[aborovsky]

No description provided.

[aborovsky]

Bumps @brightsec/node-libcurl 5.1.3 → 5.1.6, keeping bright-cli on the
maintained node-libcurl release.

Upstream: BrightSec/node-libcurl#46 (released as @brightsec/node-libcurl@5.1.6).

Change

• @brightsec/node-libcurl → 5.1.6 (package.json + lockfile)

That is the only change in this PR after rebasing onto next.

Why 5.1.6

5.1.6 makes node-libcurl's Windows vcpkg source build resilient to GNU FTP
outages. Some vcpkg ports (notably gsasl) download their sources only from
ftpmirror.gnu.org / ftp.gnu.org; when that network is unreachable the
install fails with Download timed out … halting portfile. 5.1.6 routes vcpkg
asset downloads through an x-script provider that falls back to a reachable
GNU mirror (mirrors.kernel.org) and still verifies each asset's SHA512, so the
download no longer depends on GNU FTP being up.

Relationship to #788 (already merged)

The transitive build-toolchain deps this PR originally also refreshed —
tar → 7.5.22, brace-expansion → 1.1.21 / 2.1.7 (incl. the
@brightsec/node-libcurl subtree copy), picomatch → 4.0.7 — have already
landed on next via the merged undici-override PR (#788), which refreshed the
lockfile. So those updates are no longer part of this diff; next and this
branch already carry the patched versions.

This PR is therefore the clean follow-up that moves the direct dependency itself
onto 5.1.6 (the upstream release that fixed its own lockfile and added the
GNU-mirror install resilience), so bright-cli no longer pins the superseded
5.1.3.

Security note

• No net-new Dependabot alerts are closed by this PR on its own — the
  tar / brace-expansion / picomatch runtime copies were already patched by
  fix(deps): raise undici override to ^7.29.1 and refresh lockfile #788.
• The remaining open tar / brace-expansion / picomatch alerts (chore: setup prerelease channel #133, fix(bus): stop the repeater on fatal errors #189,
  Remove window-based 'configure' from CLI #201, build(deps): bump ws from 7.4.5 to 7.4.6 #219, fix(polling): treat ESOCKETTIMEDOUT as a recoverable error #277) point only at the npm CLI vendored by semantic-release
  (node_modules/npm/node_modules/...) — a devDependency used at release time,
  never shipped to CLI consumers or bundled into the pkg binaries. npm
  bundles its own dependency tree, so neither a dependency bump nor overrides
  can rewrite those copies; they are addressed by the separate dev-toolchain
  refresh PR.

Verification

• Rebased onto current next; diff is @brightsec/node-libcurl 5.1.3 → 5.1.6
  only (package.json + the two lockfile entries).
• node-libcurl resolves from the public npm registry; no npm.pkg.github.com
  URLs in the lockfile.
• npm ci succeeds with a token-less public-npm config.
• npm run build (webpack, production) succeeds.
• npm run test:unit → 222 passed. (The one native-addon resolution error
  seen locally is from installing with --ignore-scripts, i.e. no prebuilt
  @brightsec/node-libcurl binary — not a regression; CI installs it normally.)
• E2E ci job run succeeded

[derevnjuk]

build not fix #793 (comment)

[aborovsky]

build not fix #793 (comment)

Then it won't trigger patch release. Which is a problem.

[derevnjuk]

build not fix #793 (comment)

Then it won't trigger patch release. Which is a problem.

@aborovsky your assumption isn't correct: https://github.com/NeuraLegion/bright-cli/blob/6fd1f76d9d835f784425e99edd16ba2765959328/.releaserc#L9

e.g. eeda38d