From 0c09e067eac132fb3464e4d451593a365e21009a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 2 Sep 2026 20:29:18 +0000 Subject: [PATCH 1/4] Bump @xmldom/xmldom in the npm_and_yarn group across 1 directory Bumps the npm_and_yarn group with 1 update in the / directory: [@xmldom/xmldom](https://github.com/xmldom/xmldom). Updates `@xmldom/xmldom` from 0.9.10 to 0.9.12 - [Release notes](https://github.com/xmldom/xmldom/releases) - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md) - [Commits](https://github.com/xmldom/xmldom/compare/0.9.10...0.9.12) --- updated-dependencies: - dependency-name: "@xmldom/xmldom" dependency-version: 0.9.12 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index b303691..17e7e22 100644 --- a/package-lock.json +++ b/package-lock.json @@ -55,9 +55,9 @@ } }, "node_modules/@xmldom/xmldom": { - "version": "0.9.10", - "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.10.tgz", - "integrity": "sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==", + "version": "0.9.12", + "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.12.tgz", + "integrity": "sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==", "dev": true, "license": "MIT", "engines": { From 69d4fd6f56459c6c950f6a9c2512b689dacf3ade Mon Sep 17 00:00:00 2001 From: chen21019 Date: Thu, 10 Sep 2026 00:22:24 +0800 Subject: [PATCH 2/4] ci: verify icon build and dependency updates --- .github/workflows/repository-integrity.yml | 29 ++++++++++++++++++++++ scripts/audit.mjs | 8 ++++-- 2 files changed, 35 insertions(+), 2 deletions(-) diff --git a/.github/workflows/repository-integrity.yml b/.github/workflows/repository-integrity.yml index dd834e1..ef4faac 100644 --- a/.github/workflows/repository-integrity.yml +++ b/.github/workflows/repository-integrity.yml @@ -13,3 +13,32 @@ permissions: jobs: integrity: uses: PastureStack/.github/.github/workflows/repository-integrity.yml@0830b344f020bcb7792a112c376bbfac48e63fa5 # pinned main + + build-test-audit: + name: Build, test, and dependency audit + runs-on: ubuntu-24.04 + timeout-minutes: 30 + steps: + - name: Check out candidate + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Install Node.js + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: '24.20.0' + cache: npm + + - name: Use the locked npm release + shell: bash + run: npm install --global npm@12.0.2 --ignore-scripts --no-audit --no-fund + + - name: Build, audit, and verify reproducibility + shell: bash + run: | + set -euo pipefail + test "$(node --version)" = 'v24.20.0' + test "$(npm --version)" = '12.0.2' + npm ci --no-audit --no-fund + npm test diff --git a/scripts/audit.mjs b/scripts/audit.mjs index db99086..259c3fb 100644 --- a/scripts/audit.mjs +++ b/scripts/audit.mjs @@ -10,7 +10,7 @@ const personalDenylist = [ Buffer.from("6368656e3231303139", "hex").toString("utf8"), Buffer.from("6368656e323130313940676d61696c2e636f6d", "hex").toString("utf8") ]; -const expectedRootLicenseHash = "1d5afc26765f4da03ed7605f2944198b985dac1ddac0ec0b5ace57fe06b94330"; +const expectedRootLicenseHash = "809fa1ed21450f59827d1e9aec720bbc4b687434fa22283c6cb5dd82a47ab9c0"; const expectedLucideLicenseHash = "b495047bd93a9b06913511076f504daba17d5bbeb3e0650f3bb53a4220329c57"; const expectedLucideTtfHash = "2ff7709e2f12f6ce07b2df9d3bad4120b622bfdb12c5c8eeaf5a713cf5bba233"; @@ -18,6 +18,10 @@ function sha256(value) { return createHash("sha256").update(value).digest("hex"); } +function normalizeTextLineEndings(value) { + return Buffer.from(value.toString("utf8").replaceAll("\r\n", "\n"), "utf8"); +} + async function filesUnder(directory, relative = "") { const files = []; for (const entry of await readdir(directory, { withFileTypes: true })) { @@ -69,7 +73,7 @@ for (const disallowed of ["selection.json", "compatibility-baseline.json"]) { } } -if (sha256(await readFile(path.join(root, "LICENSE"))) !== expectedRootLicenseHash) { +if (sha256(normalizeTextLineEndings(await readFile(path.join(root, "LICENSE")))) !== expectedRootLicenseHash) { throw new Error("Root LICENSE changed unexpectedly"); } const lucideLicense = await readFile(path.join(root, "node_modules", "lucide-static", "LICENSE")); From 9fb30e216828d72225b9cff41f197cceee925dca Mon Sep 17 00:00:00 2001 From: chen21019 Date: Thu, 10 Sep 2026 00:25:51 +0800 Subject: [PATCH 3/4] ci: install locked npm before package commands --- .github/workflows/repository-integrity.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/repository-integrity.yml b/.github/workflows/repository-integrity.yml index ef4faac..c3effe8 100644 --- a/.github/workflows/repository-integrity.yml +++ b/.github/workflows/repository-integrity.yml @@ -28,7 +28,6 @@ jobs: uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24.20.0' - cache: npm - name: Use the locked npm release shell: bash From e36138354af2dda9f012e8bc8599ab15f97e4870 Mon Sep 17 00:00:00 2001 From: chen21019 Date: Thu, 10 Sep 2026 00:26:49 +0800 Subject: [PATCH 4/4] ci: disable setup-node auto cache before npm pin --- .github/workflows/repository-integrity.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/repository-integrity.yml b/.github/workflows/repository-integrity.yml index c3effe8..8f2aacd 100644 --- a/.github/workflows/repository-integrity.yml +++ b/.github/workflows/repository-integrity.yml @@ -28,6 +28,7 @@ jobs: uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24.20.0' + package-manager-cache: false - name: Use the locked npm release shell: bash