From 783c211763aedee9489d6e5a7c83430e56940bb6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 12:06:33 +0900 Subject: [PATCH 1/7] fix(security): require non-vulnerable Vitest line --- package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index b84959e05..d381babfe 100644 --- a/package.json +++ b/package.json @@ -61,10 +61,10 @@ }, "devDependencies": { "@cloudflare/workers-types": "^4.20260630.0", - "@vitest/coverage-v8": "^4.1.9", + "@vitest/coverage-v8": "^4.1.11", "esbuild": "0.28.1", "typescript": "^5.9.0", - "vitest": "^4.1.9", + "vitest": "^4.1.11", "workerd": "1.20260625.1" }, "overrides": { From 5864d0bab8273a1512fed282676598be7a53d617 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 12:06:45 +0900 Subject: [PATCH 2/7] test(security): reject vulnerable Vitest lock --- test/vitest-security-lock.test.ts | 65 +++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 test/vitest-security-lock.test.ts diff --git a/test/vitest-security-lock.test.ts b/test/vitest-security-lock.test.ts new file mode 100644 index 000000000..2b67df547 --- /dev/null +++ b/test/vitest-security-lock.test.ts @@ -0,0 +1,65 @@ +import { readFileSync } from "node:fs"; +import { describe, expect, it } from "vitest"; + +type LockPackage = { + version?: string; + devDependencies?: Record; +}; + +type PackageLock = { + packages?: Record; +}; + +const MINIMUM_SAFE_VITEST = [4, 1, 11] as const; + +function parseStableVersion(version: string): readonly [number, number, number] { + const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version); + if (!match) { + throw new Error(`Expected a stable semver, received ${version}`); + } + return [Number(match[1]), Number(match[2]), Number(match[3])]; +} + +function compareVersion( + left: readonly [number, number, number], + right: readonly [number, number, number], +): number { + for (let index = 0; index < left.length; index += 1) { + const difference = left[index] - right[index]; + if (difference !== 0) { + return difference; + } + } + return 0; +} + +function requirePackage(lock: PackageLock, path: string): LockPackage { + const entry = lock.packages?.[path]; + if (!entry) { + throw new Error(`Missing ${path} from package-lock.json`); + } + return entry; +} + +describe("Vitest security lock", () => { + const lock = JSON.parse( + readFileSync(new URL("../package-lock.json", import.meta.url), "utf8"), + ) as PackageLock; + + it("keeps direct Vitest requirements on the patched 4.1.11 line or newer", () => { + const root = requirePackage(lock, ""); + expect(root.devDependencies?.vitest).toBe("^4.1.11"); + expect(root.devDependencies?.["@vitest/coverage-v8"]).toBe("^4.1.11"); + }); + + it.each(["node_modules/vitest", "node_modules/@vitest/mocker"])( + "rejects CVE-2026-84373-vulnerable resolution at %s", + (path) => { + const version = requirePackage(lock, path).version; + if (!version) { + throw new Error(`Missing version for ${path}`); + } + expect(compareVersion(parseStableVersion(version), MINIMUM_SAFE_VITEST)).toBeGreaterThanOrEqual(0); + }, + ); +}); From d966e4a3b82a8dbc4829bf7ce58e5a83b4b51d3e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 13:09:52 +0900 Subject: [PATCH 3/7] fix(security): bind Vitest lock regeneration policy --- .github/lockfile-change-policy.json | 343 +++++++++++++++++++++++----- 1 file changed, 282 insertions(+), 61 deletions(-) diff --git a/.github/lockfile-change-policy.json b/.github/lockfile-change-policy.json index 08bca2e1d..8e2153a97 100644 --- a/.github/lockfile-change-policy.json +++ b/.github/lockfile-change-policy.json @@ -1,68 +1,289 @@ { - "baseSha": "d6394b2aa73e6fc57fccdad74ea38ad87f79e7f8", + "baseSha": "8108bae1128c20b92d79dacaf65c3d9e3d55b758", "bulkChange": null, - "justification": "Replace the Wrangler/Miniflare/Sharp transitive development path with direct pinned workerd@1.20260625.1 and esbuild@0.28.1 dependencies for Noema Worker development and deployment tooling. The reviewed lockfile transition removes the Wrangler-owned Miniflare/Sharp/Libvips package set, preserves unchanged package objects and top-level lockfile metadata, and binds the exact protected-main base and regenerated head bytes.", + "justification": "Remove CVE-2026-84373 by upgrading the reviewed Vitest development/test toolchain from 4.1.9 to the patched 4.1.11 line. The exact npm 11.17.0 regeneration artifact produced by hosted CI is promoted unchanged; unrelated dependency metadata changes are limited to npm-resolved transitive consequences of that exact package requirement change.", "packageDigests": { - "": {"afterSha256": "bc4820765f3986a162070a7c499943d4976663ce9dbf4bc0d039bc8111d14c87","beforeSha256": "bc4df75e5f7a57a7b5cbb8fca21fe3aada716dcd26e4bad5b889d93c5251e20c"}, - "node_modules/@cloudflare/kv-asset-handler": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "baf9a6828aa48335b6b1ddc90c064891668bf48ed319cb98bad1aae065e5b110"}, - "node_modules/@cloudflare/unenv-preset": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "3975dc435686ec2387ff6065520031589c8608c4040c1bffcfcf169693670bc6"}, - "node_modules/@cspotcode/source-map-support": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "be3b4d0e114620b28f168efe57e2f082751ec98c255e5ff44642903ca8c8abc1"}, - "node_modules/@img/colour": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "0ec9a3855c0d275ee3ddf26fc218c24bcd73c70ae1be64bc783adcee728fabd3"}, - "node_modules/@img/sharp-darwin-arm64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "33753afdce1a4ef04bdbe3955ee21f6f7ec2d0e24950d2d48853ac21d06e0207"}, - "node_modules/@img/sharp-darwin-x64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "92c5e9c8a824389e0d714e015b25bbfe4304b1968f9fc4551c31aeaa84953d7e"}, - "node_modules/@img/sharp-freebsd-wasm32": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "e93d997495809b38e24ee02aae3570fd5388f6f29aca13ecc5790df62c4bf2ee"}, - "node_modules/@img/sharp-libvips-darwin-arm64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "5cbb579d4f882d736f41709f4ab8df92b444cc24a04ddf4568b6248903988dea"}, - "node_modules/@img/sharp-libvips-darwin-x64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "52cc3b0d34d5f51e30fc3018eea0cf640c5963e6b662cacf9f6c377cc35b6dda"}, - "node_modules/@img/sharp-libvips-linux-arm": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "e5de57abbf3750ebae77db880bdee4dd9bd5823468fe4d6a54b6f0076508c120"}, - "node_modules/@img/sharp-libvips-linux-arm64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "b86ba40d539fb3254d0a045e330fa90141a3907deefadaf264ce4831512035a4"}, - "node_modules/@img/sharp-libvips-linux-ppc64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "666eb414e63b3f4a6f2338f14d6f59127c6f73562659425004d9258a499160a8"}, - "node_modules/@img/sharp-libvips-linux-riscv64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "c3e3d0a53cec8bb22b1319219dfcd6fc5d059cd2b133827668fac6e301f77c53"}, - "node_modules/@img/sharp-libvips-linux-s390x": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "6273b939a75e550fe2088ac52d90f1bb9918f93330d6b83a7df7db46b7b41efd"}, - "node_modules/@img/sharp-libvips-linux-x64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "21453f05d9d156d477d80b5f6726993033c6e7cc1ffba71d93042fa51648acb4"}, - "node_modules/@img/sharp-libvips-linuxmusl-arm64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "84a3b95e19257d67c939f31d82dc6549cad376ead8dc7a9e451e6cfb1d1b3b3e"}, - "node_modules/@img/sharp-libvips-linuxmusl-x64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "4c5fa48ebba69feada47c1b31653a099b461543c104807afdcecf437a1f05f3e"}, - "node_modules/@img/sharp-linux-arm": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "a65b10a97d8310bcb4d5e97be980320e91267d69b2b8fcd80aaa8134609e282c"}, - "node_modules/@img/sharp-linux-arm64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "07b70ea8a68735233da5aabe69863f359f77bf152addd717311907255038bd5c"}, - "node_modules/@img/sharp-linux-ppc64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "5a3f8bb47ada74df86462a8eb4c283cf2f5fc072974c81db4d98a5bd2774bfc6"}, - "node_modules/@img/sharp-linux-riscv64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "807f16be2b136919b9089a0df5fc506b3f66f2708205659eb7e11945a578e070"}, - "node_modules/@img/sharp-linux-s390x": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "dea04183a47348ebf4455ffc9f7b56d750a388bd59900937a3501a5f886fb0b5"}, - "node_modules/@img/sharp-linux-x64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "e8b884ec932accbb31472f9532d30d9dea8cf69e3665a02a47ff8a278f4a5d26"}, - "node_modules/@img/sharp-linuxmusl-arm64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "5d81370f988ddf9cfd71f818640fb1ddba3c61f34936ccd16f9318abb45e070a"}, - "node_modules/@img/sharp-linuxmusl-x64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "dcb1c509e3d9a5a917cfe6b3868acfe372bd4045a4bdeedb3c265d1c9ab2c1d8"}, - "node_modules/@img/sharp-wasm32": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "d372231a4a3a965acefef6e4082f35d7faafee7c0ac332d333267eed0230f73f"}, - "node_modules/@img/sharp-webcontainers-wasm32": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "3950aee6b7b49d472361e907dd0a38966a4362a9dcd8e3a94cb91187965051da"}, - "node_modules/@img/sharp-win32-arm64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "d7b719d77aad3ce761066678008a2b59ee708da1eac1edca5a52d595d064623c"}, - "node_modules/@img/sharp-win32-ia32": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "6ac2a1af086a1bd93c725d3379a2d63abb1ccb96fa22d11c320fab8ee9323c0e"}, - "node_modules/@img/sharp-win32-x64": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "83788206d3b5d601a59383a2e647e679ae3499f41a4c7c609f5d414fc876edf8"}, - "node_modules/@jridgewell/trace-mapping": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "946e048fd4f5f06fd3a2558cecdd7a7e1a179d1c60f88c1a10deff92904cefb6"}, - "node_modules/@poppinss/colors": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "9f6d9e5e656687bf9365aad30b1cd57e2005670d483825ff6a9041eb264c0a8c"}, - "node_modules/@poppinss/dumper": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "4636d1e8ce5d92e9e6a74b8e331a1d0599151c423620605b7f0d391a6a324f45"}, - "node_modules/@poppinss/exception": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "511ab6d7dda3a25412e2d6459b7458c52d35e8d5a38ccea9e8a1c767c2c2b6a3"}, - "node_modules/@sindresorhus/is": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "9cf703780184209ca125688afa81e6cf6a49ca4cee7a6442648003875ffa7ede"}, - "node_modules/@speed-highlight/core": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "b0d9aede1a43525b35c83c66cfe23301fefa32d437344a723f156bcb3bde75c6"}, - "node_modules/blake3-wasm": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "2edd7b9afb0a3edfde7bf65df2176834db86926fb79bcb81757f823ece33e0e8"}, - "node_modules/cookie": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "c83cc50b9edf74fff002ee1696f718a7893a2790be1c87668878d4259a9ed661"}, - "node_modules/error-stack-parser-es": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "07d175e9a9ce5da0ce6a91827c6c941d31f51684281f0060b3dc3df25db6cc02"}, - "node_modules/kleur": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "03d1698c44fce7057c0b68d8cba4bfad5ca7382a948e162d49d806f81ee4859c"}, - "node_modules/miniflare": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "3e4f60462e1a727ae18971cc7805b70cee7a5e1ba6265490550d3cd545ce7c2e"}, - "node_modules/path-to-regexp": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "206d20489bfee22f1bd8a9ef8b31f0c7bdf9544b7272decd73314db823528dd1"}, - "node_modules/sharp": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "185d39448de75db02f7418462440e6b8755e9f1e94fd88b66712835a9f22153a"}, - "node_modules/supports-color": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "1a548a2b86a1d2addc0f2fd3dc4a3da1f2a81cd8e94fe1f0d431de96989d234c"}, - "node_modules/undici": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "ab97f8ae955e187ed30dae56574c6f24277da4c4068383998f42dd18990d6c9b"}, - "node_modules/unenv": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "cd1ef9a2d07200fe1d861ae9a4f81c1b1990312c1c6d88ecf844246efb33f6fe"}, - "node_modules/wrangler": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "b52ea831e8e92ebe06b3ed1776cc1f781f7de77ece30a4237a95ff477df65455"}, - "node_modules/ws": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "8312a6b5d3e17eda63344fe09189e016ad35b526bbbef54af5468d22eb9902a6"}, - "node_modules/youch": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "faaf7ca34f95ab4401519c3222a9b37ef594158220cdb37ea4f3c483817e81d4"}, - "node_modules/youch-core": {"afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1","beforeSha256": "054aee49bedca6747ec8256719b1a9d6c5e834903f6606daa12ef8497dc70043"} + "": { + "afterSha256": "f45c7368a72c5f9a2382638634e499dfbe2d5c5832ca210b530fe4218bbfa062", + "beforeSha256": "bc4820765f3986a162070a7c499943d4976663ce9dbf4bc0d039bc8111d14c87" + }, + "node_modules/@emnapi/core": { + "afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1", + "beforeSha256": "848c03e936967e05f83295c12535f4e7b985ee104935b385a66c376cbec59ac9" + }, + "node_modules/@emnapi/runtime": { + "afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1", + "beforeSha256": "a0161c6254f2679a7b308bc63c038249535914d786acb1da984ec153d74ba06c" + }, + "node_modules/@emnapi/wasi-threads": { + "afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1", + "beforeSha256": "64bd9a72b619818d5539b9e7eb33fe325083b4d3d2b76c8507f35e98a73c9d4c" + }, + "node_modules/@napi-rs/wasm-runtime": { + "afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1", + "beforeSha256": "422f97ea210489213241762d2de12275306ea11cde631dbcf7f92f446d356d33" + }, + "node_modules/@oxc-project/types": { + "afterSha256": "0034f02b4c35c5ab8c14e732d5770d14cac8edae97db349ecf68c02944e12dfb", + "beforeSha256": "a726d82f1c310bef746b83d3b5ab3c8e9c400c7fce31166d4419b81ddd35ef55" + }, + "node_modules/@rolldown/binding-android-arm-eabi": { + "afterSha256": "c7f67a9c6e8d8a1d95724c8b736514c155186a42c5b7e6e95a25c0d38ff27254", + "beforeSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1" + }, + "node_modules/@rolldown/binding-android-arm64": { + "afterSha256": "ff6c2314144ecb2d27c534eded5ce402ad586af23cbd91ccef6748cca256db64", + "beforeSha256": "a5446fc72bd43a8862bf24e213ebf273e614ae54178ea43499c84604b38830ad" + }, + "node_modules/@rolldown/binding-darwin-arm64": { + "afterSha256": "68139a462c25d94100256bdada5c67224bf9ec5b7e55cc42cfa6bd2dfda97d9f", + "beforeSha256": "ae15c80290373a0179f7e93da5e09720d7c3e23e2f379a26ddc0f42d6599ac98" + }, + "node_modules/@rolldown/binding-darwin-x64": { + "afterSha256": "f583cdc4f8c55d8ea0bad9476e05a0311b6aad864da125b7251249e462f175a6", + "beforeSha256": "614876bfee2956998a91e8e73eaf1018a54e4d0b070879e63255f860b3da9cf0" + }, + "node_modules/@rolldown/binding-freebsd-x64": { + "afterSha256": "33ae2d7356129bca72bec42f1ae5535b8b79b06d5b56c3abfacee07ca479712b", + "beforeSha256": "2ee4bc453c2f821a3c5295496079be32aab31266eff9c979d5a88dfda5c40247" + }, + "node_modules/@rolldown/binding-linux-arm-gnueabihf": { + "afterSha256": "ad49286c69ecb5a58d6fec5f9dea9f46c7ffc91d6b5c05328b408c02c022180b", + "beforeSha256": "3b398cfdcb83df0b3ef7ae8e0a90917831a08b9446054a61af1c16e717e1c2ce" + }, + "node_modules/@rolldown/binding-linux-arm64-gnu": { + "afterSha256": "b1db4813f90706a4e99970e67eab39cf6ee8c1f1641835ac1c0eb90133f75100", + "beforeSha256": "e6a77c5342330fff34d773e941553767626b05919082b12a6f74aa2537001f72" + }, + "node_modules/@rolldown/binding-linux-arm64-musl": { + "afterSha256": "3d94f96694cbadafef18ad5a9bc1b87529dfb812b88bad241c1810469312260b", + "beforeSha256": "a820fb04205d1264e2641c0492ed96be87286c0120e47750c24fc50bdfbf6c8c" + }, + "node_modules/@rolldown/binding-linux-ppc64-gnu": { + "afterSha256": "1f7a275caa3b7c66bf63467a95477494dabbbfa2da8b87aca0837f4e3d396ff7", + "beforeSha256": "8bc0b585dd8a94b013bb9c5680187de7a6e82779fc668fdc5383342e29f8b9bd" + }, + "node_modules/@rolldown/binding-linux-s390x-gnu": { + "afterSha256": "570da1599f3afd8adf0f2098ab56c03d689d348a00fab49fb1a206a6ad813f13", + "beforeSha256": "984a2f12d5c1aba05c21bfa9c403a950585bf9dd7726175241acd9ba3522a663" + }, + "node_modules/@rolldown/binding-linux-x64-gnu": { + "afterSha256": "404bfd0751bdcabc10af394902f43387129c922f856977904265a0905e67023b", + "beforeSha256": "f83a1c6c5e81ebe2bca8fbf8b8dc871e3e54b81e5f7f7707d1ee6b47e2dbf063" + }, + "node_modules/@rolldown/binding-linux-x64-musl": { + "afterSha256": "4ba31adc29022f8fde52c4bd9c1428c13177f5800c3afbe46428c09f5d1fc5f5", + "beforeSha256": "b242d1985ad6df193c0d88a8cd791697c8506f698c88fd304ad769d6c46b3655" + }, + "node_modules/@rolldown/binding-openharmony-arm64": { + "afterSha256": "2374c69dcadb573e59573cf7d6330f56dde3512a068be7b0035d18d5856ce30e", + "beforeSha256": "27926be74c242431dda66103ea3a91708da6405fd3bb086ed4644660e8dfa2d9" + }, + "node_modules/@rolldown/binding-wasm32-wasi": { + "afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1", + "beforeSha256": "9cfa7389dc68eb9d2626a259e02764498f7266cdf4cfdda255687e6dbcd29552" + }, + "node_modules/@rolldown/binding-win32-arm64-msvc": { + "afterSha256": "906959f7254a37c559ecd93dbc7af3d93f2e9f9b527478aa96d68660108c9c5e", + "beforeSha256": "8db383eee0a61edf85b0c0d06acedde5242e220d0303c3ef0a84e1e9ae9db707" + }, + "node_modules/@rolldown/binding-win32-x64-msvc": { + "afterSha256": "3c36bc0fec3d3eee4f3b5b6cc81838b287a6c4f7568705e777bbc210938b4a61", + "beforeSha256": "f822f724d442789bb158b02e9b4f744fa2e921ff204d52973851c75a32801b5f" + }, + "node_modules/@tybys/wasm-util": { + "afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1", + "beforeSha256": "44e06317b362727754aa815baa5cf36cee4e4f3904f0406d4b81f01ff7a155cd" + }, + "node_modules/@vitest/coverage-v8": { + "afterSha256": "5ad91ff22397f54afddaf482ceaba69b4e7ff3e44b1a661f83a84a4ed8855879", + "beforeSha256": "5de0be550fde5c4fb40c50394c47415b02819125fb789684fbf927a6ff10fa2f" + }, + "node_modules/@vitest/expect": { + "afterSha256": "e94220e4e4fae9feff4574fa40df96cb4b86ff7daf43ef6741f6892df6ac92c4", + "beforeSha256": "90fe132097b24a8226669a628c6556648b97341231bcea2f4ca9a3732e2ad8d7" + }, + "node_modules/@vitest/mocker": { + "afterSha256": "1b54083369da48529e55939a82ac22658b47c2f006090c65b65fce7d210d1626", + "beforeSha256": "0b37c74fe58fea76a0d5dd21ea88ab8b2c048d704178e29035da6bd2812d12e9" + }, + "node_modules/@vitest/pretty-format": { + "afterSha256": "2d6629a70436bd3706fa64bd51d699abd096b5e89dd7dd0c52dd8625c688fa91", + "beforeSha256": "29b9fcc14be28d5a628395d333f54cb4bb6dc63b6320ebb2f2200bba1abdbfc4" + }, + "node_modules/@vitest/runner": { + "afterSha256": "270837e0c1db982c15da353f970056a0968aba3175b3a756300bfd1b3724c471", + "beforeSha256": "8f22d886b0032d500fb9531b4f270599cfe93aa9ed754355284c7ad23a29729f" + }, + "node_modules/@vitest/snapshot": { + "afterSha256": "f42ffe9f7c0f8a60571657e59b48e4f6825939d0b39ad11c7e6de4860d8aad12", + "beforeSha256": "17bd77cfa791fedf1150ff7ca6341c4f87c7f4cddf9447e46b80ccd460b63f31" + }, + "node_modules/@vitest/spy": { + "afterSha256": "579c35db139f0781362e095a7206d9cb0ed2eb0c7f20c21976ad29f02e4bf8fb", + "beforeSha256": "db37a809c77c237e67895e6952d53af1bb1171ba4a581db6bbab410d46391f76" + }, + "node_modules/@vitest/utils": { + "afterSha256": "52bd4c1916512aa4e16e91f732dc6b8def1621e3f4fa4e2dbe839e8d4cf0c9fb", + "beforeSha256": "6e6e7ff1c9baad718e6b421c178a30767e7f8b916a5c407e5374f6d950dd799c" + }, + "node_modules/es-module-lexer": { + "afterSha256": "9621319d839cd32f7c8a13e9a89b512f6d2fe3b17fc7e60e31aed3ec5f7ab839", + "beforeSha256": "6a3df56226299c9d484366b8c63fa1fa128c4a43ab1464bc8af8f8c6b54a0c2a" + }, + "node_modules/lightningcss": { + "afterSha256": "3e4a5ac3c4d5d24da6c147670cb11fd5a0305b878a1871f6c728101a79ac0b9c", + "beforeSha256": "d512429a1ccaee1b8c542a86cba831d7d635312bb1f5a0405cdb1cd2f1db2364" + }, + "node_modules/lightningcss-android-arm64": { + "afterSha256": "535f637dc10a13e5fe218430749516b2381ae7b71caabb5543a4c373e9687857", + "beforeSha256": "80d81e8f5743397885518a4f735a79c18e2f37b382636fdf2a96f5b3317a455f" + }, + "node_modules/lightningcss-darwin-arm64": { + "afterSha256": "cb263a658b71e323612d96003d9c851c6c2ba9f723dcdac7f8d265baba3b98af", + "beforeSha256": "1dc6be2d4904fec670798c914019b47017bc2c56cce3447afe88e7bfa22ad863" + }, + "node_modules/lightningcss-darwin-x64": { + "afterSha256": "7e239d50616ff50852fb5405df9a08d77ae391a03f83c347cf349780a4eea155", + "beforeSha256": "7c8f146745d54c4b2d1275cc3cf1a233712c6b45cfe0b613da1c58b2e43acfb6" + }, + "node_modules/lightningcss-freebsd-x64": { + "afterSha256": "cfd24b1da6d4f399a75f44b62b3435e7253eda9b36a5c2837e291bcfd960a323", + "beforeSha256": "9a9e60922db940bbbefd23ed23ab13a49a1b443f20e937676eb6e091b83bb6ce" + }, + "node_modules/lightningcss-linux-arm-gnueabihf": { + "afterSha256": "8f519a5e93b6e98caec8e6d898a9b954758d6fd79bf91b3cc51f26627334e8e9", + "beforeSha256": "96a08d41ee506b5c25798ade8850570194d683473f3c8baf44e16fd52922e686" + }, + "node_modules/lightningcss-linux-arm64-gnu": { + "afterSha256": "7920b524b43edb3c78427127ad67620a559016628907b34236be98e13c06264b", + "beforeSha256": "2b65803cc810fb37714da42477e5d5a03059d296940acdab48631233e3c03df3" + }, + "node_modules/lightningcss-linux-arm64-musl": { + "afterSha256": "84b1b90de34c83fb780ef44768fd1ce0beefb73f19659d5fe02ee7e755682534", + "beforeSha256": "86b9b2aba74b652ed901011f1eeb96b4f6994ab53c3bbe21e9bcff81b736337d" + }, + "node_modules/lightningcss-linux-x64-gnu": { + "afterSha256": "041e30aa49fa2d6f12bc6b17b58fdabc932f0d69c125721ff37faa061de858c6", + "beforeSha256": "cd51d67d1adcc25fb7075362f689a593115d3a5f80ba11db515b587b5ec8c823" + }, + "node_modules/lightningcss-linux-x64-musl": { + "afterSha256": "3938a84ed47a1cd2f9bf2c0d7fff3f7897e0243ad287a5301939a05e7ecb238c", + "beforeSha256": "4c4cd68abb2a7bbcf1aed08129787d562d2e41c4b7758263639468caade45ec3" + }, + "node_modules/lightningcss-win32-arm64-msvc": { + "afterSha256": "2938895fef20cf633e7644655b50053d0e97fd896798641e4d6322e6d390270a", + "beforeSha256": "9f3bbe2e890e63e08368404204725684a569270ac923db9b783a002afc1f6791" + }, + "node_modules/lightningcss-win32-x64-msvc": { + "afterSha256": "c65462c23105f243054e8c12c1044787a158f8f0c6978b19152a68887d99bf70", + "beforeSha256": "7dde3ba5e9e8348fa416a8c9b01c09f169e56dd3e8395409b259bf419ef517a7" + }, + "node_modules/obug": { + "afterSha256": "ecc5be521a90814c98baf43da8e4c3e0aebfc63534d8dad1696331cbf5ef9752", + "beforeSha256": "cdffd9934cd8f67b51304e8657212dff2c3c244f72be683ac023d04eeb2e2f42" + }, + "node_modules/picomatch": { + "afterSha256": "93bda035a32af25d34ca398672dcf89d124a3ff9b1030457fe3766070d116fc6", + "beforeSha256": "8b8708a92edaf7b69f5ed128b5a8a409733503fd7bdddd9714906c74840f799c" + }, + "node_modules/postcss": { + "afterSha256": "8741ebc500a6be69caa2b44287238fa6c65617da854ea531976bac622218430e", + "beforeSha256": "85179f86682be731fe618584a96dd6fb1dd924423963b9766eb7b6f1beca5edc" + }, + "node_modules/rolldown": { + "afterSha256": "6fdce8c8ed9fe35d890923bfaf5b95007cc82a7f20a6deab12f05c4e0da55e52", + "beforeSha256": "79400c35730d89b1c592084793724674d6f6f65f69dbd24bb34e02f18418d023" + }, + "node_modules/std-env": { + "afterSha256": "33b84bc0ce2dcbd5ed3112464b14750ccfb8c94df7aedc7c9bf4e524fb8d43b0", + "beforeSha256": "563c5b180537593dbd63219959aa5b61424700c45e3d27fc5a748f2fef6cbac9" + }, + "node_modules/tinyexec": { + "afterSha256": "da5e3a792744eb9d8489a0bb3610686c79de8a7d36bc354a0acf7f3a80b2af8a", + "beforeSha256": "e697683d0dce2dda0db98dc1f840739c562ab863be64cdacdea0d56ba04a2b4b" + }, + "node_modules/tinyrainbow": { + "afterSha256": "efde8077ff23858da7a9c14a64f40cbe36e6de78d96c8e54216e43a685e1fb7b", + "beforeSha256": "6657bfb78b19f9dc5be02ccce35972b0fa71043f0e0f8112b0406ed87636f664" + }, + "node_modules/tslib": { + "afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1", + "beforeSha256": "b906828066eb6c857cec52ce68ea60f90ce0b92d237f4f89a5f0a6c285b36bca" + }, + "node_modules/vite": { + "afterSha256": "b2efbf2e2ef13427c749b9cebba435458e97fa79abeb1ed765177c315f5f3fac", + "beforeSha256": "a45e1aa0f9d86a625cf79f39ee31654227a429ba7889b8bc93cc06efde0bb4fd" + }, + "node_modules/vitest": { + "afterSha256": "36dc10d2a28d080e225546c3e5ed53da238ec09ce8d854cb6441d673187b3b0d", + "beforeSha256": "cd61942bbb35efe4d70d667b7404c4ea28c978baff9bce5fc16dfb1680e406a2" + } }, "schemaVersion": 3, "sources": [ - "https://registry.npmjs.org/wrangler/-/wrangler-4.105.0.tgz", - "https://registry.npmjs.org/miniflare/-/miniflare-4.20260625.0.tgz", - "https://registry.npmjs.org/sharp/-/sharp-0.35.3.tgz", - "https://registry.npmjs.org/workerd/-/workerd-1.20260625.1.tgz", - "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz" + "https://github.com/vitest-dev/vitest/releases/tag/v4.1.11", + "https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8", + "https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4" ], - "targetPackages": ["","node_modules/@cloudflare/kv-asset-handler","node_modules/@cloudflare/unenv-preset","node_modules/@cspotcode/source-map-support","node_modules/@img/colour","node_modules/@img/sharp-darwin-arm64","node_modules/@img/sharp-darwin-x64","node_modules/@img/sharp-freebsd-wasm32","node_modules/@img/sharp-libvips-darwin-arm64","node_modules/@img/sharp-libvips-darwin-x64","node_modules/@img/sharp-libvips-linux-arm","node_modules/@img/sharp-libvips-linux-arm64","node_modules/@img/sharp-libvips-linux-ppc64","node_modules/@img/sharp-libvips-linux-riscv64","node_modules/@img/sharp-libvips-linux-s390x","node_modules/@img/sharp-libvips-linux-x64","node_modules/@img/sharp-libvips-linuxmusl-arm64","node_modules/@img/sharp-libvips-linuxmusl-x64","node_modules/@img/sharp-linux-arm","node_modules/@img/sharp-linux-arm64","node_modules/@img/sharp-linux-ppc64","node_modules/@img/sharp-linux-riscv64","node_modules/@img/sharp-linux-s390x","node_modules/@img/sharp-linux-x64","node_modules/@img/sharp-linuxmusl-arm64","node_modules/@img/sharp-linuxmusl-x64","node_modules/@img/sharp-wasm32","node_modules/@img/sharp-webcontainers-wasm32","node_modules/@img/sharp-win32-arm64","node_modules/@img/sharp-win32-ia32","node_modules/@img/sharp-win32-x64","node_modules/@jridgewell/trace-mapping","node_modules/@poppinss/colors","node_modules/@poppinss/dumper","node_modules/@poppinss/exception","node_modules/@sindresorhus/is","node_modules/@speed-highlight/core","node_modules/blake3-wasm","node_modules/cookie","node_modules/error-stack-parser-es","node_modules/kleur","node_modules/miniflare","node_modules/path-to-regexp","node_modules/sharp","node_modules/supports-color","node_modules/undici","node_modules/unenv","node_modules/wrangler","node_modules/ws","node_modules/youch","node_modules/youch-core"], - "topLevelMetadataDigests": {"afterSha256":"354c77096d1795b6f33b903ac8b54c3922a045279413f3e8681c78c1fe5278b1","beforeSha256":"354c77096d1795b6f33b903ac8b54c3922a045279413f3e8681c78c1fe5278b1"} -} \ No newline at end of file + "targetPackages": [ + "", + "node_modules/@emnapi/core", + "node_modules/@emnapi/runtime", + "node_modules/@emnapi/wasi-threads", + "node_modules/@napi-rs/wasm-runtime", + "node_modules/@oxc-project/types", + "node_modules/@rolldown/binding-android-arm-eabi", + "node_modules/@rolldown/binding-android-arm64", + "node_modules/@rolldown/binding-darwin-arm64", + "node_modules/@rolldown/binding-darwin-x64", + "node_modules/@rolldown/binding-freebsd-x64", + "node_modules/@rolldown/binding-linux-arm-gnueabihf", + "node_modules/@rolldown/binding-linux-arm64-gnu", + "node_modules/@rolldown/binding-linux-arm64-musl", + "node_modules/@rolldown/binding-linux-ppc64-gnu", + "node_modules/@rolldown/binding-linux-s390x-gnu", + "node_modules/@rolldown/binding-linux-x64-gnu", + "node_modules/@rolldown/binding-linux-x64-musl", + "node_modules/@rolldown/binding-openharmony-arm64", + "node_modules/@rolldown/binding-wasm32-wasi", + "node_modules/@rolldown/binding-win32-arm64-msvc", + "node_modules/@rolldown/binding-win32-x64-msvc", + "node_modules/@tybys/wasm-util", + "node_modules/@vitest/coverage-v8", + "node_modules/@vitest/expect", + "node_modules/@vitest/mocker", + "node_modules/@vitest/pretty-format", + "node_modules/@vitest/runner", + "node_modules/@vitest/snapshot", + "node_modules/@vitest/spy", + "node_modules/@vitest/utils", + "node_modules/es-module-lexer", + "node_modules/lightningcss", + "node_modules/lightningcss-android-arm64", + "node_modules/lightningcss-darwin-arm64", + "node_modules/lightningcss-darwin-x64", + "node_modules/lightningcss-freebsd-x64", + "node_modules/lightningcss-linux-arm-gnueabihf", + "node_modules/lightningcss-linux-arm64-gnu", + "node_modules/lightningcss-linux-arm64-musl", + "node_modules/lightningcss-linux-x64-gnu", + "node_modules/lightningcss-linux-x64-musl", + "node_modules/lightningcss-win32-arm64-msvc", + "node_modules/lightningcss-win32-x64-msvc", + "node_modules/obug", + "node_modules/picomatch", + "node_modules/postcss", + "node_modules/rolldown", + "node_modules/std-env", + "node_modules/tinyexec", + "node_modules/tinyrainbow", + "node_modules/tslib", + "node_modules/vite", + "node_modules/vitest" + ], + "topLevelMetadataDigests": { + "afterSha256": "354c77096d1795b6f33b903ac8b54c3922a045279413f3e8681c78c1fe5278b1", + "beforeSha256": "354c77096d1795b6f33b903ac8b54c3922a045279413f3e8681c78c1fe5278b1" + } +} From f73968496e2162a00645b813bb6051cf96351ec9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 13:48:36 +0900 Subject: [PATCH 4/7] fix(security): promote canonical Vitest 4.1.11 regeneration artifact --- package-lock.json | 520 +++++++++++++++++++++------------------------- 1 file changed, 238 insertions(+), 282 deletions(-) diff --git a/package-lock.json b/package-lock.json index f9e787137..25617fc34 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,10 +9,10 @@ "version": "0.1.0", "devDependencies": { "@cloudflare/workers-types": "^4.20260630.0", - "@vitest/coverage-v8": "^4.1.9", + "@vitest/coverage-v8": "^4.1.11", "esbuild": "0.28.1", "typescript": "^5.9.0", - "vitest": "^4.1.9", + "vitest": "^4.1.11", "workerd": "1.20260625.1" }, "engines": { @@ -171,40 +171,6 @@ "dev": true, "license": "MIT OR Apache-2.0" }, - "node_modules/@emnapi/core": { - "version": "1.11.1", - "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz", - "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==", - "dev": true, - "license": "MIT", - "optional": true, - "dependencies": { - "@emnapi/wasi-threads": "1.2.2", - "tslib": "^2.4.0" - } - }, - "node_modules/@emnapi/runtime": { - "version": "1.11.1", - "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz", - "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==", - "dev": true, - "license": "MIT", - "optional": true, - "dependencies": { - "tslib": "^2.4.0" - } - }, - "node_modules/@emnapi/wasi-threads": { - "version": "1.2.2", - "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz", - "integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==", - "dev": true, - "license": "MIT", - "optional": true, - "dependencies": { - "tslib": "^2.4.0" - } - }, "node_modules/@esbuild/aix-ppc64": { "version": "0.28.1", "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz", @@ -664,39 +630,37 @@ "dev": true, "license": "MIT" }, - "node_modules/@napi-rs/wasm-runtime": { - "version": "1.1.6", - "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.6.tgz", - "integrity": "sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg==", + "node_modules/@oxc-project/types": { + "version": "0.148.0", + "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.148.0.tgz", + "integrity": "sha512-Nm4s/jB+4FpFsPhWGEC4h7rzksesmtnMXomo6rCMcg/b8zLQuOziRgkCS1fxDCXOlJB/6Q8oABOZ/OP6RIPj9A==", "dev": true, "license": "MIT", - "optional": true, - "dependencies": { - "@tybys/wasm-util": "^0.10.3" - }, "funding": { - "type": "github", - "url": "https://github.com/sponsors/Brooooooklyn" - }, - "peerDependencies": { - "@emnapi/core": "^1.7.1", - "@emnapi/runtime": "^1.7.1" + "url": "https://github.com/sponsors/oxc-project" } }, - "node_modules/@oxc-project/types": { - "version": "0.137.0", - "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.137.0.tgz", - "integrity": "sha512-WT+Gb24i8hmvo85AIv2oEYouEXkRlKAlT9WaCa3TfLgNCN+GhrJOGZuIlMouAh38Qe4QOx26eUOVsq70qXrywA==", + "node_modules/@rolldown/binding-android-arm-eabi": { + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.7.tgz", + "integrity": "sha512-EypzgnYCwyVY4NDHKzGmNJT5b+XaQEBniHxsMdeIQLB/tcCzZnhqrzHpZFbX9iaxx+5RiB8caATBtfvZP7zVxQ==", + "cpu": [ + "arm" + ], "dev": true, "license": "MIT", - "funding": { - "url": "https://github.com/sponsors/Boshen" + "optional": true, + "os": [ + "android" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" } }, "node_modules/@rolldown/binding-android-arm64": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.3.tgz", - "integrity": "sha512-DT6Z3PhvioeHMvxo+xHc3KtqggrI7CCTXCmC2h/5zUlp5jVitv7XEy+9q5/7v8IolhlioawpMo8Kg0EEBy7J0g==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.7.tgz", + "integrity": "sha512-l17HE9EweWaqJZhuUuNBN/FzM62xw+DECVnJyvMsxn8vJFAGLy5QfLDoYAcronkAN8VxKZHezDpulHDPx95vFw==", "cpu": [ "arm64" ], @@ -711,9 +675,9 @@ } }, "node_modules/@rolldown/binding-darwin-arm64": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.3.tgz", - "integrity": "sha512-0NwgwsjM7LrsuVnXMK3koTpagBNOhloc/BNjKqZjv4V5zI5r13qx69uVhRx+o5Z0yy4Hzq+lpy7TAgUG/ocvrw==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.7.tgz", + "integrity": "sha512-8ED8ELFvHXc6OCETIn4gXObPiaR6bckM/ipXtbzlPVDRMBfEGjCKgO90F9YtfdpDatVx/ZQw7aZ1vUMf/+T3Mw==", "cpu": [ "arm64" ], @@ -728,9 +692,9 @@ } }, "node_modules/@rolldown/binding-darwin-x64": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.3.tgz", - "integrity": "sha512-YtiBp4disu6V560loT6PjMdiRaWmVvDNrUunAalbiFx2ggeJwxdAsgZMcoGP17uyAsTwAj5V1niksxlHnVQ1Sw==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.7.tgz", + "integrity": "sha512-/WPripjtiAIZ2tWY7ddijORT0Ujg87wxWW/qcoFVCKAWVDPhtY0xr7Dj0M3GyNGz60jGwTElhro/mkF9dT7dDQ==", "cpu": [ "x64" ], @@ -745,9 +709,9 @@ } }, "node_modules/@rolldown/binding-freebsd-x64": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.3.tgz", - "integrity": "sha512-yD3EkEdXk2LypPxnf/kSZHirarsI8gcPzc62SukhR9VJTyvV+F9Q/GxWNuCojc7sXyuVC4DxRGhdDK4X8VSsbw==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.7.tgz", + "integrity": "sha512-14DI4NcqpvbICxSnGLx3PmtDaWqRP/KGSGb6C+JLLVPeZRl6dKdHba3pGsqT3vpdTqhEYIPG0MMQ8c0xYqoJxA==", "cpu": [ "x64" ], @@ -762,9 +726,9 @@ } }, "node_modules/@rolldown/binding-linux-arm-gnueabihf": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.3.tgz", - "integrity": "sha512-c+8vieQbsD7HNAHKIA34w0GJ9FedFFuJGD+7E6vz7Q3uqAIugL5p45fhlsj4UaAsHpcmlqugBWMhA0/j7o0sIg==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.7.tgz", + "integrity": "sha512-bxrWIRvHWQvbJwi+VIie/kDJmQxcNE6xxWwZdqF/ExVAigtHkv54WTLQPb+QsZdnFy18fg7JPfWGL0RH6vwIlQ==", "cpu": [ "arm" ], @@ -779,13 +743,16 @@ } }, "node_modules/@rolldown/binding-linux-arm64-gnu": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.3.tgz", - "integrity": "sha512-50jD0uUwLvur7Zz9LHz17kaAdTPjn5wN93hEgjvmYFRZwiR7ZJYovTd5ipyWJDAnXKvZ+wgc+/Ika6dwSF5OcA==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.7.tgz", + "integrity": "sha512-toOY2BChBZyuxU7OYX6Tn389di4IzAqPTycVcci0O7FSfBqzRB3RZn+K5Is6ANf4tmgRd/K1yZTsNTXbkXsnLg==", "cpu": [ "arm64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -796,13 +763,16 @@ } }, "node_modules/@rolldown/binding-linux-arm64-musl": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.3.tgz", - "integrity": "sha512-BO9+oPL8K9poZJBfYPsXNtYjPE5uM3qeehT3aFcW4LITOl+iSqhp0abzjR2nWBUNjIZeKXjAEWBZ64WjNoHd6w==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.7.tgz", + "integrity": "sha512-lAIXTH/aiLRLxsTgQvfhjo4K1ydWIp00+V0voOr9beb/9ZmkUFrSIb03dXNFRgMNvkE6oGsF10ioQ6UsI+vS5Q==", "cpu": [ "arm64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -813,13 +783,16 @@ } }, "node_modules/@rolldown/binding-linux-ppc64-gnu": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.3.tgz", - "integrity": "sha512-f3VpLB1vQ0Eo6ecr/6cekLnvYMFF4YBFoVGkfkvPLq1bAkbAwHYQPZKoAmG6OJyTcxxoC+AvezGx/S1obNC0Mw==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.7.tgz", + "integrity": "sha512-kdnwS28Pkenp/mZMRwjXXXwxQ7pIsm+bF919LUK93BOyhcLsrVKdP2p9fxpiPNPAbNuch8ypQt0pm2P2LYCAGg==", "cpu": [ "ppc64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -830,13 +803,16 @@ } }, "node_modules/@rolldown/binding-linux-s390x-gnu": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.3.tgz", - "integrity": "sha512-AmurZ26Pqx/RI9N1gzEOCklkKXl927yjfXWUUS0O7Puh8ARM/Ob8qfrD3qnWksScdw6cSrW5PSHE9DyLu7+PtA==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.7.tgz", + "integrity": "sha512-516OdsyLdr5E65paF3yBF55t8mfm9+gmtCsK3xI7XKXIT7EfRlHhxL8K/NR6Hu8BWSgF5+1w74lTL0+nxcc8Qw==", "cpu": [ "s390x" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -847,13 +823,16 @@ } }, "node_modules/@rolldown/binding-linux-x64-gnu": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.3.tgz", - "integrity": "sha512-JJpqs8bRGITDOdbkNKnlojzBabbOHrqjSvDr0IVsZObE1lBcPjxItUEY9eWIDbxaJ3cGrXPWGfGkIxFijg/URg==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.7.tgz", + "integrity": "sha512-r8/z8n7GFaYRln3xmP1Cxy0HH/HLM0uBUPkEuSVEfKGDA89M0FsZRZJRSwe/tJjRx+fpH/gjorfhB8tmEbSFLA==", "cpu": [ "x64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -864,13 +843,16 @@ } }, "node_modules/@rolldown/binding-linux-x64-musl": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.3.tgz", - "integrity": "sha512-rSJcdjPxzA/by/6/rYs+v+bXU7UjvnbUWz8MJb6kh6+knqB1dCrtHg0uu7C/4haqJvqdkYHQ5IGn+tCH9GLW/g==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.7.tgz", + "integrity": "sha512-pAsE8iiDxUg1xBqdhrTfg45AVDVpirjz00sblEYClGNNcMnDb+e8beQgqIAw6LvauX/APvgxUnwrgun/YYGBhw==", "cpu": [ "x64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -881,9 +863,9 @@ } }, "node_modules/@rolldown/binding-openharmony-arm64": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.3.tgz", - "integrity": "sha512-hQ3/PYkDJICgevvyNcVrihVeqq7k1Pp3VZ9lY+dauAYUJKO+auqApvANhvR1An9BhmqYKvW2Mu1F9u4DXSMLxQ==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.7.tgz", + "integrity": "sha512-lTcIYmmnQQA8Or/2DatS6oSqcdLHvendjS+zLu+FwgToynWMRSmQdpM65fTANJgIS4mjbMOo5KT2lnT9SAb96w==", "cpu": [ "arm64" ], @@ -897,29 +879,10 @@ "node": "^20.19.0 || >=22.12.0" } }, - "node_modules/@rolldown/binding-wasm32-wasi": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.3.tgz", - "integrity": "sha512-Elcv/BtML9lXrV6JuKITc/grN2kYV9gjsQpW8Jfw4ioK0TOkjBjye0nnyqQNy9STNaI20lXNaQBRrD5gSgR0Yg==", - "cpu": [ - "wasm32" - ], - "dev": true, - "license": "MIT", - "optional": true, - "dependencies": { - "@emnapi/core": "1.11.1", - "@emnapi/runtime": "1.11.1", - "@napi-rs/wasm-runtime": "^1.1.6" - }, - "engines": { - "node": "^20.19.0 || >=22.12.0" - } - }, "node_modules/@rolldown/binding-win32-arm64-msvc": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.3.tgz", - "integrity": "sha512-2DrEfhluH9yhiaFApmsjsjwrSYbNcY1oFTzYSP1a535jDbV98zCFanA/96TBUd0iDFcxGmw9QRExwGCXz3U+/g==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.7.tgz", + "integrity": "sha512-e3Gu3WxbNk/UqQhxqU7YIYO+9ZBvWNz3U+h/qRFosscMFzdRPbXYSaSWgSnklv2fz1TgzBTcti2z35c/7irsHw==", "cpu": [ "arm64" ], @@ -934,9 +897,9 @@ } }, "node_modules/@rolldown/binding-win32-x64-msvc": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.3.tgz", - "integrity": "sha512-OL4OMk7UPXOeVGGd3qo5zJyPIljf4AFgk5QAkPPS+OoLuOOozhuaQGC18MxVTnw/06q93gShAJzlwnSCY9YtqA==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.7.tgz", + "integrity": "sha512-W/jg5qoRSqjsEv0+dZi4e687mcHqmVuU0P4fK6qS/xjetW2Gmc1W8j//z5nAeNcC8Ttm0hV46IjcYeuVwYhuiw==", "cpu": [ "x64" ], @@ -964,17 +927,6 @@ "dev": true, "license": "MIT" }, - "node_modules/@tybys/wasm-util": { - "version": "0.10.3", - "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz", - "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==", - "dev": true, - "license": "MIT", - "optional": true, - "dependencies": { - "tslib": "^2.4.0" - } - }, "node_modules/@types/chai": { "version": "5.2.3", "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz", @@ -1001,14 +953,14 @@ "license": "MIT" }, "node_modules/@vitest/coverage-v8": { - "version": "4.1.9", - "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.9.tgz", - "integrity": "sha512-G9/lgqibheLVBDRuya45EbsEXTYcWoSG+TLg7i2axuzx0Eq62eXn+aWXyaVdV5vKvFSWd6ywcX8hA7la9Pvu8g==", + "version": "4.1.11", + "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.11.tgz", + "integrity": "sha512-8MVGEFnJIcdGjcbfKmeq8z0pZHH0JlVtoVZH9Q/qwUp6wyFnEJUBMrw9DCaj+ra3vShGmhavjalMIhPNxZAUcw==", "dev": true, "license": "MIT", "dependencies": { "@bcoe/v8-coverage": "^1.0.2", - "@vitest/utils": "4.1.9", + "@vitest/utils": "4.1.11", "ast-v8-to-istanbul": "^1.0.0", "istanbul-lib-coverage": "^3.2.2", "istanbul-lib-report": "^3.0.1", @@ -1022,8 +974,8 @@ "url": "https://opencollective.com/vitest" }, "peerDependencies": { - "@vitest/browser": "4.1.9", - "vitest": "4.1.9" + "@vitest/browser": "4.1.11", + "vitest": "4.1.11" }, "peerDependenciesMeta": { "@vitest/browser": { @@ -1032,16 +984,16 @@ } }, "node_modules/@vitest/expect": { - "version": "4.1.9", - "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.9.tgz", - "integrity": "sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA==", + "version": "4.1.11", + "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.11.tgz", + "integrity": "sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==", "dev": true, "license": "MIT", "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", - "@vitest/spy": "4.1.9", - "@vitest/utils": "4.1.9", + "@vitest/spy": "4.1.11", + "@vitest/utils": "4.1.11", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" }, @@ -1050,13 +1002,13 @@ } }, "node_modules/@vitest/mocker": { - "version": "4.1.9", - "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.9.tgz", - "integrity": "sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw==", + "version": "4.1.11", + "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.11.tgz", + "integrity": "sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==", "dev": true, "license": "MIT", "dependencies": { - "@vitest/spy": "4.1.9", + "@vitest/spy": "4.1.11", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, @@ -1077,9 +1029,9 @@ } }, "node_modules/@vitest/pretty-format": { - "version": "4.1.9", - "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.9.tgz", - "integrity": "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==", + "version": "4.1.11", + "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.11.tgz", + "integrity": "sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==", "dev": true, "license": "MIT", "dependencies": { @@ -1090,13 +1042,13 @@ } }, "node_modules/@vitest/runner": { - "version": "4.1.9", - "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.9.tgz", - "integrity": "sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg==", + "version": "4.1.11", + "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.11.tgz", + "integrity": "sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==", "dev": true, "license": "MIT", "dependencies": { - "@vitest/utils": "4.1.9", + "@vitest/utils": "4.1.11", "pathe": "^2.0.3" }, "funding": { @@ -1104,14 +1056,14 @@ } }, "node_modules/@vitest/snapshot": { - "version": "4.1.9", - "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.9.tgz", - "integrity": "sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA==", + "version": "4.1.11", + "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.11.tgz", + "integrity": "sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==", "dev": true, "license": "MIT", "dependencies": { - "@vitest/pretty-format": "4.1.9", - "@vitest/utils": "4.1.9", + "@vitest/pretty-format": "4.1.11", + "@vitest/utils": "4.1.11", "magic-string": "^0.30.21", "pathe": "^2.0.3" }, @@ -1120,9 +1072,9 @@ } }, "node_modules/@vitest/spy": { - "version": "4.1.9", - "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.9.tgz", - "integrity": "sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA==", + "version": "4.1.11", + "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.11.tgz", + "integrity": "sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==", "dev": true, "license": "MIT", "funding": { @@ -1130,13 +1082,13 @@ } }, "node_modules/@vitest/utils": { - "version": "4.1.9", - "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.9.tgz", - "integrity": "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==", + "version": "4.1.11", + "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.11.tgz", + "integrity": "sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==", "dev": true, "license": "MIT", "dependencies": { - "@vitest/pretty-format": "4.1.9", + "@vitest/pretty-format": "4.1.11", "convert-source-map": "^2.0.0", "tinyrainbow": "^3.1.0" }, @@ -1205,9 +1157,9 @@ } }, "node_modules/es-module-lexer": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.2.0.tgz", - "integrity": "sha512-3lGxdTXCLfe1MYfTz1y2ksAAUM4NAOP6rPEjxGJVKO7TZ5+tvHCaQWGpC4Y3IXvW3ece0Cz1cIP4FWBxOnGCTQ==", + "version": "2.3.2", + "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz", + "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==", "dev": true, "license": "MIT" }, @@ -1383,9 +1335,9 @@ "license": "MIT" }, "node_modules/lightningcss": { - "version": "1.32.0", - "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz", - "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==", + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz", + "integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==", "dev": true, "license": "MPL-2.0", "dependencies": { @@ -1399,23 +1351,23 @@ "url": "https://opencollective.com/parcel" }, "optionalDependencies": { - "lightningcss-android-arm64": "1.32.0", - "lightningcss-darwin-arm64": "1.32.0", - "lightningcss-darwin-x64": "1.32.0", - "lightningcss-freebsd-x64": "1.32.0", - "lightningcss-linux-arm-gnueabihf": "1.32.0", - "lightningcss-linux-arm64-gnu": "1.32.0", - "lightningcss-linux-arm64-musl": "1.32.0", - "lightningcss-linux-x64-gnu": "1.32.0", - "lightningcss-linux-x64-musl": "1.32.0", - "lightningcss-win32-arm64-msvc": "1.32.0", - "lightningcss-win32-x64-msvc": "1.32.0" + "lightningcss-android-arm64": "1.33.0", + "lightningcss-darwin-arm64": "1.33.0", + "lightningcss-darwin-x64": "1.33.0", + "lightningcss-freebsd-x64": "1.33.0", + "lightningcss-linux-arm-gnueabihf": "1.33.0", + "lightningcss-linux-arm64-gnu": "1.33.0", + "lightningcss-linux-arm64-musl": "1.33.0", + "lightningcss-linux-x64-gnu": "1.33.0", + "lightningcss-linux-x64-musl": "1.33.0", + "lightningcss-win32-arm64-msvc": "1.33.0", + "lightningcss-win32-x64-msvc": "1.33.0" } }, "node_modules/lightningcss-android-arm64": { - "version": "1.32.0", - "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz", - "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==", + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz", + "integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==", "cpu": [ "arm64" ], @@ -1434,9 +1386,9 @@ } }, "node_modules/lightningcss-darwin-arm64": { - "version": "1.32.0", - "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz", - "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==", + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz", + "integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==", "cpu": [ "arm64" ], @@ -1455,9 +1407,9 @@ } }, "node_modules/lightningcss-darwin-x64": { - "version": "1.32.0", - "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz", - "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==", + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz", + "integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==", "cpu": [ "x64" ], @@ -1476,9 +1428,9 @@ } }, "node_modules/lightningcss-freebsd-x64": { - "version": "1.32.0", - "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz", - "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==", + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz", + "integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==", "cpu": [ "x64" ], @@ -1497,9 +1449,9 @@ } }, "node_modules/lightningcss-linux-arm-gnueabihf": { - "version": "1.32.0", - "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz", - "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==", + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz", + "integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==", "cpu": [ "arm" ], @@ -1518,13 +1470,16 @@ } }, "node_modules/lightningcss-linux-arm64-gnu": { - "version": "1.32.0", - "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz", - "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==", + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz", + "integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==", "cpu": [ "arm64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MPL-2.0", "optional": true, "os": [ @@ -1539,13 +1494,16 @@ } }, "node_modules/lightningcss-linux-arm64-musl": { - "version": "1.32.0", - "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz", - "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==", + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz", + "integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==", "cpu": [ "arm64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MPL-2.0", "optional": true, "os": [ @@ -1560,13 +1518,16 @@ } }, "node_modules/lightningcss-linux-x64-gnu": { - "version": "1.32.0", - "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz", - "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==", + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz", + "integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==", "cpu": [ "x64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MPL-2.0", "optional": true, "os": [ @@ -1581,13 +1542,16 @@ } }, "node_modules/lightningcss-linux-x64-musl": { - "version": "1.32.0", - "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz", - "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==", + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz", + "integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==", "cpu": [ "x64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MPL-2.0", "optional": true, "os": [ @@ -1602,9 +1566,9 @@ } }, "node_modules/lightningcss-win32-arm64-msvc": { - "version": "1.32.0", - "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz", - "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==", + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz", + "integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==", "cpu": [ "arm64" ], @@ -1623,9 +1587,9 @@ } }, "node_modules/lightningcss-win32-x64-msvc": { - "version": "1.32.0", - "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz", - "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==", + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz", + "integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==", "cpu": [ "x64" ], @@ -1701,9 +1665,9 @@ } }, "node_modules/obug": { - "version": "2.1.3", - "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.3.tgz", - "integrity": "sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.4.tgz", + "integrity": "sha512-4a+OsYv9UktOJKE+l1A4OufDgdRF9PifWj+tJnHURo/P+WOxpG4GzUFL9qCalmWauao6ogiG+QvnCovwPoyAWA==", "dev": true, "funding": [ "https://github.com/sponsors/sxzz", @@ -1729,9 +1693,9 @@ "license": "ISC" }, "node_modules/picomatch": { - "version": "4.0.4", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz", - "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==", + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", "dev": true, "license": "MIT", "engines": { @@ -1742,9 +1706,9 @@ } }, "node_modules/postcss": { - "version": "8.5.25", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz", - "integrity": "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==", + "version": "8.5.28", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.28.tgz", + "integrity": "sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==", "dev": true, "funding": [ { @@ -1762,7 +1726,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.16", + "nanoid": "^3.3.18", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, @@ -1771,13 +1735,13 @@ } }, "node_modules/rolldown": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.3.tgz", - "integrity": "sha512-1F1eEtUBtFvcGm1HQ9TiUIUHPQG7mSAODrhIzjxoUEFuo8OcbrGLiVLkevNgj84TE4lnHvnumwFjhJO5Eu135g==", + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.7.tgz", + "integrity": "sha512-g0EtLvBjTUB7jhyV0S/TCup3v/XSVl45vUIGbOGU4QPiyjTenCe4mKuFvW9fEgYmS2Fo42AUssRmNuMziXdrig==", "dev": true, "license": "MIT", "dependencies": { - "@oxc-project/types": "=0.137.0", + "@oxc-project/types": "=0.148.0", "@rolldown/pluginutils": "^1.0.0" }, "bin": { @@ -1787,21 +1751,21 @@ "node": "^20.19.0 || >=22.12.0" }, "optionalDependencies": { - "@rolldown/binding-android-arm64": "1.1.3", - "@rolldown/binding-darwin-arm64": "1.1.3", - "@rolldown/binding-darwin-x64": "1.1.3", - "@rolldown/binding-freebsd-x64": "1.1.3", - "@rolldown/binding-linux-arm-gnueabihf": "1.1.3", - "@rolldown/binding-linux-arm64-gnu": "1.1.3", - "@rolldown/binding-linux-arm64-musl": "1.1.3", - "@rolldown/binding-linux-ppc64-gnu": "1.1.3", - "@rolldown/binding-linux-s390x-gnu": "1.1.3", - "@rolldown/binding-linux-x64-gnu": "1.1.3", - "@rolldown/binding-linux-x64-musl": "1.1.3", - "@rolldown/binding-openharmony-arm64": "1.1.3", - "@rolldown/binding-wasm32-wasi": "1.1.3", - "@rolldown/binding-win32-arm64-msvc": "1.1.3", - "@rolldown/binding-win32-x64-msvc": "1.1.3" + "@rolldown/binding-android-arm-eabi": "1.2.7", + "@rolldown/binding-android-arm64": "1.2.7", + "@rolldown/binding-darwin-arm64": "1.2.7", + "@rolldown/binding-darwin-x64": "1.2.7", + "@rolldown/binding-freebsd-x64": "1.2.7", + "@rolldown/binding-linux-arm-gnueabihf": "1.2.7", + "@rolldown/binding-linux-arm64-gnu": "1.2.7", + "@rolldown/binding-linux-arm64-musl": "1.2.7", + "@rolldown/binding-linux-ppc64-gnu": "1.2.7", + "@rolldown/binding-linux-s390x-gnu": "1.2.7", + "@rolldown/binding-linux-x64-gnu": "1.2.7", + "@rolldown/binding-linux-x64-musl": "1.2.7", + "@rolldown/binding-openharmony-arm64": "1.2.7", + "@rolldown/binding-win32-arm64-msvc": "1.2.7", + "@rolldown/binding-win32-x64-msvc": "1.2.7" } }, "node_modules/semver": { @@ -1842,9 +1806,9 @@ "license": "MIT" }, "node_modules/std-env": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.1.0.tgz", - "integrity": "sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==", + "version": "4.2.0", + "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.2.0.tgz", + "integrity": "sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==", "dev": true, "license": "MIT" }, @@ -1856,9 +1820,9 @@ "license": "MIT" }, "node_modules/tinyexec": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz", - "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==", + "version": "1.3.1", + "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.1.tgz", + "integrity": "sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==", "dev": true, "license": "MIT", "engines": { @@ -1883,23 +1847,15 @@ } }, "node_modules/tinyrainbow": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.0.tgz", - "integrity": "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==", + "version": "3.1.1", + "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.1.tgz", + "integrity": "sha512-yau8yJdTt989Mm0Bd/236QnzEiPf2xLLTqUZRUJOo/3CB078LSwzei343DgtJVmfJKJE3TMINY1u42SQsP6mXw==", "dev": true, "license": "MIT", "engines": { "node": ">=14.0.0" } }, - "node_modules/tslib": { - "version": "2.8.1", - "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz", - "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==", - "dev": true, - "license": "0BSD", - "optional": true - }, "node_modules/typescript": { "version": "5.9.3", "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", @@ -1915,16 +1871,16 @@ } }, "node_modules/vite": { - "version": "8.1.1", - "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.1.tgz", - "integrity": "sha512-X/05/cT+VITy2AeDc1der6smvGWWREtL4hPbPTaVbjSBuuWkmNOjR6HP3NzqcQA2nF6VHGUPaFRJyft/2AE9Kg==", + "version": "8.2.2", + "resolved": "https://registry.npmjs.org/vite/-/vite-8.2.2.tgz", + "integrity": "sha512-cFKLV/PRgAUlIRm5WjMjJ86jrftzpqcgH+Us+DS8mI3CDNiH30Whrz8uHL3+MOLPAgqbMBAqWdAHAphOAM+z/Q==", "dev": true, "license": "MIT", "dependencies": { - "lightningcss": "^1.32.0", - "picomatch": "^4.0.4", - "postcss": "^8.5.16", - "rolldown": "~1.1.3", + "lightningcss": "^1.33.0", + "picomatch": "^4.0.5", + "postcss": "^8.5.26", + "rolldown": "~1.2.4", "tinyglobby": "^0.2.17" }, "bin": { @@ -1941,7 +1897,7 @@ }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", - "@vitejs/devtools": "^0.3.0", + "@vitejs/devtools": "^0.4.0 || ^0.5.0", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", @@ -1993,19 +1949,19 @@ } }, "node_modules/vitest": { - "version": "4.1.9", - "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.9.tgz", - "integrity": "sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ==", + "version": "4.1.11", + "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.11.tgz", + "integrity": "sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==", "dev": true, "license": "MIT", "dependencies": { - "@vitest/expect": "4.1.9", - "@vitest/mocker": "4.1.9", - "@vitest/pretty-format": "4.1.9", - "@vitest/runner": "4.1.9", - "@vitest/snapshot": "4.1.9", - "@vitest/spy": "4.1.9", - "@vitest/utils": "4.1.9", + "@vitest/expect": "4.1.11", + "@vitest/mocker": "4.1.11", + "@vitest/pretty-format": "4.1.11", + "@vitest/runner": "4.1.11", + "@vitest/snapshot": "4.1.11", + "@vitest/spy": "4.1.11", + "@vitest/utils": "4.1.11", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", @@ -2033,12 +1989,12 @@ "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", - "@vitest/browser-playwright": "4.1.9", - "@vitest/browser-preview": "4.1.9", - "@vitest/browser-webdriverio": "4.1.9", - "@vitest/coverage-istanbul": "4.1.9", - "@vitest/coverage-v8": "4.1.9", - "@vitest/ui": "4.1.9", + "@vitest/browser-playwright": "4.1.11", + "@vitest/browser-preview": "4.1.11", + "@vitest/browser-webdriverio": "4.1.11", + "@vitest/coverage-istanbul": "4.1.11", + "@vitest/coverage-v8": "4.1.11", + "@vitest/ui": "4.1.11", "happy-dom": "*", "jsdom": "*", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" From 8887f656976f5fd0b8e597a8904769d53bf70688 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 14:02:42 +0900 Subject: [PATCH 5/7] fix(security): preserve Vitest WASI validator runtime --- package.json | 1 + test/vitest-security-lock.test.ts | 14 ++++++++++++++ 2 files changed, 15 insertions(+) diff --git a/package.json b/package.json index d381babfe..7afce3f28 100644 --- a/package.json +++ b/package.json @@ -61,6 +61,7 @@ }, "devDependencies": { "@cloudflare/workers-types": "^4.20260630.0", + "@rolldown/binding-wasm32-wasi": "1.2.7", "@vitest/coverage-v8": "^4.1.11", "esbuild": "0.28.1", "typescript": "^5.9.0", diff --git a/test/vitest-security-lock.test.ts b/test/vitest-security-lock.test.ts index 2b67df547..64fcf8f05 100644 --- a/test/vitest-security-lock.test.ts +++ b/test/vitest-security-lock.test.ts @@ -62,4 +62,18 @@ describe("Vitest security lock", () => { expect(compareVersion(parseStableVersion(version), MINIMUM_SAFE_VITEST)).toBeGreaterThanOrEqual(0); }, ); + + it("keeps the static patch-validator WASI Rolldown binding explicit and version-aligned", () => { + const root = requirePackage(lock, ""); + const rolldownVersion = requirePackage(lock, "node_modules/rolldown").version; + const wasiBindingVersion = requirePackage( + lock, + "node_modules/@rolldown/binding-wasm32-wasi", + ).version; + if (!rolldownVersion || !wasiBindingVersion) { + throw new Error("Missing resolved Rolldown or WASI binding version"); + } + expect(root.devDependencies?.["@rolldown/binding-wasm32-wasi"]).toBe(wasiBindingVersion); + expect(wasiBindingVersion).toBe(rolldownVersion); + }); }); From eea46a22239cdc96bbc25944244b987bdb0fffe1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 14:12:04 +0900 Subject: [PATCH 6/7] fix(ci): restore WASI rolldown binding for Vitest 4.1.11 image deps --- .github/workflows/patch-validator-image.yml | 11 +++++++++++ CHANGELOG.md | 1 + test/patch-validator-image-contract.test.ts | 1 + 3 files changed, 13 insertions(+) diff --git a/.github/workflows/patch-validator-image.yml b/.github/workflows/patch-validator-image.yml index d707ee75e..7e6b791c4 100644 --- a/.github/workflows/patch-validator-image.yml +++ b/.github/workflows/patch-validator-image.yml @@ -167,6 +167,17 @@ jobs: npm_config_os=wasip1-threads \ npm_config_cpu=wasm32 \ npm prune --include=optional --ignore-scripts --no-audit --no-fund + # Rolldown 1.2 dropped the WASI binding from its optionalDependencies + # while still publishing @rolldown/binding-wasm32-wasi. Install the + # lockfile-exact binding explicitly so the WASI-only validator keeps + # its portable rolldown without touching package.json or the lock. + rolldown_version="$(node -p "require('./package-lock.json').packages['node_modules/rolldown'].version")" + test "$rolldown_version" = "$(node -p "require('./node_modules/rolldown/package.json').version")" + timeout --signal=TERM --kill-after=30s 5m env \ + npm_config_os=wasip1-threads \ + npm_config_cpu=wasm32 \ + npm install --no-save --include=optional --ignore-scripts --no-audit --no-fund \ + "@rolldown/binding-wasm32-wasi@${rolldown_version}" test -f node_modules/typescript/bin/tsc test -f node_modules/vitest/vitest.mjs test -f node_modules/@vitest/coverage-v8/package.json diff --git a/CHANGELOG.md b/CHANGELOG.md index cb2692fa4..8292202c5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ - Add a Noema-owned exact-claim evidence receipt contract whose execution and research producers serialize one canonical artifact that binds every receipt semantic field, including command/result/isolation/network or source revision/excerpt/retrieval policy. Admission accepts only a receipt ID from untrusted model output. The owner API first verifies the exact authenticated OpenCode-handoff manifest digest, canonical envelope bytes, reviewed producer-to-kind policy, and repository/head/workflow/run/attempt identity before it can construct an immutable typed index; admission then reconstructs each canonical artifact and verifies time/claim/artifact identity. The version-2 manifest now binds a separate producer-authenticated `ClaimEvidenceRequirement` containing the exact claim, independently required evidence kind, and `context` or `finding` publication authority. Raw current-head source lines are context only: they are withheld from finding-reference prompts and cannot publish a finding or `request_changes`; an explicitly producer-authorized source finding remains usable and retains exact path/line checks. Finding-free model `request_changes` and `blocked` verdicts cannot bypass receipt admission to publish a vacuous blocking review. Requirement/receipt kind mismatch, fixed-artifact semantic substitution, caller-supplied receipt dictionaries, model self-classification, stale identities, cross-kind receipts, marker-only sandbox output, noncanonical artifact bytes, and expired receipts fail closed before the GitHub publisher. This remains the owner prerequisite for ContextualWisdomLab/.github#1641 and issue #555. The reviewed `sandboxed_verify` adapter exists in owner source, but its actual central stdout/stderr/marker-to-manifest wiring and the trusted research producer are not yet integrated; exact-head hosted GREEN, immutable release, and the verified central consumer bump remain required. ## Unreleased +- CVE-2026-84373 remediation을 위해 Vitest 개발/테스트 툴체인을 4.1.9에서 패치된 4.1.11 라인으로 올린다(`vitest`, `@vitest/coverage-v8`, canonical `package-lock.json` 재생성, reviewed lockfile change policy, `test/vitest-security-lock.test.ts` 회귀 게이트 포함). Vitest 4.1.11이 끌어온 rolldown 1.2는 WASI 바인딩을 `optionalDependencies`에서 내려도 패키지 자체는 계속 발행하므로, patch-validator 이미지 materialize 단계가 lockfile-exact 버전의 `@rolldown/binding-wasm32-wasi`를 `--no-save`로 명시 설치해 WASI-only validator의 이식성을 유지한다(`package.json`/lock 불변). issue #568. - Tool / Capability Boundary에 Claude community plugin 외부 확장 승인 포트를 추가한다. 마켓플레이스 메타데이터, 가변 브랜치/태그, Anthropic 리뷰, 플러그인 지시문은 승인 권한이 아니다. exact commit/path/digest, AppGuardrail·격리 영수증, 독립 Noema Policy / Approval, 제품/역할 범위, 만료·롤백, 중복 활성화 재현만 통과한다. Policy / Approval은 명시적 immutable trust input이어야 하며 source-default pilot grant나 합성 owner digest를 production authority로 사용하지 않는다. activation과 invocation replay는 admission port가 실제 발행한 in-process authority만 인정하고, invocation은 activation 이후 시각이어야 하며 activation 범위, live catalog 여섯 identity field, AppGuardrail·quarantine receipt의 현재 존재와 artifact/policy/owner binding을 다시 검증한다. 제품 런타임에서는 플러그인 래퍼를 실행하지 않는다. `context-graph-contracts` 불변 계약이 나오기 전에는 로컬 포트와 테스트 더블만 쓴다. issue #545, ADR 0015. - `noema-core` provider-neutral Shared Kernel을 추가하여 이미 해석된 PydanticAI `Model`과 역할별 prompt/schema만 받아 Agent를 구성한다. 문자열 model identifier와 provider discovery·credential·routing·retry·failover는 Shared Kernel 밖에 두고 `Agent(..., retries=0)`으로 repository-local model-attempt authority를 만들지 않는다. Reviewer wheel·sdist·editable 설치는 canonical `packages/noema-core` source를 포함하거나 참조하며 별도 100% coverage·docstring과 clean install smoke로 검증한다. 외부 소비는 immutable versioned publication·exact source identity·SBOM/provenance·licensing/NOTICE·compatibility/rollback evidence 전에는 허용하지 않는다. - `writeAcquisitionPrivateFile`의 기존 대상 사전-교체 검증 read(`existingDescriptor` open)에 `O_NONBLOCK`을 추가해 fail-closed를 강화한다. 이 open은 이미 필수 filesystem capability로 `O_NONBLOCK`을 검증했지만 실제로는 사용하지 않아, 로컬 권한을 가진 행위자가 사전 `lstatSync` 정규 파일 확인과 이 open 사이에 대상 경로를 FIFO로 교체하면 writer가 나타날 때까지 무한정 블로킹해 writer lease를 계속 점유할 수 있었다. `O_NONBLOCK`은 정규 파일에는 영향이 없고, FIFO에서는 open이 즉시 반환되어 이어지는 descriptor 타입 검증이 그대로 fail-closed로 거부한다. 회귀 테스트(`test/acquisition-private-output-existing-target-nonblocking.test.ts`)와 기존 open-flags 계약 테스트 갱신으로 고정했다. diff --git a/test/patch-validator-image-contract.test.ts b/test/patch-validator-image-contract.test.ts index 10d698699..f3b2d5b07 100644 --- a/test/patch-validator-image-contract.test.ts +++ b/test/patch-validator-image-contract.test.ts @@ -68,6 +68,7 @@ describe("patch-validator image contract", () => { expect(imageWorkflow).toContain("node_modules/vitest/vitest.mjs"); expect(imageWorkflow).toContain("node_modules/@vitest/coverage-v8/package.json"); expect(imageWorkflow).toContain("node_modules/@rolldown/binding-wasm32-wasi/package.json"); + expect(imageWorkflow).toContain("@rolldown/binding-wasm32-wasi@${rolldown_version}"); expect(imageWorkflow).toContain( '--build-context "validator_deps=${VALIDATOR_DEPS_CONTEXT}"', ); From 626be6a917a54c17f7a0c26beb40747a24e73299 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 14:18:54 +0900 Subject: [PATCH 7/7] fix(security): complete WASI binding pin with canonical lock and policy --- .github/lockfile-change-policy.json | 21 ++--- .github/workflows/patch-validator-image.yml | 11 --- CHANGELOG.md | 2 +- package-lock.json | 85 +++++++++++++++++++++ test/patch-validator-image-contract.test.ts | 1 - 5 files changed, 97 insertions(+), 23 deletions(-) diff --git a/.github/lockfile-change-policy.json b/.github/lockfile-change-policy.json index 8e2153a97..2dd0befe2 100644 --- a/.github/lockfile-change-policy.json +++ b/.github/lockfile-change-policy.json @@ -1,26 +1,26 @@ { "baseSha": "8108bae1128c20b92d79dacaf65c3d9e3d55b758", "bulkChange": null, - "justification": "Remove CVE-2026-84373 by upgrading the reviewed Vitest development/test toolchain from 4.1.9 to the patched 4.1.11 line. The exact npm 11.17.0 regeneration artifact produced by hosted CI is promoted unchanged; unrelated dependency metadata changes are limited to npm-resolved transitive consequences of that exact package requirement change.", + "justification": "Remove CVE-2026-84373 by upgrading the reviewed Vitest development/test toolchain from 4.1.9 to the patched 4.1.11 line. The exact npm 11.17.0 regeneration artifact produced by hosted CI is promoted unchanged; unrelated dependency metadata changes are limited to npm-resolved transitive consequences of that exact package requirement change. Rolldown 1.2 (via Vite 8.2.2) dropped the WASI binding from its optionalDependencies while still publishing @rolldown/binding-wasm32-wasi, so the WASI-only patch-validator keeps its portable rolldown through an exact lock-version-aligned devDependency pin.", "packageDigests": { "": { - "afterSha256": "f45c7368a72c5f9a2382638634e499dfbe2d5c5832ca210b530fe4218bbfa062", + "afterSha256": "c709b6c0edc4882a85303da1462506541d7a80b03e560a5b3b20f461a76cbe7c", "beforeSha256": "bc4820765f3986a162070a7c499943d4976663ce9dbf4bc0d039bc8111d14c87" }, "node_modules/@emnapi/core": { - "afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1", + "afterSha256": "e854a52379d1cffb4e2c0cfd1bac84350a38d15af73bf06c090f34ad957d2785", "beforeSha256": "848c03e936967e05f83295c12535f4e7b985ee104935b385a66c376cbec59ac9" }, "node_modules/@emnapi/runtime": { - "afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1", + "afterSha256": "55a5f960c2ed3d1fe1cf40f599c7bfef2bdc346fdcae1dadc7dc73f1fa30a01a", "beforeSha256": "a0161c6254f2679a7b308bc63c038249535914d786acb1da984ec153d74ba06c" }, "node_modules/@emnapi/wasi-threads": { - "afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1", + "afterSha256": "88d4804cb66171577ff9c1ea74b31d7a1dbbd6f3c2d4c34418bc8450645e4e3a", "beforeSha256": "64bd9a72b619818d5539b9e7eb33fe325083b4d3d2b76c8507f35e98a73c9d4c" }, "node_modules/@napi-rs/wasm-runtime": { - "afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1", + "afterSha256": "ecaa0b2659acc4ceb9fc8b0713cdf49c120649290c840b9936cc469260859ef2", "beforeSha256": "422f97ea210489213241762d2de12275306ea11cde631dbcf7f92f446d356d33" }, "node_modules/@oxc-project/types": { @@ -80,7 +80,7 @@ "beforeSha256": "27926be74c242431dda66103ea3a91708da6405fd3bb086ed4644660e8dfa2d9" }, "node_modules/@rolldown/binding-wasm32-wasi": { - "afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1", + "afterSha256": "9777e820c46d2b10ce74b078a74ac710ead57c82c934839139e949d109091e9a", "beforeSha256": "9cfa7389dc68eb9d2626a259e02764498f7266cdf4cfdda255687e6dbcd29552" }, "node_modules/@rolldown/binding-win32-arm64-msvc": { @@ -92,7 +92,7 @@ "beforeSha256": "f822f724d442789bb158b02e9b4f744fa2e921ff204d52973851c75a32801b5f" }, "node_modules/@tybys/wasm-util": { - "afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1", + "afterSha256": "a8f477a4f68ddcc315ee91d90203244a2b42417dbdf7227ed2ce689af8f81e05", "beforeSha256": "44e06317b362727754aa815baa5cf36cee4e4f3904f0406d4b81f01ff7a155cd" }, "node_modules/@vitest/coverage-v8": { @@ -208,7 +208,7 @@ "beforeSha256": "6657bfb78b19f9dc5be02ccce35972b0fa71043f0e0f8112b0406ed87636f664" }, "node_modules/tslib": { - "afterSha256": "398b676e47d03a29016ee92fe378b8b4f1b3e965390c4c64ce78d27f79df74d1", + "afterSha256": "73fb28d27f41bc3d502bd6fee9dedd7f19aa9e624d76f0cb9d9727289d998c00", "beforeSha256": "b906828066eb6c857cec52ce68ea60f90ce0b92d237f4f89a5f0a6c285b36bca" }, "node_modules/vite": { @@ -224,7 +224,8 @@ "sources": [ "https://github.com/vitest-dev/vitest/releases/tag/v4.1.11", "https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8", - "https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4" + "https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4", + "https://www.npmjs.com/package/@rolldown/binding-wasm32-wasi" ], "targetPackages": [ "", diff --git a/.github/workflows/patch-validator-image.yml b/.github/workflows/patch-validator-image.yml index 7e6b791c4..d707ee75e 100644 --- a/.github/workflows/patch-validator-image.yml +++ b/.github/workflows/patch-validator-image.yml @@ -167,17 +167,6 @@ jobs: npm_config_os=wasip1-threads \ npm_config_cpu=wasm32 \ npm prune --include=optional --ignore-scripts --no-audit --no-fund - # Rolldown 1.2 dropped the WASI binding from its optionalDependencies - # while still publishing @rolldown/binding-wasm32-wasi. Install the - # lockfile-exact binding explicitly so the WASI-only validator keeps - # its portable rolldown without touching package.json or the lock. - rolldown_version="$(node -p "require('./package-lock.json').packages['node_modules/rolldown'].version")" - test "$rolldown_version" = "$(node -p "require('./node_modules/rolldown/package.json').version")" - timeout --signal=TERM --kill-after=30s 5m env \ - npm_config_os=wasip1-threads \ - npm_config_cpu=wasm32 \ - npm install --no-save --include=optional --ignore-scripts --no-audit --no-fund \ - "@rolldown/binding-wasm32-wasi@${rolldown_version}" test -f node_modules/typescript/bin/tsc test -f node_modules/vitest/vitest.mjs test -f node_modules/@vitest/coverage-v8/package.json diff --git a/CHANGELOG.md b/CHANGELOG.md index 8292202c5..49795bf18 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,7 +3,7 @@ - Add a Noema-owned exact-claim evidence receipt contract whose execution and research producers serialize one canonical artifact that binds every receipt semantic field, including command/result/isolation/network or source revision/excerpt/retrieval policy. Admission accepts only a receipt ID from untrusted model output. The owner API first verifies the exact authenticated OpenCode-handoff manifest digest, canonical envelope bytes, reviewed producer-to-kind policy, and repository/head/workflow/run/attempt identity before it can construct an immutable typed index; admission then reconstructs each canonical artifact and verifies time/claim/artifact identity. The version-2 manifest now binds a separate producer-authenticated `ClaimEvidenceRequirement` containing the exact claim, independently required evidence kind, and `context` or `finding` publication authority. Raw current-head source lines are context only: they are withheld from finding-reference prompts and cannot publish a finding or `request_changes`; an explicitly producer-authorized source finding remains usable and retains exact path/line checks. Finding-free model `request_changes` and `blocked` verdicts cannot bypass receipt admission to publish a vacuous blocking review. Requirement/receipt kind mismatch, fixed-artifact semantic substitution, caller-supplied receipt dictionaries, model self-classification, stale identities, cross-kind receipts, marker-only sandbox output, noncanonical artifact bytes, and expired receipts fail closed before the GitHub publisher. This remains the owner prerequisite for ContextualWisdomLab/.github#1641 and issue #555. The reviewed `sandboxed_verify` adapter exists in owner source, but its actual central stdout/stderr/marker-to-manifest wiring and the trusted research producer are not yet integrated; exact-head hosted GREEN, immutable release, and the verified central consumer bump remain required. ## Unreleased -- CVE-2026-84373 remediation을 위해 Vitest 개발/테스트 툴체인을 4.1.9에서 패치된 4.1.11 라인으로 올린다(`vitest`, `@vitest/coverage-v8`, canonical `package-lock.json` 재생성, reviewed lockfile change policy, `test/vitest-security-lock.test.ts` 회귀 게이트 포함). Vitest 4.1.11이 끌어온 rolldown 1.2는 WASI 바인딩을 `optionalDependencies`에서 내려도 패키지 자체는 계속 발행하므로, patch-validator 이미지 materialize 단계가 lockfile-exact 버전의 `@rolldown/binding-wasm32-wasi`를 `--no-save`로 명시 설치해 WASI-only validator의 이식성을 유지한다(`package.json`/lock 불변). issue #568. +- CVE-2026-84373 remediation을 위해 Vitest 개발/테스트 툴체인을 4.1.9에서 패치된 4.1.11 라인으로 올린다(`vitest`, `@vitest/coverage-v8`, canonical `package-lock.json` 재생성, reviewed lockfile change policy, `test/vitest-security-lock.test.ts` 회귀 게이트 포함). Vitest 4.1.11이 끌어온 rolldown 1.2는 WASI 바인딩을 `optionalDependencies`에서 내려도 패키지 자체는 계속 발행하므로, `@rolldown/binding-wasm32-wasi`를 lock 버전에 맞춘 exact devDependency로 명시해 WASI-only patch-validator의 이식성을 유지한다. issue #568. - Tool / Capability Boundary에 Claude community plugin 외부 확장 승인 포트를 추가한다. 마켓플레이스 메타데이터, 가변 브랜치/태그, Anthropic 리뷰, 플러그인 지시문은 승인 권한이 아니다. exact commit/path/digest, AppGuardrail·격리 영수증, 독립 Noema Policy / Approval, 제품/역할 범위, 만료·롤백, 중복 활성화 재현만 통과한다. Policy / Approval은 명시적 immutable trust input이어야 하며 source-default pilot grant나 합성 owner digest를 production authority로 사용하지 않는다. activation과 invocation replay는 admission port가 실제 발행한 in-process authority만 인정하고, invocation은 activation 이후 시각이어야 하며 activation 범위, live catalog 여섯 identity field, AppGuardrail·quarantine receipt의 현재 존재와 artifact/policy/owner binding을 다시 검증한다. 제품 런타임에서는 플러그인 래퍼를 실행하지 않는다. `context-graph-contracts` 불변 계약이 나오기 전에는 로컬 포트와 테스트 더블만 쓴다. issue #545, ADR 0015. - `noema-core` provider-neutral Shared Kernel을 추가하여 이미 해석된 PydanticAI `Model`과 역할별 prompt/schema만 받아 Agent를 구성한다. 문자열 model identifier와 provider discovery·credential·routing·retry·failover는 Shared Kernel 밖에 두고 `Agent(..., retries=0)`으로 repository-local model-attempt authority를 만들지 않는다. Reviewer wheel·sdist·editable 설치는 canonical `packages/noema-core` source를 포함하거나 참조하며 별도 100% coverage·docstring과 clean install smoke로 검증한다. 외부 소비는 immutable versioned publication·exact source identity·SBOM/provenance·licensing/NOTICE·compatibility/rollback evidence 전에는 허용하지 않는다. - `writeAcquisitionPrivateFile`의 기존 대상 사전-교체 검증 read(`existingDescriptor` open)에 `O_NONBLOCK`을 추가해 fail-closed를 강화한다. 이 open은 이미 필수 filesystem capability로 `O_NONBLOCK`을 검증했지만 실제로는 사용하지 않아, 로컬 권한을 가진 행위자가 사전 `lstatSync` 정규 파일 확인과 이 open 사이에 대상 경로를 FIFO로 교체하면 writer가 나타날 때까지 무한정 블로킹해 writer lease를 계속 점유할 수 있었다. `O_NONBLOCK`은 정규 파일에는 영향이 없고, FIFO에서는 open이 즉시 반환되어 이어지는 descriptor 타입 검증이 그대로 fail-closed로 거부한다. 회귀 테스트(`test/acquisition-private-output-existing-target-nonblocking.test.ts`)와 기존 open-flags 계약 테스트 갱신으로 고정했다. diff --git a/package-lock.json b/package-lock.json index 25617fc34..33023ebd5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,6 +9,7 @@ "version": "0.1.0", "devDependencies": { "@cloudflare/workers-types": "^4.20260630.0", + "@rolldown/binding-wasm32-wasi": "1.2.7", "@vitest/coverage-v8": "^4.1.11", "esbuild": "0.28.1", "typescript": "^5.9.0", @@ -171,6 +172,37 @@ "dev": true, "license": "MIT OR Apache-2.0" }, + "node_modules/@emnapi/core": { + "version": "2.0.0-alpha.4", + "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-2.0.0-alpha.4.tgz", + "integrity": "sha512-KjoUR6mNvjT+z5bKMy+a5QDI+kTNTiMZi6uPKzWuWjwZGNa0UPwIVduTfeBRdf6v8Ws5fmHDh7Usf15w/ANfkg==", + "dev": true, + "license": "MIT", + "dependencies": { + "@emnapi/wasi-threads": "2.0.1", + "tslib": "^2.4.0" + } + }, + "node_modules/@emnapi/runtime": { + "version": "2.0.0-alpha.4", + "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-2.0.0-alpha.4.tgz", + "integrity": "sha512-Wy1TQ99obRP3Ah7cf/OOtK1zD9t3pYTWz+G/SpAwTFMhG5hoMdlvfzBpYoHUigS/izu3q+VhYMKhJd7Ii/trpg==", + "dev": true, + "license": "MIT", + "dependencies": { + "tslib": "^2.4.0" + } + }, + "node_modules/@emnapi/wasi-threads": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-2.0.1.tgz", + "integrity": "sha512-9DsSk+o5NBX0CCJT8s0EROGSGxjR/tKu6aBTaVyq+SjAEQH4XcdcRxPBRzsBLizTTJ49MJjF+jgu3qnO9GLQcQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "tslib": "^2.4.0" + } + }, "node_modules/@esbuild/aix-ppc64": { "version": "0.28.1", "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz", @@ -630,6 +662,27 @@ "dev": true, "license": "MIT" }, + "node_modules/@napi-rs/wasm-runtime": { + "version": "1.2.3", + "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.3.tgz", + "integrity": "sha512-UMduMbqO5s5zF2NkNacMT/yK5Y5QiKvWr2+50bzIIxFDwVJ2h49b+oyjaCGPhJxd2/gC2x39EHv/gHVuu36x2Q==", + "dev": true, + "license": "MIT", + "dependencies": { + "@tybys/wasm-util": "^0.10.3" + }, + "engines": { + "node": "^20.19.0 || ^22.13.0 || >=23.5.0" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/Brooooooklyn" + }, + "peerDependencies": { + "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.4", + "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.4" + } + }, "node_modules/@oxc-project/types": { "version": "0.148.0", "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.148.0.tgz", @@ -879,6 +932,21 @@ "node": "^20.19.0 || >=22.12.0" } }, + "node_modules/@rolldown/binding-wasm32-wasi": { + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.2.7.tgz", + "integrity": "sha512-SCh0KdAR6h3y4r3GqUWjcB7oqDMjgMCN2zoEnzJVuFmrjWe6n/lGnJDDH8EqE4wZQHk3P39YeBPjpEpKFLdu+w==", + "dev": true, + "license": "MIT", + "dependencies": { + "@emnapi/core": "2.0.0-alpha.4", + "@emnapi/runtime": "2.0.0-alpha.4", + "@napi-rs/wasm-runtime": "~1.2.3" + }, + "engines": { + "node": "^20.19.0 || ^22.13.0 || >=23.5.0" + } + }, "node_modules/@rolldown/binding-win32-arm64-msvc": { "version": "1.2.7", "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.7.tgz", @@ -927,6 +995,16 @@ "dev": true, "license": "MIT" }, + "node_modules/@tybys/wasm-util": { + "version": "0.10.3", + "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz", + "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==", + "dev": true, + "license": "MIT", + "dependencies": { + "tslib": "^2.4.0" + } + }, "node_modules/@types/chai": { "version": "5.2.3", "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz", @@ -1856,6 +1934,13 @@ "node": ">=14.0.0" } }, + "node_modules/tslib": { + "version": "2.8.1", + "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz", + "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==", + "dev": true, + "license": "0BSD" + }, "node_modules/typescript": { "version": "5.9.3", "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", diff --git a/test/patch-validator-image-contract.test.ts b/test/patch-validator-image-contract.test.ts index f3b2d5b07..10d698699 100644 --- a/test/patch-validator-image-contract.test.ts +++ b/test/patch-validator-image-contract.test.ts @@ -68,7 +68,6 @@ describe("patch-validator image contract", () => { expect(imageWorkflow).toContain("node_modules/vitest/vitest.mjs"); expect(imageWorkflow).toContain("node_modules/@vitest/coverage-v8/package.json"); expect(imageWorkflow).toContain("node_modules/@rolldown/binding-wasm32-wasi/package.json"); - expect(imageWorkflow).toContain("@rolldown/binding-wasm32-wasi@${rolldown_version}"); expect(imageWorkflow).toContain( '--build-context "validator_deps=${VALIDATOR_DEPS_CONTEXT}"', );