From 969d807f93b7d4b2d76d946a316334e6ff51cbe2 Mon Sep 17 00:00:00 2001 From: ugi-dev Date: Sun, 8 Nov 2026 10:08:04 +1100 Subject: [PATCH] chore(deps): bump happy-dom to 21, biome to 2.6, bun to 1.4.4 Fixes two Socket alerts on happy-dom@20.14.6, pulled in through @happy-dom/global-registrator in packages/react: - SSRF via iframe and link stylesheet (<= 20.14.6, fixed in 21.0.0) - Unsanitized import alias leads to host code execution, an incomplete fix for CVE-2026-33943 (<= 21.0.3, fixed in 21.0.4) Also bumps @biomejs/biome 2.5.15 -> 2.6.6, @types/bun to ^1.4.4 and packageManager to bun@1.4.4. Biome 2.6 adds rules that flagged the tests, so the Streamed test components move to module level (noComponentHookFactories), the compat tests compare exports via Object.entries instead of dynamic namespace access, and the biome.json schema URL points at 2.6.6. --- biome.json | 2 +- bun.lock | 36 ++++++++++++---------- package.json | 6 ++-- packages/compat-rehype/test/compat.test.ts | 2 +- packages/compat/package.json | 2 +- packages/compat/test/compat.test.ts | 2 +- packages/kirari/package.json | 2 +- packages/react/package.json | 2 +- packages/react/test/hook.test.tsx | 15 +++++---- packages/react/test/stream.test.tsx | 9 +++--- scripts/check-packages.ts | 2 +- 11 files changed, 44 insertions(+), 36 deletions(-) diff --git a/biome.json b/biome.json index 5ec4143..eeaed39 100644 --- a/biome.json +++ b/biome.json @@ -1,5 +1,5 @@ { - "$schema": "https://biomejs.dev/schemas/2.5.15/schema.json", + "$schema": "https://biomejs.dev/schemas/2.6.6/schema.json", "vcs": { "enabled": true, "clientKind": "git", diff --git a/bun.lock b/bun.lock index 8275dcd..82cf15c 100644 --- a/bun.lock +++ b/bun.lock @@ -5,9 +5,9 @@ "": { "name": "kirari-workspace", "devDependencies": { - "@biomejs/biome": "2.5.15", + "@biomejs/biome": "2.6.6", "@changesets/cli": "^3.0.3", - "@types/bun": "^1.4.3", + "@types/bun": "^1.4.4", "typescript": "^7.0.2", }, }, @@ -62,7 +62,7 @@ "name": "kirari-react", "version": "1.2.0", "devDependencies": { - "@happy-dom/global-registrator": "^20.14.6", + "@happy-dom/global-registrator": "^21.0.4", "@types/react": "^19.3.0", "@types/react-dom": "^19.3.0", "kirari": "workspace:*", @@ -129,23 +129,27 @@ }, }, "packages": { - "@biomejs/biome": ["@biomejs/biome@2.5.15", "", { "optionalDependencies": { "@biomejs/cli-darwin-arm64": "2.5.15", "@biomejs/cli-darwin-x64": "2.5.15", "@biomejs/cli-linux-arm64": "2.5.15", "@biomejs/cli-linux-arm64-musl": "2.5.15", "@biomejs/cli-linux-x64": "2.5.15", "@biomejs/cli-linux-x64-musl": "2.5.15", "@biomejs/cli-win32-arm64": "2.5.15", "@biomejs/cli-win32-x64": "2.5.15" }, "bin": { "biome": "bin/biome" } }, "sha512-WZTW4slm/pdkh92K6t/3aEN++44JD1PQ7squ7RCMLI1flHGl43DVOIGXvCjHiZgBMO1V4uYxoFNtqrIA4qGuIQ=="], + "@biomejs/biome": ["@biomejs/biome@2.6.6", "", { "optionalDependencies": { "@biomejs/cli-android-arm64": "2.6.6", "@biomejs/cli-android-x64": "2.6.6", "@biomejs/cli-darwin-arm64": "2.6.6", "@biomejs/cli-darwin-x64": "2.6.6", "@biomejs/cli-linux-arm64": "2.6.6", "@biomejs/cli-linux-arm64-musl": "2.6.6", "@biomejs/cli-linux-x64": "2.6.6", "@biomejs/cli-linux-x64-musl": "2.6.6", "@biomejs/cli-win32-arm64": "2.6.6", "@biomejs/cli-win32-x64": "2.6.6" }, "bin": { "biome": "bin/biome" } }, "sha512-NCgVJRyrU1+hsW1ILNaRqNAb9fRL4n49bwyef+wjVJQ488/bXbp0BfnNqTTExkiNQT3ugkgYKR1vK8NxsjlNSQ=="], - "@biomejs/cli-darwin-arm64": ["@biomejs/cli-darwin-arm64@2.5.15", "", { "os": "darwin", "cpu": "arm64" }, "sha512-BZVzFhJ/mUvTLMYbc9x6el0o2Uv5zP7bACYyhFb6fSc1giroXm7PL0a5KqMJ9F+/BnkYRjagD/ROSDVOZ6eapg=="], + "@biomejs/cli-android-arm64": ["@biomejs/cli-android-arm64@2.6.6", "", { "os": "android", "cpu": "arm64" }, "sha512-bicnqNNxEX7pjkDQaptYvPRIWDfgXJLl/Ok7iZjC+F1AhfReor3FSS7SgPYnOvUy/jf++5U/KYN4T8OKH5rrNA=="], - "@biomejs/cli-darwin-x64": ["@biomejs/cli-darwin-x64@2.5.15", "", { "os": "darwin", "cpu": "x64" }, "sha512-V5Kw63V+fVGNFhFrizDxMbGXAzZCh8kYzJpy3GI6gTapWDg7bZK9oYC9CbVgQSEdTnupz0U5Efz8Ev+5vdBBXw=="], + "@biomejs/cli-android-x64": ["@biomejs/cli-android-x64@2.6.6", "", { "os": "android", "cpu": "x64" }, "sha512-N443kDSElF4kDMKjarsL+ymj/ewLA5R9VAdawA7fJ7pwgN3JVDZp0K+xhKBglH8EwsKi2+K8xC6WxXSkgziFfw=="], - "@biomejs/cli-linux-arm64": ["@biomejs/cli-linux-arm64@2.5.15", "", { "os": "linux", "cpu": "arm64" }, "sha512-XaG7P7eeSLYETD3K9grfB0mQmpLQZjygdbsxekWBJAg4am79fGAtRpfRyNnTvXB2fZFNnJZG3nXm7HBat0+VUw=="], + "@biomejs/cli-darwin-arm64": ["@biomejs/cli-darwin-arm64@2.6.6", "", { "os": "darwin", "cpu": "arm64" }, "sha512-/vSAqWx3by3p8w5ew+HVJDgguuaTK3U6Fb5gk/oDUH21iWOopm3gOlhT6tZfy5mTaM5R4CVc3uFWkxBtEDrKyw=="], - "@biomejs/cli-linux-arm64-musl": ["@biomejs/cli-linux-arm64-musl@2.5.15", "", { "os": "linux", "cpu": "arm64" }, "sha512-tGzZUTcJCV7tj5Adh/Gn6nR4MycqA3iohq2LEcrarAgRBkU0h0OKd2UzCRkOsOYOuUGaUJb4YmqRqyy2feGGSw=="], + "@biomejs/cli-darwin-x64": ["@biomejs/cli-darwin-x64@2.6.6", "", { "os": "darwin", "cpu": "x64" }, "sha512-lLdOAJKbrAoDs+3GvTyVmMW345D9IhrIE3GgoL2eeHwO1boN4VhrSlALtFYsP0p+Jy4udUp4bTguij0qjKrH8w=="], - "@biomejs/cli-linux-x64": ["@biomejs/cli-linux-x64@2.5.15", "", { "os": "linux", "cpu": "x64" }, "sha512-xE4iEW/3LqlYj9GFgGrFsFSH51dEEpUbYWBfeOv0q87WkUDxK2o/HhreSb7qMJqck70RVM6Lg96hgedcAYcOkA=="], + "@biomejs/cli-linux-arm64": ["@biomejs/cli-linux-arm64@2.6.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-UzJdUCg9dbEGpZOuZRyehEPrnwKjx9z4Um7sWLG5x6txu7UjeWdJZuBXVGlyAdD39w2Hx0nZeK1jKC4NFUTCNQ=="], - "@biomejs/cli-linux-x64-musl": ["@biomejs/cli-linux-x64-musl@2.5.15", "", { "os": "linux", "cpu": "x64" }, "sha512-IlxUcyxilVGPsE008x13pWdkTbU3nQpP2i9b5UrbOYj6goBkKsRX1XB7yJLcV+O1H9LBchIIm4adOaVLZBX0ZQ=="], + "@biomejs/cli-linux-arm64-musl": ["@biomejs/cli-linux-arm64-musl@2.6.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-rw2Vsoi/WZGDyRjMXx9KZH9zsHe79LIzkdWHkLqsIkeKZm6qiGxtiIApxn7cmJSoEPaSvHaH5pRj1FhTcyL/XA=="], - "@biomejs/cli-win32-arm64": ["@biomejs/cli-win32-arm64@2.5.15", "", { "os": "win32", "cpu": "arm64" }, "sha512-2kPKzhNlm8C+Ru3GcO0Me2ODkCBLrVOUNuyi84RJyWDVKAA4+Kjj3jMjL938lF6BRfvltC4vB2nPY9SvN51Ovg=="], + "@biomejs/cli-linux-x64": ["@biomejs/cli-linux-x64@2.6.6", "", { "os": "linux", "cpu": "x64" }, "sha512-l8/aPXc1cz8VpUyd4hb5Pm5zx+X3voQBks4aLYbp5pC8KSchuHyvqDfY5xax39qCHomI/2xn6NKEot+zebG38g=="], - "@biomejs/cli-win32-x64": ["@biomejs/cli-win32-x64@2.5.15", "", { "os": "win32", "cpu": "x64" }, "sha512-yAzh4UqEImV6Hcy0zjUqNfJAsUhoD64FBQCdTG8Md/Z2wQeVP/ZmJ3XRYAs1g8J9fjTFyl2fCtc5FB5til47+g=="], + "@biomejs/cli-linux-x64-musl": ["@biomejs/cli-linux-x64-musl@2.6.6", "", { "os": "linux", "cpu": "x64" }, "sha512-DiKejs+GnFbOVQsBnukUpiB+T13tqUDFGwwjsTq51vatAsaflzFzVD0BOgjVUGRrqKgE0K0Xf+wNtkcmdN2chw=="], + + "@biomejs/cli-win32-arm64": ["@biomejs/cli-win32-arm64@2.6.6", "", { "os": "win32", "cpu": "arm64" }, "sha512-DjVXwQAQeHrO1JEZAEus54k40Tnh4glyU3VFLcDBKwoz0xnxCEnqw6TCMXoujcQMQynWd3AY8bLrbR1o0XNqow=="], + + "@biomejs/cli-win32-x64": ["@biomejs/cli-win32-x64@2.6.6", "", { "os": "win32", "cpu": "x64" }, "sha512-B7KMG26A4I9lAuxwBGMmiVcjMGAeJRoz+pzFt9brRvOAsIrgOu8ptJld5rUWui6tM1uiJwxeJhhDPuAiZtxXdw=="], "@changesets/apply-release-plan": ["@changesets/apply-release-plan@8.1.1", "", { "dependencies": { "@changesets/config": "^4.0.1", "@changesets/format": "^0.1.2", "@changesets/git": "^4.0.1", "@changesets/should-skip-package": "^1.0.0", "@changesets/types": "^7.0.0", "import-meta-resolve": "^4.2.0", "jsonc-parser": "^3.3.1", "semver": "^7.8.1" } }, "sha512-nk2Hbq3M9NeHMdaIRBDvawKrQJzXB9sGyBUE5yWnIKtvdcNCPj75zBekJYr0gTT2ecJH3eFeTrc8eisPImcv0Q=="], @@ -183,7 +187,7 @@ "@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="], - "@happy-dom/global-registrator": ["@happy-dom/global-registrator@20.14.6", "", { "dependencies": { "@types/node": ">=20.0.0", "happy-dom": "^20.14.6" } }, "sha512-Xd2FwCdm0cAZ+EG0upp69tpxBT9jtvVxaZv1lnbgWsNaZyEuPs0PojYgvCmtQ1RRdRCYCyWTeLjn3Z0aSxDchA=="], + "@happy-dom/global-registrator": ["@happy-dom/global-registrator@21.0.4", "", { "dependencies": { "@types/node": ">=20.0.0", "happy-dom": "^21.0.4" } }, "sha512-Bbr0hW9hhDhBf3Jp0EyDlkCbFgbr0z2jd3BMKYOYW+fOkPM4Nx195GMXyCtRCGEgoNn6i09FabXrSkNFm2ONzg=="], "@img/colour": ["@img/colour@1.1.0", "", {}, "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ=="], @@ -269,7 +273,7 @@ "@swc/helpers": ["@swc/helpers@0.5.23", "", { "dependencies": { "tslib": "^2.8.0" } }, "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw=="], - "@types/bun": ["@types/bun@1.4.3", "", { "dependencies": { "bun-types": "1.4.3" } }, "sha512-N67Pqy8JXbAY/j0tNraS3V5mubGvc6rrrNDmDCtZLlFzccbUJPDb0tvgUBC5q4m8ybkP93Jcn1QB+RYQ6PvBhw=="], + "@types/bun": ["@types/bun@1.4.4", "", { "dependencies": { "bun-types": "1.4.4" } }, "sha512-9wkRDXUXK124pEnAutE6n/l18j+i9GC5IAHK8TmX/2nlySETmky0OU6yL5U8pW1AoKh++AN9auDCr647BfurjQ=="], "@types/debug": ["@types/debug@4.1.13", "", { "dependencies": { "@types/ms": "*" } }, "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw=="], @@ -361,7 +365,7 @@ "buffer-image-size": ["buffer-image-size@0.6.4", "", { "dependencies": { "@types/node": "*" } }, "sha512-nEh+kZOPY1w+gcCMobZ6ETUp9WfibndnosbpwB1iJk/8Gt5ZF2bhS6+B6bPYz424KtwsR6Rflc3tCz1/ghX2dQ=="], - "bun-types": ["bun-types@1.4.3", "", { "dependencies": { "@types/node": "*", "undici-types": "*" } }, "sha512-tinRJNGOmUN+tEAsn2y2e942n9JHRHR42iUYzDH75NmhJqVBokGSQkkfSFdNWwsANIdrK6ACH9t01M452YyTwg=="], + "bun-types": ["bun-types@1.4.4", "", { "dependencies": { "@types/node": "*", "undici-types": "*" } }, "sha512-yjrJh5oGX7mMPKGd19YXyIjmEuj4G4zNC30bs7PM9Az7NQ3ndF3j6hbeRdvJTRQEhJ/FYQwW0a2moweEi2hMxQ=="], "cac": ["cac@7.1.0", "", {}, "sha512-LMDU/U2yA4IPIY8KT0NsNPWEYZvAMkbgyspxJ6btJaYV+WMDOHAZCmB0lsTObiHaRS1V/ztKAl7+TSkTqXyeoA=="], @@ -433,7 +437,7 @@ "gsap": ["gsap@3.15.0", "", {}, "sha512-dMW4CWBTUK1AEEDeZc1g4xpPGIrSf9fJF960qbTZmN/QwZIWY5wgliS6JWl9/25fpTGJrMRtSjGtOmPnfjZB+A=="], - "happy-dom": ["happy-dom@20.14.6", "", { "dependencies": { "@types/node": ">=20.0.0", "@types/whatwg-mimetype": "^3.0.2", "@types/ws": "^8.18.1", "buffer-image-size": "^0.6.4", "entities": "^7.0.1", "whatwg-mimetype": "^3.0.0", "ws": "^8.21.0" } }, "sha512-5DDsf4QmEIlRL6NkCv/fxSjYHHkZceL/IaYQdJc2h3G7DRTEai++VTjbfL0LB9geW2VrA3+vrjF3Efx+OTtX0Q=="], + "happy-dom": ["happy-dom@21.0.4", "", { "dependencies": { "@types/node": ">=20.0.0", "@types/whatwg-mimetype": "^3.0.2", "@types/ws": "^8.18.1", "buffer-image-size": "^0.6.4", "entities": "^7.0.1", "whatwg-mimetype": "^3.0.0", "ws": "^8.21.0" } }, "sha512-tFm+GaLBgo6o0awHnvHaNoraVo27qJ+2tZEtZ+cIa08hXbeitrxAJajLI05hsUy/2/YTKcUjQYzHe5mCcraLBw=="], "hast-util-sanitize": ["hast-util-sanitize@5.0.2", "", { "dependencies": { "@types/hast": "^3.0.0", "@ungap/structured-clone": "^1.0.0", "unist-util-position": "^5.0.0" } }, "sha512-3yTWghByc50aGS7JlGhk61SPenfE/p1oaFeNwkOOyrscaOkMGrcW9+Cy/QAIOBpZxP1yqDIzFMR0+Np0i0+usg=="], diff --git a/package.json b/package.json index 6b368ad..1138400 100644 --- a/package.json +++ b/package.json @@ -35,11 +35,11 @@ "release:kirari-react": "bash ./bin/release.sh --filter react", "lint": "biome lint" }, - "packageManager": "bun@1.3.11", + "packageManager": "bun@1.4.4", "devDependencies": { - "@biomejs/biome": "2.5.15", + "@biomejs/biome": "2.6.6", "@changesets/cli": "^3.0.3", - "@types/bun": "^1.4.3", + "@types/bun": "^1.4.4", "typescript": "^7.0.2" } } diff --git a/packages/compat-rehype/test/compat.test.ts b/packages/compat-rehype/test/compat.test.ts index 0c778de..db49076 100644 --- a/packages/compat-rehype/test/compat.test.ts +++ b/packages/compat-rehype/test/compat.test.ts @@ -11,6 +11,6 @@ test('exposes the same entry points as kirari-rehype', async () => { test('re-exports the same objects as kirari-rehype, including the default plugin', () => { expect(Object.keys(scoped).sort()).toEqual(Object.keys(rehype).sort()) - for (const key of Object.keys(rehype)) expect(scoped[key as keyof typeof scoped]).toBe(rehype[key as keyof typeof rehype]) + for (const [key, value] of Object.entries(rehype)) expect(Reflect.get(scoped, key)).toBe(value) expect(scoped.default).toBe(rehype.default) }) diff --git a/packages/compat/package.json b/packages/compat/package.json index caeaef8..42d4bc5 100644 --- a/packages/compat/package.json +++ b/packages/compat/package.json @@ -70,7 +70,7 @@ "check": "bun run build && bun run typecheck && bun test ./test", "prepublishOnly": "bun run build" }, - "packageManager": "bun@1.3.11", + "packageManager": "bun@1.4.4", "publishConfig": { "access": "public" }, diff --git a/packages/compat/test/compat.test.ts b/packages/compat/test/compat.test.ts index 5d02fb0..d6e2bb9 100644 --- a/packages/compat/test/compat.test.ts +++ b/packages/compat/test/compat.test.ts @@ -16,7 +16,7 @@ test('exposes the same entry points as kirari', () => { test('re-exports the same objects, so both names share one registry and one set of languages', async () => { expect(Object.keys(scoped).sort()).toEqual(Object.keys(core).sort()) - for (const key of Object.keys(core)) expect(scoped[key as keyof typeof scoped]).toBe(core[key as keyof typeof core]) + for (const [key, value] of Object.entries(core)) expect(Reflect.get(scoped, key)).toBe(value) expect(scopedLanguages).toEqual(coreLanguages) for (const entry of ['core', 'stream', 'decorations', 'registry', 'markdown']) { const [left, right] = await Promise.all([import(`@vortexlabs/kirari/${entry}`), import(`kirari/${entry}`)]) diff --git a/packages/kirari/package.json b/packages/kirari/package.json index 47a960d..2785745 100644 --- a/packages/kirari/package.json +++ b/packages/kirari/package.json @@ -75,7 +75,7 @@ "check": "bun run typecheck && bun test ./test && bun run build && bun test ./checks && bun run size", "prepublishOnly": "bun run build" }, - "packageManager": "bun@1.3.11", + "packageManager": "bun@1.4.4", "publishConfig": { "access": "public" }, diff --git a/packages/react/package.json b/packages/react/package.json index c0226dd..27469da 100644 --- a/packages/react/package.json +++ b/packages/react/package.json @@ -52,7 +52,7 @@ } }, "devDependencies": { - "@happy-dom/global-registrator": "^20.14.6", + "@happy-dom/global-registrator": "^21.0.4", "@types/react": "^19.3.0", "@types/react-dom": "^19.3.0", "kirari": "workspace:*", diff --git a/packages/react/test/hook.test.tsx b/packages/react/test/hook.test.tsx index 58cb911..3ad7c63 100644 --- a/packages/react/test/hook.test.tsx +++ b/packages/react/test/hook.test.tsx @@ -18,15 +18,18 @@ beforeAll(async () => { }) afterAll(() => GlobalRegistrator.unregister()) +type Handle = { current?: StreamedTokens } + +const Streamed = ({ language, handle }: { language: Language, handle: Handle }) => { + handle.current = useTokenStream(language) + return +} + const mount = (language: Language) => { const container = document.createElement('div') let root!: Root - const handle: { current?: StreamedTokens } = {} - const Streamed = ({ language }: { language: Language }) => { - handle.current = useTokenStream(language) - return - } - const render = (language: Language) => act(() => root.render()) + const handle: Handle = {} + const render = (language: Language) => act(() => root.render()) act(() => { root = createRoot(container) }) render(language) return { container, handle, render, unmount: () => act(() => root.unmount()) } diff --git a/packages/react/test/stream.test.tsx b/packages/react/test/stream.test.tsx index 1ebd562..d64c9a1 100644 --- a/packages/react/test/stream.test.tsx +++ b/packages/react/test/stream.test.tsx @@ -22,10 +22,11 @@ for (const language of [javascript, python] as Language[]) { }) } +const Streamed = () => { + const { tokens } = useTokenStream(javascript) + return +} + test('the hook starts empty and its tokens render through Code', () => { - const Streamed = () => { - const { tokens } = useTokenStream(javascript) - return - } expect(renderToStaticMarkup()).toBe('
') }) diff --git a/scripts/check-packages.ts b/scripts/check-packages.ts index 73db5dd..bb97910 100644 --- a/scripts/check-packages.ts +++ b/scripts/check-packages.ts @@ -69,7 +69,7 @@ try { } const installed = JSON.parse(await readFile(join(consumer, 'node_modules/kirari-rehype/package.json'), 'utf8')) assert.ok(installed.dependencies['@types/hast'], 'Public declarations require HAST types') - assert.ok(installed.peerDependencies['kirari'], 'The integration must use the host Kirari') + assert.ok(installed.peerDependencies.kirari, 'The integration must use the host Kirari') const reactManifest = JSON.parse(await readFile(join(consumer, 'node_modules/kirari-react/package.json'), 'utf8')) for (const peer of ['kirari', 'react']) { assert.ok(reactManifest.peerDependencies[peer], `The React integration must use the host ${peer}`)