diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 7158180a..c719e888 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -33,17 +33,17 @@ catalogs: overrides: esbuild: 0.28.1 - postcss: 8.5.18 + postcss: 8.5.23 tmp@<0.2.6: ^0.2.6 uuid@<11.1.1: ^11.1.1 js-yaml@<4.3.0: ^4.3.0 form-data@<4.0.6: ^4.0.6 - undici@<7.28.0: ^7.28.0 + undici@<7.29.0: ^7.29.0 brace-expansion@<1.1.16: ^1.1.16 minimatch@<4.0.0: ^5.1.9 body-parser@<1.20.6: ^1.20.6 - fast-uri@<3.1.3: ^3.1.3 - hono@<4.12.27: ^4.12.27 + fast-uri@<3.1.5: ^3.1.5 + hono@<4.12.34: ^4.12.34 '@hono/node-server@<2.0.5': ^2.0.5 sharp@<0.35.0: ^0.35.0 @@ -589,7 +589,7 @@ importers: version: 7.13.0(typescript@6.0.3) tsup: specifier: ^8.5.1 - version: 8.5.1(jiti@2.7.0)(postcss@8.5.18)(tsx@4.23.1)(typescript@6.0.3)(yaml@2.9.0) + version: 8.5.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.23.1)(typescript@6.0.3)(yaml@2.9.0) packages/sdks: {} @@ -683,7 +683,7 @@ importers: dependencies: '@remotion/cli': specifier: 'catalog:' - version: 4.0.503(@swc/helpers@0.5.15)(postcss@8.5.18)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3) + version: 4.0.503(@swc/helpers@0.5.15)(postcss@8.5.23)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3) '@remotion/google-fonts': specifier: 'catalog:' version: 4.0.503(react-dom@19.2.7(react@19.2.7))(react@19.2.7) @@ -705,13 +705,13 @@ importers: devDependencies: '@remotion/bundler': specifier: 'catalog:' - version: 4.0.503(@swc/helpers@0.5.15)(postcss@8.5.18)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) + version: 4.0.503(@swc/helpers@0.5.15)(postcss@8.5.23)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) '@remotion/renderer': specifier: 'catalog:' version: 4.0.503(react-dom@19.2.7(react@19.2.7))(react@19.2.7) '@remotion/tailwind-v4': specifier: 'catalog:' - version: 4.0.503(@remotion/bundler@4.0.503(@swc/helpers@0.5.15)(postcss@8.5.18)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@rspack/core@1.7.11(@swc/helpers@0.5.15))(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.18)) + version: 4.0.503(@remotion/bundler@4.0.503(@swc/helpers@0.5.15)(postcss@8.5.23)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@rspack/core@1.7.11(@swc/helpers@0.5.15))(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.23)) '@testing-library/react': specifier: ^16.3.2 version: 16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) @@ -754,7 +754,7 @@ importers: version: 5.20260804.1 tsup: specifier: ^8.5.1 - version: 8.5.1(jiti@2.7.0)(postcss@8.5.18)(tsx@4.23.1)(typescript@6.0.3)(yaml@2.9.0) + version: 8.5.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.23.1)(typescript@6.0.3)(yaml@2.9.0) packages: @@ -1662,7 +1662,7 @@ packages: resolution: {integrity: sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==} engines: {node: '>=20'} peerDependencies: - hono: ^4.12.27 + hono: ^4.12.34 '@humanfs/core@0.19.2': resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==} @@ -4904,8 +4904,8 @@ packages: fast-levenshtein@2.0.6: resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==} - fast-uri@3.1.4: - resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==} + fast-uri@3.1.5: + resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} fast-xml-builder@1.3.0: resolution: {integrity: sha512-F74cZEdCvuw9P41GAC3rod4X04jjWGM1JPEv/GWSqFTWLsdyMSBMBMlm9Hk3GLBgLBbdBNY8yee0pQh2RBVESQ==} @@ -5164,8 +5164,8 @@ packages: resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==} engines: {node: '>= 0.4'} - hono@4.12.32: - resolution: {integrity: sha512-XcuyW9qE2kJn07PkecMOBd5Vq/hMy7mmGw+idz1yblbg9N17ijJODrvPkn7/dwL3Kulj8LcRJ69DLOWf91dRUg==} + hono@4.13.0: + resolution: {integrity: sha512-jhunvfHWxd7J5EFfSgH4xsYJzSe/lfqbUCxiyyeaQasUsXeEHXtzVid+7EOGByc5JnFa23SSFL3Y2RV/z1T+eQ==} engines: {node: '>=16.9.0'} html-encoding-sniffer@6.0.0: @@ -5228,7 +5228,7 @@ packages: resolution: {integrity: sha512-soFhflCVWLfRNOPU3iv5Z9VUdT44xFRbzjLsEzSr5AQmgqPMTHdU3PMT1Cf1ssx8fLNJDA1juftYl+PUcv3MqA==} engines: {node: ^10 || ^12 || >= 14} peerDependencies: - postcss: 8.5.18 + postcss: 8.5.23 ieee754@1.2.1: resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==} @@ -6386,7 +6386,7 @@ packages: engines: {node: '>= 18'} peerDependencies: jiti: '>=1.21.0' - postcss: 8.5.18 + postcss: 8.5.23 tsx: ^4.8.1 yaml: ^2.4.2 peerDependenciesMeta: @@ -6403,25 +6403,25 @@ packages: resolution: {integrity: sha512-k3kNe0aNFQDAZGbin48pL2VNidTF0w4/eASDsxlyspobzU3wZQLOGj7L9gfRe0Jo9/4uud09DsjFNH7winGv8Q==} engines: {node: ^10 || ^12 || >= 14} peerDependencies: - postcss: 8.5.18 + postcss: 8.5.23 postcss-modules-local-by-default@4.2.0: resolution: {integrity: sha512-5kcJm/zk+GJDSfw+V/42fJ5fhjL5YbFDl8nVdXkJPLLW+Vf9mTD5Xe0wqIaDnLuL2U6cDNpTr+UQ+v2HWIBhzw==} engines: {node: ^10 || ^12 || >= 14} peerDependencies: - postcss: 8.5.18 + postcss: 8.5.23 postcss-modules-scope@3.2.1: resolution: {integrity: sha512-m9jZstCVaqGjTAuny8MdgE88scJnCiQSlSrOWcTQgM2t32UBe+MUmFSO5t7VMSfAf/FJKImAxBav8ooCHJXCJA==} engines: {node: ^10 || ^12 || >= 14} peerDependencies: - postcss: 8.5.18 + postcss: 8.5.23 postcss-modules-values@4.0.0: resolution: {integrity: sha512-RDxHkAiEGI78gS2ofyvCsu7iycRv7oqw5xMWn9iMoR0N/7mf9D50ecQqUo5BZ9Zh2vH4bCUR/ktCqbB9m8vJjQ==} engines: {node: ^10 || ^12 || >= 14} peerDependencies: - postcss: 8.5.18 + postcss: 8.5.23 postcss-selector-parser@7.1.4: resolution: {integrity: sha512-HeP7D2wyhkR+XaK6v4W8oRF62Dsz4flyuczALJp61GckGm42u1saSSJ/0auvcBqxs3jMRFEcPK34At/0JBKdOg==} @@ -6430,8 +6430,8 @@ packages: postcss-value-parser@4.2.0: resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==} - postcss@8.5.18: - resolution: {integrity: sha512-xdB1oSLHbz1vRWgCDalrCqEFTWzFlhqFC5tIHLMOSUIjhm3XXQ1qrFy8S/ESr1JYRRXqM3c1QFiMZUJdUTqyMQ==} + postcss@8.5.23: + resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==} engines: {node: ^10 || ^12 || >=14} postgres-array@2.0.0: @@ -7237,7 +7237,7 @@ packages: peerDependencies: '@microsoft/api-extractor': ^7.36.0 '@swc/core': ^1 - postcss: 8.5.18 + postcss: 8.5.23 typescript: '>=4.5.0' peerDependenciesMeta: '@microsoft/api-extractor': @@ -7339,8 +7339,8 @@ packages: undici-types@8.3.0: resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==} - undici@7.28.0: - resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} + undici@7.29.0: + resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} engines: {node: '>=20.18.1'} undici@8.9.0: @@ -8941,9 +8941,9 @@ snapshots: '@gar/promise-retry@1.0.3': {} - '@hono/node-server@2.0.12(hono@4.12.32)': + '@hono/node-server@2.0.12(hono@4.13.0)': dependencies: - hono: 4.12.32 + hono: 4.13.0 '@humanfs/core@0.19.2': dependencies: @@ -9298,7 +9298,7 @@ snapshots: '@modelcontextprotocol/sdk@1.30.0(@cfworker/json-schema@4.1.1)(zod@4.4.3)': dependencies: - '@hono/node-server': 2.0.12(hono@4.12.32) + '@hono/node-server': 2.0.12(hono@4.13.0) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -9308,7 +9308,7 @@ snapshots: eventsource-parser: 3.1.0 express: 5.2.1 express-rate-limit: 8.6.1(express@5.2.1) - hono: 4.12.32 + hono: 4.13.0 jose: 6.2.4 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -9855,7 +9855,7 @@ snapshots: transitivePeerDependencies: - supports-color - '@remotion/bundler@4.0.503(@swc/helpers@0.5.15)(postcss@8.5.18)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)': + '@remotion/bundler@4.0.503(@swc/helpers@0.5.15)(postcss@8.5.23)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)': dependencies: '@remotion/media-parser': 4.0.503 '@remotion/studio': 4.0.503(react-dom@19.2.7(react@19.2.7))(react@19.2.7) @@ -9863,14 +9863,14 @@ snapshots: '@remotion/timeline-utils': 4.0.503 '@rspack/core': 1.7.11(@swc/helpers@0.5.15) '@rspack/plugin-react-refresh': 1.6.1(react-refresh@0.18.0) - css-loader: 7.1.4(@rspack/core@1.7.11(@swc/helpers@0.5.15))(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.18)) + css-loader: 7.1.4(@rspack/core@1.7.11(@swc/helpers@0.5.15))(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.23)) esbuild: 0.28.1 react: 19.2.7 react-dom: 19.2.7(react@19.2.7) react-refresh: 0.18.0 remotion: 4.0.503(react-dom@19.2.7(react@19.2.7))(react@19.2.7) - style-loader: 4.0.0(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.18)) - webpack: 5.105.0(esbuild@0.28.1)(postcss@8.5.18) + style-loader: 4.0.0(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.23)) + webpack: 5.105.0(esbuild@0.28.1)(postcss@8.5.23) transitivePeerDependencies: - '@minify-html/node' - '@swc/core' @@ -9891,14 +9891,14 @@ snapshots: '@remotion/captions@4.0.503': {} - '@remotion/cli@4.0.503(@swc/helpers@0.5.15)(postcss@8.5.18)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3)': + '@remotion/cli@4.0.503(@swc/helpers@0.5.15)(postcss@8.5.23)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3)': dependencies: - '@remotion/bundler': 4.0.503(@swc/helpers@0.5.15)(postcss@8.5.18)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) + '@remotion/bundler': 4.0.503(@swc/helpers@0.5.15)(postcss@8.5.23)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) '@remotion/media-utils': 4.0.503(react-dom@19.2.7(react@19.2.7))(react@19.2.7) '@remotion/player': 4.0.503(react-dom@19.2.7(react@19.2.7))(react@19.2.7) '@remotion/renderer': 4.0.503(react-dom@19.2.7(react@19.2.7))(react@19.2.7) '@remotion/studio': 4.0.503(react-dom@19.2.7(react@19.2.7))(react@19.2.7) - '@remotion/studio-server': 4.0.503(@swc/helpers@0.5.15)(postcss@8.5.18)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3) + '@remotion/studio-server': 4.0.503(@swc/helpers@0.5.15)(postcss@8.5.23)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3) '@remotion/studio-shared': 4.0.503(react-dom@19.2.7(react@19.2.7))(react@19.2.7) dotenv: 17.3.1 minimist: 1.2.6 @@ -10010,11 +10010,11 @@ snapshots: '@remotion/studio-protocol@4.0.503': {} - '@remotion/studio-server@4.0.503(@swc/helpers@0.5.15)(postcss@8.5.18)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3)': + '@remotion/studio-server@4.0.503(@swc/helpers@0.5.15)(postcss@8.5.23)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3)': dependencies: '@babel/parser': 7.24.1 '@babel/types': 7.24.0 - '@remotion/bundler': 4.0.503(@swc/helpers@0.5.15)(postcss@8.5.18)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) + '@remotion/bundler': 4.0.503(@swc/helpers@0.5.15)(postcss@8.5.23)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) '@remotion/renderer': 4.0.503(react-dom@19.2.7(react@19.2.7))(react@19.2.7) '@remotion/studio-codemods': 4.0.503(react-dom@19.2.7(react@19.2.7))(react@19.2.7) '@remotion/studio-protocol': 4.0.503 @@ -10083,12 +10083,12 @@ snapshots: - bufferutil - utf-8-validate - '@remotion/tailwind-v4@4.0.503(@remotion/bundler@4.0.503(@swc/helpers@0.5.15)(postcss@8.5.18)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@rspack/core@1.7.11(@swc/helpers@0.5.15))(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.18))': + '@remotion/tailwind-v4@4.0.503(@remotion/bundler@4.0.503(@swc/helpers@0.5.15)(postcss@8.5.23)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@rspack/core@1.7.11(@swc/helpers@0.5.15))(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.23))': dependencies: - '@remotion/bundler': 4.0.503(@swc/helpers@0.5.15)(postcss@8.5.18)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) - '@tailwindcss/webpack': 4.2.0(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.18)) - css-loader: 7.1.4(@rspack/core@1.7.11(@swc/helpers@0.5.15))(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.18)) - style-loader: 4.0.0(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.18)) + '@remotion/bundler': 4.0.503(@swc/helpers@0.5.15)(postcss@8.5.23)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) + '@tailwindcss/webpack': 4.2.0(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.23)) + css-loader: 7.1.4(@rspack/core@1.7.11(@swc/helpers@0.5.15))(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.23)) + style-loader: 4.0.0(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.23)) tailwindcss: 4.2.0 transitivePeerDependencies: - '@rspack/core' @@ -10767,16 +10767,16 @@ snapshots: '@alloc/quick-lru': 5.2.0 '@tailwindcss/node': 4.3.3 '@tailwindcss/oxide': 4.3.3 - postcss: 8.5.18 + postcss: 8.5.23 tailwindcss: 4.3.3 - '@tailwindcss/webpack@4.2.0(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.18))': + '@tailwindcss/webpack@4.2.0(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.23))': dependencies: '@alloc/quick-lru': 5.2.0 '@tailwindcss/node': 4.2.0 '@tailwindcss/oxide': 4.2.0 tailwindcss: 4.2.0 - webpack: 5.105.0(esbuild@0.28.1)(postcss@8.5.18) + webpack: 5.105.0(esbuild@0.28.1)(postcss@8.5.23) '@testing-library/dom@10.4.1': dependencies: @@ -11266,7 +11266,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.4 + fast-uri: 3.1.5 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -11799,19 +11799,19 @@ snapshots: csp_evaluator@1.1.5: {} - css-loader@7.1.4(@rspack/core@1.7.11(@swc/helpers@0.5.15))(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.18)): + css-loader@7.1.4(@rspack/core@1.7.11(@swc/helpers@0.5.15))(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.23)): dependencies: - icss-utils: 5.1.0(postcss@8.5.18) - postcss: 8.5.18 - postcss-modules-extract-imports: 3.1.0(postcss@8.5.18) - postcss-modules-local-by-default: 4.2.0(postcss@8.5.18) - postcss-modules-scope: 3.2.1(postcss@8.5.18) - postcss-modules-values: 4.0.0(postcss@8.5.18) + icss-utils: 5.1.0(postcss@8.5.23) + postcss: 8.5.23 + postcss-modules-extract-imports: 3.1.0(postcss@8.5.23) + postcss-modules-local-by-default: 4.2.0(postcss@8.5.23) + postcss-modules-scope: 3.2.1(postcss@8.5.23) + postcss-modules-values: 4.0.0(postcss@8.5.23) postcss-value-parser: 4.2.0 semver: 7.8.5 optionalDependencies: '@rspack/core': 1.7.11(@swc/helpers@0.5.15) - webpack: 5.105.0(esbuild@0.28.1)(postcss@8.5.18) + webpack: 5.105.0(esbuild@0.28.1)(postcss@8.5.23) css-select@7.0.0: dependencies: @@ -12424,7 +12424,7 @@ snapshots: fast-levenshtein@2.0.6: {} - fast-uri@3.1.4: {} + fast-uri@3.1.5: {} fast-xml-builder@1.3.0: dependencies: @@ -12708,7 +12708,7 @@ snapshots: dependencies: function-bind: 1.1.2 - hono@4.12.32: {} + hono@4.13.0: {} html-encoding-sniffer@6.0.0(@noble/hashes@2.2.0): dependencies: @@ -12778,9 +12778,9 @@ snapshots: dependencies: safer-buffer: 2.1.2 - icss-utils@5.1.0(postcss@8.5.18): + icss-utils@5.1.0(postcss@8.5.23): dependencies: - postcss: 8.5.18 + postcss: 8.5.23 ieee754@1.2.1: optional: true @@ -13444,7 +13444,7 @@ snapshots: dependencies: '@cspotcode/source-map-support': 0.8.1 sharp: 0.35.2 - undici: 7.28.0 + undici: 7.29.0 workerd: 1.20260730.1 ws: 8.21.0 youch: 4.1.0-beta.10 @@ -13550,7 +13550,7 @@ snapshots: '@swc/helpers': 0.5.15 baseline-browser-mapping: 2.11.6 caniuse-lite: 1.0.30001806 - postcss: 8.5.18 + postcss: 8.5.23 react: 19.2.8 react-dom: 19.2.8(react@19.2.8) styled-jsx: 5.1.6(@babel/core@7.29.7)(react@19.2.8) @@ -13873,35 +13873,35 @@ snapshots: postal-mime@2.7.5: {} - postcss-load-config@6.0.1(jiti@2.7.0)(postcss@8.5.18)(tsx@4.23.1)(yaml@2.9.0): + postcss-load-config@6.0.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.23.1)(yaml@2.9.0): dependencies: lilconfig: 3.1.3 optionalDependencies: jiti: 2.7.0 - postcss: 8.5.18 + postcss: 8.5.23 tsx: 4.23.1 yaml: 2.9.0 - postcss-modules-extract-imports@3.1.0(postcss@8.5.18): + postcss-modules-extract-imports@3.1.0(postcss@8.5.23): dependencies: - postcss: 8.5.18 + postcss: 8.5.23 - postcss-modules-local-by-default@4.2.0(postcss@8.5.18): + postcss-modules-local-by-default@4.2.0(postcss@8.5.23): dependencies: - icss-utils: 5.1.0(postcss@8.5.18) - postcss: 8.5.18 + icss-utils: 5.1.0(postcss@8.5.23) + postcss: 8.5.23 postcss-selector-parser: 7.1.4 postcss-value-parser: 4.2.0 - postcss-modules-scope@3.2.1(postcss@8.5.18): + postcss-modules-scope@3.2.1(postcss@8.5.23): dependencies: - postcss: 8.5.18 + postcss: 8.5.23 postcss-selector-parser: 7.1.4 - postcss-modules-values@4.0.0(postcss@8.5.18): + postcss-modules-values@4.0.0(postcss@8.5.23): dependencies: - icss-utils: 5.1.0(postcss@8.5.18) - postcss: 8.5.18 + icss-utils: 5.1.0(postcss@8.5.23) + postcss: 8.5.23 postcss-selector-parser@7.1.4: dependencies: @@ -13910,7 +13910,7 @@ snapshots: postcss-value-parser@4.2.0: {} - postcss@8.5.18: + postcss@8.5.23: dependencies: nanoid: 3.3.16 picocolors: 1.1.1 @@ -14669,9 +14669,9 @@ snapshots: '@tokenizer/token': 0.3.0 optional: true - style-loader@4.0.0(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.18)): + style-loader@4.0.0(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.23)): dependencies: - webpack: 5.105.0(esbuild@0.28.1)(postcss@8.5.18) + webpack: 5.105.0(esbuild@0.28.1)(postcss@8.5.23) styled-jsx@5.1.6(@babel/core@7.29.7)(react@19.2.8): dependencies: @@ -14763,16 +14763,16 @@ snapshots: - bare-abort-controller - react-native-b4a - terser-webpack-plugin@5.6.1(esbuild@0.28.1)(postcss@8.5.18)(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.18)): + terser-webpack-plugin@5.6.1(esbuild@0.28.1)(postcss@8.5.23)(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.23)): dependencies: '@jridgewell/trace-mapping': 0.3.31 jest-worker: 27.5.1 schema-utils: 4.3.3 terser: 5.49.0 - webpack: 5.105.0(esbuild@0.28.1)(postcss@8.5.18) + webpack: 5.105.0(esbuild@0.28.1)(postcss@8.5.23) optionalDependencies: esbuild: 0.28.1 - postcss: 8.5.18 + postcss: 8.5.23 terser@5.16.9: dependencies: @@ -14872,7 +14872,7 @@ snapshots: tslib@2.8.1: {} - tsup@8.5.1(jiti@2.7.0)(postcss@8.5.18)(tsx@4.23.1)(typescript@6.0.3)(yaml@2.9.0): + tsup@8.5.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.23.1)(typescript@6.0.3)(yaml@2.9.0): dependencies: bundle-require: 5.1.0(esbuild@0.28.1) cac: 6.7.14 @@ -14883,7 +14883,7 @@ snapshots: fix-dts-default-cjs-exports: 1.0.1 joycon: 3.1.1 picocolors: 1.1.1 - postcss-load-config: 6.0.1(jiti@2.7.0)(postcss@8.5.18)(tsx@4.23.1)(yaml@2.9.0) + postcss-load-config: 6.0.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.23.1)(yaml@2.9.0) resolve-from: 5.0.0 rollup: 4.62.2 source-map: 0.7.6 @@ -14892,7 +14892,7 @@ snapshots: tinyglobby: 0.2.17 tree-kill: 1.2.2 optionalDependencies: - postcss: 8.5.18 + postcss: 8.5.23 typescript: 6.0.3 transitivePeerDependencies: - jiti @@ -15020,7 +15020,7 @@ snapshots: undici-types@8.3.0: {} - undici@7.28.0: {} + undici@7.29.0: {} undici@8.9.0: {} @@ -15098,7 +15098,7 @@ snapshots: dependencies: lightningcss: 1.32.0 picomatch: 4.0.5 - postcss: 8.5.18 + postcss: 8.5.23 rolldown: 1.0.3 tinyglobby: 0.2.17 optionalDependencies: @@ -15168,7 +15168,7 @@ snapshots: webpack-sources@3.5.1: {} - webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.18): + webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.23): dependencies: '@types/eslint-scope': 3.7.7 '@types/estree': 1.0.9 @@ -15192,7 +15192,7 @@ snapshots: neo-async: 2.6.2 schema-utils: 4.3.3 tapable: 2.3.3 - terser-webpack-plugin: 5.6.1(esbuild@0.28.1)(postcss@8.5.18)(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.18)) + terser-webpack-plugin: 5.6.1(esbuild@0.28.1)(postcss@8.5.23)(webpack@5.105.0(esbuild@0.28.1)(postcss@8.5.23)) watchpack: 2.5.2 webpack-sources: 3.5.1 transitivePeerDependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 3c1d920a..adf1be24 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -24,22 +24,49 @@ onlyBuiltDependencies: # pnpm 10 reads `overrides` from here (same as the settings above), not package.json. # esbuild 0.28.1 -> fixes GHSA-gv7w-rqvm-qjhr (#8, high) + GHSA-g7r4-m6w7-qqqr (#7, low); # within vite 8's supported "^0.27.0 || ^0.28.0", no build-API breaking changes for our targets. -# postcss 8.5.18 -> fixes GHSA-r28c-9q8g-f849 (#32, high; `map: { prev: ... }` auto-loading follows +# postcss 8.5.23 -> fixes GHSA-fxqj-rqcc-2cmp (#42, med; the INCOMPLETE fix of GHSA-6g55-p6wh-862q — +# an attacker-controlled `sourceMappingURL` still reads an arbitrary `.map` file when `from` is +# unset), and before it GHSA-r28c-9q8g-f849 (#32, high; `map: { prev: ... }` auto-loading follows # a `sourceMappingURL` out of the source's directory, so compiling attacker-authored CSS discloses # an arbitrary `.map` file) and, still, CVE-2026-41305 / GHSA-qx2v-qp2m-jg93 (#1, medium). -# BUMPED from 8.5.15, which this bare key was actively HOLDING at a vulnerable version — a bare pin -# rewrites every copy, so the stale value is a floor AND a ceiling. It had also drifted BELOW two -# consumers' declared ranges (@tailwindcss/postcss 4.3.3 wants ^8.5.16, vite 8.1.5 wants ^8.5.17); -# 8.5.18 satisfies both, so this bump restores range compliance rather than straining it. +# BUMPED 8.5.18 -> 8.5.23 on 2026-08-05; before that from 8.5.15, which this bare key was actively +# HOLDING at a vulnerable version — a bare pin rewrites every copy, so a stale value is a floor AND +# a ceiling. It had also drifted BELOW two consumers' declared ranges (@tailwindcss/postcss 4.3.3 +# wants ^8.5.16, vite 8 wants ^8.5.15); 8.5.23 satisfies both, so this bump restores range +# compliance rather than straining it. # NB `next` declares an EXACT `postcss: 8.4.31`, which this bare key has crossed since #1; the # advisory's precondition is "processing untrusted CSS" and every stylesheet compiled here is # first-party, so the residual risk is build-time only. # The range-scoped pins below were stranded in package.json's "pnpm.overrides" (pnpm 10 stopped # reading that field, silently making them inert). Moved here so they apply again. Range-scoped # (`name@=4.0.6 (critical + high), undici >=7.28.0 (high/med/low), tmp >=0.2.6, +# form-data >=4.0.6 (critical + high), undici >=7.29.0 (high/med/low), tmp >=0.2.6, # uuid >=11.1.1, js-yaml >=4.3.0. # +# undici >=7.29.0 -> RETARGETED 2026-08-05 from the then-inert `<7.28.0` key (the tree sat at exactly +# 7.28.0, which the key could not match). Clears five alerts at once: GHSA-4cwx-7wf7-3272 (#35, +# high; cross-user disclosure + parse-time crash via degenerate private cache directives), +# GHSA-8xcm-r25x-g524 (#34, med; downstream response desync via the retry interceptor), +# GHSA-jr45-8vmc-qm54 (#37, med; cross-user disclosure via whitespace around `=` in Cache-Control), +# GHSA-m8rv-5g2x-5cg5 (#38, med; CRLF injection via a blob-like body `type`) and +# GHSA-v3r7-h72x-cjcm (#36, med; cookie attribute injection via unsanitized domain). +# The tree holds TWO copies and only ONE was vulnerable: miniflare's 7.28.0 (in-band) and jsdom's +# 8.9.0, which is already AT the 8.x fix floor (every one of the five advisories lists `>= 8.0.0, +# < 8.9.0 -> 8.9.0`). The `<7.29.0` key deliberately leaves the 8.x copy alone rather than dragging +# it anywhere. Both consumers are dev/test-only — miniflare is the local Workers runtime and jsdom +# the test environment — and undici is 0 of 648 inputs in the deployed MCP bundle, so nothing here +# is prod-reachable. +# ⚠ This is the ONE pin in this block that changes code we actually EXECUTE, and it crosses an +# EXACT declared version: miniflare 5.20260730.0-alpha declares `undici: 7.28.0` (pinned, not a +# range), so the override moves the local Workers runtime's HTTP stack off the version it shipped +# against. Verified rather than assumed, because a bad outcome here would surface as a test flake +# rather than a build error: apps/engine (the heaviest miniflare consumer, 35 files / 460 tests) +# was run 3x on each side of the bump — 460/460 passed all six times. An `EnvironmentTeardownError` +# ("Closing rpc while was pending") appears in the log nondeterministically, but it is +# PRE-EXISTING and unrelated: 7.28.0 emitted it in 2 of 3 runs and 7.29.0 in 0 of 3. Do not read a +# single A/B sample here as causation — that count is a race, and three runs is the minimum that +# distinguishes it. Re-run that comparison if this key is ever retargeted again. +# # CAUTION on the `name@=3.1.3 -> fixes GHSA-4c8g-83qw-93j6 (#30, high; the IDN path calls the non-existent -# `URL.domainToASCII`, swallows the resulting TypeError into `parsed.error`, and hands back a -# host still in Unicode — a check/use desync for anything gating on that host). The ONLY one of -# the five that ships: ajv is statically imported by the SDK's server/index.js and `require`s -# fast-uri at isolate init, putting 3 fast-uri modules in the Worker bundle. ajv@8.20.0 declares -# `fast-uri ^3.0.1`, so ^3.1.3 is an in-range patch bump. Reached only as ajv's `uriResolver` -# for schema `$id`/`$ref` (ajv-formats 3.0.1 implements `format: "uri"` as a regex and never -# calls it), and the outbound-delivery URL path does not touch ajv at all — so the HIGH rating -# does not carry over to this tree. NB @redocly/cli esbuild-INLINES its own copy of fast-uri -# 3.1.2, which the lockfile records as a zero-dep leaf; no override can reach those bytes. That -# copy is dev-only (`pnpm --filter @webhook-co/openapi validate`) and never deployed. -# hono >=4.12.27 -> fixes GHSA-hvrm-45r6-mjfj (#29, med; hono/jsx leaks context across requests), -# GHSA-w62v-xxxg-mg59 (#28, med; JSX escaping bypass in cx()) and GHSA-xgm2-5f3f-mvvc (#27, med; -# the API Gateway v1 adapter drops a repeated header). None are reachable: hono is 0 of 521 -# inputs in the deployed bundle, nothing in the tree imports hono/jsx, hono/css or -# hono/aws-lambda, and no tsconfig sets jsxImportSource. 4.12.27 satisfies the SDK's declared -# ^4.11.4 — an in-range minor, so this is a free hygiene pin. +# The three pins below clear seven alerts, all on transitives of ONE direct dependency — +# apps/mcp's `@modelcontextprotocol/sdk`, which is already the newest published release, so there is +# no parent bump to take instead. Reachability is measured against the real deployed artifact +# (`wrangler deploy -c apps/mcp/wrangler.jsonc --dry-run`), not inferred from node_modules — only +# fast-uri is actually in it. RE-MEASURED 2026-08-05 (3,295,870 bytes, 648 inputs, up from 2,673,185 +# / 521): fast-uri 3 of 648, hono 0 of 648, @hono/node-server 0 of 648. Re-measure on every retarget +# — a bundle that has grown by a quarter is not one whose old input census can be assumed forward. +# fast-uri >=3.1.5 -> RETARGETED 2026-08-05 from the then-inert `<3.1.3` key (the tree sat at 3.1.4, +# inside the new advisory's band and above the old key's ceiling). Fixes GHSA-7p8r-x3mc-p8w7 (#43, +# high; host confusion via a backslash authority introducer), and before it GHSA-4c8g-83qw-93j6 +# (#30, high; the IDN path calls the non-existent `URL.domainToASCII`, swallows the resulting +# TypeError into `parsed.error`, and hands back a host still in Unicode — a check/use desync for +# anything gating on that host). The ONLY one of the three that ships: ajv is statically imported +# by the SDK's server/index.js and `require`s fast-uri at isolate init, putting 3 fast-uri modules +# in the Worker bundle. ajv@8.20.0 declares `fast-uri ^3.0.1`, so ^3.1.5 is an in-range patch bump. +# Reached only as ajv's `uriResolver` for schema `$id`/`$ref` — re-verified 2026-08-05: the only +# call sites are dist/compile/resolve.js (schema `$id`/`$ref`, first-party schemas) and the +# dist/core.js default, and ajv-formats 3.0.1 still implements `format: "uri"` as a regex and never +# calls it. So a request payload never reaches fast-uri's host parser, and the HIGH rating — which +# is about gating decisions on a parsed host — does not carry over to this tree. +# NB the advisory also has a `>= 4.0.0, < 4.1.2` band; no 4.x copy exists here, and `^3.1.5` keeps +# it that way. If one ever appears, this key will NOT cover it — add a second key. +# NB @redocly/cli esbuild-INLINES its own copy of fast-uri 3.1.2, which the lockfile records as a +# zero-dep leaf; no override can reach those bytes. That copy is dev-only +# (`pnpm --filter @webhook-co/openapi validate`) and never deployed. +# hono >=4.12.34 -> RETARGETED 2026-08-05 from the then-inert `<4.12.27` key (the tree sat at +# 4.12.32). Fixes GHSA-8j4g-w8fx-2239 (#39, med; ReDoS in the CORS middleware via +# Access-Control-Request-Headers), and before it GHSA-hvrm-45r6-mjfj (#29, med; hono/jsx leaks +# context across requests), GHSA-w62v-xxxg-mg59 (#28, med; JSX escaping bypass in cx()) and +# GHSA-xgm2-5f3f-mvvc (#27, med; the API Gateway v1 adapter drops a repeated header). None are +# reachable: hono is 0 of 648 inputs in the deployed bundle (re-measured, not carried over — the +# CORS advisory is a different code path from the JSX ones the earlier census was about), nothing +# in the tree imports hono/jsx, hono/css or hono/aws-lambda, and no tsconfig sets jsxImportSource. +# Resolves to 4.13.0, which satisfies the SDK's declared ^4.11.4 and @hono/node-server's ^4.12.8 — +# in-range for both, so this stays a free hygiene pin. # @hono/node-server >=2.0.5 -> fixes GHSA-frvp-7c67-39w9 (#26, med; serve-static path traversal on # WINDOWS via an encoded backslash). This pin deliberately CROSSES A MAJOR and violates the # SDK's declared `^1.19.9`: 1.19.14 is the last 1.x ever published and the fix floor is 2.0.5, @@ -155,16 +195,16 @@ onlyBuiltDependencies: # binary from every install. Drop this key once next and miniflare both ship a >=0.35 default. overrides: esbuild: 0.28.1 - postcss: 8.5.18 + postcss: 8.5.23 "tmp@<0.2.6": "^0.2.6" "uuid@<11.1.1": "^11.1.1" "js-yaml@<4.3.0": "^4.3.0" "form-data@<4.0.6": "^4.0.6" - "undici@<7.28.0": "^7.28.0" + "undici@<7.29.0": "^7.29.0" "brace-expansion@<1.1.16": "^1.1.16" "minimatch@<4.0.0": "^5.1.9" "body-parser@<1.20.6": "^1.20.6" - "fast-uri@<3.1.3": "^3.1.3" - "hono@<4.12.27": "^4.12.27" + "fast-uri@<3.1.5": "^3.1.5" + "hono@<4.12.34": "^4.12.34" "@hono/node-server@<2.0.5": "^2.0.5" "sharp@<0.35.0": "^0.35.0"