diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4882d95c..26703475 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,10 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + glob@>=9.0.0 <14.0.2: ^14.0.2 + filelist>minimatch: ^11.0.1 + patchedDependencies: '@capacitor/cli@8.4.3': d205ba8093a05871f0c75b5a16fda564dcc42f5a4808d14a05f6b066488187fe '@capawesome/capacitor-live-update@8.3.0': bde38c758771ca4a578a76b47f58ad30ebfec7c01dd91fd24390b86efab706fc @@ -1287,14 +1291,13 @@ packages: resolution: {integrity: sha512-3cKScz9Jx2/Pr9ijj1OzGlBDfcmx7OMVBt4+P1uRR0SSW4cm1/y3Mo4OY3lfkuaYifMNBW8Wz6lQHbs1bihr7A==} engines: {node: '>=16.0.0'} - '@isaacs/cliui@9.0.0': - resolution: {integrity: sha512-AokJm4tuBHillT+FpMtxQ60n8ObyXBatq7jD2/JA9dxbDDokKQm8KMht5ibGzLVU9IJDIKK4TPKgMHEYMn3lMg==} - engines: {node: '>=18'} - '@isaacs/fs-minipass@4.0.1': resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==} engines: {node: '>=18.0.0'} + '@isaacs/nonrecursive-glob-match@1.0.3': + resolution: {integrity: sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==} + '@jridgewell/gen-mapping@0.3.13': resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==} @@ -2353,9 +2356,6 @@ packages: peerDependencies: '@babel/core': ^7.4.0 || ^8.0.0-0 <8.0.0 - balanced-match@1.0.2: - resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} - balanced-match@4.0.4: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} @@ -2376,9 +2376,6 @@ packages: resolution: {integrity: sha512-apC2+fspHGI3mMKj+dGevkGo/tCqVB8jMb6i+OX+E29p0Iposz07fABkRIfVUPNd5A5VbuOz1bZbnmkKLYF+wQ==} engines: {node: '>= 5.10.0'} - brace-expansion@2.1.7: - resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==} - brace-expansion@5.0.12: resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} @@ -2790,10 +2787,6 @@ packages: resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==} engines: {node: '>= 0.4'} - foreground-child@3.3.1: - resolution: {integrity: sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==} - engines: {node: '>=14'} - framer-motion@12.42.2: resolution: {integrity: sha512-5XY9luDiu0oHfHBjpDthFMh0ES+122w6p/papSJBweMkO8Sn+PW2QaEgRblQBpWFnuvZS5qvarpt/hO2pjGmnw==} peerDependencies: @@ -2866,14 +2859,8 @@ packages: resolution: {integrity: sha512-/6gFNr0N04nob252sTQxyFLi3eKFRqIg1I87YcqAMT1i6SQrSF6KujUEQrtrjMV0H/eejTCltLdDSTEMzHbnsQ==} engines: {node: '>=20.20.0'} - glob@11.1.0: - resolution: {integrity: sha512-vuNwKSaKiqm7g0THUBu2x7ckSs3XJLXE+2ssL7/MfTGPLLcrJQ/4Uq1CjPTtO5cCIiRxqvN6Twy1qOwhL0Xjcw==} - engines: {node: 20 || >=22} - deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me - hasBin: true - - glob@13.0.6: - resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==} + glob@14.0.3: + resolution: {integrity: sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==} engines: {node: 18 || 20 || >=22} globalthis@1.0.4: @@ -3140,10 +3127,6 @@ packages: resolution: {integrity: sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==} engines: {node: '>=8'} - jackspeak@4.2.3: - resolution: {integrity: sha512-ykkVRwrYvFm1nb2AJfKKYPr0emF6IiXDYUaFx4Zn9ZuIH7MrzEZ3sD5RlqGXNRpHtvUHJyOnCEFxOlNDtGo7wg==} - engines: {node: 20 || >=22} - jake@10.9.4: resolution: {integrity: sha512-wpHYzhxiVQL+IV05BLE2Xn34zW1S223hvjtqk0+gsPrwd/8JNLXJgZZM/iPFsYc1xyphF+6M6EvdE5E9MBGkDA==} engines: {node: '>=10'} @@ -3389,14 +3372,10 @@ packages: resolution: {integrity: sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==} engines: {node: '>=6'} - minimatch@10.2.5: - resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==} + minimatch@11.0.3: + resolution: {integrity: sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==} engines: {node: 18 || 20 || >=22} - minimatch@5.1.9: - resolution: {integrity: sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==} - engines: {node: '>=10'} - minipass@7.1.3: resolution: {integrity: sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==} engines: {node: '>=16 || 14 >=14.17'} @@ -3554,8 +3533,8 @@ packages: path-parse@1.0.7: resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==} - path-scurry@2.0.2: - resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==} + path-scurry@3.0.0: + resolution: {integrity: sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==} engines: {node: 18 || 20 || >=22} pathe@2.0.3: @@ -3775,15 +3754,15 @@ packages: resolution: {integrity: sha512-kYEnegpAxWFjUw3dSYdSM9zVlTrsxDbsSkq/qd3B7VanqyJ+JdDy6qVyuqVGBhSfuD/rLZQEKuXsO5KZFCrVYQ==} engines: {node: '>=20.0.0'} - seroval-plugins@1.6.9: - resolution: {integrity: sha512-kiDK/Tb8IWZ61WEU8pA2PDmAuw37gKph9Y77OZlD56mg0Y2g0Bg7gZ1HeHhs5d40w+nRoUq/wj08V26ilbez9g==} - engines: {node: '>=10'} + seroval-plugins@1.7.6: + resolution: {integrity: sha512-/TPCAd6q5stAZnugD2fsvNKtM2UpgwrS8/fO1cXTgPC0EqCsGB+UfkEEsToFCfg35CDTMlWkppfr/zWnLJGpBA==} + engines: {node: '>=20'} peerDependencies: seroval: ^1.0 - seroval@1.6.9: - resolution: {integrity: sha512-UeEzHwAK+yl0YLbsvROV1t5yMYEwZZ0CfKYxDvUgS2fO9Vxdf8djqVIB+OuVpuawRNPqw68LE1Du/GMsW2ZPqA==} - engines: {node: '>=10'} + seroval@1.7.6: + resolution: {integrity: sha512-oKNe6A8I3lSA5J0xg9xsrWCWDpET6CFhCMVuIsCmqrjNpBXzQXDAAQI5UfuC4Ner4DIR+VAtSw7TC0AmRMqFFQ==} + engines: {node: '>=20'} set-function-length@1.2.2: resolution: {integrity: sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==} @@ -3836,10 +3815,6 @@ packages: signal-exit@3.0.7: resolution: {integrity: sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==} - signal-exit@4.1.0: - resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==} - engines: {node: '>=14'} - sisteransi@1.0.5: resolution: {integrity: sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==} @@ -5683,12 +5658,12 @@ snapshots: transitivePeerDependencies: - supports-color - '@isaacs/cliui@9.0.0': {} - '@isaacs/fs-minipass@4.0.1': dependencies: minipass: 7.1.3 + '@isaacs/nonrecursive-glob-match@1.0.3': {} + '@jridgewell/gen-mapping@0.3.13': dependencies: '@jridgewell/sourcemap-codec': 1.5.5 @@ -6154,8 +6129,8 @@ snapshots: dependencies: '@tanstack/history': 1.162.4 cookie-es: 3.1.1 - seroval: 1.6.9 - seroval-plugins: 1.6.9(seroval@1.6.9) + seroval: 1.7.6 + seroval-plugins: 1.7.6(seroval@1.7.6) '@tanstack/router-generator@1.167.40': dependencies: @@ -6212,7 +6187,7 @@ snapshots: '@tanstack/router-core': 1.171.34 '@tanstack/start-fn-stubs': 1.162.0 '@tanstack/start-storage-context': 1.167.36 - seroval: 1.6.9 + seroval: 1.7.6 '@tanstack/start-fn-stubs@1.162.0': {} @@ -6231,7 +6206,7 @@ snapshots: lightningcss: 1.33.0 pathe: 2.0.3 picomatch: 4.0.7 - seroval: 1.6.9 + seroval: 1.7.6 source-map: 0.7.6 srvx: 0.11.22 tinyglobby: 0.2.17 @@ -6263,7 +6238,7 @@ snapshots: '@tanstack/start-storage-context': 1.167.36 fetchdts: 0.1.7 h3-v2: h3@2.0.1-rc.20(crossws@0.4.10(srvx@0.11.22)) - seroval: 1.6.9 + seroval: 1.7.6 transitivePeerDependencies: - crossws @@ -6612,8 +6587,6 @@ snapshots: transitivePeerDependencies: - supports-color - balanced-match@1.0.2: {} - balanced-match@4.0.4: {} base64-js@1.5.1: {} @@ -6626,10 +6599,6 @@ snapshots: dependencies: big-integer: 1.6.52 - brace-expansion@2.1.7: - dependencies: - balanced-match: 1.0.2 - brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -7023,17 +6992,12 @@ snapshots: filelist@1.0.6: dependencies: - minimatch: 5.1.9 + minimatch: 11.0.3 for-each@0.3.5: dependencies: is-callable: 1.2.7 - foreground-child@3.3.1: - dependencies: - cross-spawn: 7.0.6 - signal-exit: 4.1.0 - framer-motion@12.42.2(react-dom@19.2.3(react@19.2.3))(react@19.2.3): dependencies: motion-dom: 12.42.2 @@ -7113,20 +7077,11 @@ snapshots: dependencies: resolve-pkg-maps: 1.0.0 - glob@11.1.0: + glob@14.0.3: dependencies: - foreground-child: 3.3.1 - jackspeak: 4.2.3 - minimatch: 10.2.5 + minimatch: 11.0.3 minipass: 7.1.3 - package-json-from-dist: 1.0.1 - path-scurry: 2.0.2 - - glob@13.0.6: - dependencies: - minimatch: 10.2.5 - minipass: 7.1.3 - path-scurry: 2.0.2 + path-scurry: 3.0.0 globalthis@1.0.4: dependencies: @@ -7389,10 +7344,6 @@ snapshots: html-escaper: 2.0.2 istanbul-lib-report: 3.0.1 - jackspeak@4.2.3: - dependencies: - '@isaacs/cliui': 9.0.0 - jake@10.9.4: dependencies: async: 3.2.6 @@ -7570,14 +7521,11 @@ snapshots: mimic-fn@2.1.0: {} - minimatch@10.2.5: + minimatch@11.0.3: dependencies: + '@isaacs/nonrecursive-glob-match': 1.0.3 brace-expansion: 5.0.12 - minimatch@5.1.9: - dependencies: - brace-expansion: 2.1.7 - minipass@7.1.3: {} minizlib@3.1.0: @@ -7749,7 +7697,7 @@ snapshots: path-parse@1.0.7: {} - path-scurry@2.0.2: + path-scurry@3.0.0: dependencies: lru-cache: 11.5.2 minipass: 7.1.3 @@ -7887,7 +7835,7 @@ snapshots: rimraf@6.1.3: dependencies: - glob: 13.0.6 + glob: 14.0.3 package-json-from-dist: 1.0.1 rolldown-plugin-dts@0.27.14(rolldown@1.2.0)(typescript@5.9.3): @@ -8018,11 +7966,11 @@ snapshots: serialize-javascript@7.1.3: {} - seroval-plugins@1.6.9(seroval@1.6.9): + seroval-plugins@1.7.6(seroval@1.7.6): dependencies: - seroval: 1.6.9 + seroval: 1.7.6 - seroval@1.6.9: {} + seroval@1.7.6: {} set-function-length@1.2.2: dependencies: @@ -8117,8 +8065,6 @@ snapshots: signal-exit@3.0.7: {} - signal-exit@4.1.0: {} - sisteransi@1.0.5: {} skin-tone@2.0.0: @@ -8601,7 +8547,7 @@ snapshots: eta: 4.6.0 fast-json-stable-stringify: 2.1.0 fs-extra: 9.1.0 - glob: 11.1.0 + glob: 14.0.3 pretty-bytes: 5.6.0 rollup: 4.62.2 source-map: 0.8.0-beta.0 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index c7064de0..d58c7410 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -9,6 +9,16 @@ allowBuilds: # platform with no prebuilt binary the import fails and the CLI degrades to one icon # warning (bin/lib/icons.mjs `loadSharp`), which is the right failure. sharp: false +# Security overrides: each parent's latest release still pins a vulnerable range, so force +# the patched one. Drop an entry once its parent ships a release that allows the fix. +overrides: + # GHSA-3g3m-2fjr-6pw4 (glob >=9 <=14.0.1). workbox-build 7.4.1 wants ^11 and rimraf + # 6.1.3 (via @capacitor/cli) wants ^13; both call only `glob` / `globSync`, unchanged in 14. + # glob 14 also moves its minimatch to ^11, which clears GHSA-g3hv-75wg-m249 for that copy. + 'glob@>=9.0.0 <14.0.2': ^14.0.2 + # GHSA-g3hv-75wg-m249 (minimatch <11.0.1). filelist 1.0.6 is reached only through ejs's + # jake CLI (ejs's library never loads it) and calls `minimatch.match`, which 11 still exports. + 'filelist>minimatch': ^11.0.1 # Version-PINNED patch keys (not bare names): a patch is written against a specific # version's code, so pin it. If the resolved version ever drifts, pnpm fails the install # LOUDLY (no matching version) instead of silently applying the patch to changed code —