1.2.4": + version: 1.2.4 + resolution: "@rolldown/binding-linux-s390x-gnu@npm:1.2.4" + conditions: os=linux & cpu=s390x & libc=glibc + languageName: node + linkType: hard + +"@rolldown/binding-linux-x64-gnu@npm:1.2.4": + version: 1.2.4 + resolution: "@rolldown/binding-linux-x64-gnu@npm:1.2.4" + conditions: os=linux & cpu=x64 & libc=glibc + languageName: node + linkType: hard + +"@rolldown/binding-linux-x64-musl@npm:1.2.4": + version: 1.2.4 + resolution: "@rolldown/binding-linux-x64-musl@npm:1.2.4" + conditions: os=linux & cpu=x64 & libc=musl + languageName: node + linkType: hard + +"@rolldown/binding-openharmony-arm64@npm:1.2.4": + version: 1.2.4 + resolution: "@rolldown/binding-openharmony-arm64@npm:1.2.4" + conditions: os=openharmony & cpu=arm64 + languageName: node + linkType: hard + +"@rolldown/binding-win32-arm64-msvc@npm:1.2.4": + version: 1.2.4 + resolution: "@rolldown/binding-win32-arm64-msvc@npm:1.2.4" + conditions: os=win32 & cpu=arm64 + languageName: node + linkType: hard + +"@rolldown/binding-win32-x64-msvc@npm:1.2.4": + version: 1.2.4 + resolution: "@rolldown/binding-win32-x64-msvc@npm:1.2.4" + conditions: os=win32 & cpu=x64 + languageName: node + linkType: hard + +"@rolldown/pluginutils@npm:^1.0.0": + version: 1.0.1 + resolution: "@rolldown/pluginutils@npm:1.0.1" + checksum: 10/4e95cf9ce23d75e5aa03ea0249cd86f7d1e21f83fbf6f8520e4edd8a251ba1b82c4ba9bc13cd24b6c4661daec6225b06e6d35c64c604e731b230b2a49af47d05 + languageName: node + linkType: hard + "@rollup/rollup-android-arm-eabi@npm:4.59.0": version: 4.59.0 resolution: "@rollup/rollup-android-arm-eabi@npm:4.59.0" @@ -2704,7 +2816,7 @@ __metadata: languageName: node linkType: hard -"@standard-schema/spec@npm:^1.0.0": +"@standard-schema/spec@npm:^1.1.0": version: 1.1.0 resolution: "@standard-schema/spec@npm:1.1.0" checksum: 10/a209615c9e8b2ea535d7db0a5f6aa0f962fd4ab73ee86a46c100fb78116964af1f55a27c1794d4801e534a196794223daa25ff5135021e03c7828aa3d95e1763 @@ -3416,17 +3528,17 @@ __metadata: languageName: node linkType: hard -"@vitest/expect@npm:4.0.18": - version: 4.0.18 - resolution: "@vitest/expect@npm:4.0.18" +"@vitest/expect@npm:4.1.10": + version: 4.1.10 + resolution: "@vitest/expect@npm:4.1.10" dependencies: - "@standard-schema/spec": "npm:^1.0.0" + "@standard-schema/spec": "npm:^1.1.0" "@types/chai": "npm:^5.2.2" - "@vitest/spy": "npm:4.0.18" - "@vitest/utils": "npm:4.0.18" - chai: "npm:^6.2.1" - tinyrainbow: "npm:^3.0.3" - checksum: 10/2115bff1bbcad460ce72032022e4dbcf8572c4b0fe07ca60f5644a8d96dd0dfa112986b5a1a5c5705f4548119b3b829c45d1de0838879211e0d6bb276b4ece73 + "@vitest/spy": "npm:4.1.10" + "@vitest/utils": "npm:4.1.10" + chai: "npm:^6.2.2" + tinyrainbow: "npm:^3.1.0" + checksum: 10/487fcad404a68968a54ae5fb9d099f12170cd793420a04b34a5606516317090c50a8303ab687c70166ee181864e3e138941d4a96d0405434dcd37696b3105350 languageName: node linkType: hard @@ -3468,22 +3580,22 @@ __metadata: languageName: node linkType: hard -"@vitest/mocker@npm:4.0.18": - version: 4.0.18 - resolution: "@vitest/mocker@npm:4.0.18" +"@vitest/mocker@npm:4.1.10": + version: 4.1.10 + resolution: "@vitest/mocker@npm:4.1.10" dependencies: - "@vitest/spy": "npm:4.0.18" + "@vitest/spy": "npm:4.1.10" estree-walker: "npm:^3.0.3" magic-string: "npm:^0.30.21" peerDependencies: msw: ^2.4.9 - vite: ^6.0.0 || ^7.0.0-0 + vite: ^6.0.0 || ^7.0.0 || ^8.0.0 peerDependenciesMeta: msw: optional: true vite: optional: true - checksum: 10/46f584a4c1180dfb513137bc8db6e2e3b53e141adfe964307297e98321652d86a3f2a52d80cda1f810205bd5fdcab789bb8b52a532e68f175ef1e20be398218d + checksum: 10/ae9645d1bcdad3ab7de7182feb4f1c9148a5ff97cef19581eec9257112aace94889eee9a1ad12e40ce59453ac05f52453b5fdb49ff76a31af8ccdbaaa4471ef3 languageName: node linkType: hard @@ -3505,12 +3617,12 @@ __metadata: languageName: node linkType: hard -"@vitest/pretty-format@npm:4.0.18": - version: 4.0.18 - resolution: "@vitest/pretty-format@npm:4.0.18" +"@vitest/pretty-format@npm:4.1.10": + version: 4.1.10 + resolution: "@vitest/pretty-format@npm:4.1.10" dependencies: - tinyrainbow: "npm:^3.0.3" - checksum: 10/4cafc7c9853097345bd94e8761bf47c2c04e00d366ac56d79928182787ff83c512c96f1dc2ce9b6aeed4d3a8c23ce12254da203783108d3c096bc398eed2a62d + tinyrainbow: "npm:^3.1.0" + checksum: 10/e4f6907143ab0e40dda29d70b17027586c92921d622091321f10512e660b3995dcee7aa56e17b750b72560f295e25f96035372348415f18ebfd39b66a55b4704 languageName: node linkType: hard @@ -3557,13 +3669,13 @@ __metadata: languageName: node linkType: hard -"@vitest/runner@npm:4.0.18": - version: 4.0.18 - resolution: "@vitest/runner@npm:4.0.18" +"@vitest/runner@npm:4.1.10": + version: 4.1.10 + resolution: "@vitest/runner@npm:4.1.10" dependencies: - "@vitest/utils": "npm:4.0.18" + "@vitest/utils": "npm:4.1.10" pathe: "npm:^2.0.3" - checksum: 10/d7deebf086d7e084f449733ecea6c9c81737a18aafece318cbe7500e45debea00fa9dbf9315fd38aa88550dd5240a791b885ac71665f89b154d71a6c63da5836 + checksum: 10/2c962cb13af0880990036808a35679b7ac6657c8f542490234c2faa6ffd2ab080ac6bf21b487c64d84aa635cfb37b49eb679098c2003a100dfc6c4d5e87bf055 languageName: node linkType: hard @@ -3611,14 +3723,15 @@ __metadata: languageName: node linkType: hard -"@vitest/snapshot@npm:4.0.18": - version: 4.0.18 - resolution: "@vitest/snapshot@npm:4.0.18" +"@vitest/snapshot@npm:4.1.10": + version: 4.1.10 + resolution: "@vitest/snapshot@npm:4.1.10" dependencies: - "@vitest/pretty-format": "npm:4.0.18" + "@vitest/pretty-format": "npm:4.1.10" + "@vitest/utils": "npm:4.1.10" magic-string: "npm:^0.30.21" pathe: "npm:^2.0.3" - checksum: 10/50aa5fb7fca45c499c145cc2f20e53b8afb0990b53ff4a4e6447dd6f147437edc5316f22e2d82119e154c3cf7c59d44898e7b2faf7ba614ac1051cbe4d662a77 + checksum: 10/7940d83ffd2fbebf9a04ea31e196b7e8bf981093ec739950959fe8dd29caa33c80823780fb4b1063d9459c44a0a8d8b2748c00dfb6941becd7404e6d687eea01 languageName: node linkType: hard @@ -3658,10 +3771,10 @@ __metadata: languageName: node linkType: hard -"@vitest/spy@npm:4.0.18": - version: 4.0.18 - resolution: "@vitest/spy@npm:4.0.18" - checksum: 10/f7b1618ae13790105771dd2a8c973c63c018366fcc69b50f15ce5d12f9ac552efd3c1e6e5ae4ebdb6023d0b8d8f31fef2a0b1b77334284928db45c80c63de456 +"@vitest/spy@npm:4.1.10": + version: 4.1.10 + resolution: "@vitest/spy@npm:4.1.10" + checksum: 10/7c1b79a95474338e0659f0f2e43be4df1ef7939ff5b37b044954e0287582947803bd417508f44a7f244809672309d9b3dd67660b704ec3fe7f323cc958ae47a3 languageName: node linkType: hard @@ -3710,13 +3823,14 @@ __metadata: languageName: node linkType: hard -"@vitest/utils@npm:4.0.18": - version: 4.0.18 - resolution: "@vitest/utils@npm:4.0.18" +"@vitest/utils@npm:4.1.10": + version: 4.1.10 + resolution: "@vitest/utils@npm:4.1.10" dependencies: - "@vitest/pretty-format": "npm:4.0.18" - tinyrainbow: "npm:^3.0.3" - checksum: 10/e8b2ad7bc35b2bc5590f9dc1d1a67644755da416b47ab7099a6f26792903fa0aacb81e6ba99f0f03858d9d3a1d76eeba65150a1a0849690a40817424e749c367 + "@vitest/pretty-format": "npm:4.1.10" + convert-source-map: "npm:^2.0.0" + tinyrainbow: "npm:^3.1.0" + checksum: 10/95484aad55c7b00bbcd4963e27cbb86fe207620a6093973d68da9d0a06bad37c388d84c9ab43d5f35d88e46c8f376a5592d9c54c025c958361160f4802bb25ee languageName: node linkType: hard @@ -4532,7 +4646,7 @@ __metadata: languageName: node linkType: hard -"chai@npm:^6.2.1": +"chai@npm:^6.2.2": version: 6.2.2 resolution: "chai@npm:6.2.2" checksum: 10/13cda42cc40aa46da04a41cf7e5c61df6b6ae0b4e8a8c8b40e04d6947e4d7951377ea8c14f9fa7fe5aaa9e8bd9ba414f11288dc958d4cee6f5221b9436f2778f @@ -5094,7 +5208,7 @@ __metadata: languageName: node linkType: hard -"detect-libc@npm:^2.0.0, detect-libc@npm:^2.1.2": +"detect-libc@npm:^2.0.0, detect-libc@npm:^2.0.3, detect-libc@npm:^2.1.2": version: 2.1.2 resolution: "detect-libc@npm:2.1.2" checksum: 10/b736c8d97d5d46164c0d1bed53eb4e6a3b1d8530d460211e2d52f1c552875e706c58a5376854e4e54f8b828c9cada58c855288c968522eb93ac7696d65970766 @@ -5307,6 +5421,13 @@ __metadata: languageName: node linkType: hard +"es-module-lexer@npm:^2.0.0": + version: 2.3.1 + resolution: "es-module-lexer@npm:2.3.1" + checksum: 10/15bd9f6d70ec7f046a308b7fbeb56a1fd4bde09e6a46df0015caee58bd5888fc114029754e922ca68577b761890ac95cc450683424209464530cfe54f69b8566 + languageName: node + linkType: hard + "es-object-atoms@npm:^1.0.0, es-object-atoms@npm:^1.1.1": version: 1.1.1 resolution: "es-object-atoms@npm:1.1.1" @@ -5868,10 +5989,10 @@ __metadata: languageName: node linkType: hard -"expect-type@npm:^1.1.0, expect-type@npm:^1.2.1, expect-type@npm:^1.2.2": - version: 1.3.0 - resolution: "expect-type@npm:1.3.0" - checksum: 10/a5fada3d0c621649261f886e7d93e6bf80ce26d8a86e5d517e38301b8baec8450ab2cb94ba6e7a0a6bf2fc9ee55f54e1b06938ef1efa52ddcfeffbfa01acbbcc +"expect-type@npm:^1.1.0, expect-type@npm:^1.2.1, expect-type@npm:^1.3.0": + version: 1.4.0 + resolution: "expect-type@npm:1.4.0" + checksum: 10/bad91f4b7eb807248695ee840a935d12818fe531ad523bc7ac7dcc540a4d86dc566a3ef829f4da6e8b5a458ac84092771739865114c91e7e8a9317302f401f09 languageName: node linkType: hard @@ -7915,6 +8036,126 @@ __metadata: languageName: unknown linkType: soft +"lightningcss-android-arm64@npm:1.33.0": + version: 1.33.0 + resolution: "lightningcss-android-arm64@npm:1.33.0" + conditions: os=android & cpu=arm64 + languageName: node + linkType: hard + +"lightningcss-darwin-arm64@npm:1.33.0": + version: 1.33.0 + resolution: "lightningcss-darwin-arm64@npm:1.33.0" + conditions: os=darwin & cpu=arm64 + languageName: node + linkType: hard + +"lightningcss-darwin-x64@npm:1.33.0": + version: 1.33.0 + resolution: "lightningcss-darwin-x64@npm:1.33.0" + conditions: os=darwin & cpu=x64 + languageName: node + linkType: hard + +"lightningcss-freebsd-x64@npm:1.33.0": + version: 1.33.0 + resolution: "lightningcss-freebsd-x64@npm:1.33.0" + conditions: os=freebsd & cpu=x64 + languageName: node + linkType: hard + +"lightningcss-linux-arm-gnueabihf@npm:1.33.0": + version: 1.33.0 + resolution: "lightningcss-linux-arm-gnueabihf@npm:1.33.0" + conditions: os=linux & cpu=arm + languageName: node + linkType: hard + +"lightningcss-linux-arm64-gnu@npm:1.33.0": + version: 1.33.0 + resolution: "lightningcss-linux-arm64-gnu@npm:1.33.0" + conditions: os=linux & cpu=arm64 & libc=glibc + languageName: node + linkType: hard + +"lightningcss-linux-arm64-musl@npm:1.33.0": + version: 1.33.0 + resolution: "lightningcss-linux-arm64-musl@npm:1.33.0" + conditions: os=linux & cpu=arm64 & libc=musl + languageName: node + linkType: hard + +"lightningcss-linux-x64-gnu@npm:1.33.0": + version: 1.33.0 + resolution: "lightningcss-linux-x64-gnu@npm:1.33.0" + conditions: os=linux & cpu=x64 & libc=glibc + languageName: node + linkType: hard + +"lightningcss-linux-x64-musl@npm:1.33.0": + version: 1.33.0 + resolution: "lightningcss-linux-x64-musl@npm:1.33.0" + conditions: os=linux & cpu=x64 & libc=musl + languageName: node + linkType: hard + +"lightningcss-win32-arm64-msvc@npm:1.33.0": + version: 1.33.0 + resolution: "lightningcss-win32-arm64-msvc@npm:1.33.0" + conditions: os=win32 & cpu=arm64 + languageName: node + linkType: hard + +"lightningcss-win32-x64-msvc@npm:1.33.0": + version: 1.33.0 + resolution: "lightningcss-win32-x64-msvc@npm:1.33.0" + conditions: os=win32 & cpu=x64 + languageName: node + linkType: hard + +"lightningcss@npm:^1.33.0": + version: 1.33.0 + resolution: "lightningcss@npm:1.33.0" + dependencies: + detect-libc: "npm:^2.0.3" + lightningcss-android-arm64: "npm:1.33.0" + lightningcss-darwin-arm64: "npm:1.33.0" + lightningcss-darwin-x64: "npm:1.33.0" + lightningcss-freebsd-x64: "npm:1.33.0" + lightningcss-linux-arm-gnueabihf: "npm:1.33.0" + lightningcss-linux-arm64-gnu: "npm:1.33.0" + lightningcss-linux-arm64-musl: "npm:1.33.0" + lightningcss-linux-x64-gnu: "npm:1.33.0" + lightningcss-linux-x64-musl: "npm:1.33.0" + lightningcss-win32-arm64-msvc: "npm:1.33.0" + lightningcss-win32-x64-msvc: "npm:1.33.0" + dependenciesMeta: + lightningcss-android-arm64: + optional: true + lightningcss-darwin-arm64: + optional: true + lightningcss-darwin-x64: + optional: true + lightningcss-freebsd-x64: + optional: true + lightningcss-linux-arm-gnueabihf: + optional: true + lightningcss-linux-arm64-gnu: + optional: true + lightningcss-linux-arm64-musl: + optional: true + lightningcss-linux-x64-gnu: + optional: true + lightningcss-linux-x64-musl: + optional: true + lightningcss-win32-arm64-msvc: + optional: true + lightningcss-win32-x64-msvc: + optional: true + checksum: 10/9b3b5db404af352fe5861926b9909281d29bede175539035c1a01e1ad4dcee8bb6f871e8e3d01a67a85e9e1cd18a63e52871a48cf62feab4d1aa868d4f2c3c2e + languageName: node + linkType: hard + "lines-and-columns@npm:^1.1.6": version: 1.2.4 resolution: "lines-and-columns@npm:1.2.4" @@ -8682,12 +8923,12 @@ __metadata: languageName: node linkType: hard -"nanoid@npm:^3.3.11, nanoid@npm:^3.3.6": - version: 3.3.11 - resolution: "nanoid@npm:3.3.11" +"nanoid@npm:^3.3.17, nanoid@npm:^3.3.6": + version: 3.3.18 + resolution: "nanoid@npm:3.3.18" bin: nanoid: bin/nanoid.cjs - checksum: 10/73b5afe5975a307aaa3c95dfe3334c52cdf9ae71518176895229b8d65ab0d1c0417dd081426134eb7571c055720428ea5d57c645138161e7d10df80815527c48 + checksum: 10/1b3b4fdac831b92b56d1dbe8b1e63a372432faf86ea383134e3b53141ef8108a60b7f84343b5cefecac9550bb74edf8164da93ea07d1c4f757039bc75d8a5d9e languageName: node linkType: hard @@ -9857,7 +10098,7 @@ __metadata: languageName: node linkType: hard -"picomatch@npm:^4.0.2, picomatch@npm:^4.0.3, picomatch@npm:^4.0.4": +"picomatch@npm:^4.0.2, picomatch@npm:^4.0.3, picomatch@npm:^4.0.4, picomatch@npm:^4.0.5": version: 4.0.5 resolution: "picomatch@npm:4.0.5" checksum: 10/8bad770af9dcdb7f94ad1a893adcbe08a97d75a18872f8fed37161d3124217471c402b3929f051532f795f4ff2e53dcebb1644df4c1a5f3a9c476fef3b9f8c51 @@ -9938,14 +10179,14 @@ __metadata: languageName: node linkType: hard -"postcss@npm:^8.4.43, postcss@npm:^8.5.6": - version: 8.5.8 - resolution: "postcss@npm:8.5.8" +"postcss@npm:^8.4.43, postcss@npm:^8.5.25, postcss@npm:^8.5.6": + version: 8.5.26 + resolution: "postcss@npm:8.5.26" dependencies: - nanoid: "npm:^3.3.11" + nanoid: "npm:^3.3.17" picocolors: "npm:^1.1.1" source-map-js: "npm:^1.2.1" - checksum: 10/cbacbfd7f767e2c820d4bf09a3a744834dd7d14f69ff08d1f57b1a7defce9ae5efcf31981890d9697a972a64e9965de677932ef28e4c8ba23a87aad45b82c459 + checksum: 10/842a624f822f77cb37264cc24f0cf97c0a69dd8d6f7b4a6d76b5a8dc95355899dd044f33a2d4e890da858293de570fce18dff453f3b629ff14cac67a3591895a languageName: node linkType: hard @@ -10535,6 +10776,61 @@ __metadata: languageName: node linkType: hard +"rolldown@npm:~1.2.1": + version: 1.2.4 + resolution: "rolldown@npm:1.2.4" + dependencies: + "@oxc-project/types": "npm:=0.144.0" + "@rolldown/binding-android-arm64": "npm:1.2.4" + "@rolldown/binding-darwin-arm64": "npm:1.2.4" + "@rolldown/binding-darwin-x64": "npm:1.2.4" + "@rolldown/binding-freebsd-x64": "npm:1.2.4" + "@rolldown/binding-linux-arm-gnueabihf": "npm:1.2.4" + "@rolldown/binding-linux-arm64-gnu": "npm:1.2.4" + "@rolldown/binding-linux-arm64-musl": "npm:1.2.4" + "@rolldown/binding-linux-ppc64-gnu": "npm:1.2.4" + "@rolldown/binding-linux-s390x-gnu": "npm:1.2.4" + "@rolldown/binding-linux-x64-gnu": "npm:1.2.4" + "@rolldown/binding-linux-x64-musl": "npm:1.2.4" + "@rolldown/binding-openharmony-arm64": "npm:1.2.4" + "@rolldown/binding-win32-arm64-msvc": "npm:1.2.4" + "@rolldown/binding-win32-x64-msvc": "npm:1.2.4" + "@rolldown/pluginutils": "npm:^1.0.0" + dependenciesMeta: + "@rolldown/binding-android-arm64": + optional: true + "@rolldown/binding-darwin-arm64": + optional: true + "@rolldown/binding-darwin-x64": + optional: true + "@rolldown/binding-freebsd-x64": + optional: true + "@rolldown/binding-linux-arm-gnueabihf": + optional: true + "@rolldown/binding-linux-arm64-gnu": + optional: true + "@rolldown/binding-linux-arm64-musl": + optional: true + "@rolldown/binding-linux-ppc64-gnu": + optional: true + "@rolldown/binding-linux-s390x-gnu": + optional: true + "@rolldown/binding-linux-x64-gnu": + optional: true + "@rolldown/binding-linux-x64-musl": + optional: true + "@rolldown/binding-openharmony-arm64": + optional: true + "@rolldown/binding-win32-arm64-msvc": + optional: true + "@rolldown/binding-win32-x64-msvc": + optional: true + bin: + rolldown: ./bin/cli.mjs + checksum: 10/89447addc6695e0fe1224592ac7648545faf2077c18361b48df01d1f453a0a9b3390cedad58daccaf5dce7b37646cb5fb7e318c42b8b85d4998b33be43d05b43 + languageName: node + linkType: hard + "rollup@npm:^4.59.0": version: 4.59.0 resolution: "rollup@npm:4.59.0" @@ -11269,13 +11565,20 @@ __metadata: languageName: node linkType: hard -"std-env@npm:^3.10.0, std-env@npm:^3.3.3, std-env@npm:^3.5.0, std-env@npm:^3.8.0, std-env@npm:^3.9.0": +"std-env@npm:^3.3.3, std-env@npm:^3.5.0, std-env@npm:^3.8.0, std-env@npm:^3.9.0": version: 3.10.0 resolution: "std-env@npm:3.10.0" checksum: 10/19c9cda4f370b1ffae2b8b08c72167d8c3e5cfa972aaf5c6873f85d0ed2faa729407f5abb194dc33380708c00315002febb6f1e1b484736bfcf9361ad366013a languageName: node linkType: hard +"std-env@npm:^4.0.0-rc.1": + version: 4.2.0 + resolution: "std-env@npm:4.2.0" + checksum: 10/d30c3ae49c5568b4e61dca628eaafe12944dbcfe76980e5b1b1499b48e23f85f1ee01fe2306eeef5964a80b763948bbf2ba40490bc53709f45cf989071c9e4e7 + languageName: node + linkType: hard + "stream-combiner2@npm:~1.1.1": version: 1.1.1 resolution: "stream-combiner2@npm:1.1.1" @@ -11683,7 +11986,7 @@ __metadata: languageName: node linkType: hard -"tinyglobby@npm:^0.2.12, tinyglobby@npm:^0.2.14, tinyglobby@npm:^0.2.15": +"tinyglobby@npm:^0.2.12, tinyglobby@npm:^0.2.14, tinyglobby@npm:^0.2.15, tinyglobby@npm:^0.2.17": version: 0.2.17 resolution: "tinyglobby@npm:0.2.17" dependencies: @@ -11728,10 +12031,10 @@ __metadata: languageName: node linkType: hard -"tinyrainbow@npm:^3.0.3": - version: 3.0.3 - resolution: "tinyrainbow@npm:3.0.3" - checksum: 10/169cc63c15e1378674180f3207c82c05bfa58fc79992e48792e8d97b4b759012f48e95297900ede24a81f0087cf329a0d85bb81109739eacf03c650127b3f6c1 +"tinyrainbow@npm:^3.1.0": + version: 3.1.1 + resolution: "tinyrainbow@npm:3.1.1" + checksum: 10/6aa4aadf89cc8ecf8c227ef189616911292c4f0d2d5708b669b00375c5a8b43058115685f043034ffb11a8744c24650a30493525ff62134b436d94c84fa33ed5 languageName: node linkType: hard @@ -12310,7 +12613,7 @@ __metadata: languageName: node linkType: hard -"vite@npm:^5.0.0 || ^6.0.0 || ^7.0.0-0, vite@npm:^6.0.0 || ^7.0.0": +"vite@npm:^5.0.0 || ^6.0.0 || ^7.0.0-0": version: 7.3.1 resolution: "vite@npm:7.3.1" dependencies: @@ -12365,6 +12668,63 @@ __metadata: languageName: node linkType: hard +"vite@npm:^6.0.0 || ^7.0.0 || ^8.0.0": + version: 8.2.1 + resolution: "vite@npm:8.2.1" + dependencies: + fsevents: "npm:~2.3.3" + lightningcss: "npm:^1.33.0" + picomatch: "npm:^4.0.5" + postcss: "npm:^8.5.25" + rolldown: "npm:~1.2.1" + tinyglobby: "npm:^0.2.17" + peerDependencies: + "@types/node": ^20.19.0 || >=22.12.0 + "@vitejs/devtools": ^0.4.0 + esbuild: ^0.27.0 || ^0.28.0 + jiti: ">=1.21.0" + less: ^4.0.0 + sass: ^1.70.0 + sass-embedded: ^1.70.0 + stylus: ">=0.54.8" + sugarss: ^5.0.0 + terser: ^5.16.0 + tsx: ^4.8.1 + yaml: ^2.4.2 + dependenciesMeta: + fsevents: + optional: true + peerDependenciesMeta: + "@types/node": + optional: true + "@vitejs/devtools": + optional: true + esbuild: + optional: true + jiti: + optional: true + less: + optional: true + sass: + optional: true + sass-embedded: + optional: true + stylus: + optional: true + sugarss: + optional: true + terser: + optional: true + tsx: + optional: true + yaml: + optional: true + bin: + vite: bin/vite.js + checksum: 10/af65bf23dc346f968b8b2f577da4c5d18a5a21eea2ce699eb0018918151238ed185067de1749408d26ba93c743635c5870602bd77b4b6f2f678d8d685a9635d8 + languageName: node + linkType: hard + "vitest-appmap-node-test@workspace:test/vitest": version: 0.0.0-use.local resolution: "vitest-appmap-node-test@workspace:test/vitest" @@ -12401,7 +12761,7 @@ __metadata: version: 0.0.0-use.local resolution: "vitest4-appmap-node-test@workspace:test/vitest4" dependencies: - vitest: "npm:^4.0.0" + vitest: "npm:^4.1.0" languageName: unknown linkType: soft @@ -12621,40 +12981,43 @@ __metadata: languageName: node linkType: hard -"vitest@npm:^4.0.0": - version: 4.0.18 - resolution: "vitest@npm:4.0.18" +"vitest@npm:^4.1.0": + version: 4.1.10 + resolution: "vitest@npm:4.1.10" dependencies: - "@vitest/expect": "npm:4.0.18" - "@vitest/mocker": "npm:4.0.18" - "@vitest/pretty-format": "npm:4.0.18" - "@vitest/runner": "npm:4.0.18" - "@vitest/snapshot": "npm:4.0.18" - "@vitest/spy": "npm:4.0.18" - "@vitest/utils": "npm:4.0.18" - es-module-lexer: "npm:^1.7.0" - expect-type: "npm:^1.2.2" + "@vitest/expect": "npm:4.1.10" + "@vitest/mocker": "npm:4.1.10" + "@vitest/pretty-format": "npm:4.1.10" + "@vitest/runner": "npm:4.1.10" + "@vitest/snapshot": "npm:4.1.10" + "@vitest/spy": "npm:4.1.10" + "@vitest/utils": "npm:4.1.10" + es-module-lexer: "npm:^2.0.0" + expect-type: "npm:^1.3.0" magic-string: "npm:^0.30.21" obug: "npm:^2.1.1" pathe: "npm:^2.0.3" picomatch: "npm:^4.0.3" - std-env: "npm:^3.10.0" + std-env: "npm:^4.0.0-rc.1" tinybench: "npm:^2.9.0" tinyexec: "npm:^1.0.2" tinyglobby: "npm:^0.2.15" - tinyrainbow: "npm:^3.0.3" - vite: "npm:^6.0.0 || ^7.0.0" + tinyrainbow: "npm:^3.1.0" + vite: "npm:^6.0.0 || ^7.0.0 || ^8.0.0" why-is-node-running: "npm:^2.3.0" peerDependencies: "@edge-runtime/vm": "*" "@opentelemetry/api": ^1.9.0 "@types/node": ^20.0.0 || ^22.0.0 || >=24.0.0 - "@vitest/browser-playwright": 4.0.18 - "@vitest/browser-preview": 4.0.18 - "@vitest/browser-webdriverio": 4.0.18 - "@vitest/ui": 4.0.18 + "@vitest/browser-playwright": 4.1.10 + "@vitest/browser-preview": 4.1.10 + "@vitest/browser-webdriverio": 4.1.10 + "@vitest/coverage-istanbul": 4.1.10 + "@vitest/coverage-v8": 4.1.10 + "@vitest/ui": 4.1.10 happy-dom: "*" jsdom: "*" + vite: ^6.0.0 || ^7.0.0 || ^8.0.0 peerDependenciesMeta: "@edge-runtime/vm": optional: true @@ -12668,15 +13031,21 @@ __metadata: optional: true "@vitest/browser-webdriverio": optional: true + "@vitest/coverage-istanbul": + optional: true + "@vitest/coverage-v8": + optional: true "@vitest/ui": optional: true happy-dom: optional: true jsdom: optional: true + vite: + optional: false bin: - vitest: vitest.mjs - checksum: 10/6c6464ebcf3af83546862896fd1b5f10cb6607261bffce39df60033a288b8c1687ae1dd20002b6e4997a7a05303376d1eb58ce20afe63be052529a4378a8c165 + vitest: ./vitest.mjs + checksum: 10/020843460fe696c23be2a363634dde4daf54625f1c443c24066ba3f87c478b0ccfdd5124343ba30eb092f54902ffea09f4bed0af4a16a9ee805e494ee2dce34e languageName: node linkType: hard From e0acddc7d9cf6c1eee149aad08d197126e4ad05d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Rzepecki?= Date: Mon, 17 Aug 2026 11:28:02 +0200 Subject: [PATCH 04/11] chore(deps): bump next to 16.3.1 in test/next16 Clears the whole outstanding Next.js 16 advisory set for this workspace: GHSA-q4gf-8mx6-v5v3 and GHSA-8h8q-6873-q5fj (DoS with Server Components), GHSA-26hh-7cqf-hhc6 (middleware/proxy bypass via segment-prefetch routes), GHSA-3g8h-86w9-wvmq (cache-poisonable middleware redirects), GHSA-ffhc-5mcf-pf4q (XSS via CSP nonces), GHSA-gx5p-jg67-6x7h (XSS in beforeInteractive scripts), GHSA-vfv6-92ff-j949 (RSC cache-busting collisions), GHSA-mg66-mrh9-m8jx (DoS via connection exhaustion) and GHSA-h64f-5h5j-jqjh (DoS in the Image Optimization API). Also pulls sharp 0.35.3, fixing GHSA-f88m-g3jw-g9cj (inherited libvips CVE-2026-33327, CVE-2026-33328, CVE-2026-35590 and CVE-2026-35591). The snapshot update is upstream response-header churn only, not an instrumentation change: Next now sends `Cache-Control: no-cache` instead of `no-store` and the rendered page is 62 bytes longer. The recorded AppMap structure is byte-identical otherwise. Assisted-by: Claude:claude-opus-5[1m] --- test/__snapshots__/next16.test.ts.snap | 4 +- test/next16/package.json | 2 +- yarn.lock | 381 ++++++++++++++----------- 3 files changed, 211 insertions(+), 176 deletions(-) diff --git a/test/__snapshots__/next16.test.ts.snap b/test/__snapshots__/next16.test.ts.snap index eb8abe4..d7e5f31 100644 --- a/test/__snapshots__/next16.test.ts.snap +++ b/test/__snapshots__/next16.test.ts.snap @@ -191,8 +191,8 @@ exports[`mapping a Next.js 16 appmap 1`] = ` "event": "return", "http_server_response": { "headers": { - "Cache-Control": "no-store, must-revalidate", - "Content-Length": "2210", + "Cache-Control": "no-cache, must-revalidate", + "Content-Length": "2272", "Content-Type": "text/html; charset=utf-8", "Vary": "Accept-Encoding", "X-Powered-By": "Next.js", diff --git a/test/next16/package.json b/test/next16/package.json index 10228ff..ecfa42f 100644 --- a/test/next16/package.json +++ b/test/next16/package.json @@ -3,7 +3,7 @@ "packageManager": "yarn@4.13.0", "private": true, "dependencies": { - "next": "^16.1.7", + "next": "^16.2.6", "react": "^19", "react-dom": "^19" }, diff --git a/yarn.lock b/yarn.lock index d9da553..59abe08 100644 --- a/yarn.lock +++ b/yarn.lock @@ -407,12 +407,12 @@ __metadata: languageName: node linkType: hard -"@emnapi/runtime@npm:^1.7.0": - version: 1.8.1 - resolution: "@emnapi/runtime@npm:1.8.1" +"@emnapi/runtime@npm:^1.11.1": + version: 1.11.3 + resolution: "@emnapi/runtime@npm:1.11.3" dependencies: tslib: "npm:^2.4.0" - checksum: 10/26725e202d4baefdc4a6ba770f703dfc80825a27c27a08c22bac1e1ce6f8f75c47b4fe9424d9b63239463c33ef20b650f08d710da18dfa1164a95e5acb865dba + checksum: 10/ec834cc0fe248e06dd84f6dee10162133f8a692636189e99aa992303c791d4be1679536ee91aeee6661c4478609768cee9c085acd858caa92784c67acaab44a5 languageName: node linkType: hard @@ -1057,18 +1057,18 @@ __metadata: languageName: node linkType: hard -"@img/colour@npm:^1.0.0": - version: 1.0.0 - resolution: "@img/colour@npm:1.0.0" - checksum: 10/bd248d7c4b8ba99a72b22a005a63f1d3309ee8343a74b6d0d1314bae300a3096919991a09e9a9243cf6ca50e393b4c5a7e065488ed616c3b58d052473240b812 +"@img/colour@npm:^1.1.0": + version: 1.1.0 + resolution: "@img/colour@npm:1.1.0" + checksum: 10/2a29be7b06b046bd33c80ffa0f3493b7535b0841a69f54af81bf5e2d8867f21704fab42e9cf24ec30c089de34f790bae4dad1fc617c3163fbf264998dc316f0a languageName: node linkType: hard -"@img/sharp-darwin-arm64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-darwin-arm64@npm:0.34.5" +"@img/sharp-darwin-arm64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-darwin-arm64@npm:0.35.3" dependencies: - "@img/sharp-libvips-darwin-arm64": "npm:1.2.4" + "@img/sharp-libvips-darwin-arm64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-darwin-arm64": optional: true @@ -1076,11 +1076,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-darwin-x64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-darwin-x64@npm:0.34.5" +"@img/sharp-darwin-x64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-darwin-x64@npm:0.35.3" dependencies: - "@img/sharp-libvips-darwin-x64": "npm:1.2.4" + "@img/sharp-libvips-darwin-x64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-darwin-x64": optional: true @@ -1088,81 +1088,90 @@ __metadata: languageName: node linkType: hard -"@img/sharp-libvips-darwin-arm64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-darwin-arm64@npm:1.2.4" +"@img/sharp-freebsd-wasm32@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-freebsd-wasm32@npm:0.35.3" + dependencies: + "@img/sharp-wasm32": "npm:0.35.3" + conditions: os=freebsd + languageName: node + linkType: hard + +"@img/sharp-libvips-darwin-arm64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-darwin-arm64@npm:1.3.2" conditions: os=darwin & cpu=arm64 languageName: node linkType: hard -"@img/sharp-libvips-darwin-x64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-darwin-x64@npm:1.2.4" +"@img/sharp-libvips-darwin-x64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-darwin-x64@npm:1.3.2" conditions: os=darwin & cpu=x64 languageName: node linkType: hard -"@img/sharp-libvips-linux-arm64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linux-arm64@npm:1.2.4" +"@img/sharp-libvips-linux-arm64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linux-arm64@npm:1.3.2" conditions: os=linux & cpu=arm64 & libc=glibc languageName: node linkType: hard -"@img/sharp-libvips-linux-arm@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linux-arm@npm:1.2.4" +"@img/sharp-libvips-linux-arm@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linux-arm@npm:1.3.2" conditions: os=linux & cpu=arm & libc=glibc languageName: node linkType: hard -"@img/sharp-libvips-linux-ppc64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linux-ppc64@npm:1.2.4" +"@img/sharp-libvips-linux-ppc64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linux-ppc64@npm:1.3.2" conditions: os=linux & cpu=ppc64 & libc=glibc languageName: node linkType: hard -"@img/sharp-libvips-linux-riscv64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linux-riscv64@npm:1.2.4" +"@img/sharp-libvips-linux-riscv64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linux-riscv64@npm:1.3.2" conditions: os=linux & cpu=riscv64 & libc=glibc languageName: node linkType: hard -"@img/sharp-libvips-linux-s390x@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linux-s390x@npm:1.2.4" +"@img/sharp-libvips-linux-s390x@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linux-s390x@npm:1.3.2" conditions: os=linux & cpu=s390x & libc=glibc languageName: node linkType: hard -"@img/sharp-libvips-linux-x64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linux-x64@npm:1.2.4" +"@img/sharp-libvips-linux-x64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linux-x64@npm:1.3.2" conditions: os=linux & cpu=x64 & libc=glibc languageName: node linkType: hard -"@img/sharp-libvips-linuxmusl-arm64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linuxmusl-arm64@npm:1.2.4" +"@img/sharp-libvips-linuxmusl-arm64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linuxmusl-arm64@npm:1.3.2" conditions: os=linux & cpu=arm64 & libc=musl languageName: node linkType: hard -"@img/sharp-libvips-linuxmusl-x64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linuxmusl-x64@npm:1.2.4" +"@img/sharp-libvips-linuxmusl-x64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linuxmusl-x64@npm:1.3.2" conditions: os=linux & cpu=x64 & libc=musl languageName: node linkType: hard -"@img/sharp-linux-arm64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linux-arm64@npm:0.34.5" +"@img/sharp-linux-arm64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linux-arm64@npm:0.35.3" dependencies: - "@img/sharp-libvips-linux-arm64": "npm:1.2.4" + "@img/sharp-libvips-linux-arm64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linux-arm64": optional: true @@ -1170,11 +1179,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-linux-arm@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linux-arm@npm:0.34.5" +"@img/sharp-linux-arm@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linux-arm@npm:0.35.3" dependencies: - "@img/sharp-libvips-linux-arm": "npm:1.2.4" + "@img/sharp-libvips-linux-arm": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linux-arm": optional: true @@ -1182,11 +1191,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-linux-ppc64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linux-ppc64@npm:0.34.5" +"@img/sharp-linux-ppc64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linux-ppc64@npm:0.35.3" dependencies: - "@img/sharp-libvips-linux-ppc64": "npm:1.2.4" + "@img/sharp-libvips-linux-ppc64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linux-ppc64": optional: true @@ -1194,11 +1203,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-linux-riscv64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linux-riscv64@npm:0.34.5" +"@img/sharp-linux-riscv64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linux-riscv64@npm:0.35.3" dependencies: - "@img/sharp-libvips-linux-riscv64": "npm:1.2.4" + "@img/sharp-libvips-linux-riscv64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linux-riscv64": optional: true @@ -1206,11 +1215,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-linux-s390x@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linux-s390x@npm:0.34.5" +"@img/sharp-linux-s390x@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linux-s390x@npm:0.35.3" dependencies: - "@img/sharp-libvips-linux-s390x": "npm:1.2.4" + "@img/sharp-libvips-linux-s390x": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linux-s390x": optional: true @@ -1218,11 +1227,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-linux-x64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linux-x64@npm:0.34.5" +"@img/sharp-linux-x64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linux-x64@npm:0.35.3" dependencies: - "@img/sharp-libvips-linux-x64": "npm:1.2.4" + "@img/sharp-libvips-linux-x64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linux-x64": optional: true @@ -1230,11 +1239,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-linuxmusl-arm64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linuxmusl-arm64@npm:0.34.5" +"@img/sharp-linuxmusl-arm64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linuxmusl-arm64@npm:0.35.3" dependencies: - "@img/sharp-libvips-linuxmusl-arm64": "npm:1.2.4" + "@img/sharp-libvips-linuxmusl-arm64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linuxmusl-arm64": optional: true @@ -1242,11 +1251,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-linuxmusl-x64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linuxmusl-x64@npm:0.34.5" +"@img/sharp-linuxmusl-x64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linuxmusl-x64@npm:0.35.3" dependencies: - "@img/sharp-libvips-linuxmusl-x64": "npm:1.2.4" + "@img/sharp-libvips-linuxmusl-x64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linuxmusl-x64": optional: true @@ -1254,32 +1263,41 @@ __metadata: languageName: node linkType: hard -"@img/sharp-wasm32@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-wasm32@npm:0.34.5" +"@img/sharp-wasm32@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-wasm32@npm:0.35.3" dependencies: - "@emnapi/runtime": "npm:^1.7.0" + "@emnapi/runtime": "npm:^1.11.1" + checksum: 10/9cad3671879be2448c6252a978af2dc39727e4464d335a3eea5aab6751596b8af68bba9487f5fd2600671807f7d4ec34abfbd78b01ededb48843d904c6a1387d + languageName: node + linkType: hard + +"@img/sharp-webcontainers-wasm32@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-webcontainers-wasm32@npm:0.35.3" + dependencies: + "@img/sharp-wasm32": "npm:0.35.3" conditions: cpu=wasm32 languageName: node linkType: hard -"@img/sharp-win32-arm64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-win32-arm64@npm:0.34.5" +"@img/sharp-win32-arm64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-win32-arm64@npm:0.35.3" conditions: os=win32 & cpu=arm64 languageName: node linkType: hard -"@img/sharp-win32-ia32@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-win32-ia32@npm:0.34.5" +"@img/sharp-win32-ia32@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-win32-ia32@npm:0.35.3" conditions: os=win32 & cpu=ia32 languageName: node linkType: hard -"@img/sharp-win32-x64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-win32-x64@npm:0.34.5" +"@img/sharp-win32-x64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-win32-x64@npm:0.35.3" conditions: os=win32 & cpu=x64 languageName: node linkType: hard @@ -1675,10 +1693,10 @@ __metadata: languageName: node linkType: hard -"@next/env@npm:16.1.7": - version: 16.1.7 - resolution: "@next/env@npm:16.1.7" - checksum: 10/5f05c5e6e2ecfbfb1f2d828c25d916caf0eb6843d414f38916209f6439fa13b4aa942c317e65bf3c2bc7dee4601158ee505096b689f172c36048af8a9b66c6b0 +"@next/env@npm:16.3.1": + version: 16.3.1 + resolution: "@next/env@npm:16.3.1" + checksum: 10/d6cd2906f937c09bab62edd8c0caac2a8b7aba5ce86123db7860ffc5f44f6831b5c0c84bf3615fea04442825694109f64ef167ec74e97e506ebca5c05c9e0078 languageName: node linkType: hard @@ -1689,9 +1707,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-darwin-arm64@npm:16.1.7": - version: 16.1.7 - resolution: "@next/swc-darwin-arm64@npm:16.1.7" +"@next/swc-darwin-arm64@npm:16.3.1": + version: 16.3.1 + resolution: "@next/swc-darwin-arm64@npm:16.3.1" conditions: os=darwin & cpu=arm64 languageName: node linkType: hard @@ -1703,9 +1721,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-darwin-x64@npm:16.1.7": - version: 16.1.7 - resolution: "@next/swc-darwin-x64@npm:16.1.7" +"@next/swc-darwin-x64@npm:16.3.1": + version: 16.3.1 + resolution: "@next/swc-darwin-x64@npm:16.3.1" conditions: os=darwin & cpu=x64 languageName: node linkType: hard @@ -1717,9 +1735,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-linux-arm64-gnu@npm:16.1.7": - version: 16.1.7 - resolution: "@next/swc-linux-arm64-gnu@npm:16.1.7" +"@next/swc-linux-arm64-gnu@npm:16.3.1": + version: 16.3.1 + resolution: "@next/swc-linux-arm64-gnu@npm:16.3.1" conditions: os=linux & cpu=arm64 & libc=glibc languageName: node linkType: hard @@ -1731,9 +1749,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-linux-arm64-musl@npm:16.1.7": - version: 16.1.7 - resolution: "@next/swc-linux-arm64-musl@npm:16.1.7" +"@next/swc-linux-arm64-musl@npm:16.3.1": + version: 16.3.1 + resolution: "@next/swc-linux-arm64-musl@npm:16.3.1" conditions: os=linux & cpu=arm64 & libc=musl languageName: node linkType: hard @@ -1745,9 +1763,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-linux-x64-gnu@npm:16.1.7": - version: 16.1.7 - resolution: "@next/swc-linux-x64-gnu@npm:16.1.7" +"@next/swc-linux-x64-gnu@npm:16.3.1": + version: 16.3.1 + resolution: "@next/swc-linux-x64-gnu@npm:16.3.1" conditions: os=linux & cpu=x64 & libc=glibc languageName: node linkType: hard @@ -1759,9 +1777,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-linux-x64-musl@npm:16.1.7": - version: 16.1.7 - resolution: "@next/swc-linux-x64-musl@npm:16.1.7" +"@next/swc-linux-x64-musl@npm:16.3.1": + version: 16.3.1 + resolution: "@next/swc-linux-x64-musl@npm:16.3.1" conditions: os=linux & cpu=x64 & libc=musl languageName: node linkType: hard @@ -1773,9 +1791,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-win32-arm64-msvc@npm:16.1.7": - version: 16.1.7 - resolution: "@next/swc-win32-arm64-msvc@npm:16.1.7" +"@next/swc-win32-arm64-msvc@npm:16.3.1": + version: 16.3.1 + resolution: "@next/swc-win32-arm64-msvc@npm:16.3.1" conditions: os=win32 & cpu=arm64 languageName: node linkType: hard @@ -1794,9 +1812,9 @@ __metadata: languageName: node linkType: hard -"@next/swc-win32-x64-msvc@npm:16.1.7": - version: 16.1.7 - resolution: "@next/swc-win32-x64-msvc@npm:16.1.7" +"@next/swc-win32-x64-msvc@npm:16.3.1": + version: 16.3.1 + resolution: "@next/swc-win32-x64-msvc@npm:16.3.1" conditions: os=win32 & cpu=x64 languageName: node linkType: hard @@ -2946,12 +2964,12 @@ __metadata: languageName: node linkType: hard -"@swc/helpers@npm:0.5.15": - version: 0.5.15 - resolution: "@swc/helpers@npm:0.5.15" +"@swc/helpers@npm:0.5.23": + version: 0.5.23 + resolution: "@swc/helpers@npm:0.5.23" dependencies: tslib: "npm:^2.8.0" - checksum: 10/e3f32c6deeecfb0fa3f22edff03a7b358e7ce16d27b0f1c8b5cdc3042c5c4ce4da6eac0b781ab7cc4f54696ece657467d56734fb26883439fb00017385364c4c + checksum: 10/899c9761e827d5bf504bd02067596cfe59ad6c7d6b6f0691a2fb05acf3e6c2954ddece7e15d4a6a81e8d95c81500652e6abec326c6c9bbb50bc3e2141696de43 languageName: node linkType: hard @@ -8923,7 +8941,7 @@ __metadata: languageName: node linkType: hard -"nanoid@npm:^3.3.17, nanoid@npm:^3.3.6": +"nanoid@npm:^3.3.16, nanoid@npm:^3.3.17, nanoid@npm:^3.3.6": version: 3.3.18 resolution: "nanoid@npm:3.3.18" bin: @@ -8983,7 +9001,7 @@ __metadata: resolution: "next16-appmap-node-test@workspace:test/next16" dependencies: "@types/react": "npm:^19" - next: "npm:^16.1.7" + next: "npm:^16.2.6" react: "npm:^19" react-dom: "npm:^19" languageName: unknown @@ -9047,24 +9065,24 @@ __metadata: languageName: node linkType: hard -"next@npm:^16.1.7": - version: 16.1.7 - resolution: "next@npm:16.1.7" +"next@npm:^16.2.6": + version: 16.3.1 + resolution: "next@npm:16.3.1" dependencies: - "@next/env": "npm:16.1.7" - "@next/swc-darwin-arm64": "npm:16.1.7" - "@next/swc-darwin-x64": "npm:16.1.7" - "@next/swc-linux-arm64-gnu": "npm:16.1.7" - "@next/swc-linux-arm64-musl": "npm:16.1.7" - "@next/swc-linux-x64-gnu": "npm:16.1.7" - "@next/swc-linux-x64-musl": "npm:16.1.7" - "@next/swc-win32-arm64-msvc": "npm:16.1.7" - "@next/swc-win32-x64-msvc": "npm:16.1.7" - "@swc/helpers": "npm:0.5.15" + "@next/env": "npm:16.3.1" + "@next/swc-darwin-arm64": "npm:16.3.1" + "@next/swc-darwin-x64": "npm:16.3.1" + "@next/swc-linux-arm64-gnu": "npm:16.3.1" + "@next/swc-linux-arm64-musl": "npm:16.3.1" + "@next/swc-linux-x64-gnu": "npm:16.3.1" + "@next/swc-linux-x64-musl": "npm:16.3.1" + "@next/swc-win32-arm64-msvc": "npm:16.3.1" + "@next/swc-win32-x64-msvc": "npm:16.3.1" + "@swc/helpers": "npm:0.5.23" baseline-browser-mapping: "npm:^2.9.19" caniuse-lite: "npm:^1.0.30001579" - postcss: "npm:8.4.31" - sharp: "npm:^0.34.4" + postcss: "npm:8.5.23" + sharp: "npm:^0.35.3" styled-jsx: "npm:5.1.6" peerDependencies: "@opentelemetry/api": ^1.1.0 @@ -9103,7 +9121,7 @@ __metadata: optional: true bin: next: dist/bin/next - checksum: 10/50bfebb84cbcf2091b950d77b78b8877c7de39de705785fe0231c828917a95baffe9c27e84e934b69e294f3e3c07f54a56b4e925b649cf5f5b3140ef3cca3962 + checksum: 10/c1e50b985bdc5c595cfcb15cc0f5d430b536d5d609242e97d51966349c36f250b961212b0d7861deace6d49f9e229ebb447653d5718ab32a15dc6ed953c3988a languageName: node linkType: hard @@ -10179,6 +10197,17 @@ __metadata: languageName: node linkType: hard +"postcss@npm:8.5.23": + version: 8.5.23 + resolution: "postcss@npm:8.5.23" + dependencies: + nanoid: "npm:^3.3.16" + picocolors: "npm:^1.1.1" + source-map-js: "npm:^1.2.1" + checksum: 10/8387f421216696bf62a13e5a270e9fefdafc81e196903c0f8d7653f8bab315367cc2261b3c22cf197e492cb075f31bdfc07fd9c3be1cb165ff3cabe14c5a039a + languageName: node + linkType: hard + "postcss@npm:^8.4.43, postcss@npm:^8.5.25, postcss@npm:^8.5.6": version: 8.5.26 resolution: "postcss@npm:8.5.26" @@ -11097,42 +11126,45 @@ __metadata: languageName: node linkType: hard -"sharp@npm:^0.34.4": - version: 0.34.5 - resolution: "sharp@npm:0.34.5" - dependencies: - "@img/colour": "npm:^1.0.0" - "@img/sharp-darwin-arm64": "npm:0.34.5" - "@img/sharp-darwin-x64": "npm:0.34.5" - "@img/sharp-libvips-darwin-arm64": "npm:1.2.4" - "@img/sharp-libvips-darwin-x64": "npm:1.2.4" - "@img/sharp-libvips-linux-arm": "npm:1.2.4" - "@img/sharp-libvips-linux-arm64": "npm:1.2.4" - "@img/sharp-libvips-linux-ppc64": "npm:1.2.4" - "@img/sharp-libvips-linux-riscv64": "npm:1.2.4" - "@img/sharp-libvips-linux-s390x": "npm:1.2.4" - "@img/sharp-libvips-linux-x64": "npm:1.2.4" - "@img/sharp-libvips-linuxmusl-arm64": "npm:1.2.4" - "@img/sharp-libvips-linuxmusl-x64": "npm:1.2.4" - "@img/sharp-linux-arm": "npm:0.34.5" - "@img/sharp-linux-arm64": "npm:0.34.5" - "@img/sharp-linux-ppc64": "npm:0.34.5" - "@img/sharp-linux-riscv64": "npm:0.34.5" - "@img/sharp-linux-s390x": "npm:0.34.5" - "@img/sharp-linux-x64": "npm:0.34.5" - "@img/sharp-linuxmusl-arm64": "npm:0.34.5" - "@img/sharp-linuxmusl-x64": "npm:0.34.5" - "@img/sharp-wasm32": "npm:0.34.5" - "@img/sharp-win32-arm64": "npm:0.34.5" - "@img/sharp-win32-ia32": "npm:0.34.5" - "@img/sharp-win32-x64": "npm:0.34.5" +"sharp@npm:^0.35.3": + version: 0.35.3 + resolution: "sharp@npm:0.35.3" + dependencies: + "@img/colour": "npm:^1.1.0" + "@img/sharp-darwin-arm64": "npm:0.35.3" + "@img/sharp-darwin-x64": "npm:0.35.3" + "@img/sharp-freebsd-wasm32": "npm:0.35.3" + "@img/sharp-libvips-darwin-arm64": "npm:1.3.2" + "@img/sharp-libvips-darwin-x64": "npm:1.3.2" + "@img/sharp-libvips-linux-arm": "npm:1.3.2" + "@img/sharp-libvips-linux-arm64": "npm:1.3.2" + "@img/sharp-libvips-linux-ppc64": "npm:1.3.2" + "@img/sharp-libvips-linux-riscv64": "npm:1.3.2" + "@img/sharp-libvips-linux-s390x": "npm:1.3.2" + "@img/sharp-libvips-linux-x64": "npm:1.3.2" + "@img/sharp-libvips-linuxmusl-arm64": "npm:1.3.2" + "@img/sharp-libvips-linuxmusl-x64": "npm:1.3.2" + "@img/sharp-linux-arm": "npm:0.35.3" + "@img/sharp-linux-arm64": "npm:0.35.3" + "@img/sharp-linux-ppc64": "npm:0.35.3" + "@img/sharp-linux-riscv64": "npm:0.35.3" + "@img/sharp-linux-s390x": "npm:0.35.3" + "@img/sharp-linux-x64": "npm:0.35.3" + "@img/sharp-linuxmusl-arm64": "npm:0.35.3" + "@img/sharp-linuxmusl-x64": "npm:0.35.3" + "@img/sharp-webcontainers-wasm32": "npm:0.35.3" + "@img/sharp-win32-arm64": "npm:0.35.3" + "@img/sharp-win32-ia32": "npm:0.35.3" + "@img/sharp-win32-x64": "npm:0.35.3" detect-libc: "npm:^2.1.2" - semver: "npm:^7.7.3" + semver: "npm:^7.8.5" dependenciesMeta: "@img/sharp-darwin-arm64": optional: true "@img/sharp-darwin-x64": optional: true + "@img/sharp-freebsd-wasm32": + optional: true "@img/sharp-libvips-darwin-arm64": optional: true "@img/sharp-libvips-darwin-x64": @@ -11169,7 +11201,7 @@ __metadata: optional: true "@img/sharp-linuxmusl-x64": optional: true - "@img/sharp-wasm32": + "@img/sharp-webcontainers-wasm32": optional: true "@img/sharp-win32-arm64": optional: true @@ -11177,7 +11209,10 @@ __metadata: optional: true "@img/sharp-win32-x64": optional: true - checksum: 10/d62bc638c8ad382dffc266beeaffab71457d592abeb6fdf95b512e6dcbce0abf47b8d903b4ea081f012ceb40e4462f1e219184c729329146df32a5ccec2c231f + peerDependenciesMeta: + "@types/node": + optional: true + checksum: 10/5f5c7739421f470d18e1b0d8160342103530724f59e3ef11d9cf15d5ec22e36fd2226d3c8f15ac72b3da947605c4076faf9ab8902e08575ed950c6f48a36ffa8 languageName: node linkType: hard From 637ff8617f26875ec4c9aacd890cbb2135fde4e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Rzepecki?= Date: Mon, 17 Aug 2026 11:29:49 +0200 Subject: [PATCH 05/11] chore(deps): bump vite to 7.3.6 and esbuild to 0.28.2 vite 7.3.1 -> 7.3.6 in the test/vitest3 dependency chain fixes GHSA-4w7w-66w2-5vf9 (path traversal in optimized-deps `.map` handling), GHSA-v2wj-q39q-566r and GHSA-fx2h-pf6j-xcff (`server.fs.deny` bypasses), GHSA-p9ff-h696-f583 (arbitrary file read via the dev-server WebSocket) and GHSA-v6wh-96g9-6wx3 (launch-editor NTLMv2 hash disclosure on Windows). The transitive esbuild 0.27.3 -> 0.28.2 that comes with it fixes GHSA-g7r4-m6w7-qqqr (arbitrary file read when running the dev server on Windows). vitest 3.2.7 already allows `^7.0.0-0`, so this is a lockfile-only change. Assisted-by: Claude:claude-opus-5[1m] --- yarn.lock | 497 +++++++++++++----------------------------------------- 1 file changed, 113 insertions(+), 384 deletions(-) diff --git a/yarn.lock b/yarn.lock index 59abe08..afa6e89 100644 --- a/yarn.lock +++ b/yarn.lock @@ -423,16 +423,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/aix-ppc64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/aix-ppc64@npm:0.27.3" - conditions: os=aix & cpu=ppc64 - languageName: node - linkType: hard - -"@esbuild/aix-ppc64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/aix-ppc64@npm:0.28.1" +"@esbuild/aix-ppc64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/aix-ppc64@npm:0.28.2" conditions: os=aix & cpu=ppc64 languageName: node linkType: hard @@ -444,16 +437,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/android-arm64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/android-arm64@npm:0.27.3" - conditions: os=android & cpu=arm64 - languageName: node - linkType: hard - -"@esbuild/android-arm64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/android-arm64@npm:0.28.1" +"@esbuild/android-arm64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/android-arm64@npm:0.28.2" conditions: os=android & cpu=arm64 languageName: node linkType: hard @@ -465,16 +451,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/android-arm@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/android-arm@npm:0.27.3" - conditions: os=android & cpu=arm - languageName: node - linkType: hard - -"@esbuild/android-arm@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/android-arm@npm:0.28.1" +"@esbuild/android-arm@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/android-arm@npm:0.28.2" conditions: os=android & cpu=arm languageName: node linkType: hard @@ -486,16 +465,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/android-x64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/android-x64@npm:0.27.3" - conditions: os=android & cpu=x64 - languageName: node - linkType: hard - -"@esbuild/android-x64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/android-x64@npm:0.28.1" +"@esbuild/android-x64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/android-x64@npm:0.28.2" conditions: os=android & cpu=x64 languageName: node linkType: hard @@ -507,16 +479,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/darwin-arm64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/darwin-arm64@npm:0.27.3" - conditions: os=darwin & cpu=arm64 - languageName: node - linkType: hard - -"@esbuild/darwin-arm64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/darwin-arm64@npm:0.28.1" +"@esbuild/darwin-arm64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/darwin-arm64@npm:0.28.2" conditions: os=darwin & cpu=arm64 languageName: node linkType: hard @@ -528,16 +493,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/darwin-x64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/darwin-x64@npm:0.27.3" - conditions: os=darwin & cpu=x64 - languageName: node - linkType: hard - -"@esbuild/darwin-x64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/darwin-x64@npm:0.28.1" +"@esbuild/darwin-x64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/darwin-x64@npm:0.28.2" conditions: os=darwin & cpu=x64 languageName: node linkType: hard @@ -549,16 +507,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/freebsd-arm64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/freebsd-arm64@npm:0.27.3" - conditions: os=freebsd & cpu=arm64 - languageName: node - linkType: hard - -"@esbuild/freebsd-arm64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/freebsd-arm64@npm:0.28.1" +"@esbuild/freebsd-arm64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/freebsd-arm64@npm:0.28.2" conditions: os=freebsd & cpu=arm64 languageName: node linkType: hard @@ -570,16 +521,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/freebsd-x64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/freebsd-x64@npm:0.27.3" - conditions: os=freebsd & cpu=x64 - languageName: node - linkType: hard - -"@esbuild/freebsd-x64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/freebsd-x64@npm:0.28.1" +"@esbuild/freebsd-x64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/freebsd-x64@npm:0.28.2" conditions: os=freebsd & cpu=x64 languageName: node linkType: hard @@ -591,16 +535,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-arm64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/linux-arm64@npm:0.27.3" - conditions: os=linux & cpu=arm64 - languageName: node - linkType: hard - -"@esbuild/linux-arm64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/linux-arm64@npm:0.28.1" +"@esbuild/linux-arm64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/linux-arm64@npm:0.28.2" conditions: os=linux & cpu=arm64 languageName: node linkType: hard @@ -612,16 +549,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-arm@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/linux-arm@npm:0.27.3" - conditions: os=linux & cpu=arm - languageName: node - linkType: hard - -"@esbuild/linux-arm@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/linux-arm@npm:0.28.1" +"@esbuild/linux-arm@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/linux-arm@npm:0.28.2" conditions: os=linux & cpu=arm languageName: node linkType: hard @@ -633,16 +563,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-ia32@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/linux-ia32@npm:0.27.3" - conditions: os=linux & cpu=ia32 - languageName: node - linkType: hard - -"@esbuild/linux-ia32@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/linux-ia32@npm:0.28.1" +"@esbuild/linux-ia32@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/linux-ia32@npm:0.28.2" conditions: os=linux & cpu=ia32 languageName: node linkType: hard @@ -654,16 +577,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-loong64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/linux-loong64@npm:0.27.3" - conditions: os=linux & cpu=loong64 - languageName: node - linkType: hard - -"@esbuild/linux-loong64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/linux-loong64@npm:0.28.1" +"@esbuild/linux-loong64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/linux-loong64@npm:0.28.2" conditions: os=linux & cpu=loong64 languageName: node linkType: hard @@ -675,16 +591,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-mips64el@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/linux-mips64el@npm:0.27.3" - conditions: os=linux & cpu=mips64el - languageName: node - linkType: hard - -"@esbuild/linux-mips64el@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/linux-mips64el@npm:0.28.1" +"@esbuild/linux-mips64el@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/linux-mips64el@npm:0.28.2" conditions: os=linux & cpu=mips64el languageName: node linkType: hard @@ -696,16 +605,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-ppc64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/linux-ppc64@npm:0.27.3" - conditions: os=linux & cpu=ppc64 - languageName: node - linkType: hard - -"@esbuild/linux-ppc64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/linux-ppc64@npm:0.28.1" +"@esbuild/linux-ppc64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/linux-ppc64@npm:0.28.2" conditions: os=linux & cpu=ppc64 languageName: node linkType: hard @@ -717,16 +619,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-riscv64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/linux-riscv64@npm:0.27.3" - conditions: os=linux & cpu=riscv64 - languageName: node - linkType: hard - -"@esbuild/linux-riscv64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/linux-riscv64@npm:0.28.1" +"@esbuild/linux-riscv64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/linux-riscv64@npm:0.28.2" conditions: os=linux & cpu=riscv64 languageName: node linkType: hard @@ -738,16 +633,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-s390x@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/linux-s390x@npm:0.27.3" - conditions: os=linux & cpu=s390x - languageName: node - linkType: hard - -"@esbuild/linux-s390x@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/linux-s390x@npm:0.28.1" +"@esbuild/linux-s390x@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/linux-s390x@npm:0.28.2" conditions: os=linux & cpu=s390x languageName: node linkType: hard @@ -759,30 +647,16 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-x64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/linux-x64@npm:0.27.3" - conditions: os=linux & cpu=x64 - languageName: node - linkType: hard - -"@esbuild/linux-x64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/linux-x64@npm:0.28.1" +"@esbuild/linux-x64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/linux-x64@npm:0.28.2" conditions: os=linux & cpu=x64 languageName: node linkType: hard -"@esbuild/netbsd-arm64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/netbsd-arm64@npm:0.27.3" - conditions: os=netbsd & cpu=arm64 - languageName: node - linkType: hard - -"@esbuild/netbsd-arm64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/netbsd-arm64@npm:0.28.1" +"@esbuild/netbsd-arm64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/netbsd-arm64@npm:0.28.2" conditions: os=netbsd & cpu=arm64 languageName: node linkType: hard @@ -794,30 +668,16 @@ __metadata: languageName: node linkType: hard -"@esbuild/netbsd-x64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/netbsd-x64@npm:0.27.3" - conditions: os=netbsd & cpu=x64 - languageName: node - linkType: hard - -"@esbuild/netbsd-x64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/netbsd-x64@npm:0.28.1" +"@esbuild/netbsd-x64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/netbsd-x64@npm:0.28.2" conditions: os=netbsd & cpu=x64 languageName: node linkType: hard -"@esbuild/openbsd-arm64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/openbsd-arm64@npm:0.27.3" - conditions: os=openbsd & cpu=arm64 - languageName: node - linkType: hard - -"@esbuild/openbsd-arm64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/openbsd-arm64@npm:0.28.1" +"@esbuild/openbsd-arm64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/openbsd-arm64@npm:0.28.2" conditions: os=openbsd & cpu=arm64 languageName: node linkType: hard @@ -829,30 +689,16 @@ __metadata: languageName: node linkType: hard -"@esbuild/openbsd-x64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/openbsd-x64@npm:0.27.3" +"@esbuild/openbsd-x64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/openbsd-x64@npm:0.28.2" conditions: os=openbsd & cpu=x64 languageName: node linkType: hard -"@esbuild/openbsd-x64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/openbsd-x64@npm:0.28.1" - conditions: os=openbsd & cpu=x64 - languageName: node - linkType: hard - -"@esbuild/openharmony-arm64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/openharmony-arm64@npm:0.27.3" - conditions: os=openharmony & cpu=arm64 - languageName: node - linkType: hard - -"@esbuild/openharmony-arm64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/openharmony-arm64@npm:0.28.1" +"@esbuild/openharmony-arm64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/openharmony-arm64@npm:0.28.2" conditions: os=openharmony & cpu=arm64 languageName: node linkType: hard @@ -864,16 +710,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/sunos-x64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/sunos-x64@npm:0.27.3" - conditions: os=sunos & cpu=x64 - languageName: node - linkType: hard - -"@esbuild/sunos-x64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/sunos-x64@npm:0.28.1" +"@esbuild/sunos-x64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/sunos-x64@npm:0.28.2" conditions: os=sunos & cpu=x64 languageName: node linkType: hard @@ -885,16 +724,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/win32-arm64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/win32-arm64@npm:0.27.3" - conditions: os=win32 & cpu=arm64 - languageName: node - linkType: hard - -"@esbuild/win32-arm64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/win32-arm64@npm:0.28.1" +"@esbuild/win32-arm64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/win32-arm64@npm:0.28.2" conditions: os=win32 & cpu=arm64 languageName: node linkType: hard @@ -906,16 +738,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/win32-ia32@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/win32-ia32@npm:0.27.3" - conditions: os=win32 & cpu=ia32 - languageName: node - linkType: hard - -"@esbuild/win32-ia32@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/win32-ia32@npm:0.28.1" +"@esbuild/win32-ia32@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/win32-ia32@npm:0.28.2" conditions: os=win32 & cpu=ia32 languageName: node linkType: hard @@ -927,16 +752,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/win32-x64@npm:0.27.3": - version: 0.27.3 - resolution: "@esbuild/win32-x64@npm:0.27.3" - conditions: os=win32 & cpu=x64 - languageName: node - linkType: hard - -"@esbuild/win32-x64@npm:0.28.1": - version: 0.28.1 - resolution: "@esbuild/win32-x64@npm:0.28.1" +"@esbuild/win32-x64@npm:0.28.2": + version: 0.28.2 + resolution: "@esbuild/win32-x64@npm:0.28.2" conditions: os=win32 & cpu=x64 languageName: node linkType: hard @@ -5535,125 +5353,36 @@ __metadata: languageName: node linkType: hard -"esbuild@npm:^0.27.0": - version: 0.27.3 - resolution: "esbuild@npm:0.27.3" - dependencies: - "@esbuild/aix-ppc64": "npm:0.27.3" - "@esbuild/android-arm": "npm:0.27.3" - "@esbuild/android-arm64": "npm:0.27.3" - "@esbuild/android-x64": "npm:0.27.3" - "@esbuild/darwin-arm64": "npm:0.27.3" - "@esbuild/darwin-x64": "npm:0.27.3" - "@esbuild/freebsd-arm64": "npm:0.27.3" - "@esbuild/freebsd-x64": "npm:0.27.3" - "@esbuild/linux-arm": "npm:0.27.3" - "@esbuild/linux-arm64": "npm:0.27.3" - "@esbuild/linux-ia32": "npm:0.27.3" - "@esbuild/linux-loong64": "npm:0.27.3" - "@esbuild/linux-mips64el": "npm:0.27.3" - "@esbuild/linux-ppc64": "npm:0.27.3" - "@esbuild/linux-riscv64": "npm:0.27.3" - "@esbuild/linux-s390x": "npm:0.27.3" - "@esbuild/linux-x64": "npm:0.27.3" - "@esbuild/netbsd-arm64": "npm:0.27.3" - "@esbuild/netbsd-x64": "npm:0.27.3" - "@esbuild/openbsd-arm64": "npm:0.27.3" - "@esbuild/openbsd-x64": "npm:0.27.3" - "@esbuild/openharmony-arm64": "npm:0.27.3" - "@esbuild/sunos-x64": "npm:0.27.3" - "@esbuild/win32-arm64": "npm:0.27.3" - "@esbuild/win32-ia32": "npm:0.27.3" - "@esbuild/win32-x64": "npm:0.27.3" - dependenciesMeta: - "@esbuild/aix-ppc64": - optional: true - "@esbuild/android-arm": - optional: true - "@esbuild/android-arm64": - optional: true - "@esbuild/android-x64": - optional: true - "@esbuild/darwin-arm64": - optional: true - "@esbuild/darwin-x64": - optional: true - "@esbuild/freebsd-arm64": - optional: true - "@esbuild/freebsd-x64": - optional: true - "@esbuild/linux-arm": - optional: true - "@esbuild/linux-arm64": - optional: true - "@esbuild/linux-ia32": - optional: true - "@esbuild/linux-loong64": - optional: true - "@esbuild/linux-mips64el": - optional: true - "@esbuild/linux-ppc64": - optional: true - "@esbuild/linux-riscv64": - optional: true - "@esbuild/linux-s390x": - optional: true - "@esbuild/linux-x64": - optional: true - "@esbuild/netbsd-arm64": - optional: true - "@esbuild/netbsd-x64": - optional: true - "@esbuild/openbsd-arm64": - optional: true - "@esbuild/openbsd-x64": - optional: true - "@esbuild/openharmony-arm64": - optional: true - "@esbuild/sunos-x64": - optional: true - "@esbuild/win32-arm64": - optional: true - "@esbuild/win32-ia32": - optional: true - "@esbuild/win32-x64": - optional: true - bin: - esbuild: bin/esbuild - checksum: 10/aa74b8d8a3ed8e2eea4d8421737b322f4d21215244e8fa2156c6402d49b5bda01343c220196f1e3f830a7ce92b54ef653c6c723a8cc2e912bb4d17b7398b51ae - languageName: node - linkType: hard - -"esbuild@npm:^0.28.1": - version: 0.28.1 - resolution: "esbuild@npm:0.28.1" - dependencies: - "@esbuild/aix-ppc64": "npm:0.28.1" - "@esbuild/android-arm": "npm:0.28.1" - "@esbuild/android-arm64": "npm:0.28.1" - "@esbuild/android-x64": "npm:0.28.1" - "@esbuild/darwin-arm64": "npm:0.28.1" - "@esbuild/darwin-x64": "npm:0.28.1" - "@esbuild/freebsd-arm64": "npm:0.28.1" - "@esbuild/freebsd-x64": "npm:0.28.1" - "@esbuild/linux-arm": "npm:0.28.1" - "@esbuild/linux-arm64": "npm:0.28.1" - "@esbuild/linux-ia32": "npm:0.28.1" - "@esbuild/linux-loong64": "npm:0.28.1" - "@esbuild/linux-mips64el": "npm:0.28.1" - "@esbuild/linux-ppc64": "npm:0.28.1" - "@esbuild/linux-riscv64": "npm:0.28.1" - "@esbuild/linux-s390x": "npm:0.28.1" - "@esbuild/linux-x64": "npm:0.28.1" - "@esbuild/netbsd-arm64": "npm:0.28.1" - "@esbuild/netbsd-x64": "npm:0.28.1" - "@esbuild/openbsd-arm64": "npm:0.28.1" - "@esbuild/openbsd-x64": "npm:0.28.1" - "@esbuild/openharmony-arm64": "npm:0.28.1" - "@esbuild/sunos-x64": "npm:0.28.1" - "@esbuild/win32-arm64": "npm:0.28.1" - "@esbuild/win32-ia32": "npm:0.28.1" - "@esbuild/win32-x64": "npm:0.28.1" +"esbuild@npm:^0.27.0 || ^0.28.0, esbuild@npm:^0.28.1": + version: 0.28.2 + resolution: "esbuild@npm:0.28.2" + dependencies: + "@esbuild/aix-ppc64": "npm:0.28.2" + "@esbuild/android-arm": "npm:0.28.2" + "@esbuild/android-arm64": "npm:0.28.2" + "@esbuild/android-x64": "npm:0.28.2" + "@esbuild/darwin-arm64": "npm:0.28.2" + "@esbuild/darwin-x64": "npm:0.28.2" + "@esbuild/freebsd-arm64": "npm:0.28.2" + "@esbuild/freebsd-x64": "npm:0.28.2" + "@esbuild/linux-arm": "npm:0.28.2" + "@esbuild/linux-arm64": "npm:0.28.2" + "@esbuild/linux-ia32": "npm:0.28.2" + "@esbuild/linux-loong64": "npm:0.28.2" + "@esbuild/linux-mips64el": "npm:0.28.2" + "@esbuild/linux-ppc64": "npm:0.28.2" + "@esbuild/linux-riscv64": "npm:0.28.2" + "@esbuild/linux-s390x": "npm:0.28.2" + "@esbuild/linux-x64": "npm:0.28.2" + "@esbuild/netbsd-arm64": "npm:0.28.2" + "@esbuild/netbsd-x64": "npm:0.28.2" + "@esbuild/openbsd-arm64": "npm:0.28.2" + "@esbuild/openbsd-x64": "npm:0.28.2" + "@esbuild/openharmony-arm64": "npm:0.28.2" + "@esbuild/sunos-x64": "npm:0.28.2" + "@esbuild/win32-arm64": "npm:0.28.2" + "@esbuild/win32-ia32": "npm:0.28.2" + "@esbuild/win32-x64": "npm:0.28.2" dependenciesMeta: "@esbuild/aix-ppc64": optional: true @@ -5709,7 +5438,7 @@ __metadata: optional: true bin: esbuild: bin/esbuild - checksum: 10/aaa4a922644afffac45e735c99caf343f881e2d36abcc6b6fb53c230bd69940504a5bb6b0041bdd1a690e748ebc681d3308a7d178987c523d74c63c2c280bac8 + checksum: 10/c21a050b308c6f4b99e1a6ed458661d49b83b424b05c5e0851072f7b01fc2999910754454f6833599175d6c94102d99e400849dd67cfcbeef4f0aec7dfa504a6 languageName: node linkType: hard @@ -12649,10 +12378,10 @@ __metadata: linkType: hard "vite@npm:^5.0.0 || ^6.0.0 || ^7.0.0-0": - version: 7.3.1 - resolution: "vite@npm:7.3.1" + version: 7.3.6 + resolution: "vite@npm:7.3.6" dependencies: - esbuild: "npm:^0.27.0" + esbuild: "npm:^0.27.0 || ^0.28.0" fdir: "npm:^6.5.0" fsevents: "npm:~2.3.3" picomatch: "npm:^4.0.3" @@ -12699,7 +12428,7 @@ __metadata: optional: true bin: vite: bin/vite.js - checksum: 10/62e48ffa4283b688f0049005405a004447ad38ffc99a0efea4c3aa9b7eed739f7402b43f00668c0ee5a895b684dc953d62f0722d8a92c5b2f6c95f051bceb208 + checksum: 10/6fcbadb1a409990e1bbd4ff0ff41e763c87049228cdc407984bdca40b96ab32de0f1f70fa62fb1f3ca001a5b90accbbe22ddfad5cc436855058357b3f2141d3b languageName: node linkType: hard From 029011243f1de06c5eea490497ce4ddf1f52bc38 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Rzepecki?= Date: Mon, 17 Aug 2026 11:32:03 +0200 Subject: [PATCH 06/11] chore(deps): bump sqlite3 to 5.1.7 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 5.1.7 replaces the unmaintained @mapbox/node-pre-gyp with prebuild-install, which drops @mapbox/node-pre-gyp and its rimraf 3.0.2 / gauge 3.0.2 / are-we-there-yet 2.0.0 subtree out of the installed graph. Two caveats, both cosmetic as far as `yarn npm audit -AR` is concerned: - sqlite3 5.1.7 still declares `node-gyp: 8.x` as an *optional* dependency, so the deprecated node-gyp 8.4.1 subtree (npmlog, gauge, are-we-there-yet, rimraf, cacache 15.3.0, @npmcli/move-file, @tootallnate/once, inflight) is still reachable in the lockfile and still reported. It is optional and not linked, so nothing is actually installed from it. Clearing it needs sqlite3 6.x (node-gyp 12.x), which requires Node >=20.17.0 against our declared `engines.node: >=18` — deferred. - prebuild-install is itself deprecated with no successor, so the audit trades one deprecation notice for another. sqlite3 6.x depends on prebuild-install too, so this is unavoidable either way. Assisted-by: Claude:claude-opus-5[1m] --- test/sqlite/package.json | 2 +- yarn.lock | 363 +++++++++++++++++++++++++-------------- 2 files changed, 236 insertions(+), 129 deletions(-) diff --git a/test/sqlite/package.json b/test/sqlite/package.json index 59575e7..fe67912 100644 --- a/test/sqlite/package.json +++ b/test/sqlite/package.json @@ -2,7 +2,7 @@ "name": "sqlite-appmap-node-test", "packageManager": "yarn@4.13.0", "dependencies": { - "sqlite3": "^5.1.6" + "sqlite3": "^5.1.7" }, "private": true } diff --git a/yarn.lock b/yarn.lock index afa6e89..ab9bf09 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1476,25 +1476,6 @@ __metadata: languageName: node linkType: hard -"@mapbox/node-pre-gyp@npm:^1.0.0": - version: 1.0.11 - resolution: "@mapbox/node-pre-gyp@npm:1.0.11" - dependencies: - detect-libc: "npm:^2.0.0" - https-proxy-agent: "npm:^5.0.0" - make-dir: "npm:^3.1.0" - node-fetch: "npm:^2.6.7" - nopt: "npm:^5.0.0" - npmlog: "npm:^5.0.1" - rimraf: "npm:^3.0.2" - semver: "npm:^7.3.5" - tar: "npm:^6.1.11" - bin: - node-pre-gyp: bin/node-pre-gyp - checksum: 10/59529a2444e44fddb63057152452b00705aa58059079191126c79ac1388ae4565625afa84ed4dd1bf017d1111ab6e47907f7c5192e06d83c9496f2f3e708680a - languageName: node - linkType: hard - "@mongodb-js/saslprep@npm:^1.1.0": version: 1.1.4 resolution: "@mongodb-js/saslprep@npm:1.1.4" @@ -3958,16 +3939,6 @@ __metadata: languageName: node linkType: hard -"are-we-there-yet@npm:^2.0.0": - version: 2.0.0 - resolution: "are-we-there-yet@npm:2.0.0" - dependencies: - delegates: "npm:^1.0.0" - readable-stream: "npm:^3.6.0" - checksum: 10/ea6f47d14fc33ae9cbea3e686eeca021d9d7b9db83a306010dd04ad5f2c8b7675291b127d3fcbfcbd8fec26e47b3324ad5b469a6cc3733a582f2fe4e12fc6756 - languageName: node - linkType: hard - "are-we-there-yet@npm:^3.0.0": version: 3.0.1 resolution: "are-we-there-yet@npm:3.0.1" @@ -4149,6 +4120,13 @@ __metadata: languageName: node linkType: hard +"base64-js@npm:^1.3.1": + version: 1.5.1 + resolution: "base64-js@npm:1.5.1" + checksum: 10/669632eb3745404c2f822a18fc3a0122d2f9a7a13f7fb8b5823ee19d1d2ff9ee5b52c53367176ea4ad093c332fd5ab4bd0ebae5a8e27917a4105a4cfc86b1005 + languageName: node + linkType: hard + "baseline-browser-mapping@npm:^2.10.12, baseline-browser-mapping@npm:^2.9.19": version: 2.10.38 resolution: "baseline-browser-mapping@npm:2.10.38" @@ -4199,6 +4177,26 @@ __metadata: languageName: node linkType: hard +"bindings@npm:^1.5.0": + version: 1.5.0 + resolution: "bindings@npm:1.5.0" + dependencies: + file-uri-to-path: "npm:1.0.0" + checksum: 10/593d5ae975ffba15fbbb4788fe5abd1e125afbab849ab967ab43691d27d6483751805d98cb92f7ac24a2439a8a8678cd0131c535d5d63de84e383b0ce2786133 + languageName: node + linkType: hard + +"bl@npm:^4.0.3": + version: 4.1.0 + resolution: "bl@npm:4.1.0" + dependencies: + buffer: "npm:^5.5.0" + inherits: "npm:^2.0.4" + readable-stream: "npm:^3.4.0" + checksum: 10/b7904e66ed0bdfc813c06ea6c3e35eafecb104369dbf5356d0f416af90c1546de3b74e5b63506f0629acf5e16a6f87c3798f16233dcff086e9129383aa02ab55 + languageName: node + linkType: hard + "body-parser@npm:^2.2.1": version: 2.3.0 resolution: "body-parser@npm:2.3.0" @@ -4312,6 +4310,16 @@ __metadata: languageName: node linkType: hard +"buffer@npm:^5.5.0": + version: 5.7.1 + resolution: "buffer@npm:5.7.1" + dependencies: + base64-js: "npm:^1.3.1" + ieee754: "npm:^1.1.13" + checksum: 10/997434d3c6e3b39e0be479a80288875f71cd1c07d75a3855e6f08ef848a3c966023f79534e22e415ff3a5112708ce06127277ab20e527146d55c84566405c7c6 + languageName: node + linkType: hard + "busboy@npm:1.6.0": version: 1.6.0 resolution: "busboy@npm:1.6.0" @@ -4559,6 +4567,13 @@ __metadata: languageName: node linkType: hard +"chownr@npm:^1.1.1": + version: 1.1.4 + resolution: "chownr@npm:1.1.4" + checksum: 10/115648f8eb38bac5e41c3857f3e663f9c39ed6480d1349977c4d96c95a47266fcacc5a5aabf3cb6c481e22d72f41992827db47301851766c4fd77ac21a4f081d + languageName: node + linkType: hard + "chownr@npm:^2.0.0": version: 2.0.0 resolution: "chownr@npm:2.0.0" @@ -4739,7 +4754,7 @@ __metadata: languageName: node linkType: hard -"color-support@npm:^1.1.2, color-support@npm:^1.1.3": +"color-support@npm:^1.1.3": version: 1.1.3 resolution: "color-support@npm:1.1.3" bin: @@ -4789,7 +4804,7 @@ __metadata: languageName: node linkType: hard -"console-control-strings@npm:^1.0.0, console-control-strings@npm:^1.1.0": +"console-control-strings@npm:^1.1.0": version: 1.1.0 resolution: "console-control-strings@npm:1.1.0" checksum: 10/27b5fa302bc8e9ae9e98c03c66d76ca289ad0c61ce2fe20ab288d288bee875d217512d2edb2363fc83165e88f1c405180cf3f5413a46e51b4fe1a004840c6cdb @@ -4981,6 +4996,15 @@ __metadata: languageName: node linkType: hard +"decompress-response@npm:^6.0.0": + version: 6.0.0 + resolution: "decompress-response@npm:6.0.0" + dependencies: + mimic-response: "npm:^3.1.0" + checksum: 10/d377cf47e02d805e283866c3f50d3d21578b779731e8c5072d6ce8c13cc31493db1c2f6784da9d1d5250822120cefa44f1deab112d5981015f2e17444b763812 + languageName: node + linkType: hard + "dedent@npm:^1.0.0": version: 1.5.1 resolution: "dedent@npm:1.5.1" @@ -5196,6 +5220,15 @@ __metadata: languageName: node linkType: hard +"end-of-stream@npm:^1.1.0, end-of-stream@npm:^1.4.1": + version: 1.4.5 + resolution: "end-of-stream@npm:1.4.5" + dependencies: + once: "npm:^1.4.0" + checksum: 10/1e0cfa6e7f49887544e03314f9dfc56a8cb6dde910cbb445983ecc2ff426fc05946df9d75d8a21a3a64f2cecfe1bf88f773952029f46756b2ed64a24e95b1fb8 + languageName: node + linkType: hard + "env-ci@npm:^11.0.0, env-ci@npm:^11.2.0": version: 11.2.0 resolution: "env-ci@npm:11.2.0" @@ -5736,6 +5769,13 @@ __metadata: languageName: node linkType: hard +"expand-template@npm:^2.0.3": + version: 2.0.3 + resolution: "expand-template@npm:2.0.3" + checksum: 10/588c19847216421ed92befb521767b7018dc88f88b0576df98cb242f20961425e96a92cbece525ef28cc5becceae5d544ae0f5b9b5e2aa05acb13716ca5b3099 + languageName: node + linkType: hard + "expect-type@npm:^1.1.0, expect-type@npm:^1.2.1, expect-type@npm:^1.3.0": version: 1.4.0 resolution: "expect-type@npm:1.4.0" @@ -5904,6 +5944,13 @@ __metadata: languageName: node linkType: hard +"file-uri-to-path@npm:1.0.0": + version: 1.0.0 + resolution: "file-uri-to-path@npm:1.0.0" + checksum: 10/b648580bdd893a008c92c7ecc96c3ee57a5e7b6c4c18a9a09b44fb5d36d79146f8e442578bc0e173dc027adf3987e254ba1dfd6e3ec998b7c282873010502144 + languageName: node + linkType: hard + "fill-range@npm:^7.1.1": version: 7.1.1 resolution: "fill-range@npm:7.1.1" @@ -6023,6 +6070,13 @@ __metadata: languageName: node linkType: hard +"fs-constants@npm:^1.0.0": + version: 1.0.0 + resolution: "fs-constants@npm:1.0.0" + checksum: 10/18f5b718371816155849475ac36c7d0b24d39a11d91348cfcb308b4494824413e03572c403c86d3a260e049465518c4f0d5bd00f0371cdfcad6d4f30a85b350d + languageName: node + linkType: hard + "fs-extra@npm:^11.0.0": version: 11.1.1 resolution: "fs-extra@npm:11.1.1" @@ -6092,23 +6146,6 @@ __metadata: languageName: node linkType: hard -"gauge@npm:^3.0.0": - version: 3.0.2 - resolution: "gauge@npm:3.0.2" - dependencies: - aproba: "npm:^1.0.3 || ^2.0.0" - color-support: "npm:^1.1.2" - console-control-strings: "npm:^1.0.0" - has-unicode: "npm:^2.0.1" - object-assign: "npm:^4.1.1" - signal-exit: "npm:^3.0.0" - string-width: "npm:^4.2.3" - strip-ansi: "npm:^6.0.1" - wide-align: "npm:^1.1.2" - checksum: 10/46df086451672a5fecd58f7ec86da74542c795f8e00153fbef2884286ce0e86653c3eb23be2d0abb0c4a82b9b2a9dec3b09b6a1cf31c28085fa0376599a26589 - languageName: node - linkType: hard - "gauge@npm:^4.0.3": version: 4.0.4 resolution: "gauge@npm:4.0.4" @@ -6236,6 +6273,13 @@ __metadata: languageName: node linkType: hard +"github-from-package@npm:0.0.0": + version: 0.0.0 + resolution: "github-from-package@npm:0.0.0" + checksum: 10/2a091ba07fbce22205642543b4ea8aaf068397e1433c00ae0f9de36a3607baf5bcc14da97fbb798cfca6393b3c402031fca06d8b491a44206d6efef391c58537 + languageName: node + linkType: hard + "glob-parent@npm:^5.1.2, glob-parent@npm:~5.1.2": version: 5.1.2 resolution: "glob-parent@npm:5.1.2" @@ -6607,6 +6651,13 @@ __metadata: languageName: node linkType: hard +"ieee754@npm:^1.1.13": + version: 1.2.1 + resolution: "ieee754@npm:1.2.1" + checksum: 10/d9f2557a59036f16c282aaeb107832dc957a93d73397d89bbad4eb1130560560eb695060145e8e6b3b498b15ab95510226649a0b8f52ae06583575419fe10fc4 + languageName: node + linkType: hard + "ignore-walk@npm:^8.0.0": version: 8.0.0 resolution: "ignore-walk@npm:8.0.0" @@ -6714,7 +6765,7 @@ __metadata: languageName: node linkType: hard -"inherits@npm:2, inherits@npm:^2.0.3, inherits@npm:~2.0.3, inherits@npm:~2.0.4": +"inherits@npm:2, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.3, inherits@npm:~2.0.4": version: 2.0.4 resolution: "inherits@npm:2.0.4" checksum: 10/cd45e923bee15186c07fa4c89db0aace24824c482fb887b528304694b2aa6ff8a898da8657046a5dcf3e46cd6db6c61629551f9215f208d7c3f157cf9b290521 @@ -8105,15 +8156,6 @@ __metadata: languageName: node linkType: hard -"make-dir@npm:^3.1.0": - version: 3.1.0 - resolution: "make-dir@npm:3.1.0" - dependencies: - semver: "npm:^6.0.0" - checksum: 10/484200020ab5a1fdf12f393fe5f385fc8e4378824c940fba1729dcd198ae4ff24867bc7a5646331e50cead8abff5d9270c456314386e629acec6dff4b8016b78 - languageName: node - linkType: hard - "make-dir@npm:^4.0.0": version: 4.0.0 resolution: "make-dir@npm:4.0.0" @@ -8337,6 +8379,13 @@ __metadata: languageName: node linkType: hard +"mimic-response@npm:^3.1.0": + version: 3.1.0 + resolution: "mimic-response@npm:3.1.0" + checksum: 10/7e719047612411fe071332a7498cf0448bbe43c485c0d780046c76633a771b223ff49bd00267be122cedebb897037fdb527df72335d0d0f74724604ca70b37ad + languageName: node + linkType: hard + "minimatch@npm:^10.0.3, minimatch@npm:^10.1.1, minimatch@npm:^10.2.1, minimatch@npm:^10.2.2, minimatch@npm:^10.2.5": version: 10.2.6 resolution: "minimatch@npm:10.2.6" @@ -8373,7 +8422,7 @@ __metadata: languageName: node linkType: hard -"minimist@npm:^1.2.0, minimist@npm:^1.2.5": +"minimist@npm:^1.2.0, minimist@npm:^1.2.3, minimist@npm:^1.2.5": version: 1.2.8 resolution: "minimist@npm:1.2.8" checksum: 10/908491b6cc15a6c440ba5b22780a0ba89b9810e1aea684e253e43c4e3b8d56ec1dcdd7ea96dde119c29df59c936cde16062159eae4225c691e19c70b432b6e6f @@ -8521,6 +8570,13 @@ __metadata: languageName: node linkType: hard +"mkdirp-classic@npm:^0.5.2, mkdirp-classic@npm:^0.5.3": + version: 0.5.3 + resolution: "mkdirp-classic@npm:0.5.3" + checksum: 10/3f4e088208270bbcc148d53b73e9a5bd9eef05ad2cbf3b3d0ff8795278d50dd1d11a8ef1875ff5aea3fa888931f95bfcb2ad5b7c1061cfefd6284d199e6776ac + languageName: node + linkType: hard + "mkdirp@npm:^1.0.3, mkdirp@npm:^1.0.4": version: 1.0.4 resolution: "mkdirp@npm:1.0.4" @@ -8679,6 +8735,13 @@ __metadata: languageName: node linkType: hard +"napi-build-utils@npm:^2.0.0": + version: 2.0.0 + resolution: "napi-build-utils@npm:2.0.0" + checksum: 10/69adcdb828481737f1ec64440286013f6479d5b264e24d5439ba795f65293d0bb6d962035de07c65fae525ed7d2fcd0baab6891d8e3734ea792fec43918acf83 + languageName: node + linkType: hard + "natural-compare@npm:^1.4.0": version: 1.4.0 resolution: "natural-compare@npm:1.4.0" @@ -8865,12 +8928,21 @@ __metadata: languageName: node linkType: hard -"node-addon-api@npm:^4.2.0": - version: 4.3.0 - resolution: "node-addon-api@npm:4.3.0" +"node-abi@npm:^3.3.0": + version: 3.94.0 + resolution: "node-abi@npm:3.94.0" + dependencies: + semver: "npm:^7.3.5" + checksum: 10/2f32c86f81d499e887ca22015f7032880aafb6441b9fe0f90fe61a9fcdaa7b6c25ceb92eee9f9e782bb30a3b49cdb7d9e05686778019b02ee01bb2edb4ef2fd5 + languageName: node + linkType: hard + +"node-addon-api@npm:^7.0.0": + version: 7.1.1 + resolution: "node-addon-api@npm:7.1.1" dependencies: node-gyp: "npm:latest" - checksum: 10/d3b38d16cb9ad0714d965331d0e38cef1c27750c2c3343cd3464a9ed8158501a2910ccbf2fd9fdc476e806a19dbc9e0524ff9d66a7c779d42a9752a63ba30b80 + checksum: 10/ee1e1ed6284a2f8cd1d59ac6175ecbabf8978dcf570345e9a8095a9d0a2b9ced591074ae77f9009287b00c402352b38aa9322a34f2199cdc9f567b842a636b94 languageName: node linkType: hard @@ -8886,20 +8958,6 @@ __metadata: languageName: node linkType: hard -"node-fetch@npm:^2.6.7": - version: 2.7.0 - resolution: "node-fetch@npm:2.7.0" - dependencies: - whatwg-url: "npm:^5.0.0" - peerDependencies: - encoding: ^0.1.0 - peerDependenciesMeta: - encoding: - optional: true - checksum: 10/b24f8a3dc937f388192e59bcf9d0857d7b6940a2496f328381641cb616efccc9866e89ec43f2ec956bbd6c3d3ee05524ce77fe7b29ccd34692b3a16f237d6676 - languageName: node - linkType: hard - "node-gyp@npm:8.x": version: 8.4.1 resolution: "node-gyp@npm:8.4.1" @@ -9248,18 +9306,6 @@ __metadata: languageName: node linkType: hard -"npmlog@npm:^5.0.1": - version: 5.0.1 - resolution: "npmlog@npm:5.0.1" - dependencies: - are-we-there-yet: "npm:^2.0.0" - console-control-strings: "npm:^1.1.0" - gauge: "npm:^3.0.0" - set-blocking: "npm:^2.0.0" - checksum: 10/f42c7b9584cdd26a13c41a21930b6f5912896b6419ab15be88cc5721fc792f1c3dd30eb602b26ae08575694628ba70afdcf3675d86e4f450fc544757e52726ec - languageName: node - linkType: hard - "npmlog@npm:^6.0.0": version: 6.0.2 resolution: "npmlog@npm:6.0.2" @@ -9272,7 +9318,7 @@ __metadata: languageName: node linkType: hard -"object-assign@npm:^4.0.1, object-assign@npm:^4.1.1": +"object-assign@npm:^4.0.1": version: 4.1.1 resolution: "object-assign@npm:4.1.1" checksum: 10/fcc6e4ea8c7fe48abfbb552578b1c53e0d194086e2e6bbbf59e0a536381a292f39943c6e9628af05b5528aa5e3318bb30d6b2e53cadaf5b8fe9e12c4b69af23f @@ -9309,7 +9355,7 @@ __metadata: languageName: node linkType: hard -"once@npm:^1.3.0, once@npm:^1.4.0": +"once@npm:^1.3.0, once@npm:^1.3.1, once@npm:^1.4.0": version: 1.4.0 resolution: "once@npm:1.4.0" dependencies: @@ -10023,6 +10069,28 @@ __metadata: languageName: unknown linkType: soft +"prebuild-install@npm:^7.1.1": + version: 7.1.3 + resolution: "prebuild-install@npm:7.1.3" + dependencies: + detect-libc: "npm:^2.0.0" + expand-template: "npm:^2.0.3" + github-from-package: "npm:0.0.0" + minimist: "npm:^1.2.3" + mkdirp-classic: "npm:^0.5.3" + napi-build-utils: "npm:^2.0.0" + node-abi: "npm:^3.3.0" + pump: "npm:^3.0.0" + rc: "npm:^1.2.7" + simple-get: "npm:^4.0.0" + tar-fs: "npm:^2.0.0" + tunnel-agent: "npm:^0.6.0" + bin: + prebuild-install: bin.js + checksum: 10/1b7e4c00d2750b532a4fc2a83ffb0c5fefa1b6f2ad071896ead15eeadc3255f5babd816949991af083cf7429e375ae8c7d1c51f73658559da36f948a020a3a11 + languageName: node + linkType: hard + "prelude-ls@npm:^1.2.1": version: 1.2.1 resolution: "prelude-ls@npm:1.2.1" @@ -10195,6 +10263,16 @@ __metadata: languageName: node linkType: hard +"pump@npm:^3.0.0": + version: 3.0.4 + resolution: "pump@npm:3.0.4" + dependencies: + end-of-stream: "npm:^1.1.0" + once: "npm:^1.3.1" + checksum: 10/d043c3e710c56ffd280711e98a94e863ab334f79ea43cee0fb70e1349b2355ffd2ff287c7522e4c960a247699d5b7825f00fa090b85d6179c973be13f78a6c49 + languageName: node + linkType: hard + "punycode@npm:^2.1.0, punycode@npm:^2.3.0": version: 2.3.1 resolution: "punycode@npm:2.3.1" @@ -10263,7 +10341,7 @@ __metadata: languageName: node linkType: hard -"rc@npm:^1.2.8": +"rc@npm:^1.2.7, rc@npm:^1.2.8": version: 1.2.8 resolution: "rc@npm:1.2.8" dependencies: @@ -10417,7 +10495,7 @@ __metadata: languageName: node linkType: hard -"readable-stream@npm:^3.6.0": +"readable-stream@npm:^3.1.1, readable-stream@npm:^3.4.0, readable-stream@npm:^3.6.0": version: 3.6.2 resolution: "readable-stream@npm:3.6.2" dependencies: @@ -10708,7 +10786,7 @@ __metadata: languageName: node linkType: hard -"safe-buffer@npm:^5.1.0, safe-buffer@npm:~5.2.0": +"safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.1.0, safe-buffer@npm:~5.2.0": version: 5.2.1 resolution: "safe-buffer@npm:5.2.1" checksum: 10/32872cd0ff68a3ddade7a7617b8f4c2ae8764d8b7d884c651b74457967a9e0e886267d3ecc781220629c44a865167b61c375d2da6c720c840ecd73f45d5d9451 @@ -10783,7 +10861,7 @@ __metadata: languageName: node linkType: hard -"semver@npm:^6.0.0, semver@npm:^6.3.0, semver@npm:^6.3.1": +"semver@npm:^6.3.0, semver@npm:^6.3.1": version: 6.3.1 resolution: "semver@npm:6.3.1" bin: @@ -11016,7 +11094,7 @@ __metadata: languageName: node linkType: hard -"signal-exit@npm:^3.0.0, signal-exit@npm:^3.0.3, signal-exit@npm:^3.0.7": +"signal-exit@npm:^3.0.3, signal-exit@npm:^3.0.7": version: 3.0.7 resolution: "signal-exit@npm:3.0.7" checksum: 10/a2f098f247adc367dffc27845853e9959b9e88b01cb301658cfe4194352d8d2bb32e18467c786a7fe15f1d44b233ea35633d076d5e737870b7139949d1ab6318 @@ -11055,6 +11133,24 @@ __metadata: languageName: node linkType: hard +"simple-concat@npm:^1.0.0": + version: 1.0.1 + resolution: "simple-concat@npm:1.0.1" + checksum: 10/4d211042cc3d73a718c21ac6c4e7d7a0363e184be6a5ad25c8a1502e49df6d0a0253979e3d50dbdd3f60ef6c6c58d756b5d66ac1e05cda9cacd2e9fc59e3876a + languageName: node + linkType: hard + +"simple-get@npm:^4.0.0": + version: 4.0.1 + resolution: "simple-get@npm:4.0.1" + dependencies: + decompress-response: "npm:^6.0.0" + once: "npm:^1.3.1" + simple-concat: "npm:^1.0.0" + checksum: 10/93f1b32319782f78f2f2234e9ce34891b7ab6b990d19d8afefaa44423f5235ce2676aae42d6743fecac6c8dfff4b808d4c24fe5265be813d04769917a9a44f36 + languageName: node + linkType: hard + "sisteransi@npm:^1.0.5": version: 1.0.5 resolution: "sisteransi@npm:1.0.5" @@ -11248,17 +11344,18 @@ __metadata: version: 0.0.0-use.local resolution: "sqlite-appmap-node-test@workspace:test/sqlite" dependencies: - sqlite3: "npm:^5.1.6" + sqlite3: "npm:^5.1.7" languageName: unknown linkType: soft -"sqlite3@npm:^5.1.6": - version: 5.1.6 - resolution: "sqlite3@npm:5.1.6" +"sqlite3@npm:^5.1.7": + version: 5.1.7 + resolution: "sqlite3@npm:5.1.7" dependencies: - "@mapbox/node-pre-gyp": "npm:^1.0.0" - node-addon-api: "npm:^4.2.0" + bindings: "npm:^1.5.0" + node-addon-api: "npm:^7.0.0" node-gyp: "npm:8.x" + prebuild-install: "npm:^7.1.1" tar: "npm:^6.1.11" peerDependencies: node-gyp: 8.x @@ -11268,7 +11365,7 @@ __metadata: peerDependenciesMeta: node-gyp: optional: true - checksum: 10/343ffefb69c044f256043b5945a91b723b26b9c1ad55eba896e8895a12303307cfd931f00ebe1d39a2b5d475acdf3c4f877539de59877ddc85a22fb9f4c5755d + checksum: 10/84b1183d39791b00bc9d9aa6f0d74738084c9447e7cff7cf3cc2fa7458474159e1272eed675cd3a5c6c5100e97557578dbf0e77082f1043ab6356e6446314e32 languageName: node linkType: hard @@ -11635,6 +11732,31 @@ __metadata: languageName: node linkType: hard +"tar-fs@npm:^2.0.0": + version: 2.1.5 + resolution: "tar-fs@npm:2.1.5" + dependencies: + chownr: "npm:^1.1.1" + mkdirp-classic: "npm:^0.5.2" + pump: "npm:^3.0.0" + tar-stream: "npm:^2.1.4" + checksum: 10/9dfbde66d223e3164a8018521c7c1eb205696917cbfb116d15cde286ccc7f2445964bb3d4772f369eb003aad67c2573e4f1390c74266fee32fa16cb846b6d144 + languageName: node + linkType: hard + +"tar-stream@npm:^2.1.4": + version: 2.2.0 + resolution: "tar-stream@npm:2.2.0" + dependencies: + bl: "npm:^4.0.3" + end-of-stream: "npm:^1.4.1" + fs-constants: "npm:^1.0.0" + inherits: "npm:^2.0.3" + readable-stream: "npm:^3.1.1" + checksum: 10/1a52a51d240c118cbcd30f7368ea5e5baef1eac3e6b793fb1a41e6cd7319296c79c0264ccc5859f5294aa80f8f00b9239d519e627b9aade80038de6f966fec6a + languageName: node + linkType: hard + "tar@npm:7.5.22": version: 7.5.22 resolution: "tar@npm:7.5.22" @@ -11862,13 +11984,6 @@ __metadata: languageName: node linkType: hard -"tr46@npm:~0.0.3": - version: 0.0.3 - resolution: "tr46@npm:0.0.3" - checksum: 10/8f1f5aa6cb232f9e1bdc86f485f916b7aa38caee8a778b378ffec0b70d9307873f253f5cbadbe2955ece2ac5c83d0dc14a77513166ccd0a0c7fe197e21396695 - languageName: node - linkType: hard - "traverse@npm:~0.6.6": version: 0.6.7 resolution: "traverse@npm:0.6.7" @@ -11957,6 +12072,15 @@ __metadata: languageName: node linkType: hard +"tunnel-agent@npm:^0.6.0": + version: 0.6.0 + resolution: "tunnel-agent@npm:0.6.0" + dependencies: + safe-buffer: "npm:^5.0.1" + checksum: 10/7f0d9ed5c22404072b2ae8edc45c071772affd2ed14a74f03b4e71b4dd1a14c3714d85aed64abcaaee5fec2efc79002ba81155c708f4df65821b444abb0cfade + languageName: node + linkType: hard + "tunnel@npm:^0.0.6": version: 0.0.6 resolution: "tunnel@npm:0.0.6" @@ -12836,13 +12960,6 @@ __metadata: languageName: node linkType: hard -"webidl-conversions@npm:^3.0.0": - version: 3.0.1 - resolution: "webidl-conversions@npm:3.0.1" - checksum: 10/b65b9f8d6854572a84a5c69615152b63371395f0c5dcd6729c45789052296df54314db2bc3e977df41705eacb8bc79c247cee139a63fa695192f95816ed528ad - languageName: node - linkType: hard - "webidl-conversions@npm:^7.0.0": version: 7.0.0 resolution: "webidl-conversions@npm:7.0.0" @@ -12860,16 +12977,6 @@ __metadata: languageName: node linkType: hard -"whatwg-url@npm:^5.0.0": - version: 5.0.0 - resolution: "whatwg-url@npm:5.0.0" - dependencies: - tr46: "npm:~0.0.3" - webidl-conversions: "npm:^3.0.0" - checksum: 10/f95adbc1e80820828b45cc671d97da7cd5e4ef9deb426c31bcd5ab00dc7103042291613b3ef3caec0a2335ed09e0d5ed026c940755dbb6d404e2b27f940fdf07 - languageName: node - linkType: hard - "which-command@npm:^0.1.0": version: 0.1.0 resolution: "which-command@npm:0.1.0" @@ -12913,7 +13020,7 @@ __metadata: languageName: node linkType: hard -"wide-align@npm:^1.1.2, wide-align@npm:^1.1.5": +"wide-align@npm:^1.1.5": version: 1.1.5 resolution: "wide-align@npm:1.1.5" dependencies: From 73a02cd866e4577af0348cd995f7f9cd8ac6be50 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Rzepecki?= Date: Mon, 17 Aug 2026 11:46:45 +0200 Subject: [PATCH 07/11] chore(deps): pin node-gyp to ^11.5.0 to drop deprecated build toolchain Three different optional `node-gyp` entries were being resolved across the lockfile -- 8.4.1 (sqlite3), 9.4.0 (fsevents and node-addon-api, both via `node-gyp: latest`) and 12.4.0 (npm's own tree). The 8.x and 9.x ones drag in a large deprecated subtree, which `yarn npm audit -AR` reports because it walks optional lockfile entries even though nothing links them: sqlite3 and fsevents both ship prebuilt binaries, so node-gyp never actually runs here. Consolidating on node-gyp 11.5.0 clears six findings: - npmlog 6.0.2 (deprecated) and its gauge 4.0.4 / are-we-there-yet 3.0.1 - rimraf 3.0.2 (deprecated, @npmcli/move-file 1.1.2 (deprecated, moved to @npmcli/fs) - http-proxy-agent 4.0.1 -> @tootallnate/once 1.1.2 (GHSA-vpq2-c234-7xj6) node-gyp 11.5.0 rather than 12.x on purpose: 12.x drops make-fetch-happen and cacache entirely (so it would also clear the remaining glob 10.5.0), but it declares `engines.node: ^20.17.0 || >=22.9.0` and CI still covers Node 18. 11.5.0 declares `^18.17.0 || >=20.5.0`, matching our `engines.node: >=18`. Worth revisiting when the Node 18 floor is raised. Assisted-by: Claude:claude-opus-5[1m] --- package.json | 1 + yarn.lock | 679 +++++++++------------------------------------------ 2 files changed, 113 insertions(+), 567 deletions(-) diff --git a/package.json b/package.json index 063fd45..22035f8 100644 --- a/package.json +++ b/package.json @@ -98,6 +98,7 @@ "yaml": "^2.3.4" }, "resolutions": { + "node-gyp": "^11.5.0", "rollup": "^4.59.0", "tar": "7.5.22" }, diff --git a/yarn.lock b/yarn.lock index ab9bf09..292f583 100644 --- a/yarn.lock +++ b/yarn.lock @@ -837,13 +837,6 @@ __metadata: languageName: node linkType: hard -"@gar/promisify@npm:^1.0.1": - version: 1.1.3 - resolution: "@gar/promisify@npm:1.1.3" - checksum: 10/052dd232140fa60e81588000cbe729a40146579b361f1070bce63e2a761388a22a16d00beeffc504bd3601cb8e055c57b21a185448b3ed550cf50716f4fd442e - languageName: node - linkType: hard - "@humanfs/core@npm:^0.19.1": version: 0.19.1 resolution: "@humanfs/core@npm:0.19.1" @@ -1645,6 +1638,19 @@ __metadata: languageName: node linkType: hard +"@npmcli/agent@npm:^3.0.0": + version: 3.0.0 + resolution: "@npmcli/agent@npm:3.0.0" + dependencies: + agent-base: "npm:^7.1.0" + http-proxy-agent: "npm:^7.0.0" + https-proxy-agent: "npm:^7.0.1" + lru-cache: "npm:^10.0.1" + socks-proxy-agent: "npm:^8.0.3" + checksum: 10/775c9a7eb1f88c195dfb3bce70c31d0fe2a12b28b754e25c08a3edb4bc4816bfedb7ac64ef1e730579d078ca19dacf11630e99f8f3c3e0fd7b23caa5fd6d30a6 + languageName: node + linkType: hard + "@npmcli/agent@npm:^4.0.0": version: 4.0.2 resolution: "@npmcli/agent@npm:4.0.2" @@ -1718,22 +1724,12 @@ __metadata: languageName: node linkType: hard -"@npmcli/fs@npm:^1.0.0": - version: 1.1.1 - resolution: "@npmcli/fs@npm:1.1.1" - dependencies: - "@gar/promisify": "npm:^1.0.1" - semver: "npm:^7.3.5" - checksum: 10/8b5e6d75759b9f1a8b7885913df274c8cbbb1221176872615f2aecedf47b2c36e5dfbf4046ff1a905c9f3592fbd32051b3050b8a897bf03514a1a404b39af074 - languageName: node - linkType: hard - -"@npmcli/fs@npm:^3.1.0": - version: 3.1.0 - resolution: "@npmcli/fs@npm:3.1.0" +"@npmcli/fs@npm:^4.0.0": + version: 4.0.0 + resolution: "@npmcli/fs@npm:4.0.0" dependencies: semver: "npm:^7.3.5" - checksum: 10/f3a7ab3a31de65e42aeb6ed03ed035ef123d2de7af4deb9d4a003d27acc8618b57d9fb9d259fe6c28ca538032a028f37337264388ba27d26d37fff7dde22476e + checksum: 10/405c4490e1ff11cf299775449a3c254a366a4b1ffc79d87159b0ee7d5558ac9f6a2f8c0735fd6ff3873cef014cb1a44a5f9127cb6a1b2dbc408718cca9365b5a languageName: node linkType: hard @@ -1799,16 +1795,6 @@ __metadata: languageName: node linkType: hard -"@npmcli/move-file@npm:^1.0.1": - version: 1.1.2 - resolution: "@npmcli/move-file@npm:1.1.2" - dependencies: - mkdirp: "npm:^1.0.4" - rimraf: "npm:^3.0.2" - checksum: 10/c96381d4a37448ea280951e46233f7e541058cf57a57d4094dd4bdcaae43fa5872b5f2eb6bfb004591a68e29c5877abe3cdc210cb3588cbf20ab2877f31a7de7 - languageName: node - linkType: hard - "@npmcli/name-from-folder@npm:^4.0.0": version: 4.0.0 resolution: "@npmcli/name-from-folder@npm:4.0.0" @@ -2803,20 +2789,6 @@ __metadata: languageName: node linkType: hard -"@tootallnate/once@npm:1": - version: 1.1.2 - resolution: "@tootallnate/once@npm:1.1.2" - checksum: 10/e1fb1bbbc12089a0cb9433dc290f97bddd062deadb6178ce9bcb93bb7c1aecde5e60184bc7065aec42fe1663622a213493c48bbd4972d931aae48315f18e1be9 - languageName: node - linkType: hard - -"@tootallnate/once@npm:2": - version: 2.0.1 - resolution: "@tootallnate/once@npm:2.0.1" - checksum: 10/487b59b5adb8458dc13394a5aae997bf9705c51fa1e2396c50cd967019d06b273faba3c4d9e7895a996b9e9b055f1c55e53d822e54b3e9c298bcb4f6967cd0d5 - languageName: node - linkType: hard - "@tsconfig/node10@npm:^1.0.7": version: 1.0.9 resolution: "@tsconfig/node10@npm:1.0.9" @@ -3651,10 +3623,10 @@ __metadata: languageName: node linkType: hard -"abbrev@npm:1, abbrev@npm:^1.0.0": - version: 1.1.1 - resolution: "abbrev@npm:1.1.1" - checksum: 10/2d882941183c66aa665118bafdab82b7a177e9add5eb2776c33e960a4f3c89cff88a1b38aba13a456de01d0dd9d66a8bea7c903268b21ea91dd1097e1e2e8243 +"abbrev@npm:^3.0.0": + version: 3.0.1 + resolution: "abbrev@npm:3.0.1" + checksum: 10/ebd2c149dda6f543b66ce3779ea612151bb3aa9d0824f169773ee9876f1ca5a4e0adbcccc7eed048c04da7998e1825e2aa76fcca92d9e67dea50ac2b0a58dc2e languageName: node linkType: hard @@ -3709,15 +3681,6 @@ __metadata: languageName: node linkType: hard -"agent-base@npm:6, agent-base@npm:^6.0.2": - version: 6.0.2 - resolution: "agent-base@npm:6.0.2" - dependencies: - debug: "npm:4" - checksum: 10/21fb903e0917e5cb16591b4d0ef6a028a54b83ac30cd1fca58dece3d4e0990512a8723f9f83130d88a41e2af8b1f7be1386fda3ea2d181bb1a62155e75e95e23 - languageName: node - linkType: hard - "agent-base@npm:9.0.0": version: 9.0.0 resolution: "agent-base@npm:9.0.0" @@ -3732,25 +3695,6 @@ __metadata: languageName: node linkType: hard -"agentkeepalive@npm:^4.1.3, agentkeepalive@npm:^4.2.1": - version: 4.5.0 - resolution: "agentkeepalive@npm:4.5.0" - dependencies: - humanize-ms: "npm:^1.2.1" - checksum: 10/dd210ba2a2e2482028f027b1156789744aadbfd773a6c9dd8e4e8001930d5af82382abe19a69240307b1d8003222ce6b0542935038313434b900e351914fc15f - languageName: node - linkType: hard - -"aggregate-error@npm:^3.0.0": - version: 3.1.0 - resolution: "aggregate-error@npm:3.1.0" - dependencies: - clean-stack: "npm:^2.0.0" - indent-string: "npm:^4.0.0" - checksum: 10/1101a33f21baa27a2fa8e04b698271e64616b886795fd43c31068c07533c7b3facfcaf4e9e0cab3624bd88f729a592f1c901a1a229c9e490eafce411a8644b79 - languageName: node - linkType: hard - "aggregate-error@npm:^5.0.0": version: 5.0.0 resolution: "aggregate-error@npm:5.0.0" @@ -3925,7 +3869,7 @@ __metadata: languageName: unknown linkType: soft -"aproba@npm:^1.0.3 || ^2.0.0, aproba@npm:^2.0.0": +"aproba@npm:^2.0.0": version: 2.0.0 resolution: "aproba@npm:2.0.0" checksum: 10/c2b9a631298e8d6f3797547e866db642f68493808f5b37cd61da778d5f6ada890d16f668285f7d60bd4fc3b03889bd590ffe62cf81b700e9bb353431238a0a7b @@ -3939,16 +3883,6 @@ __metadata: languageName: node linkType: hard -"are-we-there-yet@npm:^3.0.0": - version: 3.0.1 - resolution: "are-we-there-yet@npm:3.0.1" - dependencies: - delegates: "npm:^1.0.0" - readable-stream: "npm:^3.6.0" - checksum: 10/390731720e1bf9ed5d0efc635ea7df8cbc4c90308b0645a932f06e8495a0bf1ecc7987d3b97e805f62a17d6c4b634074b25200aa4d149be2a7b17250b9744bc4 - languageName: node - linkType: hard - "arg@npm:^4.1.0": version: 4.1.3 resolution: "arg@npm:4.1.3" @@ -4343,49 +4277,23 @@ __metadata: languageName: node linkType: hard -"cacache@npm:^15.2.0": - version: 15.3.0 - resolution: "cacache@npm:15.3.0" - dependencies: - "@npmcli/fs": "npm:^1.0.0" - "@npmcli/move-file": "npm:^1.0.1" - chownr: "npm:^2.0.0" - fs-minipass: "npm:^2.0.0" - glob: "npm:^7.1.4" - infer-owner: "npm:^1.0.4" - lru-cache: "npm:^6.0.0" - minipass: "npm:^3.1.1" - minipass-collect: "npm:^1.0.2" - minipass-flush: "npm:^1.0.5" - minipass-pipeline: "npm:^1.2.2" - mkdirp: "npm:^1.0.3" - p-map: "npm:^4.0.0" - promise-inflight: "npm:^1.0.1" - rimraf: "npm:^3.0.2" - ssri: "npm:^8.0.1" - tar: "npm:^6.0.2" - unique-filename: "npm:^1.1.1" - checksum: 10/1432d84f3f4b31421cf47c15e6956e5e736a93c65126b0fd69ae5f70643d29be8996f33d4995204f578850de5d556268540911c04ecc1c026375b18600534f08 - languageName: node - linkType: hard - -"cacache@npm:^17.0.0": - version: 17.1.4 - resolution: "cacache@npm:17.1.4" +"cacache@npm:^19.0.1": + version: 19.0.1 + resolution: "cacache@npm:19.0.1" dependencies: - "@npmcli/fs": "npm:^3.1.0" + "@npmcli/fs": "npm:^4.0.0" fs-minipass: "npm:^3.0.0" glob: "npm:^10.2.2" - lru-cache: "npm:^7.7.1" + lru-cache: "npm:^10.0.1" minipass: "npm:^7.0.3" - minipass-collect: "npm:^1.0.2" + minipass-collect: "npm:^2.0.1" minipass-flush: "npm:^1.0.5" minipass-pipeline: "npm:^1.2.4" - p-map: "npm:^4.0.0" - ssri: "npm:^10.0.0" - tar: "npm:^6.1.11" - unique-filename: "npm:^3.0.0" - checksum: 10/6e26c788bc6a18ff42f4d4f97db30d5c60a5dfac8e7c10a03b0307a92cf1b647570547cf3cd96463976c051eb9c7258629863f156e224c82018862c1a8ad0e70 + p-map: "npm:^7.0.2" + ssri: "npm:^12.0.0" + tar: "npm:^7.4.3" + unique-filename: "npm:^4.0.0" + checksum: 10/ea026b27b13656330c2bbaa462a88181dcaa0435c1c2e705db89b31d9bdf7126049d6d0445ba746dca21454a0cfdf1d6f47fd39d34c8c8435296b30bc5738a13 languageName: node linkType: hard @@ -4574,13 +4482,6 @@ __metadata: languageName: node linkType: hard -"chownr@npm:^2.0.0": - version: 2.0.0 - resolution: "chownr@npm:2.0.0" - checksum: 10/c57cf9dd0791e2f18a5ee9c1a299ae6e801ff58fee96dc8bfd0dcb4738a6ce58dd252a3605b1c93c6418fe4f9d5093b28ffbf4d66648cb2a9c67eaef9679be2f - languageName: node - linkType: hard - "chownr@npm:^3.0.0": version: 3.0.0 resolution: "chownr@npm:3.0.0" @@ -4616,13 +4517,6 @@ __metadata: languageName: node linkType: hard -"clean-stack@npm:^2.0.0": - version: 2.2.0 - resolution: "clean-stack@npm:2.2.0" - checksum: 10/2ac8cd2b2f5ec986a3c743935ec85b07bc174d5421a5efc8017e1f146a1cf5f781ae962618f416352103b32c9cd7e203276e8c28241bbe946160cab16149fb68 - languageName: node - linkType: hard - "clean-stack@npm:^5.2.0": version: 5.2.0 resolution: "clean-stack@npm:5.2.0" @@ -4754,15 +4648,6 @@ __metadata: languageName: node linkType: hard -"color-support@npm:^1.1.3": - version: 1.1.3 - resolution: "color-support@npm:1.1.3" - bin: - color-support: bin.js - checksum: 10/4bcfe30eea1498fe1cabc852bbda6c9770f230ea0e4faf4611c5858b1b9e4dde3730ac485e65f54ca182f4c50b626c1bea7c8441ceda47367a54a818c248aa7a - languageName: node - linkType: hard - "common-ancestor-path@npm:^2.0.0": version: 2.0.0 resolution: "common-ancestor-path@npm:2.0.0" @@ -4804,13 +4689,6 @@ __metadata: languageName: node linkType: hard -"console-control-strings@npm:^1.1.0": - version: 1.1.0 - resolution: "console-control-strings@npm:1.1.0" - checksum: 10/27b5fa302bc8e9ae9e98c03c66d76ca289ad0c61ce2fe20ab288d288bee875d217512d2edb2363fc83165e88f1c405180cf3f5413a46e51b4fe1a004840c6cdb - languageName: node - linkType: hard - "content-disposition@npm:^1.0.0": version: 1.0.1 resolution: "content-disposition@npm:1.0.1" @@ -4977,7 +4855,7 @@ __metadata: languageName: node linkType: hard -"debug@npm:4, debug@npm:^4.0.0, debug@npm:^4.1.0, debug@npm:^4.1.1, debug@npm:^4.3.1, debug@npm:^4.3.2, debug@npm:^4.3.3, debug@npm:^4.3.4, debug@npm:^4.3.5, debug@npm:^4.3.7, debug@npm:^4.4.0, debug@npm:^4.4.1, debug@npm:^4.4.3": +"debug@npm:4, debug@npm:^4.0.0, debug@npm:^4.1.0, debug@npm:^4.1.1, debug@npm:^4.3.1, debug@npm:^4.3.2, debug@npm:^4.3.4, debug@npm:^4.3.5, debug@npm:^4.3.7, debug@npm:^4.4.0, debug@npm:^4.4.1, debug@npm:^4.4.3": version: 4.4.3 resolution: "debug@npm:4.4.3" dependencies: @@ -5054,13 +4932,6 @@ __metadata: languageName: node linkType: hard -"delegates@npm:^1.0.0": - version: 1.0.0 - resolution: "delegates@npm:1.0.0" - checksum: 10/a51744d9b53c164ba9c0492471a1a2ffa0b6727451bdc89e31627fdf4adda9d51277cfcbfb20f0a6f08ccb3c436f341df3e92631a3440226d93a8971724771fd - languageName: node - linkType: hard - "depd@npm:^2.0.0, depd@npm:~2.0.0": version: 2.0.0 resolution: "depd@npm:2.0.0" @@ -5211,7 +5082,7 @@ __metadata: languageName: node linkType: hard -"encoding@npm:^0.1.12, encoding@npm:^0.1.13": +"encoding@npm:^0.1.13": version: 0.1.13 resolution: "encoding@npm:0.1.13" dependencies: @@ -6088,15 +5959,6 @@ __metadata: languageName: node linkType: hard -"fs-minipass@npm:^2.0.0": - version: 2.1.0 - resolution: "fs-minipass@npm:2.1.0" - dependencies: - minipass: "npm:^3.0.0" - checksum: 10/03191781e94bc9a54bd376d3146f90fe8e082627c502185dbf7b9b3032f66b0b142c1115f3b2cc5936575fc1b44845ce903dd4c21bec2a8d69f3bd56f9cee9ec - languageName: node - linkType: hard - "fs-minipass@npm:^3.0.0, fs-minipass@npm:^3.0.3": version: 3.0.3 resolution: "fs-minipass@npm:3.0.3" @@ -6146,22 +6008,6 @@ __metadata: languageName: node linkType: hard -"gauge@npm:^4.0.3": - version: 4.0.4 - resolution: "gauge@npm:4.0.4" - dependencies: - aproba: "npm:^1.0.3 || ^2.0.0" - color-support: "npm:^1.1.3" - console-control-strings: "npm:^1.1.0" - has-unicode: "npm:^2.0.1" - signal-exit: "npm:^3.0.7" - string-width: "npm:^4.2.3" - strip-ansi: "npm:^6.0.1" - wide-align: "npm:^1.1.5" - checksum: 10/09535dd53b5ced6a34482b1fa9f3929efdeac02f9858569cde73cef3ed95050e0f3d095706c1689614059898924b7a74aa14042f51381a1ccc4ee5c29d2389c4 - languageName: node - linkType: hard - "generator-function@npm:^2.0.0": version: 2.0.1 resolution: "generator-function@npm:2.0.1" @@ -6419,13 +6265,6 @@ __metadata: languageName: node linkType: hard -"has-unicode@npm:^2.0.1": - version: 2.0.1 - resolution: "has-unicode@npm:2.0.1" - checksum: 10/041b4293ad6bf391e21c5d85ed03f412506d6623786b801c4ab39e4e6ca54993f13201bceb544d92963f9e0024e6e7fbf0cb1d84c9d6b31cb9c79c8c990d13d8 - languageName: node - linkType: hard - "has@npm:^1.0.3": version: 1.0.3 resolution: "has@npm:1.0.3" @@ -6492,7 +6331,7 @@ __metadata: languageName: node linkType: hard -"http-cache-semantics@npm:^4.1.0, http-cache-semantics@npm:^4.1.1": +"http-cache-semantics@npm:^4.1.1": version: 4.1.1 resolution: "http-cache-semantics@npm:4.1.1" checksum: 10/362d5ed66b12ceb9c0a328fb31200b590ab1b02f4a254a697dc796850cc4385603e75f53ec59f768b2dad3bfa1464bd229f7de278d2899a0e3beffc634b6683f @@ -6521,28 +6360,6 @@ __metadata: languageName: node linkType: hard -"http-proxy-agent@npm:^4.0.1": - version: 4.0.1 - resolution: "http-proxy-agent@npm:4.0.1" - dependencies: - "@tootallnate/once": "npm:1" - agent-base: "npm:6" - debug: "npm:4" - checksum: 10/2e17f5519f2f2740b236d1d14911ea4be170c67419dc15b05ea9a860a22c5d9c6ff4da270972117067cc2cefeba9df5f7cd5e7818fdc6ae52b6acf2a533e5fdd - languageName: node - linkType: hard - -"http-proxy-agent@npm:^5.0.0": - version: 5.0.0 - resolution: "http-proxy-agent@npm:5.0.0" - dependencies: - "@tootallnate/once": "npm:2" - agent-base: "npm:6" - debug: "npm:4" - checksum: 10/5ee19423bc3e0fd5f23ce991b0755699ad2a46a440ce9cec99e8126bb98448ad3479d2c0ea54be5519db5b19a4ffaa69616bac01540db18506dd4dac3dc418f0 - languageName: node - linkType: hard - "http-proxy-agent@npm:^7.0.0": version: 7.0.0 resolution: "http-proxy-agent@npm:7.0.0" @@ -6572,16 +6389,6 @@ __metadata: languageName: unknown linkType: soft -"https-proxy-agent@npm:^5.0.0": - version: 5.0.1 - resolution: "https-proxy-agent@npm:5.0.1" - dependencies: - agent-base: "npm:6" - debug: "npm:4" - checksum: 10/f0dce7bdcac5e8eaa0be3c7368bb8836ed010fb5b6349ffb412b172a203efe8f807d9a6681319105ea1b6901e1972c7b5ea899672a7b9aad58309f766dcbe0df - languageName: node - linkType: hard - "https-proxy-agent@npm:^7.0.1": version: 7.0.2 resolution: "https-proxy-agent@npm:7.0.2" @@ -6624,15 +6431,6 @@ __metadata: languageName: node linkType: hard -"humanize-ms@npm:^1.2.1": - version: 1.2.1 - resolution: "humanize-ms@npm:1.2.1" - dependencies: - ms: "npm:^2.0.0" - checksum: 10/9c7a74a2827f9294c009266c82031030eae811ca87b0da3dceb8d6071b9bde22c9f3daef0469c3c533cc67a97d8a167cd9fc0389350e5f415f61a79b171ded16 - languageName: node - linkType: hard - "iconv-lite@npm:^0.6.2": version: 0.6.3 resolution: "iconv-lite@npm:0.6.3" @@ -6727,13 +6525,6 @@ __metadata: languageName: node linkType: hard -"indent-string@npm:^4.0.0": - version: 4.0.0 - resolution: "indent-string@npm:4.0.0" - checksum: 10/cd3f5cbc9ca2d624c6a1f53f12e6b341659aba0e2d3254ae2b4464aaea8b4294cdb09616abbc59458f980531f2429784ed6a420d48d245bcad0811980c9efae9 - languageName: node - linkType: hard - "indent-string@npm:^5.0.0": version: 5.0.0 resolution: "indent-string@npm:5.0.0" @@ -6748,13 +6539,6 @@ __metadata: languageName: node linkType: hard -"infer-owner@npm:^1.0.4": - version: 1.0.4 - resolution: "infer-owner@npm:1.0.4" - checksum: 10/181e732764e4a0611576466b4b87dac338972b839920b2a8cde43642e4ed6bd54dc1fb0b40874728f2a2df9a1b097b8ff83b56d5f8f8e3927f837fdcb47d8a89 - languageName: node - linkType: hard - "inflight@npm:^1.0.4": version: 1.0.6 resolution: "inflight@npm:1.0.6" @@ -6878,13 +6662,6 @@ __metadata: languageName: node linkType: hard -"is-lambda@npm:^1.0.1": - version: 1.0.1 - resolution: "is-lambda@npm:1.0.1" - checksum: 10/93a32f01940220532e5948538699ad610d5924ac86093fcee83022252b363eb0cc99ba53ab084a04e4fb62bf7b5731f55496257a4c38adf87af9c4d352c71c35 - languageName: node - linkType: hard - "is-number@npm:^7.0.0": version: 7.0.0 resolution: "is-number@npm:7.0.0" @@ -6969,6 +6746,13 @@ __metadata: languageName: node linkType: hard +"isexe@npm:^3.1.1": + version: 3.1.5 + resolution: "isexe@npm:3.1.5" + checksum: 10/ae479f6b0505507f1a73c1d57be6d0546e59fc9202bb0d5b31ba8ff5f3e79dd385bce57a2e60c5645aba567018cbbfc663519cd28367e9962242d97dd151d2ab + languageName: node + linkType: hard + "isexe@npm:^4.0.0": version: 4.0.0 resolution: "isexe@npm:4.0.0" @@ -8120,22 +7904,6 @@ __metadata: languageName: node linkType: hard -"lru-cache@npm:^6.0.0": - version: 6.0.0 - resolution: "lru-cache@npm:6.0.0" - dependencies: - yallist: "npm:^4.0.0" - checksum: 10/fc1fe2ee205f7c8855fa0f34c1ab0bcf14b6229e35579ec1fd1079f31d6fc8ef8eb6fd17f2f4d99788d7e339f50e047555551ebd5e434dda503696e7c6591825 - languageName: node - linkType: hard - -"lru-cache@npm:^7.7.1": - version: 7.18.3 - resolution: "lru-cache@npm:7.18.3" - checksum: 10/6029ca5aba3aacb554e919d7ef804fffd4adfc4c83db00fac8248c7c78811fb6d4b6f70f7fd9d55032b3823446546a007edaa66ad1f2377ae833bd983fac5d98 - languageName: node - linkType: hard - "magic-string@npm:^0.30.1, magic-string@npm:^0.30.12, magic-string@npm:^0.30.17, magic-string@npm:^0.30.21, magic-string@npm:^0.30.5": version: 0.30.21 resolution: "magic-string@npm:0.30.21" @@ -8172,26 +7940,22 @@ __metadata: languageName: node linkType: hard -"make-fetch-happen@npm:^11.0.3": - version: 11.1.1 - resolution: "make-fetch-happen@npm:11.1.1" +"make-fetch-happen@npm:^14.0.3": + version: 14.0.3 + resolution: "make-fetch-happen@npm:14.0.3" dependencies: - agentkeepalive: "npm:^4.2.1" - cacache: "npm:^17.0.0" + "@npmcli/agent": "npm:^3.0.0" + cacache: "npm:^19.0.1" http-cache-semantics: "npm:^4.1.1" - http-proxy-agent: "npm:^5.0.0" - https-proxy-agent: "npm:^5.0.0" - is-lambda: "npm:^1.0.1" - lru-cache: "npm:^7.7.1" - minipass: "npm:^5.0.0" - minipass-fetch: "npm:^3.0.0" + minipass: "npm:^7.0.2" + minipass-fetch: "npm:^4.0.0" minipass-flush: "npm:^1.0.5" minipass-pipeline: "npm:^1.2.4" - negotiator: "npm:^0.6.3" + negotiator: "npm:^1.0.0" + proc-log: "npm:^5.0.0" promise-retry: "npm:^2.0.1" - socks-proxy-agent: "npm:^7.0.0" - ssri: "npm:^10.0.0" - checksum: 10/b4b442cfaaec81db159f752a5f2e3ee3d7aa682782868fa399200824ec6298502e01bdc456e443dc219bcd5546c8e4471644d54109c8599841dc961d17a805fa + ssri: "npm:^12.0.0" + checksum: 10/fce0385840b6d86b735053dfe941edc2dd6468fda80fe74da1eeff10cbd82a75760f406194f2bc2fa85b99545b2bc1f84c08ddf994b21830775ba2d1a87e8bdf languageName: node linkType: hard @@ -8215,30 +7979,6 @@ __metadata: languageName: node linkType: hard -"make-fetch-happen@npm:^9.1.0": - version: 9.1.0 - resolution: "make-fetch-happen@npm:9.1.0" - dependencies: - agentkeepalive: "npm:^4.1.3" - cacache: "npm:^15.2.0" - http-cache-semantics: "npm:^4.1.0" - http-proxy-agent: "npm:^4.0.1" - https-proxy-agent: "npm:^5.0.0" - is-lambda: "npm:^1.0.1" - lru-cache: "npm:^6.0.0" - minipass: "npm:^3.1.3" - minipass-collect: "npm:^1.0.2" - minipass-fetch: "npm:^1.3.2" - minipass-flush: "npm:^1.0.5" - minipass-pipeline: "npm:^1.2.4" - negotiator: "npm:^0.6.2" - promise-retry: "npm:^2.0.1" - socks-proxy-agent: "npm:^6.0.0" - ssri: "npm:^8.0.0" - checksum: 10/a868e74fc223a78afb7a1f8115133befdffae84f07a5f5dd9317cbf9f784a8373f28829a73ae3f31060e1b0cb4944e73257733c3b10c314354060fab412b6028 - languageName: node - linkType: hard - "makeerror@npm:1.0.12": version: 1.0.12 resolution: "makeerror@npm:1.0.12" @@ -8429,15 +8169,6 @@ __metadata: languageName: node linkType: hard -"minipass-collect@npm:^1.0.2": - version: 1.0.2 - resolution: "minipass-collect@npm:1.0.2" - dependencies: - minipass: "npm:^3.0.0" - checksum: 10/14df761028f3e47293aee72888f2657695ec66bd7d09cae7ad558da30415fdc4752bbfee66287dcc6fd5e6a2fa3466d6c484dc1cbd986525d9393b9523d97f10 - languageName: node - linkType: hard - "minipass-collect@npm:^2.0.1": version: 2.0.1 resolution: "minipass-collect@npm:2.0.1" @@ -8447,33 +8178,18 @@ __metadata: languageName: node linkType: hard -"minipass-fetch@npm:^1.3.2": - version: 1.4.1 - resolution: "minipass-fetch@npm:1.4.1" - dependencies: - encoding: "npm:^0.1.12" - minipass: "npm:^3.1.0" - minipass-sized: "npm:^1.0.3" - minizlib: "npm:^2.0.0" - dependenciesMeta: - encoding: - optional: true - checksum: 10/4c6f678d2c976c275ba35735aa18e341401d1fb94bbf38a36bb2c2d01835ac699f15b7ab1adaf4ee40a751361527d312a18853feaf9c0121f4904f811656575a - languageName: node - linkType: hard - -"minipass-fetch@npm:^3.0.0": - version: 3.0.4 - resolution: "minipass-fetch@npm:3.0.4" +"minipass-fetch@npm:^4.0.0": + version: 4.0.1 + resolution: "minipass-fetch@npm:4.0.1" dependencies: encoding: "npm:^0.1.13" minipass: "npm:^7.0.3" minipass-sized: "npm:^1.0.3" - minizlib: "npm:^2.1.2" + minizlib: "npm:^3.0.1" dependenciesMeta: encoding: optional: true - checksum: 10/3edf72b900e30598567eafe96c30374432a8709e61bb06b87198fa3192d466777e2ec21c52985a0999044fa6567bd6f04651585983a1cbb27e2c1770a07ed2a2 + checksum: 10/7ddfebdbb87d9866e7b5f7eead5a9e3d9d507992af932a11d275551f60006cf7d9178e66d586dbb910894f3e3458d27c0ddf93c76e94d49d0a54a541ddc1263d languageName: node linkType: hard @@ -8501,7 +8217,7 @@ __metadata: languageName: node linkType: hard -"minipass-pipeline@npm:^1.2.2, minipass-pipeline@npm:^1.2.4": +"minipass-pipeline@npm:^1.2.4": version: 1.2.4 resolution: "minipass-pipeline@npm:1.2.4" dependencies: @@ -8528,7 +8244,7 @@ __metadata: languageName: node linkType: hard -"minipass@npm:^3.0.0, minipass@npm:^3.1.0, minipass@npm:^3.1.1, minipass@npm:^3.1.3": +"minipass@npm:^3.0.0": version: 3.3.6 resolution: "minipass@npm:3.3.6" dependencies: @@ -8537,13 +8253,6 @@ __metadata: languageName: node linkType: hard -"minipass@npm:^5.0.0": - version: 5.0.0 - resolution: "minipass@npm:5.0.0" - checksum: 10/61682162d29f45d3152b78b08bab7fb32ca10899bc5991ffe98afc18c9e9543bd1e3be94f8b8373ba6262497db63607079dc242ea62e43e7b2270837b7347c93 - languageName: node - linkType: hard - "minipass@npm:^5.0.0 || ^6.0.2 || ^7.0.0, minipass@npm:^7.0.2, minipass@npm:^7.0.3, minipass@npm:^7.0.4, minipass@npm:^7.1.2, minipass@npm:^7.1.3": version: 7.1.3 resolution: "minipass@npm:7.1.3" @@ -8551,16 +8260,6 @@ __metadata: languageName: node linkType: hard -"minizlib@npm:^2.0.0, minizlib@npm:^2.1.2": - version: 2.1.2 - resolution: "minizlib@npm:2.1.2" - dependencies: - minipass: "npm:^3.0.0" - yallist: "npm:^4.0.0" - checksum: 10/ae0f45436fb51344dcb87938446a32fbebb540d0e191d63b35e1c773d47512e17307bf54aa88326cc6d176594d00e4423563a091f7266c2f9a6872cdc1e234d1 - languageName: node - linkType: hard - "minizlib@npm:^3.0.1, minizlib@npm:^3.1.0": version: 3.1.0 resolution: "minizlib@npm:3.1.0" @@ -8577,15 +8276,6 @@ __metadata: languageName: node linkType: hard -"mkdirp@npm:^1.0.3, mkdirp@npm:^1.0.4": - version: 1.0.4 - resolution: "mkdirp@npm:1.0.4" - bin: - mkdirp: bin/cmd.js - checksum: 10/d71b8dcd4b5af2fe13ecf3bd24070263489404fe216488c5ba7e38ece1f54daf219e72a833a3a2dc404331e870e9f44963a33399589490956bff003a3404d3b2 - languageName: node - linkType: hard - "mlly@npm:^1.4.0, mlly@npm:^1.7.3, mlly@npm:^1.7.4": version: 1.8.0 resolution: "mlly@npm:1.8.0" @@ -8681,7 +8371,7 @@ __metadata: languageName: node linkType: hard -"ms@npm:^2.0.0, ms@npm:^2.1.2, ms@npm:^2.1.3": +"ms@npm:^2.1.2, ms@npm:^2.1.3": version: 2.1.3 resolution: "ms@npm:2.1.3" checksum: 10/aa92de608021b242401676e35cfa5aa42dd70cbdc082b916da7fb925c542173e36bce97ea3e804923fe92c0ad991434e4a38327e15a1b5b5f945d66df615ae6d @@ -8749,13 +8439,6 @@ __metadata: languageName: node linkType: hard -"negotiator@npm:^0.6.2, negotiator@npm:^0.6.3": - version: 0.6.3 - resolution: "negotiator@npm:0.6.3" - checksum: 10/2723fb822a17ad55c93a588a4bc44d53b22855bf4be5499916ca0cab1e7165409d0b288ba2577d7b029f10ce18cf2ed8e703e5af31c984e1e2304277ef979837 - languageName: node - linkType: hard - "negotiator@npm:^1.0.0": version: 1.0.0 resolution: "negotiator@npm:1.0.0" @@ -8958,64 +8641,23 @@ __metadata: languageName: node linkType: hard -"node-gyp@npm:8.x": - version: 8.4.1 - resolution: "node-gyp@npm:8.4.1" - dependencies: - env-paths: "npm:^2.2.0" - glob: "npm:^7.1.4" - graceful-fs: "npm:^4.2.6" - make-fetch-happen: "npm:^9.1.0" - nopt: "npm:^5.0.0" - npmlog: "npm:^6.0.0" - rimraf: "npm:^3.0.2" - semver: "npm:^7.3.5" - tar: "npm:^6.1.2" - which: "npm:^2.0.2" - bin: - node-gyp: bin/node-gyp.js - checksum: 10/5ac19a7f6212c787f33bb72f889fafb1ce9d80b7ecb87b3785aebb0ff94a70cd5dbb3ecb435a308eaeb26d037c6edaf173951a9edacaadf0f4c3ae189f1e5077 - languageName: node - linkType: hard - -"node-gyp@npm:^12.1.0, node-gyp@npm:^12.4.0": - version: 12.4.0 - resolution: "node-gyp@npm:12.4.0" +"node-gyp@npm:^11.5.0": + version: 11.5.0 + resolution: "node-gyp@npm:11.5.0" dependencies: env-paths: "npm:^2.2.0" exponential-backoff: "npm:^3.1.1" graceful-fs: "npm:^4.2.6" - nopt: "npm:^9.0.0" - proc-log: "npm:^6.0.0" + make-fetch-happen: "npm:^14.0.3" + nopt: "npm:^8.0.0" + proc-log: "npm:^5.0.0" semver: "npm:^7.3.5" - tar: "npm:^7.5.4" + tar: "npm:^7.4.3" tinyglobby: "npm:^0.2.12" - undici: "npm:^6.25.0" - which: "npm:^6.0.0" + which: "npm:^5.0.0" bin: node-gyp: bin/node-gyp.js - checksum: 10/b1f52282398b08ed485f7d93859d45a7bd54f9a3ba8f1e2626ebc2e7e150834c20d90d7f204e07f67c0a88e85c7400d90e01618d7e6d7dd8056bc493821ef181 - languageName: node - linkType: hard - -"node-gyp@npm:latest": - version: 9.4.0 - resolution: "node-gyp@npm:9.4.0" - dependencies: - env-paths: "npm:^2.2.0" - exponential-backoff: "npm:^3.1.1" - glob: "npm:^7.1.4" - graceful-fs: "npm:^4.2.6" - make-fetch-happen: "npm:^11.0.3" - nopt: "npm:^6.0.0" - npmlog: "npm:^6.0.0" - rimraf: "npm:^3.0.2" - semver: "npm:^7.3.5" - tar: "npm:^6.1.2" - which: "npm:^2.0.2" - bin: - node-gyp: bin/node-gyp.js - checksum: 10/458317127c63877365f227b18ef2362b013b7f8440b35ae722935e61b31e6b84ec0e3625ab07f90679e2f41a1d5a7df6c4049fdf8e7b3c81fcf22775147b47ac + checksum: 10/15a600b626116e1e528c49f73027c5ff84dbf6986df77b0fb61d6eb079ab4230c39f245295cb67f0590e6541a848cbd267e00c5769e8fb8bf88a5cca3701b551 languageName: node linkType: hard @@ -9033,25 +8675,14 @@ __metadata: languageName: node linkType: hard -"nopt@npm:^5.0.0": - version: 5.0.0 - resolution: "nopt@npm:5.0.0" - dependencies: - abbrev: "npm:1" - bin: - nopt: bin/nopt.js - checksum: 10/00f9bb2d16449469ba8ffcf9b8f0eae6bae285ec74b135fec533e5883563d2400c0cd70902d0a7759e47ac031ccf206ace4e86556da08ed3f1c66dda206e9ccd - languageName: node - linkType: hard - -"nopt@npm:^6.0.0": - version: 6.0.0 - resolution: "nopt@npm:6.0.0" +"nopt@npm:^8.0.0": + version: 8.1.0 + resolution: "nopt@npm:8.1.0" dependencies: - abbrev: "npm:^1.0.0" + abbrev: "npm:^3.0.0" bin: nopt: bin/nopt.js - checksum: 10/3c1128e07cd0241ae66d6e6a472170baa9f3e84dd4203950ba8df5bafac4efa2166ce917a57ef02b01ba7c40d18b2cc64b29b225fd3640791fe07b24f0b33a32 + checksum: 10/26ab456c51a96f02a9e5aa8d1b80ef3219f2070f3f3528a040e32fb735b1e651e17bdf0f1476988d3a46d498f35c65ed662d122f340d38ce4a7e71dd7b20c4bc languageName: node linkType: hard @@ -9306,18 +8937,6 @@ __metadata: languageName: node linkType: hard -"npmlog@npm:^6.0.0": - version: 6.0.2 - resolution: "npmlog@npm:6.0.2" - dependencies: - are-we-there-yet: "npm:^3.0.0" - console-control-strings: "npm:^1.1.0" - gauge: "npm:^4.0.3" - set-blocking: "npm:^2.0.0" - checksum: 10/82b123677e62deb9e7472e27b92386c09e6e254ee6c8bcd720b3011013e4168bc7088e984f4fbd53cb6e12f8b4690e23e4fa6132689313e0d0dc4feea45489bb - languageName: node - linkType: hard - "object-assign@npm:^4.0.1": version: 4.1.1 resolution: "object-assign@npm:4.1.1" @@ -9493,15 +9112,6 @@ __metadata: languageName: node linkType: hard -"p-map@npm:^4.0.0": - version: 4.0.0 - resolution: "p-map@npm:4.0.0" - dependencies: - aggregate-error: "npm:^3.0.0" - checksum: 10/7ba4a2b1e24c05e1fc14bbaea0fc6d85cf005ae7e9c9425d4575550f37e2e584b1af97bcde78eacd7559208f20995988d52881334db16cf77bc1bcf68e48ed7c - languageName: node - linkType: hard - "p-map@npm:^7.0.1, p-map@npm:^7.0.2, p-map@npm:^7.0.4": version: 7.0.6 resolution: "p-map@npm:7.0.6" @@ -10156,6 +9766,13 @@ __metadata: languageName: unknown linkType: soft +"proc-log@npm:^5.0.0": + version: 5.0.0 + resolution: "proc-log@npm:5.0.0" + checksum: 10/35610bdb0177d3ab5d35f8827a429fb1dc2518d9e639f2151ac9007f01a061c30e0c635a970c9b00c39102216160f6ec54b62377c92fac3b7bfc2ad4b98d195c + languageName: node + linkType: hard + "proc-log@npm:^6.0.0, proc-log@npm:^6.1.0": version: 6.1.0 resolution: "proc-log@npm:6.1.0" @@ -10191,13 +9808,6 @@ __metadata: languageName: node linkType: hard -"promise-inflight@npm:^1.0.1": - version: 1.0.1 - resolution: "promise-inflight@npm:1.0.1" - checksum: 10/1560d413ea20c5a74f3631d39ba8cbd1972b9228072a755d01e1f5ca5110382d9af76a1582d889445adc6e75bb5ac4886b56dc4b6eae51b30145d7bb1ac7505b - languageName: node - linkType: hard - "promise-retry@npm:^2.0.1": version: 2.0.1 resolution: "promise-retry@npm:2.0.1" @@ -10495,7 +10105,7 @@ __metadata: languageName: node linkType: hard -"readable-stream@npm:^3.1.1, readable-stream@npm:^3.4.0, readable-stream@npm:^3.6.0": +"readable-stream@npm:^3.1.1, readable-stream@npm:^3.4.0": version: 3.6.2 resolution: "readable-stream@npm:3.6.2" dependencies: @@ -10601,17 +10211,6 @@ __metadata: languageName: node linkType: hard -"rimraf@npm:^3.0.2": - version: 3.0.2 - resolution: "rimraf@npm:3.0.2" - dependencies: - glob: "npm:^7.1.3" - bin: - rimraf: bin.js - checksum: 10/063ffaccaaaca2cfd0ef3beafb12d6a03dd7ff1260d752d62a6077b5dfff6ae81bea571f655bb6b589d366930ec1bdd285d40d560c0dae9b12f125e54eb743d5 - languageName: node - linkType: hard - "rolldown@npm:~1.2.1": version: 1.2.4 resolution: "rolldown@npm:1.2.4" @@ -10919,13 +10518,6 @@ __metadata: languageName: node linkType: hard -"set-blocking@npm:^2.0.0": - version: 2.0.0 - resolution: "set-blocking@npm:2.0.0" - checksum: 10/8980ebf7ae9eb945bb036b6e283c547ee783a1ad557a82babf758a065e2fb6ea337fd82cac30dd565c1e606e423f30024a19fff7afbf4977d784720c4026a8ef - languageName: node - linkType: hard - "setprototypeof@npm:~1.2.0": version: 1.2.0 resolution: "setprototypeof@npm:1.2.0" @@ -11181,28 +10773,6 @@ __metadata: languageName: node linkType: hard -"socks-proxy-agent@npm:^6.0.0": - version: 6.2.1 - resolution: "socks-proxy-agent@npm:6.2.1" - dependencies: - agent-base: "npm:^6.0.2" - debug: "npm:^4.3.3" - socks: "npm:^2.6.2" - checksum: 10/554749ba3bdba0742ec36493a907261c116dd0dafcd618ea5babdfc90ce5a5ae648d4ee4d2e26e7184afd854973d282372ce0af63e1fc6412bb9fa1a2b1f2d45 - languageName: node - linkType: hard - -"socks-proxy-agent@npm:^7.0.0": - version: 7.0.0 - resolution: "socks-proxy-agent@npm:7.0.0" - dependencies: - agent-base: "npm:^6.0.2" - debug: "npm:^4.3.3" - socks: "npm:^2.6.2" - checksum: 10/26c75d9c62a9ed3fd494df60e65e88da442f78e0d4bc19bfd85ac37bd2c67470d6d4bba5202e804561cda6674db52864c9e2a2266775f879bc8d89c1445a5f4c - languageName: node - linkType: hard - "socks-proxy-agent@npm:^8.0.3": version: 8.0.5 resolution: "socks-proxy-agent@npm:8.0.5" @@ -11214,7 +10784,7 @@ __metadata: languageName: node linkType: hard -"socks@npm:^2.6.2, socks@npm:^2.8.3": +"socks@npm:^2.8.3": version: 2.8.9 resolution: "socks@npm:2.8.9" dependencies: @@ -11376,12 +10946,12 @@ __metadata: languageName: node linkType: hard -"ssri@npm:^10.0.0": - version: 10.0.5 - resolution: "ssri@npm:10.0.5" +"ssri@npm:^12.0.0": + version: 12.0.0 + resolution: "ssri@npm:12.0.0" dependencies: minipass: "npm:^7.0.3" - checksum: 10/453f9a1c241c13f5dfceca2ab7b4687bcff354c3ccbc932f35452687b9ef0ccf8983fd13b8a3baa5844c1a4882d6e3ddff48b0e7fd21d743809ef33b80616d79 + checksum: 10/7024c1a6e39b3f18aa8f1c8290e884fe91b0f9ca5a6c6d410544daad54de0ba664db879afe16412e187c6c292fd60b937f047ee44292e5c2af2dcc6d8e1a9b48 languageName: node linkType: hard @@ -11394,15 +10964,6 @@ __metadata: languageName: node linkType: hard -"ssri@npm:^8.0.0, ssri@npm:^8.0.1": - version: 8.0.1 - resolution: "ssri@npm:8.0.1" - dependencies: - minipass: "npm:^3.1.1" - checksum: 10/fde247b7107674d9a424a20f9c1a6e3ad88a139c2636b9d9ffa7df59e85e11a894cdae48fadd0ad6be41eb0d5b847fe094736513d333615c7eebc3d111abe0d2 - languageName: node - linkType: hard - "stack-utils@npm:^2.0.3, stack-utils@npm:^2.0.6": version: 2.0.6 resolution: "stack-utils@npm:2.0.6" @@ -11467,7 +11028,7 @@ __metadata: languageName: node linkType: hard -"string-width-cjs@npm:string-width@^4.2.0, string-width@npm:^1.0.2 || 2 || 3 || 4, string-width@npm:^4.1.0, string-width@npm:^4.2.0, string-width@npm:^4.2.3": +"string-width-cjs@npm:string-width@^4.2.0, string-width@npm:^4.1.0, string-width@npm:^4.2.0, string-width@npm:^4.2.3": version: 4.2.3 resolution: "string-width@npm:4.2.3" dependencies: @@ -12210,7 +11771,7 @@ __metadata: languageName: node linkType: hard -"undici@npm:^6.23.0, undici@npm:^6.25.0": +"undici@npm:^6.23.0": version: 6.28.0 resolution: "undici@npm:6.28.0" checksum: 10/672a7a53bd1f6c80edb73b357ab36e98ef9e474024c442aab2b8ea2bc32f1103cab05525c78661ae724f3e1340e23d03efb9730fba28e76218ab0ec52e15d75a @@ -12252,39 +11813,21 @@ __metadata: languageName: node linkType: hard -"unique-filename@npm:^1.1.1": - version: 1.1.1 - resolution: "unique-filename@npm:1.1.1" - dependencies: - unique-slug: "npm:^2.0.0" - checksum: 10/9b6969d649a2096755f19f793315465c6427453b66d67c2a1bee8f36ca7e1fc40725be2c028e974dec110d365bd30a4248e89b1044dc1dfe29663b6867d071ef - languageName: node - linkType: hard - -"unique-filename@npm:^3.0.0": - version: 3.0.0 - resolution: "unique-filename@npm:3.0.0" - dependencies: - unique-slug: "npm:^4.0.0" - checksum: 10/8e2f59b356cb2e54aab14ff98a51ac6c45781d15ceaab6d4f1c2228b780193dc70fae4463ce9e1df4479cb9d3304d7c2043a3fb905bdeca71cc7e8ce27e063df - languageName: node - linkType: hard - -"unique-slug@npm:^2.0.0": - version: 2.0.2 - resolution: "unique-slug@npm:2.0.2" +"unique-filename@npm:^4.0.0": + version: 4.0.0 + resolution: "unique-filename@npm:4.0.0" dependencies: - imurmurhash: "npm:^0.1.4" - checksum: 10/6cfaf91976acc9c125fd0686c561ee9ca0784bb4b2b408972e6cd30e747b4ff0ca50264c01bcf5e711b463535ea611ffb84199e9f73088cd79ac9ddee8154042 + unique-slug: "npm:^5.0.0" + checksum: 10/6a62094fcac286b9ec39edbd1f8f64ff92383baa430af303dfed1ffda5e47a08a6b316408554abfddd9730c78b6106bef4ca4d02c1231a735ddd56ced77573df languageName: node linkType: hard -"unique-slug@npm:^4.0.0": - version: 4.0.0 - resolution: "unique-slug@npm:4.0.0" +"unique-slug@npm:^5.0.0": + version: 5.0.0 + resolution: "unique-slug@npm:5.0.0" dependencies: imurmurhash: "npm:^0.1.4" - checksum: 10/40912a8963fc02fb8b600cf50197df4a275c602c60de4cac4f75879d3c48558cfac48de08a25cc10df8112161f7180b3bbb4d662aadb711568602f9eddee54f0 + checksum: 10/beafdf3d6f44990e0a5ce560f8f881b4ee811be70b6ba0db25298c31c8cf525ed963572b48cd03be1c1349084f9e339be4241666d7cf1ebdad20598d3c652b27 languageName: node linkType: hard @@ -12986,7 +12529,7 @@ __metadata: languageName: node linkType: hard -"which@npm:^2.0.1, which@npm:^2.0.2": +"which@npm:^2.0.1": version: 2.0.2 resolution: "which@npm:2.0.2" dependencies: @@ -12997,6 +12540,17 @@ __metadata: languageName: node linkType: hard +"which@npm:^5.0.0": + version: 5.0.0 + resolution: "which@npm:5.0.0" + dependencies: + isexe: "npm:^3.1.1" + bin: + node-which: bin/which.js + checksum: 10/6ec99e89ba32c7e748b8a3144e64bfc74aa63e2b2eacbb61a0060ad0b961eb1a632b08fb1de067ed59b002cec3e21de18299216ebf2325ef0f78e0f121e14e90 + languageName: node + linkType: hard + "which@npm:^6.0.0, which@npm:^6.0.1": version: 6.0.1 resolution: "which@npm:6.0.1" @@ -13020,15 +12574,6 @@ __metadata: languageName: node linkType: hard -"wide-align@npm:^1.1.5": - version: 1.1.5 - resolution: "wide-align@npm:1.1.5" - dependencies: - string-width: "npm:^1.0.2 || 2 || 3 || 4" - checksum: 10/d5f8027b9a8255a493a94e4ec1b74a27bff6679d5ffe29316a3215e4712945c84ef73ca4045c7e20ae7d0c72f5f57f296e04a4928e773d4276a2f1222e4c2e99 - languageName: node - linkType: hard - "wordwrap@npm:^1.0.0": version: 1.0.0 resolution: "wordwrap@npm:1.0.0" From 898ec72b42129f4a5b9fb38b3238848bbf2f5583 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Rzepecki?= Date: Mon, 17 Aug 2026 11:47:36 +0200 Subject: [PATCH 08/11] chore(deps): override postcss to ^8.5.26 to fix pinned-transitive advisories next@14.2.35 depends on `"postcss": "8.4.31"` -- an exact pin, so the resolver has no range to move within and this cannot be fixed by a bump. A resolution override is the only route short of moving test/next off Next 14. Clears four findings: - GHSA-28wg-ghj8-5hjv (high) and GHSA-2v37-7h3g-55p8 (high) -- nanoid non-secure/custom generators can loop indefinitely; pulled in via postcss -> nanoid, now 3.3.18 - the two remaining postcss advisories against 8.4.31 Scope of verification: test/next and test/next16 both pass, but neither test app contains any CSS or a postcss config, so postcss is loaded by Next's build pipeline without being meaningfully exercised. The override stays inside the 8.x major and both workspaces are private and test-only, so the blast radius is limited to CI; Next's exact pin looks like lockfile hygiene on Vercel's side rather than a hard API requirement. Assisted-by: Claude:claude-opus-5[1m] --- package.json | 1 + yarn.lock | 26 ++------------------------ 2 files changed, 3 insertions(+), 24 deletions(-) diff --git a/package.json b/package.json index 22035f8..876f55e 100644 --- a/package.json +++ b/package.json @@ -99,6 +99,7 @@ }, "resolutions": { "node-gyp": "^11.5.0", + "postcss": "^8.5.26", "rollup": "^4.59.0", "tar": "7.5.22" }, diff --git a/yarn.lock b/yarn.lock index 292f583..f88e885 100644 --- a/yarn.lock +++ b/yarn.lock @@ -8416,7 +8416,7 @@ __metadata: languageName: node linkType: hard -"nanoid@npm:^3.3.16, nanoid@npm:^3.3.17, nanoid@npm:^3.3.6": +"nanoid@npm:^3.3.17": version: 3.3.18 resolution: "nanoid@npm:3.3.18" bin: @@ -9571,29 +9571,7 @@ __metadata: languageName: node linkType: hard -"postcss@npm:8.4.31": - version: 8.4.31 - resolution: "postcss@npm:8.4.31" - dependencies: - nanoid: "npm:^3.3.6" - picocolors: "npm:^1.0.0" - source-map-js: "npm:^1.0.2" - checksum: 10/1a6653e72105907377f9d4f2cd341d8d90e3fde823a5ddea1e2237aaa56933ea07853f0f2758c28892a1d70c53bbaca200eb8b80f8ed55f13093003dbec5afa0 - languageName: node - linkType: hard - -"postcss@npm:8.5.23": - version: 8.5.23 - resolution: "postcss@npm:8.5.23" - dependencies: - nanoid: "npm:^3.3.16" - picocolors: "npm:^1.1.1" - source-map-js: "npm:^1.2.1" - checksum: 10/8387f421216696bf62a13e5a270e9fefdafc81e196903c0f8d7653f8bab315367cc2261b3c22cf197e492cb075f31bdfc07fd9c3be1cb165ff3cabe14c5a039a - languageName: node - linkType: hard - -"postcss@npm:^8.4.43, postcss@npm:^8.5.25, postcss@npm:^8.5.6": +"postcss@npm:^8.5.26": version: 8.5.26 resolution: "postcss@npm:8.5.26" dependencies: From cd1ccfdaec5c76e06fdaf9cb1bd7fe8f30a25d33 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Rzepecki?= Date: Mon, 17 Aug 2026 12:09:56 +0200 Subject: [PATCH 09/11] chore: accept remaining audit findings by advisory ID and document them `yarn npm audit -AR` now exits clean. Every remaining finding is listed individually in `npmAuditIgnoreAdvisories` with a rationale, and the reasoning plus the version floors that unblock each group are written up in docs/maintenance/deferred-upgrades.md. Listed by advisory ID rather than via `npmAuditExcludePackages` on purpose. Excluding a package masks its future advisories too, and for `next` and `vite` that would hide genuinely actionable alerts against test/next16 (current Next 16.x) and the vitest 3/4 chains (vite 7/8). Verified precise rather than blanket: removing any single ID makes exactly that finding reappear. The list is long, so it is structured to be retired wholesale rather than audited entry by entry. Each block carries a `REMOVE WHEN:` line naming the version floor that frees it, and the doc has the matching table. 26 of the 31 entries go away with just the vitest<3 and Next<15 drops. Accepted groups, all dev/test-only -- `yarn npm audit -R --environment production` reports no suggestions, so nothing here reaches published dist/: - vitest 0.34.6/1.6.1/2.1.9 GHSA-5xrq-8626-4rwp (critical). No fix exists on those lines; each is the final release of its major. Needs the Vitest UI server listening, which these tests never start. - next 14.2.35, 21 advisories. 14.2.35 is the last stable 14.x, so there is no headroom within the major. - vite 5.4.21 and esbuild 0.21.5, downstream of vitest 0.34/1.6 pinning vite ^5; 5.4.21 is the last 5.x. - serialize-javascript 6.0.2 via mocha. No released mocha allows 7.x, and an override is blocked because 7.x requires Node >=20. - prebuild-install, glob and inflight deprecation notices with no successor. The doc also records two decisions that are easy to undo by accident: - Dependabot, not yarn audit, is the security signal here, and accepted alerts are dismissed manually. Dismissals are self-cleaning where a config file rots, and it is already the established workflow. Moving the test fixtures' deps to devDependencies to make a development-scope auto-triage rule match was investigated and rejected: 24 of 31 alerts attribute to yarn.lock, which carries no dev/runtime partition, so only the 7 direct next alerts could flip -- and those disappear with the Next 14 drop anyway. - yarn audit is deliberately not a CI gate. It duplicates Dependabot and would fail builds on findings we have explicitly accepted. Assisted-by: Claude:claude-opus-5[1m] --- .yarnrc.yml | 84 ++++++++++ docs/maintenance/deferred-upgrades.md | 221 ++++++++++++++++++++++++++ 2 files changed, 305 insertions(+) create mode 100644 docs/maintenance/deferred-upgrades.md diff --git a/.yarnrc.yml b/.yarnrc.yml index 979dcaf..72a305e 100644 --- a/.yarnrc.yml +++ b/.yarnrc.yml @@ -5,3 +5,87 @@ enableGlobalCache: true nodeLinker: node-modules yarnPath: .yarn/releases/yarn-4.13.0.cjs + +# Accepted `yarn npm audit -AR` findings. See +# docs/maintenance/deferred-upgrades.md for the full rationale and the version +# floors that unblock each group. +# +# These are listed as individual advisory IDs rather than via +# npmAuditExcludePackages on purpose: excluding a package masks its *future* +# advisories too, and for `next` and `vite` that would hide genuinely +# actionable alerts against test/next16 (Next 16.x) and the vitest 3/4 chains +# (vite 7/8). Suppressing by ID keeps every new advisory visible. +# +# Nothing here reaches the published `dist/`: +# yarn npm audit -R --environment production => No audit suggestions +# +# Every block below carries a REMOVE WHEN line naming the version floor that +# retires it. Blocks are deleted wholesale, not audited entry by entry -- 26 of +# these 31 entries go away with just the vitest<3 and Next<15 drops. +npmAuditIgnoreAdvisories: + # vitest 0.34.6 / 1.6.1 / 2.1.9 (test/vitest, test/vitest1, test/vitest2) + # GHSA-5xrq-8626-4rwp, critical. No fix exists on these lines - upstream + # fixed it in 3.2.6 and 4.1.0 only, and each of these is the final release + # of its major. Requires the Vitest UI server to be listening; never started. + # REMOVE WHEN: support for vitest < 3 is dropped. + - "1139528" + + # next 14.2.35 (test/next). 14.2.35 is the last stable 14.x, so there is no + # headroom within the major; every fix landed in 15.5.x or later. + # REMOVE WHEN: test/next moves off the Next 14 line. + - "1112593" + - "1112653" + - "1114897" + - "1114940" + - "1116376" + - "1117931" + - "1118942" + - "1118944" + - "1118946" + - "1118948" + - "1118952" + - "1118954" + - "1118958" + - "1118962" + - "1124172" + - "1124185" + - "1124187" + - "1124189" + - "1124191" + - "1124193" + - "1124197" + + # vite 5.4.21, pinned by vitest 0.34.6 (`^3.1.0 || ^4.0.0 || ^5.0.0-0`) and + # 1.6.1 (`^5.0.0`). 5.4.21 is the last 5.x; fixes land in 6.4.3+. + # REMOVE WHEN: support for vitest < 3 is dropped. + - "1116229" + - "1120784" + - "1123525" + + # esbuild 0.21.5, pinned by vite 5.4.21 (`^0.21.3`). + # REMOVE WHEN: support for vitest < 3 is dropped. + - "1102341" + + # serialize-javascript 6.0.2 via mocha. No released mocha allows the fix: + # 10.8.2 and 11.8.0 both pin `^6.0.2`, only mocha 12.0.0-rc.6 moves to + # `^7.0.2`. A resolution override is blocked too - serialize-javascript 7.x + # declares `engines.node: >=20.0.0` and we still support Node 18. Only + # reachable from mocha's parallel-mode workers, which test/mocha never uses. + # REMOVE WHEN: engines.node floor reaches 20 (then bump mocha and drop the + # `resolutions` block on it, or override serialize-javascript to ^7.1.0). + - "1113686" + - "1119440" + + # Deprecation notices with no available successor. + # prebuild-install: unmaintained, 7.1.3 is latest, sqlite3 6.x needs it too. + # REMOVE WHEN: never, unless upstream sqlite3 changes build tooling. + # glob 10.5.0: via node-gyp 11 -> make-fetch-happen -> cacache 19. node-gyp + # 12 drops that subtree entirely but needs Node >=20.17. + # REMOVE WHEN: engines.node floor reaches 20.17, then drop the node-gyp + # `resolutions` pin (or move it to ^12) and this clears itself. + # inflight: via mocha's glob 8.1.0. mocha 11 moves to glob ^10.4.5, which + # only swaps this notice for the glob one above. + # REMOVE WHEN: mocha is bumped past 10.x. + - "prebuild-install (deprecation)" + - "glob (deprecation)" + - "inflight (deprecation)" diff --git a/docs/maintenance/deferred-upgrades.md b/docs/maintenance/deferred-upgrades.md new file mode 100644 index 0000000..199821d --- /dev/null +++ b/docs/maintenance/deferred-upgrades.md @@ -0,0 +1,221 @@ +# Deferred dependency upgrades + +Maintainer reference for the accepted `yarn npm audit -AR` findings and the +version floors that unblock them. Written 2026-08-17. + +`yarn npm audit -AR` should exit clean. It does so because every finding below +is listed by advisory ID in `npmAuditIgnoreAdvisories` in `.yarnrc.yml`, with a +one-line rationale next to each group. **That file is the source of truth for +what is suppressed**; this document explains *why* and what it would take to +stop suppressing it. + +Advisory IDs and counts go stale quickly. The durable content here is the +"blocked on" grouping, not the tallies. + +It also records two decisions that are easy to "helpfully" undo later — see +[Dependabot](#dependabot) and +[Why `yarn npm audit` is not in CI](#why-yarn-npm-audit-is-not-in-ci). + +## Nothing we publish is affected + +``` +$ yarn npm audit -R --environment production +➤ YN0001: No audit suggestions +``` + +Every accepted finding lives in `devDependencies` or in a private, test-only +workspace under `test/`. None reach the published `dist/`, and none affect +consumers of `appmap-node`. + +## Suppress by advisory ID, not by package + +`.yarnrc.yml` deliberately uses `npmAuditIgnoreAdvisories` (advisory IDs) +rather than `npmAuditExcludePackages` (package names). + +Excluding a package masks its *future* advisories too. For `next` and `vite` +that would be actively harmful: it would hide genuinely actionable alerts +against `test/next16` (on the current Next 16.x line) and against the +vitest 3/4 chains (vite 7/8). Suppressing by ID keeps every new advisory +visible, at the cost of a longer list. + +This is verifiable — remove any single ID from the list and exactly that +finding reappears. + +## Retiring the suppressions + +The list is long (31 entries), so it is grouped into blocks that are deleted +**wholesale**, never audited entry by entry. Each block in `.yarnrc.yml` +carries a `REMOVE WHEN:` line naming its trigger. The mapping: + +| Do this | Delete these blocks | Entries freed | +| --- | --- | --- | +| Drop support for vitest < 3 | vitest, vite, esbuild | 5 | +| Move `test/next` off the Next 14 line | next | 21 | +| Raise `engines.node` to 20 | serialize-javascript | 2 | +| Raise `engines.node` to 20.17 | `glob (deprecation)`, and drop or retarget the `node-gyp` pin in `resolutions` | 1 | +| Bump mocha past 10.x | `inflight (deprecation)` | 1 | +| — (unfixable) | `prebuild-install (deprecation)` | 0 | + +**26 of the 31 entries go away with just the first two rows.** After any of +these, re-run `yarn npm audit -AR`: if it still exits clean with the block +deleted, the entries were dead and the deletion is correct. If something +reappears, the suppression was still load-bearing and the reason will be in the +block comment. + +## Blocked on dropping Node < 20 + +- **`serialize-javascript` 6.0.2 via mocha** — GHSA-5c6j-r48x-rmvq (high, RCE + via `RegExp.flags` / `Date.prototype.toISOString`) and GHSA-qj8w-gfj5-8c6v + (moderate, CPU-exhaustion DoS). Fixed in 7.0.5. + + No released mocha allows the fix: 10.8.2 **and** the latest 11.8.0 both pin + `serialize-javascript: ^6.0.2`; only `mocha@12.0.0-rc.6` moves to `^7.0.2`. + A `resolutions` override is blocked too, because **serialize-javascript 7.x + declares `engines.node: >=20.0.0`** while we declare `>=18` and CI covers + Node 18. + + Exposure is nil: mocha only requires it from `lib/nodejs/worker.js` and + `lib/nodejs/buffered-worker-pool.js` — parallel mode only — and `test/mocha` + has no `.mocharc` and never runs `--parallel`. + +- **`glob` 10.5.0 (deprecation).** We pin `node-gyp` to `^11.5.0` in + `resolutions`, which already cleared six findings. node-gyp **12.x** drops + `make-fetch-happen`/`cacache` entirely and would clear this last one too, but + declares `engines.node: ^20.17.0 || >=22.9.0`. node-gyp 11.5.0 declares + `^18.17.0 || >=20.5.0`, which matches our floor. + +- **`sqlite3`.** 6.x moves to node-gyp 12.x but declares + `engines.node: >=20.17.0`. + +## Blocked on dropping Next < 15 + +- **`next` 14.2.35 in `test/next`** — 21 advisories (high/moderate/low). Every + fix landed in 15.5.x or later; the highest floor required is **15.5.16**. + + **14.2.35 is the last stable 14.x** — only canaries beyond it — so there is + no headroom whatsoever within the major. It is the major bump or nothing. + + This workspace exists to cover the Next 14 instrumentation path + (`loadConfig` + injected webpack loader). `test/next16` already covers the + current line. Options: accept, drop Next 14 coverage, or add a + `test/next15`. + +## Blocked on dropping vitest < 3 + +- **`vitest` 0.34.6 / 1.6.1 / 2.1.9** (`test/vitest`, `test/vitest1`, + `test/vitest2`) — GHSA-5xrq-8626-4rwp, **critical**, arbitrary file read and + execution while the Vitest UI server is listening. + + **No fix exists on these lines.** Upstream fixed it in 3.2.6 and 4.1.0 only; + each of 0.34.6, 1.6.1 and 2.1.9 is the final release of its major. + `test/vitest3` and `test/vitest4` are already on fixed versions. Exposure is + nil — the advisory requires the Vitest **UI** server to be listening, which + these tests never start. + +- **`vite` 5.4.21 and `esbuild` 0.21.5** — 4 advisories, strictly downstream of + the above. `vitest` 1.6.1 pins `vite: ^5.0.0` and 0.34.6 pins + `^3.1.0 || ^4.0.0 || ^5.0.0-0`, while the vite fixes land in 6.4.3+. + **5.4.21 is the last 5.x** and it pins `esbuild: ^0.21.3`. Resolves itself + when vitest < 3 goes. + +## Unfixable at any version floor + +- **`prebuild-install` 7.1.3 (deprecation)** — unmaintained with no successor + ("contact the author of the relevant native module"). 7.1.3 is the latest + release and sqlite3 6.x depends on it too, so bumping sqlite3 will not help. + +- **`inflight` 1.0.6 (deprecation)** via mocha's `glob` 8.1.0 — mocha 11 moves + to `glob ^10.4.5`, which would drop `inflight` but only swaps it for the + `glob` 10.5.0 notice above. Not worth a mocha major on its own. + +## Active `resolutions` overrides + +Two entries in the root `package.json` exist purely to fix advisories that +could not be reached by bumping: + +- **`node-gyp: ^11.5.0`** — three different *optional* node-gyp entries (8.4.1 + via sqlite3, 9.4.0 via `fsevents`/`node-addon-api` declaring + `node-gyp: latest`, 12.4.0 via npm's own tree) were dragging in a large + deprecated subtree. `yarn npm audit -AR` reports optional lockfile entries + even though nothing links them — sqlite3 and fsevents both ship prebuilt + binaries, so node-gyp never runs here. Consolidating cleared `npmlog`, + `gauge`, `are-we-there-yet`, `rimraf`, `@npmcli/move-file` and + `@tootallnate/once`. + +- **`postcss: ^8.5.26`** — `next@14.2.35` depends on `"postcss": "8.4.31"`, an + *exact* pin, so the resolver has no range to move within. The override also + pulls `nanoid` 3.3.18, clearing two high-severity advisories. Note that + neither Next test app contains any CSS or postcss config, so postcss is + loaded by the build pipeline without being meaningfully exercised. + +Both should be re-evaluated when the version floors move — the node-gyp pin in +particular becomes unnecessary once Node 18 is dropped. + +## Dependabot + +**Dependabot, not `yarn npm audit`, is the security signal for this repo.** It +runs unprompted and opens bump PRs when a fix exists. The yarn audit +suppressions above exist only so that an ad-hoc `yarn npm audit -AR` is +readable; they are not a second security process. + +### Manual alert dismissal is the chosen approach + +Dismiss accepted alerts in the Security tab (or via the REST API) with reason +`not_used` — accurate here, since the vulnerable code paths are never exercised +by hello-world test fixtures. + +This is deliberately preferred over any in-repo config, because **dismissals +are self-cleaning**: they resolve on their own when the dependency moves, and +they live in GitHub's alert state rather than rotting in a file that someone has +to remember to prune. It is also already the established workflow here — the +`vite`, `vitest` and `serialize-javascript` alerts absent from the alert list as +of 2026-08-17 were absent because they had been manually dismissed earlier, and +they stayed quiet. + +### Do not move test deps to `devDependencies` for this + +The tempting fix is an auto-triage rule scoped to development dependencies, and +making it match by moving the private test fixtures' deps from `dependencies` to +`devDependencies`. **This was investigated and rejected.** Alert attribution as +of 2026-08-17: + +| Manifest | Alerts | Packages | +| --- | --- | --- | +| `yarn.lock` | 24 | body-parser, esbuild, nanoid, next, postcss, sharp | +| `test/next/package.json` | 7 | next | + +A lockfile carries no dev/runtime partition, so everything attributed there is +classified `runtime` regardless of how the manifests are written — and those 24 +are transitive deps that will *always* be lockfile-attributed. The flip could +only affect the 7 direct `next` alerts, which are exactly the ones that +disappear when `test/next` moves off Next 14 anyway. Roughly 13 manifests +touched for a partial win on the subset already scheduled for deletion. + +### Reference + +- `ignore` rules in `.github/dependabot.yml` suppress Dependabot's *pull + requests* only; they do **not** dismiss alerts in the Security tab. There is + no `dependabot.yml` in this repo, and adding one would newly enable + version-update PRs. +- Dismissing alerts requires the Security tab, the REST API, or auto-triage + rules (repo/org Settings → Code security). +- Dependabot reports no deprecation notices at all; those are a yarn feature. + So `glob`, `inflight` and `prebuild-install` will never appear as alerts. + +## Why `yarn npm audit` is not in CI + +Deliberate — please do not add it without revisiting this. + +It would largely duplicate Dependabot, which already covers the same advisories +and additionally opens fix PRs. Worse, as a build gate it would fail CI on +findings we have explicitly decided to accept, turning every accepted risk into +either a red build or another suppression edit. The only things yarn audit adds +over Dependabot are deprecation notices and optional-lockfile entries — real, +but not worth gating on. + +Run it ad hoc instead, and expect it to exit clean: + +``` +yarn npm audit -AR # accepted findings suppressed +yarn npm audit -R --environment production # what we actually publish +``` From b505b1c92d0cb90c542acfd71590aecfa079b8c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Rzepecki?= Date: Mon, 17 Aug 2026 12:50:58 +0200 Subject: [PATCH 10/11] test(next16): disable Next.js agent-rules file generation in the fixture Next 16 bundles @vercel/detect-agent and, on `next dev`, writes a managed AGENTS.md / CLAUDE.md block into the project directory when it detects an AI coding agent in the environment -- CLAUDECODE, AI_AGENT, CURSOR_TRACE_ID, GEMINI_CLI, CODEX_*, COPILOT_* and friends. See next/dist/server/lib/generate-agent-files.js, gated on `agentRules !== false` (default true). The effect is that running the suite under an AI coding agent leaves two untracked files in test/next16 while running it as a human leaves none, so the fixture is no longer reproducible across environments. Setting `agentRules: false` fixes the cause rather than hiding the symptom with .gitignore, and avoids committing Next's AI instructions into a fixture that serves one hello route. This is the first next.config in the repo. Verified with the detection env vars still set, so generation would otherwise have fired: test/next16.test.ts passes and the files are no longer created, i.e. the added config does not perturb the loadConfig hook or the injected webpack loader. Assisted-by: Claude:claude-opus-5[1m] --- test/next16/next.config.js | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 test/next16/next.config.js diff --git a/test/next16/next.config.js b/test/next16/next.config.js new file mode 100644 index 0000000..73a57bf --- /dev/null +++ b/test/next16/next.config.js @@ -0,0 +1,5 @@ +// Don't let `next dev` write AGENTS.md / CLAUDE.md into the fixture when it +// detects an AI coding agent in the environment (CLAUDECODE, AI_AGENT, CURSOR_* +// and friends -- see next/dist/compiled/@vercel/detect-agent). Keeps the test +// tree identical whether the suite is run by a human, by CI, or by an agent. +module.exports = { agentRules: false }; From 0c364676df18cd24a2d96aeeb792c0ad4b257dc4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Rzepecki?= Date: Mon, 17 Aug 2026 13:07:58 +0200 Subject: [PATCH 11/11] test(vitest): skip the vitest 4 cases on Node 18 vitest 4 declares `engines.node: ^20.0.0 || ^22.0.0 || >=24.0.0` and genuinely cannot start on Node 18. Bumping test/vitest4 to 4.1.10 pulled vite 8, which brings rolldown, and rolldown imports `styleText` from `node:util` -- added in Node 20.12. That is a SyntaxError at module load, so `vitest run` dies before executing anything and the run produces no AppMaps at all rather than failing an assertion: SyntaxError: The requested module 'node:util' does not provide an export named 'styleText' at async start (.../vitest/dist/chunks/cac.*.js) This surfaced as a Node 18 CI failure. It is a regression from the 4.1.10 bump: 4.0.18 resolved vite 7 without rolldown and did run on Node 18 despite declaring the same engines range. Skip rather than pin back, because vitest 4 does not support Node 18 by its own declaration -- exercising it there tests a combination no user can have, and any 4.x patch would break it again. Reverting to 4.0.18 would also reinstate GHSA-5xrq-8626-4rwp (critical). Scoped to v4 only, deliberately: vitest 0.34.6, 1.6.1, 2.1.9 and 3.2.7 all declare support for Node 18 (`^18.0.0`), so they keep running there. Verified on both: Node 18 gives 9 passed / 2 skipped, Node 24 gives 11 passed. Uses the same `cond ? test : test.skip` shape as test/postgres.test.ts and test/simple.test.ts. Assisted-by: Claude:claude-opus-5[1m] --- test/vitest.test.ts | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/test/vitest.test.ts b/test/vitest.test.ts index 38b78fa..54e14bb 100644 --- a/test/vitest.test.ts +++ b/test/vitest.test.ts @@ -1,4 +1,5 @@ import path from "node:path"; +import util from "node:util"; import { readAppmaps, runAppmapNode, testDir } from "./helpers"; // v0 keeps the original flag set @@ -11,16 +12,28 @@ describe("vitest v0", () => { }); }); +// vitest 4 declares engines.node ^20.0.0 || ^22.0.0 || >=24.0.0, but the real +// floor is tighter: it pulls vite 8, whose rolldown imports `styleText` from +// node:util. That landed in Node 20.12 and 21.7, so on Node 18, 20.0-20.11 and +// 21.0-21.6 the import is a SyntaxError at module load and `vitest run` dies +// before producing any AppMaps at all, rather than failing a test. +// +// Feature-detect instead of encoding that version table -- the child process +// spawned by runAppmapNode uses this same binary (process.argv[0]), so probing +// node:util here answers the question for the run that actually matters. +const nodeSupportsVitest4 = "styleText" in util; + // v1+ uses pool-based flags describe.each([ ["1", path.join(__dirname, "vitest1")], ["2", path.join(__dirname, "vitest2")], ["3", path.join(__dirname, "vitest3")], ["4", path.join(__dirname, "vitest4")], -])("vitest v%s", (_version, dir) => { +])("vitest v%s", (version, dir) => { beforeAll(() => testDir(dir)); - test.each(["", "--pool=forks"])("mapping vitest run %s", (arg) => { + const maybeTest = version === "4" && !nodeSupportsVitest4 ? test.skip : test; + maybeTest.each(["", "--pool=forks"])("mapping vitest run %s", (arg) => { const args = arg ? ["yarn", "vitest", "run", arg] : ["yarn", "vitest", "run"]; expect(runAppmapNode(...args).status).toBe(1); expect(readAppmaps()).toMatchSnapshot();