From 2513347055bce7bde90a99a8c48b1221ef686169 Mon Sep 17 00:00:00 2001 From: Thomas Honeyman Date: Sun, 11 Oct 2026 08:19:43 -0400 Subject: [PATCH 1/3] Upgrade npm dependencies and PureScript package set --- DEPENDENCY_AUDIT.md | 525 +++++++ app/package.json | 2 +- app/test/App/Manifest/SpagoYaml.purs | 11 + foreign/package.json | 20 +- foreign/src/Foreign/SPDX.js | 2 +- foreign/src/Foreign/Yaml.js | 17 +- foreign/test/Foreign/SPDX.purs | 3 +- lib/package.json | 2 +- nix/overlay.nix | 2 +- package-lock.json | 2077 ++++++-------------------- spago.lock | 286 ++-- spago.yaml | 60 +- 12 files changed, 1164 insertions(+), 1843 deletions(-) create mode 100644 DEPENDENCY_AUDIT.md diff --git a/DEPENDENCY_AUDIT.md b/DEPENDENCY_AUDIT.md new file mode 100644 index 000000000..cc6edc66f --- /dev/null +++ b/DEPENDENCY_AUDIT.md @@ -0,0 +1,525 @@ +# Dependency upgrade audit — 2026-10-11 + +## Scope and method + +Baseline: the pushed `maintenance/nix-2026-10` branch (PR #802). Versions below +are **locked versions**, not the lower bounds of the old manifest ranges. +Targets were checked against npm's live `latest` dist-tags on 2026-10-11; +prereleases were excluded. All 15 distinct direct third-party npm dependencies +are covered, including the four already at latest. Eleven advance. + +For changed packages, this review compared the old and new **published npm +tarballs**, upstream tagged source, intervening commits, and release notes or +changelogs where available. This matters for generated distributions such as +AWS and Octokit. The links below identify the exact comparison, not just a +project homepage. Development-only upstream changes do not affect our runtime. + +The binding review checked imports/exports, arguments/options/defaults, result +shapes, exceptions, Promise/callback behavior, and runtime/native requirements. +Real dependencies were exercised through our FFI, including real loopback HTTP +with the actual SDKs, serializers, signers, transport, retry and throttling +plugins. Those probes do not substitute SDK mocks for the packages being +upgraded. They do not claim compatibility with a live GitHub or DigitalOcean +account; no production service or credential was used. + +### Manifest and tooling inventory + +- npm: root `package.json` and `package-lock.json`; workspaces + `app/package.json`, `foreign/package.json`, `lib/package.json`. There are no + first-party devDependencies or additional workspace npm lockfiles. Local + `registry-*` file dependencies remain local, not npm release targets. +- Spago: root `spago.yaml` and `spago.lock`; package configurations in `app/`, + `app-e2e/`, `dashboard/`, `foreign/`, `lib/`, `scripts/`, and `test-utils/`. +- The package manifests under `app/fixtures/licenses/{ambiguous-gfdl, + deprecated-agpl,halogen-hooks}/` are historical license-detection inputs, + not installed first-party dependencies. Changing them would change the tests. +- `.agents/setup` runs the root npm/Spago commands using Nix. The dashboard + workflow installs `purescript@0.15.16`, `spago@1.0.4`, and unversioned `esbuild` + with `--no-save`. Compiler and Spago pins are already the latest published + stable versions. esbuild currently resolves to 0.28.2; it has no old npm lock + entry. Tooling verification is recorded below. +- Nix's toolchain and `flake.lock` remain those of PR #802. The npm dependency + hash in `nix/overlay.nix` is regenerated. No package overrides, Node patches, + SQLite source-build hooks, compiler inputs, or new packaging exceptions were + introduced. `CONTRIBUTING.md` and `deploy.yml` are unchanged. + +## Direct JavaScript dependencies + +### @aws-sdk/client-s3: 3.1009.0 → 3.1149.0 (foreign) + +Sources: [full comparison](https://github.com/aws/aws-sdk-js-v3/compare/v3.1009.0...v3.1149.0), +[S3 changelog](https://github.com/aws/aws-sdk-js-v3/blob/v3.1149.0/clients/client-s3/CHANGELOG.md), +[command builder](https://github.com/aws/aws-sdk-js-v3/blob/v3.1149.0/clients/client-s3/src/commandBuilder.ts), +[runtime configuration](https://github.com/aws/aws-sdk-js-v3/blob/v3.1149.0/clients/client-s3/src/runtimeConfig.ts). +The upstream [upgrade guide](https://github.com/aws/aws-sdk-js-v3/blob/v3.1149.0/UPGRADING.md) +is a v2-to-v3 guide; this upgrade stays within v3. + +Changes across this interval include binary-decision-diagram endpoint +resolution and endpoint cache fixes; thinner generated command classes; S3 +middleware consolidation; internal XML parsing; checksum implementation +consolidation and additional MD5, SHA512 and XXHash algorithms; retry fixes +(including errors in HTTP 200 responses, adaptive throttling and transient DNS +errors); and core error fallback/metrics changes. Service-model additions cover +directory-bucket metrics/inventory, annotations, AWS Backup access points, +Object Lock event holds, inventory reference dates, region/storage-class and +checksum enum additions, and outpost access-point validation. TypeScript and +internal import reorganizations do not change our command constructors. + +`foreign/src/Foreign/S3.js` uses named exports `S3`, `ListObjectsCommand`, +`PutObjectCommand`, `DeleteObjectCommand`, and `DeleteObjectsCommand`. It passes +explicit endpoint, region, static credentials, and `forcePathStyle: false`; +commands use `Bucket`, `Prefix`, `Marker`, `Key`, buffer `Body`, `ACL`, and +`Delete: { Objects: [{ Key }], Quiet: true }`. All remain supported. The four +commands still return Promises with the same consumed `Contents`, `ETag`, +delete header fields and pagination fields. Missing `Contents` still maps to +`[]`. New optional output fields are ignored. Default checksum calculation +continues to run; it is not disabled to make tests pass. Node requirement is +>=20, satisfied by the inherited Node 24.21.0. + +**Validation:** actual local HTTP checked XML `&` decoding, numeric size, +Date conversion, missing `Contents`, buffer bytes, public-read ACL, SigV4 +authorization, default CRC32 headers on PUT and bulk DELETE, ETag, delete-marker +and version headers, AccessDenied/403 rejection, retry of an embedded +InternalError in HTTP 200, and two-page bulk deletion with the last-key marker +fallback. Isolated integration also exercises uploads/deletes through the real +SDK. **No binding change required.** + +Existing caveat, not introduced here: the PureScript delete response declares +fields that S3 can omit for an unversioned bucket. This upgrade neither makes +those fields required upstream nor changes the binding's existing behavior. + +### @octokit/plugin-retry: 8.1.0 → 8.1.1 (foreign) + +Sources: [comparison](https://github.com/octokit/plugin-retry.js/compare/v8.1.0...v8.1.1), +[release](https://github.com/octokit/plugin-retry.js/releases/tag/v8.1.1), +[retry implementation](https://github.com/octokit/plugin-retry.js/blob/v8.1.1/src/index.ts). +Published runtime source is unchanged except the version constant. Changes +update dependencies (`@octokit/types` 16 → 17 and request-error's minimum), +tests and development tooling. Peer requirement remains Octokit core >=7; +Node >=20 remains sufficient. Default retry status exclusions, retry count and +quadratic backoff are unchanged. + +`foreign/src/Foreign/Octokit.js` composes the named `retry` plugin with REST +and throttling and passes failures to `onError`. **Validation:** an actual 500 +followed by 200 produced two requests and a success callback; 401 was not +retried. Error callback status and response handling remain correct. +**No binding change required.** + +### @octokit/plugin-throttling: 11.0.3 → 11.0.5 (foreign) + +Sources: [comparison](https://github.com/octokit/plugin-throttling.js/compare/v11.0.3...v11.0.5), +[release](https://github.com/octokit/plugin-throttling.js/releases/tag/v11.0.5), +[implementation](https://github.com/octokit/plugin-throttling.js/blob/v11.0.5/src/index.ts). +The material runtime change defers Bottleneck instantiation until the first +request for Cloudflare Workers compatibility. Groups and the retry limiter are +initialized lazily; existing supplied limiters are preserved. The later patch +updates Octokit type dependencies to v17. No callback argument or return +contract change; Node >=20 and Octokit core >=7 are unchanged. + +Our `onRateLimit` reads `options.request.retryCount` and returns true while it +is <=2; `onSecondaryRateLimit` does not opt into retries. **Validation:** the +first real request succeeded after lazy initialization, a persistent primary +403 exhausted the existing policy after four total attempts, and a secondary +403 was returned after one attempt. Pagination still produced one combined +array. **No binding change required.** + +### @octokit/rest: 22.0.1 → 22.0.1 (foreign; already latest) + +Sources: [release](https://github.com/octokit/rest.js/releases/tag/v22.0.1), +[package definition](https://github.com/octokit/rest.js/blob/v22.0.1/package.json). +There is no direct-version source delta. The existing named `Octokit` export, +`.plugin()`, constructor auth/baseUrl options, `.request(route, args)` response +object and `.paginate(route, args)` array remain correct. Node >=20 is met. +The lock refresh updates compatible transitive packages; see the separate +Octokit transitive review below. **Validation:** the combined real HTTP probes +and the registry's GitHub integration paths, not only mocked unit tests. +**No binding change required.** + +### better-sqlite3: 13.0.3 → 13.0.3 (app and foreign; already latest) + +Sources: [release](https://github.com/WiseLibs/better-sqlite3/releases/tag/v13.0.3), +[API](https://github.com/WiseLibs/better-sqlite3/blob/v13.0.3/docs/api.md). +PR #802 already supplies this version. There is no new major-version +transition or source delta here. `app/src/App/SQLite.js` uses the default +Database export, synchronous constructor with `fileMustExist`/`verbose`, +`pragma`, prepared `.get/.all/.run` statements and synchronous `.transaction` +callbacks; these remain the v13 API. Statement result and error behavior are +unchanged. Node >=22 is required, and the addon must match Node's ABI. + +**Validation:** ordinary Nix npm packaging built successfully on Node +24.21.0; real SQLite job/deduplication tests, the server API integration and +VM smoke passed. No addon override was needed. **No binding change required.** +Darwin execution of this stack is still needed, despite PR #802's earlier +Apple Silicon validation. + +### fast-glob: 3.3.3 → 3.3.3 (foreign; already latest) + +Sources: [release](https://github.com/mrmlnc/fast-glob/releases/tag/3.3.3), +[API/options](https://github.com/mrmlnc/fast-glob/tree/3.3.3#api). +There is no direct source delta. `foreign/src/Foreign/FastGlob.js` imports the +default function and passes pattern arrays with cwd, ignore, file/directory, +case sensitivity, dotfile and uniqueness options. It still returns a Promise +of paths and rejects on filesystem errors. Node >=8.6 is met. `fastq` advances +1.20.1 → 1.20.3 and `picomatch` 2.3.1 → 2.3.2 within declared dependency ranges. + +**Validation:** real temporary files checked brace expansion, dotfiles and +ignore filtering; existing foreign glob tests and integration package-file +selection passed. **No binding change required.** The unresolved braces +security advisory below is not a successful security remediation claim. + +### fs-extra: 11.3.4 → 11.4.1 (foreign) + +Sources: [comparison](https://github.com/jprichardson/node-fs-extra/compare/11.3.4...11.4.1), +[complete interval changelog](https://github.com/jprichardson/node-fs-extra/blob/11.4.1/CHANGELOG.md). +11.3.5 fixes Windows identical-link detection, timestamp error handling and +synchronous descriptor cleanup; 11.3.6 prevents recursive copy/move through +symlinked destination ancestors; 11.4.0 reports EEXIST for a broken destination +symlink; 11.4.1 propagates emptyDir read errors and allows Unicode-normalization +renames on APFS. There is no change to defaults or exports of our APIs. + +`foreign/src/Foreign/FSExtra.js` uses named `ensureDir`, `remove`, and `copy` +from the package root, converting their Promises to Aff. `copy` passes the +Boolean `preserveTimestamps`; mkdir/remove return values are ignored. The +timestamp and symlink-copy fixes affect our possible inputs, not our calling +convention. We do not call move, emptyDir or ensureSymlink. Node >=14.14 is met. + +**Validation:** real directory creation/removal, copied bytes and preserved +mtime, ENOENT Promise rejection, and rejection of copying a directory through +a destination symlink back into itself. Integration package copies also passed. +**No binding change required.** APFS-specific rename behavior was not executed +on Linux and is not used by these bindings. + +### fuse.js: 7.1.0 → 7.5.0 (foreign) + +Sources: [comparison](https://github.com/krisk/Fuse/compare/v7.1.0...v7.5.0), +[changelog](https://github.com/krisk/Fuse/blob/v7.5.0/CHANGELOG.md). +7.2 adds runtime plugins, search caching/heap optimizations and match/index +fixes. 7.3 adds token search, static match and BigInt support, rewrites source +to TypeScript, removes UMD builds, changes removeAt's return, and makes empty +queries return all documents. 7.4 adds workers, token options and index/cache, +field-normalization, highlighting and worker-result fixes. 7.4.1/7.4.2 fix +declaration exports and move the build to tsdown. 7.5 fixes field word counts, +key-weight normalization, top-N tie selection and minMatchCharLength; upstream +explicitly warns that scores and ordering can change. + +`foreign/src/Foreign/SPDX.js` uses the default ESM Fuse constructor on a fixed +array of current/deprecated license strings with default options and maps +`search(identifier)` results' `item` field. No worker, token search, custom +weights, limit, mutation, highlights or UMD path is used. Constructor/result +shapes remain correct. Node >=10 is met. We accept corrected fuzzy scoring, +but an empty license must not suddenly suggest every license. + +**Binding adaptation:** return `[]` for the empty string. The existing public +`fuzzyMatchLicense` test now includes that input; before this guard it failed +with a list of suggested licenses, afterward it passed. A real-data probe +checked that **all 734 current/deprecated identifiers** remain their own top +exact result, and checked a misspelled BSD query. Existing Apache/BSD typo +tests remain unchanged. No scores or new private interaction tests were pinned. + +### jsonrepair: 3.13.3 → 3.15.0 (foreign) + +Sources: [comparison](https://github.com/josdejong/jsonrepair/compare/v3.13.3...v3.15.0), +[changelog](https://github.com/josdejong/jsonrepair/blob/v3.15.0/CHANGELOG.md). +3.14 repairs backslash-escaped newlines. 3.14.1 fixes invalid number repair, +unquoted strings beginning with a keyword, unescaped quotes before closing +characters/end-of-string, and nested trailing-comma repair. 3.15 adds +HTML-entity-encoded JSON repair and fixes infinite recursion for a string +followed by a backslash. Both regular and streaming implementations change. + +`foreign/src/Foreign/JsonRepair.js` only uses the synchronous named `jsonrepair` +function, passing a string and returning repaired text through `onSuccess` or +the existing `onError` value after a throw. No streaming, option, export or +async contract change. New repair capabilities are intentional improvements +for legacy input; actual quoted strings must still preserve literal entities. +No native requirement is introduced. + +**Validation:** entity-encoded JSON decodes `&` correctly; ordinary quoted +`&` stays literal; `[2., trueble]` repairs to numeric 2 and string +`trueble`; an outside-string backslash calls the failure branch rather than +recursing. Existing repair tests passed. **No binding change required.** + +### semver: 7.7.4 → 7.8.5 (foreign) + +Sources: [comparison](https://github.com/npm/node-semver/compare/v7.7.4...v7.8.5), +[changelog](https://github.com/npm/node-semver/blob/v7.8.5/CHANGELOG.md). +7.8 adds `truncate` and a CLI warning; 7.8.1 fixes prerelease subset logic and +strips build metadata before comparator trimming; 7.8.2 fixes incrementing +dotted prerelease identifiers; 7.8.3/7.8.5 correct caret/tilde lower bounds when +including prereleases; 7.8.4 rejects numeric components after wildcard +components. The remaining changes are documentation/development tooling. + +`foreign/src/Foreign/SemVer.js` uses default CJS-to-ESM import and synchronous +`validRange(string, { loose: true, includePrerelease: false })`, returning a +normalized comparator string or null. New functions/CLI and includePrerelease +true behavior are unused. Build metadata stripping and invalid wildcard +ordering are relevant input corrections. Node >=10 is met. + +**Validation:** exact normalized caret/loose-v results, build-metadata removal, +and `1.x.3` rejection; existing lenient-range public tests passed. +**No binding change required.** + +### tar: 7.5.21 → 7.5.22 (foreign) + +Sources: [comparison](https://github.com/isaacs/node-tar/compare/v7.5.21...v7.5.22), +[options source](https://github.com/isaacs/node-tar/blob/v7.5.22/src/options.ts). +The only functional-source delta broadens the TypeScript `transform` callback +return type to permit falsey values already accepted at runtime. It does not +change listing, extraction behavior, defaults or exports. + +`foreign/src/Foreign/Tar.js` uses named `list` with file, sync, filter and +onReadEntry options and consumes `entry.path`. It supplies no transform. +Execution stays synchronous with filesystem errors thrown. Node >=18 is met. +**Validation:** created a real gzip tarball, checked only the top-level +directory is returned and checked missing-file ENOENT; existing CLI archive +tests/integration passed. **No binding change required.** + +### tmp: 0.2.5 → 0.2.7 (foreign) + +Sources: [comparison](https://github.com/raszi/node-tmp/compare/v0.2.5...v0.2.7), +[implementation](https://github.com/raszi/node-tmp/blob/v0.2.7/lib/tmp.js). +0.2.6 uses relative-path containment checks instead of a raw prefix check. +0.2.7 rejects non-string prefix/postfix/template values and traversal substrings +that previously could evade validation. Generation and cleanup contracts remain +unchanged. + +`foreign/src/Foreign/Tmp.js` imports named `setGracefulCleanup` and `dirSync`, +enables cleanup once and always passes the literal string template `XXXXXX`. +It consumes the returned object's `name`. These inputs pass the stricter +validation; the API remains synchronous. Node >=14.14 is met. +**Validation:** a real directory was created; a child process using the binding +created an empty directory which was gone after graceful exit. Existing +temporary-directory users in tests passed. **No binding change required.** + +### yaml: 2.8.2 → 2.9.1 (app and foreign) + +Sources: [comparison](https://github.com/eemeli/yaml/compare/v2.8.2...v2.9.1), +[2.8.3](https://github.com/eemeli/yaml/releases/tag/v2.8.3), +[2.8.4](https://github.com/eemeli/yaml/releases/tag/v2.8.4), +[2.9.0](https://github.com/eemeli/yaml/releases/tag/v2.9.0), +[2.9.1](https://github.com/eemeli/yaml/releases/tag/v2.9.1). +2.8.3 adds a flow-stringification trailing-comma option and catches composition +stack overflow; 2.8.4 fixes alias-disable handling, invalid Unicode escapes and +decimal minFractionDigits. 2.9 avoids large-array push/apply and recursive lexer +stack exhaustion and **removes the documentation promise that parseDocument +never throws**. 2.9.1 limits recursive merge aliases and simplifies quoted-string +line unfolding. Stringification options and YAML 1.1 merge handling are unused +by our default parser. Node >=14.6 is met. + +`foreign/src/Foreign/Yaml.js` imports the default package object, calls +`parseDocument(string)`, checks `doc.errors`, and converts with `doc.toJSON()`. +Those methods and JSON shapes remain correct, but both parse and conversion +errors must stay inside `yamlParser :: String -> Either String JSON`. + +**Binding adaptation:** catch parse/conversion exceptions and return their +message through the failure callback, preserving existing doc.errors handling. +The success callback remains outside the catch. A real 11-by-11 alias expansion +previously threw `ReferenceError: Excessive alias count indicates a resource +exhaustion attack` past the public `parseYaml` interface; the new regression +test failed before the fix and passes after it. This uncaught conversion error +was also possible in the old dependency; the review found it while checking +the weakened upstream throwing guarantee, not as a new v2.9 invention. +Ordinary JSON values, malformed syntax and invalid Unicode were also exercised. + +### spdx-expression-parse: 4.0.0 → 5.0.0 (lib; major) + +Sources: [complete comparison](https://github.com/jslicense/spdx-expression-parse.js/compare/v4.0.0...v5.0.0), +[parser source](https://github.com/jslicense/spdx-expression-parse.js/blob/v5.0.0/parse.js). +There is no separate migration guide. Published package comparison shows the +entire parser delta: LicenseRef nodes can now carry a `WITH` exception, and +truncated DocumentRef input gets an explicit `Unexpected end of input` Error +instead of dereferencing a null token. The package version is the other delta; +scanner, entrypoint, dependency declarations and ordinary conjunction ASTs are +unchanged. It remains synchronous CJS with a default ESM interop import. + +`lib/src/License.js` reads leaf `license`, `plus`, optional `exception`, and +branch `left`, `right`, `conjunction`; it already understands the added optional +field and catches thrown parse errors. PureScript `Registry.License` still +requires recognized SPDX identifiers, so accepting LicenseRef WITH upstream +does not admit arbitrary custom licenses into registry manifests. + +**Validation:** actual v5 AST decoding preserved the LicenseRef exception; +truncated DocumentRef reached the error callback; public `License.parse` +continued to reject custom refs. Nested AND/OR round-tripping and deprecated +GPL-plus canonicalization passed, as did existing library tests. **No binding +change required despite the major.** + +### ssh2: 1.17.0 → 1.17.0 (lib; already latest) + +Sources: [tagged source](https://github.com/mscdex/ssh2/tree/v1.17.0), +[key-parser API](https://github.com/mscdex/ssh2/tree/v1.17.0#utilities). +There is no direct-version delta. `lib/src/SSH.js` uses the default CJS interop +import and `utils.parseKey(buffer, passphrase)`; parsed-key sign/verify, +type/comment, isPrivateKey, equals and getPublicSSH remain synchronous. +parseKey's possible Error/array results have not changed. Node >=10.16 is met. + +The lock refresh updates `nan` 2.25.0 → 2.29.0 for native-build compatibility: +[comparison](https://github.com/nodejs/nan/compare/v2.25.0...v2.29.0), +[changelog](https://github.com/nodejs/nan/blob/v2.29.0/CHANGELOG.md). +The interval adds V8 embedder/external-pointer type tags, fixes the associated +weak-pointer header/copy-paste issues and adds Node 26/V8 15.3 support; it does +not change the first-party JS API. The optional cpu-features version remains +0.0.10 and is omitted by Nix's existing `--omit=optional`. **Validation:** +existing real-key parsing/signing/verifying/ownership library tests and signed +integration operations passed under Node 24. **No binding change required.** + +## Material transitive changes + +### AWS runtime consolidation + +`@aws-sdk/core` 3.973.20 → 3.978.2, `@smithy/core` 3.23.11 → 3.35.2, +`@smithy/node-http-handler` 4.4.16 → 4.12.1, +`@smithy/fetch-http-handler` 5.3.15 → 5.8.0, +`@smithy/signature-v4` 5.3.12 → 5.7.4, +`@aws-sdk/middleware-sdk-s3` 3.972.20 → 3.972.78 and +`@aws-sdk/xml-builder` 3.972.11 → 3.972.41 accompany the generated-client change. +`@aws-sdk/checksums` 3.1001.2 is new. Many small AWS/Smithy packages and the +fast-xml-parser/fast-xml-builder/strnum chain disappear, being replaced by the +SDK's consolidated internal modules rather than our own replacements. +Credential-provider packages are refreshed, but our explicit static credential +object does not use their discovery chain. + +The S3 command/runtime source comparisons linked above show the moved checksum, +endpoint, retry and XML import paths and preserved command middleware settings. +The real-wire S3 checks specifically exercised those risky paths, including +signed request headers, XML scalar conversion, default checksums and an HTTP +200 error retry. No private AWS/Smithy submodule is imported by first-party FFI. + +### Octokit transport and types + +`@octokit/request` 10.0.8 → 10.0.16: +[comparison](https://github.com/octokit/request.js/compare/v10.0.8...v10.0.16). +Published fetch-wrapper changes replace fast-content-type-parse with +`content-type` 3.1.1, keep octet-stream responses binary even with utf-8 charset, +and safely extract errors from null/primitive JSON bodies. `.request` still +returns response headers/status/data and throws a RequestError for HTTP errors. +Real HTTP probes verified ordinary JSON, a null-bodied 401 error and binary +bytes `[0, 255, 128]` with a misleading charset. Our declared GitHub routes +consume JSON, including base64 repository content, not raw binary downloads. + +`@octokit/core` 7.0.6 → 7.0.8 and `@octokit/endpoint` 11.0.3 → 11.0.5 have no +published runtime-source difference except version constants; +`@octokit/request-error` 7.1.0 → 7.1.2 has no published runtime-source difference. +Sources: [core](https://github.com/octokit/core.js/compare/v7.0.6...v7.0.8), +[endpoint](https://github.com/octokit/endpoint.js/compare/v11.0.3...v11.0.5), +[request-error](https://github.com/octokit/request-error.js/compare/v7.1.0...v7.1.2). + +`json-with-bigint` 3.5.7 → 3.5.12 remains the transport's JSON codec. Sources: +[old published code](https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.7.tgz), +[new published code](https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.12.tgz). +The distribution adds iterative parse/reviver and stringify fallbacks for deep +objects, tightens string-marker regular expressions, and generates its CJS +distribution from ESM. Native context.source parsing and rawJSON serialization +remain fast paths. The real Octokit HTTP round-trip checked safe numeric +9007199254740991, positive/negative BigInt 9007199254740993, literal `123n` and +fractional values, then parsed a 10,000-deep array without losing its BigInt. +No user reviver/replacer or private codec API is exposed by our bindings. + +The root `@octokit/types` advances 16 → 18 and openapi-types 27 → 29.0.1; +retry/throttling resolve types 17/openapi-types 28 separately, while REST's +endpoint/pagination plugins retain their v16 declarations. These are +declaration-only packages, not new JS implementations or wire coercions. +No TypeScript declaration is used by the PureScript FFI. Real response, +error, retry and pagination checks establish compatibility independently of +those type versions. + +### SPDX data and glob security + +`spdx-license-ids` 3.0.23 → 3.0.24 is imported directly by our License/SPDX FFI +but supplied transitively by spdx-expression-parse. Published JSON comparison +adds 13 current identifiers and does not remove/reclassify old IDs or change +the deprecated list. Sources: [comparison](https://github.com/jslicense/spdx-license-ids/compare/v3.0.23...v3.0.24), +[current data](https://github.com/jslicense/spdx-license-ids/blob/v3.0.24/index.json). +All 734 current/deprecated exact fuzzy matches were checked; normal/canonical +license parser tests passed. This intentionally expands accepted current IDs. + +`picomatch` 2.3.1 → 2.3.2 adds null-prototype lookup tables and extglob +anti-ReDoS handling, fixing +[method injection](https://github.com/advisories/GHSA-3v7f-55p6-f55p) and +[extglob ReDoS](https://github.com/advisories/GHSA-c2c7-rcm5-vvqj). +Source: [comparison](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2). +Real glob checks and package inclusion/exclusion integration passed. Highly +complex nested extglob behavior can be restricted by the security fix; we do +not weaken it with a custom option or override. + +**Unresolved security limitation:** `npm audit` still reports three high-severity +package entries (`braces`, propagated to `micromatch` and `fast-glob`) for one +[deeply nested brace stack-exhaustion advisory](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm). +braces 3.0.3 and fast-glob 3.3.3 are already latest and npm reports no fix. +Manifest include/exclude patterns can reach glob processing, so this cannot be +dismissed as development-only. Thomas explicitly excluded remediation from this +task; it is recorded here, not a publication blocker. This PR does not claim a +clean security audit, silently pin an older release, or invent an override. + +## PureScript and tooling outcome + +Per Thomas's direction, use the latest package set, **68.1.1 → 81.4.0** (published +2026-10-09), not a solver migration or per-package overrides. Source: +[package set](https://github.com/purescript/registry/blob/main/package-sets/81.4.0.json). +Both Git overrides are removed because the set now provides published registry +packages at newer versions. Effective resolved package changes are: + +| Package | Old | New | +| --- | --- | --- | +| b64 | 0.0.8 | 0.0.9 | +| dodo-printer | Git v2.2.1 | registry 2.2.3 | +| encoding | 0.0.9 | 0.0.10 | +| http-methods | 6.0.0 | 6.1.0 | +| language-cst-parser | Git v0.13.0 | registry 0.14.1 | +| parsing | 10.3.0 | 11.0.0 | +| spec | 8.1.1 | 8.1.2 | + +Other edits in the lock's package-set snapshot describe packages this workspace +does not resolve; they are not additional installed upgrades. Some published +releases are newer than the set (for example node-path 6 and web-dom 7); retaining +the curated latest set rather than overriding those is intentional and explicit. +All seven workspace packages compile without warnings/errors. No dashboard +source, styles, Halogen, or DOM dependency version changed in the final stack. + +Tooling: PureScript 0.15.16 and Spago 1.0.4 already match npm latest and the +dashboard workflow pins. The dashboard bundle was built with both inherited +Nix esbuild 0.27.2 and npm latest esbuild **0.28.2**, matching the workflow's +unversioned install. The former remains part of the parent PR's Nix toolchain, +not an npm lock dependency upgraded here. Sources: +[esbuild comparison](https://github.com/evanw/esbuild/compare/v0.27.2...v0.28.2), +[0.28.0 notes](https://github.com/evanw/esbuild/releases/tag/v0.28.0), +[0.28.1 notes](https://github.com/evanw/esbuild/releases/tag/v0.28.1), +[0.28.2 notes](https://github.com/evanw/esbuild/releases/tag/v0.28.2). +The 0.28 transition adds text imports and integrity checking for fallback binary +downloads, updates Go, and fixes dev-server traversal, Deno integrity, JS/TS +tree shaking/printing/evaluation, CSS minification and output-overwrite handling. +Our CLI uses browser/Node bundling, distinct input/output paths and JSON import +attributes; it does not use Deno, wasm, text imports or CSS minification. Existing +CLI flags remain valid. No esbuild JS API binding or custom binary install exists. + +## Validation and limitations + +Executed on Chantilly, Linux x86_64, inherited Node 24.21.0/npm 11.19.0: + +- `spago build`: all seven workspace packages, zero warnings/errors. +- `spago test -p registry-lib`: **129/129**. +- `spago test -p registry-foreign`: **18/18**, including the empty-license + regression that failed before its binding fix. +- `spago test -p registry-app`: **153/153**, including the YAML regression + that threw before its binding fix. +- Targeted actual-dependency probes: **11/11 groups**, with assertions on + observable values and failures as described in each package section. Test + HTTP servers bound ephemeral loopback ports and were shut down afterward. +- Dashboard browser bundle: passed with esbuild 0.27.2 and 0.28.2. +- PureScript formatting check: passed. +- `nix flake check -L`: Linux `spago-test`, `nix-format`, `purescript-format`, + `verify-dhall`, `integration`, and `smoke`: **all six passed** on the final + binding changes. Integration passed **29/29** tests, uses isolated mocks, + and smoke uses a NixOS VM, not the shared interactive test environment. +- `npm outdated --json`: `{}`. `npm audit` is **not clean**: the three high + package entries described above remain without an available upstream fix. + +Darwin source compatibility is assessed, not executed: APIs remain portable, +Node requirements are met, no new platform-specific FFI or packaging override +was added, and both removed Spago Git dependencies now use registry tarballs. +The existing Darwin Spago cache-path handling remains intact. The unchanged +SQLite version still needs its native addon on the target Node ABI; fs-extra's +APFS-only fix was not exercised here. Thomas explicitly waived Darwin execution +for this task; it is not a publication blocker, and no Darwin test pass is +claimed. The dashboard workflow's Node 22 path was not separately executed +here. No push, PR publication, merge or deployment is part of these local +validation results. diff --git a/app/package.json b/app/package.json index aae2ea250..6c77e9ac7 100644 --- a/app/package.json +++ b/app/package.json @@ -7,6 +7,6 @@ "better-sqlite3": "^13.0.3", "registry-foreign": "file:../foreign", "registry-lib": "file:../lib", - "yaml": "^2.8.2" + "yaml": "^2.9.1" } } diff --git a/app/test/App/Manifest/SpagoYaml.purs b/app/test/App/Manifest/SpagoYaml.purs index 172b961c0..b3c83cff7 100644 --- a/app/test/App/Manifest/SpagoYaml.purs +++ b/app/test/App/Manifest/SpagoYaml.purs @@ -28,6 +28,17 @@ spec = do Left err -> Assert.fail $ path <> " failed: " <> err Right _ -> pure unit + Spec.it "Returns a parse error when YAML aliases exceed the expansion limit" do + let + input = + """ + a: &a [1] + b: &b [*a, *a, *a, *a, *a, *a, *a, *a, *a, *a, *a] + c: [*b, *b, *b, *b, *b, *b, *b, *b, *b, *b, *b] + """ + + parseYaml SpagoYaml.spagoYamlCodec input `Assert.shouldSatisfy` isLeft + Spec.it "Rejects deprecated SPDX identifiers in publish config" do let input = diff --git a/foreign/package.json b/foreign/package.json index c6e7eba48..2a0ce09c1 100644 --- a/foreign/package.json +++ b/foreign/package.json @@ -4,19 +4,19 @@ "private": true, "license": "BSD-3-Clause", "dependencies": { - "@aws-sdk/client-s3": "^3.1009.0", - "@octokit/plugin-retry": "^8.1.0", - "@octokit/plugin-throttling": "^11.0.3", + "@aws-sdk/client-s3": "^3.1149.0", + "@octokit/plugin-retry": "^8.1.1", + "@octokit/plugin-throttling": "^11.0.5", "@octokit/rest": "^22.0.1", "better-sqlite3": "^13.0.3", "fast-glob": "^3.3.3", - "fs-extra": "^11.3.4", - "fuse.js": "^7.1.0", - "jsonrepair": "^3.13.3", + "fs-extra": "^11.4.1", + "fuse.js": "^7.5.0", + "jsonrepair": "^3.15.0", "registry-lib": "file:../lib", - "semver": "^7.7.4", - "tar": "^7.5.21", - "tmp": "^0.2.5", - "yaml": "^2.8.2" + "semver": "^7.8.5", + "tar": "^7.5.22", + "tmp": "^0.2.7", + "yaml": "^2.9.1" } } diff --git a/foreign/src/Foreign/SPDX.js b/foreign/src/Foreign/SPDX.js index 4ec017a62..a55485377 100644 --- a/foreign/src/Foreign/SPDX.js +++ b/foreign/src/Foreign/SPDX.js @@ -11,4 +11,4 @@ const allIdentifiers = identifiers.concat(deprecatedIdentifiers); const fuse = new Fuse(allIdentifiers); export const matchLicenseImpl = (identifier) => - fuse.search(identifier).map(({ item }) => item); + identifier === "" ? [] : fuse.search(identifier).map(({ item }) => item); diff --git a/foreign/src/Foreign/Yaml.js b/foreign/src/Foreign/Yaml.js index 6aed7b02a..fd5154e62 100644 --- a/foreign/src/Foreign/Yaml.js +++ b/foreign/src/Foreign/Yaml.js @@ -1,11 +1,16 @@ import Yaml from 'yaml'; export function yamlDocParserImpl(fail, succ, s) { - const doc = Yaml.parseDocument(s); - if (doc.errors.length === 0) { - return succ(doc.toJSON()); - } else { - // TODO: eh, we should return properly structured errors here - return fail(JSON.stringify(doc.errors)); + let value; + try { + const doc = Yaml.parseDocument(s); + if (doc.errors.length !== 0) { + // TODO: eh, we should return properly structured errors here + return fail(JSON.stringify(doc.errors)); + } + value = doc.toJSON(); + } catch (error) { + return fail(error instanceof Error ? error.message : String(error)); } + return succ(value); } diff --git a/foreign/test/Foreign/SPDX.purs b/foreign/test/Foreign/SPDX.purs index ba3fef56d..0cf36c1aa 100644 --- a/foreign/test/Foreign/SPDX.purs +++ b/foreign/test/Foreign/SPDX.purs @@ -44,5 +44,6 @@ fixable = unfixable :: Array String unfixable = - [ "MIT AND BSD-3" + [ "" + , "MIT AND BSD-3" ] diff --git a/lib/package.json b/lib/package.json index 04f4dc98c..f068d8afb 100644 --- a/lib/package.json +++ b/lib/package.json @@ -3,7 +3,7 @@ "private": true, "license": "BSD-3-Clause", "dependencies": { - "spdx-expression-parse": "^4.0.0", + "spdx-expression-parse": "^5.0.0", "ssh2": "^1.17.0" } } diff --git a/nix/overlay.nix b/nix/overlay.nix index 4dad587cc..9ebe82ec3 100644 --- a/nix/overlay.nix +++ b/nix/overlay.nix @@ -167,7 +167,7 @@ in npmFlags = [ "--omit=optional" ]; # To update: run `nix build .#server` and copy the hash from the error - npmDepsHash = "sha256-uj1LQ+Q9Zz8zguehJp9tQrEAMLoUm7BZEraCGQVGByQ="; + npmDepsHash = "sha256-7AFgk11qIzTqgn2jtXBw340ZFcGqJMtjeZ+Xvr0vqNc="; installPhase = '' mkdir -p $out diff --git a/package-lock.json b/package-lock.json index 1131fac1d..e9c6b3a4c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -19,299 +19,69 @@ "better-sqlite3": "^13.0.3", "registry-foreign": "file:../foreign", "registry-lib": "file:../lib", - "yaml": "^2.8.2" + "yaml": "^2.9.1" } }, "foreign": { "name": "registry-foreign", "license": "BSD-3-Clause", "dependencies": { - "@aws-sdk/client-s3": "^3.1009.0", - "@octokit/plugin-retry": "^8.1.0", - "@octokit/plugin-throttling": "^11.0.3", + "@aws-sdk/client-s3": "^3.1149.0", + "@octokit/plugin-retry": "^8.1.1", + "@octokit/plugin-throttling": "^11.0.5", "@octokit/rest": "^22.0.1", "better-sqlite3": "^13.0.3", "fast-glob": "^3.3.3", - "fs-extra": "^11.3.4", - "fuse.js": "^7.1.0", - "jsonrepair": "^3.13.3", + "fs-extra": "^11.4.1", + "fuse.js": "^7.5.0", + "jsonrepair": "^3.15.0", "registry-lib": "file:../lib", - "semver": "^7.7.4", - "tar": "^7.5.21", - "tmp": "^0.2.5", - "yaml": "^2.8.2" + "semver": "^7.8.5", + "tar": "^7.5.22", + "tmp": "^0.2.7", + "yaml": "^2.9.1" } }, "lib": { "name": "registry-lib", "license": "BSD-3-Clause", "dependencies": { - "spdx-expression-parse": "^4.0.0", + "spdx-expression-parse": "^5.0.0", "ssh2": "^1.17.0" } }, - "node_modules/@aws-crypto/crc32": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/@aws-crypto/crc32/-/crc32-5.2.0.tgz", - "integrity": "sha512-nLbCWqQNgUiwwtFsen1AdzAtvuLRsQS8rYgMuxCrdKf9kOssamGLuPwyTY9wyYblNr9+1XM8v6zoDTPPSIeANg==", + "node_modules/@aws-sdk/checksums": { + "version": "3.1001.2", + "resolved": "https://registry.npmjs.org/@aws-sdk/checksums/-/checksums-3.1001.2.tgz", + "integrity": "sha512-gKRj5IXZ/O0ehk2rwfb55YygdNKNhK5N1l/Ztg/w06tk21AJtCPuyErETk2RS/6XOmpBkcZY6CN3GlQ2fWTh1g==", "license": "Apache-2.0", "dependencies": { - "@aws-crypto/util": "^5.2.0", - "@aws-sdk/types": "^3.222.0", + "@aws-sdk/core": "^3.978.2", + "@aws-sdk/types": "^3.974.6", + "@smithy/core": "^3.35.2", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { - "node": ">=16.0.0" - } - }, - "node_modules/@aws-crypto/crc32c": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/@aws-crypto/crc32c/-/crc32c-5.2.0.tgz", - "integrity": "sha512-+iWb8qaHLYKrNvGRbiYRHSdKRWhto5XlZUEBwDjYNf+ly5SVYG6zEoYIdxvf5R3zyeP16w4PLBn3rH1xc74Rag==", - "license": "Apache-2.0", - "dependencies": { - "@aws-crypto/util": "^5.2.0", - "@aws-sdk/types": "^3.222.0", - "tslib": "^2.6.2" - } - }, - "node_modules/@aws-crypto/sha1-browser": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/@aws-crypto/sha1-browser/-/sha1-browser-5.2.0.tgz", - "integrity": "sha512-OH6lveCFfcDjX4dbAvCFSYUjJZjDr/3XJ3xHtjn3Oj5b9RjojQo8npoLeA/bNwkOkrSQ0wgrHzXk4tDRxGKJeg==", - "license": "Apache-2.0", - "dependencies": { - "@aws-crypto/supports-web-crypto": "^5.2.0", - "@aws-crypto/util": "^5.2.0", - "@aws-sdk/types": "^3.222.0", - "@aws-sdk/util-locate-window": "^3.0.0", - "@smithy/util-utf8": "^2.0.0", - "tslib": "^2.6.2" - } - }, - "node_modules/@aws-crypto/sha1-browser/node_modules/@smithy/is-array-buffer": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-2.2.0.tgz", - "integrity": "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==", - "license": "Apache-2.0", - "dependencies": { - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=14.0.0" - } - }, - "node_modules/@aws-crypto/sha1-browser/node_modules/@smithy/util-buffer-from": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-2.2.0.tgz", - "integrity": "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/is-array-buffer": "^2.2.0", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=14.0.0" - } - }, - "node_modules/@aws-crypto/sha1-browser/node_modules/@smithy/util-utf8": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-2.3.0.tgz", - "integrity": "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/util-buffer-from": "^2.2.0", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=14.0.0" - } - }, - "node_modules/@aws-crypto/sha256-browser": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/@aws-crypto/sha256-browser/-/sha256-browser-5.2.0.tgz", - "integrity": "sha512-AXfN/lGotSQwu6HNcEsIASo7kWXZ5HYWvfOmSNKDsEqC4OashTp8alTmaz+F7TC2L083SFv5RdB+qU3Vs1kZqw==", - "license": "Apache-2.0", - "dependencies": { - "@aws-crypto/sha256-js": "^5.2.0", - "@aws-crypto/supports-web-crypto": "^5.2.0", - "@aws-crypto/util": "^5.2.0", - "@aws-sdk/types": "^3.222.0", - "@aws-sdk/util-locate-window": "^3.0.0", - "@smithy/util-utf8": "^2.0.0", - "tslib": "^2.6.2" - } - }, - "node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/is-array-buffer": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-2.2.0.tgz", - "integrity": "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==", - "license": "Apache-2.0", - "dependencies": { - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=14.0.0" - } - }, - "node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/util-buffer-from": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-2.2.0.tgz", - "integrity": "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/is-array-buffer": "^2.2.0", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=14.0.0" - } - }, - "node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/util-utf8": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-2.3.0.tgz", - "integrity": "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/util-buffer-from": "^2.2.0", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=14.0.0" - } - }, - "node_modules/@aws-crypto/sha256-js": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/@aws-crypto/sha256-js/-/sha256-js-5.2.0.tgz", - "integrity": "sha512-FFQQyu7edu4ufvIZ+OadFpHHOt+eSTBaYaki44c+akjg7qZg9oOQeLlk77F6tSYqjDAFClrHJk9tMf0HdVyOvA==", - "license": "Apache-2.0", - "dependencies": { - "@aws-crypto/util": "^5.2.0", - "@aws-sdk/types": "^3.222.0", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=16.0.0" - } - }, - "node_modules/@aws-crypto/supports-web-crypto": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/@aws-crypto/supports-web-crypto/-/supports-web-crypto-5.2.0.tgz", - "integrity": "sha512-iAvUotm021kM33eCdNfwIN//F77/IADDSs58i+MDaOqFrVjZo9bAal0NK7HurRuWLLpF1iLX7gbWrjHjeo+YFg==", - "license": "Apache-2.0", - "dependencies": { - "tslib": "^2.6.2" - } - }, - "node_modules/@aws-crypto/util": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/@aws-crypto/util/-/util-5.2.0.tgz", - "integrity": "sha512-4RkU9EsI6ZpBve5fseQlGNUWKMa1RLPQ1dnjnQoe07ldfIzcsGb5hC5W0Dm7u423KWzawlrpbjXBrXCEv9zazQ==", - "license": "Apache-2.0", - "dependencies": { - "@aws-sdk/types": "^3.222.0", - "@smithy/util-utf8": "^2.0.0", - "tslib": "^2.6.2" - } - }, - "node_modules/@aws-crypto/util/node_modules/@smithy/is-array-buffer": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-2.2.0.tgz", - "integrity": "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==", - "license": "Apache-2.0", - "dependencies": { - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=14.0.0" - } - }, - "node_modules/@aws-crypto/util/node_modules/@smithy/util-buffer-from": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-2.2.0.tgz", - "integrity": "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/is-array-buffer": "^2.2.0", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=14.0.0" - } - }, - "node_modules/@aws-crypto/util/node_modules/@smithy/util-utf8": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-2.3.0.tgz", - "integrity": "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/util-buffer-from": "^2.2.0", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=14.0.0" + "node": ">=20.0.0" } }, "node_modules/@aws-sdk/client-s3": { - "version": "3.1009.0", - "resolved": "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1009.0.tgz", - "integrity": "sha512-luy8CxallkoiGWTqU86ca/BbvkWJjs0oala7uIIRN1JtQxMb5i4Yl/PBZVcQFhbK9kQi0PK0GfD8gIpLkI91fw==", + "version": "3.1149.0", + "resolved": "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1149.0.tgz", + "integrity": "sha512-wEccG+3/ap7iIBO4DbWwqNHh2u5Qm5OCQJzJaAvtVFIoZbp0qia8HIXv4rpnNmJJEX8205mlq67F9QJ0nKlcxg==", "license": "Apache-2.0", "dependencies": { - "@aws-crypto/sha1-browser": "5.2.0", - "@aws-crypto/sha256-browser": "5.2.0", - "@aws-crypto/sha256-js": "5.2.0", - "@aws-sdk/core": "^3.973.20", - "@aws-sdk/credential-provider-node": "^3.972.21", - "@aws-sdk/middleware-bucket-endpoint": "^3.972.8", - "@aws-sdk/middleware-expect-continue": "^3.972.8", - "@aws-sdk/middleware-flexible-checksums": "^3.973.6", - "@aws-sdk/middleware-host-header": "^3.972.8", - "@aws-sdk/middleware-location-constraint": "^3.972.8", - "@aws-sdk/middleware-logger": "^3.972.8", - "@aws-sdk/middleware-recursion-detection": "^3.972.8", - "@aws-sdk/middleware-sdk-s3": "^3.972.20", - "@aws-sdk/middleware-ssec": "^3.972.8", - "@aws-sdk/middleware-user-agent": "^3.972.21", - "@aws-sdk/region-config-resolver": "^3.972.8", - "@aws-sdk/signature-v4-multi-region": "^3.996.8", - "@aws-sdk/types": "^3.973.6", - "@aws-sdk/util-endpoints": "^3.996.5", - "@aws-sdk/util-user-agent-browser": "^3.972.8", - "@aws-sdk/util-user-agent-node": "^3.973.7", - "@smithy/config-resolver": "^4.4.11", - "@smithy/core": "^3.23.11", - "@smithy/eventstream-serde-browser": "^4.2.12", - "@smithy/eventstream-serde-config-resolver": "^4.3.12", - "@smithy/eventstream-serde-node": "^4.2.12", - "@smithy/fetch-http-handler": "^5.3.15", - "@smithy/hash-blob-browser": "^4.2.13", - "@smithy/hash-node": "^4.2.12", - "@smithy/hash-stream-node": "^4.2.12", - "@smithy/invalid-dependency": "^4.2.12", - "@smithy/md5-js": "^4.2.12", - "@smithy/middleware-content-length": "^4.2.12", - "@smithy/middleware-endpoint": "^4.4.25", - "@smithy/middleware-retry": "^4.4.42", - "@smithy/middleware-serde": "^4.2.14", - "@smithy/middleware-stack": "^4.2.12", - "@smithy/node-config-provider": "^4.3.12", - "@smithy/node-http-handler": "^4.4.16", - "@smithy/protocol-http": "^5.3.12", - "@smithy/smithy-client": "^4.12.5", - "@smithy/types": "^4.13.1", - "@smithy/url-parser": "^4.2.12", - "@smithy/util-base64": "^4.3.2", - "@smithy/util-body-length-browser": "^4.2.2", - "@smithy/util-body-length-node": "^4.2.3", - "@smithy/util-defaults-mode-browser": "^4.3.41", - "@smithy/util-defaults-mode-node": "^4.2.44", - "@smithy/util-endpoints": "^3.3.3", - "@smithy/util-middleware": "^4.2.12", - "@smithy/util-retry": "^4.2.12", - "@smithy/util-stream": "^4.5.19", - "@smithy/util-utf8": "^4.2.2", - "@smithy/util-waiter": "^4.2.13", + "@aws-sdk/checksums": "^3.1001.2", + "@aws-sdk/core": "^3.978.2", + "@aws-sdk/credential-provider-node": "^3.972.85", + "@aws-sdk/middleware-sdk-s3": "^3.972.78", + "@aws-sdk/signature-v4-multi-region": "^3.996.48", + "@aws-sdk/types": "^3.974.6", + "@smithy/core": "^3.35.2", + "@smithy/fetch-http-handler": "^5.8.0", + "@smithy/node-http-handler": "^4.12.1", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { @@ -319,36 +89,18 @@ } }, "node_modules/@aws-sdk/core": { - "version": "3.973.20", - "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.973.20.tgz", - "integrity": "sha512-i3GuX+lowD892F3IuJf8o6AbyDupMTdyTxQrCJGcn71ni5hTZ82L4nQhcdumxZ7XPJRJJVHS/CR3uYOIIs0PVA==", + "version": "3.978.2", + "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.978.2.tgz", + "integrity": "sha512-ViOBLuGSSyPAmkKGJ6KJXtVN7MOEp3rnI7uH+kWxnHccvo8C9cvunEAnN5/oaZH1laQfsTBw7IOnmNkWlFZl2A==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/types": "^3.973.6", - "@aws-sdk/xml-builder": "^3.972.11", - "@smithy/core": "^3.23.11", - "@smithy/node-config-provider": "^4.3.12", - "@smithy/property-provider": "^4.2.12", - "@smithy/protocol-http": "^5.3.12", - "@smithy/signature-v4": "^5.3.12", - "@smithy/smithy-client": "^4.12.5", - "@smithy/types": "^4.13.1", - "@smithy/util-base64": "^4.3.2", - "@smithy/util-middleware": "^4.2.12", - "@smithy/util-utf8": "^4.2.2", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/crc64-nvme": { - "version": "3.972.5", - "resolved": "https://registry.npmjs.org/@aws-sdk/crc64-nvme/-/crc64-nvme-3.972.5.tgz", - "integrity": "sha512-2VbTstbjKdT+yKi8m7b3a9CiVac+pL/IY2PHJwsaGkkHmuuqkJZIErPck1h6P3T9ghQMLSdMPyW6Qp7Di5swFg==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/types": "^4.13.1", + "@aws-sdk/types": "^3.974.6", + "@aws-sdk/xml-builder": "^3.972.41", + "@aws/lambda-invoke-store": "^0.3.0", + "@smithy/core": "^3.35.2", + "@smithy/signature-v4": "^5.7.4", + "@smithy/types": "^4.19.0", + "bowser": "^2.11.0", "tslib": "^2.6.2" }, "engines": { @@ -356,15 +108,15 @@ } }, "node_modules/@aws-sdk/credential-provider-env": { - "version": "3.972.18", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.18.tgz", - "integrity": "sha512-X0B8AlQY507i5DwjLByeU2Af4ARsl9Vr84koDcXCbAkplmU+1xBFWxEPrWRAoh56waBne/yJqEloSwvRf4x6XA==", + "version": "3.972.73", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.73.tgz", + "integrity": "sha512-PxlFZiF5IPUsPnuVSqjM9jlmRwZhL0xx40ccWfZiLQS8TRnHQpegpK1uAidatWuEqbJtbbY97A2Sezikz2AMUw==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.973.20", - "@aws-sdk/types": "^3.973.6", - "@smithy/property-provider": "^4.2.12", - "@smithy/types": "^4.13.1", + "@aws-sdk/core": "^3.978.2", + "@aws-sdk/types": "^3.974.6", + "@smithy/core": "^3.35.2", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { @@ -372,20 +124,17 @@ } }, "node_modules/@aws-sdk/credential-provider-http": { - "version": "3.972.20", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.20.tgz", - "integrity": "sha512-ey9Lelj001+oOfrbKmS6R2CJAiXX7QKY4Vj9VJv6L2eE6/VjD8DocHIoYqztTm70xDLR4E1jYPTKfIui+eRNDA==", + "version": "3.972.75", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.75.tgz", + "integrity": "sha512-Q/uIDy8eAVN7JgSKDg16F/f+hmNJj/ZyLJN8AkW2ofVdDgJVh8fO/A26iZ7YsvM2/k76hsf/u2lLAtyXsK8Ziw==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.973.20", - "@aws-sdk/types": "^3.973.6", - "@smithy/fetch-http-handler": "^5.3.15", - "@smithy/node-http-handler": "^4.4.16", - "@smithy/property-provider": "^4.2.12", - "@smithy/protocol-http": "^5.3.12", - "@smithy/smithy-client": "^4.12.5", - "@smithy/types": "^4.13.1", - "@smithy/util-stream": "^4.5.19", + "@aws-sdk/core": "^3.978.2", + "@aws-sdk/types": "^3.974.6", + "@smithy/core": "^3.35.2", + "@smithy/fetch-http-handler": "^5.8.0", + "@smithy/node-http-handler": "^4.12.1", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { @@ -393,24 +142,23 @@ } }, "node_modules/@aws-sdk/credential-provider-ini": { - "version": "3.972.20", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.972.20.tgz", - "integrity": "sha512-5flXSnKHMloObNF+9N0cupKegnH1Z37cdVlpETVgx8/rAhCe+VNlkcZH3HDg2SDn9bI765S+rhNPXGDJJPfbtA==", + "version": "3.973.18", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.973.18.tgz", + "integrity": "sha512-KoyjZ9vdjuxEQ8obAH06xKP8H0WKqGhwUZLMqAOiS7G0xgUAht4X8f0ASLC/vhNLCWGblZOD3VQHWyTROGJHLg==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.973.20", - "@aws-sdk/credential-provider-env": "^3.972.18", - "@aws-sdk/credential-provider-http": "^3.972.20", - "@aws-sdk/credential-provider-login": "^3.972.20", - "@aws-sdk/credential-provider-process": "^3.972.18", - "@aws-sdk/credential-provider-sso": "^3.972.20", - "@aws-sdk/credential-provider-web-identity": "^3.972.20", - "@aws-sdk/nested-clients": "^3.996.10", - "@aws-sdk/types": "^3.973.6", - "@smithy/credential-provider-imds": "^4.2.12", - "@smithy/property-provider": "^4.2.12", - "@smithy/shared-ini-file-loader": "^4.4.7", - "@smithy/types": "^4.13.1", + "@aws-sdk/core": "^3.978.2", + "@aws-sdk/credential-provider-env": "^3.972.73", + "@aws-sdk/credential-provider-http": "^3.972.75", + "@aws-sdk/credential-provider-login": "^3.972.80", + "@aws-sdk/credential-provider-process": "^3.972.73", + "@aws-sdk/credential-provider-sso": "^3.973.17", + "@aws-sdk/credential-provider-web-identity": "^3.972.79", + "@aws-sdk/nested-clients": "^3.997.47", + "@aws-sdk/types": "^3.974.6", + "@smithy/core": "^3.35.2", + "@smithy/credential-provider-imds": "^4.5.2", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { @@ -418,18 +166,16 @@ } }, "node_modules/@aws-sdk/credential-provider-login": { - "version": "3.972.20", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.20.tgz", - "integrity": "sha512-gEWo54nfqp2jABMu6HNsjVC4hDLpg9HC8IKSJnp0kqWtxIJYHTmiLSsIfI4ScQjxEwpB+jOOH8dOLax1+hy/Hw==", + "version": "3.972.80", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.80.tgz", + "integrity": "sha512-xF9A0gaO7k+1dYPFoo69OQatA9Ov0QuDZfqE8H0FLyIoOph+mlEC+I1Qo9UULupGuDfSYh+kVpfcDSxSYf/2fg==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.973.20", - "@aws-sdk/nested-clients": "^3.996.10", - "@aws-sdk/types": "^3.973.6", - "@smithy/property-provider": "^4.2.12", - "@smithy/protocol-http": "^5.3.12", - "@smithy/shared-ini-file-loader": "^4.4.7", - "@smithy/types": "^4.13.1", + "@aws-sdk/core": "^3.978.2", + "@aws-sdk/nested-clients": "^3.997.47", + "@aws-sdk/types": "^3.974.6", + "@smithy/core": "^3.35.2", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { @@ -437,22 +183,21 @@ } }, "node_modules/@aws-sdk/credential-provider-node": { - "version": "3.972.21", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.21.tgz", - "integrity": "sha512-hah8if3/B/Q+LBYN5FukyQ1Mym6PLPDsBOBsIgNEYD6wLyZg0UmUF/OKIVC3nX9XH8TfTPuITK+7N/jenVACWA==", + "version": "3.972.85", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.85.tgz", + "integrity": "sha512-CrFcML/xImiSlquH4W3V6Npz3aSkPXHDVciAU1JOBN0vqjmkcz9H9up2sCHQqN76J/WrT+TJ580L8h2joksQrg==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/credential-provider-env": "^3.972.18", - "@aws-sdk/credential-provider-http": "^3.972.20", - "@aws-sdk/credential-provider-ini": "^3.972.20", - "@aws-sdk/credential-provider-process": "^3.972.18", - "@aws-sdk/credential-provider-sso": "^3.972.20", - "@aws-sdk/credential-provider-web-identity": "^3.972.20", - "@aws-sdk/types": "^3.973.6", - "@smithy/credential-provider-imds": "^4.2.12", - "@smithy/property-provider": "^4.2.12", - "@smithy/shared-ini-file-loader": "^4.4.7", - "@smithy/types": "^4.13.1", + "@aws-sdk/credential-provider-env": "^3.972.73", + "@aws-sdk/credential-provider-http": "^3.972.75", + "@aws-sdk/credential-provider-ini": "^3.973.18", + "@aws-sdk/credential-provider-process": "^3.972.73", + "@aws-sdk/credential-provider-sso": "^3.973.17", + "@aws-sdk/credential-provider-web-identity": "^3.972.79", + "@aws-sdk/types": "^3.974.6", + "@smithy/core": "^3.35.2", + "@smithy/credential-provider-imds": "^4.5.2", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { @@ -460,16 +205,15 @@ } }, "node_modules/@aws-sdk/credential-provider-process": { - "version": "3.972.18", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.18.tgz", - "integrity": "sha512-Tpl7SRaPoOLT32jbTWchPsn52hYYgJ0kpiFgnwk8pxTANQdUymVSZkzFvv1+oOgZm1CrbQUP9MBeoMZ9IzLZjA==", + "version": "3.972.73", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.73.tgz", + "integrity": "sha512-tyNnT4aVuOEXmKKKZPExBi828vRd9heshobBsKF0bov5EORHSJc1AGsHOMRP57sDt+dIuVASUOywaixiX26t4g==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.973.20", - "@aws-sdk/types": "^3.973.6", - "@smithy/property-provider": "^4.2.12", - "@smithy/shared-ini-file-loader": "^4.4.7", - "@smithy/types": "^4.13.1", + "@aws-sdk/core": "^3.978.2", + "@aws-sdk/types": "^3.974.6", + "@smithy/core": "^3.35.2", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { @@ -477,18 +221,17 @@ } }, "node_modules/@aws-sdk/credential-provider-sso": { - "version": "3.972.20", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.972.20.tgz", - "integrity": "sha512-p+R+PYR5Z7Gjqf/6pvbCnzEHcqPCpLzR7Yf127HjJ6EAb4hUcD+qsNRnuww1sB/RmSeCLxyay8FMyqREw4p1RA==", + "version": "3.973.17", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.973.17.tgz", + "integrity": "sha512-gxKTWaUk2gSbBOH4m3NPRfEKcGXeDAOgHr7nNG5JktR1xZLo0R+DpMjbcleoHbB0uJREOG7hjIRE635IuBWsRQ==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.973.20", - "@aws-sdk/nested-clients": "^3.996.10", - "@aws-sdk/token-providers": "3.1009.0", - "@aws-sdk/types": "^3.973.6", - "@smithy/property-provider": "^4.2.12", - "@smithy/shared-ini-file-loader": "^4.4.7", - "@smithy/types": "^4.13.1", + "@aws-sdk/core": "^3.978.2", + "@aws-sdk/nested-clients": "^3.997.47", + "@aws-sdk/token-providers": "3.1149.0", + "@aws-sdk/types": "^3.974.6", + "@smithy/core": "^3.35.2", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { @@ -496,134 +239,16 @@ } }, "node_modules/@aws-sdk/credential-provider-web-identity": { - "version": "3.972.20", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.20.tgz", - "integrity": "sha512-rWCmh8o7QY4CsUj63qopzMzkDq/yPpkrpb+CnjBEFSOg/02T/we7sSTVg4QsDiVS9uwZ8VyONhq98qt+pIh3KA==", - "license": "Apache-2.0", - "dependencies": { - "@aws-sdk/core": "^3.973.20", - "@aws-sdk/nested-clients": "^3.996.10", - "@aws-sdk/types": "^3.973.6", - "@smithy/property-provider": "^4.2.12", - "@smithy/shared-ini-file-loader": "^4.4.7", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/middleware-bucket-endpoint": { - "version": "3.972.8", - "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-bucket-endpoint/-/middleware-bucket-endpoint-3.972.8.tgz", - "integrity": "sha512-WR525Rr2QJSETa9a050isktyWi/4yIGcmY3BQ1kpHqb0LqUglQHCS8R27dTJxxWNZvQ0RVGtEZjTCbZJpyF3Aw==", - "license": "Apache-2.0", - "dependencies": { - "@aws-sdk/types": "^3.973.6", - "@aws-sdk/util-arn-parser": "^3.972.3", - "@smithy/node-config-provider": "^4.3.12", - "@smithy/protocol-http": "^5.3.12", - "@smithy/types": "^4.13.1", - "@smithy/util-config-provider": "^4.2.2", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/middleware-expect-continue": { - "version": "3.972.8", - "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-expect-continue/-/middleware-expect-continue-3.972.8.tgz", - "integrity": "sha512-5DTBTiotEES1e2jOHAq//zyzCjeMB78lEHd35u15qnrid4Nxm7diqIf9fQQ3Ov0ChH1V3Vvt13thOnrACmfGVQ==", - "license": "Apache-2.0", - "dependencies": { - "@aws-sdk/types": "^3.973.6", - "@smithy/protocol-http": "^5.3.12", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/middleware-flexible-checksums": { - "version": "3.973.6", - "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-flexible-checksums/-/middleware-flexible-checksums-3.973.6.tgz", - "integrity": "sha512-0nYEgkJH7Yt9k+nZJyllTghnkKaz17TWFcr5Mi0XMVMzYlF4ytDZADQpF2/iJo36cKL5AYSzRsvlykE4M/ErTA==", - "license": "Apache-2.0", - "dependencies": { - "@aws-crypto/crc32": "5.2.0", - "@aws-crypto/crc32c": "5.2.0", - "@aws-crypto/util": "5.2.0", - "@aws-sdk/core": "^3.973.20", - "@aws-sdk/crc64-nvme": "^3.972.5", - "@aws-sdk/types": "^3.973.6", - "@smithy/is-array-buffer": "^4.2.2", - "@smithy/node-config-provider": "^4.3.12", - "@smithy/protocol-http": "^5.3.12", - "@smithy/types": "^4.13.1", - "@smithy/util-middleware": "^4.2.12", - "@smithy/util-stream": "^4.5.19", - "@smithy/util-utf8": "^4.2.2", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/middleware-host-header": { - "version": "3.972.8", - "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-host-header/-/middleware-host-header-3.972.8.tgz", - "integrity": "sha512-wAr2REfKsqoKQ+OkNqvOShnBoh+nkPurDKW7uAeVSu6kUECnWlSJiPvnoqxGlfousEY/v9LfS9sNc46hjSYDIQ==", - "license": "Apache-2.0", - "dependencies": { - "@aws-sdk/types": "^3.973.6", - "@smithy/protocol-http": "^5.3.12", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/middleware-location-constraint": { - "version": "3.972.8", - "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-location-constraint/-/middleware-location-constraint-3.972.8.tgz", - "integrity": "sha512-KaUoFuoFPziIa98DSQsTPeke1gvGXlc5ZGMhy+b+nLxZ4A7jmJgLzjEF95l8aOQN2T/qlPP3MrAyELm8ExXucw==", - "license": "Apache-2.0", - "dependencies": { - "@aws-sdk/types": "^3.973.6", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/middleware-logger": { - "version": "3.972.8", - "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-logger/-/middleware-logger-3.972.8.tgz", - "integrity": "sha512-CWl5UCM57WUFaFi5kB7IBY1UmOeLvNZAZ2/OZ5l20ldiJ3TiIz1pC65gYj8X0BCPWkeR1E32mpsCk1L1I4n+lA==", - "license": "Apache-2.0", - "dependencies": { - "@aws-sdk/types": "^3.973.6", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/middleware-recursion-detection": { - "version": "3.972.8", - "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-recursion-detection/-/middleware-recursion-detection-3.972.8.tgz", - "integrity": "sha512-BnnvYs2ZEpdlmZ2PNlV2ZyQ8j8AEkMTjN79y/YA475ER1ByFYrkVR85qmhni8oeTaJcDqbx364wDpitDAA/wCA==", + "version": "3.972.79", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.79.tgz", + "integrity": "sha512-/jn0Gs/qm6fs6nTIA5yncHayybz42SATZ3rNxCEBYPJ9v69PLrDRgk07E9xTT2gpRcNmDXXbi27ZbuU06N0Z6Q==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/types": "^3.973.6", - "@aws/lambda-invoke-store": "^0.2.2", - "@smithy/protocol-http": "^5.3.12", - "@smithy/types": "^4.13.1", + "@aws-sdk/core": "^3.978.2", + "@aws-sdk/nested-clients": "^3.997.47", + "@aws-sdk/types": "^3.974.6", + "@smithy/core": "^3.35.2", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { @@ -631,57 +256,16 @@ } }, "node_modules/@aws-sdk/middleware-sdk-s3": { - "version": "3.972.20", - "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.972.20.tgz", - "integrity": "sha512-yhva/xL5H4tWQgsBjwV+RRD0ByCzg0TcByDCLp3GXdn/wlyRNfy8zsswDtCvr1WSKQkSQYlyEzPuWkJG0f5HvQ==", - "license": "Apache-2.0", - "dependencies": { - "@aws-sdk/core": "^3.973.20", - "@aws-sdk/types": "^3.973.6", - "@aws-sdk/util-arn-parser": "^3.972.3", - "@smithy/core": "^3.23.11", - "@smithy/node-config-provider": "^4.3.12", - "@smithy/protocol-http": "^5.3.12", - "@smithy/signature-v4": "^5.3.12", - "@smithy/smithy-client": "^4.12.5", - "@smithy/types": "^4.13.1", - "@smithy/util-config-provider": "^4.2.2", - "@smithy/util-middleware": "^4.2.12", - "@smithy/util-stream": "^4.5.19", - "@smithy/util-utf8": "^4.2.2", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/middleware-ssec": { - "version": "3.972.8", - "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-ssec/-/middleware-ssec-3.972.8.tgz", - "integrity": "sha512-wqlK0yO/TxEC2UsY9wIlqeeutF6jjLe0f96Pbm40XscTo57nImUk9lBcw0dPgsm0sppFtAkSlDrfpK+pC30Wqw==", - "license": "Apache-2.0", - "dependencies": { - "@aws-sdk/types": "^3.973.6", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/middleware-user-agent": { - "version": "3.972.21", - "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-user-agent/-/middleware-user-agent-3.972.21.tgz", - "integrity": "sha512-62XRl1GDYPpkt7cx1AX1SPy9wgNE9Iw/NPuurJu4lmhCWS7sGKO+kS53TQ8eRmIxy3skmvNInnk0ZbWrU5Dpyg==", + "version": "3.972.78", + "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.972.78.tgz", + "integrity": "sha512-W1kXIqMBkfrpVTbOOUSt63D2mEM4882TLqGWXjkZ1OcJ2ggSEWzgyjlyVDIHu/goGJSREd5s/KQ9wAgVZ0djeQ==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.973.20", - "@aws-sdk/types": "^3.973.6", - "@aws-sdk/util-endpoints": "^3.996.5", - "@smithy/core": "^3.23.11", - "@smithy/protocol-http": "^5.3.12", - "@smithy/types": "^4.13.1", - "@smithy/util-retry": "^4.2.12", + "@aws-sdk/core": "^3.978.2", + "@aws-sdk/signature-v4-multi-region": "^3.996.48", + "@aws-sdk/types": "^3.974.6", + "@smithy/core": "^3.35.2", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { @@ -689,64 +273,18 @@ } }, "node_modules/@aws-sdk/nested-clients": { - "version": "3.996.10", - "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.996.10.tgz", - "integrity": "sha512-SlDol5Z+C7Ivnc2rKGqiqfSUmUZzY1qHfVs9myt/nxVwswgfpjdKahyTzLTx802Zfq0NFRs7AejwKzzzl5Co2w==", - "license": "Apache-2.0", - "dependencies": { - "@aws-crypto/sha256-browser": "5.2.0", - "@aws-crypto/sha256-js": "5.2.0", - "@aws-sdk/core": "^3.973.20", - "@aws-sdk/middleware-host-header": "^3.972.8", - "@aws-sdk/middleware-logger": "^3.972.8", - "@aws-sdk/middleware-recursion-detection": "^3.972.8", - "@aws-sdk/middleware-user-agent": "^3.972.21", - "@aws-sdk/region-config-resolver": "^3.972.8", - "@aws-sdk/types": "^3.973.6", - "@aws-sdk/util-endpoints": "^3.996.5", - "@aws-sdk/util-user-agent-browser": "^3.972.8", - "@aws-sdk/util-user-agent-node": "^3.973.7", - "@smithy/config-resolver": "^4.4.11", - "@smithy/core": "^3.23.11", - "@smithy/fetch-http-handler": "^5.3.15", - "@smithy/hash-node": "^4.2.12", - "@smithy/invalid-dependency": "^4.2.12", - "@smithy/middleware-content-length": "^4.2.12", - "@smithy/middleware-endpoint": "^4.4.25", - "@smithy/middleware-retry": "^4.4.42", - "@smithy/middleware-serde": "^4.2.14", - "@smithy/middleware-stack": "^4.2.12", - "@smithy/node-config-provider": "^4.3.12", - "@smithy/node-http-handler": "^4.4.16", - "@smithy/protocol-http": "^5.3.12", - "@smithy/smithy-client": "^4.12.5", - "@smithy/types": "^4.13.1", - "@smithy/url-parser": "^4.2.12", - "@smithy/util-base64": "^4.3.2", - "@smithy/util-body-length-browser": "^4.2.2", - "@smithy/util-body-length-node": "^4.2.3", - "@smithy/util-defaults-mode-browser": "^4.3.41", - "@smithy/util-defaults-mode-node": "^4.2.44", - "@smithy/util-endpoints": "^3.3.3", - "@smithy/util-middleware": "^4.2.12", - "@smithy/util-retry": "^4.2.12", - "@smithy/util-utf8": "^4.2.2", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/region-config-resolver": { - "version": "3.972.8", - "resolved": "https://registry.npmjs.org/@aws-sdk/region-config-resolver/-/region-config-resolver-3.972.8.tgz", - "integrity": "sha512-1eD4uhTDeambO/PNIDVG19A6+v4NdD7xzwLHDutHsUqz0B+i661MwQB2eYO4/crcCvCiQG4SRm1k81k54FEIvw==", + "version": "3.997.47", + "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.997.47.tgz", + "integrity": "sha512-bovCKvDsLocNTzaj6VrrMVJ2BGROqO0JlwcGseO67a+I9Bo+08nUJhSQfZUIx4+A4a7I4101GEJd/AYm7dQ68w==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/types": "^3.973.6", - "@smithy/config-resolver": "^4.4.11", - "@smithy/node-config-provider": "^4.3.12", - "@smithy/types": "^4.13.1", + "@aws-sdk/core": "^3.978.2", + "@aws-sdk/signature-v4-multi-region": "^3.996.48", + "@aws-sdk/types": "^3.974.6", + "@smithy/core": "^3.35.2", + "@smithy/fetch-http-handler": "^5.8.0", + "@smithy/node-http-handler": "^4.12.1", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { @@ -754,16 +292,14 @@ } }, "node_modules/@aws-sdk/signature-v4-multi-region": { - "version": "3.996.8", - "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.8.tgz", - "integrity": "sha512-n1qYFD+tbqZuyskVaxUE+t10AUz9g3qzDw3Tp6QZDKmqsjfDmZBd4GIk2EKJJNtcCBtE5YiUjDYA+3djFAFBBg==", + "version": "3.996.48", + "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.48.tgz", + "integrity": "sha512-cFDXfEbXaGwbnpvR/DyqfxfjxpjXVRVthQLgkwvcfDS5u3+8G9WSj1X1Ag/pTRg/QOeOno1Tq3ycEdrKsCUcOA==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/middleware-sdk-s3": "^3.972.20", - "@aws-sdk/types": "^3.973.6", - "@smithy/protocol-http": "^5.3.12", - "@smithy/signature-v4": "^5.3.12", - "@smithy/types": "^4.13.1", + "@aws-sdk/types": "^3.974.6", + "@smithy/signature-v4": "^5.7.4", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { @@ -771,17 +307,16 @@ } }, "node_modules/@aws-sdk/token-providers": { - "version": "3.1009.0", - "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1009.0.tgz", - "integrity": "sha512-KCPLuTqN9u0Rr38Arln78fRG9KXpzsPWmof+PZzfAHMMQq2QED6YjQrkrfiH7PDefLWEposY1o4/eGwrmKA4JA==", + "version": "3.1149.0", + "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1149.0.tgz", + "integrity": "sha512-CAwYyA8eVk1w6h8YgLvkjIOakWPwURaUFrP7BRVgkxTFUM+O87thyKsGKJ6rVPbP8eoEV10cBWQ5YfaYl3qSVQ==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.973.20", - "@aws-sdk/nested-clients": "^3.996.10", - "@aws-sdk/types": "^3.973.6", - "@smithy/property-provider": "^4.2.12", - "@smithy/shared-ini-file-loader": "^4.4.7", - "@smithy/types": "^4.13.1", + "@aws-sdk/core": "^3.978.2", + "@aws-sdk/nested-clients": "^3.997.47", + "@aws-sdk/types": "^3.974.6", + "@smithy/core": "^3.35.2", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { @@ -789,103 +324,25 @@ } }, "node_modules/@aws-sdk/types": { - "version": "3.973.6", - "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.973.6.tgz", - "integrity": "sha512-Atfcy4E++beKtwJHiDln2Nby8W/mam64opFPTiHEqgsthqeydFS1pY+OUlN1ouNOmf8ArPU/6cDS65anOP3KQw==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/util-arn-parser": { - "version": "3.972.3", - "resolved": "https://registry.npmjs.org/@aws-sdk/util-arn-parser/-/util-arn-parser-3.972.3.tgz", - "integrity": "sha512-HzSD8PMFrvgi2Kserxuff5VitNq2sgf3w9qxmskKDiDTThWfVteJxuCS9JXiPIPtmCrp+7N9asfIaVhBFORllA==", - "license": "Apache-2.0", - "dependencies": { - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/util-endpoints": { - "version": "3.996.5", - "resolved": "https://registry.npmjs.org/@aws-sdk/util-endpoints/-/util-endpoints-3.996.5.tgz", - "integrity": "sha512-Uh93L5sXFNbyR5sEPMzUU8tJ++Ku97EY4udmC01nB8Zu+xfBPwpIwJ6F7snqQeq8h2pf+8SGN5/NoytfKgYPIw==", - "license": "Apache-2.0", - "dependencies": { - "@aws-sdk/types": "^3.973.6", - "@smithy/types": "^4.13.1", - "@smithy/url-parser": "^4.2.12", - "@smithy/util-endpoints": "^3.3.3", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/util-locate-window": { - "version": "3.965.5", - "resolved": "https://registry.npmjs.org/@aws-sdk/util-locate-window/-/util-locate-window-3.965.5.tgz", - "integrity": "sha512-WhlJNNINQB+9qtLtZJcpQdgZw3SCDCpXdUJP7cToGwHbCWCnRckGlc6Bx/OhWwIYFNAn+FIydY8SZ0QmVu3xTQ==", - "license": "Apache-2.0", - "dependencies": { - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@aws-sdk/util-user-agent-browser": { - "version": "3.972.8", - "resolved": "https://registry.npmjs.org/@aws-sdk/util-user-agent-browser/-/util-user-agent-browser-3.972.8.tgz", - "integrity": "sha512-B3KGXJviV2u6Cdw2SDY2aDhoJkVfY/Q/Trwk2CMSkikE1Oi6gRzxhvhIfiRpHfmIsAhV4EA54TVEX8K6CbHbkA==", - "license": "Apache-2.0", - "dependencies": { - "@aws-sdk/types": "^3.973.6", - "@smithy/types": "^4.13.1", - "bowser": "^2.11.0", - "tslib": "^2.6.2" - } - }, - "node_modules/@aws-sdk/util-user-agent-node": { - "version": "3.973.7", - "resolved": "https://registry.npmjs.org/@aws-sdk/util-user-agent-node/-/util-user-agent-node-3.973.7.tgz", - "integrity": "sha512-Hz6EZMUAEzqUd7e+vZ9LE7mn+5gMbxltXy18v+YSFY+9LBJz15wkNZvw5JqfX3z0FS9n3bgUtz3L5rAsfh4YlA==", + "version": "3.974.6", + "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.974.6.tgz", + "integrity": "sha512-v/clNZzZnDxGyvpHMOGpJKVXFAExJzUNAAjaWGdcx8QAcXLGwTaOkw33p5SHAi0YAioK32xB3hWwOekRVfmfKg==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/middleware-user-agent": "^3.972.21", - "@aws-sdk/types": "^3.973.6", - "@smithy/node-config-provider": "^4.3.12", - "@smithy/types": "^4.13.1", - "@smithy/util-config-provider": "^4.2.2", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { "node": ">=20.0.0" - }, - "peerDependencies": { - "aws-crt": ">=1.0.0" - }, - "peerDependenciesMeta": { - "aws-crt": { - "optional": true - } } }, "node_modules/@aws-sdk/xml-builder": { - "version": "3.972.11", - "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.11.tgz", - "integrity": "sha512-iitV/gZKQMvY9d7ovmyFnFuTHbBAtrmLnvaSb/3X8vOKyevwtpmEtyc8AdhVWZe0pI/1GsHxlEvQeOePFzy7KQ==", + "version": "3.972.41", + "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.41.tgz", + "integrity": "sha512-ctjVSyCMegrWfXlx6VqzSBFI6UqmQ5ZlnfMhdLIiWmhoH8UAQxSCP5N3OpG7X3k4LnS7ou74C4mt20+bfTW2aQ==", "license": "Apache-2.0", "dependencies": { - "@smithy/types": "^4.13.1", - "fast-xml-parser": "5.4.1", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { @@ -893,9 +350,9 @@ } }, "node_modules/@aws/lambda-invoke-store": { - "version": "0.2.4", - "resolved": "https://registry.npmjs.org/@aws/lambda-invoke-store/-/lambda-invoke-store-0.2.4.tgz", - "integrity": "sha512-iY8yvjE0y651BixKNPgmv1WrQc+GZ142sb0z4gYnChDDY2YqI4P/jsSopBWrKfAt7LOJAkOXt7rC/hms+WclQQ==", + "version": "0.3.0", + "resolved": "https://registry.npmjs.org/@aws/lambda-invoke-store/-/lambda-invoke-store-0.3.0.tgz", + "integrity": "sha512-sl4Bm6yiMNYrZKkqqDFWN0UfnWhlS8ivKxrYl+6t0gCLrqr8y3B2IqZZbFRkfaVVp7C/baApyh71P+LeE1A2sQ==", "license": "Apache-2.0", "engines": { "node": ">=18.0.0" @@ -932,935 +389,343 @@ "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==", "license": "MIT", "engines": { - "node": ">= 8" - } - }, - "node_modules/@nodelib/fs.walk": { - "version": "1.2.8", - "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz", - "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==", - "license": "MIT", - "dependencies": { - "@nodelib/fs.scandir": "2.1.5", - "fastq": "^1.6.0" - }, - "engines": { - "node": ">= 8" - } - }, - "node_modules/@octokit/auth-token": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz", - "integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==", - "license": "MIT", - "engines": { - "node": ">= 20" - } - }, - "node_modules/@octokit/core": { - "version": "7.0.6", - "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz", - "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==", - "license": "MIT", - "dependencies": { - "@octokit/auth-token": "^6.0.0", - "@octokit/graphql": "^9.0.3", - "@octokit/request": "^10.0.6", - "@octokit/request-error": "^7.0.2", - "@octokit/types": "^16.0.0", - "before-after-hook": "^4.0.0", - "universal-user-agent": "^7.0.0" - }, - "engines": { - "node": ">= 20" - } - }, - "node_modules/@octokit/endpoint": { - "version": "11.0.3", - "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.3.tgz", - "integrity": "sha512-FWFlNxghg4HrXkD3ifYbS/IdL/mDHjh9QcsNyhQjN8dplUoZbejsdpmuqdA76nxj2xoWPs7p8uX2SNr9rYu0Ag==", - "license": "MIT", - "dependencies": { - "@octokit/types": "^16.0.0", - "universal-user-agent": "^7.0.2" - }, - "engines": { - "node": ">= 20" - } - }, - "node_modules/@octokit/graphql": { - "version": "9.0.3", - "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz", - "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==", - "license": "MIT", - "dependencies": { - "@octokit/request": "^10.0.6", - "@octokit/types": "^16.0.0", - "universal-user-agent": "^7.0.0" - }, - "engines": { - "node": ">= 20" - } - }, - "node_modules/@octokit/openapi-types": { - "version": "27.0.0", - "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz", - "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==", - "license": "MIT" - }, - "node_modules/@octokit/plugin-paginate-rest": { - "version": "14.0.0", - "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz", - "integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==", - "license": "MIT", - "dependencies": { - "@octokit/types": "^16.0.0" - }, - "engines": { - "node": ">= 20" - }, - "peerDependencies": { - "@octokit/core": ">=6" - } - }, - "node_modules/@octokit/plugin-request-log": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-6.0.0.tgz", - "integrity": "sha512-UkOzeEN3W91/eBq9sPZNQ7sUBvYCqYbrrD8gTbBuGtHEuycE4/awMXcYvx6sVYo7LypPhmQwwpUe4Yyu4QZN5Q==", - "license": "MIT", - "engines": { - "node": ">= 20" - }, - "peerDependencies": { - "@octokit/core": ">=6" - } - }, - "node_modules/@octokit/plugin-rest-endpoint-methods": { - "version": "17.0.0", - "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz", - "integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==", - "license": "MIT", - "dependencies": { - "@octokit/types": "^16.0.0" - }, - "engines": { - "node": ">= 20" - }, - "peerDependencies": { - "@octokit/core": ">=6" - } - }, - "node_modules/@octokit/plugin-retry": { - "version": "8.1.0", - "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.1.0.tgz", - "integrity": "sha512-O1FZgXeiGb2sowEr/hYTr6YunGdSAFWnr2fyW39Ah85H8O33ELASQxcvOFF5LE6Tjekcyu2ms4qAzJVhSaJxTw==", - "license": "MIT", - "dependencies": { - "@octokit/request-error": "^7.0.2", - "@octokit/types": "^16.0.0", - "bottleneck": "^2.15.3" - }, - "engines": { - "node": ">= 20" - }, - "peerDependencies": { - "@octokit/core": ">=7" - } - }, - "node_modules/@octokit/plugin-throttling": { - "version": "11.0.3", - "resolved": "https://registry.npmjs.org/@octokit/plugin-throttling/-/plugin-throttling-11.0.3.tgz", - "integrity": "sha512-34eE0RkFCKycLl2D2kq7W+LovheM/ex3AwZCYN8udpi6bxsyjZidb2McXs69hZhLmJlDqTSP8cH+jSRpiaijBg==", - "license": "MIT", - "dependencies": { - "@octokit/types": "^16.0.0", - "bottleneck": "^2.15.3" - }, - "engines": { - "node": ">= 20" - }, - "peerDependencies": { - "@octokit/core": "^7.0.0" - } - }, - "node_modules/@octokit/request": { - "version": "10.0.8", - "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.8.tgz", - "integrity": "sha512-SJZNwY9pur9Agf7l87ywFi14W+Hd9Jg6Ifivsd33+/bGUQIjNujdFiXII2/qSlN2ybqUHfp5xpekMEjIBTjlSw==", - "license": "MIT", - "dependencies": { - "@octokit/endpoint": "^11.0.3", - "@octokit/request-error": "^7.0.2", - "@octokit/types": "^16.0.0", - "fast-content-type-parse": "^3.0.0", - "json-with-bigint": "^3.5.3", - "universal-user-agent": "^7.0.2" - }, - "engines": { - "node": ">= 20" - } - }, - "node_modules/@octokit/request-error": { - "version": "7.1.0", - "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz", - "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==", - "license": "MIT", - "dependencies": { - "@octokit/types": "^16.0.0" - }, - "engines": { - "node": ">= 20" - } - }, - "node_modules/@octokit/rest": { - "version": "22.0.1", - "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-22.0.1.tgz", - "integrity": "sha512-Jzbhzl3CEexhnivb1iQ0KJ7s5vvjMWcmRtq5aUsKmKDrRW6z3r84ngmiFKFvpZjpiU/9/S6ITPFRpn5s/3uQJw==", - "license": "MIT", - "dependencies": { - "@octokit/core": "^7.0.6", - "@octokit/plugin-paginate-rest": "^14.0.0", - "@octokit/plugin-request-log": "^6.0.0", - "@octokit/plugin-rest-endpoint-methods": "^17.0.0" - }, - "engines": { - "node": ">= 20" - } - }, - "node_modules/@octokit/types": { - "version": "16.0.0", - "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz", - "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==", - "license": "MIT", - "dependencies": { - "@octokit/openapi-types": "^27.0.0" - } - }, - "node_modules/@smithy/abort-controller": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/abort-controller/-/abort-controller-4.2.12.tgz", - "integrity": "sha512-xolrFw6b+2iYGl6EcOL7IJY71vvyZ0DJ3mcKtpykqPe2uscwtzDZJa1uVQXyP7w9Dd+kGwYnPbMsJrGISKiY/Q==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/chunked-blob-reader": { - "version": "5.2.2", - "resolved": "https://registry.npmjs.org/@smithy/chunked-blob-reader/-/chunked-blob-reader-5.2.2.tgz", - "integrity": "sha512-St+kVicSyayWQca+I1rGitaOEH6uKgE8IUWoYnnEX26SWdWQcL6LvMSD19Lg+vYHKdT9B2Zuu7rd3i6Wnyb/iw==", - "license": "Apache-2.0", - "dependencies": { - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/chunked-blob-reader-native": { - "version": "4.2.3", - "resolved": "https://registry.npmjs.org/@smithy/chunked-blob-reader-native/-/chunked-blob-reader-native-4.2.3.tgz", - "integrity": "sha512-jA5k5Udn7Y5717L86h4EIv06wIr3xn8GM1qHRi/Nf31annXcXHJjBKvgztnbn2TxH3xWrPBfgwHsOwZf0UmQWw==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/util-base64": "^4.3.2", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/config-resolver": { - "version": "4.4.11", - "resolved": "https://registry.npmjs.org/@smithy/config-resolver/-/config-resolver-4.4.11.tgz", - "integrity": "sha512-YxFiiG4YDAtX7WMN7RuhHZLeTmRRAOyCbr+zB8e3AQzHPnUhS8zXjB1+cniPVQI3xbWsQPM0X2aaIkO/ME0ymw==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/node-config-provider": "^4.3.12", - "@smithy/types": "^4.13.1", - "@smithy/util-config-provider": "^4.2.2", - "@smithy/util-endpoints": "^3.3.3", - "@smithy/util-middleware": "^4.2.12", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/core": { - "version": "3.23.11", - "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.23.11.tgz", - "integrity": "sha512-952rGf7hBRnhUIaeLp6q4MptKW8sPFe5VvkoZ5qIzFAtx6c/QZ/54FS3yootsyUSf9gJX/NBqEBNdNR7jMIlpQ==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/protocol-http": "^5.3.12", - "@smithy/types": "^4.13.1", - "@smithy/url-parser": "^4.2.12", - "@smithy/util-base64": "^4.3.2", - "@smithy/util-body-length-browser": "^4.2.2", - "@smithy/util-middleware": "^4.2.12", - "@smithy/util-stream": "^4.5.19", - "@smithy/util-utf8": "^4.2.2", - "@smithy/uuid": "^1.1.2", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/credential-provider-imds": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.2.12.tgz", - "integrity": "sha512-cr2lR792vNZcYMriSIj+Um3x9KWrjcu98kn234xA6reOAFMmbRpQMOv8KPgEmLLtx3eldU6c5wALKFqNOhugmg==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/node-config-provider": "^4.3.12", - "@smithy/property-provider": "^4.2.12", - "@smithy/types": "^4.13.1", - "@smithy/url-parser": "^4.2.12", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/eventstream-codec": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/eventstream-codec/-/eventstream-codec-4.2.12.tgz", - "integrity": "sha512-FE3bZdEl62ojmy8x4FHqxq2+BuOHlcxiH5vaZ6aqHJr3AIZzwF5jfx8dEiU/X0a8RboyNDjmXjlbr8AdEyLgiA==", - "license": "Apache-2.0", - "dependencies": { - "@aws-crypto/crc32": "5.2.0", - "@smithy/types": "^4.13.1", - "@smithy/util-hex-encoding": "^4.2.2", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/eventstream-serde-browser": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/eventstream-serde-browser/-/eventstream-serde-browser-4.2.12.tgz", - "integrity": "sha512-XUSuMxlTxV5pp4VpqZf6Sa3vT/Q75FVkLSpSSE3KkWBvAQWeuWt1msTv8fJfgA4/jcJhrbrbMzN1AC/hvPmm5A==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/eventstream-serde-universal": "^4.2.12", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/eventstream-serde-config-resolver": { - "version": "4.3.12", - "resolved": "https://registry.npmjs.org/@smithy/eventstream-serde-config-resolver/-/eventstream-serde-config-resolver-4.3.12.tgz", - "integrity": "sha512-7epsAZ3QvfHkngz6RXQYseyZYHlmWXSTPOfPmXkiS+zA6TBNo1awUaMFL9vxyXlGdoELmCZyZe1nQE+imbmV+Q==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/eventstream-serde-node": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/eventstream-serde-node/-/eventstream-serde-node-4.2.12.tgz", - "integrity": "sha512-D1pFuExo31854eAvg89KMn9Oab/wEeJR6Buy32B49A9Ogdtx5fwZPqBHUlDzaCDpycTFk2+fSQgX689Qsk7UGA==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/eventstream-serde-universal": "^4.2.12", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/eventstream-serde-universal": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/eventstream-serde-universal/-/eventstream-serde-universal-4.2.12.tgz", - "integrity": "sha512-+yNuTiyBACxOJUTvbsNsSOfH9G9oKbaJE1lNL3YHpGcuucl6rPZMi3nrpehpVOVR2E07YqFFmtwpImtpzlouHQ==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/eventstream-codec": "^4.2.12", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/fetch-http-handler": { - "version": "5.3.15", - "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.3.15.tgz", - "integrity": "sha512-T4jFU5N/yiIfrtrsb9uOQn7RdELdM/7HbyLNr6uO/mpkj1ctiVs7CihVr51w4LyQlXWDpXFn4BElf1WmQvZu/A==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/protocol-http": "^5.3.12", - "@smithy/querystring-builder": "^4.2.12", - "@smithy/types": "^4.13.1", - "@smithy/util-base64": "^4.3.2", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/hash-blob-browser": { - "version": "4.2.13", - "resolved": "https://registry.npmjs.org/@smithy/hash-blob-browser/-/hash-blob-browser-4.2.13.tgz", - "integrity": "sha512-YrF4zWKh+ghLuquldj6e/RzE3xZYL8wIPfkt0MqCRphVICjyyjH8OwKD7LLlKpVEbk4FLizFfC1+gwK6XQdR3g==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/chunked-blob-reader": "^5.2.2", - "@smithy/chunked-blob-reader-native": "^4.2.3", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/hash-node": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/hash-node/-/hash-node-4.2.12.tgz", - "integrity": "sha512-QhBYbGrbxTkZ43QoTPrK72DoYviDeg6YKDrHTMJbbC+A0sml3kSjzFtXP7BtbyJnXojLfTQldGdUR0RGD8dA3w==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/types": "^4.13.1", - "@smithy/util-buffer-from": "^4.2.2", - "@smithy/util-utf8": "^4.2.2", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/hash-stream-node": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/hash-stream-node/-/hash-stream-node-4.2.12.tgz", - "integrity": "sha512-O3YbmGExeafuM/kP7Y8r6+1y0hIh3/zn6GROx0uNlB54K9oihAL75Qtc+jFfLNliTi6pxOAYZrRKD9A7iA6UFw==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/types": "^4.13.1", - "@smithy/util-utf8": "^4.2.2", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/invalid-dependency": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/invalid-dependency/-/invalid-dependency-4.2.12.tgz", - "integrity": "sha512-/4F1zb7Z8LOu1PalTdESFHR0RbPwHd3FcaG1sI3UEIriQTWakysgJr65lc1jj6QY5ye7aFsisajotH6UhWfm/g==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/is-array-buffer": { - "version": "4.2.2", - "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-4.2.2.tgz", - "integrity": "sha512-n6rQ4N8Jj4YTQO3YFrlgZuwKodf4zUFs7EJIWH86pSCWBaAtAGBFfCM7Wx6D2bBJ2xqFNxGBSrUWswT3M0VJow==", - "license": "Apache-2.0", - "dependencies": { - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/md5-js": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/md5-js/-/md5-js-4.2.12.tgz", - "integrity": "sha512-W/oIpHCpWU2+iAkfZYyGWE+qkpuf3vEXHLxQQDx9FPNZTTdnul0dZ2d/gUFrtQ5je1G2kp4cjG0/24YueG2LbQ==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/types": "^4.13.1", - "@smithy/util-utf8": "^4.2.2", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/middleware-content-length": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/middleware-content-length/-/middleware-content-length-4.2.12.tgz", - "integrity": "sha512-YE58Yz+cvFInWI/wOTrB+DbvUVz/pLn5mC5MvOV4fdRUc6qGwygyngcucRQjAhiCEbmfLOXX0gntSIcgMvAjmA==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/protocol-http": "^5.3.12", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/middleware-endpoint": { - "version": "4.4.25", - "resolved": "https://registry.npmjs.org/@smithy/middleware-endpoint/-/middleware-endpoint-4.4.25.tgz", - "integrity": "sha512-dqjLwZs2eBxIUG6Qtw8/YZ4DvzHGIf0DA18wrgtfP6a50UIO7e2nY0FPdcbv5tVJKqWCCU5BmGMOUwT7Puan+A==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/core": "^3.23.11", - "@smithy/middleware-serde": "^4.2.14", - "@smithy/node-config-provider": "^4.3.12", - "@smithy/shared-ini-file-loader": "^4.4.7", - "@smithy/types": "^4.13.1", - "@smithy/url-parser": "^4.2.12", - "@smithy/util-middleware": "^4.2.12", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/middleware-retry": { - "version": "4.4.42", - "resolved": "https://registry.npmjs.org/@smithy/middleware-retry/-/middleware-retry-4.4.42.tgz", - "integrity": "sha512-vbwyqHRIpIZutNXZpLAozakzamcINaRCpEy1MYmK6xBeW3xN+TyPRA123GjXnuxZIjc9848MRRCugVMTXxC4Eg==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/node-config-provider": "^4.3.12", - "@smithy/protocol-http": "^5.3.12", - "@smithy/service-error-classification": "^4.2.12", - "@smithy/smithy-client": "^4.12.5", - "@smithy/types": "^4.13.1", - "@smithy/util-middleware": "^4.2.12", - "@smithy/util-retry": "^4.2.12", - "@smithy/uuid": "^1.1.2", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/middleware-serde": { - "version": "4.2.14", - "resolved": "https://registry.npmjs.org/@smithy/middleware-serde/-/middleware-serde-4.2.14.tgz", - "integrity": "sha512-+CcaLoLa5apzSRtloOyG7lQvkUw2ZDml3hRh4QiG9WyEPfW5Ke/3tPOPiPjUneuT59Tpn8+c3RVaUvvkkwqZwg==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/core": "^3.23.11", - "@smithy/protocol-http": "^5.3.12", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/middleware-stack": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/middleware-stack/-/middleware-stack-4.2.12.tgz", - "integrity": "sha512-kruC5gRHwsCOuyCd4ouQxYjgRAym2uDlCvQ5acuMtRrcdfg7mFBg6blaxcJ09STpt3ziEkis6bhg1uwrWU7txw==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/node-config-provider": { - "version": "4.3.12", - "resolved": "https://registry.npmjs.org/@smithy/node-config-provider/-/node-config-provider-4.3.12.tgz", - "integrity": "sha512-tr2oKX2xMcO+rBOjobSwVAkV05SIfUKz8iI53rzxEmgW3GOOPOv0UioSDk+J8OpRQnpnhsO3Af6IEBabQBVmiw==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/property-provider": "^4.2.12", - "@smithy/shared-ini-file-loader": "^4.4.7", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/node-http-handler": { - "version": "4.4.16", - "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.4.16.tgz", - "integrity": "sha512-ULC8UCS/HivdCB3jhi+kLFYe4B5gxH2gi9vHBfEIiRrT2jfKiZNiETJSlzRtE6B26XbBHjPtc8iZKSNqMol9bw==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/abort-controller": "^4.2.12", - "@smithy/protocol-http": "^5.3.12", - "@smithy/querystring-builder": "^4.2.12", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/property-provider": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/property-provider/-/property-provider-4.2.12.tgz", - "integrity": "sha512-jqve46eYU1v7pZ5BM+fmkbq3DerkSluPr5EhvOcHxygxzD05ByDRppRwRPPpFrsFo5yDtCYLKu+kreHKVrvc7A==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" - } - }, - "node_modules/@smithy/protocol-http": { - "version": "5.3.12", - "resolved": "https://registry.npmjs.org/@smithy/protocol-http/-/protocol-http-5.3.12.tgz", - "integrity": "sha512-fit0GZK9I1xoRlR4jXmbLhoN0OdEpa96ul8M65XdmXnxXkuMxM0Y8HDT0Fh0Xb4I85MBvBClOzgSrV1X2s1Hxw==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" + "node": ">= 8" } }, - "node_modules/@smithy/querystring-builder": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/querystring-builder/-/querystring-builder-4.2.12.tgz", - "integrity": "sha512-6wTZjGABQufekycfDGMEB84BgtdOE/rCVTov+EDXQ8NHKTUNIp/j27IliwP7tjIU9LR+sSzyGBOXjeEtVgzCHg==", - "license": "Apache-2.0", + "node_modules/@nodelib/fs.walk": { + "version": "1.2.8", + "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz", + "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==", + "license": "MIT", "dependencies": { - "@smithy/types": "^4.13.1", - "@smithy/util-uri-escape": "^4.2.2", - "tslib": "^2.6.2" + "@nodelib/fs.scandir": "2.1.5", + "fastq": "^1.6.0" }, "engines": { - "node": ">=18.0.0" + "node": ">= 8" } }, - "node_modules/@smithy/querystring-parser": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/querystring-parser/-/querystring-parser-4.2.12.tgz", - "integrity": "sha512-P2OdvrgiAKpkPNKlKUtWbNZKB1XjPxM086NeVhK+W+wI46pIKdWBe5QyXvhUm3MEcyS/rkLvY8rZzyUdmyDZBw==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, + "node_modules/@octokit/auth-token": { + "version": "6.0.0", + "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz", + "integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==", + "license": "MIT", "engines": { - "node": ">=18.0.0" + "node": ">= 20" } }, - "node_modules/@smithy/service-error-classification": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/service-error-classification/-/service-error-classification-4.2.12.tgz", - "integrity": "sha512-LlP29oSQN0Tw0b6D0Xo6BIikBswuIiGYbRACy5ujw/JgWSzTdYj46U83ssf6Ux0GyNJVivs2uReU8pt7Eu9okQ==", - "license": "Apache-2.0", + "node_modules/@octokit/core": { + "version": "7.0.8", + "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.8.tgz", + "integrity": "sha512-L7y8eYc+AwxGr2PWI4WFt1VG4TiJ66c26BD16mXpYIlXxG0SMigM1+m4aTSlYyBr5BlQsGAlz8uDCoZN4SEMcg==", + "license": "MIT", "dependencies": { - "@smithy/types": "^4.13.1" + "@octokit/auth-token": "^6.0.0", + "@octokit/graphql": "^9.0.5", + "@octokit/request": "^10.0.16", + "@octokit/request-error": "^7.1.2", + "@octokit/types": "^18.0.0", + "before-after-hook": "^4.0.0", + "universal-user-agent": "^7.0.0" }, "engines": { - "node": ">=18.0.0" + "node": ">= 20" } }, - "node_modules/@smithy/shared-ini-file-loader": { - "version": "4.4.7", - "resolved": "https://registry.npmjs.org/@smithy/shared-ini-file-loader/-/shared-ini-file-loader-4.4.7.tgz", - "integrity": "sha512-HrOKWsUb+otTeo1HxVWeEb99t5ER1XrBi/xka2Wv6NVmTbuCUC1dvlrksdvxFtODLBjsC+PHK+fuy2x/7Ynyiw==", - "license": "Apache-2.0", + "node_modules/@octokit/endpoint": { + "version": "11.0.5", + "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.5.tgz", + "integrity": "sha512-iXa654H3yFafF/ieHkukfbgWo2rmXD2ceD0ZOtrPhw1bc3FDch1d9N/TNs0FQ1/cIbwb7kspUX8jzIs8nzb9DQ==", + "license": "MIT", "dependencies": { - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" + "@octokit/types": "^18.0.0", + "universal-user-agent": "^7.0.2" }, "engines": { - "node": ">=18.0.0" + "node": ">= 20" } }, - "node_modules/@smithy/signature-v4": { - "version": "5.3.12", - "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.3.12.tgz", - "integrity": "sha512-B/FBwO3MVOL00DaRSXfXfa/TRXRheagt/q5A2NM13u7q+sHS59EOVGQNfG7DkmVtdQm5m3vOosoKAXSqn/OEgw==", - "license": "Apache-2.0", + "node_modules/@octokit/graphql": { + "version": "9.0.5", + "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.5.tgz", + "integrity": "sha512-bt/hm03LeU6Vy7FwTrkkC9p3XGT/lBwClglMqxBSe5/q0E5CdJTXeAqEI0vlw89/LF/G6tryTIH8HirZ3prMVg==", + "license": "MIT", "dependencies": { - "@smithy/is-array-buffer": "^4.2.2", - "@smithy/protocol-http": "^5.3.12", - "@smithy/types": "^4.13.1", - "@smithy/util-hex-encoding": "^4.2.2", - "@smithy/util-middleware": "^4.2.12", - "@smithy/util-uri-escape": "^4.2.2", - "@smithy/util-utf8": "^4.2.2", - "tslib": "^2.6.2" + "@octokit/request": "^10.0.16", + "@octokit/types": "^18.0.0", + "universal-user-agent": "^7.0.0" }, "engines": { - "node": ">=18.0.0" + "node": ">= 20" } }, - "node_modules/@smithy/smithy-client": { - "version": "4.12.5", - "resolved": "https://registry.npmjs.org/@smithy/smithy-client/-/smithy-client-4.12.5.tgz", - "integrity": "sha512-UqwYawyqSr/aog8mnLnfbPurS0gi4G7IYDcD28cUIBhsvWs1+rQcL2IwkUQ+QZ7dibaoRzhNF99fAQ9AUcO00w==", - "license": "Apache-2.0", + "node_modules/@octokit/openapi-types": { + "version": "29.0.1", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-29.0.1.tgz", + "integrity": "sha512-9qWOMFNxxLokERcms42rU0PTLqQmVs7g5E41TI4mCOxmpFayD1rfC7XxOL55cG9MBZLFlC31BrR37myMKardwg==", + "license": "MIT" + }, + "node_modules/@octokit/plugin-paginate-rest": { + "version": "14.0.0", + "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz", + "integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==", + "license": "MIT", "dependencies": { - "@smithy/core": "^3.23.11", - "@smithy/middleware-endpoint": "^4.4.25", - "@smithy/middleware-stack": "^4.2.12", - "@smithy/protocol-http": "^5.3.12", - "@smithy/types": "^4.13.1", - "@smithy/util-stream": "^4.5.19", - "tslib": "^2.6.2" + "@octokit/types": "^16.0.0" }, "engines": { - "node": ">=18.0.0" + "node": ">= 20" + }, + "peerDependencies": { + "@octokit/core": ">=6" } }, - "node_modules/@smithy/types": { - "version": "4.13.1", - "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.13.1.tgz", - "integrity": "sha512-787F3yzE2UiJIQ+wYW1CVg2odHjmaWLGksnKQHUrK/lYZSEcy1msuLVvxaR/sI2/aDe9U+TBuLsXnr3vod1g0g==", - "license": "Apache-2.0", + "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": { + "version": "27.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz", + "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==", + "license": "MIT" + }, + "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": { + "version": "16.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz", + "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==", + "license": "MIT", "dependencies": { - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" + "@octokit/openapi-types": "^27.0.0" } }, - "node_modules/@smithy/url-parser": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/url-parser/-/url-parser-4.2.12.tgz", - "integrity": "sha512-wOPKPEpso+doCZGIlr+e1lVI6+9VAKfL4kZWFgzVgGWY2hZxshNKod4l2LXS3PRC9otH/JRSjtEHqQ/7eLciRA==", - "license": "Apache-2.0", - "dependencies": { - "@smithy/querystring-parser": "^4.2.12", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, + "node_modules/@octokit/plugin-request-log": { + "version": "6.0.0", + "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-6.0.0.tgz", + "integrity": "sha512-UkOzeEN3W91/eBq9sPZNQ7sUBvYCqYbrrD8gTbBuGtHEuycE4/awMXcYvx6sVYo7LypPhmQwwpUe4Yyu4QZN5Q==", + "license": "MIT", "engines": { - "node": ">=18.0.0" + "node": ">= 20" + }, + "peerDependencies": { + "@octokit/core": ">=6" } }, - "node_modules/@smithy/util-base64": { - "version": "4.3.2", - "resolved": "https://registry.npmjs.org/@smithy/util-base64/-/util-base64-4.3.2.tgz", - "integrity": "sha512-XRH6b0H/5A3SgblmMa5ErXQ2XKhfbQB+Fm/oyLZ2O2kCUrwgg55bU0RekmzAhuwOjA9qdN5VU2BprOvGGUkOOQ==", - "license": "Apache-2.0", + "node_modules/@octokit/plugin-rest-endpoint-methods": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz", + "integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==", + "license": "MIT", "dependencies": { - "@smithy/util-buffer-from": "^4.2.2", - "@smithy/util-utf8": "^4.2.2", - "tslib": "^2.6.2" + "@octokit/types": "^16.0.0" }, "engines": { - "node": ">=18.0.0" + "node": ">= 20" + }, + "peerDependencies": { + "@octokit/core": ">=6" } }, - "node_modules/@smithy/util-body-length-browser": { - "version": "4.2.2", - "resolved": "https://registry.npmjs.org/@smithy/util-body-length-browser/-/util-body-length-browser-4.2.2.tgz", - "integrity": "sha512-JKCrLNOup3OOgmzeaKQwi4ZCTWlYR5H4Gm1r2uTMVBXoemo1UEghk5vtMi1xSu2ymgKVGW631e2fp9/R610ZjQ==", - "license": "Apache-2.0", + "node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/openapi-types": { + "version": "27.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz", + "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==", + "license": "MIT" + }, + "node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/types": { + "version": "16.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz", + "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==", + "license": "MIT", "dependencies": { - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" + "@octokit/openapi-types": "^27.0.0" } }, - "node_modules/@smithy/util-body-length-node": { - "version": "4.2.3", - "resolved": "https://registry.npmjs.org/@smithy/util-body-length-node/-/util-body-length-node-4.2.3.tgz", - "integrity": "sha512-ZkJGvqBzMHVHE7r/hcuCxlTY8pQr1kMtdsVPs7ex4mMU+EAbcXppfo5NmyxMYi2XU49eqaz56j2gsk4dHHPG/g==", - "license": "Apache-2.0", + "node_modules/@octokit/plugin-retry": { + "version": "8.1.1", + "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.1.1.tgz", + "integrity": "sha512-VCVvZ/R1+u3WuiBWpNavZ0mY4aaJNAsENrpBP9aLSR2QyOpQgd7DhM5j4AW7z4MQpnJYgwBPf0XqPQoNBRdQwg==", + "license": "MIT", "dependencies": { - "tslib": "^2.6.2" + "@octokit/request-error": "^7.1.1", + "@octokit/types": "^17.0.0", + "bottleneck": "^2.15.3" }, "engines": { - "node": ">=18.0.0" + "node": ">= 20" + }, + "peerDependencies": { + "@octokit/core": ">=7" } }, - "node_modules/@smithy/util-buffer-from": { - "version": "4.2.2", - "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-4.2.2.tgz", - "integrity": "sha512-FDXD7cvUoFWwN6vtQfEta540Y/YBe5JneK3SoZg9bThSoOAC/eGeYEua6RkBgKjGa/sz6Y+DuBZj3+YEY21y4Q==", - "license": "Apache-2.0", + "node_modules/@octokit/plugin-retry/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/plugin-retry/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", "dependencies": { - "@smithy/is-array-buffer": "^4.2.2", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" + "@octokit/openapi-types": "^28.0.0" } }, - "node_modules/@smithy/util-config-provider": { - "version": "4.2.2", - "resolved": "https://registry.npmjs.org/@smithy/util-config-provider/-/util-config-provider-4.2.2.tgz", - "integrity": "sha512-dWU03V3XUprJwaUIFVv4iOnS1FC9HnMHDfUrlNDSh4315v0cWyaIErP8KiqGVbf5z+JupoVpNM7ZB3jFiTejvQ==", - "license": "Apache-2.0", + "node_modules/@octokit/plugin-throttling": { + "version": "11.0.5", + "resolved": "https://registry.npmjs.org/@octokit/plugin-throttling/-/plugin-throttling-11.0.5.tgz", + "integrity": "sha512-LIdrkrUv+DWbKeg/49rGuFJ3SU0d3hUS+B4MhNZLepBoNUFXms8Ic9edJjrlx+zycqJHjrMRudVpVb/bAXM2Lw==", + "license": "MIT", "dependencies": { - "tslib": "^2.6.2" + "@octokit/types": "^17.0.0", + "bottleneck": "^2.15.3" }, "engines": { - "node": ">=18.0.0" + "node": ">= 20" + }, + "peerDependencies": { + "@octokit/core": "^7.0.0" } }, - "node_modules/@smithy/util-defaults-mode-browser": { - "version": "4.3.41", - "resolved": "https://registry.npmjs.org/@smithy/util-defaults-mode-browser/-/util-defaults-mode-browser-4.3.41.tgz", - "integrity": "sha512-M1w1Ux0rSVvBOxIIiqbxvZvhnjQ+VUjJrugtORE90BbadSTH+jsQL279KRL3Hv0w69rE7EuYkV/4Lepz/NBW9g==", - "license": "Apache-2.0", + "node_modules/@octokit/plugin-throttling/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/plugin-throttling/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", "dependencies": { - "@smithy/property-provider": "^4.2.12", - "@smithy/smithy-client": "^4.12.5", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" + "@octokit/openapi-types": "^28.0.0" } }, - "node_modules/@smithy/util-defaults-mode-node": { - "version": "4.2.44", - "resolved": "https://registry.npmjs.org/@smithy/util-defaults-mode-node/-/util-defaults-mode-node-4.2.44.tgz", - "integrity": "sha512-YPze3/lD1KmWuZsl9JlfhcgGLX7AXhSoaCDtiPntUjNW5/YY0lOHjkcgxyE9x/h5vvS1fzDifMGjzqnNlNiqOQ==", - "license": "Apache-2.0", + "node_modules/@octokit/request": { + "version": "10.0.16", + "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.16.tgz", + "integrity": "sha512-A0zWGjHzISIb+9ccG8s0dq7LKO5zVpJLRICjgUb+sJxEWqn8RUHB1rD3AE51+PECvXHIxqZ1VVvs4fHTSD9nUQ==", + "license": "MIT", "dependencies": { - "@smithy/config-resolver": "^4.4.11", - "@smithy/credential-provider-imds": "^4.2.12", - "@smithy/node-config-provider": "^4.3.12", - "@smithy/property-provider": "^4.2.12", - "@smithy/smithy-client": "^4.12.5", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" + "@octokit/endpoint": "^11.0.5", + "@octokit/request-error": "^7.1.2", + "@octokit/types": "^18.0.0", + "content-type": "^3.0.0", + "json-with-bigint": "^3.5.12", + "universal-user-agent": "^7.0.2" }, "engines": { - "node": ">=18.0.0" + "node": ">= 20" } }, - "node_modules/@smithy/util-endpoints": { - "version": "3.3.3", - "resolved": "https://registry.npmjs.org/@smithy/util-endpoints/-/util-endpoints-3.3.3.tgz", - "integrity": "sha512-VACQVe50j0HZPjpwWcjyT51KUQ4AnsvEaQ2lKHOSL4mNLD0G9BjEniQ+yCt1qqfKfiAHRAts26ud7hBjamrwig==", - "license": "Apache-2.0", + "node_modules/@octokit/request-error": { + "version": "7.1.2", + "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.2.tgz", + "integrity": "sha512-XZRuT3xZ84D3gYErI1DZvhJ33dCWVV6uzBtWkaBB4TvA/L6eOeTZodxLFVB44bBEEo3vEx7y00UfX1tBLrtLRg==", + "license": "MIT", "dependencies": { - "@smithy/node-config-provider": "^4.3.12", - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" + "@octokit/types": "^18.0.0" }, "engines": { - "node": ">=18.0.0" + "node": ">= 20" } }, - "node_modules/@smithy/util-hex-encoding": { - "version": "4.2.2", - "resolved": "https://registry.npmjs.org/@smithy/util-hex-encoding/-/util-hex-encoding-4.2.2.tgz", - "integrity": "sha512-Qcz3W5vuHK4sLQdyT93k/rfrUwdJ8/HZ+nMUOyGdpeGA1Wxt65zYwi3oEl9kOM+RswvYq90fzkNDahPS8K0OIg==", - "license": "Apache-2.0", + "node_modules/@octokit/rest": { + "version": "22.0.1", + "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-22.0.1.tgz", + "integrity": "sha512-Jzbhzl3CEexhnivb1iQ0KJ7s5vvjMWcmRtq5aUsKmKDrRW6z3r84ngmiFKFvpZjpiU/9/S6ITPFRpn5s/3uQJw==", + "license": "MIT", "dependencies": { - "tslib": "^2.6.2" + "@octokit/core": "^7.0.6", + "@octokit/plugin-paginate-rest": "^14.0.0", + "@octokit/plugin-request-log": "^6.0.0", + "@octokit/plugin-rest-endpoint-methods": "^17.0.0" }, "engines": { - "node": ">=18.0.0" + "node": ">= 20" } }, - "node_modules/@smithy/util-middleware": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/util-middleware/-/util-middleware-4.2.12.tgz", - "integrity": "sha512-Er805uFUOvgc0l8nv0e0su0VFISoxhJ/AwOn3gL2NWNY2LUEldP5WtVcRYSQBcjg0y9NfG8JYrCJaYDpupBHJQ==", - "license": "Apache-2.0", + "node_modules/@octokit/types": { + "version": "18.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-18.0.0.tgz", + "integrity": "sha512-l6bAF43PNxkJp6g+W4PjoUSSkxHomXw2nOum5CTftJz1NlV3vu93NImgOYtLf6CbBUb5j+fiuzW0PPQ5JTSvZA==", + "license": "MIT", "dependencies": { - "@smithy/types": "^4.13.1", - "tslib": "^2.6.2" - }, - "engines": { - "node": ">=18.0.0" + "@octokit/openapi-types": "^29.0.1" } }, - "node_modules/@smithy/util-retry": { - "version": "4.2.12", - "resolved": "https://registry.npmjs.org/@smithy/util-retry/-/util-retry-4.2.12.tgz", - "integrity": "sha512-1zopLDUEOwumjcHdJ1mwBHddubYF8GMQvstVCLC54Y46rqoHwlIU+8ZzUeaBcD+WCJHyDGSeZ2ml9YSe9aqcoQ==", + "node_modules/@smithy/core": { + "version": "3.35.2", + "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.35.2.tgz", + "integrity": "sha512-ejTukBuP/Pg3t9N8Ux+0zKsXeHWm7p6W3HbXFOyltKasSxZwCFmvTut7kBdZSCF3m9y1bXXyVu6p2xuMFcsTyQ==", "license": "Apache-2.0", "dependencies": { - "@smithy/service-error-classification": "^4.2.12", - "@smithy/types": "^4.13.1", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { "node": ">=18.0.0" } }, - "node_modules/@smithy/util-stream": { - "version": "4.5.19", - "resolved": "https://registry.npmjs.org/@smithy/util-stream/-/util-stream-4.5.19.tgz", - "integrity": "sha512-v4sa+3xTweL1CLO2UP0p7tvIMH/Rq1X4KKOxd568mpe6LSLMQCnDHs4uv7m3ukpl3HvcN2JH6jiCS0SNRXKP/w==", + "node_modules/@smithy/credential-provider-imds": { + "version": "4.5.2", + "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.5.2.tgz", + "integrity": "sha512-A9uSdn72ozbRUSit0eib0TW7nXuNPlaeM0zcGkJ+nE6tFcSDbnmtwoxbTCFBukVQcszDAyvsd7+rTduPTXpygg==", "license": "Apache-2.0", "dependencies": { - "@smithy/fetch-http-handler": "^5.3.15", - "@smithy/node-http-handler": "^4.4.16", - "@smithy/types": "^4.13.1", - "@smithy/util-base64": "^4.3.2", - "@smithy/util-buffer-from": "^4.2.2", - "@smithy/util-hex-encoding": "^4.2.2", - "@smithy/util-utf8": "^4.2.2", + "@smithy/core": "^3.33.2", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { "node": ">=18.0.0" } }, - "node_modules/@smithy/util-uri-escape": { - "version": "4.2.2", - "resolved": "https://registry.npmjs.org/@smithy/util-uri-escape/-/util-uri-escape-4.2.2.tgz", - "integrity": "sha512-2kAStBlvq+lTXHyAZYfJRb/DfS3rsinLiwb+69SstC9Vb0s9vNWkRwpnj918Pfi85mzi42sOqdV72OLxWAISnw==", + "node_modules/@smithy/fetch-http-handler": { + "version": "5.8.0", + "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.8.0.tgz", + "integrity": "sha512-ycSJu3tFAQ4v04CBB0agqFMVsSQ1iG3yw+SpgxRqKfaURpQD4CZ8Wn0zPMmSnOuTpTh65Vz+EA0rMrw089wvkA==", "license": "Apache-2.0", "dependencies": { + "@smithy/core": "^3.33.3", + "@smithy/types": "^4.18.0", "tslib": "^2.6.2" }, "engines": { "node": ">=18.0.0" } }, - "node_modules/@smithy/util-utf8": { - "version": "4.2.2", - "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-4.2.2.tgz", - "integrity": "sha512-75MeYpjdWRe8M5E3AW0O4Cx3UadweS+cwdXjwYGBW5h/gxxnbeZ877sLPX/ZJA9GVTlL/qG0dXP29JWFCD1Ayw==", + "node_modules/@smithy/node-http-handler": { + "version": "4.12.1", + "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.12.1.tgz", + "integrity": "sha512-ThMkboGeONWXAelq9FvGsuJC4rOi+qyC4/zhUF58xYpxUg5sQKx2VXZYJmtNjr4dSuBJ1HeJXETQILCz3wOHvw==", "license": "Apache-2.0", "dependencies": { - "@smithy/util-buffer-from": "^4.2.2", + "@smithy/core": "^3.33.3", + "@smithy/types": "^4.18.0", "tslib": "^2.6.2" }, "engines": { "node": ">=18.0.0" } }, - "node_modules/@smithy/util-waiter": { - "version": "4.2.13", - "resolved": "https://registry.npmjs.org/@smithy/util-waiter/-/util-waiter-4.2.13.tgz", - "integrity": "sha512-2zdZ9DTHngRtcYxJK1GUDxruNr53kv5W2Lupe0LMU+Imr6ohQg8M2T14MNkj1Y0wS3FFwpgpGQyvuaMF7CiTmQ==", + "node_modules/@smithy/signature-v4": { + "version": "5.7.4", + "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.7.4.tgz", + "integrity": "sha512-tHy0K0VtqNd5Y7Y41h0a0Lhh0L1GzC08dTWg0F7vRJWFtTENg7IZikf3wQkanYIRdb7ngoIPMTmqgUi401fEeQ==", "license": "Apache-2.0", "dependencies": { - "@smithy/abort-controller": "^4.2.12", - "@smithy/types": "^4.13.1", + "@smithy/core": "^3.35.0", + "@smithy/types": "^4.19.0", "tslib": "^2.6.2" }, "engines": { "node": ">=18.0.0" } }, - "node_modules/@smithy/uuid": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/@smithy/uuid/-/uuid-1.1.2.tgz", - "integrity": "sha512-O/IEdcCUKkubz60tFbGA7ceITTAJsty+lBjNoorP4Z6XRqaFb/OjQjZODophEcuq68nKm6/0r+6/lLQ+XVpk8g==", + "node_modules/@smithy/types": { + "version": "4.19.0", + "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.19.0.tgz", + "integrity": "sha512-r7jh49VJxGerfAcTQA6gXcKc+98zOp/tqRwzYjgOE+iSQsP6cEU1hq2QzbuipmP68QtYdY9wKEhiCQZIzHgZ4Q==", "license": "Apache-2.0", "dependencies": { "tslib": "^2.6.2" @@ -1947,6 +812,19 @@ "node": ">=18" } }, + "node_modules/content-type": { + "version": "3.1.1", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-3.1.1.tgz", + "integrity": "sha512-GW4qUsfFo59d0HbUibDlWv5wPz+vAAcaTWbKIuKCf0JkC7wWkSyf8f13IpXn5JkeMlB2P8iTSSIjwXljorg2vA==", + "license": "MIT", + "engines": { + "node": ">=22" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, "node_modules/cpu-features": { "version": "0.0.10", "resolved": "https://registry.npmjs.org/cpu-features/-/cpu-features-0.0.10.tgz", @@ -1961,22 +839,6 @@ "node": ">=10.0.0" } }, - "node_modules/fast-content-type-parse": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz", - "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/fastify" - }, - { - "type": "opencollective", - "url": "https://opencollective.com/fastify" - } - ], - "license": "MIT" - }, "node_modules/fast-glob": { "version": "3.3.3", "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz", @@ -1993,44 +855,10 @@ "node": ">=8.6.0" } }, - "node_modules/fast-xml-builder": { - "version": "1.1.4", - "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.4.tgz", - "integrity": "sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/NaturalIntelligence" - } - ], - "license": "MIT", - "dependencies": { - "path-expression-matcher": "^1.1.3" - } - }, - "node_modules/fast-xml-parser": { - "version": "5.4.1", - "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.4.1.tgz", - "integrity": "sha512-BQ30U1mKkvXQXXkAGcuyUA/GA26oEB7NzOtsxCDtyu62sjGw5QraKFhx2Em3WQNjPw9PG6MQ9yuIIgkSDfGu5A==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/NaturalIntelligence" - } - ], - "license": "MIT", - "dependencies": { - "fast-xml-builder": "^1.0.0", - "strnum": "^2.1.2" - }, - "bin": { - "fxparser": "src/cli/cli.js" - } - }, "node_modules/fastq": { - "version": "1.20.1", - "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz", - "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==", + "version": "1.20.3", + "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.3.tgz", + "integrity": "sha512-XKv5nnLs6nLF71NgiKJLIZFLkPyIEuOselLG7ujZnGrRfQK8HpvY+WqKhAJUAdLomwVHErVS4LfxFlPq0/FTAw==", "license": "ISC", "dependencies": { "reusify": "^1.0.4" @@ -2049,9 +877,9 @@ } }, "node_modules/fs-extra": { - "version": "11.3.4", - "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.4.tgz", - "integrity": "sha512-CTXd6rk/M3/ULNQj8FBqBWHYBVYybQ3VPBw0xGKFe3tuH7ytT6ACnvzpIQ3UZtB8yvUKC2cXn1a+x+5EVQLovA==", + "version": "11.4.1", + "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.4.1.tgz", + "integrity": "sha512-KYAb4c9BJQI6QqGKthV68OHe0badztdXJWKo0WtBA9IuCFPTKvE5ZdUBglP833aMjhaSPNO4A5j/EkzZtGlKjA==", "license": "MIT", "dependencies": { "graceful-fs": "^4.2.0", @@ -2063,12 +891,16 @@ } }, "node_modules/fuse.js": { - "version": "7.1.0", - "resolved": "https://registry.npmjs.org/fuse.js/-/fuse.js-7.1.0.tgz", - "integrity": "sha512-trLf4SzuuUxfusZADLINj+dE8clK1frKdmqiJNb1Es75fmI5oY6X2mxLVUciLLjxqw/xr72Dhy+lER6dGd02FQ==", + "version": "7.5.0", + "resolved": "https://registry.npmjs.org/fuse.js/-/fuse.js-7.5.0.tgz", + "integrity": "sha512-sQtrEfA+ez/3G0cCZecF70oqpCRttCexYUG4mUrtWL49ULUzUyxokt5kyqwtKzj1270RaKih+hcP3qLcumccow==", "license": "Apache-2.0", "engines": { "node": ">=10" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/krisk" } }, "node_modules/glob-parent": { @@ -2120,15 +952,15 @@ } }, "node_modules/json-with-bigint": { - "version": "3.5.7", - "resolved": "https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.7.tgz", - "integrity": "sha512-7ei3MdAI5+fJPVnKlW77TKNKwQ5ppSzWvhPuSuINT/GYW9ZOC1eRKOuhV9yHG5aEsUPj9BBx5JIekkmoLHxZOw==", + "version": "3.5.12", + "resolved": "https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.12.tgz", + "integrity": "sha512-uwbF/wSSuOgC7qqlq27Xp5B6a2MHVug3t0idZdTqu0JnlFvgJuH7ju+KAk/J06C7GfhoYy2gnb9wz2INqcne7w==", "license": "MIT" }, "node_modules/jsonfile": { - "version": "6.2.0", - "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz", - "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==", + "version": "6.2.1", + "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz", + "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==", "license": "MIT", "dependencies": { "universalify": "^2.0.0" @@ -2138,9 +970,9 @@ } }, "node_modules/jsonrepair": { - "version": "3.13.3", - "resolved": "https://registry.npmjs.org/jsonrepair/-/jsonrepair-3.13.3.tgz", - "integrity": "sha512-BTznj0owIt2CBAH/LTo7+1I5pMvl1e1033LRl/HUowlZmJOIhzC0zbX5bxMngLkfT4WnzPP26QnW5wMr2g9tsQ==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/jsonrepair/-/jsonrepair-3.15.0.tgz", + "integrity": "sha512-wy8OTjwsJwQRnQJkKnMJJ9vcytRdBPAgIF/Hy6+s1dAj42BHMKiyL8JzEieIl3JY7idt8eyHwBWTO8mh/+mtwA==", "license": "ISC", "bin": { "jsonrepair": "bin/cli.js" @@ -2190,9 +1022,9 @@ } }, "node_modules/nan": { - "version": "2.25.0", - "resolved": "https://registry.npmjs.org/nan/-/nan-2.25.0.tgz", - "integrity": "sha512-0M90Ag7Xn5KMLLZ7zliPWP3rT90P6PN+IzVFS0VqmnPktBk3700xUVv8Ikm9EUaUE5SDWdp/BIxdENzVznpm1g==", + "version": "2.29.0", + "resolved": "https://registry.npmjs.org/nan/-/nan-2.29.0.tgz", + "integrity": "sha512-GlGk3HIvitbvs+LT3g6XUP1kpirKNvmDFwF/bmo6XNWSb/eYEs/O4bfgIEIXCZ+lIOTS5xNwDvSGMw6FJdAhtA==", "license": "MIT", "optional": true }, @@ -2205,25 +1037,10 @@ "node": "^18 || ^20 || >= 21" } }, - "node_modules/path-expression-matcher": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.1.3.tgz", - "integrity": "sha512-qdVgY8KXmVdJZRSS1JdEPOKPdTiEK/pi0RkcT2sw1RhXxohdujUlJFPuS1TSkevZ9vzd3ZlL7ULl1MHGTApKzQ==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/NaturalIntelligence" - } - ], - "license": "MIT", - "engines": { - "node": ">=14.0.0" - } - }, "node_modules/picomatch": { - "version": "2.3.1", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz", - "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==", + "version": "2.3.2", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz", + "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==", "license": "MIT", "engines": { "node": ">=8.6" @@ -2304,9 +1121,9 @@ "license": "MIT" }, "node_modules/semver": { - "version": "7.7.4", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz", - "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==", + "version": "7.8.5", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", + "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==", "license": "ISC", "bin": { "semver": "bin/semver.js" @@ -2322,9 +1139,9 @@ "license": "CC-BY-3.0" }, "node_modules/spdx-expression-parse": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-4.0.0.tgz", - "integrity": "sha512-Clya5JIij/7C6bRR22+tnGXbc4VKlibKSVj2iHvVeX5iMW7s1SIQlqu699JkODJJIhh/pUu8L0/VLh8xflD+LQ==", + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-5.0.0.tgz", + "integrity": "sha512-vngmw3Rgn+o2arXNbnZaj5UtOEBuWBfvaI+Wc8GFfykIhA5/vdK9/Sp/XkLv63dykz2rxKDvKEHupF5P0FORcQ==", "license": "MIT", "dependencies": { "spdx-exceptions": "^2.1.0", @@ -2332,9 +1149,9 @@ } }, "node_modules/spdx-license-ids": { - "version": "3.0.23", - "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.23.tgz", - "integrity": "sha512-CWLcCCH7VLu13TgOH+r8p1O/Znwhqv/dbb6lqWy67G+pT1kHmeD/+V36AVb/vq8QMIQwVShJ6Ssl5FPh0fuSdw==", + "version": "3.0.24", + "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.24.tgz", + "integrity": "sha512-cLS9TtWkIQFyLkJ3/5aFQAOHOSKTlOs/7WDut/XPSdjom1fJhUdkepeJAKXa9Y05+FabHd0sti+Et559vDtkpQ==", "license": "CC0-1.0" }, "node_modules/ssh2": { @@ -2354,22 +1171,10 @@ "nan": "^2.23.0" } }, - "node_modules/strnum": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.0.tgz", - "integrity": "sha512-Y7Bj8XyJxnPAORMZj/xltsfo55uOiyHcU2tnAVzHUnSJR/KsEX+9RoDeXEnsXtl/CX4fAcrt64gZ13aGaWPeBg==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/NaturalIntelligence" - } - ], - "license": "MIT" - }, "node_modules/tar": { - "version": "7.5.21", - "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.21.tgz", - "integrity": "sha512-XdhtCvlMywwxpCW8YEq3lOXBJpUPTR2OHHcwLPO3HwsJqOHa2Ok/oJ7ruGzp+JrKoRPVCzJwAdEjqLW/vNRPHA==", + "version": "7.5.22", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz", + "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==", "license": "BlueOak-1.0.0", "dependencies": { "@isaacs/fs-minipass": "^4.0.0", @@ -2383,9 +1188,9 @@ } }, "node_modules/tmp": { - "version": "0.2.5", - "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.5.tgz", - "integrity": "sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==", + "version": "0.2.7", + "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.7.tgz", + "integrity": "sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==", "license": "MIT", "engines": { "node": ">=14.14" @@ -2440,9 +1245,9 @@ } }, "node_modules/yaml": { - "version": "2.8.2", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.2.tgz", - "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==", + "version": "2.9.1", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz", + "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==", "license": "ISC", "bin": { "yaml": "bin.mjs" diff --git a/spago.lock b/spago.lock index 8e89fad9c..5a5aa6a14 100644 --- a/spago.lock +++ b/spago.lock @@ -327,7 +327,7 @@ }, "package_set": { "address": { - "registry": "68.1.1" + "registry": "81.4.0" }, "compiler": ">=0.15.15 <0.16.0", "content": { @@ -358,16 +358,18 @@ "arraybuffer-builder": "3.1.0", "arraybuffer-types": "3.0.2", "arrays": "7.3.0", - "arrays-extra": "0.6.1", + "arrays-extra": "0.6.2", "arrays-zipper": "2.0.1", "ask": "1.0.0", "assert": "6.0.0", "assert-multiple": "0.4.0", "avar": "5.0.1", "axon": "0.0.3", - "b64": "0.0.8", + "b64": "0.0.9", "barbies": "1.0.1", - "barlow-lens": "0.9.0", + "barlow-lens": "1.0.0", + "baskerville-core": "0.1.3", + "baskerville-mycroft": "0.1.0", "benchlib": "0.0.4", "bifunctors": "6.1.0", "bigints": "7.0.1", @@ -375,6 +377,7 @@ "bolson": "0.3.9", "bookhound": "0.1.7", "bower-json": "3.0.0", + "bytestrings": "9.0.0", "call-by-name": "4.0.1", "canvas": "6.0.0", "canvas-action": "9.0.0", @@ -387,6 +390,8 @@ "chameleon-styled": "2.5.0", "chameleon-transformers": "1.0.0", "channel": "1.0.0", + "chartjs": "0.2.0", + "chartjs-halogen": "0.2.0", "checked-exceptions": "3.1.1", "choku": "1.0.2", "classless": "0.1.1", @@ -398,6 +403,7 @@ "codec-argonaut": "10.0.0", "codec-json": "2.0.0", "colors": "7.0.1", + "compile-fail": "0.4.0", "concur-core": "0.5.0", "concur-react": "0.5.0", "concurrent-queues": "3.0.0", @@ -409,16 +415,17 @@ "coroutines": "7.0.0", "css": "6.0.0", "css-class-name-extractor": "0.0.4", - "css-frameworks": "1.0.1", + "css-frameworks": "1.1.0", "csv-stream": "2.3.0", + "currency": "0.1.0", "data-mvc": "0.0.2", "datetime": "6.1.0", "datetime-parsing": "0.2.0", - "debounce": "0.1.0", + "debounce": "0.1.2", "debug": "6.0.2", "decimals": "7.1.0", "default-values": "1.0.1", - "deku": "0.9.23", + "deku": "0.9.24", "deno": "0.0.5", "dissect": "1.0.0", "distributive": "6.0.0", @@ -434,14 +441,13 @@ "echarts-simple": "0.0.1", "effect": "4.0.0", "either": "6.1.0", - "elmish": "0.13.0", + "elmish": "0.16.0", "elmish-enzyme": "0.1.1", - "elmish-hooks": "0.11.0", - "elmish-html": "0.10.0", - "elmish-testing-library": "0.3.2", - "elmish-time-machine": "0.4.2", + "elmish-hooks": "0.12.0", + "elmish-html": "0.14.0", + "elmish-testing-library": "0.5.0", "email-validate": "7.0.0", - "encoding": "0.0.9", + "encoding": "0.0.10", "enums": "6.0.1", "env-names": "0.4.0", "environment": "2.0.0", @@ -454,6 +460,7 @@ "express": "0.9.1", "ezfetch": "1.1.1", "fahrtwind": "2.0.0", + "faker-ffi": "0.1.1", "fakerjs": "0.0.1", "fallback": "0.1.0", "fast-vect": "1.2.0", @@ -480,7 +487,7 @@ "fork": "6.0.0", "form-urlencoded": "7.0.0", "formatters": "7.0.0", - "framer-motion": "1.0.1", + "framer-motion": "3.1.0", "free": "7.1.0", "freeap": "7.0.0", "freer-free": "0.0.1", @@ -496,10 +503,12 @@ "geometria": "2.2.0", "gesso": "1.0.1", "gojs": "0.1.1", + "golden-test": "0.1.0", "golem-fetch": "0.1.0", "grain": "3.0.0", "grain-router": "3.0.0", "grain-virtualized": "3.0.0", + "graphql-client": "10.1.1", "graphs": "8.1.0", "group": "4.1.1", "halogen": "7.0.0", @@ -521,19 +530,37 @@ "halogen-use-trigger-hooks": "1.0.0", "halogen-vdom": "8.0.0", "halogen-vdom-string-renderer": "0.5.0", + "halogen-widgets": "0.3.1", "halogen-xterm": "2.0.0", + "harmonia": "0.2.0", "heckin": "2.0.1", "heterogeneous": "0.7.0", "homogeneous": "0.4.0", - "http-methods": "6.0.0", + "http-methods": "6.1.0", "httpurple": "4.0.0", "huffman": "0.4.0", "humdrum": "0.0.1", - "hyrule": "2.3.8", + "hylograph-canvas": "0.1.0", + "hylograph-components": "0.1.0", + "hylograph-d3-kernel": "0.1.0", + "hylograph-graph": "0.3.0", + "hylograph-layout": "0.3.0", + "hylograph-music": "0.4.0", + "hylograph-optics": "0.1.0", + "hylograph-selection": "0.5.3", + "hylograph-simulation": "0.6.0", + "hylograph-simulation-core": "0.1.0", + "hylograph-simulation-halogen": "0.5.1", + "hylograph-transitions": "0.1.0", + "hylograph-wasm-kernel": "0.1.0", + "hyrule": "2.3.9", + "i18next": "0.1.0", + "idb": "0.2.0", "identity": "6.0.0", "identy": "4.0.1", "indexed-db": "1.0.0", "indexed-monad": "3.0.0", + "ink": "0.0.1", "int64": "3.0.0", "integers": "6.0.0", "interpolate": "5.0.2", @@ -549,14 +576,16 @@ "js-date": "8.0.0", "js-fetch": "0.2.1", "js-fileio": "3.0.0", - "js-intl": "1.1.4", + "js-intl": "1.3.0", "js-iterators": "0.1.1", "js-maps": "0.1.2", "js-promise": "1.0.0", "js-promise-aff": "1.0.0", + "js-temporal": "3.0.0", "js-timers": "6.1.0", "js-uri": "3.1.0", "jsdom": "1.0.0", + "jsinc": "0.5.1", "json": "1.1.0", "json-codecs": "5.0.0", "justifill": "0.5.0", @@ -570,6 +599,7 @@ "leveldb": "1.0.1", "liminal": "1.0.1", "linalg": "6.0.0", + "linear": "0.1.0", "lists": "7.0.0", "literals": "1.0.2", "logging": "3.0.0", @@ -579,6 +609,7 @@ "maps-eager": "0.5.0", "marionette": "1.0.0", "marionette-react-basic-hooks": "0.1.1", + "markdown-it-js": "0.1.0", "marked": "0.1.0", "matrices": "5.0.1", "matryoshka": "1.0.0", @@ -586,6 +617,7 @@ "media-types": "6.0.0", "meowclient": "1.0.0", "midi": "4.0.0", + "milkdown": "0.1.0", "milkis": "9.0.0", "mimetype": "0.0.1", "minibench": "4.0.1", @@ -596,10 +628,12 @@ "monad-unlift": "1.0.1", "monoid-extras": "0.0.1", "monoidal": "0.16.0", - "morello": "0.4.0", "mote": "3.0.0", + "motion": "4.0.0", "motsunabe": "2.0.0", "mvc": "0.0.1", + "mycroft": "0.1.1", + "mycroft-z3-wasm": "0.1.0", "mysql": "6.0.1", "n3": "0.1.0", "nano-id": "1.1.0", @@ -607,6 +641,7 @@ "naturals": "3.0.0", "nested-functor": "0.2.1", "newtype": "5.0.0", + "next-purs-rsc": "0.1.0", "nextjs": "0.1.1", "nextui": "0.2.0", "node-buffer": "9.0.0", @@ -623,6 +658,7 @@ "node-path": "5.0.1", "node-process": "11.2.0", "node-readline": "8.1.1", + "node-sqlite": "0.2.0", "node-sqlite3": "8.0.0", "node-stream-pipes": "2.1.6", "node-streams": "9.0.1", @@ -633,6 +669,7 @@ "nonempty": "7.0.0", "now": "6.0.0", "npm-package-json": "2.0.0", + "nqueens": "0.1.4", "nullable": "6.0.0", "numberfield": "0.2.2", "numbers": "9.0.1", @@ -652,13 +689,13 @@ "options": "7.0.0", "optparse": "5.0.1", "ordered-collections": "3.2.0", - "ordered-set": "0.4.0", + "ordered-set": "0.5.2", "orders": "6.0.0", "org-doc": "0.1.0", "owoify": "1.2.0", "pairs": "9.0.1", "parallel": "7.0.0", - "parsing": "10.3.0", + "parsing": "11.0.0", "parsing-dataview": "3.2.4", "partial": "4.0.0", "pathy": "9.0.0", @@ -667,13 +704,13 @@ "phylio": "1.1.2", "pipes": "8.0.0", "pirates-charm": "0.0.1", - "play": "0.2.1", - "pmock": "0.9.0", + "play": "1.0.0", + "pmock": "1.1.0", "point-free": "1.0.0", "pointed-list": "0.5.1", "polymorphic-vectors": "4.0.0", "posix-types": "6.0.0", - "postgresql": "2.0.20", + "postgresql": "2.0.21", "precise": "6.0.0", "precise-datetime": "7.0.0", "prelude": "6.0.2", @@ -682,11 +719,13 @@ "priority-queue": "0.1.2", "profunctor": "6.0.1", "profunctor-lenses": "8.0.0", + "prospero": "0.1.0", "protobuf": "4.4.0", + "ps-spa": "0.7.1", "psa-utils": "8.0.0", "psci-support": "6.0.0", "punycode": "1.0.0", - "pursfmt": "0.16.0", + "pursfmt": "0.17.0", "qualified-do": "2.2.0", "quantities": "12.2.0", "quickcheck": "8.0.1", @@ -704,11 +743,12 @@ "react-basic-dom": "7.0.0", "react-basic-dom-beta": "0.1.1", "react-basic-emotion": "7.1.0", - "react-basic-hooks": "8.2.0", + "react-basic-hooks": "9.1.1", "react-basic-storybook": "2.0.0", + "react-dnd-kit": "0.6.0", "react-dom": "8.0.0", "react-halo": "3.0.0", - "react-icons": "1.1.5", + "react-icons": "1.1.6", "react-markdown": "0.1.0", "react-testing-library": "4.0.1", "react-virtuoso": "1.0.0", @@ -720,6 +760,7 @@ "record-extra-srghma": "0.2.8", "record-ptional-fields": "0.1.2", "record-studio": "1.0.4", + "ref-lifted": "0.0.2", "refs": "6.0.0", "remotedata": "5.0.1", "repr": "0.5.0", @@ -742,7 +783,10 @@ "selection-foldable": "0.2.0", "selective-functors": "1.0.1", "semirings": "7.0.0", + "seowebchecker": "1.0.4", "shuffle": "2.0.0", + "sigil": "0.3.0", + "sigil-hats": "0.3.0", "signal": "13.0.0", "simple-emitter": "3.0.1", "simple-i18n": "2.0.1", @@ -751,13 +795,13 @@ "simple-ulid": "3.0.0", "sized-matrices": "1.0.0", "sized-vectors": "5.0.2", - "slug": "3.1.0", + "slug": "3.2.0", "small-ffi": "4.0.1", "soundfonts": "4.1.0", "sparse-matrices": "2.0.1", "sparse-polynomials": "3.0.1", - "spec": "8.1.1", - "spec-discovery": "8.4.0", + "spec": "8.1.2", + "spec-discovery": "8.4.1", "spec-mocha": "5.1.1", "spec-node": "0.0.3", "spec-quickcheck": "5.0.2", @@ -770,17 +814,19 @@ "string-parsers": "8.0.0", "strings": "6.0.1", "strings-extra": "4.0.0", - "stringutils": "0.0.12", + "stringutils": "0.0.13", "structured-logging": "1.0.0", "substitute": "0.2.3", + "supabase": "0.1.0", "supply": "0.2.0", "svg-parser": "3.0.0", "systemd-journald": "0.3.0", "tagged": "4.0.2", "tailrec": "6.1.0", - "tanstack-query": "2.0.0", + "tanstack-query": "3.0.0", "tecton": "0.2.1", "tecton-halogen": "0.2.0", + "temporal": "0.2.0", "test-unit": "17.0.0", "text-formatting": "0.1.0", "thermite": "6.3.1", @@ -791,8 +837,11 @@ "tidy-codegen": "4.0.1", "tldr": "0.0.0", "toestand": "0.9.0", + "tramaj-halogen": "0.4.1", + "tramaj-purs": "0.4.1", "transformation-matrix": "1.0.1", "transformers": "6.1.0", + "transit": "1.0.0", "tree-rose": "4.0.2", "trivial-unfold": "0.5.0", "ts-bridge": "4.0.0", @@ -834,7 +883,9 @@ "vectors": "2.1.0", "versions": "7.0.0", "visx": "0.0.2", - "vitest": "1.0.0", + "vitest": "2.0.1", + "wasm-base": "0.2.0", + "web-chain": "1.0.1", "web-clipboard": "6.0.0", "web-cssom": "2.0.0", "web-cssom-view": "0.1.0", @@ -858,20 +909,74 @@ "web-touchevents": "4.0.0", "web-uievents": "5.0.0", "web-url": "2.0.0", - "web-workers": "1.1.0", + "web-workers": "2.0.0", "web-xhr": "5.0.1", + "webb-aff-list": "0.0.2", + "webb-array": "0.0.2", + "webb-channel": "0.0.3", + "webb-commandline": "0.0.3", + "webb-directory": "0.0.7", + "webb-file": "0.0.1", + "webb-map": "0.0.1", + "webb-monad": "0.0.2", + "webb-mutex": "0.0.7", + "webb-parsing": "0.0.5", + "webb-random": "0.0.1", + "webb-refer": "0.0.3", + "webb-set": "0.0.1", + "webb-slot": "0.0.1", + "webb-stateful": "0.0.3", + "webb-string": "0.0.1", + "webb-test": "0.0.1", + "webb-thread": "0.0.2", + "webb-writer": "0.0.3", "webextension-polyfill": "0.1.0", "webgpu": "0.0.1", "which": "2.0.0", - "whine-core": "0.0.32", + "whine-core": "0.0.34", "xterm": "1.0.0", "yaml-next": "3.1.1", + "yoga-acp-om": "0.1.1", + "yoga-better-auth": "0.2.2", + "yoga-bun-yoga": "0.2.1", + "yoga-config": "0.2.1", + "yoga-country": "3.0.0", + "yoga-docker-compose": "0.1.1", + "yoga-dynamodb": "0.1.1", + "yoga-elasticsearch": "0.1.1", + "yoga-fastify": "0.5.4", + "yoga-fastify-om": "0.4.7", "yoga-fetch": "1.0.1", - "yoga-json": "5.1.0", - "yoga-om": "0.1.0", + "yoga-fetch-om": "0.8.0", + "yoga-format": "1.0.0", + "yoga-heroui": "2.0.3", + "yoga-http-api": "0.3.4", + "yoga-jaeger": "0.1.1", + "yoga-json": "5.2.1", + "yoga-language": "1.0.0", + "yoga-next-fastify": "0.2.0", + "yoga-om": "2.2.1", + "yoga-om-layer": "2.1.0", + "yoga-om-strom": "0.4.3", + "yoga-om-workerbees": "0.1.2", + "yoga-opentelemetry": "0.2.0", + "yoga-options": "0.1.1", + "yoga-pino": "0.1.1", "yoga-postgres": "6.0.0", - "yoga-react-dom": "1.0.1", + "yoga-react": "1.0.2", + "yoga-react-dom": "2.0.1", + "yoga-react-native": "0.2.1", + "yoga-react-om": "0.2.0", + "yoga-redis": "0.1.1", + "yoga-scylladb": "0.1.1", + "yoga-shadcn": "1.0.5", + "yoga-sql-types": "0.2.0", + "yoga-sqlite": "0.3.4", + "yoga-sqlite-om": "0.3.0", + "yoga-sse": "0.1.1", "yoga-subtlecrypto": "0.1.0", + "yoga-test-docker": "0.1.2", + "yoga-timezone": "1.0.0", "yoga-tree": "1.0.0", "yoga-tree-svg": "0.1.0", "yoga-tree-utils": "1.0.0", @@ -879,69 +984,7 @@ "zipperarray": "2.0.0" } }, - "extra_packages": { - "dodo-printer": { - "repo": "https://github.com/natefaubion/purescript-dodo-printer.git", - "version": "v2.2.1", - "dependencies": [ - "aff", - "ansi", - "arrays", - "avar", - "console", - "control", - "effect", - "either", - "exceptions", - "foldable-traversable", - "integers", - "lists", - "maybe", - "newtype", - "parallel", - "partial", - "posix-types", - "prelude", - "safe-coerce", - "strings", - "tuples" - ] - }, - "language-cst-parser": { - "repo": "https://github.com/natefaubion/purescript-language-cst-parser.git", - "version": "v0.13.0", - "dependencies": [ - "arrays", - "console", - "const", - "control", - "effect", - "either", - "enums", - "foldable-traversable", - "free", - "functions", - "functors", - "identity", - "integers", - "lazy", - "lists", - "maybe", - "newtype", - "numbers", - "ordered-collections", - "partial", - "prelude", - "st", - "strings", - "transformers", - "tuples", - "typelevel-prelude", - "unfoldable", - "unsafe-coerce" - ] - } - } + "extra_packages": {} }, "packages": { "aff": { @@ -1096,8 +1139,8 @@ }, "b64": { "type": "registry", - "version": "0.0.8", - "integrity": "sha256-YGa1p2zXZvw7iZ8VzumQsJ6JYLSOGmlwPwMwKQIVKVk=", + "version": "0.0.9", + "integrity": "sha256-V4b3XWdhWwzcuHpz324hMXTmBlc3Ipf7H6I3yBOI+98=", "dependencies": [ "arraybuffer-types", "either", @@ -1264,27 +1307,18 @@ ] }, "dodo-printer": { - "type": "git", - "url": "https://github.com/natefaubion/purescript-dodo-printer.git", - "rev": "831c5c963a57ca4bfd62f96335267d7d0785851d", + "type": "registry", + "version": "2.2.3", + "integrity": "sha256-z6LZV9tXQPBZvHqzUYyCYGB7zHq6u7TOgV6Pr0wiobs=", "dependencies": [ - "aff", "ansi", - "arrays", - "avar", - "console", - "control", - "effect", "either", - "exceptions", "foldable-traversable", "integers", "lists", "maybe", "newtype", - "parallel", "partial", - "posix-types", "prelude", "safe-coerce", "strings", @@ -1360,8 +1394,8 @@ }, "encoding": { "type": "registry", - "version": "0.0.9", - "integrity": "sha256-VmELMMTv0r8C5ZABFHANoni7HZ7dX2yu5O83hSLZsSM=", + "version": "0.0.10", + "integrity": "sha256-5Q5DVmlsGZJctAHGZbJld7igDkIXctTlomsTg5ImRNE=", "dependencies": [ "arraybuffer-types", "either", @@ -1751,8 +1785,8 @@ }, "http-methods": { "type": "registry", - "version": "6.0.0", - "integrity": "sha256-S0UjrJSgwJxEsFHM/pX77dM8V4HfvvDqdHPckQrtxMs=", + "version": "6.1.0", + "integrity": "sha256-WbjEmCv6rysY/aKwlrcspyzShi5bIQy+AFpDzPMnSP4=", "dependencies": [ "either", "prelude", @@ -1957,15 +1991,13 @@ ] }, "language-cst-parser": { - "type": "git", - "url": "https://github.com/natefaubion/purescript-language-cst-parser.git", - "rev": "5621f2e9fa1a0df5930b95b26f922fa94c494e80", + "type": "registry", + "version": "0.14.1", + "integrity": "sha256-tnue0oM2/EmyNJmLoJDnmUDfinKLJHi2fcSGt7d6ewU=", "dependencies": [ "arrays", - "console", "const", "control", - "effect", "either", "enums", "foldable-traversable", @@ -2510,8 +2542,8 @@ }, "parsing": { "type": "registry", - "version": "10.3.0", - "integrity": "sha256-8gjwCqLq2mV8zlleVo7kTLQsjqSyDbVRGw51OSU0O9s=", + "version": "11.0.0", + "integrity": "sha256-N88gb/XbM29vw/Uop83shuMFT4wieQCz4wlQAct5eMs=", "dependencies": [ "arrays", "control", @@ -2721,8 +2753,8 @@ }, "spec": { "type": "registry", - "version": "8.1.1", - "integrity": "sha256-b6qjDb7lUJGLV+WEoywLu6BCXC4zGpfbN43mTL+vBeI=", + "version": "8.1.2", + "integrity": "sha256-klPPJ6lBQI1CGOAdLJ+ZoGRt8XZippkTKjn53BrSkL0=", "dependencies": [ "aff", "ansi", diff --git a/spago.yaml b/spago.yaml index dabe26cc5..8f928c7af 100644 --- a/spago.yaml +++ b/spago.yaml @@ -1,61 +1,3 @@ workspace: packageSet: - registry: 68.1.1 - extraPackages: - dodo-printer: - repo: https://github.com/natefaubion/purescript-dodo-printer.git - version: v2.2.1 - dependencies: - - aff - - ansi - - arrays - - avar - - console - - control - - effect - - either - - exceptions - - foldable-traversable - - integers - - lists - - maybe - - newtype - - parallel - - partial - - posix-types - - prelude - - safe-coerce - - strings - - tuples - language-cst-parser: - repo: https://github.com/natefaubion/purescript-language-cst-parser.git - version: v0.13.0 - dependencies: - - arrays - - console - - const - - control - - effect - - either - - enums - - foldable-traversable - - free - - functions - - functors - - identity - - integers - - lazy - - lists - - maybe - - newtype - - numbers - - ordered-collections - - partial - - prelude - - st - - strings - - transformers - - tuples - - typelevel-prelude - - unfoldable - - unsafe-coerce + registry: 81.4.0 From c5dd12edfb5bad8593b079860ca263390cf08592 Mon Sep 17 00:00:00 2001 From: Thomas Honeyman Date: Sun, 11 Oct 2026 08:47:00 -0400 Subject: [PATCH 2/3] Apply dependency upgrade review feedback --- DEPENDENCY_AUDIT.md | 525 --------------------------------- foreign/test/Foreign/SPDX.purs | 3 +- 2 files changed, 1 insertion(+), 527 deletions(-) delete mode 100644 DEPENDENCY_AUDIT.md diff --git a/DEPENDENCY_AUDIT.md b/DEPENDENCY_AUDIT.md deleted file mode 100644 index cc6edc66f..000000000 --- a/DEPENDENCY_AUDIT.md +++ /dev/null @@ -1,525 +0,0 @@ -# Dependency upgrade audit — 2026-10-11 - -## Scope and method - -Baseline: the pushed `maintenance/nix-2026-10` branch (PR #802). Versions below -are **locked versions**, not the lower bounds of the old manifest ranges. -Targets were checked against npm's live `latest` dist-tags on 2026-10-11; -prereleases were excluded. All 15 distinct direct third-party npm dependencies -are covered, including the four already at latest. Eleven advance. - -For changed packages, this review compared the old and new **published npm -tarballs**, upstream tagged source, intervening commits, and release notes or -changelogs where available. This matters for generated distributions such as -AWS and Octokit. The links below identify the exact comparison, not just a -project homepage. Development-only upstream changes do not affect our runtime. - -The binding review checked imports/exports, arguments/options/defaults, result -shapes, exceptions, Promise/callback behavior, and runtime/native requirements. -Real dependencies were exercised through our FFI, including real loopback HTTP -with the actual SDKs, serializers, signers, transport, retry and throttling -plugins. Those probes do not substitute SDK mocks for the packages being -upgraded. They do not claim compatibility with a live GitHub or DigitalOcean -account; no production service or credential was used. - -### Manifest and tooling inventory - -- npm: root `package.json` and `package-lock.json`; workspaces - `app/package.json`, `foreign/package.json`, `lib/package.json`. There are no - first-party devDependencies or additional workspace npm lockfiles. Local - `registry-*` file dependencies remain local, not npm release targets. -- Spago: root `spago.yaml` and `spago.lock`; package configurations in `app/`, - `app-e2e/`, `dashboard/`, `foreign/`, `lib/`, `scripts/`, and `test-utils/`. -- The package manifests under `app/fixtures/licenses/{ambiguous-gfdl, - deprecated-agpl,halogen-hooks}/` are historical license-detection inputs, - not installed first-party dependencies. Changing them would change the tests. -- `.agents/setup` runs the root npm/Spago commands using Nix. The dashboard - workflow installs `purescript@0.15.16`, `spago@1.0.4`, and unversioned `esbuild` - with `--no-save`. Compiler and Spago pins are already the latest published - stable versions. esbuild currently resolves to 0.28.2; it has no old npm lock - entry. Tooling verification is recorded below. -- Nix's toolchain and `flake.lock` remain those of PR #802. The npm dependency - hash in `nix/overlay.nix` is regenerated. No package overrides, Node patches, - SQLite source-build hooks, compiler inputs, or new packaging exceptions were - introduced. `CONTRIBUTING.md` and `deploy.yml` are unchanged. - -## Direct JavaScript dependencies - -### @aws-sdk/client-s3: 3.1009.0 → 3.1149.0 (foreign) - -Sources: [full comparison](https://github.com/aws/aws-sdk-js-v3/compare/v3.1009.0...v3.1149.0), -[S3 changelog](https://github.com/aws/aws-sdk-js-v3/blob/v3.1149.0/clients/client-s3/CHANGELOG.md), -[command builder](https://github.com/aws/aws-sdk-js-v3/blob/v3.1149.0/clients/client-s3/src/commandBuilder.ts), -[runtime configuration](https://github.com/aws/aws-sdk-js-v3/blob/v3.1149.0/clients/client-s3/src/runtimeConfig.ts). -The upstream [upgrade guide](https://github.com/aws/aws-sdk-js-v3/blob/v3.1149.0/UPGRADING.md) -is a v2-to-v3 guide; this upgrade stays within v3. - -Changes across this interval include binary-decision-diagram endpoint -resolution and endpoint cache fixes; thinner generated command classes; S3 -middleware consolidation; internal XML parsing; checksum implementation -consolidation and additional MD5, SHA512 and XXHash algorithms; retry fixes -(including errors in HTTP 200 responses, adaptive throttling and transient DNS -errors); and core error fallback/metrics changes. Service-model additions cover -directory-bucket metrics/inventory, annotations, AWS Backup access points, -Object Lock event holds, inventory reference dates, region/storage-class and -checksum enum additions, and outpost access-point validation. TypeScript and -internal import reorganizations do not change our command constructors. - -`foreign/src/Foreign/S3.js` uses named exports `S3`, `ListObjectsCommand`, -`PutObjectCommand`, `DeleteObjectCommand`, and `DeleteObjectsCommand`. It passes -explicit endpoint, region, static credentials, and `forcePathStyle: false`; -commands use `Bucket`, `Prefix`, `Marker`, `Key`, buffer `Body`, `ACL`, and -`Delete: { Objects: [{ Key }], Quiet: true }`. All remain supported. The four -commands still return Promises with the same consumed `Contents`, `ETag`, -delete header fields and pagination fields. Missing `Contents` still maps to -`[]`. New optional output fields are ignored. Default checksum calculation -continues to run; it is not disabled to make tests pass. Node requirement is ->=20, satisfied by the inherited Node 24.21.0. - -**Validation:** actual local HTTP checked XML `&` decoding, numeric size, -Date conversion, missing `Contents`, buffer bytes, public-read ACL, SigV4 -authorization, default CRC32 headers on PUT and bulk DELETE, ETag, delete-marker -and version headers, AccessDenied/403 rejection, retry of an embedded -InternalError in HTTP 200, and two-page bulk deletion with the last-key marker -fallback. Isolated integration also exercises uploads/deletes through the real -SDK. **No binding change required.** - -Existing caveat, not introduced here: the PureScript delete response declares -fields that S3 can omit for an unversioned bucket. This upgrade neither makes -those fields required upstream nor changes the binding's existing behavior. - -### @octokit/plugin-retry: 8.1.0 → 8.1.1 (foreign) - -Sources: [comparison](https://github.com/octokit/plugin-retry.js/compare/v8.1.0...v8.1.1), -[release](https://github.com/octokit/plugin-retry.js/releases/tag/v8.1.1), -[retry implementation](https://github.com/octokit/plugin-retry.js/blob/v8.1.1/src/index.ts). -Published runtime source is unchanged except the version constant. Changes -update dependencies (`@octokit/types` 16 → 17 and request-error's minimum), -tests and development tooling. Peer requirement remains Octokit core >=7; -Node >=20 remains sufficient. Default retry status exclusions, retry count and -quadratic backoff are unchanged. - -`foreign/src/Foreign/Octokit.js` composes the named `retry` plugin with REST -and throttling and passes failures to `onError`. **Validation:** an actual 500 -followed by 200 produced two requests and a success callback; 401 was not -retried. Error callback status and response handling remain correct. -**No binding change required.** - -### @octokit/plugin-throttling: 11.0.3 → 11.0.5 (foreign) - -Sources: [comparison](https://github.com/octokit/plugin-throttling.js/compare/v11.0.3...v11.0.5), -[release](https://github.com/octokit/plugin-throttling.js/releases/tag/v11.0.5), -[implementation](https://github.com/octokit/plugin-throttling.js/blob/v11.0.5/src/index.ts). -The material runtime change defers Bottleneck instantiation until the first -request for Cloudflare Workers compatibility. Groups and the retry limiter are -initialized lazily; existing supplied limiters are preserved. The later patch -updates Octokit type dependencies to v17. No callback argument or return -contract change; Node >=20 and Octokit core >=7 are unchanged. - -Our `onRateLimit` reads `options.request.retryCount` and returns true while it -is <=2; `onSecondaryRateLimit` does not opt into retries. **Validation:** the -first real request succeeded after lazy initialization, a persistent primary -403 exhausted the existing policy after four total attempts, and a secondary -403 was returned after one attempt. Pagination still produced one combined -array. **No binding change required.** - -### @octokit/rest: 22.0.1 → 22.0.1 (foreign; already latest) - -Sources: [release](https://github.com/octokit/rest.js/releases/tag/v22.0.1), -[package definition](https://github.com/octokit/rest.js/blob/v22.0.1/package.json). -There is no direct-version source delta. The existing named `Octokit` export, -`.plugin()`, constructor auth/baseUrl options, `.request(route, args)` response -object and `.paginate(route, args)` array remain correct. Node >=20 is met. -The lock refresh updates compatible transitive packages; see the separate -Octokit transitive review below. **Validation:** the combined real HTTP probes -and the registry's GitHub integration paths, not only mocked unit tests. -**No binding change required.** - -### better-sqlite3: 13.0.3 → 13.0.3 (app and foreign; already latest) - -Sources: [release](https://github.com/WiseLibs/better-sqlite3/releases/tag/v13.0.3), -[API](https://github.com/WiseLibs/better-sqlite3/blob/v13.0.3/docs/api.md). -PR #802 already supplies this version. There is no new major-version -transition or source delta here. `app/src/App/SQLite.js` uses the default -Database export, synchronous constructor with `fileMustExist`/`verbose`, -`pragma`, prepared `.get/.all/.run` statements and synchronous `.transaction` -callbacks; these remain the v13 API. Statement result and error behavior are -unchanged. Node >=22 is required, and the addon must match Node's ABI. - -**Validation:** ordinary Nix npm packaging built successfully on Node -24.21.0; real SQLite job/deduplication tests, the server API integration and -VM smoke passed. No addon override was needed. **No binding change required.** -Darwin execution of this stack is still needed, despite PR #802's earlier -Apple Silicon validation. - -### fast-glob: 3.3.3 → 3.3.3 (foreign; already latest) - -Sources: [release](https://github.com/mrmlnc/fast-glob/releases/tag/3.3.3), -[API/options](https://github.com/mrmlnc/fast-glob/tree/3.3.3#api). -There is no direct source delta. `foreign/src/Foreign/FastGlob.js` imports the -default function and passes pattern arrays with cwd, ignore, file/directory, -case sensitivity, dotfile and uniqueness options. It still returns a Promise -of paths and rejects on filesystem errors. Node >=8.6 is met. `fastq` advances -1.20.1 → 1.20.3 and `picomatch` 2.3.1 → 2.3.2 within declared dependency ranges. - -**Validation:** real temporary files checked brace expansion, dotfiles and -ignore filtering; existing foreign glob tests and integration package-file -selection passed. **No binding change required.** The unresolved braces -security advisory below is not a successful security remediation claim. - -### fs-extra: 11.3.4 → 11.4.1 (foreign) - -Sources: [comparison](https://github.com/jprichardson/node-fs-extra/compare/11.3.4...11.4.1), -[complete interval changelog](https://github.com/jprichardson/node-fs-extra/blob/11.4.1/CHANGELOG.md). -11.3.5 fixes Windows identical-link detection, timestamp error handling and -synchronous descriptor cleanup; 11.3.6 prevents recursive copy/move through -symlinked destination ancestors; 11.4.0 reports EEXIST for a broken destination -symlink; 11.4.1 propagates emptyDir read errors and allows Unicode-normalization -renames on APFS. There is no change to defaults or exports of our APIs. - -`foreign/src/Foreign/FSExtra.js` uses named `ensureDir`, `remove`, and `copy` -from the package root, converting their Promises to Aff. `copy` passes the -Boolean `preserveTimestamps`; mkdir/remove return values are ignored. The -timestamp and symlink-copy fixes affect our possible inputs, not our calling -convention. We do not call move, emptyDir or ensureSymlink. Node >=14.14 is met. - -**Validation:** real directory creation/removal, copied bytes and preserved -mtime, ENOENT Promise rejection, and rejection of copying a directory through -a destination symlink back into itself. Integration package copies also passed. -**No binding change required.** APFS-specific rename behavior was not executed -on Linux and is not used by these bindings. - -### fuse.js: 7.1.0 → 7.5.0 (foreign) - -Sources: [comparison](https://github.com/krisk/Fuse/compare/v7.1.0...v7.5.0), -[changelog](https://github.com/krisk/Fuse/blob/v7.5.0/CHANGELOG.md). -7.2 adds runtime plugins, search caching/heap optimizations and match/index -fixes. 7.3 adds token search, static match and BigInt support, rewrites source -to TypeScript, removes UMD builds, changes removeAt's return, and makes empty -queries return all documents. 7.4 adds workers, token options and index/cache, -field-normalization, highlighting and worker-result fixes. 7.4.1/7.4.2 fix -declaration exports and move the build to tsdown. 7.5 fixes field word counts, -key-weight normalization, top-N tie selection and minMatchCharLength; upstream -explicitly warns that scores and ordering can change. - -`foreign/src/Foreign/SPDX.js` uses the default ESM Fuse constructor on a fixed -array of current/deprecated license strings with default options and maps -`search(identifier)` results' `item` field. No worker, token search, custom -weights, limit, mutation, highlights or UMD path is used. Constructor/result -shapes remain correct. Node >=10 is met. We accept corrected fuzzy scoring, -but an empty license must not suddenly suggest every license. - -**Binding adaptation:** return `[]` for the empty string. The existing public -`fuzzyMatchLicense` test now includes that input; before this guard it failed -with a list of suggested licenses, afterward it passed. A real-data probe -checked that **all 734 current/deprecated identifiers** remain their own top -exact result, and checked a misspelled BSD query. Existing Apache/BSD typo -tests remain unchanged. No scores or new private interaction tests were pinned. - -### jsonrepair: 3.13.3 → 3.15.0 (foreign) - -Sources: [comparison](https://github.com/josdejong/jsonrepair/compare/v3.13.3...v3.15.0), -[changelog](https://github.com/josdejong/jsonrepair/blob/v3.15.0/CHANGELOG.md). -3.14 repairs backslash-escaped newlines. 3.14.1 fixes invalid number repair, -unquoted strings beginning with a keyword, unescaped quotes before closing -characters/end-of-string, and nested trailing-comma repair. 3.15 adds -HTML-entity-encoded JSON repair and fixes infinite recursion for a string -followed by a backslash. Both regular and streaming implementations change. - -`foreign/src/Foreign/JsonRepair.js` only uses the synchronous named `jsonrepair` -function, passing a string and returning repaired text through `onSuccess` or -the existing `onError` value after a throw. No streaming, option, export or -async contract change. New repair capabilities are intentional improvements -for legacy input; actual quoted strings must still preserve literal entities. -No native requirement is introduced. - -**Validation:** entity-encoded JSON decodes `&` correctly; ordinary quoted -`&` stays literal; `[2., trueble]` repairs to numeric 2 and string -`trueble`; an outside-string backslash calls the failure branch rather than -recursing. Existing repair tests passed. **No binding change required.** - -### semver: 7.7.4 → 7.8.5 (foreign) - -Sources: [comparison](https://github.com/npm/node-semver/compare/v7.7.4...v7.8.5), -[changelog](https://github.com/npm/node-semver/blob/v7.8.5/CHANGELOG.md). -7.8 adds `truncate` and a CLI warning; 7.8.1 fixes prerelease subset logic and -strips build metadata before comparator trimming; 7.8.2 fixes incrementing -dotted prerelease identifiers; 7.8.3/7.8.5 correct caret/tilde lower bounds when -including prereleases; 7.8.4 rejects numeric components after wildcard -components. The remaining changes are documentation/development tooling. - -`foreign/src/Foreign/SemVer.js` uses default CJS-to-ESM import and synchronous -`validRange(string, { loose: true, includePrerelease: false })`, returning a -normalized comparator string or null. New functions/CLI and includePrerelease -true behavior are unused. Build metadata stripping and invalid wildcard -ordering are relevant input corrections. Node >=10 is met. - -**Validation:** exact normalized caret/loose-v results, build-metadata removal, -and `1.x.3` rejection; existing lenient-range public tests passed. -**No binding change required.** - -### tar: 7.5.21 → 7.5.22 (foreign) - -Sources: [comparison](https://github.com/isaacs/node-tar/compare/v7.5.21...v7.5.22), -[options source](https://github.com/isaacs/node-tar/blob/v7.5.22/src/options.ts). -The only functional-source delta broadens the TypeScript `transform` callback -return type to permit falsey values already accepted at runtime. It does not -change listing, extraction behavior, defaults or exports. - -`foreign/src/Foreign/Tar.js` uses named `list` with file, sync, filter and -onReadEntry options and consumes `entry.path`. It supplies no transform. -Execution stays synchronous with filesystem errors thrown. Node >=18 is met. -**Validation:** created a real gzip tarball, checked only the top-level -directory is returned and checked missing-file ENOENT; existing CLI archive -tests/integration passed. **No binding change required.** - -### tmp: 0.2.5 → 0.2.7 (foreign) - -Sources: [comparison](https://github.com/raszi/node-tmp/compare/v0.2.5...v0.2.7), -[implementation](https://github.com/raszi/node-tmp/blob/v0.2.7/lib/tmp.js). -0.2.6 uses relative-path containment checks instead of a raw prefix check. -0.2.7 rejects non-string prefix/postfix/template values and traversal substrings -that previously could evade validation. Generation and cleanup contracts remain -unchanged. - -`foreign/src/Foreign/Tmp.js` imports named `setGracefulCleanup` and `dirSync`, -enables cleanup once and always passes the literal string template `XXXXXX`. -It consumes the returned object's `name`. These inputs pass the stricter -validation; the API remains synchronous. Node >=14.14 is met. -**Validation:** a real directory was created; a child process using the binding -created an empty directory which was gone after graceful exit. Existing -temporary-directory users in tests passed. **No binding change required.** - -### yaml: 2.8.2 → 2.9.1 (app and foreign) - -Sources: [comparison](https://github.com/eemeli/yaml/compare/v2.8.2...v2.9.1), -[2.8.3](https://github.com/eemeli/yaml/releases/tag/v2.8.3), -[2.8.4](https://github.com/eemeli/yaml/releases/tag/v2.8.4), -[2.9.0](https://github.com/eemeli/yaml/releases/tag/v2.9.0), -[2.9.1](https://github.com/eemeli/yaml/releases/tag/v2.9.1). -2.8.3 adds a flow-stringification trailing-comma option and catches composition -stack overflow; 2.8.4 fixes alias-disable handling, invalid Unicode escapes and -decimal minFractionDigits. 2.9 avoids large-array push/apply and recursive lexer -stack exhaustion and **removes the documentation promise that parseDocument -never throws**. 2.9.1 limits recursive merge aliases and simplifies quoted-string -line unfolding. Stringification options and YAML 1.1 merge handling are unused -by our default parser. Node >=14.6 is met. - -`foreign/src/Foreign/Yaml.js` imports the default package object, calls -`parseDocument(string)`, checks `doc.errors`, and converts with `doc.toJSON()`. -Those methods and JSON shapes remain correct, but both parse and conversion -errors must stay inside `yamlParser :: String -> Either String JSON`. - -**Binding adaptation:** catch parse/conversion exceptions and return their -message through the failure callback, preserving existing doc.errors handling. -The success callback remains outside the catch. A real 11-by-11 alias expansion -previously threw `ReferenceError: Excessive alias count indicates a resource -exhaustion attack` past the public `parseYaml` interface; the new regression -test failed before the fix and passes after it. This uncaught conversion error -was also possible in the old dependency; the review found it while checking -the weakened upstream throwing guarantee, not as a new v2.9 invention. -Ordinary JSON values, malformed syntax and invalid Unicode were also exercised. - -### spdx-expression-parse: 4.0.0 → 5.0.0 (lib; major) - -Sources: [complete comparison](https://github.com/jslicense/spdx-expression-parse.js/compare/v4.0.0...v5.0.0), -[parser source](https://github.com/jslicense/spdx-expression-parse.js/blob/v5.0.0/parse.js). -There is no separate migration guide. Published package comparison shows the -entire parser delta: LicenseRef nodes can now carry a `WITH` exception, and -truncated DocumentRef input gets an explicit `Unexpected end of input` Error -instead of dereferencing a null token. The package version is the other delta; -scanner, entrypoint, dependency declarations and ordinary conjunction ASTs are -unchanged. It remains synchronous CJS with a default ESM interop import. - -`lib/src/License.js` reads leaf `license`, `plus`, optional `exception`, and -branch `left`, `right`, `conjunction`; it already understands the added optional -field and catches thrown parse errors. PureScript `Registry.License` still -requires recognized SPDX identifiers, so accepting LicenseRef WITH upstream -does not admit arbitrary custom licenses into registry manifests. - -**Validation:** actual v5 AST decoding preserved the LicenseRef exception; -truncated DocumentRef reached the error callback; public `License.parse` -continued to reject custom refs. Nested AND/OR round-tripping and deprecated -GPL-plus canonicalization passed, as did existing library tests. **No binding -change required despite the major.** - -### ssh2: 1.17.0 → 1.17.0 (lib; already latest) - -Sources: [tagged source](https://github.com/mscdex/ssh2/tree/v1.17.0), -[key-parser API](https://github.com/mscdex/ssh2/tree/v1.17.0#utilities). -There is no direct-version delta. `lib/src/SSH.js` uses the default CJS interop -import and `utils.parseKey(buffer, passphrase)`; parsed-key sign/verify, -type/comment, isPrivateKey, equals and getPublicSSH remain synchronous. -parseKey's possible Error/array results have not changed. Node >=10.16 is met. - -The lock refresh updates `nan` 2.25.0 → 2.29.0 for native-build compatibility: -[comparison](https://github.com/nodejs/nan/compare/v2.25.0...v2.29.0), -[changelog](https://github.com/nodejs/nan/blob/v2.29.0/CHANGELOG.md). -The interval adds V8 embedder/external-pointer type tags, fixes the associated -weak-pointer header/copy-paste issues and adds Node 26/V8 15.3 support; it does -not change the first-party JS API. The optional cpu-features version remains -0.0.10 and is omitted by Nix's existing `--omit=optional`. **Validation:** -existing real-key parsing/signing/verifying/ownership library tests and signed -integration operations passed under Node 24. **No binding change required.** - -## Material transitive changes - -### AWS runtime consolidation - -`@aws-sdk/core` 3.973.20 → 3.978.2, `@smithy/core` 3.23.11 → 3.35.2, -`@smithy/node-http-handler` 4.4.16 → 4.12.1, -`@smithy/fetch-http-handler` 5.3.15 → 5.8.0, -`@smithy/signature-v4` 5.3.12 → 5.7.4, -`@aws-sdk/middleware-sdk-s3` 3.972.20 → 3.972.78 and -`@aws-sdk/xml-builder` 3.972.11 → 3.972.41 accompany the generated-client change. -`@aws-sdk/checksums` 3.1001.2 is new. Many small AWS/Smithy packages and the -fast-xml-parser/fast-xml-builder/strnum chain disappear, being replaced by the -SDK's consolidated internal modules rather than our own replacements. -Credential-provider packages are refreshed, but our explicit static credential -object does not use their discovery chain. - -The S3 command/runtime source comparisons linked above show the moved checksum, -endpoint, retry and XML import paths and preserved command middleware settings. -The real-wire S3 checks specifically exercised those risky paths, including -signed request headers, XML scalar conversion, default checksums and an HTTP -200 error retry. No private AWS/Smithy submodule is imported by first-party FFI. - -### Octokit transport and types - -`@octokit/request` 10.0.8 → 10.0.16: -[comparison](https://github.com/octokit/request.js/compare/v10.0.8...v10.0.16). -Published fetch-wrapper changes replace fast-content-type-parse with -`content-type` 3.1.1, keep octet-stream responses binary even with utf-8 charset, -and safely extract errors from null/primitive JSON bodies. `.request` still -returns response headers/status/data and throws a RequestError for HTTP errors. -Real HTTP probes verified ordinary JSON, a null-bodied 401 error and binary -bytes `[0, 255, 128]` with a misleading charset. Our declared GitHub routes -consume JSON, including base64 repository content, not raw binary downloads. - -`@octokit/core` 7.0.6 → 7.0.8 and `@octokit/endpoint` 11.0.3 → 11.0.5 have no -published runtime-source difference except version constants; -`@octokit/request-error` 7.1.0 → 7.1.2 has no published runtime-source difference. -Sources: [core](https://github.com/octokit/core.js/compare/v7.0.6...v7.0.8), -[endpoint](https://github.com/octokit/endpoint.js/compare/v11.0.3...v11.0.5), -[request-error](https://github.com/octokit/request-error.js/compare/v7.1.0...v7.1.2). - -`json-with-bigint` 3.5.7 → 3.5.12 remains the transport's JSON codec. Sources: -[old published code](https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.7.tgz), -[new published code](https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.12.tgz). -The distribution adds iterative parse/reviver and stringify fallbacks for deep -objects, tightens string-marker regular expressions, and generates its CJS -distribution from ESM. Native context.source parsing and rawJSON serialization -remain fast paths. The real Octokit HTTP round-trip checked safe numeric -9007199254740991, positive/negative BigInt 9007199254740993, literal `123n` and -fractional values, then parsed a 10,000-deep array without losing its BigInt. -No user reviver/replacer or private codec API is exposed by our bindings. - -The root `@octokit/types` advances 16 → 18 and openapi-types 27 → 29.0.1; -retry/throttling resolve types 17/openapi-types 28 separately, while REST's -endpoint/pagination plugins retain their v16 declarations. These are -declaration-only packages, not new JS implementations or wire coercions. -No TypeScript declaration is used by the PureScript FFI. Real response, -error, retry and pagination checks establish compatibility independently of -those type versions. - -### SPDX data and glob security - -`spdx-license-ids` 3.0.23 → 3.0.24 is imported directly by our License/SPDX FFI -but supplied transitively by spdx-expression-parse. Published JSON comparison -adds 13 current identifiers and does not remove/reclassify old IDs or change -the deprecated list. Sources: [comparison](https://github.com/jslicense/spdx-license-ids/compare/v3.0.23...v3.0.24), -[current data](https://github.com/jslicense/spdx-license-ids/blob/v3.0.24/index.json). -All 734 current/deprecated exact fuzzy matches were checked; normal/canonical -license parser tests passed. This intentionally expands accepted current IDs. - -`picomatch` 2.3.1 → 2.3.2 adds null-prototype lookup tables and extglob -anti-ReDoS handling, fixing -[method injection](https://github.com/advisories/GHSA-3v7f-55p6-f55p) and -[extglob ReDoS](https://github.com/advisories/GHSA-c2c7-rcm5-vvqj). -Source: [comparison](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2). -Real glob checks and package inclusion/exclusion integration passed. Highly -complex nested extglob behavior can be restricted by the security fix; we do -not weaken it with a custom option or override. - -**Unresolved security limitation:** `npm audit` still reports three high-severity -package entries (`braces`, propagated to `micromatch` and `fast-glob`) for one -[deeply nested brace stack-exhaustion advisory](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm). -braces 3.0.3 and fast-glob 3.3.3 are already latest and npm reports no fix. -Manifest include/exclude patterns can reach glob processing, so this cannot be -dismissed as development-only. Thomas explicitly excluded remediation from this -task; it is recorded here, not a publication blocker. This PR does not claim a -clean security audit, silently pin an older release, or invent an override. - -## PureScript and tooling outcome - -Per Thomas's direction, use the latest package set, **68.1.1 → 81.4.0** (published -2026-10-09), not a solver migration or per-package overrides. Source: -[package set](https://github.com/purescript/registry/blob/main/package-sets/81.4.0.json). -Both Git overrides are removed because the set now provides published registry -packages at newer versions. Effective resolved package changes are: - -| Package | Old | New | -| --- | --- | --- | -| b64 | 0.0.8 | 0.0.9 | -| dodo-printer | Git v2.2.1 | registry 2.2.3 | -| encoding | 0.0.9 | 0.0.10 | -| http-methods | 6.0.0 | 6.1.0 | -| language-cst-parser | Git v0.13.0 | registry 0.14.1 | -| parsing | 10.3.0 | 11.0.0 | -| spec | 8.1.1 | 8.1.2 | - -Other edits in the lock's package-set snapshot describe packages this workspace -does not resolve; they are not additional installed upgrades. Some published -releases are newer than the set (for example node-path 6 and web-dom 7); retaining -the curated latest set rather than overriding those is intentional and explicit. -All seven workspace packages compile without warnings/errors. No dashboard -source, styles, Halogen, or DOM dependency version changed in the final stack. - -Tooling: PureScript 0.15.16 and Spago 1.0.4 already match npm latest and the -dashboard workflow pins. The dashboard bundle was built with both inherited -Nix esbuild 0.27.2 and npm latest esbuild **0.28.2**, matching the workflow's -unversioned install. The former remains part of the parent PR's Nix toolchain, -not an npm lock dependency upgraded here. Sources: -[esbuild comparison](https://github.com/evanw/esbuild/compare/v0.27.2...v0.28.2), -[0.28.0 notes](https://github.com/evanw/esbuild/releases/tag/v0.28.0), -[0.28.1 notes](https://github.com/evanw/esbuild/releases/tag/v0.28.1), -[0.28.2 notes](https://github.com/evanw/esbuild/releases/tag/v0.28.2). -The 0.28 transition adds text imports and integrity checking for fallback binary -downloads, updates Go, and fixes dev-server traversal, Deno integrity, JS/TS -tree shaking/printing/evaluation, CSS minification and output-overwrite handling. -Our CLI uses browser/Node bundling, distinct input/output paths and JSON import -attributes; it does not use Deno, wasm, text imports or CSS minification. Existing -CLI flags remain valid. No esbuild JS API binding or custom binary install exists. - -## Validation and limitations - -Executed on Chantilly, Linux x86_64, inherited Node 24.21.0/npm 11.19.0: - -- `spago build`: all seven workspace packages, zero warnings/errors. -- `spago test -p registry-lib`: **129/129**. -- `spago test -p registry-foreign`: **18/18**, including the empty-license - regression that failed before its binding fix. -- `spago test -p registry-app`: **153/153**, including the YAML regression - that threw before its binding fix. -- Targeted actual-dependency probes: **11/11 groups**, with assertions on - observable values and failures as described in each package section. Test - HTTP servers bound ephemeral loopback ports and were shut down afterward. -- Dashboard browser bundle: passed with esbuild 0.27.2 and 0.28.2. -- PureScript formatting check: passed. -- `nix flake check -L`: Linux `spago-test`, `nix-format`, `purescript-format`, - `verify-dhall`, `integration`, and `smoke`: **all six passed** on the final - binding changes. Integration passed **29/29** tests, uses isolated mocks, - and smoke uses a NixOS VM, not the shared interactive test environment. -- `npm outdated --json`: `{}`. `npm audit` is **not clean**: the three high - package entries described above remain without an available upstream fix. - -Darwin source compatibility is assessed, not executed: APIs remain portable, -Node requirements are met, no new platform-specific FFI or packaging override -was added, and both removed Spago Git dependencies now use registry tarballs. -The existing Darwin Spago cache-path handling remains intact. The unchanged -SQLite version still needs its native addon on the target Node ABI; fs-extra's -APFS-only fix was not exercised here. Thomas explicitly waived Darwin execution -for this task; it is not a publication blocker, and no Darwin test pass is -claimed. The dashboard workflow's Node 22 path was not separately executed -here. No push, PR publication, merge or deployment is part of these local -validation results. diff --git a/foreign/test/Foreign/SPDX.purs b/foreign/test/Foreign/SPDX.purs index 0cf36c1aa..ba3fef56d 100644 --- a/foreign/test/Foreign/SPDX.purs +++ b/foreign/test/Foreign/SPDX.purs @@ -44,6 +44,5 @@ fixable = unfixable :: Array String unfixable = - [ "" - , "MIT AND BSD-3" + [ "MIT AND BSD-3" ] From d90dc1f303aaf514f69a58c3d324aec7e70e90f1 Mon Sep 17 00:00:00 2001 From: Thomas Honeyman Date: Sun, 11 Oct 2026 08:55:35 -0400 Subject: [PATCH 3/3] Reject YAML aliases in registry manifests --- app/test/App/Manifest/SpagoYaml.purs | 15 ++++++++++----- foreign/src/Foreign/Yaml.js | 5 +++++ 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/app/test/App/Manifest/SpagoYaml.purs b/app/test/App/Manifest/SpagoYaml.purs index b3c83cff7..553c26b1a 100644 --- a/app/test/App/Manifest/SpagoYaml.purs +++ b/app/test/App/Manifest/SpagoYaml.purs @@ -28,16 +28,21 @@ spec = do Left err -> Assert.fail $ path <> " failed: " <> err Right _ -> pure unit - Spec.it "Returns a parse error when YAML aliases exceed the expansion limit" do + Spec.it "Rejects YAML aliases but accepts literal asterisks" do let input = """ - a: &a [1] - b: &b [*a, *a, *a, *a, *a, *a, *a, *a, *a, *a, *a] - c: [*b, *b, *b, *b, *b, *b, *b, *b, *b, *b, *b] + package: + name: &name example + description: *name + dependencies: [] """ + literalInput = String.replace (String.Pattern "*name") (String.Replacement "'*name'") input - parseYaml SpagoYaml.spagoYamlCodec input `Assert.shouldSatisfy` isLeft + parseYaml SpagoYaml.spagoYamlCodec input `Assert.shouldEqual` Left "YAML: YAML aliases are not supported" + case parseYaml SpagoYaml.spagoYamlCodec literalInput of + Left err -> Assert.fail err + Right config -> (config.package >>= _.description) `Assert.shouldEqual` Just "*name" Spec.it "Rejects deprecated SPDX identifiers in publish config" do let diff --git a/foreign/src/Foreign/Yaml.js b/foreign/src/Foreign/Yaml.js index fd5154e62..727d60dfd 100644 --- a/foreign/src/Foreign/Yaml.js +++ b/foreign/src/Foreign/Yaml.js @@ -8,6 +8,11 @@ export function yamlDocParserImpl(fail, succ, s) { // TODO: eh, we should return properly structured errors here return fail(JSON.stringify(doc.errors)); } + Yaml.visit(doc, { + Alias() { + throw new Error('YAML aliases are not supported'); + } + }); value = doc.toJSON(); } catch (error) { return fail(error instanceof Error ? error.message : String(error));