Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package git-bug for openSUSE:Factory checked in at 2026-11-05 18:23:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/git-bug (Old) and /work/SRC/openSUSE:Factory/.git-bug.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "git-bug" Thu Nov 5 18:23:08 2026 rev:21 rq:1395221 version:0.11.0 Changes: -------- --- /work/SRC/openSUSE:Factory/git-bug/git-bug.changes 2026-10-24 22:06:33.822478398 +0200 +++ /work/SRC/openSUSE:Factory/.git-bug.new.3759290/git-bug.changes 2026-11-05 18:24:16.837611002 +0100 @@ -1,0 +2,34 @@ +Thu Nov 5 11:45:06 UTC 2026 - Matej Cepl <[email protected]> + +- Complete JavaScript revendoring for the reported security fixes: + - Override all @graphql-tools/utils dependencies to 12.0.2 and + remove the remaining vulnerable 11.2.2 copy used by GraphQL + code generation. Fix prototype pollution through non-primitive + incremental-result paths, CVE-2026-114604, bsc#1287363. + - Retain body-parser 2.4.0 for the compressed-request denial of + service fix, CVE-2026-111181, bsc#1287338. + - Retain qs 6.17.0 for empty-array query parameter injection, + CVE-2026-110910, bsc#1288154. + - Regenerate the npm lock, source inventories and container with + 860 tarballs. Reject security inventories retaining utils + 11.2.2 and document the code-generation override. + +------------------------------------------------------------------- +Mon Nov 2 19:08:22 UTC 2026 - Matej Cepl <[email protected]> + +- Update JavaScript vendoring for security fixes: + - body-parser 2.3.0 -> 2.4.0 (bsc#1287338, CVE-2026-111181). + - @graphql-tools/utils 12.0.1 -> 12.0.2 (bsc#1287363, + CVE-2026-114604); add vendored dependency + @whatwg-node/promise-helpers 2.0.1. + - qs 6.16.1 -> 6.17.0 (bsc#1288154, CVE-2026-110910). + - Regenerate npm lock and node_modules container (861 tarballs); + update prepare-webui-lock.py security inventory replacements. + +------------------------------------------------------------------- +Thu Oct 29 12:32:50 UTC 2026 - Lubos Kocman <[email protected]> + +- Add GPL-3.0-or-later and MPL-2.0 to main license tag + Triggered by Legaldb review + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ git-bug.spec ++++++ --- /var/tmp/diff_new_pack.I9lElT/_old 2026-11-05 18:24:29.146122960 +0100 +++ /var/tmp/diff_new_pack.I9lElT/_new 2026-11-05 18:24:29.151123168 +0100 @@ -35,7 +35,7 @@ # notices collector includes dependencies even when Vite tree-shakes them. License: 0BSD AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND BlueOak-1.0.0 AND CC-BY-4.0 AND ISC AND MIT AND OFL-1.1 AND Python-2.0 AND Unlicense %else -License: MIT +License: MIT AND GPL-3.0-or-later and MPL-2.0 %endif URL: https://github.com/git-bug/git-bug Source0: https://github.com/git-bug/%{name}/archive/refs/tags/v%{version}.tar.gz#/git-bug-%{version}.tar.gz ++++++ WEBUI-PACKAGING.md ++++++ --- /var/tmp/diff_new_pack.I9lElT/_old 2026-11-05 18:24:29.312129865 +0100 +++ /var/tmp/diff_new_pack.I9lElT/_new 2026-11-05 18:24:29.318130115 +0100 @@ -24,7 +24,7 @@ | 1. Separate downloading and npm resolution | Complete | | 2. Implement converter | Complete | | 3. Use service's multi-lock input | Complete and tested with installed service | -| 4. Test conversion | Complete; 37 unit tests across preparation, native addons and notice collection | +| 4. Test conversion | Complete; 38 unit tests across preparation, native addons and notice collection | | 5. Generate genuine npm lock | Generated; provenance checked and fresh-cache installation passed. Exact peer-graph equivalence is not claimed. | | 6. Integrate service/submission workflow | Implemented with manual services, a legacy cpio container and generated source includes | | 7. Factory tools and native dependencies | Complete: native addons compiled from Rust sources; esbuild is not used by the build | @@ -154,9 +154,15 @@ ## Downstream security updates -The submitted inventory replaces upstream fast-uri 3.1.7 with 3.1.9 and -qs 6.16.0 with 6.16.1. The npm manifest pins these replacements through -overrides. All other source records are unchanged. +The submitted inventory replaces upstream fast-uri 3.1.7 with 3.1.9, +qs 6.16.0 with 6.17.0, body-parser 2.3.0 with 2.4.0, and +@graphql-tools/utils 11.2.2 and 12.0.1 with 12.0.2, which additionally vendors +@whatwg-node/promise-helpers 2.0.1. The npm manifest pins fast-uri, +qs, body-parser and @graphql-tools/utils through overrides. The GraphQL +code-generation dependencies still request utils 11.x, which has no fixed +release. The override makes them use 12.0.2 too; replacing only 12.0.1 leaves +an exploitable 11.2.2 copy in the container. All other source records are +unchanged. To regenerate the lock with these reviewed replacements, add `--security-inventory /absolute/path/to/node-sources-full.json` to the ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.I9lElT/_old 2026-11-05 18:24:29.388133027 +0100 +++ /var/tmp/diff_new_pack.I9lElT/_new 2026-11-05 18:24:29.400133526 +0100 @@ -1,5 +1,5 @@ -mtime: 1792796107 -commit: 626f9c9a9a8aff7dcfe1fa1379c67c633a8e251b58a04b94e3c26cb88144def4 +mtime: 1793881291 +commit: 62fd89d6562e01c5807e896d3a20e0ce3233fa623ea4a684c80f370b859fcb88 url: https://src.opensuse.org/mcepl/git-bug revision: factory ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-11-05 13:21:31.000000000 +0100 @@ -0,0 +1,15 @@ +_build.* +build.specials.obscpio +git-bug/ +*.obscpio +!node_modules.obscpio +*.osc +.osc +.pbuild +_scmsync.obsinfo +_service:* +git-bug-*-build/ +# Git clones cached by the tar_scm services for the native addons +/rolldown/ +/tailwindcss/ +/lightningcss/ ++++++ node-sources-full.json ++++++ --- /var/tmp/diff_new_pack.I9lElT/_old 2026-11-05 18:24:29.758148417 +0100 +++ /var/tmp/diff_new_pack.I9lElT/_new 2026-11-05 18:24:29.762148583 +0100 @@ -1379,23 +1379,13 @@ } } }, - "@graphql-tools/[email protected]": { + "@graphql-tools/[email protected]": { "lockfileVersion": 3, "packages": { "node_modules/@graphql-tools/utils": { - "integrity": "sha512-Do2A/t6ayqOma8m7PvpYMsCBswL+NB35BQSng4GWSBqafL2/BnfAZy/NSENPwV721Rm2fG0BHETFC0+FJJZmLw==", - "resolved": "https://registry.npmjs.org/@graphql-tools/utils/-/utils-11.2.2.tgz";, - "version": "11.2.2" - } - } - }, - "@graphql-tools/[email protected]": { - "lockfileVersion": 3, - "packages": { - "node_modules/@graphql-tools/utils": { - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "resolved": "https://registry.npmjs.org/@graphql-tools/utils/-/utils-12.0.1.tgz";, - "version": "12.0.1" + "integrity": "sha512-N1j6fG12Cq5HN4826NGNtGu8O65eLCO6nHbTTboa0GEB7c2Ym2kLGU3ewHrG9DR/coL09GQjREChSG0SjUuAGA==", + "resolved": "https://registry.npmjs.org/@graphql-tools/utils/-/utils-12.0.2.tgz";, + "version": "12.0.2" } } }, @@ -4349,6 +4339,16 @@ } } }, + "@whatwg-node/[email protected]": { + "lockfileVersion": 3, + "packages": { + "node_modules/@whatwg-node/promise-helpers": { + "integrity": "sha512-ziVgm01A9irPLVBaUFei64qp771BrDXldbv5pY6kgFgNtA+7zq8ux6nj/6w8bELGH/+Ttnc76ox04HIjU8nqvg==", + "resolved": "https://registry.npmjs.org/@whatwg-node/promise-helpers/-/promise-helpers-2.0.1.tgz";, + "version": "2.0.1" + } + } + }, "@wry/[email protected]": { "lockfileVersion": 3, "packages": { @@ -4689,13 +4689,13 @@ } } }, - "[email protected]": { + "[email protected]": { "lockfileVersion": 3, "packages": { "node_modules/body-parser": { - "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz";, - "version": "2.3.0" + "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz";, + "version": "2.4.0" } } }, @@ -9549,13 +9549,13 @@ } } }, - "[email protected]": { + "[email protected]": { "lockfileVersion": 3, "packages": { "node_modules/qs": { - "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz";, - "version": "6.16.1" + "integrity": "sha512-5LK5BZ2XDHMvcUJaf0CQ5HL3aVgKbpklvByC7qLSxYkfE8COEEbJg5xCHWCTqzqi0Gs4Jn5Mv5v3R38W6edscA==", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.17.0.tgz";, + "version": "6.17.0" } } }, ++++++ node-sources.json ++++++ --- /var/tmp/diff_new_pack.I9lElT/_old 2026-11-05 18:24:29.794149914 +0100 +++ /var/tmp/diff_new_pack.I9lElT/_new 2026-11-05 18:24:29.800150164 +0100 @@ -899,23 +899,13 @@ } } }, - "@graphql-tools/[email protected]": { + "@graphql-tools/[email protected]": { "lockfileVersion": 3, "packages": { "node_modules/@graphql-tools/utils": { - "integrity": "sha512-Do2A/t6ayqOma8m7PvpYMsCBswL+NB35BQSng4GWSBqafL2/BnfAZy/NSENPwV721Rm2fG0BHETFC0+FJJZmLw==", - "resolved": "https://registry.npmjs.org/@graphql-tools/utils/-/utils-11.2.2.tgz";, - "version": "11.2.2" - } - } - }, - "@graphql-tools/[email protected]": { - "lockfileVersion": 3, - "packages": { - "node_modules/@graphql-tools/utils": { - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "resolved": "https://registry.npmjs.org/@graphql-tools/utils/-/utils-12.0.1.tgz";, - "version": "12.0.1" + "integrity": "sha512-N1j6fG12Cq5HN4826NGNtGu8O65eLCO6nHbTTboa0GEB7c2Ym2kLGU3ewHrG9DR/coL09GQjREChSG0SjUuAGA==", + "resolved": "https://registry.npmjs.org/@graphql-tools/utils/-/utils-12.0.2.tgz";, + "version": "12.0.2" } } }, @@ -2359,6 +2349,16 @@ } } }, + "@whatwg-node/[email protected]": { + "lockfileVersion": 3, + "packages": { + "node_modules/@whatwg-node/promise-helpers": { + "integrity": "sha512-ziVgm01A9irPLVBaUFei64qp771BrDXldbv5pY6kgFgNtA+7zq8ux6nj/6w8bELGH/+Ttnc76ox04HIjU8nqvg==", + "resolved": "https://registry.npmjs.org/@whatwg-node/promise-helpers/-/promise-helpers-2.0.1.tgz";, + "version": "2.0.1" + } + } + }, "@wry/[email protected]": { "lockfileVersion": 3, "packages": { @@ -2649,13 +2649,13 @@ } } }, - "[email protected]": { + "[email protected]": { "lockfileVersion": 3, "packages": { "node_modules/body-parser": { - "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz";, - "version": "2.3.0" + "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz";, + "version": "2.4.0" } } }, @@ -6759,13 +6759,13 @@ } } }, - "[email protected]": { + "[email protected]": { "lockfileVersion": 3, "packages": { "node_modules/qs": { - "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz";, - "version": "6.16.1" + "integrity": "sha512-5LK5BZ2XDHMvcUJaf0CQ5HL3aVgKbpklvByC7qLSxYkfE8COEEbJg5xCHWCTqzqi0Gs4Jn5Mv5v3R38W6edscA==", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.17.0.tgz";, + "version": "6.17.0" } } }, ++++++ node_modules.obscpio ++++++ Binary files old/@graphql-tools-utils-11.2.2.tgz and new/@graphql-tools-utils-11.2.2.tgz differ Binary files old/@graphql-tools-utils-12.0.1.tgz and new/@graphql-tools-utils-12.0.1.tgz differ Binary files old/@graphql-tools-utils-12.0.2.tgz and new/@graphql-tools-utils-12.0.2.tgz differ Binary files old/@whatwg-node-promise-helpers-2.0.1.tgz and new/@whatwg-node-promise-helpers-2.0.1.tgz differ Binary files old/body-parser-2.3.0.tgz and new/body-parser-2.3.0.tgz differ Binary files old/body-parser-2.4.0.tgz and new/body-parser-2.4.0.tgz differ Binary files old/qs-6.16.1.tgz and new/qs-6.16.1.tgz differ Binary files old/qs-6.17.0.tgz and new/qs-6.17.0.tgz differ ++++++ node_modules.spec.inc ++++++ --- /var/tmp/diff_new_pack.I9lElT/_old 2026-11-05 18:24:31.004200245 +0100 +++ /var/tmp/diff_new_pack.I9lElT/_new 2026-11-05 18:24:31.007200370 +0100 @@ -88,152 +88,152 @@ Source10087: https://registry.npmjs.org/@graphql-tools/relay-operation-optimizer/-/relay-operation-optimizer-7.1.10.tgz#/@graphql-tools-relay-operation-optimizer-7.1.10.tgz Source10088: https://registry.npmjs.org/@graphql-tools/schema/-/schema-10.1.1.tgz#/@graphql-tools-schema-10.1.1.tgz Source10089: https://registry.npmjs.org/@graphql-tools/url-loader/-/url-loader-9.1.9.tgz#/@graphql-tools-url-loader-9.1.9.tgz -Source10090: https://registry.npmjs.org/@graphql-tools/utils/-/utils-11.2.2.tgz#/@graphql-tools-utils-11.2.2.tgz -Source10091: https://registry.npmjs.org/@graphql-tools/utils/-/utils-12.0.1.tgz#/@graphql-tools-utils-12.0.1.tgz -Source10092: https://registry.npmjs.org/@graphql-tools/wrap/-/wrap-11.2.0.tgz#/@graphql-tools-wrap-11.2.0.tgz -Source10093: https://registry.npmjs.org/@graphql-typed-document-node/core/-/core-3.2.0.tgz#/@graphql-typed-document-node-core-3.2.0.tgz -Source10094: https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.1.tgz#/@hono-node-server-2.1.1.tgz -Source10095: https://registry.npmjs.org/@inquirer/ansi/-/ansi-2.0.8.tgz#/@inquirer-ansi-2.0.8.tgz -Source10096: https://registry.npmjs.org/@inquirer/checkbox/-/checkbox-5.2.5.tgz#/@inquirer-checkbox-5.2.5.tgz -Source10097: https://registry.npmjs.org/@inquirer/confirm/-/confirm-6.3.2.tgz#/@inquirer-confirm-6.3.2.tgz -Source10098: https://registry.npmjs.org/@inquirer/core/-/core-12.0.3.tgz#/@inquirer-core-12.0.3.tgz -Source10099: https://registry.npmjs.org/@inquirer/editor/-/editor-5.3.3.tgz#/@inquirer-editor-5.3.3.tgz -Source10100: https://registry.npmjs.org/@inquirer/expand/-/expand-5.1.5.tgz#/@inquirer-expand-5.1.5.tgz -Source10101: https://registry.npmjs.org/@inquirer/external-editor/-/external-editor-3.0.5.tgz#/@inquirer-external-editor-3.0.5.tgz -Source10102: https://registry.npmjs.org/@inquirer/figures/-/figures-2.0.9.tgz#/@inquirer-figures-2.0.9.tgz -Source10103: https://registry.npmjs.org/@inquirer/input/-/input-5.1.6.tgz#/@inquirer-input-5.1.6.tgz -Source10104: https://registry.npmjs.org/@inquirer/number/-/number-4.2.3.tgz#/@inquirer-number-4.2.3.tgz -Source10105: https://registry.npmjs.org/@inquirer/password/-/password-5.2.2.tgz#/@inquirer-password-5.2.2.tgz -Source10106: https://registry.npmjs.org/@inquirer/prompts/-/prompts-8.7.2.tgz#/@inquirer-prompts-8.7.2.tgz -Source10107: https://registry.npmjs.org/@inquirer/rawlist/-/rawlist-5.3.5.tgz#/@inquirer-rawlist-5.3.5.tgz -Source10108: https://registry.npmjs.org/@inquirer/search/-/search-4.3.3.tgz#/@inquirer-search-4.3.3.tgz -Source10109: https://registry.npmjs.org/@inquirer/select/-/select-5.2.5.tgz#/@inquirer-select-5.2.5.tgz -Source10110: https://registry.npmjs.org/@inquirer/type/-/type-4.1.1.tgz#/@inquirer-type-4.1.1.tgz -Source10111: https://registry.npmjs.org/@joshwooding/vite-plugin-react-docgen-typescript/-/vite-plugin-react-docgen-typescript-0.7.0.tgz#/@joshwooding-vite-plugin-react-docgen-typescript-0.7.0.tgz -Source10112: https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz#/@jridgewell-gen-mapping-0.3.13.tgz -Source10113: https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz#/@jridgewell-remapping-2.3.5.tgz -Source10114: https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz#/@jridgewell-resolve-uri-3.1.2.tgz -Source10115: https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz#/@jridgewell-sourcemap-codec-1.6.0.tgz -Source10116: https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz#/@jridgewell-trace-mapping-0.3.31.tgz -Source10117: https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz#/@modelcontextprotocol-sdk-1.30.0.tgz -Source10118: https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.4.tgz#/@napi-rs-wasm-runtime-1.2.4.tgz -Source10119: https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz#/@nodelib-fs.scandir-2.1.5.tgz -Source10120: https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz#/@nodelib-fs.stat-2.0.5.tgz -Source10121: https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz#/@nodelib-fs.walk-1.2.8.tgz -Source10122: https://registry.npmjs.org/@oxc-project/types/-/types-0.127.0.tgz#/@oxc-project-types-0.127.0.tgz -Source10123: https://registry.npmjs.org/@oxc-project/types/-/types-0.149.0.tgz#/@oxc-project-types-0.149.0.tgz -Source10124: https://registry.npmjs.org/@polka/url/-/url-1.0.0-next.29.tgz#/@polka-url-1.0.0-next.29.tgz -Source10125: https://registry.npmjs.org/@repeaterjs/repeater/-/repeater-3.1.0.tgz#/@repeaterjs-repeater-3.1.0.tgz -Source10126: https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz#/@rolldown-pluginutils-1.0.1.tgz -Source10127: https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-5.4.0.tgz#/@rollup-pluginutils-5.4.0.tgz -Source10128: https://registry.npmjs.org/@sec-ant/readable-stream/-/readable-stream-0.4.1.tgz#/@sec-ant-readable-stream-0.4.1.tgz -Source10129: https://registry.npmjs.org/@shikijs/core/-/core-4.4.3.tgz#/@shikijs-core-4.4.3.tgz -Source10130: https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.4.3.tgz#/@shikijs-engine-javascript-4.4.3.tgz -Source10131: https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.4.3.tgz#/@shikijs-engine-oniguruma-4.4.3.tgz -Source10132: https://registry.npmjs.org/@shikijs/langs/-/langs-4.4.3.tgz#/@shikijs-langs-4.4.3.tgz -Source10133: https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.4.3.tgz#/@shikijs-primitive-4.4.3.tgz -Source10134: https://registry.npmjs.org/@shikijs/rehype/-/rehype-4.4.3.tgz#/@shikijs-rehype-4.4.3.tgz -Source10135: https://registry.npmjs.org/@shikijs/themes/-/themes-4.4.3.tgz#/@shikijs-themes-4.4.3.tgz -Source10136: https://registry.npmjs.org/@shikijs/types/-/types-4.4.3.tgz#/@shikijs-types-4.4.3.tgz -Source10137: https://registry.npmjs.org/@shikijs/vscode-textmate/-/vscode-textmate-10.0.2.tgz#/@shikijs-vscode-textmate-10.0.2.tgz -Source10138: https://registry.npmjs.org/@sindresorhus/is/-/is-4.6.0.tgz#/@sindresorhus-is-4.6.0.tgz -Source10139: https://registry.npmjs.org/@sindresorhus/merge-streams/-/merge-streams-4.0.0.tgz#/@sindresorhus-merge-streams-4.0.0.tgz -Source10140: https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz#/@standard-schema-spec-1.1.0.tgz -Source10141: https://registry.npmjs.org/@storybook/addon-a11y/-/addon-a11y-10.6.0.tgz#/@storybook-addon-a11y-10.6.0.tgz -Source10142: https://registry.npmjs.org/@storybook/addon-vitest/-/addon-vitest-10.6.0.tgz#/@storybook-addon-vitest-10.6.0.tgz -Source10143: https://registry.npmjs.org/@storybook/builder-vite/-/builder-vite-10.6.0.tgz#/@storybook-builder-vite-10.6.0.tgz -Source10144: https://registry.npmjs.org/@storybook/global/-/global-5.0.0.tgz#/@storybook-global-5.0.0.tgz -Source10145: https://registry.npmjs.org/@storybook/icons/-/icons-2.1.0.tgz#/@storybook-icons-2.1.0.tgz -Source10146: https://registry.npmjs.org/@storybook/react/-/react-10.6.0.tgz#/@storybook-react-10.6.0.tgz -Source10147: https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.6.0.tgz#/@storybook-react-dom-shim-10.6.0.tgz -Source10148: https://registry.npmjs.org/@storybook/react-vite/-/react-vite-10.6.0.tgz#/@storybook-react-vite-10.6.0.tgz -Source10149: https://registry.npmjs.org/@svgr/babel-plugin-add-jsx-attribute/-/babel-plugin-add-jsx-attribute-8.0.0.tgz#/@svgr-babel-plugin-add-jsx-attribute-8.0.0.tgz -Source10150: https://registry.npmjs.org/@svgr/babel-plugin-remove-jsx-attribute/-/babel-plugin-remove-jsx-attribute-8.0.0.tgz#/@svgr-babel-plugin-remove-jsx-attribute-8.0.0.tgz -Source10151: https://registry.npmjs.org/@svgr/babel-plugin-remove-jsx-empty-expression/-/babel-plugin-remove-jsx-empty-expression-8.0.0.tgz#/@svgr-babel-plugin-remove-jsx-empty-expression-8.0.0.tgz -Source10152: https://registry.npmjs.org/@svgr/babel-plugin-replace-jsx-attribute-value/-/babel-plugin-replace-jsx-attribute-value-8.0.0.tgz#/@svgr-babel-plugin-replace-jsx-attribute-value-8.0.0.tgz -Source10153: https://registry.npmjs.org/@svgr/babel-plugin-svg-dynamic-title/-/babel-plugin-svg-dynamic-title-8.0.0.tgz#/@svgr-babel-plugin-svg-dynamic-title-8.0.0.tgz -Source10154: https://registry.npmjs.org/@svgr/babel-plugin-svg-em-dimensions/-/babel-plugin-svg-em-dimensions-8.0.0.tgz#/@svgr-babel-plugin-svg-em-dimensions-8.0.0.tgz -Source10155: https://registry.npmjs.org/@svgr/babel-plugin-transform-react-native-svg/-/babel-plugin-transform-react-native-svg-8.1.0.tgz#/@svgr-babel-plugin-transform-react-native-svg-8.1.0.tgz -Source10156: https://registry.npmjs.org/@svgr/babel-plugin-transform-svg-component/-/babel-plugin-transform-svg-component-8.0.0.tgz#/@svgr-babel-plugin-transform-svg-component-8.0.0.tgz -Source10157: https://registry.npmjs.org/@svgr/babel-preset/-/babel-preset-8.1.0.tgz#/@svgr-babel-preset-8.1.0.tgz -Source10158: https://registry.npmjs.org/@svgr/core/-/core-8.1.0.tgz#/@svgr-core-8.1.0.tgz -Source10159: https://registry.npmjs.org/@svgr/hast-util-to-babel-ast/-/hast-util-to-babel-ast-8.0.0.tgz#/@svgr-hast-util-to-babel-ast-8.0.0.tgz -Source10160: https://registry.npmjs.org/@svgr/plugin-jsx/-/plugin-jsx-8.1.0.tgz#/@svgr-plugin-jsx-8.1.0.tgz -Source10161: https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.3.tgz#/@tailwindcss-node-4.3.3.tgz -Source10162: https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.3.tgz#/@tailwindcss-oxide-4.3.3.tgz -Source10163: https://registry.npmjs.org/@tailwindcss/typography/-/typography-0.5.20.tgz#/@tailwindcss-typography-0.5.20.tgz -Source10164: https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.3.tgz#/@tailwindcss-vite-4.3.3.tgz -Source10165: https://registry.npmjs.org/@tanstack/eslint-plugin-router/-/eslint-plugin-router-1.162.0.tgz#/@tanstack-eslint-plugin-router-1.162.0.tgz -Source10166: https://registry.npmjs.org/@tanstack/history/-/history-1.162.4.tgz#/@tanstack-history-1.162.4.tgz -Source10167: https://registry.npmjs.org/@tanstack/react-router/-/react-router-1.170.36.tgz#/@tanstack-react-router-1.170.36.tgz -Source10168: https://registry.npmjs.org/@tanstack/react-store/-/react-store-0.11.1.tgz#/@tanstack-react-store-0.11.1.tgz -Source10169: https://registry.npmjs.org/@tanstack/router-core/-/router-core-1.171.30.tgz#/@tanstack-router-core-1.171.30.tgz -Source10170: https://registry.npmjs.org/@tanstack/router-generator/-/router-generator-1.167.36.tgz#/@tanstack-router-generator-1.167.36.tgz -Source10171: https://registry.npmjs.org/@tanstack/router-plugin/-/router-plugin-1.168.38.tgz#/@tanstack-router-plugin-1.168.38.tgz -Source10172: https://registry.npmjs.org/@tanstack/router-utils/-/router-utils-1.162.3.tgz#/@tanstack-router-utils-1.162.3.tgz -Source10173: https://registry.npmjs.org/@tanstack/store/-/store-0.11.1.tgz#/@tanstack-store-0.11.1.tgz -Source10174: https://registry.npmjs.org/@tanstack/virtual-file-routes/-/virtual-file-routes-1.162.0.tgz#/@tanstack-virtual-file-routes-1.162.0.tgz -Source10175: https://registry.npmjs.org/@testing-library/dom/-/dom-10.4.1.tgz#/@testing-library-dom-10.4.1.tgz -Source10176: https://registry.npmjs.org/@testing-library/jest-dom/-/jest-dom-6.9.1.tgz#/@testing-library-jest-dom-6.9.1.tgz -Source10177: https://registry.npmjs.org/@testing-library/jest-dom/-/jest-dom-7.0.1.tgz#/@testing-library-jest-dom-7.0.1.tgz -Source10178: https://registry.npmjs.org/@testing-library/react/-/react-16.3.3.tgz#/@testing-library-react-16.3.3.tgz -Source10179: https://registry.npmjs.org/@testing-library/user-event/-/user-event-14.6.7.tgz#/@testing-library-user-event-14.6.7.tgz -Source10180: https://registry.npmjs.org/@ts-morph/common/-/common-0.27.0.tgz#/@ts-morph-common-0.27.0.tgz -Source10181: https://registry.npmjs.org/@tsconfig/strictest/-/strictest-2.0.8.tgz#/@tsconfig-strictest-2.0.8.tgz -Source10182: https://registry.npmjs.org/@tsconfig/vite-react/-/vite-react-8.1.1.tgz#/@tsconfig-vite-react-8.1.1.tgz -Source10183: https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.4.tgz#/@tybys-wasm-util-0.10.4.tgz -Source10184: https://registry.npmjs.org/@types/aria-query/-/aria-query-5.0.4.tgz#/@types-aria-query-5.0.4.tgz -Source10185: https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz#/@types-babel__core-7.20.5.tgz -Source10186: https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.27.0.tgz#/@types-babel__generator-7.27.0.tgz -Source10187: https://registry.npmjs.org/@types/babel__template/-/babel__template-7.4.4.tgz#/@types-babel__template-7.4.4.tgz -Source10188: https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.28.0.tgz#/@types-babel__traverse-7.28.0.tgz -Source10189: https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz#/@types-chai-5.2.3.tgz -Source10190: https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz#/@types-debug-4.1.13.tgz -Source10191: https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz#/@types-deep-eql-4.0.2.tgz -Source10192: https://registry.npmjs.org/@types/doctrine/-/doctrine-0.0.9.tgz#/@types-doctrine-0.0.9.tgz -Source10193: https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz#/@types-estree-1.0.9.tgz -Source10194: https://registry.npmjs.org/@types/estree-jsx/-/estree-jsx-1.0.5.tgz#/@types-estree-jsx-1.0.5.tgz -Source10195: https://registry.npmjs.org/@types/hast/-/hast-3.0.5.tgz#/@types-hast-3.0.5.tgz -Source10196: https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz#/@types-mdast-4.0.4.tgz -Source10197: https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz#/@types-ms-2.1.0.tgz -Source10198: https://registry.npmjs.org/@types/node/-/node-22.20.2.tgz#/@types-node-22.20.2.tgz -Source10199: https://registry.npmjs.org/@types/react/-/react-19.3.0.tgz#/@types-react-19.3.0.tgz -Source10200: https://registry.npmjs.org/@types/react-dom/-/react-dom-19.3.0.tgz#/@types-react-dom-19.3.0.tgz -Source10201: https://registry.npmjs.org/@types/resolve/-/resolve-1.20.6.tgz#/@types-resolve-1.20.6.tgz -Source10202: https://registry.npmjs.org/@types/unist/-/unist-2.0.11.tgz#/@types-unist-2.0.11.tgz -Source10203: https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz#/@types-unist-3.0.3.tgz -Source10204: https://registry.npmjs.org/@types/validate-npm-package-name/-/validate-npm-package-name-4.0.2.tgz#/@types-validate-npm-package-name-4.0.2.tgz -Source10205: https://registry.npmjs.org/@types/whatwg-mimetype/-/whatwg-mimetype-3.0.2.tgz#/@types-whatwg-mimetype-3.0.2.tgz -Source10206: https://registry.npmjs.org/@types/ws/-/ws-8.18.1.tgz#/@types-ws-8.18.1.tgz -Source10207: https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.70.0.tgz#/@typescript-eslint-project-service-8.70.0.tgz -Source10208: https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.70.0.tgz#/@typescript-eslint-scope-manager-8.70.0.tgz -Source10209: https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.70.0.tgz#/@typescript-eslint-tsconfig-utils-8.70.0.tgz -Source10210: https://registry.npmjs.org/@typescript-eslint/types/-/types-8.70.0.tgz#/@typescript-eslint-types-8.70.0.tgz -Source10211: https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.70.0.tgz#/@typescript-eslint-typescript-estree-8.70.0.tgz -Source10212: https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.70.0.tgz#/@typescript-eslint-utils-8.70.0.tgz -Source10213: https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.70.0.tgz#/@typescript-eslint-visitor-keys-8.70.0.tgz -Source10214: https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.0.tgz#/@ungap-structured-clone-1.3.0.tgz -Source10215: https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.1.1.tgz#/@vitejs-plugin-react-6.1.1.tgz -Source10216: https://registry.npmjs.org/@vitest/browser/-/browser-4.1.11.tgz#/@vitest-browser-4.1.11.tgz -Source10217: https://registry.npmjs.org/@vitest/browser-playwright/-/browser-playwright-4.1.11.tgz#/@vitest-browser-playwright-4.1.11.tgz -Source10218: https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.11.tgz#/@vitest-coverage-v8-4.1.11.tgz -Source10219: https://registry.npmjs.org/@vitest/expect/-/expect-3.2.4.tgz#/@vitest-expect-3.2.4.tgz -Source10220: https://registry.npmjs.org/@vitest/expect/-/expect-4.1.11.tgz#/@vitest-expect-4.1.11.tgz -Source10221: https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.11.tgz#/@vitest-mocker-4.1.11.tgz -Source10222: https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-3.2.4.tgz#/@vitest-pretty-format-3.2.4.tgz -Source10223: https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.11.tgz#/@vitest-pretty-format-4.1.11.tgz -Source10224: https://registry.npmjs.org/@vitest/runner/-/runner-4.1.11.tgz#/@vitest-runner-4.1.11.tgz -Source10225: https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.11.tgz#/@vitest-snapshot-4.1.11.tgz -Source10226: https://registry.npmjs.org/@vitest/spy/-/spy-3.2.4.tgz#/@vitest-spy-3.2.4.tgz -Source10227: https://registry.npmjs.org/@vitest/spy/-/spy-4.1.11.tgz#/@vitest-spy-4.1.11.tgz -Source10228: https://registry.npmjs.org/@vitest/ui/-/ui-4.1.11.tgz#/@vitest-ui-4.1.11.tgz -Source10229: https://registry.npmjs.org/@vitest/utils/-/utils-3.2.4.tgz#/@vitest-utils-3.2.4.tgz -Source10230: https://registry.npmjs.org/@vitest/utils/-/utils-4.1.11.tgz#/@vitest-utils-4.1.11.tgz -Source10231: https://registry.npmjs.org/@webcontainer/env/-/env-1.1.1.tgz#/@webcontainer-env-1.1.1.tgz -Source10232: https://registry.npmjs.org/@whatwg-node/disposablestack/-/disposablestack-0.0.6.tgz#/@whatwg-node-disposablestack-0.0.6.tgz -Source10233: https://registry.npmjs.org/@whatwg-node/fetch/-/fetch-0.10.13.tgz#/@whatwg-node-fetch-0.10.13.tgz -Source10234: https://registry.npmjs.org/@whatwg-node/node-fetch/-/node-fetch-0.8.6.tgz#/@whatwg-node-node-fetch-0.8.6.tgz -Source10235: https://registry.npmjs.org/@whatwg-node/promise-helpers/-/promise-helpers-1.3.2.tgz#/@whatwg-node-promise-helpers-1.3.2.tgz +Source10090: https://registry.npmjs.org/@graphql-tools/utils/-/utils-12.0.2.tgz#/@graphql-tools-utils-12.0.2.tgz +Source10091: https://registry.npmjs.org/@graphql-tools/wrap/-/wrap-11.2.0.tgz#/@graphql-tools-wrap-11.2.0.tgz +Source10092: https://registry.npmjs.org/@graphql-typed-document-node/core/-/core-3.2.0.tgz#/@graphql-typed-document-node-core-3.2.0.tgz +Source10093: https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.1.tgz#/@hono-node-server-2.1.1.tgz +Source10094: https://registry.npmjs.org/@inquirer/ansi/-/ansi-2.0.8.tgz#/@inquirer-ansi-2.0.8.tgz +Source10095: https://registry.npmjs.org/@inquirer/checkbox/-/checkbox-5.2.5.tgz#/@inquirer-checkbox-5.2.5.tgz +Source10096: https://registry.npmjs.org/@inquirer/confirm/-/confirm-6.3.2.tgz#/@inquirer-confirm-6.3.2.tgz +Source10097: https://registry.npmjs.org/@inquirer/core/-/core-12.0.3.tgz#/@inquirer-core-12.0.3.tgz +Source10098: https://registry.npmjs.org/@inquirer/editor/-/editor-5.3.3.tgz#/@inquirer-editor-5.3.3.tgz +Source10099: https://registry.npmjs.org/@inquirer/expand/-/expand-5.1.5.tgz#/@inquirer-expand-5.1.5.tgz +Source10100: https://registry.npmjs.org/@inquirer/external-editor/-/external-editor-3.0.5.tgz#/@inquirer-external-editor-3.0.5.tgz +Source10101: https://registry.npmjs.org/@inquirer/figures/-/figures-2.0.9.tgz#/@inquirer-figures-2.0.9.tgz +Source10102: https://registry.npmjs.org/@inquirer/input/-/input-5.1.6.tgz#/@inquirer-input-5.1.6.tgz +Source10103: https://registry.npmjs.org/@inquirer/number/-/number-4.2.3.tgz#/@inquirer-number-4.2.3.tgz +Source10104: https://registry.npmjs.org/@inquirer/password/-/password-5.2.2.tgz#/@inquirer-password-5.2.2.tgz +Source10105: https://registry.npmjs.org/@inquirer/prompts/-/prompts-8.7.2.tgz#/@inquirer-prompts-8.7.2.tgz +Source10106: https://registry.npmjs.org/@inquirer/rawlist/-/rawlist-5.3.5.tgz#/@inquirer-rawlist-5.3.5.tgz +Source10107: https://registry.npmjs.org/@inquirer/search/-/search-4.3.3.tgz#/@inquirer-search-4.3.3.tgz +Source10108: https://registry.npmjs.org/@inquirer/select/-/select-5.2.5.tgz#/@inquirer-select-5.2.5.tgz +Source10109: https://registry.npmjs.org/@inquirer/type/-/type-4.1.1.tgz#/@inquirer-type-4.1.1.tgz +Source10110: https://registry.npmjs.org/@joshwooding/vite-plugin-react-docgen-typescript/-/vite-plugin-react-docgen-typescript-0.7.0.tgz#/@joshwooding-vite-plugin-react-docgen-typescript-0.7.0.tgz +Source10111: https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz#/@jridgewell-gen-mapping-0.3.13.tgz +Source10112: https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz#/@jridgewell-remapping-2.3.5.tgz +Source10113: https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz#/@jridgewell-resolve-uri-3.1.2.tgz +Source10114: https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz#/@jridgewell-sourcemap-codec-1.6.0.tgz +Source10115: https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz#/@jridgewell-trace-mapping-0.3.31.tgz +Source10116: https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz#/@modelcontextprotocol-sdk-1.30.0.tgz +Source10117: https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.4.tgz#/@napi-rs-wasm-runtime-1.2.4.tgz +Source10118: https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz#/@nodelib-fs.scandir-2.1.5.tgz +Source10119: https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz#/@nodelib-fs.stat-2.0.5.tgz +Source10120: https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz#/@nodelib-fs.walk-1.2.8.tgz +Source10121: https://registry.npmjs.org/@oxc-project/types/-/types-0.127.0.tgz#/@oxc-project-types-0.127.0.tgz +Source10122: https://registry.npmjs.org/@oxc-project/types/-/types-0.149.0.tgz#/@oxc-project-types-0.149.0.tgz +Source10123: https://registry.npmjs.org/@polka/url/-/url-1.0.0-next.29.tgz#/@polka-url-1.0.0-next.29.tgz +Source10124: https://registry.npmjs.org/@repeaterjs/repeater/-/repeater-3.1.0.tgz#/@repeaterjs-repeater-3.1.0.tgz +Source10125: https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz#/@rolldown-pluginutils-1.0.1.tgz +Source10126: https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-5.4.0.tgz#/@rollup-pluginutils-5.4.0.tgz +Source10127: https://registry.npmjs.org/@sec-ant/readable-stream/-/readable-stream-0.4.1.tgz#/@sec-ant-readable-stream-0.4.1.tgz +Source10128: https://registry.npmjs.org/@shikijs/core/-/core-4.4.3.tgz#/@shikijs-core-4.4.3.tgz +Source10129: https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.4.3.tgz#/@shikijs-engine-javascript-4.4.3.tgz +Source10130: https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.4.3.tgz#/@shikijs-engine-oniguruma-4.4.3.tgz +Source10131: https://registry.npmjs.org/@shikijs/langs/-/langs-4.4.3.tgz#/@shikijs-langs-4.4.3.tgz +Source10132: https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.4.3.tgz#/@shikijs-primitive-4.4.3.tgz +Source10133: https://registry.npmjs.org/@shikijs/rehype/-/rehype-4.4.3.tgz#/@shikijs-rehype-4.4.3.tgz +Source10134: https://registry.npmjs.org/@shikijs/themes/-/themes-4.4.3.tgz#/@shikijs-themes-4.4.3.tgz +Source10135: https://registry.npmjs.org/@shikijs/types/-/types-4.4.3.tgz#/@shikijs-types-4.4.3.tgz +Source10136: https://registry.npmjs.org/@shikijs/vscode-textmate/-/vscode-textmate-10.0.2.tgz#/@shikijs-vscode-textmate-10.0.2.tgz +Source10137: https://registry.npmjs.org/@sindresorhus/is/-/is-4.6.0.tgz#/@sindresorhus-is-4.6.0.tgz +Source10138: https://registry.npmjs.org/@sindresorhus/merge-streams/-/merge-streams-4.0.0.tgz#/@sindresorhus-merge-streams-4.0.0.tgz +Source10139: https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz#/@standard-schema-spec-1.1.0.tgz +Source10140: https://registry.npmjs.org/@storybook/addon-a11y/-/addon-a11y-10.6.0.tgz#/@storybook-addon-a11y-10.6.0.tgz +Source10141: https://registry.npmjs.org/@storybook/addon-vitest/-/addon-vitest-10.6.0.tgz#/@storybook-addon-vitest-10.6.0.tgz +Source10142: https://registry.npmjs.org/@storybook/builder-vite/-/builder-vite-10.6.0.tgz#/@storybook-builder-vite-10.6.0.tgz +Source10143: https://registry.npmjs.org/@storybook/global/-/global-5.0.0.tgz#/@storybook-global-5.0.0.tgz +Source10144: https://registry.npmjs.org/@storybook/icons/-/icons-2.1.0.tgz#/@storybook-icons-2.1.0.tgz +Source10145: https://registry.npmjs.org/@storybook/react/-/react-10.6.0.tgz#/@storybook-react-10.6.0.tgz +Source10146: https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.6.0.tgz#/@storybook-react-dom-shim-10.6.0.tgz +Source10147: https://registry.npmjs.org/@storybook/react-vite/-/react-vite-10.6.0.tgz#/@storybook-react-vite-10.6.0.tgz +Source10148: https://registry.npmjs.org/@svgr/babel-plugin-add-jsx-attribute/-/babel-plugin-add-jsx-attribute-8.0.0.tgz#/@svgr-babel-plugin-add-jsx-attribute-8.0.0.tgz +Source10149: https://registry.npmjs.org/@svgr/babel-plugin-remove-jsx-attribute/-/babel-plugin-remove-jsx-attribute-8.0.0.tgz#/@svgr-babel-plugin-remove-jsx-attribute-8.0.0.tgz +Source10150: https://registry.npmjs.org/@svgr/babel-plugin-remove-jsx-empty-expression/-/babel-plugin-remove-jsx-empty-expression-8.0.0.tgz#/@svgr-babel-plugin-remove-jsx-empty-expression-8.0.0.tgz +Source10151: https://registry.npmjs.org/@svgr/babel-plugin-replace-jsx-attribute-value/-/babel-plugin-replace-jsx-attribute-value-8.0.0.tgz#/@svgr-babel-plugin-replace-jsx-attribute-value-8.0.0.tgz +Source10152: https://registry.npmjs.org/@svgr/babel-plugin-svg-dynamic-title/-/babel-plugin-svg-dynamic-title-8.0.0.tgz#/@svgr-babel-plugin-svg-dynamic-title-8.0.0.tgz +Source10153: https://registry.npmjs.org/@svgr/babel-plugin-svg-em-dimensions/-/babel-plugin-svg-em-dimensions-8.0.0.tgz#/@svgr-babel-plugin-svg-em-dimensions-8.0.0.tgz +Source10154: https://registry.npmjs.org/@svgr/babel-plugin-transform-react-native-svg/-/babel-plugin-transform-react-native-svg-8.1.0.tgz#/@svgr-babel-plugin-transform-react-native-svg-8.1.0.tgz +Source10155: https://registry.npmjs.org/@svgr/babel-plugin-transform-svg-component/-/babel-plugin-transform-svg-component-8.0.0.tgz#/@svgr-babel-plugin-transform-svg-component-8.0.0.tgz +Source10156: https://registry.npmjs.org/@svgr/babel-preset/-/babel-preset-8.1.0.tgz#/@svgr-babel-preset-8.1.0.tgz +Source10157: https://registry.npmjs.org/@svgr/core/-/core-8.1.0.tgz#/@svgr-core-8.1.0.tgz +Source10158: https://registry.npmjs.org/@svgr/hast-util-to-babel-ast/-/hast-util-to-babel-ast-8.0.0.tgz#/@svgr-hast-util-to-babel-ast-8.0.0.tgz +Source10159: https://registry.npmjs.org/@svgr/plugin-jsx/-/plugin-jsx-8.1.0.tgz#/@svgr-plugin-jsx-8.1.0.tgz +Source10160: https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.3.tgz#/@tailwindcss-node-4.3.3.tgz +Source10161: https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.3.tgz#/@tailwindcss-oxide-4.3.3.tgz +Source10162: https://registry.npmjs.org/@tailwindcss/typography/-/typography-0.5.20.tgz#/@tailwindcss-typography-0.5.20.tgz +Source10163: https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.3.tgz#/@tailwindcss-vite-4.3.3.tgz +Source10164: https://registry.npmjs.org/@tanstack/eslint-plugin-router/-/eslint-plugin-router-1.162.0.tgz#/@tanstack-eslint-plugin-router-1.162.0.tgz +Source10165: https://registry.npmjs.org/@tanstack/history/-/history-1.162.4.tgz#/@tanstack-history-1.162.4.tgz +Source10166: https://registry.npmjs.org/@tanstack/react-router/-/react-router-1.170.36.tgz#/@tanstack-react-router-1.170.36.tgz +Source10167: https://registry.npmjs.org/@tanstack/react-store/-/react-store-0.11.1.tgz#/@tanstack-react-store-0.11.1.tgz +Source10168: https://registry.npmjs.org/@tanstack/router-core/-/router-core-1.171.30.tgz#/@tanstack-router-core-1.171.30.tgz +Source10169: https://registry.npmjs.org/@tanstack/router-generator/-/router-generator-1.167.36.tgz#/@tanstack-router-generator-1.167.36.tgz +Source10170: https://registry.npmjs.org/@tanstack/router-plugin/-/router-plugin-1.168.38.tgz#/@tanstack-router-plugin-1.168.38.tgz +Source10171: https://registry.npmjs.org/@tanstack/router-utils/-/router-utils-1.162.3.tgz#/@tanstack-router-utils-1.162.3.tgz +Source10172: https://registry.npmjs.org/@tanstack/store/-/store-0.11.1.tgz#/@tanstack-store-0.11.1.tgz +Source10173: https://registry.npmjs.org/@tanstack/virtual-file-routes/-/virtual-file-routes-1.162.0.tgz#/@tanstack-virtual-file-routes-1.162.0.tgz +Source10174: https://registry.npmjs.org/@testing-library/dom/-/dom-10.4.1.tgz#/@testing-library-dom-10.4.1.tgz +Source10175: https://registry.npmjs.org/@testing-library/jest-dom/-/jest-dom-6.9.1.tgz#/@testing-library-jest-dom-6.9.1.tgz +Source10176: https://registry.npmjs.org/@testing-library/jest-dom/-/jest-dom-7.0.1.tgz#/@testing-library-jest-dom-7.0.1.tgz +Source10177: https://registry.npmjs.org/@testing-library/react/-/react-16.3.3.tgz#/@testing-library-react-16.3.3.tgz +Source10178: https://registry.npmjs.org/@testing-library/user-event/-/user-event-14.6.7.tgz#/@testing-library-user-event-14.6.7.tgz +Source10179: https://registry.npmjs.org/@ts-morph/common/-/common-0.27.0.tgz#/@ts-morph-common-0.27.0.tgz +Source10180: https://registry.npmjs.org/@tsconfig/strictest/-/strictest-2.0.8.tgz#/@tsconfig-strictest-2.0.8.tgz +Source10181: https://registry.npmjs.org/@tsconfig/vite-react/-/vite-react-8.1.1.tgz#/@tsconfig-vite-react-8.1.1.tgz +Source10182: https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.4.tgz#/@tybys-wasm-util-0.10.4.tgz +Source10183: https://registry.npmjs.org/@types/aria-query/-/aria-query-5.0.4.tgz#/@types-aria-query-5.0.4.tgz +Source10184: https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz#/@types-babel__core-7.20.5.tgz +Source10185: https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.27.0.tgz#/@types-babel__generator-7.27.0.tgz +Source10186: https://registry.npmjs.org/@types/babel__template/-/babel__template-7.4.4.tgz#/@types-babel__template-7.4.4.tgz +Source10187: https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.28.0.tgz#/@types-babel__traverse-7.28.0.tgz +Source10188: https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz#/@types-chai-5.2.3.tgz +Source10189: https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz#/@types-debug-4.1.13.tgz +Source10190: https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz#/@types-deep-eql-4.0.2.tgz +Source10191: https://registry.npmjs.org/@types/doctrine/-/doctrine-0.0.9.tgz#/@types-doctrine-0.0.9.tgz +Source10192: https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz#/@types-estree-1.0.9.tgz +Source10193: https://registry.npmjs.org/@types/estree-jsx/-/estree-jsx-1.0.5.tgz#/@types-estree-jsx-1.0.5.tgz +Source10194: https://registry.npmjs.org/@types/hast/-/hast-3.0.5.tgz#/@types-hast-3.0.5.tgz +Source10195: https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz#/@types-mdast-4.0.4.tgz +Source10196: https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz#/@types-ms-2.1.0.tgz +Source10197: https://registry.npmjs.org/@types/node/-/node-22.20.2.tgz#/@types-node-22.20.2.tgz +Source10198: https://registry.npmjs.org/@types/react/-/react-19.3.0.tgz#/@types-react-19.3.0.tgz +Source10199: https://registry.npmjs.org/@types/react-dom/-/react-dom-19.3.0.tgz#/@types-react-dom-19.3.0.tgz +Source10200: https://registry.npmjs.org/@types/resolve/-/resolve-1.20.6.tgz#/@types-resolve-1.20.6.tgz +Source10201: https://registry.npmjs.org/@types/unist/-/unist-2.0.11.tgz#/@types-unist-2.0.11.tgz +Source10202: https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz#/@types-unist-3.0.3.tgz +Source10203: https://registry.npmjs.org/@types/validate-npm-package-name/-/validate-npm-package-name-4.0.2.tgz#/@types-validate-npm-package-name-4.0.2.tgz +Source10204: https://registry.npmjs.org/@types/whatwg-mimetype/-/whatwg-mimetype-3.0.2.tgz#/@types-whatwg-mimetype-3.0.2.tgz +Source10205: https://registry.npmjs.org/@types/ws/-/ws-8.18.1.tgz#/@types-ws-8.18.1.tgz +Source10206: https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.70.0.tgz#/@typescript-eslint-project-service-8.70.0.tgz +Source10207: https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.70.0.tgz#/@typescript-eslint-scope-manager-8.70.0.tgz +Source10208: https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.70.0.tgz#/@typescript-eslint-tsconfig-utils-8.70.0.tgz +Source10209: https://registry.npmjs.org/@typescript-eslint/types/-/types-8.70.0.tgz#/@typescript-eslint-types-8.70.0.tgz +Source10210: https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.70.0.tgz#/@typescript-eslint-typescript-estree-8.70.0.tgz +Source10211: https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.70.0.tgz#/@typescript-eslint-utils-8.70.0.tgz +Source10212: https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.70.0.tgz#/@typescript-eslint-visitor-keys-8.70.0.tgz +Source10213: https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.0.tgz#/@ungap-structured-clone-1.3.0.tgz +Source10214: https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.1.1.tgz#/@vitejs-plugin-react-6.1.1.tgz +Source10215: https://registry.npmjs.org/@vitest/browser/-/browser-4.1.11.tgz#/@vitest-browser-4.1.11.tgz +Source10216: https://registry.npmjs.org/@vitest/browser-playwright/-/browser-playwright-4.1.11.tgz#/@vitest-browser-playwright-4.1.11.tgz +Source10217: https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.11.tgz#/@vitest-coverage-v8-4.1.11.tgz +Source10218: https://registry.npmjs.org/@vitest/expect/-/expect-3.2.4.tgz#/@vitest-expect-3.2.4.tgz +Source10219: https://registry.npmjs.org/@vitest/expect/-/expect-4.1.11.tgz#/@vitest-expect-4.1.11.tgz +Source10220: https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.11.tgz#/@vitest-mocker-4.1.11.tgz +Source10221: https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-3.2.4.tgz#/@vitest-pretty-format-3.2.4.tgz +Source10222: https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.11.tgz#/@vitest-pretty-format-4.1.11.tgz +Source10223: https://registry.npmjs.org/@vitest/runner/-/runner-4.1.11.tgz#/@vitest-runner-4.1.11.tgz +Source10224: https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.11.tgz#/@vitest-snapshot-4.1.11.tgz +Source10225: https://registry.npmjs.org/@vitest/spy/-/spy-3.2.4.tgz#/@vitest-spy-3.2.4.tgz +Source10226: https://registry.npmjs.org/@vitest/spy/-/spy-4.1.11.tgz#/@vitest-spy-4.1.11.tgz +Source10227: https://registry.npmjs.org/@vitest/ui/-/ui-4.1.11.tgz#/@vitest-ui-4.1.11.tgz +Source10228: https://registry.npmjs.org/@vitest/utils/-/utils-3.2.4.tgz#/@vitest-utils-3.2.4.tgz +Source10229: https://registry.npmjs.org/@vitest/utils/-/utils-4.1.11.tgz#/@vitest-utils-4.1.11.tgz +Source10230: https://registry.npmjs.org/@webcontainer/env/-/env-1.1.1.tgz#/@webcontainer-env-1.1.1.tgz +Source10231: https://registry.npmjs.org/@whatwg-node/disposablestack/-/disposablestack-0.0.6.tgz#/@whatwg-node-disposablestack-0.0.6.tgz +Source10232: https://registry.npmjs.org/@whatwg-node/fetch/-/fetch-0.10.13.tgz#/@whatwg-node-fetch-0.10.13.tgz +Source10233: https://registry.npmjs.org/@whatwg-node/node-fetch/-/node-fetch-0.8.6.tgz#/@whatwg-node-node-fetch-0.8.6.tgz +Source10234: https://registry.npmjs.org/@whatwg-node/promise-helpers/-/promise-helpers-1.3.2.tgz#/@whatwg-node-promise-helpers-1.3.2.tgz +Source10235: https://registry.npmjs.org/@whatwg-node/promise-helpers/-/promise-helpers-2.0.1.tgz#/@whatwg-node-promise-helpers-2.0.1.tgz Source10236: https://registry.npmjs.org/@wry/caches/-/caches-1.0.1.tgz#/@wry-caches-1.0.1.tgz Source10237: https://registry.npmjs.org/@wry/context/-/context-0.7.4.tgz#/@wry-context-0.7.4.tgz Source10238: https://registry.npmjs.org/@wry/equality/-/equality-0.5.7.tgz#/@wry-equality-0.5.7.tgz @@ -263,7 +263,7 @@ Source10262: https://registry.npmjs.org/bail/-/bail-2.0.2.tgz#/bail-2.0.2.tgz Source10263: https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz#/balanced-match-4.0.4.tgz Source10264: https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.23.tgz#/baseline-browser-mapping-2.11.23.tgz -Source10265: https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz#/body-parser-2.3.0.tgz +Source10265: https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz#/body-parser-2.4.0.tgz Source10266: https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz#/brace-expansion-5.0.9.tgz Source10267: https://registry.npmjs.org/braces/-/braces-3.0.3.tgz#/braces-3.0.3.tgz Source10268: https://registry.npmjs.org/browserslist/-/browserslist-4.28.9.tgz#/browserslist-4.28.9.tgz @@ -674,7 +674,7 @@ Source10673: https://registry.npmjs.org/prompts/-/prompts-2.4.2.tgz#/prompts-2.4.2.tgz Source10674: https://registry.npmjs.org/property-information/-/property-information-7.2.0.tgz#/property-information-7.2.0.tgz Source10675: https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz#/proxy-addr-2.0.7.tgz -Source10676: https://registry.npmjs.org/qs/-/qs-6.16.1.tgz#/qs-6.16.1.tgz +Source10676: https://registry.npmjs.org/qs/-/qs-6.17.0.tgz#/qs-6.17.0.tgz Source10677: https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz#/queue-microtask-1.2.3.tgz Source10678: https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz#/range-parser-1.3.0.tgz Source10679: https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz#/raw-body-3.0.2.tgz ++++++ package-lock.json ++++++ --- /var/tmp/diff_new_pack.I9lElT/_old 2026-11-05 18:24:31.028201243 +0100 +++ /var/tmp/diff_new_pack.I9lElT/_new 2026-11-05 18:24:31.033201451 +0100 @@ -1654,24 +1654,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/apollo-engine-loader/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/batch-execute": { "version": "10.2.0", "integrity": "sha512-lXz9fGum2shGKMMU7zmt0mXHUFo/KbPzHpv/Qzb2/MrJUYDNfWCKPPpiJi0e4uS09xmuafub02VPH2IZfFlGJw==", @@ -1690,24 +1672,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/batch-execute/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/code-file-loader": { "version": "8.1.39", "integrity": "sha512-9hPTdcF1qEkS7C6DJmrSM25G5BiY0yLajTfrtVW7VQppDHqIU8Uyi8DPVwtDDmOZ2o9fYQKwd5tIL1csrjmyBA==", @@ -1727,24 +1691,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/code-file-loader/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/delegate": { "version": "12.2.0", "integrity": "sha512-WKLTBY8p/P0Q1f5ILlFw+7NMQyHaKQxuEemFw5pHYTPmIYDDFt/P8/D8rwSrNe6yu//EktyouwU8u0fNVRtXVA==", @@ -1767,24 +1713,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/delegate/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/documents": { "version": "1.0.2", "integrity": "sha512-l/0r+E0857uSa0zr70qFxzV7SiqGVWbR8KwxLyynENmIeHw6JpChUpYmp2cSUjrUZ9aRMlZ8X01utcsZFeiBFg==", @@ -1836,24 +1764,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/executor-common/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/executor-graphql-ws": { "version": "3.2.0", "integrity": "sha512-Yi84qS3C77BIy0YJw1+nHJ+GAI4bTzHaCWLW1j/9PpHUqmlp32iMxPQOdI7QrXke+pBkIl03aMxyZpmZ/jDidA==", @@ -1875,24 +1785,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/executor-graphql-ws/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/executor-http": { "version": "3.4.1", "integrity": "sha512-OcIfgG/F8ysubB20PCf9SiCcxkwMOd8n9GmnpwpYhU7s/DDF13Ady969dPzRzAsgjNWjSS5DqzvVN8e2OphtiA==", @@ -1916,24 +1808,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/executor-http/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/executor-legacy-ws": { "version": "1.1.35", "integrity": "sha512-9wV6p+b6lagujNCcBMRvWcWO/6ZpANt1uMe0ST60/zTxQa+9GZ/pMR/Q9wsGeOorQ+0PNnOkt8GB8mtd4o9Bow==", @@ -1953,42 +1827,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/executor-legacy-ws/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, - "node_modules/@graphql-tools/executor/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/git-loader": { "version": "8.0.42", "integrity": "sha512-1goUoV8vSrnKez93lseg9da1zQ8b7L16Z6p/i7vYM5JHjEpl1pfFH9qJmg6D6uZmB/X56P8o+evb5vPW2Ak1AQ==", @@ -2009,24 +1847,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/git-loader/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/github-loader": { "version": "9.1.8", "integrity": "sha512-2MUWGQ3aEjb1hQjWLlH16KENNZlhFNtX5qFZcWtUtwYADF4LQXIRniZTqrGXbi8+llTrdrrggF0KTNJ9u9P9Bw==", @@ -2048,24 +1868,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/github-loader/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/graphql-file-loader": { "version": "8.1.20", "integrity": "sha512-XIdIfbwrXMYEvWZL6LKqELCDuq2zimVeNGdY4rT/Xb68Jmptp7eqkLUGrPv/zBs0prSUmFgkT+padqihJhD8jg==", @@ -2085,24 +1887,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/graphql-file-loader/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/graphql-tag-pluck": { "version": "8.3.37", "integrity": "sha512-pTKex/pmHH+MjNEtzFAKhksM8S6qL+60kssc2/DurcaQmQn6Tkt/yRHe90JNAJsRHNXxhlqZRl8iAI8bIAMuXQ==", @@ -2123,24 +1907,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/graphql-tag-pluck/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/import": { "version": "7.2.0", "integrity": "sha512-U0Y4CDTHgQWedgvGNHGQ/IPSW43hku5y11s24WP0OTYObWZ92lHr8RFL4Pw+YQgFZJIEvbhTG35054UVtiKuww==", @@ -2158,24 +1924,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/import/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/json-file-loader": { "version": "8.0.34", "integrity": "sha512-EIxXypzuAM7WkiK9VMk1v+UZQ9PAKa1YkIh1RSZRqQWMXcFpxMDtaBANY+1b93RCJ2ZJI2R/vW190kRLcLV0Cw==", @@ -2194,24 +1942,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/json-file-loader/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/load": { "version": "8.1.17", "integrity": "sha512-ZRmA/B2FjB1+qhh1Dok29fr9m+9abnmpI5I3CphyuO6P1equ4V1rL+Z1QCvf2ElAvSuPxHZZTlQbVvD7ZKMKLw==", @@ -2230,24 +1960,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/load/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/merge": { "version": "9.2.4", "integrity": "sha512-vV+8uWNWn0+OsqT0r22lZuoT0cTe6fBqBtpLHre2rriLjI/ZTrsOHmabLPTUOyzgFnRrS2PzFSYGL3zKL1Wj4Q==", @@ -2264,24 +1976,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/merge/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/optimize": { "version": "2.0.1", "integrity": "sha512-I63H75wg7SD/+iPj+QdvZgvul0dxxf/el18Yiry5zmwKeqRvzcm6l2KUYRNgMR/ydytp0VuHw3XeyGhPWGigAg==", @@ -2314,24 +2008,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/relay-operation-optimizer/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/schema": { "version": "10.1.1", "integrity": "sha512-24jJghRxEW+SG1lbJ45Zg9HEZ8ZKS923ihbFjOicspFLpryxJkWp6gZJ7D8tCVaSAhli4x1+1wDPAfhT8mLqxg==", @@ -2349,24 +2025,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/schema/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-tools/url-loader": { "version": "9.1.9", "integrity": "sha512-8QDpG7M5EvQGMcODCqP44g/2wxrny4aYiyPlnPjcR+ioodaXGXUJJwlRxbGin8xUqb8u9H15lRc1jQqOSTe6xA==", @@ -2393,14 +2051,14 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/url-loader/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", + "node_modules/@graphql-tools/utils": { + "version": "12.0.2", + "integrity": "sha512-N1j6fG12Cq5HN4826NGNtGu8O65eLCO6nHbTTboa0GEB7c2Ym2kLGU3ewHrG9DR/coL09GQjREChSG0SjUuAGA==", "dev": true, "license": "MIT", "dependencies": { "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", + "@whatwg-node/promise-helpers": "^2.0.0", "cross-inspect": "1.0.1", "tslib": "^2.4.0" }, @@ -2411,22 +2069,16 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/utils": { - "version": "11.2.2", - "integrity": "sha512-Do2A/t6ayqOma8m7PvpYMsCBswL+NB35BQSng4GWSBqafL2/BnfAZy/NSENPwV721Rm2fG0BHETFC0+FJJZmLw==", + "node_modules/@graphql-tools/utils/node_modules/@whatwg-node/promise-helpers": { + "version": "2.0.1", + "integrity": "sha512-ziVgm01A9irPLVBaUFei64qp771BrDXldbv5pY6kgFgNtA+7zq8ux6nj/6w8bELGH/+Ttnc76ox04HIjU8nqvg==", "dev": true, "license": "MIT", "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" + "tslib": "^2.6.3" }, "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" + "node": ">=22.15.0" } }, "node_modules/@graphql-tools/wrap": { @@ -2448,24 +2100,6 @@ "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, - "node_modules/@graphql-tools/wrap/node_modules/@graphql-tools/utils": { - "version": "12.0.1", - "integrity": "sha512-8YC6jn4xYDS6YTY6xDAgQAs/nGgvzRaIGHS8GeSfVItQzNK7Ms24CQtE3EJY+amvR+tBnhRSX0N83aGj+V/RIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@graphql-typed-document-node/core": "^3.1.1", - "@whatwg-node/promise-helpers": "^1.0.0", - "cross-inspect": "1.0.1", - "tslib": "^2.4.0" - }, - "engines": { - "node": ">=16.0.0" - }, - "peerDependencies": { - "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" - } - }, "node_modules/@graphql-typed-document-node/core": { "version": "3.2.0", "integrity": "sha512-mB9oAsNCm9aM3/SOv4YtBMqZbYj10R7dkq8byBqxGY/ncFwhf2oQzMV+LCRlWoDSEBJ3COiR1yeDvMtsoOsuFQ==", @@ -7220,17 +6854,17 @@ } }, "node_modules/body-parser": { - "version": "2.3.0", - "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==", + "version": "2.4.0", + "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==", "license": "MIT", "dependencies": { "bytes": "^3.1.2", - "content-type": "^2.0.0", + "content-type": "^2.1.0", "debug": "^4.4.3", "http-errors": "^2.0.1", - "iconv-lite": "^0.7.2", + "iconv-lite": "^0.7.3", "on-finished": "^2.4.1", - "qs": "^6.15.2", + "qs": "^6.16.1", "raw-body": "^3.0.2", "type-is": "^2.1.0" }, @@ -12532,8 +12166,8 @@ } }, "node_modules/qs": { - "version": "6.16.1", - "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==", + "version": "6.17.0", + "integrity": "sha512-5LK5BZ2XDHMvcUJaf0CQ5HL3aVgKbpklvByC7qLSxYkfE8COEEbJg5xCHWCTqzqi0Gs4Jn5Mv5v3R38W6edscA==", "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1", ++++++ prepare-webui-lock.py ++++++ --- /var/tmp/diff_new_pack.I9lElT/_old 2026-11-05 18:24:31.067202866 +0100 +++ /var/tmp/diff_new_pack.I9lElT/_new 2026-11-05 18:24:31.078203323 +0100 @@ -31,6 +31,12 @@ NATIVE = runpy.run_path(str(Path(__file__).with_name("native-addons.py"))) Error = CONVERTER["ConversionError"] PLATFORM_FIELDS = ("os", "cpu", "libc") +SECURITY_OVERRIDES = { + "fast-uri": "3.1.9", + "qs": "6.17.0", + "body-parser": "2.4.0", + "@graphql-tools/utils": "12.0.2", +} def build_manifest(package, lock): @@ -203,6 +209,29 @@ server.wait() +def apply_security_inventory(inventory, reviewed): + """Validate and apply downstream reviewed security replacements to upstream inventory.""" + removed = { + "[email protected]", + "[email protected]", + "[email protected]", + "@graphql-tools/[email protected]", + "@graphql-tools/[email protected]", + } + added = { + "[email protected]", + "[email protected]", + "[email protected]", + "@graphql-tools/[email protected]", + "@whatwg-node/[email protected]", + } + if set(inventory) - set(reviewed) != removed or set(reviewed) - set(inventory) != added: + raise Error("Security inventory must only replace fast-uri, qs, body-parser, and @graphql-tools/utils") + if any(reviewed[key] != value for key, value in inventory.items() if key not in removed): + raise Error("Security inventory changed unrelated sources") + return reviewed + + def main(): parser = argparse.ArgumentParser(description=__doc__) parser.add_argument("--webui", type=Path, required=True) @@ -212,7 +241,7 @@ help="helper command; defaults to local-npm-registry") parser.add_argument("--timeout", type=int, default=180) parser.add_argument("--security-inventory", type=Path, - help="reviewed complete inventory with fast-uri/qs security updates " + help="reviewed complete inventory with downstream security updates " "(node-sources-full.json)") parser.add_argument("--_in-namespace", action="store_true", help=argparse.SUPPRESS) args = parser.parse_args() @@ -231,18 +260,12 @@ inventory = CONVERTER["convert"](lock) if args.security_inventory: reviewed = json.loads(args.security_inventory.read_text()) - removed = {"[email protected]", "[email protected]"} - added = {"[email protected]", "[email protected]"} - if set(inventory) - set(reviewed) != removed or set(reviewed) - set(inventory) != added: - raise Error("Security inventory must only replace fast-uri and qs") - if any(reviewed[key] != value for key, value in inventory.items() if key not in removed): - raise Error("Security inventory changed unrelated sources") - inventory = reviewed + inventory = apply_security_inventory(inventory, reviewed) tarballs = args.tarballs.resolve() CONVERTER["verify_downloads"](inventory, tarballs) manifest = build_manifest(json.loads((args.webui / "package.json").read_text()), lock) if args.security_inventory: - manifest["overrides"].update({"fast-uri": "3.1.9", "qs": "6.16.1"}) + manifest["overrides"].update(SECURITY_OVERRIDES) npm_lock = resolve(manifest, tarballs, args.registry_helper, args.timeout) unify = native_overrides(npm_lock) if unify: ++++++ test_prepare_webui_lock.py ++++++ --- /var/tmp/diff_new_pack.I9lElT/_old 2026-11-05 18:24:31.139205860 +0100 +++ /var/tmp/diff_new_pack.I9lElT/_new 2026-11-05 18:24:31.142205985 +0100 @@ -132,6 +132,44 @@ del lock["packages"]["node_modules/x/node_modules/lightningcss"] self.assertEqual(HELPER["native_overrides"](lock), {}) + def test_apply_security_inventory(self): + upstream = { + "[email protected]": {"v": 1}, + "[email protected]": {"v": 1}, + "[email protected]": {"v": 1}, + "@graphql-tools/[email protected]": {"v": 1}, + "@graphql-tools/[email protected]": {"v": 1}, + "[email protected]": {"v": 1}, + } + reviewed = { + "[email protected]": {"v": 2}, + "[email protected]": {"v": 2}, + "[email protected]": {"v": 2}, + "@graphql-tools/[email protected]": {"v": 2}, + "@whatwg-node/[email protected]": {"v": 2}, + "[email protected]": {"v": 1}, + } + self.assertEqual(HELPER["apply_security_inventory"](upstream, reviewed), reviewed) + for name, version in HELPER["SECURITY_OVERRIDES"].items(): + self.assertIn(f"{name}@{version}", reviewed) + self.assertEqual(HELPER["SECURITY_OVERRIDES"]["@graphql-tools/utils"], "12.0.2") + + vulnerable_copy = reviewed.copy() + vulnerable_copy["@graphql-tools/[email protected]"] = upstream["@graphql-tools/[email protected]"] + with self.assertRaisesRegex(ValueError, "must only replace"): + HELPER["apply_security_inventory"](upstream, vulnerable_copy) + + bad_replacement = reviewed.copy() + del bad_replacement["[email protected]"] + bad_replacement["[email protected]"] = {"v": 1} + with self.assertRaisesRegex(ValueError, "must only replace"): + HELPER["apply_security_inventory"](upstream, bad_replacement) + + unrelated_change = reviewed.copy() + unrelated_change["[email protected]"] = {"v": 999} + with self.assertRaisesRegex(ValueError, "changed unrelated sources"): + HELPER["apply_security_inventory"](upstream, unrelated_change) + if __name__ == "__main__": unittest.main() ++++++ webui-lock-report.json ++++++ --- /var/tmp/diff_new_pack.I9lElT/_old 2026-11-05 18:24:31.169207108 +0100 +++ /var/tmp/diff_new_pack.I9lElT/_new 2026-11-05 18:24:31.172207233 +0100 @@ -1,6 +1,6 @@ { "source_identities": 1028, - "installation_entries": 1076, + "installation_entries": 1056, "bundled_entries": 6, "not_selected_by_npm": [ "@adobe/[email protected]", ++++++ webui-package.json ++++++ --- /var/tmp/diff_new_pack.I9lElT/_old 2026-11-05 18:24:31.189207940 +0100 +++ /var/tmp/diff_new_pack.I9lElT/_new 2026-11-05 18:24:31.192208065 +0100 @@ -93,7 +93,9 @@ "js-yaml@4": "^4.3.2", "postcss-selector-parser": "7.1.6", "fast-uri": "3.1.9", - "qs": "6.16.1", + "qs": "6.17.0", + "body-parser": "2.4.0", + "@graphql-tools/utils": "12.0.2", "lightningcss": "1.33.0" } }
