diff --git a/package.json b/package.json index 05ae9ea01..1b620b64a 100644 --- a/package.json +++ b/package.json @@ -3443,6 +3443,7 @@ "@types/node": "catalog:", "@types/semver": "catalog:", "@types/shell-quote": "catalog:", + "@ultrathink/acorn.wasm": "catalog:", "@typescript/native-preview": "catalog:", "@vitest/coverage-v8": "catalog:", "@vitest/ui": "catalog:", @@ -3500,7 +3501,7 @@ "tar-fs": "catalog:", "tar-stream": "3.2.0", "taze": "catalog:", - "type-coverage": "2.29.7", + "type-coverage": "2.30.1", "typescript": "catalog:", "validate-npm-package-name": "6.0.2", "vitest": "catalog:", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 810db7443..0e3a3cb7a 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -396,9 +396,9 @@ overrides: fast-uri: 3.1.4 globby: 16.2.2 has-flag: 5.0.1 - hono: 4.12.31 + hono: 4.12.32 hosted-git-info: 8.1.0 - ip-address: 10.2.0 + ip-address: 10.3.1 isexe: 3.1.5 js-tokens: 10.0.0 js-yaml: 4.3.0 @@ -420,7 +420,7 @@ overrides: p-map: 7.0.6 pacote: 21.5.1 picomatch: 4.0.5 - postcss: 8.5.22 + postcss: 8.5.23 proc-log: 6.1.0 qs: 6.15.3 rolldown: 1.1.4 @@ -431,7 +431,7 @@ overrides: string-width: 8.2.2 strip-ansi: 7.2.0 supports-color: 10.2.2 - tar: 7.5.21 + tar: 7.5.22 tar-fs: 3.1.3 tar-stream: 3.2.0 tslib: 2.8.1 @@ -552,6 +552,9 @@ importers: '@typescript/native-preview': specifier: 'catalog:' version: 7.0.0-dev.20260510.1 + '@ultrathink/acorn.wasm': + specifier: 'catalog:' + version: '@ultrathink/acorn.rs.wasm@0.1.1' '@vitest/coverage-v8': specifier: 'catalog:' version: 4.1.10(vitest@4.1.10) @@ -721,8 +724,8 @@ importers: specifier: 'catalog:' version: 19.16.0(patch_hash=77208c02cff936d0f1dbf2ffcc95f6f0def9697d6ba7ca4671c399c8c933c6fd) type-coverage: - specifier: 2.29.7 - version: 2.29.7(typescript@7.0.2) + specifier: 2.30.1 + version: 2.30.1(typescript@7.0.2) typescript: specifier: 'catalog:' version: 7.0.2 @@ -737,7 +740,7 @@ importers: version: 0.3.1(typescript@7.0.2)(vite@8.1.5(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(terser@5.48.0)(yaml@2.9.0))(vitest@4.1.10) webpack: specifier: 5.109.0 - version: 5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.22) + version: 5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.23) which: specifier: 7.0.0 version: 7.0.0 @@ -3343,7 +3346,7 @@ packages: resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==} engines: {node: '>=18.14.1'} peerDependencies: - hono: 4.12.31 + hono: 4.12.32 '@inquirer/ansi@2.0.7': resolution: {integrity: sha512-3eTuUO1vH2cZm2ZKHeQxnOqlTi9EfZDGgIe3BL3I4u+rJHocr9Fz86M4fjYABPvFnQG/gGK551HqDiIcETwU6Q==} @@ -5291,8 +5294,8 @@ packages: resolution: {integrity: sha512-CsNUt5x9LUdx6hnk/E2SZLsDyvfqANZSUq4+D3D8RzDJ2M+HDTIkF60ibS1vHaK55vzgiZw1bEPFG9yH7l33wA==} engines: {node: '>=12'} - hono@4.12.31: - resolution: {integrity: sha512-zJIHFrl6bq3RDd2YusFNCDlM8qUprxKswyi/OPzPyzKDdyBXDqWx8bZlZ7R+saTdSTatUmb3O7K4SspGPaEOQg==} + hono@4.12.32: + resolution: {integrity: sha512-XcuyW9qE2kJn07PkecMOBd5Vq/hMy7mmGw+idz1yblbg9N17ijJODrvPkn7/dwL3Kulj8LcRJ69DLOWf91dRUg==} engines: {node: '>=16.9.0'} hosted-git-info@8.1.0: @@ -5351,8 +5354,8 @@ packages: resolution: {integrity: sha512-+N0ngpO3e7cRUWOJAS7qw0IZIVc6XPrW4MlFBdD066F2L4k1L6ker3hLqSq7iXxU5tgS4WGkIUElWn5vogAEnw==} engines: {node: ^18.17.0 || >=20.5.0} - ip-address@10.2.0: - resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==} + ip-address@10.3.1: + resolution: {integrity: sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -6115,8 +6118,8 @@ packages: resolution: {integrity: sha512-HeP7D2wyhkR+XaK6v4W8oRF62Dsz4flyuczALJp61GckGm42u1saSSJ/0auvcBqxs3jMRFEcPK34At/0JBKdOg==} engines: {node: '>=4'} - postcss@8.5.22: - resolution: {integrity: sha512-KBDEIpLrvpv16pp3K0Fw+UCoZfopFjjgeB+0tA/aaThfEE74kKDLrgg603YvOWJyg3+WYtyq3xYsQWsIyZlPqQ==} + postcss@8.5.23: + resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==} engines: {node: ^10 || ^12 || >=14} presentable-error@0.0.1: @@ -6401,8 +6404,8 @@ packages: tar-stream@3.2.0: resolution: {integrity: sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg==} - tar@7.5.21: - resolution: {integrity: sha512-XdhtCvlMywwxpCW8YEq3lOXBJpUPTR2OHHcwLPO3HwsJqOHa2Ok/oJ7ruGzp+JrKoRPVCzJwAdEjqLW/vNRPHA==} + tar@7.5.22: + resolution: {integrity: sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==} engines: {node: '>=18'} taze@19.16.0: @@ -6496,13 +6499,13 @@ packages: typanion@3.14.0: resolution: {integrity: sha512-ZW/lVMRabETuYCd9O9ZvMhAh8GslSqaUjxmK/JLPCh6l73CvLBiuXswj/+7LdnWOgYsQ130FqLzFz5aGT4I3Ug==} - type-coverage-core@2.29.7: - resolution: {integrity: sha512-bt+bnXekw3p5NnqiZpNupOOxfUKGw2Z/YJedfGHkxpeyGLK7DZ59a6Wds8eq1oKjJc5Wulp2xL207z8FjFO14Q==} + type-coverage-core@2.30.1: + resolution: {integrity: sha512-TFzqUvaZW5bTpKGBj3FwN8bYLsWA/smTOslISDg9rBMrpn5KadMQy9l3q068q+dXkn27CAdyfGTDlsH0PguG3A==} peerDependencies: - typescript: 2 || 3 || 4 || 5 + typescript: 2 || 3 || 4 || 5 || 6 || 7 - type-coverage@2.29.7: - resolution: {integrity: sha512-E67Chw7SxFe++uotisxt/xzB1UxxvLztzzQqVyUZ/jKujsejVqvoO5vn25oMvqJydqYrASBVBCQCy082E2qQYQ==} + type-coverage@2.30.1: + resolution: {integrity: sha512-+Y05UXYBaeonULHdpkc7kr0BF5Ix+IsdI/UzI2S6hnkCacTA4ktpi9EnKWMYyISW6xRaLYIEqK+4fz1GLpHQFg==} hasBin: true type-is@2.1.0: @@ -7056,9 +7059,9 @@ snapshots: '@henrygd/queue@1.2.0': {} - '@hono/node-server@1.19.14(hono@4.12.31)': + '@hono/node-server@1.19.14(hono@4.12.32)': dependencies: - hono: 4.12.31 + hono: 4.12.32 '@inquirer/ansi@2.0.7': {} @@ -7164,7 +7167,7 @@ snapshots: '@modelcontextprotocol/sdk@1.29.0(supports-color@10.2.2)(zod@4.4.3)': dependencies: - '@hono/node-server': 1.19.14(hono@4.12.31) + '@hono/node-server': 1.19.14(hono@4.12.32) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 2.0.0(patch_hash=985a8758e5e2783b13cabb8db054c0ff2a18591eb76a8eaacd7bc3eaae1a6ba5) @@ -7174,7 +7177,7 @@ snapshots: eventsource-parser: 3.1.0 express: 5.2.1(supports-color@10.2.2) express-rate-limit: 8.5.2(express@5.2.1(supports-color@10.2.2)) - hono: 4.12.31 + hono: 4.12.32 jose: 6.2.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -8133,7 +8136,7 @@ snapshots: p-limit: 2.3.0 semver: 7.8.5 strip-ansi: 7.2.0 - tar: 7.5.21 + tar: 7.5.22 tinylogic: 2.0.0 treeify: 1.1.0 tslib: 2.8.1 @@ -8691,7 +8694,7 @@ snapshots: express-rate-limit@8.5.2(express@5.2.1(supports-color@10.2.2)): dependencies: express: 5.2.1(supports-color@10.2.2) - ip-address: 10.2.0 + ip-address: 10.3.1 express@5.2.1(supports-color@10.2.2): dependencies: @@ -8859,7 +8862,7 @@ snapshots: has-flag@5.0.1: {} - hono@4.12.31: {} + hono@4.12.32: {} hosted-git-info@8.1.0: dependencies: @@ -8916,7 +8919,7 @@ snapshots: ini@5.0.0: {} - ip-address@10.2.0: {} + ip-address@10.3.1: {} ipaddr.js@1.9.1: {} @@ -9421,19 +9424,19 @@ snapshots: minimist@1.2.8: {} - minimizer-webpack-plugin@5.6.1(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.22)(webpack@5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.22)): + minimizer-webpack-plugin@5.6.1(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.23)(webpack@5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.23)): dependencies: '@jridgewell/trace-mapping': 0.3.31 jest-worker: 27.5.1 schema-utils: 4.3.3 terser: 5.48.0 - webpack: 5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.22) + webpack: 5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.23) optionalDependencies: '@swc/core': 1.15.43 csso: 5.0.5 esbuild: 0.28.1 lightningcss: 1.32.0 - postcss: 8.5.22 + postcss: 8.5.23 minipass-collect@2.0.1: dependencies: @@ -9498,7 +9501,7 @@ snapshots: nopt: 9.0.0 proc-log: 6.1.0 semver: 7.8.5 - tar: 7.5.21 + tar: 7.5.22 tinyglobby: 0.2.17 undici: 6.27.0 which: 7.0.0 @@ -9704,7 +9707,7 @@ snapshots: proc-log: 6.1.0 sigstore: 4.1.1(supports-color@10.2.2) ssri: 12.0.0 - tar: 7.5.21 + tar: 7.5.22 transitivePeerDependencies: - supports-color @@ -9767,7 +9770,7 @@ snapshots: cssesc: 3.0.0 util-deprecate: 1.0.2 - postcss@8.5.22: + postcss@8.5.23: dependencies: nanoid: 3.3.16 picocolors: 1.1.1 @@ -9997,7 +10000,7 @@ snapshots: socks@2.8.9: dependencies: - ip-address: 10.2.0 + ip-address: 10.3.1 smart-buffer: 4.2.0 source-map-js@1.2.1: {} @@ -10108,7 +10111,7 @@ snapshots: - bare-buffer - react-native-b4a - tar@7.5.21: + tar@7.5.22: dependencies: '@isaacs/fs-minipass': 4.0.1 chownr: 3.0.0 @@ -10216,7 +10219,7 @@ snapshots: typanion@3.14.0: {} - type-coverage-core@2.29.7(typescript@7.0.2): + type-coverage-core@2.30.1(typescript@7.0.2): dependencies: fast-glob: 3.3.3 minimatch: 9.0.9 @@ -10225,11 +10228,11 @@ snapshots: tsutils: 3.21.0(typescript@7.0.2) typescript: 7.0.2 - type-coverage@2.29.7(typescript@7.0.2): + type-coverage@2.30.1(typescript@7.0.2): dependencies: chalk: 5.6.2(patch_hash=3e5adfdfa27f0c9e066fe820ac91f77773798f205f5e43ff220b250007196661) minimist: 1.2.8 - type-coverage-core: 2.29.7(typescript@7.0.2) + type-coverage-core: 2.30.1(typescript@7.0.2) transitivePeerDependencies: - typescript @@ -10334,7 +10337,7 @@ snapshots: dependencies: lightningcss: 1.32.0 picomatch: 4.0.5 - postcss: 8.5.22 + postcss: 8.5.23 rolldown: 1.1.4 tinyglobby: 0.2.17 optionalDependencies: @@ -10391,7 +10394,7 @@ snapshots: webpack-sources@3.5.1: {} - webpack@5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.22): + webpack@5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.23): dependencies: '@types/estree': 1.0.9 '@types/json-schema': 7.0.15 @@ -10407,7 +10410,7 @@ snapshots: events: 3.3.0 graceful-fs: 4.2.11 mime-db: 1.54.0 - minimizer-webpack-plugin: 5.6.1(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.22)(webpack@5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.22)) + minimizer-webpack-plugin: 5.6.1(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.23)(webpack@5.109.0(@swc/core@1.15.43)(csso@5.0.5)(esbuild@0.28.1)(lightningcss@1.32.0)(postcss@8.5.23)) neo-async: 2.6.2 schema-utils: 4.3.3 tapable: 2.3.3 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index aa6a0a9bb..5551155d9 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -152,13 +152,13 @@ minimumReleaseAgeExclude: # verkit — new dev-only transitive of taze 19.16.0 (same owner directive); # exact-pinned so future versions re-soak. -# Refuse transitive dependencies declared via git/tarball/local-tarball -# specs — an npm package shouldn't be allowed to drag in a git URL we -# don't control (bypasses npm registry validation, no provenance, no -# soak window). Direct git deps are still allowed (the test suite at -# pnpm/pkg-manager/core/test/install/blockExoticSubdeps.ts confirms -# this). pnpm's current default is `false`; declared explicitly so a -# future flip can't silently change install behavior. + # Refuse transitive dependencies declared via git/tarball/local-tarball + # specs — an npm package shouldn't be allowed to drag in a git URL we + # don't control (bypasses npm registry validation, no provenance, no + # soak window). Direct git deps are still allowed (the test suite at + # pnpm/pkg-manager/core/test/install/blockExoticSubdeps.ts confirms + # this). pnpm's current default is `false`; declared explicitly so a + # future flip can't silently change install behavior. blockExoticSubdeps: true confirmModulesPurge: false @@ -255,9 +255,9 @@ overrides: 'has-flag': '5.0.1' # 4.12.25+ clears GHSA-88fw-hqm2-52qc (hono CORS wildcard+credentials reflect), # pulled transitively via @anthropic-ai/claude-agent-sdk. - 'hono': '4.12.31' + 'hono': '4.12.32' 'hosted-git-info': '8.1.0' - 'ip-address': '10.2.0' + 'ip-address': '10.3.1' 'isexe': '3.1.5' # Dedup: js-tokens 4 (@babel/code-frame, CJS require) + 10 (ast-v8-to-istanbul, # ESM import) → 10.0.0. The two majors have incompatible APIs (v4 regex vs v10 @@ -287,7 +287,7 @@ overrides: 'p-map': '7.0.6' 'pacote': '21.5.1' 'picomatch': '4.0.5' - 'postcss': '8.5.22' + 'postcss': '8.5.23' 'proc-log': '6.1.0' 'qs': '6.15.3' # Unify every rolldown resolution to the catalog pin (1.1.0). vite 8.0.14 @@ -302,7 +302,7 @@ overrides: 'strip-ansi': '7.2.0' 'supports-color': '10.2.2' # 7.5.16+ clears GHSA (node-tar PAX size-override parser differential, <=7.5.15). - 'tar': '7.5.21' + 'tar': '7.5.22' # Dedup: tar-fs 2 (dockerode) + 3 (bundled into src/archives) → the catalog # pin, and its tar-stream 2/3 dep along with it → 3.2.0. Both are CJS; # dockerode is the only tar-fs@2 consumer (latent devtool).