From a8d7e4ef5d115d3076c00b52057dbee4781d382d Mon Sep 17 00:00:00 2001 From: Will Manning Date: Thu, 29 Oct 2026 21:35:17 -0400 Subject: [PATCH 1/4] chore: run CI, types and both Vercel projects on Node 26 Vercel now offers Node 26.x as its default. `engines.node` was ">=24", which Vercel resolves to the newest major it offers, so the site's production builds already ran on 26 while CI tested on 24 and the types matched 24. bench, which deploys prebuilt output, followed its project setting and ran on 24. Align everything on 26: - .nvmrc 26, so CI tests on the production runtime. - engines.node "26.x", so a later major arrives as a deliberate change rather than silently ahead of CI. - @types/node ^26.6.5 in both apps, and Renovate's cap raised to <27. - Both Vercel projects set to 26.x (done in the dashboard API). A local `vercel build` of bench confirms its functions follow that setting: 24.x gives nodejs24.x, 26.x gives nodejs26.x. - CLAUDE.md's Node section now describes 26 and why the range is pinned to one major. On Node 26.11.1: Biome, both builds, the site typecheck and bench's tests (662 passed; the Postgres suite skips without Docker) pass. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Will Manning --- .nvmrc | 2 +- CLAUDE.md | 14 +++++++------- bench/web/package.json | 2 +- bun.lock | 8 ++++---- package.json | 4 ++-- renovate.json | 4 ++-- 6 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.nvmrc b/.nvmrc index a45fd52..6f4247a 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -24 +26 diff --git a/CLAUDE.md b/CLAUDE.md index ef77a71..88afd40 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -93,13 +93,13 @@ Defense in depth against the npm-worm class (Shai-Hulud, mini-Shai-Hulud, the Ma ### Node version -Three places must agree, and **Vercel sets the ceiling**: it offers only Node 20.x / 22.x / 24.x, so 24 is the newest deployable major. All three are aligned on it: +Three places must agree with each other and with what Vercel runs. Vercel offers Node 22.x, 24.x and 26.x, with 26 the default, and all three are aligned on 26: -- `.nvmrc` → `24`, which both CI workflows read via `actions/setup-node`'s `node-version-file`. -- `package.json` → `engines.node = ">=24"`. Vercel resolves this range against the versions it actually offers and it **overrides the dashboard setting**, so a range no available version satisfies (e.g. `">=26"`) fails the deploy outright rather than falling back. -- `@types/node` → `^24`, matching the runtime so `tsc` cannot green-light an API that production does not have. +- `.nvmrc` → `26`, which the CI workflows read via `actions/setup-node`'s `node-version-file`. +- `package.json` → `engines.node = "26.x"`. Vercel resolves this range against the versions it offers, and it **overrides the dashboard setting**. An open range such as `">=24"` silently moves production to each new major Vercel adds, ahead of CI: that is how production reached 26 while CI still ran 24. A range no offered version satisfies fails the deploy outright. Both Vercel projects are also set to 26.x, so the setting and the range agree. +- `@types/node` → `^26`, matching the runtime so `tsc` cannot green-light an API that production does not have. -Keep them in lockstep when bumping. Raising `.nvmrc` alone makes CI validate against a runtime newer than production — APIs added after 24 would pass CI and fail in prod. Node 26 is not deployable until Vercel adds 26.x (it reaches LTS in October 2026); check https://vercel.com/docs/functions/runtimes/node-js/node-js-versions before moving. +Keep them in lockstep when bumping, and move to a new major only after Vercel offers it; check https://vercel.com/docs/functions/runtimes/node-js/node-js-versions first. 10. **Renovate auto-merge** is patch + minor only via `:automergeStableNonMajor`. Major bumps stay open for human review. The 7-day cooldown is the first gate, and the required checks on `main` are the second. Renovate merges through GitHub's auto-merge, which waits only for required checks: `Lint, build, verify` (lint, typecheck, build, `bun run verify` and Playwright), `dependency-review`, `secret-scan`, `DCO`, `REUSE compliance`, `Submit bun.lock`, `Bench: format, lint, build, test`, `Bench: deploy` and `Vercel`, plus a CodeQL code scanning rule. Lighthouse and `bun audit` are not required, so they don't hold an auto-merge. ### bench/ (Bun workspace member) @@ -111,7 +111,7 @@ Keep them in lockstep when bumping. Raising `.nvmrc` alone makes CI validate aga - **Lifecycle scripts.** pnpm's `allowBuilds` let `sharp` build (and `unrs-resolver`, which left with ESLint). `trustedDependencies` already trusts `sharp`, and stays `["esbuild", "sharp"]`. Bun blocks three bench scripts, `protobufjs`, `ssh2` and `cpu-features`, which pnpm blocked too. With the isolated linker, `bun pm untrusted` lists only packages linked at the top of `node_modules`, so it reports none of them; to audit, install once with `bun install --linker hoisted` in a scratch copy and run it there. - **Deploy CLI:** `bench-deploy.yml` installs the Vercel CLI from `.github/vercel-cli` with `npm ci --ignore-scripts`. Its `package.json` pins the version, and its `package-lock.json` locks the whole tree. That job holds `VERCEL_TOKEN`. The lockfile is npm's, not Bun's, so GitHub's dependency graph, Dependabot and dependency review read it natively. To change it, run `npm install --package-lock-only --ignore-scripts --before=<7 days ago>` in that directory (Renovate passes the same `--before`), then `npm audit`. Its `overrides` patch advisories in dependencies the CLI pins; see "bench advisories". - **Renovate** keeps bench's updates in their own `bench-` branches (it matches `bench/web/package.json`; the lockfile they change is the shared `bun.lock`, which lock file maintenance refreshes for both apps at once). They automerge like the site's (patch and minor), because `Bench: format, lint, build, test` is a required check. That includes the Vercel CLI in `.github/vercel-cli`: `Bench: deploy` is also required, so a CLI update merges only after a real preview deploy with it succeeds. -- **Node:** `bench-ci.yml` and `bench-deploy.yml` read `.nvmrc`. Keep `@types/node` in `bench/web/package.json` and the `benchmarks-website` Vercel project's Node version on the same major. +- **Node:** `bench-ci.yml` and `bench-deploy.yml` read `.nvmrc`. Keep `@types/node` in `bench/web/package.json` and the `benchmarks-website` Vercel project's Node version (26.x) on the same major. bench deploys prebuilt output, so the project setting, not `engines`, picks its function runtime. - **Audit:** `bun audit` at the root covers bench; see "bench advisories" below. ### Audit advisories @@ -128,7 +128,7 @@ Keep them in lockstep when bumping. Raising `.nvmrc` alone makes CI validate aga **Removed: `@lhci/cli`.** It brought eight advisories into `bun.lock`: extract-zip (two, with no fixed release), basic-ftp, body-parser, qs, tmp (two) and uuid. CI never used it, because the Lighthouse workflow runs `treosh/lighthouse-ci-action`, which ships its own copy. `bun run lighthouse` now fetches a pinned `@lhci/cli@0.15.1` with `bunx` when you run it. Do not add it back as a dependency. -**Held back on purpose:** `@types/node` stays on `^24` to match the deployable runtime (see "Node version"); `renovate.json` caps it with `allowedVersions: "<25"` so Renovate stops opening 25.x / 26.x PRs. +**Held back on purpose:** `@types/node` stays on `^26` to match the runtime (see "Node version"); `renovate.json` caps it with `allowedVersions: "<27"` so Renovate does not open 27.x / 28.x PRs ahead of the runtime. The `audit` job in `.github/workflows/ci.yml` runs a bare `bun audit` and never fails CI; any advisory it finds shows in its job summary, and is recorded here with how it is handled. Merge blocking on advisories is `dependency-review`'s job. diff --git a/bench/web/package.json b/bench/web/package.json index 42ac33b..43cd045 100644 --- a/bench/web/package.json +++ b/bench/web/package.json @@ -23,7 +23,7 @@ }, "devDependencies": { "@testcontainers/postgresql": "^12.0.1", - "@types/node": "^24.19.2", + "@types/node": "^26.6.5", "@types/pg": "^8.23.1", "@types/react": "^19.3.0", "@types/react-dom": "^19.3.0", diff --git a/bun.lock b/bun.lock index a8f2d6f..70fd385 100644 --- a/bun.lock +++ b/bun.lock @@ -21,7 +21,7 @@ "@biomejs/biome": "^2.5.15", "@playwright/test": "^1.64.0", "@tailwindcss/postcss": "4.3.3", - "@types/node": "^24.19.2", + "@types/node": "^26.6.5", "@types/react": "^19.3.0", "@types/react-dom": "^19.3.0", "tailwindcss": "4.3.3", @@ -42,7 +42,7 @@ }, "devDependencies": { "@testcontainers/postgresql": "^12.0.1", - "@types/node": "^24.19.2", + "@types/node": "^26.6.5", "@types/pg": "^8.23.1", "@types/react": "^19.3.0", "@types/react-dom": "^19.3.0", @@ -391,7 +391,7 @@ "@types/ms": ["@types/ms@2.1.0", "", {}, "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA=="], - "@types/node": ["@types/node@24.19.2", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-93d49wCWJkCyN87MxLpNN6KXPCwFw7bVUg79mGUV1OS40JGWwVCr8n61DXCSqz7CV6/VfPkb7xec7uP2M+QHWQ=="], + "@types/node": ["@types/node@26.6.5", "", { "dependencies": { "undici-types": "~8.9.0" } }, "sha512-uMzsv9stDdofIZBx4UGh4Z9ZgXnGC9seRDscilBcTHAeOFk67MZg/k9bWVfO+bk4qZmG+l52hRnLwUiH2LnJTg=="], "@types/pg": ["@types/pg@8.23.1", "", { "dependencies": { "@types/node": "*", "pg-protocol": "*", "pg-types": "^2.2.0" } }, "sha512-fKVHpikPdg4GKks3JuLEhvwSyvwzF23hnabPy6DD8ljVbC7+6J5dQzdv4arV6jqq57djnMgs1HKBxX4P8aBI3A=="], @@ -1103,7 +1103,7 @@ "undici": ["undici@8.12.2", "", {}, "sha512-XtuDWVdqTLr3NAxm2ly9/hU6kUsJOgGh1RASzMBbsw6aWCOaQzHdW+QQDfdERjfJ2V5vL5pRPa4RetO9UfivDg=="], - "undici-types": ["undici-types@7.24.6", "", {}, "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg=="], + "undici-types": ["undici-types@8.9.0", "", {}, "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg=="], "unified": ["unified@11.0.5", "", { "dependencies": { "@types/unist": "^3.0.0", "bail": "^2.0.0", "devlop": "^1.0.0", "extend": "^3.0.0", "is-plain-obj": "^4.0.0", "trough": "^2.0.0", "vfile": "^6.0.0" } }, "sha512-xKvGhPWw3k84Qjh8bI3ZeJjqnyadK+GEFtazSfZv/rKeTkTjOJho6mFqh2SM96iIcZokxiOpg78GazTSg8+KHA=="], diff --git a/package.json b/package.json index 83cdc6a..ddc9e03 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ ], "packageManager": "bun@1.4.3", "engines": { - "node": ">=24", + "node": "26.x", "bun": ">=1.3.0" }, "scripts": { @@ -42,7 +42,7 @@ "@biomejs/biome": "^2.5.15", "@playwright/test": "^1.64.0", "@tailwindcss/postcss": "4.3.3", - "@types/node": "^24.19.2", + "@types/node": "^26.6.5", "@types/react": "^19.3.0", "@types/react-dom": "^19.3.0", "tailwindcss": "4.3.3", diff --git a/renovate.json b/renovate.json index ad28bb1..b461d49 100644 --- a/renovate.json +++ b/renovate.json @@ -26,9 +26,9 @@ }, "packageRules": [ { - "description": "Hold @types/node to the deployable Node major (Vercel tops out at 24). Raise in lockstep with .nvmrc and engines.node.", + "description": "Hold @types/node to the Node major that production and CI run (26). Raise in lockstep with .nvmrc and engines.node.", "matchPackageNames": ["@types/node"], - "allowedVersions": "<25" + "allowedVersions": "<27" }, { "groupName": "Next.js", From 8f6789af88e6fc4c77f56674404991e6a82af9de Mon Sep 17 00:00:00 2001 From: Will Manning Date: Thu, 29 Oct 2026 21:43:28 -0400 Subject: [PATCH 2/4] docs: keep bench's Vercel project on Node 24 until CLI 65.8.0 Vercel requires CLI 65.8.0 or later to deploy Node 26 functions from prebuilt output, and bench deploys prebuilt output with 65.2.0. 65.8.0 was published on 2026-10-29, inside the 7-day cooldown, so the benchmarks-website project goes back to 24.x (done in the API) until Renovate's CLI bump lands after 2026-11-05. The site builds through Vercel's git integration, not our CLI, so it stays on 26.x. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Will Manning --- CLAUDE.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 88afd40..b71d233 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -96,7 +96,7 @@ Defense in depth against the npm-worm class (Shai-Hulud, mini-Shai-Hulud, the Ma Three places must agree with each other and with what Vercel runs. Vercel offers Node 22.x, 24.x and 26.x, with 26 the default, and all three are aligned on 26: - `.nvmrc` → `26`, which the CI workflows read via `actions/setup-node`'s `node-version-file`. -- `package.json` → `engines.node = "26.x"`. Vercel resolves this range against the versions it offers, and it **overrides the dashboard setting**. An open range such as `">=24"` silently moves production to each new major Vercel adds, ahead of CI: that is how production reached 26 while CI still ran 24. A range no offered version satisfies fails the deploy outright. Both Vercel projects are also set to 26.x, so the setting and the range agree. +- `package.json` → `engines.node = "26.x"`. Vercel resolves this range against the versions it offers, and it **overrides the dashboard setting**. An open range such as `">=24"` silently moves production to each new major Vercel adds, ahead of CI: that is how production reached 26 while CI still ran 24. A range no offered version satisfies fails the deploy outright. The `vortex` project is also set to 26.x, so the setting and the range agree. bench is the exception, below. - `@types/node` → `^26`, matching the runtime so `tsc` cannot green-light an API that production does not have. Keep them in lockstep when bumping, and move to a new major only after Vercel offers it; check https://vercel.com/docs/functions/runtimes/node-js/node-js-versions first. @@ -111,7 +111,7 @@ Keep them in lockstep when bumping, and move to a new major only after Vercel of - **Lifecycle scripts.** pnpm's `allowBuilds` let `sharp` build (and `unrs-resolver`, which left with ESLint). `trustedDependencies` already trusts `sharp`, and stays `["esbuild", "sharp"]`. Bun blocks three bench scripts, `protobufjs`, `ssh2` and `cpu-features`, which pnpm blocked too. With the isolated linker, `bun pm untrusted` lists only packages linked at the top of `node_modules`, so it reports none of them; to audit, install once with `bun install --linker hoisted` in a scratch copy and run it there. - **Deploy CLI:** `bench-deploy.yml` installs the Vercel CLI from `.github/vercel-cli` with `npm ci --ignore-scripts`. Its `package.json` pins the version, and its `package-lock.json` locks the whole tree. That job holds `VERCEL_TOKEN`. The lockfile is npm's, not Bun's, so GitHub's dependency graph, Dependabot and dependency review read it natively. To change it, run `npm install --package-lock-only --ignore-scripts --before=<7 days ago>` in that directory (Renovate passes the same `--before`), then `npm audit`. Its `overrides` patch advisories in dependencies the CLI pins; see "bench advisories". - **Renovate** keeps bench's updates in their own `bench-` branches (it matches `bench/web/package.json`; the lockfile they change is the shared `bun.lock`, which lock file maintenance refreshes for both apps at once). They automerge like the site's (patch and minor), because `Bench: format, lint, build, test` is a required check. That includes the Vercel CLI in `.github/vercel-cli`: `Bench: deploy` is also required, so a CLI update merges only after a real preview deploy with it succeeds. -- **Node:** `bench-ci.yml` and `bench-deploy.yml` read `.nvmrc`. Keep `@types/node` in `bench/web/package.json` and the `benchmarks-website` Vercel project's Node version (26.x) on the same major. bench deploys prebuilt output, so the project setting, not `engines`, picks its function runtime. +- **Node:** `bench-ci.yml` and `bench-deploy.yml` read `.nvmrc`. bench deploys prebuilt output, so the `benchmarks-website` project's Node setting, not `engines`, picks its function runtime. That setting stays on **24.x** until `.github/vercel-cli` reaches Vercel CLI 65.8.0: Vercel requires 65.8.0 or later to deploy Node 26 functions from prebuilt output, and 65.8.0 clears the 7-day cooldown on 2026-11-05. When Renovate's CLI bump lands, set the project to 26.x (`vercel api /v9/projects/benchmarks-website -X PATCH -F nodeVersion=26.x --scope vortex-data`) and drop this note. - **Audit:** `bun audit` at the root covers bench; see "bench advisories" below. ### Audit advisories From d52452aab3d55969abda1141853d28c8025fc8f8 Mon Sep 17 00:00:00 2001 From: Will Manning Date: Thu, 29 Oct 2026 21:52:21 -0400 Subject: [PATCH 3/4] ci(bench): keep bench's checks and prebuilt build on Node 24 bench's functions run on Node 24 until its Vercel project moves to 26.x, but its checks and its prebuilt `vercel build` read the shared .nvmrc, now 26. Code or a dependency that relies on Node 26 behavior could pass both and then fail on the deployed Node 24 runtime. Pin both setups to 24 until the switch; CLAUDE.md lists the step to point them back at .nvmrc. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Will Manning --- .github/actions/bench-checks/action.yml | 7 ++++--- .github/workflows/bench-deploy.yml | 5 ++++- CLAUDE.md | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/actions/bench-checks/action.yml b/.github/actions/bench-checks/action.yml index a256577..6d3b50b 100644 --- a/.github/actions/bench-checks/action.yml +++ b/.github/actions/bench-checks/action.yml @@ -27,9 +27,10 @@ runs: - name: Setup Node uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - # The repository-wide Node pin (see CLAUDE.md "Node version"). Keep - # @types/node in bench/web/package.json on the same major. - node-version-file: .nvmrc + # bench's functions still run on Node 24 (see CLAUDE.md, bench/), so + # its checks do too. Return to `node-version-file: .nvmrc` when the + # benchmarks-website project moves to 26.x. + node-version: "24" # Bun's package store, keyed on the lockfile, as in ci.yml. The restore # key falls back to any earlier cache from this OS. diff --git a/.github/workflows/bench-deploy.yml b/.github/workflows/bench-deploy.yml index 476b6c2..b291338 100644 --- a/.github/workflows/bench-deploy.yml +++ b/.github/workflows/bench-deploy.yml @@ -152,7 +152,10 @@ jobs: - name: Setup Node uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version-file: .nvmrc + # The prebuilt build runs on the Node major its functions run on: + # 24 until the benchmarks-website project moves to 26.x (see + # CLAUDE.md, bench/). Then return to `node-version-file: .nvmrc`. + node-version: "24" # .github/vercel-cli pins the CLI and locks its whole dependency tree. Its # overrides patch advisories in dependencies the CLI pins (see CLAUDE.md diff --git a/CLAUDE.md b/CLAUDE.md index bd17aef..d53d2b9 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -111,7 +111,7 @@ Keep them in lockstep when bumping, and move to a new major only after Vercel of - **Lifecycle scripts.** pnpm's `allowBuilds` let `sharp` build (and `unrs-resolver`, which left with ESLint). `trustedDependencies` already trusts `sharp`, and stays `["esbuild", "sharp"]`. Bun blocks three bench scripts, `protobufjs`, `ssh2` and `cpu-features`, which pnpm blocked too. With the isolated linker, `bun pm untrusted` lists only packages linked at the top of `node_modules`, so it reports none of them; to audit, install once with `bun install --linker hoisted` in a scratch copy and run it there. - **Deploy CLI:** `bench-deploy.yml` installs the Vercel CLI from `.github/vercel-cli` with `npm ci --ignore-scripts`. Its `package.json` pins the version, and its `package-lock.json` locks the whole tree. That job holds `VERCEL_TOKEN`. The lockfile is npm's, not Bun's, so GitHub's dependency graph, Dependabot and dependency review read it natively. To change it, run `npm install --package-lock-only --ignore-scripts --before=<7 days ago>` in that directory (Renovate passes the same `--before`), then `npm audit`. Its `overrides` patch advisories in dependencies the CLI pins; see "bench advisories". - **Renovate** keeps bench's updates in their own `bench-` branches (it matches `bench/web/package.json`; the lockfile they change is the shared `bun.lock`, which lock file maintenance refreshes for both apps at once). They automerge like the site's (patch and minor), because `Bench: format, lint, build, test` is a required check. That includes the Vercel CLI in `.github/vercel-cli`: `Bench: deploy` is also required, so a CLI update merges only after a real preview deploy with it succeeds. -- **Node:** `bench-ci.yml` and `bench-deploy.yml` read `.nvmrc`. bench deploys prebuilt output, so the `benchmarks-website` project's Node setting, not `engines`, picks its function runtime. That setting stays on **24.x** until `.github/vercel-cli` reaches Vercel CLI 65.8.0: Vercel requires 65.8.0 or later to deploy Node 26 functions from prebuilt output, and 65.8.0 clears the 7-day cooldown on 2026-11-05. Until then, bench's `@types/node` stays on `^24` too, held there by a `renovate.json` rule, so its code can't use a Node 26 API that its runtime lacks. When Renovate's CLI bump lands, set the project to 26.x (`vercel api /v9/projects/benchmarks-website -X PATCH -F nodeVersion=26.x --scope vortex-data`), move bench's `@types/node` to `^26`, drop that rule and drop this note. +- **Node:** bench deploys prebuilt output, so the `benchmarks-website` project's Node setting, not `engines`, picks its function runtime. That setting stays on **24.x** until `.github/vercel-cli` reaches Vercel CLI 65.8.0: Vercel requires 65.8.0 or later to deploy Node 26 functions from prebuilt output, and 65.8.0 clears the 7-day cooldown on 2026-11-05. Until then, bench's checks (`.github/actions/bench-checks`) and its prebuilt build in `bench-deploy.yml` run on Node 24 rather than `.nvmrc`, and its `@types/node` stays on `^24`, held there by a `renovate.json` rule, so its code can't use a Node 26 API that its runtime lacks. When Renovate's CLI bump lands, set the project to 26.x (`vercel api /v9/projects/benchmarks-website -X PATCH -F nodeVersion=26.x --scope vortex-data`), point both Node setups back at `.nvmrc`, move bench's `@types/node` to `^26`, drop that rule and drop this note. - **Audit:** `bun audit` at the root covers bench; see "bench advisories" below. ### Audit advisories From 126b779d82581bfaf7ac77a3f0dcefd5d1ee3b3e Mon Sep 17 00:00:00 2001 From: Will Manning Date: Thu, 29 Oct 2026 21:56:31 -0400 Subject: [PATCH 4/4] feat(bench): move bench to Node 26 with Vercel CLI 65.8.0 Vercel requires CLI 65.8.0 or later to deploy Node 26 functions from prebuilt output. Adopt it now, a week inside the 7-day cooldown, with maintainer approval, instead of holding bench on Node 24 until 2026-11-05. That removes the temporary bench exceptions: - .github/vercel-cli pins vercel 65.8.0. Every package younger than 7 days comes from that Vercel release (vercel, the @vercel/* builders, the vc-native binaries and Vercel's sandbox). Two third-party ones are held to older releases by exact overrides, @napi-rs/wasm-runtime 1.2.5 and @types/estree 1.0.9. npm audit reports none. - bench's checks and prebuilt build read .nvmrc again, its @types/node is ^26, and the Renovate hold on bench's types is gone. - The benchmarks-website project is set to 26.x (done in the API). A local `vercel build` of bench with CLI 65.8.0 on Node 26 emits nodejs26.x functions. On Node 26, Biome, the bench build and its 662 tests pass. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Will Manning --- .github/actions/bench-checks/action.yml | 7 +- .github/vercel-cli/package-lock.json | 802 ++++++++++++++++++------ .github/vercel-cli/package.json | 4 +- .github/workflows/bench-deploy.yml | 5 +- CLAUDE.md | 10 +- bench/web/package.json | 2 +- bun.lock | 6 +- renovate.json | 6 - 8 files changed, 623 insertions(+), 219 deletions(-) diff --git a/.github/actions/bench-checks/action.yml b/.github/actions/bench-checks/action.yml index 6d3b50b..a256577 100644 --- a/.github/actions/bench-checks/action.yml +++ b/.github/actions/bench-checks/action.yml @@ -27,10 +27,9 @@ runs: - name: Setup Node uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - # bench's functions still run on Node 24 (see CLAUDE.md, bench/), so - # its checks do too. Return to `node-version-file: .nvmrc` when the - # benchmarks-website project moves to 26.x. - node-version: "24" + # The repository-wide Node pin (see CLAUDE.md "Node version"). Keep + # @types/node in bench/web/package.json on the same major. + node-version-file: .nvmrc # Bun's package store, keyed on the lockfile, as in ci.yml. The restore # key falls back to any earlier cache from this OS. diff --git a/.github/vercel-cli/package-lock.json b/.github/vercel-cli/package-lock.json index 2c0d7f0..8c5e619 100644 --- a/.github/vercel-cli/package-lock.json +++ b/.github/vercel-cli/package-lock.json @@ -6,7 +6,7 @@ "": { "name": "bench-vercel-cli", "dependencies": { - "vercel": "65.2.0" + "vercel": "65.8.0" } }, "node_modules/@bytecodealliance/preview2-shim": { @@ -525,6 +525,326 @@ "node": ">=18.0.0" } }, + "node_modules/@koromix/koffi-android-arm64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-android-arm64/-/koffi-android-arm64-3.3.3.tgz", + "integrity": "sha512-c8iDq/mPXkgQmrmZ6SpqWIVF3ZnJEpjVQswzKzbrCSdr68pmSY/cNj1t4qvv32T8nNjW71/hB+E8Rq1+vVpmQg==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "android" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-android-x64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-android-x64/-/koffi-android-x64-3.3.3.tgz", + "integrity": "sha512-yAFu4oX6rpBCqr4HiGo3FpywmRN11LOSde4+GJZvfkFymqV3wZtx6TgVe8rZ4ogJZz9B8o1tDeKsZ6pqeoH40g==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "android" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-darwin-arm64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-darwin-arm64/-/koffi-darwin-arm64-3.3.3.tgz", + "integrity": "sha512-aFYI3YMdQWOAmHlVA+GfBlJZTpvfbUv/NoeBBkqblWN7BxuY02bkWMyoksUEl+mnx7ScoMonnjzXKJkNQXmR3w==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-darwin-x64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-darwin-x64/-/koffi-darwin-x64-3.3.3.tgz", + "integrity": "sha512-6Q8/DDhVADPMm3lFnZFJRETJtf485jZKzn1KogXeA9Gfztv/XMFiCOK4aEouFc256h9uWzC69mGimtcVcwK+Ww==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-freebsd-arm64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-freebsd-arm64/-/koffi-freebsd-arm64-3.3.3.tgz", + "integrity": "sha512-IynEDMMU9pp7EVVqQwXVU9x0JH7Opj8KB0wbcKgYNEhRM9eGzJ4ai7iwG8y8tdD/Y8niSVrVTj5WLNCCvUWXIw==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "freebsd" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-freebsd-ia32": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-freebsd-ia32/-/koffi-freebsd-ia32-3.3.3.tgz", + "integrity": "sha512-5b4W9jX+wmfWn9vG7DvKIrNhhRpPDAx7YQV5i9epUR0Ogxz4s4a3APz/beLCvgHt4WhaSRrazxGYQz1oFOlfow==", + "cpu": [ + "ia32" + ], + "license": "MIT", + "optional": true, + "os": [ + "freebsd" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-freebsd-x64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-freebsd-x64/-/koffi-freebsd-x64-3.3.3.tgz", + "integrity": "sha512-+NmMrp3ji1NN4PTaLaXDCKMaJ5Fl+0+nrClmtsu/7wi+fjCrCSGMrJZUmTIJPm1nd8Z5fMRjWesiVvQiy/ETDg==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "freebsd" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-linux-arm": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-linux-arm/-/koffi-linux-arm-3.3.3.tgz", + "integrity": "sha512-K+NFO4/SiF4ANCS1ykem36wbEjfBJKsaakLKZ+6LbaLqyLjHHGky4fEIgipac/+XJtD4ZXjhexPIVjwzkO+rMQ==", + "cpu": [ + "arm" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-linux-arm64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-linux-arm64/-/koffi-linux-arm64-3.3.3.tgz", + "integrity": "sha512-y7UHjwOKbj2IjIpWtHmI8LEKXchidt47k605DCv5+YQMIDTbzhz/i3zTI1kRp6EYBLTBwRkR1X1PGt3uUi+rKQ==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-linux-ia32": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-linux-ia32/-/koffi-linux-ia32-3.3.3.tgz", + "integrity": "sha512-dbcpe7IrWr18AAbIKa/RvJ8pM1lEpSELWYW6wsEBIYw/RTLfXqWJ6d9Ya0NWJgHTW+N7783KVQaV5c1Sr3ONDQ==", + "cpu": [ + "ia32" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-linux-loong64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-linux-loong64/-/koffi-linux-loong64-3.3.3.tgz", + "integrity": "sha512-kbJFmWSoDHGZgxgDhInuvDi8MzrHafBfQ7iWN5P+nHv297beQXrHecFfCNBApnG9d2wrhEoY+EH/TdITuvaSwQ==", + "cpu": [ + "loong64" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-linux-ppc64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-linux-ppc64/-/koffi-linux-ppc64-3.3.3.tgz", + "integrity": "sha512-YwGxjudYHsiDZ6qH4WmEawHXmTaZzjiZ4xdjcbzsVHqNvgZ3Nz7WG03PybecJ+BVH2vqBOntGZ2VsG/sL0WY1g==", + "cpu": [ + "ppc64" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-linux-riscv64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-linux-riscv64/-/koffi-linux-riscv64-3.3.3.tgz", + "integrity": "sha512-k/txpUsOO/L4TexahQHxqdFRmBEGE+g++np9M5eNcsHWNXmazeWBrrfB9sjl6cZAP69KZFO0toP+ZMfDUDHmnQ==", + "cpu": [ + "riscv64" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-linux-x64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-linux-x64/-/koffi-linux-x64-3.3.3.tgz", + "integrity": "sha512-AI4kcNNWeGmzQzsNb0S+ZL/ht4HMtDcQl5nYFkkuVUO2g1/2KdvNekkwNWhpp805mDbLSDoRZtlioHyH/v8poQ==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-openbsd-arm64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-openbsd-arm64/-/koffi-openbsd-arm64-3.3.3.tgz", + "integrity": "sha512-NEbQMrixbAWSmWCh4XyHWuhgEqgO4tegWyHoJej7Q3PmyIlgxKHTcRZsjAJ9C3sfgBDNIqPWTjMy3KO2mqEp1g==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "openbsd" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-openbsd-ia32": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-openbsd-ia32/-/koffi-openbsd-ia32-3.3.3.tgz", + "integrity": "sha512-zGFX0KwZGmrV7AZY0+oozBpMuQZT7yQEY3NCDSb0rEqKyOrYLBNiXiXA5T8NSY3ipaW0b71L5Cu0KLKabdLY0A==", + "cpu": [ + "ia32" + ], + "license": "MIT", + "optional": true, + "os": [ + "openbsd" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-openbsd-x64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-openbsd-x64/-/koffi-openbsd-x64-3.3.3.tgz", + "integrity": "sha512-c1HMWkZPAZKQesKj2HqA6Zk1YEcv7Doc6JU9YJepXG8KpK4XZmI0L5vESSfySmidmasm05QDyLAcwDnNSvtfRA==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "openbsd" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-win32-arm64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-win32-arm64/-/koffi-win32-arm64-3.3.3.tgz", + "integrity": "sha512-eL7gW4D22OBb3fi04s5ElzzNk+gkGEahaTNMB29UDLDeORe+0qIkhccBPovXW3/IRpdt8W7o8X2myUDXlTSYDQ==", + "cpu": [ + "arm64" + ], + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-win32-ia32": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-win32-ia32/-/koffi-win32-ia32-3.3.3.tgz", + "integrity": "sha512-3sw9vvQqro4yKsOWfKebzfTcdPKRwMrodGXWbfwkTsL61EQKdwsMNKA/0dDe0/ubAAZ0yPgstX8/gs94Svzfgw==", + "cpu": [ + "ia32" + ], + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, + "node_modules/@koromix/koffi-win32-x64": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/@koromix/koffi-win32-x64/-/koffi-win32-x64-3.3.3.tgz", + "integrity": "sha512-tLTF17wl4CCwOlo1Tt0NbduwUduDvM6c8JSyearcLu6hpNHQo44RF3rKN2i7UkxwCqXyiudZK0lS421CC/TPZA==", + "cpu": [ + "x64" + ], + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "funding": { + "url": "https://liberapay.com/Koromix" + } + }, "node_modules/@mapbox/node-pre-gyp": { "version": "2.0.3", "resolved": "https://registry.npmjs.org/@mapbox/node-pre-gyp/-/node-pre-gyp-2.0.3.tgz", @@ -1868,9 +2188,9 @@ } }, "node_modules/@vercel/backends": { - "version": "22.0.1", - "resolved": "https://registry.npmjs.org/@vercel/backends/-/backends-22.0.1.tgz", - "integrity": "sha512-wY4EaQT3Yv3t6WFgw/1hp0/dv0mNZIGCQ2JwoxHW8PfMe36vwi6fE4HEXLqFT5y3ZHucqzPMAuwibaTIzO0K+w==", + "version": "24.0.0", + "resolved": "https://registry.npmjs.org/@vercel/backends/-/backends-24.0.0.tgz", + "integrity": "sha512-OCJUJcpvi2c2JLvn901/wxVr7Vlx+ZAlGrfBVHZ2bmCAReJfKqftUYuAPCnE35WmrtPAQsrNLEMQ6+wlyFP6gA==", "license": "Apache-2.0", "dependencies": { "@vercel/nft": "1.10.0", @@ -1888,7 +2208,7 @@ "zod": "3.22.4" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/blob": { @@ -1909,9 +2229,9 @@ } }, "node_modules/@vercel/build-utils": { - "version": "15.0.1", - "resolved": "https://registry.npmjs.org/@vercel/build-utils/-/build-utils-15.0.1.tgz", - "integrity": "sha512-RC9c3yeLzdIdYMW7tenpr26OtG0mB0kPJonBYUJXTWWqnI2zY2254S5iXyUWs4v88MNSaee9RSETuwkMzJWudQ==", + "version": "15.2.0", + "resolved": "https://registry.npmjs.org/@vercel/build-utils/-/build-utils-15.2.0.tgz", + "integrity": "sha512-CMgTKS/0MYgfYs+49255Pre+ml70LBp5lcB66HGn5nNn7fxAHE7cl/J/Wj70Dz0ORuO1Batt1ro7j3IDPBdfOQ==", "license": "Apache-2.0", "dependencies": { "cjs-module-lexer": "1.2.3", @@ -1919,33 +2239,36 @@ } }, "node_modules/@vercel/cervel": { - "version": "0.1.87", - "resolved": "https://registry.npmjs.org/@vercel/cervel/-/cervel-0.1.87.tgz", - "integrity": "sha512-kK7kgn9VP2jwIIKmPapV5N38TqcD9yf5eytISx9xoivqxAqHCQaoJBpmVkaHsFJipWS7nMaIwCP8YhmUGPeEsg==", + "version": "0.1.91", + "resolved": "https://registry.npmjs.org/@vercel/cervel/-/cervel-0.1.91.tgz", + "integrity": "sha512-dAeEHMQYMdu/D+Rq6wRPX0YR8gZ/gsDzA52Wn1ULOfNugWH1HYzL7KyL6KvA+ONR1P5RM4fKbZ6F1YaUTruwNw==", "license": "Apache-2.0", "dependencies": { - "@vercel/backends": "22.0.1" + "@vercel/backends": "24.0.0" }, "bin": { "cervel": "bin/cervel.mjs" } }, "node_modules/@vercel/cli-auth": { - "version": "0.3.12", - "resolved": "https://registry.npmjs.org/@vercel/cli-auth/-/cli-auth-0.3.12.tgz", - "integrity": "sha512-M3g+X+/Zyg7MnaLT69duJn4sNOkfFYVPZVARx1X+Uk1qV3QFXpqm/BHhse3hW+u9nxunHVtpEwnTF8lfv0pQvQ==", + "version": "0.3.14", + "resolved": "https://registry.npmjs.org/@vercel/cli-auth/-/cli-auth-0.3.14.tgz", + "integrity": "sha512-Kw0XvBCzsI9aKXfX8D4pmK9pTs4jNuAec8jT7aey0iHSkLG9WVYMo8o0YyOfTyC/sPSG63R3UMTSDWnlo9QLKw==", "dependencies": { "@napi-rs/keyring": "1.2.0", - "@vercel/cli-config": "0.3.3", + "@vercel/cli-config": "0.3.5", "async-listen": "3.0.0", "open": "8.4.0", "zod": "4.1.11" + }, + "optionalDependencies": { + "koffi": "3.3.3" } }, "node_modules/@vercel/cli-config": { - "version": "0.3.3", - "resolved": "https://registry.npmjs.org/@vercel/cli-config/-/cli-config-0.3.3.tgz", - "integrity": "sha512-5T0ZtIFgcFHuPFuuoJKno5ZeKvLQGiS/JAFMI1zG1HBw2dklScoHdA0LDb/SoeRYD53N33iXFAqyRA0tHLhdnQ==", + "version": "0.3.5", + "resolved": "https://registry.npmjs.org/@vercel/cli-config/-/cli-config-0.3.5.tgz", + "integrity": "sha512-O7y3EFzHENSLtE/3fjM3vIRqDpFFhZor2dMcZaND4G1d88gQk9u8yBcZhRR9CKnBowgzXdl0qcXkuINI05I72w==", "license": "Apache-2.0", "dependencies": { "xdg-app-paths": "5", @@ -2014,17 +2337,70 @@ "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==", "license": "ISC" }, + "node_modules/@vercel/cli-support": { + "version": "65.8.0", + "resolved": "https://registry.npmjs.org/@vercel/cli-support/-/cli-support-65.8.0.tgz", + "integrity": "sha512-X5q1Q5rJRC8dvu4zdRwxH18UhtF+CqawzGtLh23mIhmHNeNl1CEvwQujnPN6uB1Lh3Z0NPLixWwaeMTI9u3BZA==", + "license": "Apache-2.0", + "optional": true, + "os": [ + "!darwin", + "!linux" + ], + "dependencies": { + "@vercel/backends": "24.0.0", + "@vercel/blob": "2.8.0", + "@vercel/build-utils": "15.2.0", + "@vercel/cli-auth": "0.3.14", + "@vercel/cli-config": "0.3.5", + "@vercel/container": "24.0.0", + "@vercel/detect-agent": "1.2.7", + "@vercel/elysia": "24.0.0", + "@vercel/express": "24.0.0", + "@vercel/fastify": "24.0.0", + "@vercel/fun": "1.3.6", + "@vercel/go": "27.0.0", + "@vercel/h3": "24.0.0", + "@vercel/hono": "24.0.0", + "@vercel/hydrogen": "25.0.0", + "@vercel/koa": "24.0.0", + "@vercel/nestjs": "24.0.0", + "@vercel/next": "28.0.0", + "@vercel/node": "29.0.0", + "@vercel/prepare-flags-definitions": "0.6.1", + "@vercel/python": "30.0.0", + "@vercel/python-analysis": "0.15.2", + "@vercel/redwood": "26.0.0", + "@vercel/remix-builder": "29.0.0", + "@vercel/ruby": "26.0.0", + "@vercel/rust": "25.0.0", + "@vercel/static-build": "26.0.0", + "chokidar": "4.0.0", + "esbuild": "0.27.0", + "jose": "5.9.6", + "jsonc-parser": "3.3.1", + "luxon": "^3.4.0", + "sandbox": "4.11.1", + "smol-toml": "1.5.2", + "undici": "5.29.0", + "uuid": "14.0.1", + "zod": "4.1.11" + }, + "engines": { + "node": ">= 20" + } + }, "node_modules/@vercel/container": { - "version": "22.0.1", - "resolved": "https://registry.npmjs.org/@vercel/container/-/container-22.0.1.tgz", - "integrity": "sha512-cjawCL3ONDaL/BcpmGAlxeWxi9HOKtbJGmQF7ER6LIpmyiuGYWJRPBFZ4S8nPsAEcrEQ4h5lWLtDnpqVCB5s6Q==", + "version": "24.0.0", + "resolved": "https://registry.npmjs.org/@vercel/container/-/container-24.0.0.tgz", + "integrity": "sha512-MEefGZA7A3tjiPWDlVS1JQzpKk4YCFZfE8VnTTl+iMl+ji9ILy5slaBoo0qgMM+TtIjA6Mp3Hs0Vpc5JyLyS/Q==", "license": "Apache-2.0", "dependencies": { "smol-toml": "1.5.2", "tar": "7.5.11" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/detect-agent": { @@ -2037,16 +2413,16 @@ } }, "node_modules/@vercel/elysia": { - "version": "22.0.1", - "resolved": "https://registry.npmjs.org/@vercel/elysia/-/elysia-22.0.1.tgz", - "integrity": "sha512-cSvKg1+USlmiPAePWUDlUffuDgLSYAvW4VwWhk2Wcac6KTYQ+SeZ7EYJddcg9RbZ8hoKps6gpfp6z9R4GytLaA==", + "version": "24.0.0", + "resolved": "https://registry.npmjs.org/@vercel/elysia/-/elysia-24.0.0.tgz", + "integrity": "sha512-PJii95nFAi59PDcF65KWIWvxhi69lDLJb8drahXhdwgH4HJZcqRKOAsG4E28a36yg83PkDPVXhPqXQLcgPA72A==", "license": "Apache-2.0", "dependencies": { - "@vercel/node": "27.0.1", + "@vercel/node": "29.0.0", "@vercel/static-config": "3.4.4" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/error-utils": { @@ -2056,14 +2432,14 @@ "license": "Apache-2.0" }, "node_modules/@vercel/express": { - "version": "22.0.1", - "resolved": "https://registry.npmjs.org/@vercel/express/-/express-22.0.1.tgz", - "integrity": "sha512-ggSlCNanq4EykrsxUOGF1Uq6iE/GgLDRcCkt8SJplX/DJZ5I66iQPBV18j+PBvqol+5tV/ckB03GirT5vZifOQ==", + "version": "24.0.0", + "resolved": "https://registry.npmjs.org/@vercel/express/-/express-24.0.0.tgz", + "integrity": "sha512-dBeRBVpd7CIc8D3VrLfLGbE3P6yIEQtR3RzMRVmwoyWMDAxLvv8lQpaFFBY6yNfZLNhiHt60Qf2kTeOihFe8YA==", "license": "Apache-2.0", "dependencies": { - "@vercel/cervel": "0.1.87", + "@vercel/cervel": "0.1.91", "@vercel/nft": "1.10.0", - "@vercel/node": "27.0.1", + "@vercel/node": "29.0.0", "@vercel/static-config": "3.4.4", "fs-extra": "11.1.0", "path-to-regexp": "8.3.0", @@ -2071,20 +2447,20 @@ "zod": "3.22.4" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/fastify": { - "version": "22.0.1", - "resolved": "https://registry.npmjs.org/@vercel/fastify/-/fastify-22.0.1.tgz", - "integrity": "sha512-uwyPIa5l8bRJdqWuppfrNRiq0Bhd9R//6hm8cfziAoqKqDCNfrzJfg/ztFVhMGPfqw9fI7W7VHfumLB7M7M2Fw==", + "version": "24.0.0", + "resolved": "https://registry.npmjs.org/@vercel/fastify/-/fastify-24.0.0.tgz", + "integrity": "sha512-kMvgahbRV2TgYP8JvAfRFDxNaPRlLV1iL1v+BcikORvHaghYYOeqNxbVX7VHIuGiwFV6PcOPQM14XHNwTu6y6Q==", "license": "Apache-2.0", "dependencies": { - "@vercel/node": "27.0.1", + "@vercel/node": "29.0.0", "@vercel/static-config": "3.4.4" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/fun": { @@ -2142,48 +2518,48 @@ } }, "node_modules/@vercel/gatsby-plugin-vercel-builder": { - "version": "2.2.79", - "resolved": "https://registry.npmjs.org/@vercel/gatsby-plugin-vercel-builder/-/gatsby-plugin-vercel-builder-2.2.79.tgz", - "integrity": "sha512-etvQ2c+GhjDW/snEKHOxjRH1VAHJ97B3ZXyJvvv1QgBYw6+YOUY4NpC8WIdPk4QZ/2hLB3AUl0kaVkeUb7eumA==", + "version": "2.2.83", + "resolved": "https://registry.npmjs.org/@vercel/gatsby-plugin-vercel-builder/-/gatsby-plugin-vercel-builder-2.2.83.tgz", + "integrity": "sha512-wvs3A33ntznSftMImhJARK4MipNLxPdL0cSOdNtMhmrFegzmm/lax8jztTztNPUStfNWO9i8qzfoioJyLVvmPg==", "license": "Apache-2.0", "dependencies": { "@sinclair/typebox": "0.25.24", - "@vercel/build-utils": "15.0.1", + "@vercel/build-utils": "15.2.0", "esbuild": "0.27.0", "etag": "1.8.1", "fs-extra": "11.1.0" } }, "node_modules/@vercel/go": { - "version": "25.0.1", - "resolved": "https://registry.npmjs.org/@vercel/go/-/go-25.0.1.tgz", - "integrity": "sha512-eu7oFukgpIq8wxczvfd2Rk8U9m3uzipLRVYxnH/hjwxwgcbGAHPEcGmhzWWuZLN861yGoBIThuf94q1HEb7zrw==", + "version": "27.0.0", + "resolved": "https://registry.npmjs.org/@vercel/go/-/go-27.0.0.tgz", + "integrity": "sha512-KCq8I1/EImjsROnQ866yD2yX49AyRg5zWg3uug/QyONcR7kpoAfNmPVtP1KnOQN2x42zYD9CUeXw1V8he9qrOg==", "license": "Apache-2.0", "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/h3": { - "version": "22.0.1", - "resolved": "https://registry.npmjs.org/@vercel/h3/-/h3-22.0.1.tgz", - "integrity": "sha512-D6sh/dka9ukBPWgyhQPTn9Y+ehB0jTKPugTP2bWMgZzk+7LHkUlJxMhMBVHY6GFDHdC6X/pkkEOMZGoHajOp9g==", + "version": "24.0.0", + "resolved": "https://registry.npmjs.org/@vercel/h3/-/h3-24.0.0.tgz", + "integrity": "sha512-9MGZ1Bc98oDjRftomSSg5+phM3AnsfoogU7/gGOlCnU68pc5kM0nf9PhXsmFaNvuymszBobWbn1EQZSVHBft0g==", "license": "Apache-2.0", "dependencies": { - "@vercel/node": "27.0.1", + "@vercel/node": "29.0.0", "@vercel/static-config": "3.4.4" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/hono": { - "version": "22.0.1", - "resolved": "https://registry.npmjs.org/@vercel/hono/-/hono-22.0.1.tgz", - "integrity": "sha512-tTP34o/L+Mn5YnUnFxOE6SZidzQBy5JkO1n5uhiNZs9azUtXgLLPxmTp/ESHiyvlV/5T5XMg8tG6x8YwL4+8yg==", + "version": "24.0.0", + "resolved": "https://registry.npmjs.org/@vercel/hono/-/hono-24.0.0.tgz", + "integrity": "sha512-TIXBro/nrSi9reCfy49BgnkJVzD8SuqsnIKaJ5zk9rKQtvZogUGAOXFWnm59ZJpyxtuwzPOS06sH6YKDwpj4pw==", "license": "Apache-2.0", "dependencies": { "@vercel/nft": "1.10.0", - "@vercel/node": "27.0.1", + "@vercel/node": "29.0.0", "@vercel/static-config": "3.4.4", "fs-extra": "11.1.0", "path-to-regexp": "8.3.0", @@ -2191,58 +2567,58 @@ "zod": "3.22.4" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/hydrogen": { - "version": "23.0.1", - "resolved": "https://registry.npmjs.org/@vercel/hydrogen/-/hydrogen-23.0.1.tgz", - "integrity": "sha512-QJjfmHU+WrFyHCuJTygI7X/3qb0ERPGTVlgcgC3M59xN6jpHn3quyo+b3YlVKMNsSCCq4hT6k2LkUuzE3k9NdA==", + "version": "25.0.0", + "resolved": "https://registry.npmjs.org/@vercel/hydrogen/-/hydrogen-25.0.0.tgz", + "integrity": "sha512-dKMEoPE5w+RAE8RNjZIZxufe1vjR92fi9vOxiEdDdbHLdqbzWnxccyweWiVzMDna5jWR7HA5qhhX1KLNFQmuEg==", "license": "Apache-2.0", "dependencies": { "@vercel/static-config": "3.4.4", "ts-morph": "12.0.0" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/koa": { - "version": "22.0.1", - "resolved": "https://registry.npmjs.org/@vercel/koa/-/koa-22.0.1.tgz", - "integrity": "sha512-lN9++PqtXddQV7LM7DlmAASUxwjUKFEyOy+sv9n71iAApsg25LiDnqIjt0HnBXlZkL9JmO9RLMnuCLSUjJdupw==", + "version": "24.0.0", + "resolved": "https://registry.npmjs.org/@vercel/koa/-/koa-24.0.0.tgz", + "integrity": "sha512-B4b22RGxiKGz9sSKbC4POkpn6UqpBuLyUA52Jj6iCBNcN95pQZ0OlZVMKK4sizHwHAMwVnToKfbrxvF2iFvc7Q==", "license": "Apache-2.0", "dependencies": { - "@vercel/node": "27.0.1", + "@vercel/node": "29.0.0", "@vercel/static-config": "3.4.4" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/nestjs": { - "version": "22.0.1", - "resolved": "https://registry.npmjs.org/@vercel/nestjs/-/nestjs-22.0.1.tgz", - "integrity": "sha512-rjsYi1ARf47QgmQv54YeXCUbqWQv/2MtIk2Dkb6ibgQblqFWV6Y/zCYTvm6ZzrsngCHO/kK5oN6Pz0elDg5MGw==", + "version": "24.0.0", + "resolved": "https://registry.npmjs.org/@vercel/nestjs/-/nestjs-24.0.0.tgz", + "integrity": "sha512-bKC8A09aBW1VyrjasBVfaENTADb81zUf34eO2Jr0QihrOdCvyTspuq95rJYqKh7AObMipGYp56isncGif9Xwmw==", "license": "Apache-2.0", "dependencies": { - "@vercel/node": "27.0.1", + "@vercel/node": "29.0.0", "@vercel/static-config": "3.4.4" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/next": { - "version": "26.0.1", - "resolved": "https://registry.npmjs.org/@vercel/next/-/next-26.0.1.tgz", - "integrity": "sha512-sUBauFP2P6vDXax7zPrFe8Cdxz6VLbeNtl4WNXQ2qhCDdfPyJ20VeyIbWTKaHRUHlDFmdvAoZeB6m5sd4gAq9A==", + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@vercel/next/-/next-28.0.0.tgz", + "integrity": "sha512-psSdIRO/EYZAlaN+sy+BYxiQwdN7XXWuOnTwSorrGZaKthugs6kkyIJhlfpVRtIRfIFRLwOR4kSNJsB3qKKddA==", "license": "Apache-2.0", "dependencies": { "@vercel/nft": "1.10.0" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/nft": { @@ -2272,9 +2648,9 @@ } }, "node_modules/@vercel/node": { - "version": "27.0.1", - "resolved": "https://registry.npmjs.org/@vercel/node/-/node-27.0.1.tgz", - "integrity": "sha512-yvAEUooWD32aMybQSqCeZeEi9BaV3MeJOL26rQOOADvqXhPvl2KZQP6r7ZubjoCG5JTy5ZvsRtj3p8ppPhL12A==", + "version": "29.0.0", + "resolved": "https://registry.npmjs.org/@vercel/node/-/node-29.0.0.tgz", + "integrity": "sha512-EjjzYjR5K8Gkwko6kW1IGOV7M+XvBeURBaYcKvMPs/QaK/Rm/X8RAH85Co7KczyP8ou9Qv6uITtcXmxJR1ClUQ==", "license": "Apache-2.0", "dependencies": { "@edge-runtime/node-utils": "2.3.0", @@ -2300,7 +2676,7 @@ "undici": "5.28.4" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/node/node_modules/es-module-lexer": { @@ -2366,15 +2742,15 @@ "license": "MIT" }, "node_modules/@vercel/python": { - "version": "28.0.1", - "resolved": "https://registry.npmjs.org/@vercel/python/-/python-28.0.1.tgz", - "integrity": "sha512-jWgWCtt+Xn19cZnqAEt8IMOQpPbvh8IEgh7/fVl/iqZiK1rXF6/8LjdMUl4VnY4o9GXSLnGC3kllSFP6npslIg==", + "version": "30.0.0", + "resolved": "https://registry.npmjs.org/@vercel/python/-/python-30.0.0.tgz", + "integrity": "sha512-etonAeR8EX63nyqdF7HleE76R/UnCsDjSZvlEGO2F6SFeQmKsSfAK1qV5t3uZxjWFISD8WS53SMU8oFwny7xFw==", "license": "Apache-2.0", "dependencies": { "@vercel/python-analysis": "0.15.2" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/python-analysis": { @@ -2406,9 +2782,9 @@ } }, "node_modules/@vercel/redwood": { - "version": "24.0.1", - "resolved": "https://registry.npmjs.org/@vercel/redwood/-/redwood-24.0.1.tgz", - "integrity": "sha512-NKum2/J0MdxXkdU/fvSHrpX423Tkf8Kz+Vist9KtAmKJqOXKP9nxt916wzq8Pge2UVuctWNMPlcEiTNsoS86Ew==", + "version": "26.0.0", + "resolved": "https://registry.npmjs.org/@vercel/redwood/-/redwood-26.0.0.tgz", + "integrity": "sha512-Cs6CiK+R00uPAnz8lpveaK+gyLHes3XGZKa7wVWS3WVcZBi6FoD/FXHsoqPxnl1w8KV/+RldPrNLfZJm2gzK/A==", "license": "Apache-2.0", "dependencies": { "@vercel/nft": "1.10.0", @@ -2417,7 +2793,7 @@ "ts-morph": "12.0.0" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/redwood/node_modules/semver": { @@ -2430,9 +2806,9 @@ } }, "node_modules/@vercel/remix-builder": { - "version": "27.0.1", - "resolved": "https://registry.npmjs.org/@vercel/remix-builder/-/remix-builder-27.0.1.tgz", - "integrity": "sha512-kyek08+ZzLl/yfVBo+XCb+VK4toymkKUOtuCIu4AQfooEBJvLoKGgAtjSvCjw+f+s9xSD8cebrYdfZA4Aty+NA==", + "version": "29.0.0", + "resolved": "https://registry.npmjs.org/@vercel/remix-builder/-/remix-builder-29.0.0.tgz", + "integrity": "sha512-NUct93mXUgSGhOGKksy3yjmodOSPEjtdQschjid8FokZxYRY+wLQlm5A6lC1o+ujmEZQVnm6ur0w4UlBK0d/tg==", "license": "Apache-2.0", "dependencies": { "@vercel/error-utils": "2.2.1", @@ -2443,7 +2819,7 @@ "ts-morph": "12.0.0" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/remix-builder/node_modules/path-to-regexp": { @@ -2453,18 +2829,18 @@ "license": "MIT" }, "node_modules/@vercel/ruby": { - "version": "24.0.1", - "resolved": "https://registry.npmjs.org/@vercel/ruby/-/ruby-24.0.1.tgz", - "integrity": "sha512-b+YLdDtAIGm89hzJAYRHeqXtsRRICwd1euAkIQbjYospnJMtRWY3BaNTo9qnKshiQ1AOkHZYTj8ItKnoprY9xw==", + "version": "26.0.0", + "resolved": "https://registry.npmjs.org/@vercel/ruby/-/ruby-26.0.0.tgz", + "integrity": "sha512-HD2uv2JrrqHZwA3bwF77TpmgiEUpVmdISaiovHfysvYUDj5IHWHJuLrXpMVBsMAvVEQgImZ0iBnXDvkPvr8eJg==", "license": "Apache-2.0", "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/rust": { - "version": "23.0.1", - "resolved": "https://registry.npmjs.org/@vercel/rust/-/rust-23.0.1.tgz", - "integrity": "sha512-eX4+ABJpOf7jWLLXvYRmr8sbx4yZD8+cz3rZlIBKK3ZSyp6B7O8TPanODwWwC3Oe0XCtQb1wHz0vuo9Ktb3Hqw==", + "version": "25.0.0", + "resolved": "https://registry.npmjs.org/@vercel/rust/-/rust-25.0.0.tgz", + "integrity": "sha512-JP2Rt80/ew4rq2a7SYjRy8kR/zUIpl7tvF6vUj5kCs+KWgOKWSWqYmPrTe7jXp/Kg3WLeohYg9v/dybbOU8I8w==", "license": "Apache-2.0", "dependencies": { "execa": "5", @@ -2472,7 +2848,7 @@ "smol-toml": "1.5.2" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/rust/node_modules/execa": { @@ -2526,12 +2902,13 @@ "license": "ISC" }, "node_modules/@vercel/sandbox": { - "version": "3.3.0", - "resolved": "https://registry.npmjs.org/@vercel/sandbox/-/sandbox-3.3.0.tgz", - "integrity": "sha512-TclqRD2joExyECTrrHsioi3Onw20X2YfpOYEzs3JpJUtAjOKYw2bMeXldKrUg+TB/TT7tPdDu8uKNxj9NE7QUg==", + "version": "3.9.1", + "resolved": "https://registry.npmjs.org/@vercel/sandbox/-/sandbox-3.9.1.tgz", + "integrity": "sha512-8/3vqPknI2WrE1Zd4O3LbMFbrD9elCXqCe0JjqSJH+EqsEtBHGafwwxx1raq1kTWvpLLk4lh0bZW9dMy6L5efA==", "license": "Apache-2.0", "dependencies": { - "@vercel/oidc": "3.2.0", + "@vercel/detect-agent": "1.2.5", + "@vercel/oidc": "4.0.0", "@workflow/serde": "4.1.0-beta.2", "async-retry": "1.3.3", "jose": "6.2.3", @@ -2545,15 +2922,48 @@ "zod": "^4.1.1" } }, + "node_modules/@vercel/sandbox/node_modules/@vercel/cli-config": { + "version": "0.3.1", + "resolved": "https://registry.npmjs.org/@vercel/cli-config/-/cli-config-0.3.1.tgz", + "integrity": "sha512-sISbygqlFXYb8qfPu/+2Cf/A8IjrlAuZePdag3EDQr2PRA455s7UZtl9Ro674CWsB/saBRmz3jEkw0YsQs8OoQ==", + "license": "Apache-2.0", + "dependencies": { + "xdg-app-paths": "5", + "zod": "4.1.11" + } + }, + "node_modules/@vercel/sandbox/node_modules/@vercel/detect-agent": { + "version": "1.2.5", + "resolved": "https://registry.npmjs.org/@vercel/detect-agent/-/detect-agent-1.2.5.tgz", + "integrity": "sha512-0krENrjuitlW8s6TJu0MlqCevyCU7K7JK63jZAf7xZ6n17tx+vUEwzHT3sTxawtwZxaW21hu+oFUpoOrm49FsQ==", + "license": "Apache-2.0", + "engines": { + "node": ">=14" + } + }, "node_modules/@vercel/sandbox/node_modules/@vercel/oidc": { - "version": "3.2.0", - "resolved": "https://registry.npmjs.org/@vercel/oidc/-/oidc-3.2.0.tgz", - "integrity": "sha512-UycprH3T6n3jH0k44NHMa7pnFHGu/N05MjojYr+Mc6I7obkoLIJujSWwin1pCvdy/eOxrI/l3uDLQsmcrOb4ug==", + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/@vercel/oidc/-/oidc-4.0.0.tgz", + "integrity": "sha512-ko6ATeRUlHZMB5hLFdC7+/Q1dI2f3NX3gZHxtpALdkxurwjD5HFHGWYF+4o+4SF0E47jg6KzcHknmRpHcKgJ5A==", "license": "Apache-2.0", + "dependencies": { + "@vercel/cli-config": "0.3.1", + "@vercel/cli-exec": "1.0.1", + "jose": "^5.9.6" + }, "engines": { "node": ">= 20" } }, + "node_modules/@vercel/sandbox/node_modules/@vercel/oidc/node_modules/jose": { + "version": "5.10.0", + "resolved": "https://registry.npmjs.org/jose/-/jose-5.10.0.tgz", + "integrity": "sha512-s+3Al/p9g32Iq+oqXxkW//7jk2Vig6FF1CFqzVXoTUXt2qz89YWbL+OwS17NFYEvxC35n0FKeGO2LGYSxeM2Gg==", + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/panva" + } + }, "node_modules/@vercel/sandbox/node_modules/jose": { "version": "6.2.3", "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.3.tgz", @@ -2603,18 +3013,18 @@ } }, "node_modules/@vercel/static-build": { - "version": "24.0.1", - "resolved": "https://registry.npmjs.org/@vercel/static-build/-/static-build-24.0.1.tgz", - "integrity": "sha512-HfbE9fr5OkrZJZSi7/NFVhKF0qK1fiTKS5Zu4qvddbETc9JRIWWFbH/ip4Q7r71ZV8rZDjp+gbDbQ9YBSkZbbA==", + "version": "26.0.0", + "resolved": "https://registry.npmjs.org/@vercel/static-build/-/static-build-26.0.0.tgz", + "integrity": "sha512-LSlHGgHYpmBeUMOU2aXnojm7EeB/uyBlS2eTOTOi5A99ZJIcJ5kMUoAYiKfEQVVXLa8df+CkVUe5afCF50KETA==", "license": "Apache-2.0", "dependencies": { "@vercel/gatsby-plugin-vercel-analytics": "1.0.12", - "@vercel/gatsby-plugin-vercel-builder": "2.2.79", + "@vercel/gatsby-plugin-vercel-builder": "2.2.83", "@vercel/static-config": "3.4.4", "ts-morph": "12.0.0" }, "peerDependencies": { - "@vercel/build-utils": "15.0.1" + "@vercel/build-utils": "15.2.0" } }, "node_modules/@vercel/static-config": { @@ -2630,9 +3040,9 @@ } }, "node_modules/@vercel/vc-native-darwin-arm64": { - "version": "65.2.0", - "resolved": "https://registry.npmjs.org/@vercel/vc-native-darwin-arm64/-/vc-native-darwin-arm64-65.2.0.tgz", - "integrity": "sha512-fan6OYRDqDNTBPqGXzI2mK1QBvQXBzKsyzHxgHq+71dTRwYIYoQZQNzz/Q2MEpWCYhX52LXyI8YBb9M99dlU8Q==", + "version": "65.8.0", + "resolved": "https://registry.npmjs.org/@vercel/vc-native-darwin-arm64/-/vc-native-darwin-arm64-65.8.0.tgz", + "integrity": "sha512-76XemdNXZh8sC6JnNpUzerondFIEzoN6I1HuFRL65ChU6aFdSdSYBRAy3xsdxB7dYAbjAobZgRAvdXAiu1vw0Q==", "cpu": [ "arm64" ], @@ -2643,9 +3053,9 @@ ] }, "node_modules/@vercel/vc-native-darwin-x64": { - "version": "65.2.0", - "resolved": "https://registry.npmjs.org/@vercel/vc-native-darwin-x64/-/vc-native-darwin-x64-65.2.0.tgz", - "integrity": "sha512-uMCeaSD+YBeG2uj6JcKWu9rnIc72lJcCVhXKd7G9T5TSIp8Kw3c0AXtbuv+8VpuMjHpg6iaKOIedQQIz91BT0A==", + "version": "65.8.0", + "resolved": "https://registry.npmjs.org/@vercel/vc-native-darwin-x64/-/vc-native-darwin-x64-65.8.0.tgz", + "integrity": "sha512-RDkZUAd9UMrUuVJu2OHrEWdZxvPyABeZeSi+sCYmbo7QgqOnJE+vgK0/qpd+8YeqDobPg++MPhKt/VnT+NYuwQ==", "cpu": [ "x64" ], @@ -2656,9 +3066,9 @@ ] }, "node_modules/@vercel/vc-native-linux-arm64": { - "version": "65.2.0", - "resolved": "https://registry.npmjs.org/@vercel/vc-native-linux-arm64/-/vc-native-linux-arm64-65.2.0.tgz", - "integrity": "sha512-2fuAjL75vfxWXt7kysDgKKaXNPDfn5hjOavHTocCwnTlw5fsCBabBOpUvWoqx+0H5cIkP7pQC8mAGV7IuaalRg==", + "version": "65.8.0", + "resolved": "https://registry.npmjs.org/@vercel/vc-native-linux-arm64/-/vc-native-linux-arm64-65.8.0.tgz", + "integrity": "sha512-W5R9axIqouJ1lKDt7V2MR972SQt9ZQIVoJwhl6uUTO0lZ9qT3LImQRyRBog2VLpbIQtqFHReeBs+4cNo6BX85g==", "cpu": [ "arm64" ], @@ -2672,9 +3082,9 @@ ] }, "node_modules/@vercel/vc-native-linux-arm64-musl": { - "version": "65.2.0", - "resolved": "https://registry.npmjs.org/@vercel/vc-native-linux-arm64-musl/-/vc-native-linux-arm64-musl-65.2.0.tgz", - "integrity": "sha512-q/W0IL8TxwIVc+J+mQtblv0FTDYtrtyQtoSjjkD0KfCr+NjHf/fl+GQsE6Kb4EfUgSps7IkTbRdx8vNYKJcMbQ==", + "version": "65.8.0", + "resolved": "https://registry.npmjs.org/@vercel/vc-native-linux-arm64-musl/-/vc-native-linux-arm64-musl-65.8.0.tgz", + "integrity": "sha512-3OenEKUAh+MhE9Fn0RqLfPcy/1s1QigM/u6qWLbu4qrEBQMxF3OgTN3yQRlHunN/+Byq5jiSGKK95k7Sw13Cwg==", "cpu": [ "arm64" ], @@ -2688,9 +3098,9 @@ ] }, "node_modules/@vercel/vc-native-linux-x64": { - "version": "65.2.0", - "resolved": "https://registry.npmjs.org/@vercel/vc-native-linux-x64/-/vc-native-linux-x64-65.2.0.tgz", - "integrity": "sha512-f5FDa3LCsRLUkxaRNpOfbUoq4926yi7ZGOJWw0b2LYrEjBRtviMCYYjglawhCoVGt94oV/E7oyYy2qd2CUZ88g==", + "version": "65.8.0", + "resolved": "https://registry.npmjs.org/@vercel/vc-native-linux-x64/-/vc-native-linux-x64-65.8.0.tgz", + "integrity": "sha512-mzKeQOZlFdcsl+ORh/mtMepEjuXm0ueLZ3ZnwGtJUS/qo2CKl+4QY0GoA/t0bk+x9j7e8ItBdo2AoEsgI/EZng==", "cpu": [ "x64" ], @@ -2704,9 +3114,9 @@ ] }, "node_modules/@vercel/vc-native-linux-x64-musl": { - "version": "65.2.0", - "resolved": "https://registry.npmjs.org/@vercel/vc-native-linux-x64-musl/-/vc-native-linux-x64-musl-65.2.0.tgz", - "integrity": "sha512-ftpFx3cMoa03miW/v7rC72yoSUMWX49YSJRMUQEq2+jRh8D6wRCacxanwZWruSR7tc1rXQ4S89e3XclWpyxlvw==", + "version": "65.8.0", + "resolved": "https://registry.npmjs.org/@vercel/vc-native-linux-x64-musl/-/vc-native-linux-x64-musl-65.8.0.tgz", + "integrity": "sha512-/MISs/njjcH6DDoG4GapCWUS+4k0/d3lEoMt0RTVMLynB7w0lCvLmnbAx+MB/UPR5DjJzmzg56jnNfy/YG0gJw==", "cpu": [ "x64" ], @@ -2719,32 +3129,6 @@ "linux" ] }, - "node_modules/@vercel/vc-native-win32-arm64": { - "version": "65.2.0", - "resolved": "https://registry.npmjs.org/@vercel/vc-native-win32-arm64/-/vc-native-win32-arm64-65.2.0.tgz", - "integrity": "sha512-UF55JikR5strKaWV+JZhOm7tmrJ+V4Wt6k2kAU+TApCvflns3o80xJX3g+S1irBRwEoNAd/yzsfR6pLMRhzeFw==", - "cpu": [ - "arm64" - ], - "license": "Apache-2.0", - "optional": true, - "os": [ - "win32" - ] - }, - "node_modules/@vercel/vc-native-win32-x64": { - "version": "65.2.0", - "resolved": "https://registry.npmjs.org/@vercel/vc-native-win32-x64/-/vc-native-win32-x64-65.2.0.tgz", - "integrity": "sha512-kMq6h4q+TS0XoMlXfqMxRk47llUY6uI13OTpmyd5EHTfhsRIThSziGN99Lg0Kkb72HG8smgv9AZ97961qWMkPg==", - "cpu": [ - "x64" - ], - "license": "Apache-2.0", - "optional": true, - "os": [ - "win32" - ] - }, "node_modules/@workflow/serde": { "version": "4.1.0-beta.2", "resolved": "https://registry.npmjs.org/@workflow/serde/-/serde-4.1.0-beta.2.tgz", @@ -3630,6 +4014,39 @@ "integrity": "sha512-ekDrAGso79Cvf+dtm+mL8OBI2bmAOt3gssYs833De/C9NmIpWDWyUO4zPgB5x2/OhY366dkhgfPMYfwZF7yOZA==", "license": "MIT" }, + "node_modules/koffi": { + "version": "3.3.3", + "resolved": "https://registry.npmjs.org/koffi/-/koffi-3.3.3.tgz", + "integrity": "sha512-XWNI4eyxJJzR2MakPZzR3QeZ06JOklLbxglin0dHhx/qIQCby8lqHs9Acq4Q7CpCKnOrBSj+6b9J5y69wfr2ZA==", + "hasInstallScript": true, + "license": "MIT", + "optional": true, + "funding": { + "url": "https://liberapay.com/Koromix" + }, + "optionalDependencies": { + "@koromix/koffi-android-arm64": "3.3.3", + "@koromix/koffi-android-x64": "3.3.3", + "@koromix/koffi-darwin-arm64": "3.3.3", + "@koromix/koffi-darwin-x64": "3.3.3", + "@koromix/koffi-freebsd-arm64": "3.3.3", + "@koromix/koffi-freebsd-ia32": "3.3.3", + "@koromix/koffi-freebsd-x64": "3.3.3", + "@koromix/koffi-linux-arm": "3.3.3", + "@koromix/koffi-linux-arm64": "3.3.3", + "@koromix/koffi-linux-ia32": "3.3.3", + "@koromix/koffi-linux-loong64": "3.3.3", + "@koromix/koffi-linux-ppc64": "3.3.3", + "@koromix/koffi-linux-riscv64": "3.3.3", + "@koromix/koffi-linux-x64": "3.3.3", + "@koromix/koffi-openbsd-arm64": "3.3.3", + "@koromix/koffi-openbsd-ia32": "3.3.3", + "@koromix/koffi-openbsd-x64": "3.3.3", + "@koromix/koffi-win32-arm64": "3.3.3", + "@koromix/koffi-win32-ia32": "3.3.3", + "@koromix/koffi-win32-x64": "3.3.3" + } + }, "node_modules/lru-cache": { "version": "11.5.3", "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz", @@ -4265,12 +4682,12 @@ "license": "MIT" }, "node_modules/sandbox": { - "version": "4.4.0", - "resolved": "https://registry.npmjs.org/sandbox/-/sandbox-4.4.0.tgz", - "integrity": "sha512-8DlAEKlHbOQmz5R05dAYE+P1wNQ44nEvAnf1jnWtF0LZWHiu/F48USSMKyY8Ib8iE1MCfo3Yvhmky8bUppLaWA==", + "version": "4.11.1", + "resolved": "https://registry.npmjs.org/sandbox/-/sandbox-4.11.1.tgz", + "integrity": "sha512-TRjMwPjn7lKQculAXJ9rmv73jQ+9+5Hr2L5KMm1HfQiDhDXgO0pZACiy5ExtSzRW6mZgTGniWmWslhOu77DQdA==", "license": "Apache-2.0", "dependencies": { - "@vercel/sandbox": "3.3.0", + "@vercel/sandbox": "3.9.1", "async-retry": "1.3.3", "debug": "^4.4.1", "ws": "^8.21.0", @@ -4648,44 +5065,44 @@ } }, "node_modules/vercel": { - "version": "65.2.0", - "resolved": "https://registry.npmjs.org/vercel/-/vercel-65.2.0.tgz", - "integrity": "sha512-IPalObt3xnaY9Njbwb3wbQR7ht0gyL3XYt4z1wjFui3r5pkJPKSAGaGSD4B5AX5B4tOXxSbnXpWnKx+RJgdKrg==", + "version": "65.8.0", + "resolved": "https://registry.npmjs.org/vercel/-/vercel-65.8.0.tgz", + "integrity": "sha512-VCxYpHGMd0vBDj+yZI7cXL/vfxS5ORxWix7sE+n9K5ipR1wgi2idvjU3ICb1CuZKmFhqEtraSJCX10DdsPB8wA==", "license": "Apache-2.0", "dependencies": { - "@vercel/backends": "22.0.1", + "@vercel/backends": "24.0.0", "@vercel/blob": "2.8.0", - "@vercel/build-utils": "15.0.1", - "@vercel/cli-auth": "0.3.12", - "@vercel/cli-config": "0.3.3", - "@vercel/container": "22.0.1", + "@vercel/build-utils": "15.2.0", + "@vercel/cli-auth": "0.3.14", + "@vercel/cli-config": "0.3.5", + "@vercel/container": "24.0.0", "@vercel/detect-agent": "1.2.7", - "@vercel/elysia": "22.0.1", - "@vercel/express": "22.0.1", - "@vercel/fastify": "22.0.1", + "@vercel/elysia": "24.0.0", + "@vercel/express": "24.0.0", + "@vercel/fastify": "24.0.0", "@vercel/fun": "1.3.6", - "@vercel/go": "25.0.1", - "@vercel/h3": "22.0.1", - "@vercel/hono": "22.0.1", - "@vercel/hydrogen": "23.0.1", - "@vercel/koa": "22.0.1", - "@vercel/nestjs": "22.0.1", - "@vercel/next": "26.0.1", - "@vercel/node": "27.0.1", + "@vercel/go": "27.0.0", + "@vercel/h3": "24.0.0", + "@vercel/hono": "24.0.0", + "@vercel/hydrogen": "25.0.0", + "@vercel/koa": "24.0.0", + "@vercel/nestjs": "24.0.0", + "@vercel/next": "28.0.0", + "@vercel/node": "29.0.0", "@vercel/prepare-flags-definitions": "0.6.1", - "@vercel/python": "28.0.1", + "@vercel/python": "30.0.0", "@vercel/python-analysis": "0.15.2", - "@vercel/redwood": "24.0.1", - "@vercel/remix-builder": "27.0.1", - "@vercel/ruby": "24.0.1", - "@vercel/rust": "23.0.1", - "@vercel/static-build": "24.0.1", + "@vercel/redwood": "26.0.0", + "@vercel/remix-builder": "29.0.0", + "@vercel/ruby": "26.0.0", + "@vercel/rust": "25.0.0", + "@vercel/static-build": "26.0.0", "chokidar": "4.0.0", "esbuild": "0.27.0", "jose": "5.9.6", "jsonc-parser": "3.3.1", "luxon": "^3.4.0", - "sandbox": "4.4.0", + "sandbox": "4.11.1", "smol-toml": "1.5.2", "undici": "5.29.0", "uuid": "14.0.1", @@ -4699,14 +5116,13 @@ "node": ">= 20" }, "optionalDependencies": { - "@vercel/vc-native-darwin-arm64": "65.2.0", - "@vercel/vc-native-darwin-x64": "65.2.0", - "@vercel/vc-native-linux-arm64": "65.2.0", - "@vercel/vc-native-linux-arm64-musl": "65.2.0", - "@vercel/vc-native-linux-x64": "65.2.0", - "@vercel/vc-native-linux-x64-musl": "65.2.0", - "@vercel/vc-native-win32-arm64": "65.2.0", - "@vercel/vc-native-win32-x64": "65.2.0" + "@vercel/cli-support": "65.8.0", + "@vercel/vc-native-darwin-arm64": "65.8.0", + "@vercel/vc-native-darwin-x64": "65.8.0", + "@vercel/vc-native-linux-arm64": "65.8.0", + "@vercel/vc-native-linux-arm64-musl": "65.8.0", + "@vercel/vc-native-linux-x64": "65.8.0", + "@vercel/vc-native-linux-x64-musl": "65.8.0" } }, "node_modules/web-vitals": { diff --git a/.github/vercel-cli/package.json b/.github/vercel-cli/package.json index f0217a0..adf1025 100644 --- a/.github/vercel-cli/package.json +++ b/.github/vercel-cli/package.json @@ -3,9 +3,11 @@ "private": true, "description": "Pins the Vercel CLI that .github/workflows/bench-deploy.yml runs.", "dependencies": { - "vercel": "65.2.0" + "vercel": "65.8.0" }, "overrides": { + "@napi-rs/wasm-runtime": "1.2.5", + "@types/estree": "1.0.9", "ajv@8": "^8.18.0", "js-yaml@4": "^4.3.2", "minimatch@10": "^10.2.3", diff --git a/.github/workflows/bench-deploy.yml b/.github/workflows/bench-deploy.yml index b291338..476b6c2 100644 --- a/.github/workflows/bench-deploy.yml +++ b/.github/workflows/bench-deploy.yml @@ -152,10 +152,7 @@ jobs: - name: Setup Node uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - # The prebuilt build runs on the Node major its functions run on: - # 24 until the benchmarks-website project moves to 26.x (see - # CLAUDE.md, bench/). Then return to `node-version-file: .nvmrc`. - node-version: "24" + node-version-file: .nvmrc # .github/vercel-cli pins the CLI and locks its whole dependency tree. Its # overrides patch advisories in dependencies the CLI pins (see CLAUDE.md diff --git a/CLAUDE.md b/CLAUDE.md index d53d2b9..b47bb02 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -96,7 +96,7 @@ Defense in depth against the npm-worm class (Shai-Hulud, mini-Shai-Hulud, the Ma Three places must agree with each other and with what Vercel runs. Vercel offers Node 22.x, 24.x and 26.x, with 26 the default, and all three are aligned on 26: - `.nvmrc` → `26`, which the CI workflows read via `actions/setup-node`'s `node-version-file`. -- `package.json` → `engines.node = "26.x"`. Vercel resolves this range against the versions it offers, and it **overrides the dashboard setting**. An open range such as `">=24"` silently moves production to each new major Vercel adds, ahead of CI: that is how production reached 26 while CI still ran 24. A range no offered version satisfies fails the deploy outright. The `vortex` project is also set to 26.x, so the setting and the range agree. bench is the exception, below. +- `package.json` → `engines.node = "26.x"`. Vercel resolves this range against the versions it offers, and it **overrides the dashboard setting**. An open range such as `">=24"` silently moves production to each new major Vercel adds, ahead of CI: that is how production reached 26 while CI still ran 24. A range no offered version satisfies fails the deploy outright. Both Vercel projects are also set to 26.x, so the setting and the range agree. - `@types/node` → `^26`, matching the runtime so `tsc` cannot green-light an API that production does not have. Keep them in lockstep when bumping, and move to a new major only after Vercel offers it; check https://vercel.com/docs/functions/runtimes/node-js/node-js-versions first. @@ -111,7 +111,7 @@ Keep them in lockstep when bumping, and move to a new major only after Vercel of - **Lifecycle scripts.** pnpm's `allowBuilds` let `sharp` build (and `unrs-resolver`, which left with ESLint). `trustedDependencies` already trusts `sharp`, and stays `["esbuild", "sharp"]`. Bun blocks three bench scripts, `protobufjs`, `ssh2` and `cpu-features`, which pnpm blocked too. With the isolated linker, `bun pm untrusted` lists only packages linked at the top of `node_modules`, so it reports none of them; to audit, install once with `bun install --linker hoisted` in a scratch copy and run it there. - **Deploy CLI:** `bench-deploy.yml` installs the Vercel CLI from `.github/vercel-cli` with `npm ci --ignore-scripts`. Its `package.json` pins the version, and its `package-lock.json` locks the whole tree. That job holds `VERCEL_TOKEN`. The lockfile is npm's, not Bun's, so GitHub's dependency graph, Dependabot and dependency review read it natively. To change it, run `npm install --package-lock-only --ignore-scripts --before=<7 days ago>` in that directory (Renovate passes the same `--before`), then `npm audit`. Its `overrides` patch advisories in dependencies the CLI pins; see "bench advisories". - **Renovate** keeps bench's updates in their own `bench-` branches (it matches `bench/web/package.json`; the lockfile they change is the shared `bun.lock`, which lock file maintenance refreshes for both apps at once). They automerge like the site's (patch and minor), because `Bench: format, lint, build, test` is a required check. That includes the Vercel CLI in `.github/vercel-cli`: `Bench: deploy` is also required, so a CLI update merges only after a real preview deploy with it succeeds. -- **Node:** bench deploys prebuilt output, so the `benchmarks-website` project's Node setting, not `engines`, picks its function runtime. That setting stays on **24.x** until `.github/vercel-cli` reaches Vercel CLI 65.8.0: Vercel requires 65.8.0 or later to deploy Node 26 functions from prebuilt output, and 65.8.0 clears the 7-day cooldown on 2026-11-05. Until then, bench's checks (`.github/actions/bench-checks`) and its prebuilt build in `bench-deploy.yml` run on Node 24 rather than `.nvmrc`, and its `@types/node` stays on `^24`, held there by a `renovate.json` rule, so its code can't use a Node 26 API that its runtime lacks. When Renovate's CLI bump lands, set the project to 26.x (`vercel api /v9/projects/benchmarks-website -X PATCH -F nodeVersion=26.x --scope vortex-data`), point both Node setups back at `.nvmrc`, move bench's `@types/node` to `^26`, drop that rule and drop this note. +- **Node:** `bench-ci.yml` and `bench-deploy.yml` read `.nvmrc`. bench deploys prebuilt output, so the `benchmarks-website` project's Node setting (26.x), not `engines`, picks its function runtime; keep it, `.nvmrc` and bench's `@types/node` on the same major. Vercel needs CLI 65.8.0 or later to deploy Node 26 functions from prebuilt output. - **Audit:** `bun audit` at the root covers bench; see "bench advisories" below. ### Audit advisories @@ -128,7 +128,7 @@ Keep them in lockstep when bumping, and move to a new major only after Vercel of **Removed: `@lhci/cli`.** It brought eight advisories into `bun.lock`: extract-zip (two, with no fixed release), basic-ftp, body-parser, qs, tmp (two) and uuid. CI never used it, because the Lighthouse workflow runs `treosh/lighthouse-ci-action`, which ships its own copy. `bun run lighthouse` now fetches a pinned `@lhci/cli@0.15.1` with `bunx` when you run it. Do not add it back as a dependency. -**Held back on purpose:** the site's `@types/node` stays on `^26` (bench's on `^24`, see "bench/") to match the runtime (see "Node version"); `renovate.json` caps it with `allowedVersions: "<27"` so Renovate does not open 27.x / 28.x PRs ahead of the runtime. +**Held back on purpose:** `@types/node` stays on `^26` in both apps to match the runtime (see "Node version"); `renovate.json` caps it with `allowedVersions: "<27"` so Renovate does not open 27.x / 28.x PRs ahead of the runtime. The `audit` job in `.github/workflows/ci.yml` runs a bare `bun audit` and never fails CI; any advisory it finds shows in its job summary, and is recorded here with how it is handled. Merge blocking on advisories is `dependency-review`'s job. @@ -138,8 +138,8 @@ The `audit` job in `.github/workflows/ci.yml` runs a bare `bun audit` and never - **Resolved by `overrides` in the root `package.json`:** zod (see "Audit advisories"). sharp needs no override for bench: next 16.4.1 asks for `^0.35.5` itself. - **Resolved in the lockfile:** @grpc/grpc-js, brace-expansion, js-yaml, protobufjs (7.6.5, for GHSA-f38q-mgvj-vph7 and GHSA-j3f2-48v5-ccww) and source-map-js, by refreshing within their parents' ranges. vite is a direct dev dependency of bench (`^8.3.4`), because it is vitest's peer: as a direct dependency its range sets the version the lockfile holds, so the vulnerable 8.0.16 cannot come back. (Under pnpm, an override alone left 8.0.16 locked.) -- **Resolved by `overrides` in `.github/vercel-cli/package.json`, the Vercel CLI (65.2.0) that `bench-deploy.yml` runs:** tar (one critical), undici, path-to-regexp, minimatch, js-yaml, smol-toml, zod and ajv. The CLI and its builders pin these exactly, so only overrides reach them. `npm audit` in that directory reports none. Two overrides cross a major: +- **Resolved by `overrides` in `.github/vercel-cli/package.json`, the Vercel CLI (65.8.0) that `bench-deploy.yml` runs:** tar (one critical), undici, path-to-regexp, minimatch, js-yaml, smol-toml, zod and ajv. The CLI and its builders pin these exactly, so only overrides reach them. `npm audit` in that directory reports none. Two overrides cross a major: - `undici@5` goes to 6. The CLI and `@vercel/node` pin 5.x, and the move also drops `@fastify/busboy`, which only undici 5 used. - `zod` goes to 4 for the builders that pin 3.22.4 (`@vercel/backends`, `@vercel/express`, `@vercel/hono` and `@vercel/python-analysis`). The CLI bundles its own zod. - Bench uses none of those builders. A local `vercel build` of bench gave the same output with and without the overrides, apart from Next.js's random build ID. Drop each override when the CLI's own range reaches the fix. When Renovate bumps the CLI, run `npm audit` in `.github/vercel-cli` and check the preview deploy on its PR. + Bench uses none of those builders. A local `vercel build` of bench gave the same output with and without the overrides, apart from Next.js's random build ID. Drop each override when the CLI's own range reaches the fix. When Renovate bumps the CLI, run `npm audit` in `.github/vercel-cli` and check the preview deploy on its PR. CLI 65.8.0 was adopted on 2026-10-30, a week inside the cooldown, with maintainer approval, because Vercel requires it for Node 26 prebuilt deploys. Only packages from that Vercel release are younger than 7 days; two third-party ones are held to older releases by exact overrides (`@napi-rs/wasm-runtime` 1.2.5, `@types/estree` 1.0.9), which can go after 2026-11-06. diff --git a/bench/web/package.json b/bench/web/package.json index 42ac33b..43cd045 100644 --- a/bench/web/package.json +++ b/bench/web/package.json @@ -23,7 +23,7 @@ }, "devDependencies": { "@testcontainers/postgresql": "^12.0.1", - "@types/node": "^24.19.2", + "@types/node": "^26.6.5", "@types/pg": "^8.23.1", "@types/react": "^19.3.0", "@types/react-dom": "^19.3.0", diff --git a/bun.lock b/bun.lock index 5c86378..a270fba 100644 --- a/bun.lock +++ b/bun.lock @@ -42,7 +42,7 @@ }, "devDependencies": { "@testcontainers/postgresql": "^12.0.1", - "@types/node": "^24.19.2", + "@types/node": "^26.6.5", "@types/pg": "^8.23.1", "@types/react": "^19.3.0", "@types/react-dom": "^19.3.0", @@ -1209,8 +1209,6 @@ "@types/ssh2/@types/node": ["@types/node@18.19.130", "", { "dependencies": { "undici-types": "~5.26.4" } }, "sha512-GRaXQx6jGfL8sKfaIDD6OupbIHBr9jv7Jnaml9tB7l4v068PAOXqfcujMMo5PhbIs6ggR1XODELqahT2R8v0fg=="], - "benchmarks-web/@types/node": ["@types/node@24.19.2", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-93d49wCWJkCyN87MxLpNN6KXPCwFw7bVUg79mGUV1OS40JGWwVCr8n61DXCSqz7CV6/VfPkb7xec7uP2M+QHWQ=="], - "bl/buffer": ["buffer@5.7.1", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.1.13" } }, "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ=="], "bl/readable-stream": ["readable-stream@3.6.2", "", { "dependencies": { "inherits": "^2.0.3", "string_decoder": "^1.1.1", "util-deprecate": "^1.0.1" } }, "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA=="], @@ -1267,8 +1265,6 @@ "@types/ssh2/@types/node/undici-types": ["undici-types@5.26.5", "", {}, "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA=="], - "benchmarks-web/@types/node/undici-types": ["undici-types@7.24.6", "", {}, "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg=="], - "dockerode/tar-fs/tar-stream": ["tar-stream@2.2.0", "", { "dependencies": { "bl": "^4.0.3", "end-of-stream": "^1.4.1", "fs-constants": "^1.0.0", "inherits": "^2.0.3", "readable-stream": "^3.1.1" } }, "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ=="], "hast-util-from-html/parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="], diff --git a/renovate.json b/renovate.json index 069fa14..97dabdb 100644 --- a/renovate.json +++ b/renovate.json @@ -41,12 +41,6 @@ "matchPackageNames": ["@types/node"], "allowedVersions": "<27" }, - { - "description": "bench's functions still run on Node 24 (see CLAUDE.md, bench), so hold its @types/node to 24. Drop this when the benchmarks-website project moves to 26.x.", - "matchFileNames": ["bench/web/package.json"], - "matchPackageNames": ["@types/node"], - "allowedVersions": "<25" - }, { "groupName": "Next.js", "matchPackageNames": ["next", "@next/**"]