From 01da6381a1ab3933d90e1b792647851c6a16293d Mon Sep 17 00:00:00 2001 From: Ajay Jadhav Date: Wed, 26 Aug 2026 17:50:32 +0530 Subject: [PATCH 01/11] fix(deps): remove unused direct dependencies (handlebars, protobufjs, form-data, auth0-js) These packages are listed as direct dependencies but never imported in any source file. Removing them eliminates ~21 Dependabot alerts including 2 CRITICAL (handlebars, form-data) and 5 HIGH (protobufjs) with zero code changes. Refs: #1728 Signed-off-by: Ajay Jadhav --- package.json | 6 +---- pnpm-lock.yaml | 68 ++------------------------------------------------ 2 files changed, 3 insertions(+), 71 deletions(-) diff --git a/package.json b/package.json index 7712fe10f..e593d6a69 100644 --- a/package.json +++ b/package.json @@ -60,7 +60,6 @@ "@types/json2csv": "^5.0.7", "@types/pdfkit": "^0.12.12", "async-retry": "^1.3.3", - "auth0-js": "^9.30.1", "aws-sdk": "^2.1693.0", "axios": "^1.18.0", "bcrypt": "^6.0.0", @@ -125,10 +124,7 @@ "web-push": "^3.6.7", "winston": "^3.19.0", "winston-daily-rotate-file": "^5.0.0", - "xml-js": "^1.6.11", - "protobufjs": "^7.6.5", - "handlebars": "^4.7.9", - "form-data": "^4.0.6" + "xml-js": "^1.6.11" }, "devDependencies": { "@nestjs/cli": "catalog:", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 409d365ca..cb81fa4b4 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -179,9 +179,6 @@ importers: async-retry: specifier: ^1.3.3 version: 1.3.3 - auth0-js: - specifier: ^9.30.1 - version: 9.32.0 aws-sdk: specifier: ^2.1693.0 version: 2.1693.0 @@ -236,18 +233,12 @@ importers: firebase-admin: specifier: ^13.6.1 version: 13.8.0 - form-data: - specifier: ^4.0.6 - version: 4.0.6 fs: specifier: 0.0.1-security version: 0.0.1-security generate-password: specifier: ^1.7.1 version: 1.7.1 - handlebars: - specifier: ^4.7.9 - version: 4.7.9 helmet: specifier: ^8.1.0 version: 8.1.0 @@ -329,9 +320,6 @@ importers: pg: specifier: ^8.18.0 version: 8.20.0 - protobufjs: - specifier: ^7.6.5 - version: 7.6.5 puppeteer: specifier: ^21.11.0 version: 21.11.0(typescript@5.9.3) @@ -2663,9 +2651,6 @@ packages: asynckit@0.4.0: resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==} - auth0-js@9.32.0: - resolution: {integrity: sha512-Vbt8W1sI3VLEdhaRNNP6Uq0qD5KUWQ4iSFn0nv03Xn4npC8r7YRUrvFrA27CCXK+ZV5fjy0Ajr/ElZ7ed97ukA==} - available-typed-arrays@1.0.7: resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==} engines: {node: '>= 0.4'} @@ -4188,9 +4173,6 @@ packages: resolution: {integrity: sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==} engines: {node: '>=0.10.0'} - idtoken-verifier@2.2.4: - resolution: {integrity: sha512-5t7O8cNHpJBB8FnwLD0qFZqy/+qGICObQKUl0njD6vXKHhpZPLEe8LU7qv/GBWB3Qv5e/wAIFHYVi4SoQwdOxQ==} - ieee754@1.1.13: resolution: {integrity: sha512-4vf7I2LYV/HaWerSo3XmlMkp5eZ83i+/CDluXi/IGTs/O1sejBNhTtnxzmRZfvOUqj7lZjqHkeTvpgSFDlWZTg==} @@ -4579,9 +4561,6 @@ packages: jose@4.15.9: resolution: {integrity: sha512-1vUQX+IdDMVPj4k8kOxgUqlcK518yluMuGZwqlr44FS1ppZB/5GWh4rZG89erpOBOJjU/OBsnCVFfapsRz6nEA==} - js-cookie@2.2.1: - resolution: {integrity: sha512-HvdH2LzI/EAZcUwA8+0nKNtWHqS+ZmijLA30RwZA0bo7ToCckjK5MkGhjED9KoRcXO6BaGI3I9UIzSA1FKFPOQ==} - js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} @@ -4604,9 +4583,6 @@ packages: jsbn@0.1.1: resolution: {integrity: sha512-UVU9dibq2JcFWxQPA6KCqj5O42VOmAY3zQUfEKxU0KpTGXwNoCjkX1e13eHNvw/xPynt6pU0rZ1htjWTNTSXsg==} - jsbn@1.1.0: - resolution: {integrity: sha512-4bYVV3aAMtDTTu4+xsDYa6sy9GyJ69/amsu9sYF2zqjiEoZA5xJi3BrfX3uY+/IekIu7MwdObdbDWpoZdBv3/A==} - jsesc@3.1.0: resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==} engines: {node: '>=6'} @@ -6430,9 +6406,6 @@ packages: undici-types@6.21.0: resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==} - unfetch@4.2.0: - resolution: {integrity: sha512-F9p7yYCn6cIW9El1zi0HI6vqpeIvBsr3dSuRO6Xuppb1u5rXpCPmMvLSyECLhybr9isec8Ohl0hPekMVrEinDA==} - unicode-properties@1.4.1: resolution: {integrity: sha512-CLjCCLQ6UuMxWnbIylkisbRj31qxHPAurvena/0iwSVbQ2G1VY5/HjV0IRabOEbDHlzZlRdCrD4NhB0JtU40Pg==} @@ -6459,9 +6432,6 @@ packages: uri-js@4.4.1: resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==} - url-join@4.0.1: - resolution: {integrity: sha512-jk1+QP6ZJqyOiuEI9AEWQfju/nB2Pw466kbA0LEZljHwKeMgd9WrAEgEGxjPDD2+TNbbb37rTyhEfrCXfuKXnA==} - url@0.10.3: resolution: {integrity: sha512-hzSUW2q06EqL1gKM/a+obYHLIO6ct2hwPuviqTTOcfFVc61UbfJ2Q32+uGL/HCPxKqrdGB5QUwIe7UqlDgwsOQ==} @@ -6603,9 +6573,6 @@ packages: engines: {node: '>= 8'} hasBin: true - winchan@0.2.2: - resolution: {integrity: sha512-pvN+IFAbRP74n/6mc6phNyCH8oVkzXsto4KCHPJ2AScniAnA1AmeLI03I2BzjePpaClGSI4GUMowzsD3qz5PRQ==} - winston-daily-rotate-file@5.0.0: resolution: {integrity: sha512-JDjiXXkM5qvwY06733vf09I2wnMXpZEhxEVOSPenZMii+g7pcDcTBt2MRugnoi8BwVSuCT2jfRXBUy+n1Zz/Yw==} engines: {node: '>=8'} @@ -9640,19 +9607,6 @@ snapshots: asynckit@0.4.0: {} - auth0-js@9.32.0: - dependencies: - base64-js: 1.5.1 - idtoken-verifier: 2.2.4 - js-cookie: 2.2.1 - minimist: 1.2.8 - qs: 6.15.3 - superagent: 10.3.0 - url-join: 4.0.1 - winchan: 0.2.2 - transitivePeerDependencies: - - supports-color - available-typed-arrays@1.0.7: dependencies: possible-typed-array-names: 1.1.0 @@ -10579,7 +10533,8 @@ snapshots: is-date-object: 1.1.0 is-symbol: 1.1.1 - es6-promise@4.2.8: {} + es6-promise@4.2.8: + optional: true escalade@3.2.0: {} @@ -11522,15 +11477,6 @@ snapshots: dependencies: safer-buffer: 2.1.2 - idtoken-verifier@2.2.4: - dependencies: - base64-js: 1.5.1 - crypto-js: 4.2.0 - es6-promise: 4.2.8 - jsbn: 1.1.0 - unfetch: 4.2.0 - url-join: 4.0.1 - ieee754@1.1.13: {} ieee754@1.2.1: {} @@ -12111,8 +12057,6 @@ snapshots: jose@4.15.9: {} - js-cookie@2.2.1: {} - js-tokens@4.0.0: {} js-yaml@3.15.1: @@ -12135,8 +12079,6 @@ snapshots: jsbn@0.1.1: optional: true - jsbn@1.1.0: {} - jsesc@3.1.0: {} json-bigint@1.0.0: @@ -14111,8 +14053,6 @@ snapshots: undici-types@6.21.0: {} - unfetch@4.2.0: {} - unicode-properties@1.4.1: dependencies: base64-js: 1.5.1 @@ -14145,8 +14085,6 @@ snapshots: dependencies: punycode: 2.3.1 - url-join@4.0.1: {} - url@0.10.3: dependencies: punycode: 1.3.2 @@ -14335,8 +14273,6 @@ snapshots: dependencies: isexe: 2.0.0 - winchan@0.2.2: {} - winston-daily-rotate-file@5.0.0(winston@3.19.0): dependencies: file-stream-rotator: 0.6.1 From 67299df7940f195c38f461973fb6965ec25ef68d Mon Sep 17 00:00:00 2001 From: Ajay Jadhav Date: Wed, 26 Aug 2026 17:56:06 +0530 Subject: [PATCH 02/11] fix(deps): bump axios to ^1.20.0, fix 8 Dependabot alerts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit axios minor bump resolves 5 HIGH and 3 MEDIUM alerts including prototype pollution, SSRF, ReDoS, and credential leak vulnerabilities. uuid kept at ^9.0.1 (CJS-compatible) — the vulnerable v3/v5/v6 functions are never used in this codebase (only v4 and validate are imported). qs already at latest 6.x — no change needed. Refs: #1728 Signed-off-by: Ajay Jadhav --- package.json | 2 +- pnpm-lock.yaml | 18 +++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package.json b/package.json index e593d6a69..29048c095 100644 --- a/package.json +++ b/package.json @@ -61,7 +61,7 @@ "@types/pdfkit": "^0.12.12", "async-retry": "^1.3.3", "aws-sdk": "^2.1693.0", - "axios": "^1.18.0", + "axios": "^1.20.0", "bcrypt": "^6.0.0", "blob-stream": "^0.1.3", "body-parser": "^1.20.6", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index cb81fa4b4..3ac2b24eb 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -82,7 +82,7 @@ importers: version: 3.1044.0 '@nestjs/axios': specifier: 'catalog:' - version: 4.0.1(@nestjs/common@11.1.29(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.1.14)(rxjs@7.8.2))(axios@1.18.0)(rxjs@7.8.2) + version: 4.0.1(@nestjs/common@11.1.29(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.1.14)(rxjs@7.8.2))(axios@1.20.0)(rxjs@7.8.2) '@nestjs/bull': specifier: 'catalog:' version: 11.0.5(@nestjs/common@11.1.29(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.1.14)(rxjs@7.8.2))(@nestjs/core@11.1.29)(bull@4.16.5) @@ -183,8 +183,8 @@ importers: specifier: ^2.1693.0 version: 2.1693.0 axios: - specifier: ^1.18.0 - version: 1.18.0 + specifier: ^1.20.0 + version: 1.20.0 bcrypt: specifier: ^6.0.0 version: 6.0.0 @@ -476,7 +476,7 @@ importers: dependencies: '@nestjs/axios': specifier: 'catalog:' - version: 4.0.1(@nestjs/common@11.1.29(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.1.14)(rxjs@7.8.2))(axios@1.18.0)(rxjs@7.8.2) + version: 4.0.1(@nestjs/common@11.1.29(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.1.14)(rxjs@7.8.2))(axios@1.20.0)(rxjs@7.8.2) '@nestjs/cache-manager': specifier: 'catalog:' version: 3.1.3(@nestjs/common@11.1.29(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.1.14)(rxjs@7.8.2))(@nestjs/core@11.1.29)(cache-manager@5.7.6)(keyv@4.5.4)(rxjs@7.8.2) @@ -2669,8 +2669,8 @@ packages: axios@0.26.1: resolution: {integrity: sha512-fPwcX4EvnSHuInCMItEhAGnaSEXRBjtzh9fOtsE6E1G6p7vl7edEeZe11QHf18+6+9gR5PbKV/sGKNaD8YaMeA==} - axios@1.18.0: - resolution: {integrity: sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==} + axios@1.20.0: + resolution: {integrity: sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==} b4a@1.8.1: resolution: {integrity: sha512-aiqre1Nr0B/6DgE2N5vwTc+2/oQZ4Wh1t4NznYY4E00y8LCt6NqdRv81so00oo27D8MVKTpUa/MwUUtBLXCoDw==} @@ -7922,10 +7922,10 @@ snapshots: '@msgpackr-extract/msgpackr-extract-win32-x64@3.0.3': optional: true - '@nestjs/axios@4.0.1(@nestjs/common@11.1.29(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.1.14)(rxjs@7.8.2))(axios@1.18.0)(rxjs@7.8.2)': + '@nestjs/axios@4.0.1(@nestjs/common@11.1.29(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.1.14)(rxjs@7.8.2))(axios@1.20.0)(rxjs@7.8.2)': dependencies: '@nestjs/common': 11.1.29(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.1.14)(rxjs@7.8.2) - axios: 1.18.0 + axios: 1.20.0 rxjs: 7.8.2 '@nestjs/bull-shared@11.0.5(@nestjs/common@11.1.29(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.1.14)(rxjs@7.8.2))(@nestjs/core@11.1.29)': @@ -9636,7 +9636,7 @@ snapshots: transitivePeerDependencies: - debug - axios@1.18.0: + axios@1.20.0: dependencies: follow-redirects: 1.16.0 form-data: 4.0.6 From c0d6781fd075642ce65e79799c117883bee01aba Mon Sep 17 00:00:00 2001 From: Ajay Jadhav Date: Wed, 26 Aug 2026 17:58:16 +0530 Subject: [PATCH 03/11] fix(deps): update opentelemetry and socket.io-client for transitive vuln fixes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - @opentelemetry/sdk-node ^0.217.0 → ^0.221.0 (fixes @opentelemetry/core and propagator-jaeger transitive vulnerabilities) - socket.io-client ^4.8.3 updated lockfile (fixes socket.io-parser vuln) puppeteer kept at ^21.11.0 — already at latest 21.x; major version bump deferred to avoid breaking changes. Refs: #1728 Signed-off-by: Ajay Jadhav --- package.json | 2 +- pnpm-lock.yaml | 482 ++++++++++++++++++++++--------------------------- 2 files changed, 216 insertions(+), 268 deletions(-) diff --git a/package.json b/package.json index 29048c095..dc985c325 100644 --- a/package.json +++ b/package.json @@ -50,7 +50,7 @@ "@opentelemetry/instrumentation-nestjs-core": "^0.48.1", "@opentelemetry/resources": "^2.5.1", "@opentelemetry/sdk-logs": "^0.202.0", - "@opentelemetry/sdk-node": "^0.217.0", + "@opentelemetry/sdk-node": "^0.221.0", "@opentelemetry/semantic-conventions": "^1.39.0", "@prisma/client": "^5.22.0", "@sendgrid/mail": "^7.7.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 3ac2b24eb..7da07a00c 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -150,8 +150,8 @@ importers: specifier: ^0.202.0 version: 0.202.0(@opentelemetry/api@1.9.1) '@opentelemetry/sdk-node': - specifier: ^0.217.0 - version: 0.217.0(@opentelemetry/api@1.9.1) + specifier: ^0.221.0 + version: 0.221.0(@opentelemetry/api@1.9.1) '@opentelemetry/semantic-conventions': specifier: ^1.39.0 version: 1.40.0 @@ -983,10 +983,6 @@ packages: resolution: {integrity: sha512-n2FjE7NAOYyshogdc7KQOl/VZb4sneqPjWouSyia9CMDdMhRX5+RIbqalNmC7LOLzuLAN89VlF2HvG8na9G+zQ==} engines: {node: '>=14'} - '@grpc/grpc-js@1.14.3': - resolution: {integrity: sha512-Iq8QQQ/7X3Sac15oB6p0FmUg/klxQvXLeileoqrTRGJYLV+/9tubbr9ipz0GKHjmXVsgFPo/+W+2cA8eNcR+XA==} - engines: {node: '>=12.10.0'} - '@grpc/grpc-js@1.14.4': resolution: {integrity: sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==} engines: {node: '>=12.10.0'} @@ -996,11 +992,6 @@ packages: engines: {node: '>=6'} hasBin: true - '@grpc/proto-loader@0.8.0': - resolution: {integrity: sha512-rc1hOQtjIWGxcxpb9aHAfLpIctjEnsDehj0DAiVfBlmT84uvR0uUtN2hEi/ecvWVjXUGf5qPF4qEgiLOx1YIMQ==} - engines: {node: '>=6'} - hasBin: true - '@grpc/proto-loader@0.8.1': resolution: {integrity: sha512-wtF6h+DY6M3YaDBPAmvuuA6jV8Sif9MjtOI5euKFWRgCDl5PeDpPsHR9u2l6St5ceY8AZgoNDww5+HvEsXFsGg==} engines: {node: '>=6'} @@ -1546,22 +1537,22 @@ packages: resolution: {integrity: sha512-fTBjMqKCfotFWfLzaKyhjLvyEyq5vDKTTFfBmx21btv3gvy8Lq6N5Dh2OzqeuN4DjtpSvNT1uNVfg08eD2Rfxw==} engines: {node: '>=8.0.0'} - '@opentelemetry/api-logs@0.217.0': - resolution: {integrity: sha512-Cdq0jW2lknrNfrAm92MyEAvpe2cRsKjdnQLHUL6xRA4IVUnsWx6P65E7NcUO0Y+L4w1Aee5iV8FvjSwd+lrs9A==} + '@opentelemetry/api-logs@0.221.0': + resolution: {integrity: sha512-OlanaW1vv7ufTqQ3/fPLI4arGt5ZoM+P8abOMki6uEYnpRazepSWDwDnnw+la7kE26SHVC18//SMccrDvLKOXQ==} engines: {node: '>=8.0.0'} '@opentelemetry/api@1.9.1': resolution: {integrity: sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q==} engines: {node: '>=8.0.0'} - '@opentelemetry/configuration@0.217.0': - resolution: {integrity: sha512-xCtrYOhBqdy6ZOMfe0Oa73ZKF+2LMhoOv4L5vmwAHVvOXUg+V3fvKuEIr9ZyD0Ow+vxllEjWO6PV1wd0DOtyvw==} + '@opentelemetry/configuration@0.221.0': + resolution: {integrity: sha512-uE9y56Zdi9Gt/RdxYnVOo3YmFZkKJJMA0gqtBe8wh8gdtF5Asqe+Oh/TWiDtFb1s+31jNY4CWgnfIB1KOITfFA==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.9.0 - '@opentelemetry/context-async-hooks@2.7.1': - resolution: {integrity: sha512-OPFBYuXEn1E4ja3Y6eeA7O+ZnLBNcXTV5Cgsn1VaqBZ6hC5FnpZPLBNme1LJY8ZtF4aOujPKFoeWN4ik487KuQ==} + '@opentelemetry/context-async-hooks@2.10.0': + resolution: {integrity: sha512-bvyMcgLEkozzSzpEEEo1OMoeQ97bxj6Qs2uN3mPrSdDvObMI1myffD/BPqcLlzZO9//d1SqQA/WPw7Cz2AiqhA==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': '>=1.0.0 <1.10.0' @@ -1572,14 +1563,20 @@ packages: peerDependencies: '@opentelemetry/api': '>=1.0.0 <1.10.0' + '@opentelemetry/core@2.10.0': + resolution: {integrity: sha512-/wNZ8twnEQQA4HoHu22+vcsdru6pWPWxW+7w+FlxT6Id7PE/WIbZmVKkte+PF72e0F2dnImFeHD2syyE1Mw6MQ==} + engines: {node: ^18.19.0 || >=20.6.0} + peerDependencies: + '@opentelemetry/api': '>=1.0.0 <1.10.0' + '@opentelemetry/core@2.7.1': resolution: {integrity: sha512-QAqIj32AtK6+pEVNG7EOVxHdE06RP+FM5qpiEJ4RtDcFIqKUZHYhl7/7UY5efhwmwNAg7j8QbJVBLxMerc0+gw==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': '>=1.0.0 <1.10.0' - '@opentelemetry/exporter-logs-otlp-grpc@0.217.0': - resolution: {integrity: sha512-vC5S0Dc+noxD86CVtNu1+awCHPA5Kewi1Sg23ps+9lh4YifwsKXh3pe4XTNEKtUJiAcjpJ5dqStGakLbrSE+YQ==} + '@opentelemetry/exporter-logs-otlp-grpc@0.221.0': + resolution: {integrity: sha512-txG1G0IrYSsKKMeiWZfj/i5cQmWB+h+hf3HzPpF3RqZVwp+iQQEIsv8Vtmzy6RWVdHdJZfygmVrBI39YTBvWcw==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.3.0 @@ -1590,44 +1587,44 @@ packages: peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/exporter-logs-otlp-http@0.217.0': - resolution: {integrity: sha512-KfLAdt1uilVE+3FxbgVnp2ZrzqbIawzcesnRoi+Kh9ckB5Ld5D8btUgoBvwTbdmuNx1j6b132Wsh72azq+pPNQ==} + '@opentelemetry/exporter-logs-otlp-http@0.221.0': + resolution: {integrity: sha512-nKXkr4Tomi6fjYVOf+ytcW3dZAVr4v4Bv5gsT6dr2gvpUPJpKgHB4XbMufMsPotRE3g0XH2GwVVCkN2w6SON+Q==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/exporter-logs-otlp-proto@0.217.0': - resolution: {integrity: sha512-Se0GG/ZO24mQTlQj7zprR4pNI0nKe4lPDPBsuJmi6508b9TlZEuUd3EfyuHk6oJxzL7fGyDFYAbxNigQvRP2ZQ==} + '@opentelemetry/exporter-logs-otlp-proto@0.221.0': + resolution: {integrity: sha512-AH6EY+47gXFaWYgG3hfeOneGiE9xIZGtDBk+9g0sM8NZWzsQhhmqPbQQXJzS7pyCh5jRRr2nYNXVrkCmoojRvQ==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/exporter-metrics-otlp-grpc@0.217.0': - resolution: {integrity: sha512-0GpJKnCoVaVA1rKBMVPHziznfOQlXgH72S9ktjBAF1AnAVPzX7vVEBGrhwiSxxHDAiefXk+J8znApsMb/K6Z3w==} + '@opentelemetry/exporter-metrics-otlp-grpc@0.221.0': + resolution: {integrity: sha512-KOgCtO15FC6C1T/xOqBcr7EyUs7B+7yomGNb5Y97d3s38rPbCCk5sewkmE2b0/itOkQ/PptX8CLlD+kn2mEtTg==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/exporter-metrics-otlp-http@0.217.0': - resolution: {integrity: sha512-1zkMzzhiNJdVmLxuwkltqWGw4fOOam47bqRxmuQNjyKJe/9NmY5cIrZ4kiQV7sVGxoOgT0ZvGUfLcjvtpC/b9Q==} + '@opentelemetry/exporter-metrics-otlp-http@0.221.0': + resolution: {integrity: sha512-sRfCKbOzgy8xZQV2as0RzIZlnCmCseCKZGLfRcrpo2CBngJDr+rPtX0zkG0+oUCV5kfQPUoW3W3C96Ag3Y/Clg==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/exporter-metrics-otlp-proto@0.217.0': - resolution: {integrity: sha512-nfxt/KxVGFkjkO/M+58y1ugHu/dwPtxG4eYq0KApcQ7xk5CHzhdn+IuLZfDSvNDrJ3Uy5q++Fj/wbK7i8yryfQ==} + '@opentelemetry/exporter-metrics-otlp-proto@0.221.0': + resolution: {integrity: sha512-YMF4LveY2I3yhw61rn6nmC9FE8U24IZHPeKU1Duc5+sbwjMd8FwZAwba318ImdThCg/HuVQvhm2y6bfgNPnfYg==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/exporter-prometheus@0.217.0': - resolution: {integrity: sha512-U9MCXxJu0sBCh5aEkylYRR4xVIL8D1CW6dGwvYXbfFr0qveSorfD0XJchCAWoW6QfAAIcY/yxjf4Dj8OgkHBPw==} + '@opentelemetry/exporter-prometheus@0.221.0': + resolution: {integrity: sha512-kW79a20qWESIuAdDrxzg9WKM98twV/NBWBFRAH57ap/+ssZhiCo0hckzKT0zpuwR/gSHrFAQhJL0bYDrnEM34g==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/exporter-trace-otlp-grpc@0.217.0': - resolution: {integrity: sha512-fPZs2fw7veLH3pEKu8vSepUa2fQpAE2P7al6qU10aH9GrEJJ8YaPgsd5xON7by5rbcEVS71FOU2aWyK6nzB7VQ==} + '@opentelemetry/exporter-trace-otlp-grpc@0.221.0': + resolution: {integrity: sha512-zXminlZedtq9LvOW64CnNkOqk15zV75k8JgtdTuWFge6+jk2m4GmAUm6L2eIiG1o2a2bZxXw2PDrszm+bps0IA==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.3.0 @@ -1638,20 +1635,20 @@ packages: peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/exporter-trace-otlp-http@0.217.0': - resolution: {integrity: sha512-38YQoqtYjglz2GV94LGUN/djLvxtvGIQO68o6qAFPVshjmwSdX1F2i0c7vn3lEl1L5B/YqjB/bgKXaVx7KO+RQ==} + '@opentelemetry/exporter-trace-otlp-http@0.221.0': + resolution: {integrity: sha512-AySXiKoC+meiWm6zdVj5T2LnPDZuatveBby1cMOeQteIWsYXAUxs8Sru13G2pVSPrUXz6vF+og7QVBX6GdC/oQ==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/exporter-trace-otlp-proto@0.217.0': - resolution: {integrity: sha512-nPV8gKHUiSuTZpQcnZU3/pBlK7crSyEGpZuh5MtWySB0vv6NNG0QvvfKitQt+Fc2Mc6qfyU54KlZcurwoTbrVg==} + '@opentelemetry/exporter-trace-otlp-proto@0.221.0': + resolution: {integrity: sha512-Z9i2T7vgZbWe9rSLYxXVIbeW+XyzUq4rZanW3ZyVNwVDqCsh0EJKUgBWWQ0CZfeuUA+RQPzKgJQHMuWAUnKqXw==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/exporter-zipkin@2.7.1': - resolution: {integrity: sha512-mfsD9bKAxcKrh5+y08TPodvClBO0CznBE3p79YAGnO81WI4LrdsGA65T53e4iTSbCalW4WaUpkbeJcbpyIUHfg==} + '@opentelemetry/exporter-zipkin@2.10.0': + resolution: {integrity: sha512-7gsvgf0UDoJ4l9ObrwBmz5G/ZogiPk+lq+g5GpLp24YQF/vPM/BSsnOfcLnfinast5ASUgLo78uSC/ObjlnXgg==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.0.0 @@ -1680,8 +1677,8 @@ packages: peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/instrumentation@0.217.0': - resolution: {integrity: sha512-24ucQMjz7Y34Kw3trbxL2ZrssbtgWnR+Clpaa+YdeWuuyH3Cvk23Q03PcQvqiZrDvt8AmQmjgg9v6Y9PHoxG7w==} + '@opentelemetry/instrumentation@0.221.0': + resolution: {integrity: sha512-cCk80Z/iRDf/5gfsKMB4f74LqVA5yKETB/9ojPzVW/6/f70iu89nJvGxsFCxx4XfSohaOofkU19kiYm84AiAlw==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.3.0 @@ -1692,14 +1689,14 @@ packages: peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/otlp-exporter-base@0.217.0': - resolution: {integrity: sha512-eYfqnB3UhKu/5frhd1R6+FprKygbhkomuaceMXDyzxbfXB9tKgZOVmjaJ02CkLA6Tdzumxl+e2H+vo2a8jiMPQ==} + '@opentelemetry/otlp-exporter-base@0.221.0': + resolution: {integrity: sha512-UFPIq80OH3Ns/oPFHRj14d4DTOxUo+MUFU8hUiCq5jTqFhdeJnfVSANHT+xp92409cA+oxzvlZCe6NM1wvCuBA==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/otlp-grpc-exporter-base@0.217.0': - resolution: {integrity: sha512-7RTAdZuOsCDnsyqTCG4+bDzrfnsWdzkRs7z0AVi/V3tEQx0oKeyc+OuRWYxnRsmaJXgxcmB8vb/lfxn58Dj6Ag==} + '@opentelemetry/otlp-grpc-exporter-base@0.221.0': + resolution: {integrity: sha512-rQDmNgyiGCTrescjnzH2ntVyUKVIq6I2UjuK8+stT/Xg0ZOT71FVJqwjFdspQl6Yol/Yqsut9bDo+ame8oTmDQ==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.3.0 @@ -1710,20 +1707,20 @@ packages: peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/otlp-transformer@0.217.0': - resolution: {integrity: sha512-MKK8UHKFUOGAvbZRWh90MhwHG+Fxm6OROBdjKPCF+HQobjuJ/Kuf8Chs8CR45X1aqotxrMj7OxTdsXe8sXuGVA==} + '@opentelemetry/otlp-transformer@0.221.0': + resolution: {integrity: sha512-lg6lkOU08Az23jVcn/0Els9HP+V8PnR4Km6p0KgpTggS0n/WuhnmY64rSh83Of9iR9nD+dpWr6adlcX8KzAwjg==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': ^1.3.0 - '@opentelemetry/propagator-b3@2.7.1': - resolution: {integrity: sha512-RJid6E2CKyeGfKBzXKF21ejabGMHypFkPAh3qZ+NvI+SGjuIye79t3PmiqcDgtRzdKH6ynXzbfslQ8DfpRUg2A==} + '@opentelemetry/propagator-b3@2.10.0': + resolution: {integrity: sha512-GnA5B24H+1w8BO21J0q+IWNB0z1v+AGbcquTdIt/dufibhnhgxaA8YKvz0I3akRZhB1jHT+/tlzK+qlAjEDybQ==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': '>=1.0.0 <1.10.0' - '@opentelemetry/propagator-jaeger@2.7.1': - resolution: {integrity: sha512-KMjVBHzP4N60bOzxja76M1F1hZZ43lGPga5ix+mkv9+kk1nx9SbkxSvJsMbuVUxdPQmsPTqGShmhN8ulrMOg6Q==} + '@opentelemetry/propagator-jaeger@2.10.0': + resolution: {integrity: sha512-yw/IX8DL470dSMZJoE82ScfYGp7JWZ/G8kFJo35ZILUVTB2jFPTOaioN+8s09pH0RHsWNhweVZb+ZnjJJpCChg==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': '>=1.0.0 <1.10.0' @@ -1734,6 +1731,12 @@ packages: peerDependencies: '@opentelemetry/api': '>=1.3.0 <1.10.0' + '@opentelemetry/resources@2.10.0': + resolution: {integrity: sha512-q6MMm2zhggzsHVNbabYwut+a6nbuQQe3URUoxaojM/8K1IBfwwPzvxIjNi2/lI1TFe+fMHMW9MWhrtDLEXEnkA==} + engines: {node: ^18.19.0 || >=20.6.0} + peerDependencies: + '@opentelemetry/api': '>=1.3.0 <1.10.0' + '@opentelemetry/resources@2.7.1': resolution: {integrity: sha512-DeT6KKolmC4e/dRQvMQ/RwlnzhaqeiFOXY5ngoOPJ07GgVVKxZOg9EcrNZb5aTzUn+iCrJldAgOfQm1O/QfPAQ==} engines: {node: ^18.19.0 || >=20.6.0} @@ -1746,8 +1749,8 @@ packages: peerDependencies: '@opentelemetry/api': '>=1.4.0 <1.10.0' - '@opentelemetry/sdk-logs@0.217.0': - resolution: {integrity: sha512-BB+PcHItcZDL63dPMW+mJvwN9rk37wuIDjRxbVlg6pPDvDR/7GL7UJHbGsllgoggOoTimsKgENaWPoGch/oE1A==} + '@opentelemetry/sdk-logs@0.221.0': + resolution: {integrity: sha512-FaDcazjyMp7TZZZAsqbo4IkovP0UegoCu0EBkiNt+qCqvUf7FPAsfcrZ3+ZEkKgXZ/jHafop+JoGPDk3A0SmLg==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': '>=1.4.0 <1.10.0' @@ -1758,14 +1761,14 @@ packages: peerDependencies: '@opentelemetry/api': '>=1.9.0 <1.10.0' - '@opentelemetry/sdk-metrics@2.7.1': - resolution: {integrity: sha512-MpDJdkiFDs3Pm1RHO3KByuZbuBdJEXEAkiC0+yJdsZGVCdf1RpHR6n+LHDcS7ffmfrt5kVCzJSCfm4z2C7v0uQ==} + '@opentelemetry/sdk-metrics@2.10.0': + resolution: {integrity: sha512-t6r1VSvXNtSDnPXU1FbZeetJb7yyovHmgu0wRSoftxtE0g2rSNhQZQUy69sRUCL+iioJpX8SN/S6wq6ZtvLySQ==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': '>=1.9.0 <1.10.0' - '@opentelemetry/sdk-node@0.217.0': - resolution: {integrity: sha512-K/60pSv42+NQiZKy1pAH18nYDkxltsDV4O3SJ233J0E9raU1ksyL9gsKuS8p30bYBb4AMPCfDuutHQaHYpcv0Q==} + '@opentelemetry/sdk-node@0.221.0': + resolution: {integrity: sha512-UbYuvtBrQQB5Prsh9KOKy4kxzexFxfMs5MkteHeWMoswsEB7kiNhyUVkAOFW/qsEzNHtrkgyghrD2ilZJa+5YA==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': '>=1.3.0 <1.10.0' @@ -1776,18 +1779,24 @@ packages: peerDependencies: '@opentelemetry/api': '>=1.3.0 <1.10.0' - '@opentelemetry/sdk-trace-base@2.7.1': - resolution: {integrity: sha512-NAYIlsF8MPUsKqJMiDQJTMPOmlbawC1Iz/omMLygZ1C9am8fTKYjTaI+OZM+WTY3t3Glo0wnOg/6/pac6RGPPw==} + '@opentelemetry/sdk-trace-base@2.10.0': + resolution: {integrity: sha512-GuYQQT7QD2EeO8lcZLRQzcbOyhqAzL+6WWTKTU9mSUBYBazkEDl+VrQcXQhbB08OWM9anD1aHleVadzulpOaUQ==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': '>=1.3.0 <1.10.0' - '@opentelemetry/sdk-trace-node@2.7.1': - resolution: {integrity: sha512-pCpQxU68lV+I9s9svqMyVu5iHdDDUnqUpSxqwyCU8A9ejEsSnMPCbearwsUO4yk08ZJzAIUCFuReMdVQvHrdvg==} + '@opentelemetry/sdk-trace-node@2.10.0': + resolution: {integrity: sha512-GZK/G6oZyBLGlH1pUgeDch7D91KoHd2uotUGIkWCPi9GI5T9X0p4L7nNAMDR1BQjkRYoDqo+ddfVx9t5Uhys+Q==} engines: {node: ^18.19.0 || >=20.6.0} peerDependencies: '@opentelemetry/api': '>=1.0.0 <1.10.0' + '@opentelemetry/sdk-trace@2.10.0': + resolution: {integrity: sha512-MfQGq3GRmTh5fM/y+OjaO0vj6+luCB1XO2gfXCalKCfgKw0eHL++sm75DNweC6ohlp+aFvACqeE0fYayqdRaoQ==} + engines: {node: ^18.19.0 || >=20.6.0} + peerDependencies: + '@opentelemetry/api': '>=1.3.0 <1.10.0' + '@opentelemetry/semantic-conventions@1.40.0': resolution: {integrity: sha512-cifvXDhcqMwwTlTK04GBNeIe7yyo28Mfby85QXFe1Yk8nmi36Ab/5UQwptOx84SsoGNRg+EVSjwzfSZMy6pmlw==} engines: {node: '>=14'} @@ -1841,9 +1850,6 @@ packages: '@protobufjs/float@1.0.2': resolution: {integrity: sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==} - '@protobufjs/inquire@1.1.2': - resolution: {integrity: sha512-pa0vFRuws4wkvaXKK1uXZMAwAX4/t8ANaJo45iw/oQHNQ9q5xUzwgFmVJGXiga2BeN+zpX7Vf9vmsiIa2J+MUw==} - '@protobufjs/path@1.1.2': resolution: {integrity: sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==} @@ -3394,8 +3400,8 @@ packages: end-of-stream@1.4.5: resolution: {integrity: sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==} - engine.io-client@6.6.4: - resolution: {integrity: sha512-+kjUJnZGwzewFDw951CDWcwj35vMNf2fcj7xQWOctq1F2i1jkDdVvdFG9kM/BEChymCH36KgjnW0NsL58JYRxw==} + engine.io-client@6.6.6: + resolution: {integrity: sha512-iY6QdftLQ9pyiPoX082bpf/u1UewnOaJrtJIF9T0++QB34lZrj0uP+Q/bj8AlUsAxqhnkTV2BS8SBZSxOmoV5Q==} engine.io-parser@5.2.3: resolution: {integrity: sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q==} @@ -3438,6 +3444,9 @@ packages: es-module-lexer@2.3.1: resolution: {integrity: sha512-shc1dbU90Yl/xq1QrC7QRtfcwURZuVRfPhZbDoldJ1cn1gzDvBaBWlv0eFolj5+0znnPJz5TXLxsN77X/12KTA==} + es-module-lexer@2.3.2: + resolution: {integrity: sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==} + es-object-atoms@1.1.1: resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==} engines: {node: '>= 0.4'} @@ -5468,10 +5477,6 @@ packages: resolution: {integrity: sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==} engines: {node: '>=12.0.0'} - protobufjs@8.0.1: - resolution: {integrity: sha512-NWWCCscLjs+cOKF/s/XVNFRW7Yih0fdH+9brffR5NZCy8k42yRdl5KlWKMVXuI1vfCoy4o1z80XR/W/QUb3V3w==} - engines: {node: '>=12.0.0'} - proxy-addr@2.0.7: resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==} engines: {node: '>= 0.10'} @@ -5859,10 +5864,6 @@ packages: resolution: {integrity: sha512-uP0bpjWrjQmUt5DTHq9RuoCBdFJF10cdX9X+a368j/Ft0wmaVgxlrjvK3kjvgCODOMMOz9lcaRzxmso0bTWZ/g==} engines: {node: '>=10.0.0'} - socket.io-parser@4.2.6: - resolution: {integrity: sha512-asJqbVBDsBCJx0pTqw3WfesSY0iRX+2xzWEWzrpcH7L6fLzrhyF8WPI8UaeM4YCuDfpwA/cgsdugMsmtz8EJeg==} - engines: {node: '>=10.0.0'} - socket.io-parser@4.2.7: resolution: {integrity: sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg==} engines: {node: '>=10.0.0'} @@ -6637,18 +6638,6 @@ packages: utf-8-validate: optional: true - ws@8.18.3: - resolution: {integrity: sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==} - engines: {node: '>=10.0.0'} - peerDependencies: - bufferutil: ^4.0.1 - utf-8-validate: '>=5.0.2' - peerDependenciesMeta: - bufferutil: - optional: true - utf-8-validate: - optional: true - ws@8.20.0: resolution: {integrity: sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==} engines: {node: '>=10.0.0'} @@ -7500,12 +7489,6 @@ snapshots: - supports-color optional: true - '@grpc/grpc-js@1.14.3': - dependencies: - '@grpc/proto-loader': 0.8.0 - '@js-sdsl/ordered-map': 4.4.2 - optional: true - '@grpc/grpc-js@1.14.4': dependencies: '@grpc/proto-loader': 0.8.1 @@ -7519,14 +7502,6 @@ snapshots: yargs: 17.7.3 optional: true - '@grpc/proto-loader@0.8.0': - dependencies: - lodash.camelcase: 4.3.0 - long: 5.3.2 - protobufjs: 7.6.5 - yargs: 17.7.3 - optional: true - '@grpc/proto-loader@0.8.1': dependencies: lodash.camelcase: 4.3.0 @@ -8165,19 +8140,19 @@ snapshots: dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/api-logs@0.217.0': + '@opentelemetry/api-logs@0.221.0': dependencies: '@opentelemetry/api': 1.9.1 '@opentelemetry/api@1.9.1': {} - '@opentelemetry/configuration@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/configuration@0.221.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) yaml: 2.9.0 - '@opentelemetry/context-async-hooks@2.7.1(@opentelemetry/api@1.9.1)': + '@opentelemetry/context-async-hooks@2.10.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 @@ -8186,20 +8161,23 @@ snapshots: '@opentelemetry/api': 1.9.1 '@opentelemetry/semantic-conventions': 1.40.0 + '@opentelemetry/core@2.10.0(@opentelemetry/api@1.9.1)': + dependencies: + '@opentelemetry/api': 1.9.1 + '@opentelemetry/semantic-conventions': 1.40.0 + '@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 '@opentelemetry/semantic-conventions': 1.40.0 - '@opentelemetry/exporter-logs-otlp-grpc@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/exporter-logs-otlp-grpc@0.221.0(@opentelemetry/api@1.9.1)': dependencies: - '@grpc/grpc-js': 1.14.4 '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-exporter-base': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-grpc-exporter-base': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-transformer': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-logs': 0.217.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-grpc-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-transformer': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-logs': 0.221.0(@opentelemetry/api@1.9.1) '@opentelemetry/exporter-logs-otlp-http@0.202.0(@opentelemetry/api@1.9.1)': dependencies: @@ -8210,75 +8188,58 @@ snapshots: '@opentelemetry/otlp-transformer': 0.202.0(@opentelemetry/api@1.9.1) '@opentelemetry/sdk-logs': 0.202.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-logs-otlp-http@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/exporter-logs-otlp-http@0.221.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/api-logs': 0.217.0 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-exporter-base': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-transformer': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-logs': 0.217.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-transformer': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-logs': 0.221.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-logs-otlp-proto@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/exporter-logs-otlp-proto@0.221.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/api-logs': 0.217.0 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-exporter-base': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-transformer': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-logs': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-trace-base': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-transformer': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-logs': 0.221.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-metrics-otlp-grpc@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/exporter-metrics-otlp-grpc@0.221.0(@opentelemetry/api@1.9.1)': dependencies: - '@grpc/grpc-js': 1.14.4 '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-metrics-otlp-http': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-exporter-base': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-grpc-exporter-base': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-transformer': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-metrics': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/exporter-metrics-otlp-http': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-grpc-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-transformer': 0.221.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-metrics-otlp-http@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/exporter-metrics-otlp-http@0.221.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-exporter-base': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-transformer': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-metrics': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-transformer': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/resources': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-metrics': 2.10.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-metrics-otlp-proto@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/exporter-metrics-otlp-proto@0.221.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-metrics-otlp-http': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-exporter-base': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-transformer': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-metrics': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/exporter-metrics-otlp-http': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-transformer': 0.221.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-prometheus@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/exporter-prometheus@0.221.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-metrics': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/resources': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-metrics': 2.10.0(@opentelemetry/api@1.9.1) '@opentelemetry/semantic-conventions': 1.40.0 - '@opentelemetry/exporter-trace-otlp-grpc@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/exporter-trace-otlp-grpc@0.221.0(@opentelemetry/api@1.9.1)': dependencies: - '@grpc/grpc-js': 1.14.4 '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-exporter-base': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-grpc-exporter-base': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-transformer': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-trace-base': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-grpc-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-transformer': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-trace': 2.10.0(@opentelemetry/api@1.9.1) '@opentelemetry/exporter-trace-otlp-http@0.202.0(@opentelemetry/api@1.9.1)': dependencies: @@ -8289,30 +8250,26 @@ snapshots: '@opentelemetry/resources': 2.0.1(@opentelemetry/api@1.9.1) '@opentelemetry/sdk-trace-base': 2.0.1(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-trace-otlp-http@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/exporter-trace-otlp-http@0.221.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-exporter-base': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-transformer': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-trace-base': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-transformer': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-trace': 2.10.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-trace-otlp-proto@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/exporter-trace-otlp-proto@0.221.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-exporter-base': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-transformer': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-trace-base': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-transformer': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-trace': 2.10.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-zipkin@2.7.1(@opentelemetry/api@1.9.1)': + '@opentelemetry/exporter-zipkin@2.10.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-trace-base': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/resources': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-trace': 2.10.0(@opentelemetry/api@1.9.1) '@opentelemetry/semantic-conventions': 1.40.0 '@opentelemetry/instrumentation-express@0.51.1(@opentelemetry/api@1.9.1)': @@ -8351,10 +8308,10 @@ snapshots: transitivePeerDependencies: - supports-color - '@opentelemetry/instrumentation@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/instrumentation@0.221.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/api-logs': 0.217.0 + '@opentelemetry/api-logs': 0.221.0 import-in-the-middle: 3.3.3 require-in-the-middle: 8.0.1 transitivePeerDependencies: @@ -8366,19 +8323,19 @@ snapshots: '@opentelemetry/core': 2.0.1(@opentelemetry/api@1.9.1) '@opentelemetry/otlp-transformer': 0.202.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-exporter-base@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/otlp-exporter-base@0.221.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-transformer': 0.217.0(@opentelemetry/api@1.9.1) + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-transformer': 0.221.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-grpc-exporter-base@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/otlp-grpc-exporter-base@0.221.0(@opentelemetry/api@1.9.1)': dependencies: '@grpc/grpc-js': 1.14.4 '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-exporter-base': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-transformer': 0.217.0(@opentelemetry/api@1.9.1) + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-transformer': 0.221.0(@opentelemetry/api@1.9.1) '@opentelemetry/otlp-transformer@0.202.0(@opentelemetry/api@1.9.1)': dependencies: @@ -8391,26 +8348,25 @@ snapshots: '@opentelemetry/sdk-trace-base': 2.0.1(@opentelemetry/api@1.9.1) protobufjs: 7.6.5 - '@opentelemetry/otlp-transformer@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/otlp-transformer@0.221.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/api-logs': 0.217.0 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-logs': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-metrics': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-trace-base': 2.7.1(@opentelemetry/api@1.9.1) - protobufjs: 8.0.1 + '@opentelemetry/api-logs': 0.221.0 + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/resources': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-logs': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-metrics': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-trace': 2.10.0(@opentelemetry/api@1.9.1) - '@opentelemetry/propagator-b3@2.7.1(@opentelemetry/api@1.9.1)': + '@opentelemetry/propagator-b3@2.10.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) - '@opentelemetry/propagator-jaeger@2.7.1(@opentelemetry/api@1.9.1)': + '@opentelemetry/propagator-jaeger@2.10.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) '@opentelemetry/resources@2.0.1(@opentelemetry/api@1.9.1)': dependencies: @@ -8418,6 +8374,12 @@ snapshots: '@opentelemetry/core': 2.0.1(@opentelemetry/api@1.9.1) '@opentelemetry/semantic-conventions': 1.40.0 + '@opentelemetry/resources@2.10.0(@opentelemetry/api@1.9.1)': + dependencies: + '@opentelemetry/api': 1.9.1 + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/semantic-conventions': 1.40.0 + '@opentelemetry/resources@2.7.1(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 @@ -8431,12 +8393,12 @@ snapshots: '@opentelemetry/core': 2.0.1(@opentelemetry/api@1.9.1) '@opentelemetry/resources': 2.0.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-logs@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/sdk-logs@0.221.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/api-logs': 0.217.0 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/api-logs': 0.221.0 + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/resources': 2.10.0(@opentelemetry/api@1.9.1) '@opentelemetry/semantic-conventions': 1.40.0 '@opentelemetry/sdk-metrics@2.0.1(@opentelemetry/api@1.9.1)': @@ -8445,39 +8407,41 @@ snapshots: '@opentelemetry/core': 2.0.1(@opentelemetry/api@1.9.1) '@opentelemetry/resources': 2.0.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-metrics@2.7.1(@opentelemetry/api@1.9.1)': + '@opentelemetry/sdk-metrics@2.10.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/resources': 2.10.0(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-node@0.217.0(@opentelemetry/api@1.9.1)': + '@opentelemetry/sdk-node@0.221.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/api-logs': 0.217.0 - '@opentelemetry/configuration': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/context-async-hooks': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-logs-otlp-grpc': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-logs-otlp-http': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-logs-otlp-proto': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-metrics-otlp-grpc': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-metrics-otlp-http': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-metrics-otlp-proto': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-prometheus': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-trace-otlp-grpc': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-trace-otlp-http': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-trace-otlp-proto': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/exporter-zipkin': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/instrumentation': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/otlp-exporter-base': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/propagator-b3': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/propagator-jaeger': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-logs': 0.217.0(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-metrics': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-trace-base': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-trace-node': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/api-logs': 0.221.0 + '@opentelemetry/configuration': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/context-async-hooks': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/exporter-logs-otlp-grpc': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/exporter-logs-otlp-http': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/exporter-logs-otlp-proto': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/exporter-metrics-otlp-grpc': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/exporter-metrics-otlp-http': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/exporter-metrics-otlp-proto': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/exporter-prometheus': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/exporter-trace-otlp-grpc': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/exporter-trace-otlp-http': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/exporter-trace-otlp-proto': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/exporter-zipkin': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/instrumentation': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/otlp-grpc-exporter-base': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/propagator-b3': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/propagator-jaeger': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/resources': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-logs': 0.221.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-metrics': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-trace': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-trace-base': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-trace-node': 2.10.0(@opentelemetry/api@1.9.1) '@opentelemetry/semantic-conventions': 1.40.0 transitivePeerDependencies: - supports-color @@ -8489,19 +8453,27 @@ snapshots: '@opentelemetry/resources': 2.0.1(@opentelemetry/api@1.9.1) '@opentelemetry/semantic-conventions': 1.40.0 - '@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1)': + '@opentelemetry/sdk-trace-base@2.10.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/resources': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-trace': 2.10.0(@opentelemetry/api@1.9.1) '@opentelemetry/semantic-conventions': 1.40.0 - '@opentelemetry/sdk-trace-node@2.7.1(@opentelemetry/api@1.9.1)': + '@opentelemetry/sdk-trace-node@2.10.0(@opentelemetry/api@1.9.1)': dependencies: '@opentelemetry/api': 1.9.1 - '@opentelemetry/context-async-hooks': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1) - '@opentelemetry/sdk-trace-base': 2.7.1(@opentelemetry/api@1.9.1) + '@opentelemetry/context-async-hooks': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/sdk-trace-base': 2.10.0(@opentelemetry/api@1.9.1) + + '@opentelemetry/sdk-trace@2.10.0(@opentelemetry/api@1.9.1)': + dependencies: + '@opentelemetry/api': 1.9.1 + '@opentelemetry/core': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/resources': 2.10.0(@opentelemetry/api@1.9.1) + '@opentelemetry/semantic-conventions': 1.40.0 '@opentelemetry/semantic-conventions@1.40.0': {} @@ -8551,8 +8523,6 @@ snapshots: '@protobufjs/float@1.0.2': {} - '@protobufjs/inquire@1.1.2': {} - '@protobufjs/path@1.1.2': {} '@protobufjs/pool@1.1.0': {} @@ -10386,12 +10356,12 @@ snapshots: dependencies: once: 1.4.0 - engine.io-client@6.6.4: + engine.io-client@6.6.6: dependencies: '@socket.io/component-emitter': 3.1.2 debug: 4.4.3 engine.io-parser: 5.2.3 - ws: 8.18.3 + ws: 8.21.3 xmlhttprequest-ssl: 2.1.2 transitivePeerDependencies: - bufferutil @@ -10508,6 +10478,8 @@ snapshots: es-module-lexer@2.3.1: {} + es-module-lexer@2.3.2: {} + es-object-atoms@1.1.1: dependencies: es-errors: 1.3.0 @@ -11301,7 +11273,7 @@ snapshots: google-gax@4.6.1: dependencies: - '@grpc/grpc-js': 1.14.3 + '@grpc/grpc-js': 1.14.4 '@grpc/proto-loader': 0.7.15 '@types/long': 4.0.2 abort-controller: 3.0.0 @@ -11498,7 +11470,7 @@ snapshots: import-in-the-middle@3.3.3: dependencies: cjs-module-lexer: 2.2.1 - es-module-lexer: 2.3.1 + es-module-lexer: 2.3.2 module-details-from-path: 1.0.4 import-local@3.2.0: @@ -12946,21 +12918,6 @@ snapshots: '@types/node': 20.19.39 long: 5.3.2 - protobufjs@8.0.1: - dependencies: - '@protobufjs/aspromise': 1.1.2 - '@protobufjs/base64': 1.1.2 - '@protobufjs/codegen': 2.0.5 - '@protobufjs/eventemitter': 1.1.1 - '@protobufjs/fetch': 1.1.1 - '@protobufjs/float': 1.0.2 - '@protobufjs/inquire': 1.1.2 - '@protobufjs/path': 1.1.2 - '@protobufjs/pool': 1.1.0 - '@protobufjs/utf8': 1.1.2 - '@types/node': 20.19.39 - long: 5.3.2 - proxy-addr@2.0.7: dependencies: forwarded: 0.2.0 @@ -13480,20 +13437,13 @@ snapshots: dependencies: '@socket.io/component-emitter': 3.1.2 debug: 4.4.3 - engine.io-client: 6.6.4 - socket.io-parser: 4.2.6 + engine.io-client: 6.6.6 + socket.io-parser: 4.2.7 transitivePeerDependencies: - bufferutil - supports-color - utf-8-validate - socket.io-parser@4.2.6: - dependencies: - '@socket.io/component-emitter': 3.1.2 - debug: 4.4.3 - transitivePeerDependencies: - - supports-color - socket.io-parser@4.2.7: dependencies: '@socket.io/component-emitter': 3.1.2 @@ -14334,8 +14284,6 @@ snapshots: ws@8.16.0: {} - ws@8.18.3: {} - ws@8.20.0: {} ws@8.21.3: {} From 87aec98f54da8a81fbc1ff62f53c44538c0e559c Mon Sep 17 00:00:00 2001 From: Ajay Jadhav Date: Wed, 26 Aug 2026 18:06:04 +0530 Subject: [PATCH 04/11] fix(deps): add pnpm.overrides for transitive vulnerability fixes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Force safe versions of transitive dependencies that haven't been updated by their parent packages: - brace-expansion 2.x → 2.1.4 (fixes 6 HIGH: DoS via unbounded arrays) - tar-fs 3.x → 3.1.3 (fixes 3 HIGH: symlink/path traversal) - ip-address 10.x → 10.5.0 (fixes 3 HIGH/MEDIUM: SSRF, trust-boundary bypass) Not overridden (already at safe versions): - minimatch: installed 8.x, vuln only affects >=9.0.0 - fast-uri: installed 3.1.5, already patched - js-yaml: installed 4.x, vuln only affects >=5.0.0 Refs: #1728 Signed-off-by: Ajay Jadhav --- package.json | 7 ++++++ pnpm-lock.yaml | 59 +++++++++++++++++++++++--------------------------- 2 files changed, 34 insertions(+), 32 deletions(-) diff --git a/package.json b/package.json index dc985c325..50405ce6a 100644 --- a/package.json +++ b/package.json @@ -206,6 +206,13 @@ "^@credebl/storage(|/.*)$": "/libs/storage/src/$1" } }, + "pnpm": { + "overrides": { + "brace-expansion@2": "2.1.4", + "tar-fs@>=3.0.0 <3.1.1": "3.1.3", + "ip-address@<=10.3.0": "10.5.0" + } + }, "packageManager": "pnpm@9.15.3+sha512.1f79bc245a66eb0b07c5d4d83131240774642caaa86ef7d0434ab47c0d16f66b04e21e0c086eb61e62c77efc4d7f7ec071afad3796af64892fae66509173893a", "engines": { "node": ">=18" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 7da07a00c..2a29cc212 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -73,6 +73,11 @@ catalogs: specifier: ^4.0.4 version: 4.1.0 +overrides: + brace-expansion@2: 2.1.4 + tar-fs@>=3.0.0 <3.1.1: 3.1.3 + ip-address@<=10.3.0: 10.5.0 + importers: .: @@ -2819,14 +2824,11 @@ packages: bowser@2.14.1: resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==} - brace-expansion@1.1.14: - resolution: {integrity: sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==} - - brace-expansion@2.1.0: - resolution: {integrity: sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==} + brace-expansion@1.1.18: + resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} - brace-expansion@2.1.2: - resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==} + brace-expansion@2.1.4: + resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} brace-expansion@5.0.9: resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} @@ -4230,8 +4232,8 @@ packages: resolution: {integrity: sha512-HuEDBTI70aYdx1v6U97SbNx9F1+svQKBDo30o0b9fw055LMepzpOOd0Ccg9Q6tbqmBSJaMuY0fB7yw9/vjBYCA==} engines: {node: '>=12.22.0'} - ip-address@10.2.0: - resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==} + ip-address@10.5.0: + resolution: {integrity: sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -4954,9 +4956,6 @@ packages: mitt@3.0.1: resolution: {integrity: sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw==} - mkdirp-classic@0.5.3: - resolution: {integrity: sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==} - mkdirp@0.5.6: resolution: {integrity: sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==} hasBin: true @@ -6063,8 +6062,8 @@ packages: resolution: {integrity: sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==} engines: {node: '>=6'} - tar-fs@3.0.4: - resolution: {integrity: sha512-5AFQU8b9qLfZCX9zp2duONhPmZv0hGYiBPJsyUdqMjzq/mqVpy/rEUSeHk1+YitmxugaptgBh5oDGU3VsAJq4w==} + tar-fs@3.1.3: + resolution: {integrity: sha512-/hU4AXnIdZu+Gvl1pk0oI5f5HxWsCJRtY2aFaJdk9VvyL48DWU6iU5WAIPG+wIi1YvWA6eTJvIviP/tMAZZNwQ==} tar-stream@3.2.0: resolution: {integrity: sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg==} @@ -8535,7 +8534,7 @@ snapshots: extract-zip: 2.0.1 progress: 2.0.3 proxy-agent: 6.3.0 - tar-fs: 3.0.4 + tar-fs: 3.1.3 unbzip2-stream: 1.4.3 yargs: 17.7.1 transitivePeerDependencies: @@ -8550,7 +8549,7 @@ snapshots: extract-zip: 2.0.1 progress: 2.0.3 proxy-agent: 6.3.1 - tar-fs: 3.0.4 + tar-fs: 3.1.3 unbzip2-stream: 1.4.3 yargs: 17.7.2 transitivePeerDependencies: @@ -9784,16 +9783,12 @@ snapshots: bowser@2.14.1: {} - brace-expansion@1.1.14: + brace-expansion@1.1.18: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.0: - dependencies: - balanced-match: 1.0.2 - - brace-expansion@2.1.2: + brace-expansion@2.1.4: dependencies: balanced-match: 1.0.2 @@ -11509,7 +11504,7 @@ snapshots: transitivePeerDependencies: - supports-color - ip-address@10.2.0: {} + ip-address@10.5.0: {} ipaddr.js@1.9.1: {} @@ -12369,19 +12364,19 @@ snapshots: minimatch@3.1.5: dependencies: - brace-expansion: 1.1.14 + brace-expansion: 1.1.18 minimatch@8.0.7: dependencies: - brace-expansion: 2.1.0 + brace-expansion: 2.1.4 minimatch@9.0.3: dependencies: - brace-expansion: 2.1.0 + brace-expansion: 2.1.4 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.2 + brace-expansion: 2.1.4 minimist@1.2.8: {} @@ -12391,8 +12386,6 @@ snapshots: mitt@3.0.1: {} - mkdirp-classic@0.5.3: {} - mkdirp@0.5.6: dependencies: minimist: 1.2.8 @@ -13475,7 +13468,7 @@ snapshots: socks@2.8.8: dependencies: - ip-address: 10.2.0 + ip-address: 10.5.0 smart-buffer: 4.2.0 source-map-support@0.5.13: @@ -13682,11 +13675,13 @@ snapshots: tapable@2.3.3: {} - tar-fs@3.0.4: + tar-fs@3.1.3: dependencies: - mkdirp-classic: 0.5.3 pump: 3.0.4 tar-stream: 3.2.0 + optionalDependencies: + bare-fs: 4.7.1 + bare-path: 3.0.0 transitivePeerDependencies: - bare-abort-controller - bare-buffer From 247cc35790d5d83a9599fbabd88c92abf571a72c Mon Sep 17 00:00:00 2001 From: Ajay Jadhav Date: Thu, 27 Aug 2026 02:19:33 +0530 Subject: [PATCH 05/11] fix(security): override transitive deps for CRITICAL/HIGH vulns MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds pnpm overrides to force patched versions of transitive dependencies: - websocket-driver: 0.7.4 → 0.7.5 (CRITICAL: buffer overflow) - handlebars: 4.7.8 → 4.7.9 (CRITICAL: prototype pollution) - fast-uri: 3.1.2 → 3.1.6 (HIGH: URI parsing) All three are transitive deps that cannot be bumped via direct dependency updates. Overrides are scoped to affected version ranges to minimize blast radius. Refs: #1728, #1730 Signed-off-by: Ajay Jadhav --- package.json | 5 ++++- pnpm-lock.yaml | 42 +++++++++++++----------------------------- 2 files changed, 17 insertions(+), 30 deletions(-) diff --git a/package.json b/package.json index 50405ce6a..6700ffb7e 100644 --- a/package.json +++ b/package.json @@ -210,7 +210,10 @@ "overrides": { "brace-expansion@2": "2.1.4", "tar-fs@>=3.0.0 <3.1.1": "3.1.3", - "ip-address@<=10.3.0": "10.5.0" + "ip-address@<=10.3.0": "10.5.0", + "websocket-driver@<0.7.5": "0.7.5", + "handlebars@<4.7.9": "4.7.9", + "fast-uri@<3.1.6": "3.1.6" } }, "packageManager": "pnpm@9.15.3+sha512.1f79bc245a66eb0b07c5d4d83131240774642caaa86ef7d0434ab47c0d16f66b04e21e0c086eb61e62c77efc4d7f7ec071afad3796af64892fae66509173893a", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 2a29cc212..875080540 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -77,6 +77,9 @@ overrides: brace-expansion@2: 2.1.4 tar-fs@>=3.0.0 <3.1.1: 3.1.3 ip-address@<=10.3.0: 10.5.0 + websocket-driver@<0.7.5: 0.7.5 + handlebars@<4.7.9: 4.7.9 + fast-uri@<3.1.6: 3.1.6 importers: @@ -3737,11 +3740,8 @@ packages: fast-sha256@1.3.0: resolution: {integrity: sha512-n11RGP/lrWEFI/bWdygLxhI+pVeo1ZYIVwvvPkW7azl/rOy+F3HYRZ2K5zeE9mmkhQppyv9sQFx0JM9UabnpPQ==} - fast-uri@3.1.2: - resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} - - fast-uri@3.1.5: - resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} + fast-uri@3.1.6: + resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==} fast-xml-builder@1.1.9: resolution: {integrity: sha512-jcyKVSEX13iseJqg7n/KWw+xnu/7fdrZ333Fac54KjHDIELVCfDDJXYIm6DTJ0Su4gSzrhqiK0DzY/wZbF40mw==} @@ -4055,11 +4055,6 @@ packages: resolution: {integrity: sha512-pCcEwRi+TKpMlxAQObHDQ56KawURgyAf6jtIY046fJ5tIv3zDe/LEIubckAO8fj6JnAxLdmWkUfNyulQ2iKdEw==} engines: {node: '>=14.0.0'} - handlebars@4.7.8: - resolution: {integrity: sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==} - engines: {node: '>=0.4.7'} - hasBin: true - handlebars@4.7.9: resolution: {integrity: sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==} engines: {node: '>=0.4.7'} @@ -6534,8 +6529,8 @@ packages: webpack-cli: optional: true - websocket-driver@0.7.4: - resolution: {integrity: sha512-b17KeDIQVjvb0ssuSDF2cYXSg2iztliJ4B9WdsuB6J952qCPKmnVq4DyW5motImXHDC1cBT/1UezrJVsKw5zjg==} + websocket-driver@0.7.5: + resolution: {integrity: sha512-ZL2+3c7kMBdIRCMz6l8jQMHyGVxj+UL+xVk74Ombiciboca8rHa15L86B19E5oh1pL9Ii/uj54gtsIrZGMo6zA==} engines: {node: '>=0.8.0'} websocket-extensions@0.1.4: @@ -9434,14 +9429,14 @@ snapshots: ajv@8.18.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.2 + fast-uri: 3.1.6 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.5 + fast-uri: 3.1.6 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -10845,9 +10840,7 @@ snapshots: fast-sha256@1.3.0: {} - fast-uri@3.1.2: {} - - fast-uri@3.1.5: {} + fast-uri@3.1.6: {} fast-xml-builder@1.1.9: dependencies: @@ -10874,7 +10867,7 @@ snapshots: faye-websocket@0.11.4: dependencies: - websocket-driver: 0.7.4 + websocket-driver: 0.7.5 fb-watchman@2.0.2: dependencies: @@ -11305,15 +11298,6 @@ snapshots: - supports-color optional: true - handlebars@4.7.8: - dependencies: - minimist: 1.2.8 - neo-async: 2.6.2 - source-map: 0.6.1 - wordwrap: 1.0.0 - optionalDependencies: - uglify-js: 3.19.3 - handlebars@4.7.9: dependencies: minimist: 1.2.8 @@ -12512,7 +12496,7 @@ snapshots: node-html-to-image@4.0.0: dependencies: - handlebars: 4.7.8 + handlebars: 4.7.9 puppeteer: 21.0.1 puppeteer-cluster: 0.23.0(puppeteer@21.0.1) transitivePeerDependencies: @@ -14153,7 +14137,7 @@ snapshots: - postcss - uglify-js - websocket-driver@0.7.4: + websocket-driver@0.7.5: dependencies: http-parser-js: 0.5.10 safe-buffer: 5.2.1 From 47844ebbd8c3972d49f105f51fdfe4c058218829 Mon Sep 17 00:00:00 2001 From: Ajay Jadhav Date: Thu, 27 Aug 2026 02:34:17 +0530 Subject: [PATCH 06/11] fix(security): override transitive deps for remaining MEDIUM/LOW vulns MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds pnpm overrides to force patched versions of remaining vulnerable transitive dependencies: - js-yaml: 3.15.1 → 4.3.2 (HIGH/MEDIUM: ReDoS in flow collections, merge keys) - minimatch: 9.0.3 → 9.0.9 (HIGH: ReDoS via multiple wildcards) - form-data: 2.3.3 → 2.5.6 (CRITICAL/HIGH: unsafe random, CRLF injection) - @babel/core: 7.29.0 → 7.29.6 (LOW: arbitrary file read via sourcemap) js-yaml and @babel/core overrides are dev-only (jest/istanbul). All overrides are scoped to affected version ranges. Refs: #1728, #1730 Signed-off-by: Ajay Jadhav --- package.json | 6 +- pnpm-lock.yaml | 362 ++++++++++++++++++++++--------------------------- 2 files changed, 168 insertions(+), 200 deletions(-) diff --git a/package.json b/package.json index 6700ffb7e..be5910daf 100644 --- a/package.json +++ b/package.json @@ -213,7 +213,11 @@ "ip-address@<=10.3.0": "10.5.0", "websocket-driver@<0.7.5": "0.7.5", "handlebars@<4.7.9": "4.7.9", - "fast-uri@<3.1.6": "3.1.6" + "fast-uri@<3.1.6": "3.1.6", + "js-yaml@<4.3.2": "4.3.2", + "minimatch@<9.0.7": "9.0.9", + "form-data@<2.5.6": "2.5.6", + "@babel/core@<7.29.6": "7.29.6" } }, "packageManager": "pnpm@9.15.3+sha512.1f79bc245a66eb0b07c5d4d83131240774642caaa86ef7d0434ab47c0d16f66b04e21e0c086eb61e62c77efc4d7f7ec071afad3796af64892fae66509173893a", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 875080540..ad59128c1 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -80,6 +80,10 @@ overrides: websocket-driver@<0.7.5: 0.7.5 handlebars@<4.7.9: 4.7.9 fast-uri@<3.1.6: 3.1.6 + js-yaml@<4.3.2: 4.3.2 + minimatch@<9.0.7: 9.0.9 + form-data@<2.5.6: 2.5.6 + '@babel/core@<7.29.6': 7.29.6 importers: @@ -460,7 +464,7 @@ importers: version: 7.2.2 ts-jest: specifier: ^29.4.12 - version: 29.4.12(@babel/core@7.29.0)(@jest/transform@29.7.0)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.0))(jest-util@29.7.0)(jest@29.7.0(@types/node@20.19.39)(ts-node@10.9.2(@types/node@20.19.39)(typescript@5.9.3)))(typescript@5.9.3) + version: 29.4.12(@babel/core@7.29.6)(@jest/transform@29.7.0)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.6))(jest-util@29.7.0)(jest@29.7.0(@types/node@20.19.39)(ts-node@10.9.2(@types/node@20.19.39)(typescript@5.9.3)))(typescript@5.9.3) ts-loader: specifier: ^9.5.4 version: 9.5.7(typescript@5.9.3)(webpack@5.106.2) @@ -739,14 +743,18 @@ packages: resolution: {integrity: sha512-LIVqM46zQWZhj17qA8wb4nW/ixr2y1Nw+r1etiAWgRM6U1IqP+LNhL1yg440jYZR72jCWcWbLWzIosH+uP1fqg==} engines: {node: '>=6.9.0'} - '@babel/core@7.29.0': - resolution: {integrity: sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==} + '@babel/core@7.29.6': + resolution: {integrity: sha512-QdxmAo/ikZqqRGA8s43ww8lcql6naWRvEz0FFrl6MIlc7Gi6TroXnSdWa5U/kq6fzcpqpHesicQxFZIieZbyIA==} engines: {node: '>=6.9.0'} '@babel/generator@7.29.1': resolution: {integrity: sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==} engines: {node: '>=6.9.0'} + '@babel/generator@7.29.8': + resolution: {integrity: sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==} + engines: {node: '>=6.9.0'} + '@babel/helper-compilation-targets@7.28.6': resolution: {integrity: sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==} engines: {node: '>=6.9.0'} @@ -763,7 +771,7 @@ packages: resolution: {integrity: sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==} engines: {node: '>=6.9.0'} peerDependencies: - '@babel/core': ^7.0.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils@7.28.6': resolution: {integrity: sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==} @@ -773,6 +781,10 @@ packages: resolution: {integrity: sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==} engines: {node: '>=6.9.0'} + '@babel/helper-string-parser@7.29.7': + resolution: {integrity: sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==} + engines: {node: '>=6.9.0'} + '@babel/helper-validator-identifier@7.28.5': resolution: {integrity: sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==} engines: {node: '>=6.9.0'} @@ -794,96 +806,101 @@ packages: engines: {node: '>=6.0.0'} hasBin: true + '@babel/parser@7.29.8': + resolution: {integrity: sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==} + engines: {node: '>=6.0.0'} + hasBin: true + '@babel/plugin-syntax-async-generators@7.8.4': resolution: {integrity: sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-bigint@7.8.3': resolution: {integrity: sha512-wnTnFlG+YxQm3vDxpGE57Pj0srRU4sHE/mDkt1qv2YJJSeUAec2ma4WLUnUPeKjyrfntVwe/N6dCXpU+zL3Npg==} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-class-properties@7.12.13': resolution: {integrity: sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-class-static-block@7.14.5': resolution: {integrity: sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw==} engines: {node: '>=6.9.0'} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-import-attributes@7.28.6': resolution: {integrity: sha512-jiLC0ma9XkQT3TKJ9uYvlakm66Pamywo+qwL+oL8HJOvc6TWdZXVfhqJr8CCzbSGUAbDOzlGHJC1U+vRfLQDvw==} engines: {node: '>=6.9.0'} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-import-meta@7.10.4': resolution: {integrity: sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-json-strings@7.8.3': resolution: {integrity: sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-jsx@7.28.6': resolution: {integrity: sha512-wgEmr06G6sIpqr8YDwA2dSRTE3bJ+V0IfpzfSY3Lfgd7YWOaAdlykvJi13ZKBt8cZHfgH1IXN+CL656W3uUa4w==} engines: {node: '>=6.9.0'} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-logical-assignment-operators@7.10.4': resolution: {integrity: sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-nullish-coalescing-operator@7.8.3': resolution: {integrity: sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-numeric-separator@7.10.4': resolution: {integrity: sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-object-rest-spread@7.8.3': resolution: {integrity: sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-optional-catch-binding@7.8.3': resolution: {integrity: sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-optional-chaining@7.8.3': resolution: {integrity: sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-private-property-in-object@7.14.5': resolution: {integrity: sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg==} engines: {node: '>=6.9.0'} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-top-level-await@7.14.5': resolution: {integrity: sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==} engines: {node: '>=6.9.0'} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/plugin-syntax-typescript@7.28.6': resolution: {integrity: sha512-+nDNmQye7nlnuuHDboPbGm00Vqg3oO8niRRL27/4LYHUsHYh0zJ1xWOz0uRwNFmM1Avzk8wZbc6rdiYhomzv/A==} engines: {node: '>=6.9.0'} peerDependencies: - '@babel/core': ^7.0.0-0 + '@babel/core': 7.29.6 '@babel/template@7.28.6': resolution: {integrity: sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==} @@ -897,6 +914,10 @@ packages: resolution: {integrity: sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==} engines: {node: '>=6.9.0'} + '@babel/types@7.29.8': + resolution: {integrity: sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==} + engines: {node: '>=6.9.0'} + '@bcoe/v8-coverage@0.2.3': resolution: {integrity: sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==} @@ -2594,9 +2615,6 @@ packages: arg@4.1.3: resolution: {integrity: sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==} - argparse@1.0.10: - resolution: {integrity: sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==} - argparse@2.0.1: resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==} @@ -2698,7 +2716,7 @@ packages: resolution: {integrity: sha512-BrvGY3xZSwEcCzKvKsCi2GgHqDqsYkOP4/by5xCgIwGXQxIEh+8ew3gmrE1y7XRR6LHZIj6yLYnUi/mm2KXKBg==} engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0} peerDependencies: - '@babel/core': ^7.8.0 + '@babel/core': 7.29.6 babel-plugin-istanbul@6.1.1: resolution: {integrity: sha512-Y1IQok9821cC9onCx5otgFfRm7Lm+I+wwxOx738M/WLPZ9Q42m4IG5W0FNX8WLL2gYMZo3JkuXIH2DOpWM+qwA==} @@ -2711,13 +2729,13 @@ packages: babel-preset-current-node-syntax@1.2.0: resolution: {integrity: sha512-E/VlAEzRrsLEb2+dv8yp3bo4scof3l9nR4lrld+Iy5NyVqgVYUJnDAmunkhPMisRI32Qc4iRiz425d8vM++2fg==} peerDependencies: - '@babel/core': ^7.0.0 || ^8.0.0-0 + '@babel/core': 7.29.6 babel-preset-jest@29.6.3: resolution: {integrity: sha512-0B3bhxR6snWXJZtR/RliHTDPRgn1sNHOR0yVtq/IiQFyuOVjFS+wuio/R4gSNkyYmKmJB4wGZv2NZanmKmTnNA==} engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0} peerDependencies: - '@babel/core': ^7.0.0 + '@babel/core': 7.29.6 balanced-match@1.0.2: resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} @@ -2827,9 +2845,6 @@ packages: bowser@2.14.1: resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==} - brace-expansion@1.1.18: - resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} - brace-expansion@2.1.4: resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} @@ -3082,9 +3097,6 @@ packages: component-emitter@1.3.1: resolution: {integrity: sha512-T0+barUSQRTUQASh8bx02dl+DhF54GtIDY13Y3m9oWTklKbb3Wv974meRpeZ3lp1JpLVECWWNHC4vaG2XHXouQ==} - concat-map@0.0.1: - resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==} - concat-stream@1.6.2: resolution: {integrity: sha512-27HBghJxjiZtIk3Ycvn/4kbJk/1uZuJFfuPEns6LaEvpvG1f0hTea8lilrouyo9mVc2GWdcEZ8OLoGmSADlrCw==} engines: {'0': node >= 0.8} @@ -3845,10 +3857,6 @@ packages: typescript: '>3.6.0' webpack: ^5.11.0 - form-data@2.3.3: - resolution: {integrity: sha512-1lLKB2Mu3aGP1Q/2eCOx0fNbRMe7XdwktwOruhfqqd0rIJWwN4Dh+E3hrPSlDCXnSR7UtZ1N38rVXm+6+MEhJQ==} - engines: {node: '>= 0.12'} - form-data@2.5.6: resolution: {integrity: sha512-Ogz/E85h9tlfJzpI6TuFpGcHZFhLrb9Gw8wq9v40CxSCPnv7ahKr6Xgtkn0KYCDQJ8DNn5VoMO8EXr9V5PadyA==} engines: {node: '>= 0.12'} @@ -4570,16 +4578,8 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@3.15.1: - resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==} - hasBin: true - - js-yaml@4.1.1: - resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==} - hasBin: true - - js-yaml@4.3.1: - resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} + js-yaml@4.3.2: + resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} hasBin: true js-yaml@5.2.1: @@ -4922,17 +4922,6 @@ packages: resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==} engines: {node: 18 || 20 || >=22} - minimatch@3.1.5: - resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==} - - minimatch@8.0.7: - resolution: {integrity: sha512-V+1uQNdzybxa14e/p00HZnQNNcTjnRJjDxg2V8wtkjFctq4M7hXFws4oekyTP0Jebeq7QYtpFyOeBAjc88zvYg==} - engines: {node: '>=16 || 14 >=14.17'} - - minimatch@9.0.3: - resolution: {integrity: sha512-RHiac9mvaRw0x3AYRgDC1CxAP7HTcNrrECeA8YYJeWnpo+2Q5CegtZjaotWTWxDG3UeGA1coE05iH1mPjT/2mg==} - engines: {node: '>=16 || 14 >=14.17'} - minimatch@9.0.9: resolution: {integrity: sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==} engines: {node: '>=16 || 14 >=14.17'} @@ -5896,9 +5885,6 @@ packages: resolution: {integrity: sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==} engines: {node: '>= 10.x'} - sprintf-js@1.0.3: - resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==} - sql-highlight@6.1.0: resolution: {integrity: sha512-ed7OK4e9ywpE7pgRMkMQmZDPKSVdm0oX5IEtZiKnFucSF0zu6c80GZBe38UqHuVhTWJ9xsKgSMjCG2bml86KvA==} engines: {node: '>=14'} @@ -6184,7 +6170,7 @@ packages: engines: {node: ^14.15.0 || ^16.10.0 || ^18.0.0 || >=20.0.0} hasBin: true peerDependencies: - '@babel/core': '>=7.0.0-beta.0 <8' + '@babel/core': 7.29.6 '@jest/transform': ^29.0.0 || ^30.0.0 '@jest/types': ^29.0.0 || ^30.0.0 babel-jest: ^29.0.0 || ^30.0.0 @@ -7167,12 +7153,12 @@ snapshots: '@babel/compat-data@7.29.3': {} - '@babel/core@7.29.0': + '@babel/core@7.29.6': dependencies: '@babel/code-frame': 7.29.7 - '@babel/generator': 7.29.1 + '@babel/generator': 7.29.8 '@babel/helper-compilation-targets': 7.28.6 - '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0) + '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.6) '@babel/helpers': 7.29.2 '@babel/parser': 7.29.3 '@babel/template': 7.28.6 @@ -7195,6 +7181,14 @@ snapshots: '@jridgewell/trace-mapping': 0.3.31 jsesc: 3.1.0 + '@babel/generator@7.29.8': + dependencies: + '@babel/parser': 7.29.8 + '@babel/types': 7.29.8 + '@jridgewell/gen-mapping': 0.3.13 + '@jridgewell/trace-mapping': 0.3.31 + jsesc: 3.1.0 + '@babel/helper-compilation-targets@7.28.6': dependencies: '@babel/compat-data': 7.29.3 @@ -7212,9 +7206,9 @@ snapshots: transitivePeerDependencies: - supports-color - '@babel/helper-module-transforms@7.28.6(@babel/core@7.29.0)': + '@babel/helper-module-transforms@7.28.6(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-module-imports': 7.28.6 '@babel/helper-validator-identifier': 7.29.7 '@babel/traverse': 7.29.0 @@ -7225,6 +7219,8 @@ snapshots: '@babel/helper-string-parser@7.27.1': {} + '@babel/helper-string-parser@7.29.7': {} + '@babel/helper-validator-identifier@7.28.5': {} '@babel/helper-validator-identifier@7.29.7': {} @@ -7240,89 +7236,93 @@ snapshots: dependencies: '@babel/types': 7.29.0 - '@babel/plugin-syntax-async-generators@7.8.4(@babel/core@7.29.0)': + '@babel/parser@7.29.8': dependencies: - '@babel/core': 7.29.0 + '@babel/types': 7.29.8 + + '@babel/plugin-syntax-async-generators@7.8.4(@babel/core@7.29.6)': + dependencies: + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-bigint@7.8.3(@babel/core@7.29.0)': + '@babel/plugin-syntax-bigint@7.8.3(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-class-properties@7.12.13(@babel/core@7.29.0)': + '@babel/plugin-syntax-class-properties@7.12.13(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-class-static-block@7.14.5(@babel/core@7.29.0)': + '@babel/plugin-syntax-class-static-block@7.14.5(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-import-attributes@7.28.6(@babel/core@7.29.0)': + '@babel/plugin-syntax-import-attributes@7.28.6(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-import-meta@7.10.4(@babel/core@7.29.0)': + '@babel/plugin-syntax-import-meta@7.10.4(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-json-strings@7.8.3(@babel/core@7.29.0)': + '@babel/plugin-syntax-json-strings@7.8.3(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-jsx@7.28.6(@babel/core@7.29.0)': + '@babel/plugin-syntax-jsx@7.28.6(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-logical-assignment-operators@7.10.4(@babel/core@7.29.0)': + '@babel/plugin-syntax-logical-assignment-operators@7.10.4(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-nullish-coalescing-operator@7.8.3(@babel/core@7.29.0)': + '@babel/plugin-syntax-nullish-coalescing-operator@7.8.3(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-numeric-separator@7.10.4(@babel/core@7.29.0)': + '@babel/plugin-syntax-numeric-separator@7.10.4(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-object-rest-spread@7.8.3(@babel/core@7.29.0)': + '@babel/plugin-syntax-object-rest-spread@7.8.3(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-optional-catch-binding@7.8.3(@babel/core@7.29.0)': + '@babel/plugin-syntax-optional-catch-binding@7.8.3(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-optional-chaining@7.8.3(@babel/core@7.29.0)': + '@babel/plugin-syntax-optional-chaining@7.8.3(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-private-property-in-object@7.14.5(@babel/core@7.29.0)': + '@babel/plugin-syntax-private-property-in-object@7.14.5(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-top-level-await@7.14.5(@babel/core@7.29.0)': + '@babel/plugin-syntax-top-level-await@7.14.5(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 - '@babel/plugin-syntax-typescript@7.28.6(@babel/core@7.29.0)': + '@babel/plugin-syntax-typescript@7.28.6(@babel/core@7.29.6)': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/helper-plugin-utils': 7.28.6 '@babel/template@7.28.6': @@ -7334,7 +7334,7 @@ snapshots: '@babel/traverse@7.29.0': dependencies: '@babel/code-frame': 7.29.7 - '@babel/generator': 7.29.1 + '@babel/generator': 7.29.8 '@babel/helper-globals': 7.28.0 '@babel/parser': 7.29.3 '@babel/template': 7.28.6 @@ -7348,6 +7348,11 @@ snapshots: '@babel/helper-string-parser': 7.27.1 '@babel/helper-validator-identifier': 7.29.7 + '@babel/types@7.29.8': + dependencies: + '@babel/helper-string-parser': 7.29.7 + '@babel/helper-validator-identifier': 7.29.7 + '@bcoe/v8-coverage@0.2.3': {} '@borewit/text-codec@0.2.2': {} @@ -7382,8 +7387,8 @@ snapshots: globals: 13.24.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.3.1 - minimatch: 3.1.5 + js-yaml: 4.3.2 + minimatch: 9.0.9 strip-json-comments: 3.1.1 transitivePeerDependencies: - supports-color @@ -7507,7 +7512,7 @@ snapshots: dependencies: '@humanwhocodes/object-schema': 2.0.3 debug: 4.4.3 - minimatch: 3.1.5 + minimatch: 9.0.9 transitivePeerDependencies: - supports-color @@ -7671,7 +7676,7 @@ snapshots: camelcase: 5.3.1 find-up: 4.1.0 get-package-type: 0.1.0 - js-yaml: 3.15.1 + js-yaml: 4.3.2 resolve-from: 5.0.0 '@istanbuljs/schema@0.1.6': {} @@ -7811,7 +7816,7 @@ snapshots: '@jest/transform@29.7.0': dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@jest/types': 29.6.3 '@jridgewell/trace-mapping': 0.3.31 babel-plugin-istanbul: 6.1.1 @@ -9245,7 +9250,7 @@ snapshots: debug: 4.4.3 globby: 11.1.0 is-glob: 4.0.3 - minimatch: 9.0.3 + minimatch: 9.0.9 semver: 7.8.5 ts-api-utils: 1.4.3(typescript@5.9.3) optionalDependencies: @@ -9477,10 +9482,6 @@ snapshots: arg@4.1.3: {} - argparse@1.0.10: - dependencies: - sprintf-js: 1.0.3 - argparse@2.0.1: {} array-buffer-byte-length@1.0.2: @@ -9612,13 +9613,13 @@ snapshots: b4a@1.8.1: {} - babel-jest@29.7.0(@babel/core@7.29.0): + babel-jest@29.7.0(@babel/core@7.29.6): dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@jest/transform': 29.7.0 '@types/babel__core': 7.20.5 babel-plugin-istanbul: 6.1.1 - babel-preset-jest: 29.6.3(@babel/core@7.29.0) + babel-preset-jest: 29.6.3(@babel/core@7.29.6) chalk: 4.1.2 graceful-fs: 4.2.11 slash: 3.0.0 @@ -9642,30 +9643,30 @@ snapshots: '@types/babel__core': 7.20.5 '@types/babel__traverse': 7.28.0 - babel-preset-current-node-syntax@1.2.0(@babel/core@7.29.0): - dependencies: - '@babel/core': 7.29.0 - '@babel/plugin-syntax-async-generators': 7.8.4(@babel/core@7.29.0) - '@babel/plugin-syntax-bigint': 7.8.3(@babel/core@7.29.0) - '@babel/plugin-syntax-class-properties': 7.12.13(@babel/core@7.29.0) - '@babel/plugin-syntax-class-static-block': 7.14.5(@babel/core@7.29.0) - '@babel/plugin-syntax-import-attributes': 7.28.6(@babel/core@7.29.0) - '@babel/plugin-syntax-import-meta': 7.10.4(@babel/core@7.29.0) - '@babel/plugin-syntax-json-strings': 7.8.3(@babel/core@7.29.0) - '@babel/plugin-syntax-logical-assignment-operators': 7.10.4(@babel/core@7.29.0) - '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.29.0) - '@babel/plugin-syntax-numeric-separator': 7.10.4(@babel/core@7.29.0) - '@babel/plugin-syntax-object-rest-spread': 7.8.3(@babel/core@7.29.0) - '@babel/plugin-syntax-optional-catch-binding': 7.8.3(@babel/core@7.29.0) - '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.29.0) - '@babel/plugin-syntax-private-property-in-object': 7.14.5(@babel/core@7.29.0) - '@babel/plugin-syntax-top-level-await': 7.14.5(@babel/core@7.29.0) - - babel-preset-jest@29.6.3(@babel/core@7.29.0): - dependencies: - '@babel/core': 7.29.0 + babel-preset-current-node-syntax@1.2.0(@babel/core@7.29.6): + dependencies: + '@babel/core': 7.29.6 + '@babel/plugin-syntax-async-generators': 7.8.4(@babel/core@7.29.6) + '@babel/plugin-syntax-bigint': 7.8.3(@babel/core@7.29.6) + '@babel/plugin-syntax-class-properties': 7.12.13(@babel/core@7.29.6) + '@babel/plugin-syntax-class-static-block': 7.14.5(@babel/core@7.29.6) + '@babel/plugin-syntax-import-attributes': 7.28.6(@babel/core@7.29.6) + '@babel/plugin-syntax-import-meta': 7.10.4(@babel/core@7.29.6) + '@babel/plugin-syntax-json-strings': 7.8.3(@babel/core@7.29.6) + '@babel/plugin-syntax-logical-assignment-operators': 7.10.4(@babel/core@7.29.6) + '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.29.6) + '@babel/plugin-syntax-numeric-separator': 7.10.4(@babel/core@7.29.6) + '@babel/plugin-syntax-object-rest-spread': 7.8.3(@babel/core@7.29.6) + '@babel/plugin-syntax-optional-catch-binding': 7.8.3(@babel/core@7.29.6) + '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.29.6) + '@babel/plugin-syntax-private-property-in-object': 7.14.5(@babel/core@7.29.6) + '@babel/plugin-syntax-top-level-await': 7.14.5(@babel/core@7.29.6) + + babel-preset-jest@29.6.3(@babel/core@7.29.6): + dependencies: + '@babel/core': 7.29.6 babel-plugin-jest-hoist: 29.6.3 - babel-preset-current-node-syntax: 1.2.0(@babel/core@7.29.0) + babel-preset-current-node-syntax: 1.2.0(@babel/core@7.29.6) balanced-match@1.0.2: {} @@ -9778,11 +9779,6 @@ snapshots: bowser@2.14.1: {} - brace-expansion@1.1.18: - dependencies: - balanced-match: 1.0.2 - concat-map: 0.0.1 - brace-expansion@2.1.4: dependencies: balanced-match: 1.0.2 @@ -10035,8 +10031,6 @@ snapshots: component-emitter@1.3.1: {} - concat-map@0.0.1: {} - concat-stream@1.6.2: dependencies: buffer-from: 1.1.2 @@ -10086,14 +10080,14 @@ snapshots: cosmiconfig@8.2.0: dependencies: import-fresh: 3.3.1 - js-yaml: 4.3.1 + js-yaml: 4.3.2 parse-json: 5.2.0 path-type: 4.0.0 cosmiconfig@8.3.6(typescript@5.9.3): dependencies: import-fresh: 3.3.1 - js-yaml: 4.3.1 + js-yaml: 4.3.2 parse-json: 5.2.0 path-type: 4.0.0 optionalDependencies: @@ -10103,7 +10097,7 @@ snapshots: dependencies: env-paths: 2.2.1 import-fresh: 3.3.1 - js-yaml: 4.3.1 + js-yaml: 4.3.2 parse-json: 5.2.0 optionalDependencies: typescript: 5.9.3 @@ -10577,7 +10571,7 @@ snapshots: hasown: 2.0.3 is-core-module: 2.16.2 is-glob: 4.0.3 - minimatch: 3.1.5 + minimatch: 9.0.9 object.fromentries: 2.0.8 object.groupby: 1.0.3 object.values: 1.2.1 @@ -10599,7 +10593,7 @@ snapshots: eslint-utils: 3.0.0(eslint@8.57.1) ignore: 5.3.2 is-core-module: 2.16.2 - minimatch: 3.1.5 + minimatch: 9.0.9 resolve: 1.22.12 semver: 7.7.4 @@ -10671,11 +10665,11 @@ snapshots: imurmurhash: 0.1.4 is-glob: 4.0.3 is-path-inside: 3.0.3 - js-yaml: 4.1.1 + js-yaml: 4.3.2 json-stable-stringify-without-jsonify: 1.0.1 levn: 0.4.1 lodash.merge: 4.6.2 - minimatch: 3.1.5 + minimatch: 9.0.9 natural-compare: 1.4.0 optionator: 0.9.4 strip-ansi: 6.0.1 @@ -10990,7 +10984,7 @@ snapshots: deepmerge: 4.3.1 fs-extra: 10.1.0 memfs: 3.5.3 - minimatch: 3.1.5 + minimatch: 9.0.9 node-abort-controller: 3.1.1 schema-utils: 3.3.0 semver: 7.8.5 @@ -10998,13 +10992,6 @@ snapshots: typescript: 5.9.3 webpack: 5.106.2 - form-data@2.3.3: - dependencies: - asynckit: 0.4.0 - combined-stream: 1.0.8 - mime-types: 2.1.35 - optional: true - form-data@2.5.6: dependencies: asynckit: 0.4.0 @@ -11206,14 +11193,14 @@ snapshots: fs.realpath: 1.0.0 inflight: 1.0.6 inherits: 2.0.4 - minimatch: 3.1.5 + minimatch: 9.0.9 once: 1.4.0 path-is-absolute: 1.0.1 glob@9.3.5: dependencies: fs.realpath: 1.0.0 - minimatch: 8.0.7 + minimatch: 9.0.9 minipass: 4.2.8 path-scurry: 1.11.1 @@ -11644,7 +11631,7 @@ snapshots: istanbul-lib-instrument@5.2.1: dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/parser': 7.29.3 '@istanbuljs/schema': 0.1.6 istanbul-lib-coverage: 3.2.2 @@ -11654,7 +11641,7 @@ snapshots: istanbul-lib-instrument@6.0.3: dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/parser': 7.29.3 '@istanbuljs/schema': 0.1.6 istanbul-lib-coverage: 3.2.2 @@ -11742,10 +11729,10 @@ snapshots: jest-config@29.7.0(@types/node@20.19.39)(ts-node@10.9.2(@types/node@20.19.39)(typescript@5.9.3)): dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@jest/test-sequencer': 29.7.0 '@jest/types': 29.6.3 - babel-jest: 29.7.0(@babel/core@7.29.0) + babel-jest: 29.7.0(@babel/core@7.29.6) chalk: 4.1.2 ci-info: 3.9.0 deepmerge: 4.3.1 @@ -11927,15 +11914,15 @@ snapshots: jest-snapshot@29.7.0: dependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@babel/generator': 7.29.1 - '@babel/plugin-syntax-jsx': 7.28.6(@babel/core@7.29.0) - '@babel/plugin-syntax-typescript': 7.28.6(@babel/core@7.29.0) + '@babel/plugin-syntax-jsx': 7.28.6(@babel/core@7.29.6) + '@babel/plugin-syntax-typescript': 7.28.6(@babel/core@7.29.6) '@babel/types': 7.29.0 '@jest/expect-utils': 29.7.0 '@jest/transform': 29.7.0 '@jest/types': 29.6.3 - babel-preset-current-node-syntax: 1.2.0(@babel/core@7.29.0) + babel-preset-current-node-syntax: 1.2.0(@babel/core@7.29.6) chalk: 4.1.2 expect: 29.7.0 graceful-fs: 4.2.11 @@ -12010,16 +11997,7 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@3.15.1: - dependencies: - argparse: 1.0.10 - esprima: 4.0.1 - - js-yaml@4.1.1: - dependencies: - argparse: 2.0.1 - - js-yaml@4.3.1: + js-yaml@4.3.2: dependencies: argparse: 2.0.1 @@ -12346,18 +12324,6 @@ snapshots: dependencies: brace-expansion: 5.0.9 - minimatch@3.1.5: - dependencies: - brace-expansion: 1.1.18 - - minimatch@8.0.7: - dependencies: - brace-expansion: 2.1.4 - - minimatch@9.0.3: - dependencies: - brace-expansion: 2.1.4 - minimatch@9.0.9: dependencies: brace-expansion: 2.1.4 @@ -13117,7 +13083,7 @@ snapshots: combined-stream: 1.0.8 extend: 3.0.2 forever-agent: 0.6.1 - form-data: 2.3.3 + form-data: 2.5.6 har-validator: 5.1.5 http-signature: 1.2.0 is-typedarray: 1.0.0 @@ -13473,8 +13439,6 @@ snapshots: split2@4.2.0: {} - sprintf-js@1.0.3: {} - sql-highlight@6.1.0: {} sshpk@1.18.0: @@ -13724,7 +13688,7 @@ snapshots: dependencies: '@istanbuljs/schema': 0.1.6 glob: 7.2.3 - minimatch: 3.1.5 + minimatch: 9.0.9 text-decoder@1.2.7: dependencies: @@ -13777,7 +13741,7 @@ snapshots: dependencies: typescript: 5.9.3 - ts-jest@29.4.12(@babel/core@7.29.0)(@jest/transform@29.7.0)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.0))(jest-util@29.7.0)(jest@29.7.0(@types/node@20.19.39)(ts-node@10.9.2(@types/node@20.19.39)(typescript@5.9.3)))(typescript@5.9.3): + ts-jest@29.4.12(@babel/core@7.29.6)(@jest/transform@29.7.0)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.6))(jest-util@29.7.0)(jest@29.7.0(@types/node@20.19.39)(ts-node@10.9.2(@types/node@20.19.39)(typescript@5.9.3)))(typescript@5.9.3): dependencies: bs-logger: 0.2.6 fast-json-stable-stringify: 2.1.0 @@ -13791,10 +13755,10 @@ snapshots: typescript: 5.9.3 yargs-parser: 21.1.1 optionalDependencies: - '@babel/core': 7.29.0 + '@babel/core': 7.29.6 '@jest/transform': 29.7.0 '@jest/types': 29.6.3 - babel-jest: 29.7.0(@babel/core@7.29.0) + babel-jest: 29.7.0(@babel/core@7.29.6) jest-util: 29.7.0 ts-loader@9.5.7(typescript@5.9.3)(webpack@5.106.2): From dd05381e7917e9ccdbd9afe3200fd0d9572264c7 Mon Sep 17 00:00:00 2001 From: Ajay Jadhav Date: Thu, 27 Aug 2026 02:47:19 +0530 Subject: [PATCH 07/11] =?UTF-8?q?fix(security):=20P0+P1=20=E2=80=94=20rebu?= =?UTF-8?q?ild=20base=20images,=20bump=20pnpm?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit P0: Base image rebuild (19 Hub Dockerfiles) - node:24-alpine3.23 → node:24-alpine3.24 - Alpine 3.24 ships newer OpenSSL, musl, zlib, perl - apk upgrade already runs in all Dockerfiles P1: Package manager bump - pnpm 9.15.3 → 9.15.9 (latest 9.x patch, security fixes) - Updated package.json packageManager field to match Verifier images (credo-controller, verifier-service, trust-service, airport-service, consent-management) are in a separate repo and require coordinated Go/Debian base image rebuilds (tracked in #1730). Refs: #1730 Signed-off-by: Ajay Jadhav --- Dockerfiles/Dockerfile.agent-provisioning | 4 ++-- Dockerfiles/Dockerfile.agent-service | 6 +++--- Dockerfiles/Dockerfile.api-gateway | 6 +++--- Dockerfiles/Dockerfile.cloud-wallet | 6 +++--- Dockerfiles/Dockerfile.connection | 6 +++--- Dockerfiles/Dockerfile.ecosystem | 6 +++--- Dockerfiles/Dockerfile.geolocation | 6 +++--- Dockerfiles/Dockerfile.issuance | 6 +++--- Dockerfiles/Dockerfile.ledger | 6 +++--- Dockerfiles/Dockerfile.notification | 6 +++--- Dockerfiles/Dockerfile.oid4vc-issuance | 6 +++--- Dockerfiles/Dockerfile.oid4vc-verification | 6 +++--- Dockerfiles/Dockerfile.organization | 6 +++--- Dockerfiles/Dockerfile.seed | 4 ++-- Dockerfiles/Dockerfile.user | 6 +++--- Dockerfiles/Dockerfile.utility | 6 +++--- Dockerfiles/Dockerfile.verification | 6 +++--- Dockerfiles/Dockerfile.webhook | 6 +++--- Dockerfiles/Dockerfile.x509 | 6 +++--- package.json | 2 +- 20 files changed, 56 insertions(+), 56 deletions(-) diff --git a/Dockerfiles/Dockerfile.agent-provisioning b/Dockerfiles/Dockerfile.agent-provisioning index 1638e49ca..98d5610dd 100644 --- a/Dockerfiles/Dockerfile.agent-provisioning +++ b/Dockerfiles/Dockerfile.agent-provisioning @@ -1,5 +1,5 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build # Install OpenSSL RUN apk update && apk upgrade RUN apk add --no-cache openssl @@ -38,7 +38,7 @@ RUN ls -R /app/apps/agent-provisioning/AFJ/ RUN pnpm run build agent-provisioning # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 # Install OpenSSL RUN apk update && apk upgrade RUN apk add --no-cache openssl diff --git a/Dockerfiles/Dockerfile.agent-service b/Dockerfiles/Dockerfile.agent-service index b5efc4cdf..ebf0dfa0b 100644 --- a/Dockerfiles/Dockerfile.agent-service +++ b/Dockerfiles/Dockerfile.agent-service @@ -1,5 +1,5 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache \ openssl \ openssh-client \ @@ -7,7 +7,7 @@ RUN apk update && apk upgrade && apk add --no-cache \ docker \ docker-compose \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -18,7 +18,7 @@ RUN pnpm run build agent-service RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache \ openssl \ openssh-client \ diff --git a/Dockerfiles/Dockerfile.api-gateway b/Dockerfiles/Dockerfile.api-gateway index bcacea934..a93a3b538 100644 --- a/Dockerfiles/Dockerfile.api-gateway +++ b/Dockerfiles/Dockerfile.api-gateway @@ -1,8 +1,8 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -13,7 +13,7 @@ RUN pnpm run build api-gateway RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.cloud-wallet b/Dockerfiles/Dockerfile.cloud-wallet index e0067e31c..64f39c989 100644 --- a/Dockerfiles/Dockerfile.cloud-wallet +++ b/Dockerfiles/Dockerfile.cloud-wallet @@ -1,8 +1,8 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -13,7 +13,7 @@ RUN pnpm run build cloud-wallet RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.connection b/Dockerfiles/Dockerfile.connection index 088c92915..3ccbfabaa 100644 --- a/Dockerfiles/Dockerfile.connection +++ b/Dockerfiles/Dockerfile.connection @@ -1,8 +1,8 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -13,7 +13,7 @@ RUN pnpm run build connection RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.ecosystem b/Dockerfiles/Dockerfile.ecosystem index e6fdf6c40..9ea78c539 100644 --- a/Dockerfiles/Dockerfile.ecosystem +++ b/Dockerfiles/Dockerfile.ecosystem @@ -1,8 +1,8 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -13,7 +13,7 @@ RUN pnpm run build ecosystem RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.geolocation b/Dockerfiles/Dockerfile.geolocation index 12a61abfe..84f66230f 100644 --- a/Dockerfiles/Dockerfile.geolocation +++ b/Dockerfiles/Dockerfile.geolocation @@ -1,8 +1,8 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -13,7 +13,7 @@ RUN pnpm run build geo-location RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.issuance b/Dockerfiles/Dockerfile.issuance index 31d4e9225..70f7f7d04 100644 --- a/Dockerfiles/Dockerfile.issuance +++ b/Dockerfiles/Dockerfile.issuance @@ -1,8 +1,8 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -13,7 +13,7 @@ RUN pnpm run build issuance RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.ledger b/Dockerfiles/Dockerfile.ledger index 2f7740ca7..8e7ff2952 100644 --- a/Dockerfiles/Dockerfile.ledger +++ b/Dockerfiles/Dockerfile.ledger @@ -1,8 +1,8 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -13,7 +13,7 @@ RUN pnpm run build ledger RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.notification b/Dockerfiles/Dockerfile.notification index 8f9744ccb..d2e1dae95 100644 --- a/Dockerfiles/Dockerfile.notification +++ b/Dockerfiles/Dockerfile.notification @@ -1,7 +1,7 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -12,7 +12,7 @@ RUN pnpm run build notification RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.oid4vc-issuance b/Dockerfiles/Dockerfile.oid4vc-issuance index 6787ab050..52551e6c5 100644 --- a/Dockerfiles/Dockerfile.oid4vc-issuance +++ b/Dockerfiles/Dockerfile.oid4vc-issuance @@ -1,7 +1,7 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -12,7 +12,7 @@ RUN pnpm run build oid4vc-issuance RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.oid4vc-verification b/Dockerfiles/Dockerfile.oid4vc-verification index 3b5404021..2e1cb6e19 100644 --- a/Dockerfiles/Dockerfile.oid4vc-verification +++ b/Dockerfiles/Dockerfile.oid4vc-verification @@ -1,8 +1,8 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -13,7 +13,7 @@ RUN pnpm run build oid4vc-verification RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.organization b/Dockerfiles/Dockerfile.organization index 48af77a05..30a6be0ab 100644 --- a/Dockerfiles/Dockerfile.organization +++ b/Dockerfiles/Dockerfile.organization @@ -1,8 +1,8 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -13,7 +13,7 @@ RUN pnpm run build organization RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.seed b/Dockerfiles/Dockerfile.seed index 699c63c01..e164aa994 100644 --- a/Dockerfiles/Dockerfile.seed +++ b/Dockerfiles/Dockerfile.seed @@ -1,11 +1,11 @@ -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache \ postgresql-client \ openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ && adduser -S nextjs -u 1001 \ - && npm install -g pnpm@9.15.3 --ignore-scripts + && npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY . . ENV PUPPETEER_SKIP_DOWNLOAD=true diff --git a/Dockerfiles/Dockerfile.user b/Dockerfiles/Dockerfile.user index df3b46267..e0ecaaf95 100644 --- a/Dockerfiles/Dockerfile.user +++ b/Dockerfiles/Dockerfile.user @@ -1,8 +1,8 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -13,7 +13,7 @@ RUN pnpm run build user RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.utility b/Dockerfiles/Dockerfile.utility index 1e5c256d1..2a5f2419b 100644 --- a/Dockerfiles/Dockerfile.utility +++ b/Dockerfiles/Dockerfile.utility @@ -1,8 +1,8 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -13,7 +13,7 @@ RUN pnpm run build utility RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.verification b/Dockerfiles/Dockerfile.verification index dcab746ad..a0a73c692 100644 --- a/Dockerfiles/Dockerfile.verification +++ b/Dockerfiles/Dockerfile.verification @@ -1,8 +1,8 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -13,7 +13,7 @@ RUN pnpm run build verification RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.webhook b/Dockerfiles/Dockerfile.webhook index 88bc2b0c9..1ca1527db 100644 --- a/Dockerfiles/Dockerfile.webhook +++ b/Dockerfiles/Dockerfile.webhook @@ -1,8 +1,8 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -13,7 +13,7 @@ RUN pnpm run build webhook RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/Dockerfiles/Dockerfile.x509 b/Dockerfiles/Dockerfile.x509 index 48bc7d360..98e16b249 100644 --- a/Dockerfiles/Dockerfile.x509 +++ b/Dockerfiles/Dockerfile.x509 @@ -1,8 +1,8 @@ # Stage 1: Build the application -FROM node:24-alpine3.23 AS build +FROM node:24-alpine3.24 AS build RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* -RUN npm install -g pnpm@9.15.3 --ignore-scripts +RUN npm install -g pnpm@9.15.9 --ignore-scripts WORKDIR /app COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true @@ -13,7 +13,7 @@ RUN pnpm run build x509 RUN pnpm prune --prod # Stage 2: Create the final image -FROM node:24-alpine3.23 +FROM node:24-alpine3.24 RUN apk update && apk upgrade && apk add --no-cache openssl \ && rm -rf /var/cache/apk/* \ && addgroup -g 1001 -S nodejs \ diff --git a/package.json b/package.json index be5910daf..ad4a39b0b 100644 --- a/package.json +++ b/package.json @@ -220,7 +220,7 @@ "@babel/core@<7.29.6": "7.29.6" } }, - "packageManager": "pnpm@9.15.3+sha512.1f79bc245a66eb0b07c5d4d83131240774642caaa86ef7d0434ab47c0d16f66b04e21e0c086eb61e62c77efc4d7f7ec071afad3796af64892fae66509173893a", + "packageManager": "pnpm@9.15.9+sha512-aARhQYk8ZvrQHAeSMRKOmvuJ74fiaR1p5NQO7iKJiClf1GghgbrlW1hBjDolO95lpQXsfF+UA+zlzDzTfc8lMQ==", "engines": { "node": ">=18" } From 5521b0f382d244af8abba079adaccc07d697a4e5 Mon Sep 17 00:00:00 2001 From: Ajay Jadhav Date: Thu, 27 Aug 2026 02:48:59 +0530 Subject: [PATCH 08/11] fix(security): correct sha512 hash for pnpm 9.15.9 packageManager field The previous commit used a base64-encoded integrity hash from npm view, but corepack's packageManager field requires hex-encoded SHA-512. Refs: #1730 Signed-off-by: Ajay Jadhav --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index ad4a39b0b..e293e6ed3 100644 --- a/package.json +++ b/package.json @@ -220,7 +220,7 @@ "@babel/core@<7.29.6": "7.29.6" } }, - "packageManager": "pnpm@9.15.9+sha512-aARhQYk8ZvrQHAeSMRKOmvuJ74fiaR1p5NQO7iKJiClf1GghgbrlW1hBjDolO95lpQXsfF+UA+zlzDzTfc8lMQ==", + "packageManager": "pnpm@9.15.9+sha512.68046141893c66fad01c079231128e9afb89ef87e2691d69e4d40eee228988295fd4682181bae55b58418c3a253bde65a505ec7c5f9403ece5cc3cd37dcf2531", "engines": { "node": ">=18" } From 8dcf9c6061789ebe01f8beaf249dc1046667ad54 Mon Sep 17 00:00:00 2001 From: Ajay Jadhav Date: Mon, 7 Sep 2026 00:40:56 +0530 Subject: [PATCH 09/11] test(api-gateway): add tracer, dependency-integrity and bundle smoke specs - tracer.spec.ts guards the NodeSDK bootstrap path in tracer.ts, including the disabled-by-default gate and clean SDK start/shutdown lifecycle. - dependency-integrity.spec.ts asserts every direct dependency resolves to a version matching its declared range (caret/tilde/exact and catalog: refs), guarding against lockfile drift after future upgrades. - bundle.smoke.spec.ts loads the webpack production bundle in a subprocess and verifies module evaluation completes and the OpenTelemetry SDK boots, guarding the sdk-trace-base tree-shaking failure seen with sdk-node upgrades. The suite auto-skips until a CI build job produces dist/. Refs: #1729 Signed-off-by: Ajay Jadhav --- apps/api-gateway/src/bundle.smoke.spec.ts | 59 ++++++++++ .../src/dependency-integrity.spec.ts | 101 ++++++++++++++++++ apps/api-gateway/src/tracer.spec.ts | 76 +++++++++++++ 3 files changed, 236 insertions(+) create mode 100644 apps/api-gateway/src/bundle.smoke.spec.ts create mode 100644 apps/api-gateway/src/dependency-integrity.spec.ts create mode 100644 apps/api-gateway/src/tracer.spec.ts diff --git a/apps/api-gateway/src/bundle.smoke.spec.ts b/apps/api-gateway/src/bundle.smoke.spec.ts new file mode 100644 index 000000000..5664f63d7 --- /dev/null +++ b/apps/api-gateway/src/bundle.smoke.spec.ts @@ -0,0 +1,59 @@ +import { execFileSync, type ExecFileSyncOptions } from 'node:child_process'; +import { existsSync } from 'node:fs'; +import { join } from 'node:path'; + +const distEntry = join(process.cwd(), 'dist', 'apps', 'api-gateway', 'main.js'); + +// CI does not run `nest build` yet, so the bundle only exists on demand after +// `pnpm build`. The test guards the tree-shaking-style runtime failure that was +// flagged during review of the @opentelemetry/sdk-node upgrade: a successful +// webpack build is worthless if module evaluation throws at boot. Skipped when +// the bundle has not been built; runs locally and once CI gains a build job. +const skipWithoutBundle = !existsSync(distEntry); +const describeBundle = skipWithoutBundle ? describe.skip : describe; + +describeBundle('webpack production bundle — api-gateway', () => { + const childEnv: NodeJS.ProcessEnv = { + ...process.env, + IS_ENABLE_OTEL: 'true', + OTEL_SERVICE_NAME: 'bundle-smoke', + OTEL_SERVICE_VERSION: '1.0.0', + OTEL_SERVICE_INSTANCE_ID: 'smoke', + OTEL_TRACES_OTLP_ENDPOINT: 'http://127.0.0.1:4317', + OTEL_LOGS_OTLP_ENDPOINT: 'http://127.0.0.1:4317', + OTEL_HEADERS_KEY: 'smoke-key', + OTEL_LOGGER_NAME: 'smoke', + NATS_URL: 'nats://127.0.0.1:4222', + NATS_SERVERS: 'nats://127.0.0.1:4222', + NATS_AUTH_TYPE: 'none' + }; + + const runBundle = (): string => { + const script = [ + `try {`, + ` require(${JSON.stringify(distEntry)});`, + ` setTimeout(() => { console.log('BUNDLE_LOADED'); process.exit(0); }, 3000);`, + `} catch (err) {`, + ` console.error('LOAD_FAILED', err && err.message);`, + ` process.exit(1);`, + `}` + ].join('\n'); + const options: ExecFileSyncOptions = { env: childEnv, encoding: 'utf8', timeout: 60_000 }; + return execFileSync(process.execPath, ['-e', script], options) as unknown as string; + }; + + it('completes module evaluation and boots the OpenTelemetry SDK', () => { + const output = runBundle(); + expect(output).toContain('BUNDLE_LOADED'); + expect(output).toContain('OpenTelemetry SDK started successfully'); + }); + + it('does not fail with sdk-trace-base tree-shaking errors', () => { + try { + runBundle(); + } catch (error) { + const { message } = error as Error; + expect(message).not.toMatch(/Class extends value undefined|Cannot find module|sdk-trace-base/); + } + }); +}); diff --git a/apps/api-gateway/src/dependency-integrity.spec.ts b/apps/api-gateway/src/dependency-integrity.spec.ts new file mode 100644 index 000000000..0b5f92a8b --- /dev/null +++ b/apps/api-gateway/src/dependency-integrity.spec.ts @@ -0,0 +1,101 @@ +import { readFileSync, existsSync } from 'node:fs'; +import { join } from 'node:path'; + +interface PkgJson { + version: string; +} + +interface Catalog { + [pkg: string]: string; +} + +function parseCatalog(yaml: string): Catalog { + const catalog: Catalog = {}; + const lines = yaml.split('\n'); + let inCatalog = false; + for (const raw of lines) { + const line = raw.trim(); + if (line.startsWith('catalog:')) { + inCatalog = true; + continue; + } + if (!inCatalog || line.startsWith('-') || '' === line) { + continue; + } + const separator = line.indexOf(':'); + if (-1 === separator) { + continue; + } + const name = line.slice(0, separator).trim().replace(/^"|"$/g, ''); + const range = line.slice(separator + 1).trim(); + catalog[name] = range; + } + return catalog; +} + +function declaredRange(pkg: string, dependencies: Record, catalog: Catalog): string { + const declared = dependencies[pkg]; + return 'catalog:' === declared ? (catalog[pkg] ?? declared) : declared; +} + +const toTuple = (value: string): number[] => + value + .trim() + .split('.') + .map((part) => parseInt(part, 10)) + .map((n) => (Number.isNaN(n) ? 0 : n)); + +function cmp(a: number[], b: number[]): number { + for (let index = 0; 3 > index; index += 1) { + if ((a[index] ?? 0) !== (b[index] ?? 0)) { + return (a[index] ?? 0) - (b[index] ?? 0); + } + } + return 0; +} + +function caretSatisfies(version: string, range: string): boolean { + const minimum = toTuple(range.replace(/^\^/, '')); + const major = minimum[0] ?? 0; + const minBound = [major, 0, 0]; + const maxBound = 0 === major ? [0, (minimum[1] ?? 0) + 1, 0] : [major + 1, 0, 0]; + const cmp = (a: number[], b: number[]): number => { + for (let index = 0; 3 > index; index += 1) { + if ((a[index] ?? 0) !== (b[index] ?? 0)) { + return (a[index] ?? 0) - (b[index] ?? 0); + } + } + return 0; + }; + return 0 <= cmp(toTuple(version), minBound) && 0 > cmp(toTuple(version), maxBound); +} + +describe('dependency integrity — direct dependencies resolve within declared ranges', () => { + const root = process.cwd(); + const packageJson = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')); + const catalog = parseCatalog(readFileSync(join(root, 'pnpm-workspace.yaml'), 'utf8')); + const dependencies: Record = { ...packageJson.dependencies, ...packageJson.devDependencies }; + + it.each(Object.keys(dependencies).sort())('resolves %s to a version matching its declared range', (pkg) => { + const range = declaredRange(pkg, dependencies, catalog); + const packagePath = join(root, 'node_modules', pkg, 'package.json'); + expect(existsSync(packagePath)).toBe(true); + const installed = JSON.parse(readFileSync(packagePath, 'utf8')) as PkgJson; + const installedVersion = installed.version.replace(/^[=\s]+/, ''); + + let satisfies: boolean; + if (range.startsWith('^')) { + satisfies = caretSatisfies(installedVersion, range); + } else if (range.startsWith('~')) { + const minor = toTuple(range.replace(/^~/, ''))[1] ?? 0; + satisfies = + 0 === cmp(toTuple(installedVersion), [toTuple(range)[0], minor, 0]) && + 1 === cmp(toTuple(installedVersion), [toTuple(range)[0], minor + 1, 0]); + } else if ('' === range) { + satisfies = true; + } else { + satisfies = installedVersion === range || installedVersion.startsWith(`${range}.`); + } + expect(satisfies).toBe(true); + }); +}); diff --git a/apps/api-gateway/src/tracer.spec.ts b/apps/api-gateway/src/tracer.spec.ts new file mode 100644 index 000000000..e3aa943c5 --- /dev/null +++ b/apps/api-gateway/src/tracer.spec.ts @@ -0,0 +1,76 @@ +import { trace } from '@opentelemetry/api'; + +// Guards the NodeSDK bootstrap path in ./tracer. Kept intentionally offline +// (no OTLP server): the happy-path span export over a live endpoint is covered +// by tracer.integration.spec.ts. These tests pin the boot behaviour that a +// @opentelemetry/sdk-node upgrade could silently break under webpack bundling +// (see the tree-shaking review concern on #1729). +describe('tracer — NodeSDK bootstrap', () => { + const pristineEnv = { ...process.env }; + + afterEach(() => { + process.env = { ...pristineEnv }; + jest.resetModules(); + }); + + describe('when IS_ENABLE_OTEL is not exactly "true"', () => { + it.each(['false', '0', '', 'FALSE'])('does not initialize the SDK for "%s"', async (value) => { + process.env.IS_ENABLE_OTEL = value; + const tracerModule = await import('./tracer'); + + expect(tracerModule.otelSDK).toBeNull(); + expect(tracerModule.otelLogger).toBeNull(); + expect(tracerModule.otelLoggerProviderInstance).toBeNull(); + }); + + it('does not initialize the SDK when the variable is unset', async () => { + delete process.env.IS_ENABLE_OTEL; + const tracerModule = await import('./tracer'); + + expect(tracerModule.otelSDK).toBeNull(); + expect(tracerModule.otelLogger).toBeNull(); + expect(tracerModule.otelLoggerProviderInstance).toBeNull(); + }); + }); + + describe('when IS_ENABLE_OTEL=true', () => { + beforeEach(() => { + process.env.IS_ENABLE_OTEL = 'true'; + process.env.OTEL_SERVICE_NAME = 'unit-test'; + process.env.OTEL_SERVICE_VERSION = '1.0.0'; + process.env.OTEL_SERVICE_INSTANCE_ID = 'unit-instance'; + process.env.OTEL_TRACES_OTLP_ENDPOINT = 'http://127.0.0.1:4318'; + process.env.OTEL_LOGS_OTLP_ENDPOINT = 'http://127.0.0.1:4319'; + process.env.OTEL_HEADERS_KEY = 'unit-key'; + process.env.OTEL_LOGGER_NAME = 'unit-logger'; + process.env.HOSTNAME = 'unit-host'; + }); + + it('boots NodeSDK, logger provider and exposes both', async () => { + const tracerModule = await import('./tracer'); + + expect(tracerModule.otelSDK).not.toBeNull(); + expect(tracerModule.otelLogger).not.toBeNull(); + expect(tracerModule.otelLoggerProviderInstance).not.toBeNull(); + }); + + it('allows the SDK to start and shut down cleanly', async () => { + const tracerModule = await import('./tracer'); + + expect(() => tracerModule.otelSDK?.start()).not.toThrow(); + await expect(tracerModule.otelSDK?.shutdown()).resolves.toBeUndefined(); + }); + + it('returns a working tracer from the global API after start', async () => { + const tracerModule = await import('./tracer'); + await tracerModule.otelSDK?.start(); + + const tracer = trace.getTracer('unit-test'); + const span = tracer.startSpan('unit-test-span'); + expect(span.isRecording()).toBe(true); + span.end(); + + await tracerModule.otelSDK?.shutdown(); + }); + }); +}); From 078010039e26ff78ef35681645f339d088fc1530 Mon Sep 17 00:00:00 2001 From: Ajay Jadhav Date: Mon, 7 Sep 2026 01:23:14 +0530 Subject: [PATCH 10/11] fix(test): address CodeRabbit review on test specs - fix tilde range evaluation in dependency-integrity spec (>=X.Y.z, --- .github/workflows/test.yml | 3 +++ Dockerfiles/Dockerfile.agent-provisioning | 11 +++++------ apps/api-gateway/src/bundle.smoke.spec.ts | 13 +++++++------ apps/api-gateway/src/dependency-integrity.spec.ts | 7 ++++--- apps/api-gateway/src/tracer.spec.ts | 15 ++++++++++++--- 5 files changed, 31 insertions(+), 18 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 8ce057ccc..ba6e394c6 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -33,5 +33,8 @@ jobs: - name: Generate Prisma client run: pnpm exec prisma generate --schema=libs/prisma-service/prisma/schema.prisma + - name: Build api-gateway bundle for smoke tests + run: pnpm exec nest build api-gateway + - name: Run tests run: pnpm jest --config jest.ci.config.js --runInBand diff --git a/Dockerfiles/Dockerfile.agent-provisioning b/Dockerfiles/Dockerfile.agent-provisioning index 98d5610dd..17f8d0b8a 100644 --- a/Dockerfiles/Dockerfile.agent-provisioning +++ b/Dockerfiles/Dockerfile.agent-provisioning @@ -10,21 +10,20 @@ RUN set -eux \ docker \ docker-compose \ jq \ - && npm install -g pnpm --ignore-scripts \ + && npm install -g pnpm@9.15.9 --ignore-scripts \ && export PATH=$PATH:/usr/lib/node_modules/pnpm/bin \ && rm -rf /var/cache/apk/* # Set the working directory WORKDIR /app -# Copy package.json and package-lock.json -COPY package.json ./ -COPY pnpm-workspace.yaml ./ +# Copy package.json, pnpm-lock.yaml and pnpm-workspace.yaml +COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./ ENV PUPPETEER_SKIP_DOWNLOAD=true # Install dependencies while ignoring scripts (including Puppeteer's installation) -RUN pnpm i --ignore-scripts +RUN pnpm i --frozen-lockfile --ignore-scripts # Copy the rest of the application code COPY . . @@ -49,7 +48,7 @@ RUN set -eux \ docker \ docker-compose \ jq \ - && npm install -g pnpm --ignore-scripts \ + && npm install -g pnpm@9.15.9 --ignore-scripts \ && export PATH=$PATH:/usr/lib/node_modules/pnpm/bin \ && rm -rf /var/cache/apk/* diff --git a/apps/api-gateway/src/bundle.smoke.spec.ts b/apps/api-gateway/src/bundle.smoke.spec.ts index 5664f63d7..342e5b2e3 100644 --- a/apps/api-gateway/src/bundle.smoke.spec.ts +++ b/apps/api-gateway/src/bundle.smoke.spec.ts @@ -4,12 +4,13 @@ import { join } from 'node:path'; const distEntry = join(process.cwd(), 'dist', 'apps', 'api-gateway', 'main.js'); -// CI does not run `nest build` yet, so the bundle only exists on demand after -// `pnpm build`. The test guards the tree-shaking-style runtime failure that was -// flagged during review of the @opentelemetry/sdk-node upgrade: a successful -// webpack build is worthless if module evaluation throws at boot. Skipped when -// the bundle has not been built; runs locally and once CI gains a build job. -const skipWithoutBundle = !existsSync(distEntry); +// CI builds the webpack bundle in .github/workflows/test.yml, so the suite +// always runs there. It is only skipped for local `pnpm jest` runs that have +// not run `nest build api-gateway` first. The test guards the tree-shaking +// runtime failure that was flagged during review of the @opentelemetry/sdk-node +// upgrade: a successful webpack build is worthless if module evaluation breaks +// at boot. +const skipWithoutBundle = !existsSync(distEntry) && 'true' !== process.env.CI; const describeBundle = skipWithoutBundle ? describe.skip : describe; describeBundle('webpack production bundle — api-gateway', () => { diff --git a/apps/api-gateway/src/dependency-integrity.spec.ts b/apps/api-gateway/src/dependency-integrity.spec.ts index 0b5f92a8b..4af8732a8 100644 --- a/apps/api-gateway/src/dependency-integrity.spec.ts +++ b/apps/api-gateway/src/dependency-integrity.spec.ts @@ -87,10 +87,11 @@ describe('dependency integrity — direct dependencies resolve within declared r if (range.startsWith('^')) { satisfies = caretSatisfies(installedVersion, range); } else if (range.startsWith('~')) { - const minor = toTuple(range.replace(/^~/, ''))[1] ?? 0; + const minimum = toTuple(range.replace(/^~/, '')); + const [major, minor] = minimum; + const upperMinor = (minor ?? 0) + 1; satisfies = - 0 === cmp(toTuple(installedVersion), [toTuple(range)[0], minor, 0]) && - 1 === cmp(toTuple(installedVersion), [toTuple(range)[0], minor + 1, 0]); + 0 <= cmp(toTuple(installedVersion), minimum) && 0 > cmp(toTuple(installedVersion), [major ?? 0, upperMinor, 0]); } else if ('' === range) { satisfies = true; } else { diff --git a/apps/api-gateway/src/tracer.spec.ts b/apps/api-gateway/src/tracer.spec.ts index e3aa943c5..24355596d 100644 --- a/apps/api-gateway/src/tracer.spec.ts +++ b/apps/api-gateway/src/tracer.spec.ts @@ -7,8 +7,17 @@ import { trace } from '@opentelemetry/api'; // (see the tree-shaking review concern on #1729). describe('tracer — NodeSDK bootstrap', () => { const pristineEnv = { ...process.env }; + let sdkUnderTest: (typeof import('./tracer'))['otelSDK']; - afterEach(() => { + afterEach(async () => { + if (sdkUnderTest) { + // Offline suite (no OTLP listener): shutting down may flush a pending + // batch and reject with ECONNREFUSED. The successful export path is + // covered by tracer.integration.spec.ts, so swallow it here. + await sdkUnderTest.shutdown().catch(() => {}); + sdkUnderTest = null; + } + trace.disable(); process.env = { ...pristineEnv }; jest.resetModules(); }); @@ -56,6 +65,7 @@ describe('tracer — NodeSDK bootstrap', () => { it('allows the SDK to start and shut down cleanly', async () => { const tracerModule = await import('./tracer'); + sdkUnderTest = tracerModule.otelSDK; expect(() => tracerModule.otelSDK?.start()).not.toThrow(); await expect(tracerModule.otelSDK?.shutdown()).resolves.toBeUndefined(); @@ -63,14 +73,13 @@ describe('tracer — NodeSDK bootstrap', () => { it('returns a working tracer from the global API after start', async () => { const tracerModule = await import('./tracer'); + sdkUnderTest = tracerModule.otelSDK; await tracerModule.otelSDK?.start(); const tracer = trace.getTracer('unit-test'); const span = tracer.startSpan('unit-test-span'); expect(span.isRecording()).toBe(true); span.end(); - - await tracerModule.otelSDK?.shutdown(); }); }); }); From 7a6d946494781a3b99cf57401dbbe8b0794d6298 Mon Sep 17 00:00:00 2001 From: Ajay Jadhav Date: Mon, 7 Sep 2026 01:29:09 +0530 Subject: [PATCH 11/11] fix(docker): run agent-provisioning image as non-root user MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add nodejs group + nextjs user and USER nextjs to the final stage, matching every sibling Dockerfile (Dockerfile.user, Dockerfile.agent-service, etc.). Compose override 'user: root' is unchanged for the docker.sock mount, so agent orchestration still works while the image no longer defaults to root. Refs: SonarQube quality gate — 'node' image runs with root as default user. Signed-off-by: Ajay Jadhav --- Dockerfiles/Dockerfile.agent-provisioning | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/Dockerfiles/Dockerfile.agent-provisioning b/Dockerfiles/Dockerfile.agent-provisioning index 17f8d0b8a..056be2cc2 100644 --- a/Dockerfiles/Dockerfile.agent-provisioning +++ b/Dockerfiles/Dockerfile.agent-provisioning @@ -50,7 +50,9 @@ RUN set -eux \ jq \ && npm install -g pnpm@9.15.9 --ignore-scripts \ && export PATH=$PATH:/usr/lib/node_modules/pnpm/bin \ - && rm -rf /var/cache/apk/* + && rm -rf /var/cache/apk/* \ + && addgroup -g 1001 -S nodejs \ + && adduser -S nextjs -u 1001 WORKDIR /app @@ -78,5 +80,9 @@ RUN chmod 777 /app/agent-provisioning/AFJ/token # Copy the libs folder COPY libs/ ./libs/ +# Run as non-root +RUN chown -R nextjs:nodejs /app +USER nextjs + # Set the command to run the microservice CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && npx prisma generate && cd ../.. && node dist/apps/agent-provisioning/main.js"] \ No newline at end of file