From f578422df7fb0e34fda4ad8cf6058f1d8eafb974 Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Mon, 14 Sep 2026 23:30:15 -0700 Subject: [PATCH 1/8] build(deps): prepare hosted xmldom security refresh Generate lockfile and version evidence on a read-only GitHub-hosted runner; no local npm execution. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 48993ee6-f068-4c4a-b317-2cd940fab804 --- .../workflows/temporary-xmldom-refresh.yml | 35 +++++++++++++++++++ package.json | 1 + 2 files changed, 36 insertions(+) create mode 100644 .github/workflows/temporary-xmldom-refresh.yml diff --git a/.github/workflows/temporary-xmldom-refresh.yml b/.github/workflows/temporary-xmldom-refresh.yml new file mode 100644 index 0000000..a7e441e --- /dev/null +++ b/.github/workflows/temporary-xmldom-refresh.yml @@ -0,0 +1,35 @@ +name: Temporary xmldom lock refresh + +on: + push: + branches: + - fix/dependabot-xmldom-20260915 + +permissions: + contents: read + +jobs: + refresh: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: '22' + - name: Refresh lockfile and inspect upstream versions + run: | + set -euo pipefail + mkdir -p dependency-evidence + npm view @xmldom/xmldom@0.8.15 --json > dependency-evidence/xmldom-0.8.15.json + npm view extract-zip@latest --json > dependency-evidence/extract-zip-latest.json + npm view electron@latest version dependencies --json > dependency-evidence/electron-latest.json + npm update @xmldom/xmldom --package-lock-only --ignore-scripts --include=optional --no-audit --no-fund + cp package-lock.json dependency-evidence/package-lock.json + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: xmldom-dependency-evidence + path: dependency-evidence/ + retention-days: 1 diff --git a/package.json b/package.json index 9265b24..6133a4b 100644 --- a/package.json +++ b/package.json @@ -54,6 +54,7 @@ "vitest": "^4.1.11" }, "overrides": { + "@xmldom/xmldom": "^0.8.15", "dompurify": "$dompurify", "tmp": "^0.2.7", "shell-quote": "1.9.0", From 2984ef298472e0938fae57ba8d0a9b7bbfd53875 Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Mon, 14 Sep 2026 23:32:28 -0700 Subject: [PATCH 2/8] fix(deps): require patched xmldom in packaging tools Use public registry metadata from the hosted refresh, preserve optional platform entries, and guard every resolved xmldom copy against security regressions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 48993ee6-f068-4c4a-b317-2cd940fab804 --- .../workflows/temporary-xmldom-refresh.yml | 4 +++- CHANGELOG.md | 7 +++++++ docs/src/changelog.md | 4 ++++ package-lock.json | 6 +++--- scripts/release-metadata.test.mjs | 20 +++++++++++++++++++ 5 files changed, 37 insertions(+), 4 deletions(-) diff --git a/.github/workflows/temporary-xmldom-refresh.yml b/.github/workflows/temporary-xmldom-refresh.yml index a7e441e..92723b5 100644 --- a/.github/workflows/temporary-xmldom-refresh.yml +++ b/.github/workflows/temporary-xmldom-refresh.yml @@ -26,7 +26,9 @@ jobs: npm view @xmldom/xmldom@0.8.15 --json > dependency-evidence/xmldom-0.8.15.json npm view extract-zip@latest --json > dependency-evidence/extract-zip-latest.json npm view electron@latest version dependencies --json > dependency-evidence/electron-latest.json - npm update @xmldom/xmldom --package-lock-only --ignore-scripts --include=optional --no-audit --no-fund + npm view electron@42 version dependencies --json > dependency-evidence/electron-42-versions.json + npm view @electron-internal/extract-zip@latest --json > dependency-evidence/electron-extract-zip.json + npm install --package-lock-only --ignore-scripts --include=optional --no-audit --no-fund cp package-lock.json dependency-evidence/package-lock.json - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: diff --git a/CHANGELOG.md b/CHANGELOG.md index 20e862f..e0aa599 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -28,6 +28,13 @@ ## [Unreleased] +### Security + +- Require `@xmldom/xmldom` 0.8.15 or later in the 0.8 line for Electron + packaging dependencies. This addresses the XML injection, malformed-input, + and quadratic-time parsing advisories affecting the previous 0.8.13 copy. + Add a regression guard covering every resolved copy in the lockfile. + ## [0.3.101] - 2026-08-07 ### Security diff --git a/docs/src/changelog.md b/docs/src/changelog.md index 336a7d1..a2df011 100644 --- a/docs/src/changelog.md +++ b/docs/src/changelog.md @@ -6,6 +6,10 @@ foundational work by theme. ## Unreleased +- **Build dependency security:** Require patched `@xmldom/xmldom` 0.8.15+ + within the 0.8 line for Electron packaging tools, with a lockfile guard + against reintroducing vulnerable copies. + ## v0.3.103 - 2026-08-09 - **Windows baseline enforcement compatibility:** Windows Server 2016 and diff --git a/package-lock.json b/package-lock.json index 0140f16..44abd53 100644 --- a/package-lock.json +++ b/package-lock.json @@ -258,9 +258,9 @@ } }, "apps/desktop/node_modules/@xmldom/xmldom": { - "version": "0.8.13", - "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz", - "integrity": "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==", + "version": "0.8.15", + "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.15.tgz", + "integrity": "sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA==", "dev": true, "license": "MIT", "engines": { diff --git a/scripts/release-metadata.test.mjs b/scripts/release-metadata.test.mjs index f55cc2c..46f4d8e 100644 --- a/scripts/release-metadata.test.mjs +++ b/scripts/release-metadata.test.mjs @@ -112,6 +112,26 @@ describe('public release metadata', () => { }); }); + it('keeps every xmldom dependency on a patched 0.8 release', async () => { + const [packageJson, lockfile] = await Promise.all([ + read('package.json').then(JSON.parse), + read('package-lock.json').then(JSON.parse), + ]); + const copies = Object.entries(lockfile.packages) + .filter(([packagePath]) => packagePath.endsWith('node_modules/@xmldom/xmldom')); + + expect(packageJson.overrides['@xmldom/xmldom']).toBe('^0.8.15'); + expect(copies.length).toBeGreaterThan(0); + for (const [packagePath, metadata] of copies) { + const version = /^0\.8\.(\d+)$/.exec(metadata.version); + expect(version, `${packagePath}: ${metadata.version}`).not.toBeNull(); + expect(Number(version?.[1]), packagePath).toBeGreaterThanOrEqual(15); + expect(metadata.resolved).toBe( + `https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-${metadata.version}.tgz`, + ); + } + }); + it('publishes canonical MIT license files and workspace metadata', async () => { const [license, notice, rootPackage, corePackage, lockfile] = await Promise.all([ read('LICENSE'), From a7dc1a19c1a0ac8e790527771e5d60e407867059 Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Mon, 14 Sep 2026 23:34:31 -0700 Subject: [PATCH 3/8] fix(deps): move Electron 42 to maintained ZIP extraction Stay on the supported Electron major and remove the unpatched extract-zip dependency through its upstream-maintained replacement. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 48993ee6-f068-4c4a-b317-2cd940fab804 --- .github/workflows/temporary-xmldom-refresh.yml | 1 + CHANGELOG.md | 4 ++++ apps/desktop/package.json | 2 +- docs/src/changelog.md | 3 +++ scripts/release-metadata.test.mjs | 15 +++++++++++++++ 5 files changed, 24 insertions(+), 1 deletion(-) diff --git a/.github/workflows/temporary-xmldom-refresh.yml b/.github/workflows/temporary-xmldom-refresh.yml index 92723b5..cf55842 100644 --- a/.github/workflows/temporary-xmldom-refresh.yml +++ b/.github/workflows/temporary-xmldom-refresh.yml @@ -30,6 +30,7 @@ jobs: npm view @electron-internal/extract-zip@latest --json > dependency-evidence/electron-extract-zip.json npm install --package-lock-only --ignore-scripts --include=optional --no-audit --no-fund cp package-lock.json dependency-evidence/package-lock.json + node -e "const assert = require('node:assert/strict'); const lock = require('./package-lock.json'); assert.equal(lock.packages['apps/desktop/node_modules/@xmldom/xmldom'].version, '0.8.15'); assert.equal(lock.packages['apps/desktop/node_modules/electron'].version, '42.11.3'); assert.ok(!Object.keys(lock.packages).some(p => p.endsWith('node_modules/extract-zip')));" - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: xmldom-dependency-evidence diff --git a/CHANGELOG.md b/CHANGELOG.md index e0aa599..99951f4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -34,6 +34,10 @@ packaging dependencies. This addresses the XML injection, malformed-input, and quadratic-time parsing advisories affecting the previous 0.8.13 copy. Add a regression guard covering every resolved copy in the lockfile. +- Update Electron within the 42.x line to 42.11.3. Its installation tooling + uses Electron's maintained ZIP extractor instead of the unpatched + `extract-zip` package, removing the vulnerable dependency rather than + dismissing its symlink-write advisory (`GHSA-7pqw-9j4j-h8q3`). ## [0.3.101] - 2026-08-07 diff --git a/apps/desktop/package.json b/apps/desktop/package.json index 11a0e55..b885a9a 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -52,7 +52,7 @@ "autoprefixer": "^10.5.0", "concurrently": "^9.2.4", "cross-env": "^7.0.3", - "electron": "~42.0.1", + "electron": "~42.11.3", "electron-builder": "~26.15.3", "esbuild": "^0.28.1", "eslint": "^8.57.1", diff --git a/docs/src/changelog.md b/docs/src/changelog.md index a2df011..78b6779 100644 --- a/docs/src/changelog.md +++ b/docs/src/changelog.md @@ -9,6 +9,9 @@ foundational work by theme. - **Build dependency security:** Require patched `@xmldom/xmldom` 0.8.15+ within the 0.8 line for Electron packaging tools, with a lockfile guard against reintroducing vulnerable copies. +- **Electron installation security:** Update to Electron 42.11.3, whose + maintained ZIP extractor replaces the vulnerable legacy `extract-zip` + dependency. ## v0.3.103 - 2026-08-09 diff --git a/scripts/release-metadata.test.mjs b/scripts/release-metadata.test.mjs index 46f4d8e..b4fed7d 100644 --- a/scripts/release-metadata.test.mjs +++ b/scripts/release-metadata.test.mjs @@ -132,6 +132,21 @@ describe('public release metadata', () => { } }); + it('uses Electron-maintained ZIP extraction instead of the vulnerable legacy package', async () => { + const lockfile = JSON.parse(await read('package-lock.json')); + const legacyCopies = Object.keys(lockfile.packages) + .filter((packagePath) => packagePath.endsWith('node_modules/extract-zip')); + const electronCopies = Object.entries(lockfile.packages) + .filter(([packagePath]) => packagePath.endsWith('node_modules/electron')); + + expect(legacyCopies).toEqual([]); + expect(electronCopies.length).toBeGreaterThan(0); + for (const [packagePath, metadata] of electronCopies) { + expect(metadata.dependencies['@electron-internal/extract-zip'], packagePath).toBeDefined(); + expect(metadata.dependencies).not.toHaveProperty('extract-zip'); + } + }); + it('publishes canonical MIT license files and workspace metadata', async () => { const [license, notice, rootPackage, corePackage, lockfile] = await Promise.all([ read('LICENSE'), From 4107b53c86e2d3bbc077d5c3704726ddecc65acb Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Tue, 15 Sep 2026 00:01:59 -0700 Subject: [PATCH 4/8] ci(deps): refresh Electron in its desktop workspace Generate the patched dependency lockfile on a hosted runner and retain audit evidence. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/temporary-xmldom-refresh.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/temporary-xmldom-refresh.yml b/.github/workflows/temporary-xmldom-refresh.yml index cf55842..f44d8cb 100644 --- a/.github/workflows/temporary-xmldom-refresh.yml +++ b/.github/workflows/temporary-xmldom-refresh.yml @@ -28,10 +28,12 @@ jobs: npm view electron@latest version dependencies --json > dependency-evidence/electron-latest.json npm view electron@42 version dependencies --json > dependency-evidence/electron-42-versions.json npm view @electron-internal/extract-zip@latest --json > dependency-evidence/electron-extract-zip.json - npm install --package-lock-only --ignore-scripts --include=optional --no-audit --no-fund + npm install --workspace @configforge/desktop --save-dev --save-prefix='~' electron@42.11.3 --package-lock-only --ignore-scripts --include=optional --no-audit --no-fund cp package-lock.json dependency-evidence/package-lock.json node -e "const assert = require('node:assert/strict'); const lock = require('./package-lock.json'); assert.equal(lock.packages['apps/desktop/node_modules/@xmldom/xmldom'].version, '0.8.15'); assert.equal(lock.packages['apps/desktop/node_modules/electron'].version, '42.11.3'); assert.ok(!Object.keys(lock.packages).some(p => p.endsWith('node_modules/extract-zip')));" + npm audit --json > dependency-evidence/audit.json - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + if: always() with: name: xmldom-dependency-evidence path: dependency-evidence/ From 2508340dfacf002988a74f05d570409bff3fdd37 Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Tue, 15 Sep 2026 00:04:30 -0700 Subject: [PATCH 5/8] ci(deps): resolve workspace dependencies with npm 11 Use a hosted Node 24 install to replace stale npm 10 workspace lock records and preserve native optional package metadata. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/temporary-xmldom-refresh.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/temporary-xmldom-refresh.yml b/.github/workflows/temporary-xmldom-refresh.yml index f44d8cb..c923ecc 100644 --- a/.github/workflows/temporary-xmldom-refresh.yml +++ b/.github/workflows/temporary-xmldom-refresh.yml @@ -18,7 +18,7 @@ jobs: persist-credentials: false - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: '22' + node-version: '24' - name: Refresh lockfile and inspect upstream versions run: | set -euo pipefail @@ -28,9 +28,12 @@ jobs: npm view electron@latest version dependencies --json > dependency-evidence/electron-latest.json npm view electron@42 version dependencies --json > dependency-evidence/electron-42-versions.json npm view @electron-internal/extract-zip@latest --json > dependency-evidence/electron-extract-zip.json - npm install --workspace @configforge/desktop --save-dev --save-prefix='~' electron@42.11.3 --package-lock-only --ignore-scripts --include=optional --no-audit --no-fund + node -p "require('./apps/desktop/package.json').devDependencies.electron" + npm install --workspace @configforge/desktop --save-dev --save-prefix='~' electron@42.11.3 --ignore-scripts --include=optional --no-audit --no-fund cp package-lock.json dependency-evidence/package-lock.json - node -e "const assert = require('node:assert/strict'); const lock = require('./package-lock.json'); assert.equal(lock.packages['apps/desktop/node_modules/@xmldom/xmldom'].version, '0.8.15'); assert.equal(lock.packages['apps/desktop/node_modules/electron'].version, '42.11.3'); assert.ok(!Object.keys(lock.packages).some(p => p.endsWith('node_modules/extract-zip')));" + git diff -- apps/desktop/package.json package-lock.json > dependency-evidence/refresh.diff + node -e "const assert = require('node:assert/strict'); const lock = require('./package-lock.json'); assert.equal(lock.packages['apps/desktop'].devDependencies.electron, '~42.11.3'); for (const [p, m] of Object.entries(lock.packages)) { if (p.endsWith('node_modules/@xmldom/xmldom')) assert.equal(m.version, '0.8.15', p); if (p.endsWith('node_modules/electron')) assert.equal(m.version, '42.11.3', p); assert.ok(!p.endsWith('node_modules/extract-zip'), p); }" + node scripts/verify-public-package-assets.mjs npm audit --json > dependency-evidence/audit.json - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() From 106cd6ea995c3328ec0265cc7d19cfbae45284cc Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Tue, 15 Sep 2026 00:06:39 -0700 Subject: [PATCH 6/8] fix(deps): patch brace-expansion and nanoid advisories Cover the additional denial-of-service advisories reported by the complete hosted npm audit without changing dependency major versions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- CHANGELOG.md | 4 ++++ docs/src/changelog.md | 3 +++ package.json | 7 ++++--- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 99951f4..1ff6900 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -38,6 +38,10 @@ uses Electron's maintained ZIP extractor instead of the unpatched `extract-zip` package, removing the vulnerable dependency rather than dismissing its symlink-write advisory (`GHSA-7pqw-9j4j-h8q3`). +- Update the existing `brace-expansion` overrides to 1.1.18, 2.1.4, and + 5.0.9, and require `nanoid` 3.3.18+ in the 3.x line. These address the + unbounded-expansion and zero-size generator denial-of-service advisories + found by a full development-and-production dependency audit. ## [0.3.101] - 2026-08-07 diff --git a/docs/src/changelog.md b/docs/src/changelog.md index 78b6779..bb8ae4a 100644 --- a/docs/src/changelog.md +++ b/docs/src/changelog.md @@ -12,6 +12,9 @@ foundational work by theme. - **Electron installation security:** Update to Electron 42.11.3, whose maintained ZIP extractor replaces the vulnerable legacy `extract-zip` dependency. +- **Build dependency hardening:** Update all supported `brace-expansion` + lines and `nanoid` 3.x to patched releases for denial-of-service advisories + found by the full dependency audit. ## v0.3.103 - 2026-08-09 diff --git a/package.json b/package.json index 6133a4b..5539171 100644 --- a/package.json +++ b/package.json @@ -58,9 +58,10 @@ "dompurify": "$dompurify", "tmp": "^0.2.7", "shell-quote": "1.9.0", - "brace-expansion@1": "1.1.16", - "brace-expansion@2": "2.1.2", - "brace-expansion@5": "5.0.8", + "brace-expansion@1": "1.1.18", + "brace-expansion@2": "2.1.4", + "brace-expansion@5": "5.0.9", + "nanoid@3": "^3.3.18", "esbuild": "^0.28.1", "js-yaml": "^4.3.2", "undici@7": "^7.29.0", From 07cb28d2e9080c3e17641aef33387fe62968f85b Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Tue, 15 Sep 2026 00:08:35 -0700 Subject: [PATCH 7/8] test(deps): guard patched transitive dependency resolutions Refresh overridden packages across all workspaces and assert security floors for brace-expansion, nanoid, xmldom and Electron installation tooling. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../workflows/temporary-xmldom-refresh.yml | 2 + scripts/release-metadata.test.mjs | 58 ++++++++++++++----- 2 files changed, 45 insertions(+), 15 deletions(-) diff --git a/.github/workflows/temporary-xmldom-refresh.yml b/.github/workflows/temporary-xmldom-refresh.yml index c923ecc..fd16e5b 100644 --- a/.github/workflows/temporary-xmldom-refresh.yml +++ b/.github/workflows/temporary-xmldom-refresh.yml @@ -30,11 +30,13 @@ jobs: npm view @electron-internal/extract-zip@latest --json > dependency-evidence/electron-extract-zip.json node -p "require('./apps/desktop/package.json').devDependencies.electron" npm install --workspace @configforge/desktop --save-dev --save-prefix='~' electron@42.11.3 --ignore-scripts --include=optional --no-audit --no-fund + npm update brace-expansion nanoid --workspaces --include-workspace-root --ignore-scripts --include=optional --no-audit --no-fund cp package-lock.json dependency-evidence/package-lock.json git diff -- apps/desktop/package.json package-lock.json > dependency-evidence/refresh.diff node -e "const assert = require('node:assert/strict'); const lock = require('./package-lock.json'); assert.equal(lock.packages['apps/desktop'].devDependencies.electron, '~42.11.3'); for (const [p, m] of Object.entries(lock.packages)) { if (p.endsWith('node_modules/@xmldom/xmldom')) assert.equal(m.version, '0.8.15', p); if (p.endsWith('node_modules/electron')) assert.equal(m.version, '42.11.3', p); assert.ok(!p.endsWith('node_modules/extract-zip'), p); }" node scripts/verify-public-package-assets.mjs npm audit --json > dependency-evidence/audit.json + npx --no-install vitest run scripts/release-metadata.test.mjs - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: diff --git a/scripts/release-metadata.test.mjs b/scripts/release-metadata.test.mjs index b4fed7d..17c7580 100644 --- a/scripts/release-metadata.test.mjs +++ b/scripts/release-metadata.test.mjs @@ -91,25 +91,47 @@ describe('public release metadata', () => { expect(nonPublic).toEqual([]); }); - it('pins patched brace-expansion 5.x metadata', async () => { + it('pins patched brace-expansion versions in every supported major', async () => { const [packageJson, lockfile] = await Promise.all([ read('package.json').then(JSON.parse), read('package-lock.json').then(JSON.parse), ]); - expect(packageJson.overrides['brace-expansion@5']).toBe('5.0.8'); - // Partial matcher narrowed to only the security-relevant fields: the - // patched version, its registry tarball URL, its integrity hash, and - // dev-only status. Non-security metadata (license/dependencies/engines) - // is intentionally excluded since it can legitimately shift across - // lockfile regenerations without affecting the security pin. - expect(lockfile.packages['node_modules/brace-expansion']).toMatchObject({ - version: '5.0.8', - resolved: 'https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz', - integrity: - 'sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==', - dev: true, - }); + const patchedVersions = { 1: '1.1.18', 2: '2.1.4', 5: '5.0.9' }; + const copies = Object.entries(lockfile.packages) + .filter(([packagePath]) => packagePath.endsWith('node_modules/brace-expansion')); + + for (const [major, version] of Object.entries(patchedVersions)) { + expect(packageJson.overrides[`brace-expansion@${major}`]).toBe(version); + } + expect(copies.length).toBeGreaterThan(0); + for (const [packagePath, metadata] of copies) { + const major = metadata.version.split('.')[0]; + expect(patchedVersions, packagePath).toHaveProperty(major); + expect(metadata.version, packagePath).toBe(patchedVersions[major]); + expect(metadata.resolved).toBe( + `https://registry.npmjs.org/brace-expansion/-/brace-expansion-${metadata.version}.tgz`, + ); + } + }); + + it('keeps nanoid 3.x dependencies above the zero-size generator security fix', async () => { + const [packageJson, lockfile] = await Promise.all([ + read('package.json').then(JSON.parse), + read('package-lock.json').then(JSON.parse), + ]); + const copies = Object.entries(lockfile.packages) + .filter(([packagePath]) => packagePath.endsWith('node_modules/nanoid')); + + expect(packageJson.overrides['nanoid@3']).toBe('^3.3.18'); + expect(copies.length).toBeGreaterThan(0); + for (const [packagePath, metadata] of copies) { + const version = /^3\.(\d+)\.(\d+)$/.exec(metadata.version); + expect(version, `${packagePath}: ${metadata.version}`).not.toBeNull(); + const minor = Number(version?.[1]); + const patch = Number(version?.[2]); + expect(minor > 3 || (minor === 3 && patch >= 18), packagePath).toBe(true); + } }); it('keeps every xmldom dependency on a patched 0.8 release', async () => { @@ -133,13 +155,19 @@ describe('public release metadata', () => { }); it('uses Electron-maintained ZIP extraction instead of the vulnerable legacy package', async () => { - const lockfile = JSON.parse(await read('package-lock.json')); + const [desktopPackage, lockfile] = await Promise.all([ + read('apps/desktop/package.json').then(JSON.parse), + read('package-lock.json').then(JSON.parse), + ]); const legacyCopies = Object.keys(lockfile.packages) .filter((packagePath) => packagePath.endsWith('node_modules/extract-zip')); const electronCopies = Object.entries(lockfile.packages) .filter(([packagePath]) => packagePath.endsWith('node_modules/electron')); expect(legacyCopies).toEqual([]); + expect(lockfile.packages['apps/desktop'].devDependencies.electron).toBe( + desktopPackage.devDependencies.electron, + ); expect(electronCopies.length).toBeGreaterThan(0); for (const [packagePath, metadata] of electronCopies) { expect(metadata.dependencies['@electron-internal/extract-zip'], packagePath).toBeDefined(); From fb76d70f553a7d885883422c9f936c789232d9c6 Mon Sep 17 00:00:00 2001 From: Amir Bredy Date: Tue, 15 Sep 2026 00:11:28 -0700 Subject: [PATCH 8/8] fix(deps): commit audited hosted dependency lockfile Record the clean npm 11 dependency graph and remove the temporary refresh workflow. Preserve cross-platform optional binaries and public-registry resolutions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../workflows/temporary-xmldom-refresh.yml | 45 --- package-lock.json | 324 +++++++----------- 2 files changed, 128 insertions(+), 241 deletions(-) delete mode 100644 .github/workflows/temporary-xmldom-refresh.yml diff --git a/.github/workflows/temporary-xmldom-refresh.yml b/.github/workflows/temporary-xmldom-refresh.yml deleted file mode 100644 index fd16e5b..0000000 --- a/.github/workflows/temporary-xmldom-refresh.yml +++ /dev/null @@ -1,45 +0,0 @@ -name: Temporary xmldom lock refresh - -on: - push: - branches: - - fix/dependabot-xmldom-20260915 - -permissions: - contents: read - -jobs: - refresh: - runs-on: ubuntu-latest - timeout-minutes: 10 - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - node-version: '24' - - name: Refresh lockfile and inspect upstream versions - run: | - set -euo pipefail - mkdir -p dependency-evidence - npm view @xmldom/xmldom@0.8.15 --json > dependency-evidence/xmldom-0.8.15.json - npm view extract-zip@latest --json > dependency-evidence/extract-zip-latest.json - npm view electron@latest version dependencies --json > dependency-evidence/electron-latest.json - npm view electron@42 version dependencies --json > dependency-evidence/electron-42-versions.json - npm view @electron-internal/extract-zip@latest --json > dependency-evidence/electron-extract-zip.json - node -p "require('./apps/desktop/package.json').devDependencies.electron" - npm install --workspace @configforge/desktop --save-dev --save-prefix='~' electron@42.11.3 --ignore-scripts --include=optional --no-audit --no-fund - npm update brace-expansion nanoid --workspaces --include-workspace-root --ignore-scripts --include=optional --no-audit --no-fund - cp package-lock.json dependency-evidence/package-lock.json - git diff -- apps/desktop/package.json package-lock.json > dependency-evidence/refresh.diff - node -e "const assert = require('node:assert/strict'); const lock = require('./package-lock.json'); assert.equal(lock.packages['apps/desktop'].devDependencies.electron, '~42.11.3'); for (const [p, m] of Object.entries(lock.packages)) { if (p.endsWith('node_modules/@xmldom/xmldom')) assert.equal(m.version, '0.8.15', p); if (p.endsWith('node_modules/electron')) assert.equal(m.version, '42.11.3', p); assert.ok(!p.endsWith('node_modules/extract-zip'), p); }" - node scripts/verify-public-package-assets.mjs - npm audit --json > dependency-evidence/audit.json - npx --no-install vitest run scripts/release-metadata.test.mjs - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - if: always() - with: - name: xmldom-dependency-evidence - path: dependency-evidence/ - retention-days: 1 diff --git a/package-lock.json b/package-lock.json index 44abd53..ea13793 100644 --- a/package-lock.json +++ b/package-lock.json @@ -62,7 +62,7 @@ "autoprefixer": "^10.5.0", "concurrently": "^9.2.4", "cross-env": "^7.0.3", - "electron": "~42.0.1", + "electron": "~42.11.3", "electron-builder": "~26.15.3", "esbuild": "^0.28.1", "eslint": "^8.57.1", @@ -71,34 +71,13 @@ "react": "^18.3.1", "react-dom": "^18.3.1", "react-router-dom": "^7.18.2", - "sharp": "^0.35.4", + "sharp": "0.35.4", "tailwindcss": "^3.4.19", "typescript": "^5.7.3", "vite": "^6.4.3", "wait-on": "^8.0.2" } }, - "apps/desktop/node_modules/@electron/get": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/@electron/get/-/get-5.0.0.tgz", - "integrity": "sha512-pjoBpru1KdEtcExBnuHAP1cAc/5faoedw0hzJkL3o4/IJp7HNF1+fbrdxT3gMYRX2oJfvnA/WXeCTVQpYYxyJA==", - "dev": true, - "license": "MIT", - "dependencies": { - "debug": "^4.1.1", - "env-paths": "^3.0.0", - "graceful-fs": "^4.2.11", - "progress": "^2.0.3", - "semver": "^7.6.3", - "sumchecker": "^3.0.1" - }, - "engines": { - "node": ">=22.12.0" - }, - "optionalDependencies": { - "undici": "^7.24.4" - } - }, "apps/desktop/node_modules/@electron/osx-sign": { "version": "1.3.3", "resolved": "https://registry.npmjs.org/@electron/osx-sign/-/osx-sign-1.3.3.tgz", @@ -427,16 +406,6 @@ "node": ">=8" } }, - "apps/desktop/node_modules/app-builder-lib/node_modules/env-paths": { - "version": "2.2.1", - "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz", - "integrity": "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=6" - } - }, "apps/desktop/node_modules/app-builder-lib/node_modules/jsonfile": { "version": "4.0.0", "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-4.0.0.tgz", @@ -507,9 +476,9 @@ "license": "MIT" }, "apps/desktop/node_modules/brace-expansion": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", - "integrity": "sha1-C7oicf631Fiw0xrRNiWqpHVEMeI=", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -621,25 +590,6 @@ "util-deprecate": "~1.0.1" } }, - "apps/desktop/node_modules/electron": { - "version": "42.0.1", - "resolved": "https://registry.npmjs.org/electron/-/electron-42.0.1.tgz", - "integrity": "sha512-d8HnycE970DGESe91Nj30eonFBUcAI9EZ1TwUGJVzSAnJZdh0BkFEinAXjdklvDYst+bVDc8HsksCuqVLrnqdg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@electron/get": "^5.0.0", - "@types/node": "^24.9.0", - "extract-zip": "^2.0.1" - }, - "bin": { - "electron": "cli.js", - "install-electron": "install.js" - }, - "engines": { - "node": ">= 22.12.0" - } - }, "apps/desktop/node_modules/electron-builder": { "version": "26.15.3", "resolved": "https://registry.npmjs.org/electron-builder/-/electron-builder-26.15.3.tgz", @@ -697,29 +647,6 @@ "mime": "^2.5.2" } }, - "apps/desktop/node_modules/electron/node_modules/@types/node": { - "version": "24.12.4", - "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.4.tgz", - "integrity": "sha512-GUUEShf+PBCGW2KaXwcIt3Yk+e3pkKwWKb9GSyM9WQVE+ep2jzmHdGsHzu4wgcZy5fN9FBdVzjpBQsYlpfpgLA==", - "dev": true, - "license": "MIT", - "dependencies": { - "undici-types": "~7.16.0" - } - }, - "apps/desktop/node_modules/env-paths": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-3.0.0.tgz", - "integrity": "sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A==", - "dev": true, - "license": "MIT", - "engines": { - "node": "^12.20.0 || ^14.13.1 || >=16.0.0" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, "apps/desktop/node_modules/fs-extra": { "version": "10.1.0", "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz", @@ -820,16 +747,6 @@ "node": "^20.17.0 || >=22.9.0" } }, - "apps/desktop/node_modules/node-gyp/node_modules/env-paths": { - "version": "2.2.1", - "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz", - "integrity": "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=6" - } - }, "apps/desktop/node_modules/node-gyp/node_modules/isexe": { "version": "4.0.0", "resolved": "https://registry.npmjs.org/isexe/-/isexe-4.0.0.tgz", @@ -1015,13 +932,6 @@ "node": ">=10" } }, - "apps/desktop/node_modules/undici-types": { - "version": "7.16.0", - "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz", - "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==", - "dev": true, - "license": "MIT" - }, "apps/desktop/node_modules/universalify": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz", @@ -1741,6 +1651,16 @@ "license": "MIT", "optional": true }, + "node_modules/@electron-internal/extract-zip": { + "version": "1.0.5", + "resolved": "https://registry.npmjs.org/@electron-internal/extract-zip/-/extract-zip-1.0.5.tgz", + "integrity": "sha512-+bqFCP98pLI0Tt0XQo1TmlXtwjWchISndDOxCkEcIuUgXWpBnLyRI+2DU+mesvnMMX6L1XDqYNA0lXNDHd/yiA==", + "dev": true, + "license": "BSD-2-Clause", + "engines": { + "node": ">=22.12.0" + } + }, "node_modules/@electron/asar": { "version": "3.4.1", "resolved": "https://registry.npmjs.org/@electron/asar/-/asar-3.4.1.tgz", @@ -1767,9 +1687,9 @@ "license": "MIT" }, "node_modules/@electron/asar/node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha1-cj06MMBVjCJavJ/Eeac+FOJsPC8=", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -1844,6 +1764,53 @@ "node": ">= 10.0.0" } }, + "node_modules/@electron/get": { + "version": "5.1.0", + "resolved": "https://registry.npmjs.org/@electron/get/-/get-5.1.0.tgz", + "integrity": "sha512-3kSBtG8ObcTVfXanm5vVJ6UnBLEVmVsRk1M+vGqCuMBV+XLCbJYuWQful+yIy0GQDsSlK0kHEriEHn7SPk4EnA==", + "dev": true, + "license": "MIT", + "dependencies": { + "debug": "^4.1.1", + "env-paths": "^3.0.0", + "graceful-fs": "^4.2.11", + "progress": "^2.0.3", + "semver": "^7.6.3", + "sumchecker": "^3.0.1" + }, + "engines": { + "node": ">=22.12.0" + }, + "optionalDependencies": { + "undici": "^7.24.4" + } + }, + "node_modules/@electron/get/node_modules/env-paths": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-3.0.0.tgz", + "integrity": "sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A==", + "dev": true, + "license": "MIT", + "engines": { + "node": "^12.20.0 || ^14.13.1 || >=16.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/@electron/get/node_modules/semver": { + "version": "7.8.5", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", + "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==", + "dev": true, + "license": "ISC", + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, "node_modules/@electron/notarize": { "version": "2.5.0", "resolved": "https://registry.npmjs.org/@electron/notarize/-/notarize-2.5.0.tgz", @@ -2467,9 +2434,9 @@ "license": "MIT" }, "node_modules/@eslint/eslintrc/node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha1-cj06MMBVjCJavJ/Eeac+FOJsPC8=", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -4222,9 +4189,9 @@ "license": "MIT" }, "node_modules/@humanwhocodes/config-array/node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha1-cj06MMBVjCJavJ/Eeac+FOJsPC8=", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -6016,17 +5983,6 @@ "license": "MIT", "optional": true }, - "node_modules/@types/yauzl": { - "version": "2.10.3", - "resolved": "https://registry.npmjs.org/@types/yauzl/-/yauzl-2.10.3.tgz", - "integrity": "sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==", - "dev": true, - "license": "MIT", - "optional": true, - "dependencies": { - "@types/node": "*" - } - }, "node_modules/@typescript-eslint/eslint-plugin": { "version": "8.59.2", "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.59.2.tgz", @@ -6828,9 +6784,9 @@ "optional": true }, "node_modules/brace-expansion": { - "version": "5.0.8", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", - "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { @@ -6931,16 +6887,6 @@ "ieee754": "^1.1.13" } }, - "node_modules/buffer-crc32": { - "version": "0.2.13", - "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz", - "integrity": "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": "*" - } - }, "node_modules/buffer-from": { "version": "1.1.2", "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz", @@ -6982,9 +6928,9 @@ "optional": true }, "node_modules/cacache/node_modules/brace-expansion": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", - "integrity": "sha1-C7oicf631Fiw0xrRNiWqpHVEMeI=", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "optional": true, @@ -7668,9 +7614,9 @@ "license": "MIT" }, "node_modules/dir-compare/node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha1-cj06MMBVjCJavJ/Eeac+FOJsPC8=", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -7804,6 +7750,25 @@ "node": ">=0.10.0" } }, + "node_modules/electron": { + "version": "42.11.3", + "resolved": "https://registry.npmjs.org/electron/-/electron-42.11.3.tgz", + "integrity": "sha512-r/rC6BikQ2vEGQLhnHmFwFpvVPlWTc/rnHcYfJe4HDa5MEl00yhx72ffKw7zMf1WvAM2r2hcGJ3ZftuJRo0QaQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "@electron-internal/extract-zip": "^1.0.1", + "@electron/get": "^5.0.0", + "@types/node": "^24.9.0" + }, + "bin": { + "electron": "cli.js", + "install-electron": "install.js" + }, + "engines": { + "node": ">= 22.12.0" + } + }, "node_modules/electron-log": { "version": "5.4.3", "resolved": "https://registry.npmjs.org/electron-log/-/electron-log-5.4.3.tgz", @@ -7934,6 +7899,23 @@ "node": ">=6 <7 || >=8" } }, + "node_modules/electron/node_modules/@types/node": { + "version": "24.13.4", + "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.4.tgz", + "integrity": "sha512-YJ7EqCstVTzIr0fMr7qul/977en+pQHrfmuKIo6Zr9i75Be21dr3MovcfvGtyvi2HAUrRerWps5sMO9I7WaxDw==", + "dev": true, + "license": "MIT", + "dependencies": { + "undici-types": "~7.18.0" + } + }, + "node_modules/electron/node_modules/undici-types": { + "version": "7.18.2", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz", + "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==", + "dev": true, + "license": "MIT" + }, "node_modules/embla-carousel": { "version": "8.6.0", "resolved": "https://registry.npmjs.org/embla-carousel/-/embla-carousel-8.6.0.tgz", @@ -8005,7 +7987,6 @@ "integrity": "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==", "dev": true, "license": "MIT", - "optional": true, "engines": { "node": ">=6" } @@ -8274,9 +8255,9 @@ "license": "MIT" }, "node_modules/eslint/node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha1-cj06MMBVjCJavJ/Eeac+FOJsPC8=", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -8417,27 +8398,6 @@ "license": "MIT", "optional": true }, - "node_modules/extract-zip": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/extract-zip/-/extract-zip-2.0.1.tgz", - "integrity": "sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg==", - "dev": true, - "license": "BSD-2-Clause", - "dependencies": { - "debug": "^4.1.1", - "get-stream": "^5.1.0", - "yauzl": "^2.10.0" - }, - "bin": { - "extract-zip": "cli.js" - }, - "engines": { - "node": ">= 10.17.0" - }, - "optionalDependencies": { - "@types/yauzl": "^2.9.1" - } - }, "node_modules/fast-deep-equal": { "version": "3.1.3", "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz", @@ -8553,16 +8513,6 @@ "reusify": "^1.0.4" } }, - "node_modules/fd-slicer": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz", - "integrity": "sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==", - "dev": true, - "license": "MIT", - "dependencies": { - "pend": "~1.2.0" - } - }, "node_modules/file-entry-cache": { "version": "6.0.1", "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz", @@ -8602,9 +8552,9 @@ "license": "MIT" }, "node_modules/filelist/node_modules/brace-expansion": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", - "integrity": "sha1-C7oicf631Fiw0xrRNiWqpHVEMeI=", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -8957,9 +8907,9 @@ "license": "MIT" }, "node_modules/glob/node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha1-cj06MMBVjCJavJ/Eeac+FOJsPC8=", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -10344,9 +10294,9 @@ "optional": true }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.19", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz", + "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==", "dev": true, "funding": [ { @@ -10938,13 +10888,6 @@ "url": "https://github.com/sponsors/jet2jet" } }, - "node_modules/pend": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz", - "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==", - "dev": true, - "license": "MIT" - }, "node_modules/picocolors": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz", @@ -13790,17 +13733,6 @@ "node": ">=12" } }, - "node_modules/yauzl": { - "version": "2.10.0", - "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz", - "integrity": "sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==", - "dev": true, - "license": "MIT", - "dependencies": { - "buffer-crc32": "~0.2.3", - "fd-slicer": "~1.1.0" - } - }, "node_modules/yocto-queue": { "version": "0.1.0", "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",