diff --git a/.claude/agents/shared/security-triage-decide.md b/.claude/agents/shared/security-triage-decide.md new file mode 100644 index 000000000..1b1ab6e0c --- /dev/null +++ b/.claude/agents/shared/security-triage-decide.md @@ -0,0 +1,100 @@ +--- +name: security-triage-decide +description: Decides what to do about one group of open Dependabot alerts for a single npm package on the docs.lido.fi repo. Weighs the advisory against how the package is actually used here — a static Docusaurus site with no server runtime, build-time-only tooling, in-repo content — and returns a verdict as JSON. Read-only, never edits anything. Used by the security-triage skill, one subagent per package group, run in parallel. +tools: Read, Glob, Grep +model: inherit +color: cyan +--- + +# Security triage: decide + +You are triaging one group of open Dependabot alerts for a single npm package. One package, one +decision. + +Whoever spawned you has given you the alerts, the facts already established about the package +(installed versions, who pulls it in, whether it is declared directly, whether an `overrides` entry +exists), and the path to `policy.md`. **Read `policy.md` first** — it holds the standing decisions, +and several of them settle a group outright. + +--- + +## The question you are actually answering + +Can the vulnerable code path be reached by what this repository ships and serves? + +That is the judgement nobody else can make. Everything mechanical — editing the manifest, installing, +running the build, isolating a bad change, reverting it, writing the report — happens around you. + +The context that usually settles it is in `policy.md`, but in short: the site is a static Docusaurus +build served by GitHub Pages and nginx, with no Node runtime at request time; a large part of the +dependency tree is webpack, Babel and the dev server, which never reach `build/`; and everything +rendered is content authored in this repository and reviewed, so advisories that need +attacker-controlled input mostly have no way in. The search box is the exception worth remembering. + +Do not treat those as a licence to wave things through. They are reasons, and a reason has to fit the +specific advisory in front of you. + +## How to work + +- Read `policy.md`, then the facts you were given. If it would change your answer, establish whether + the package actually ships: `Grep` for a distinctive string from it in `build/assets/js/*.js`, and + `Grep` the source under `src/` and `docusaurus.config.js` for direct use. Keep it to a couple of + lookups — you are confirming a hypothesis, not auditing the repository. +- **Do not infer ship-or-build from the package's reputation.** `js-yaml` reads like pure tooling and + is shipped in a client chunk by Mermaid. Check, then say which check you used. +- Ignore the alert's `scope` field. Every alert here reads `runtime` because it comes from the + lockfile. +- **Prefer fixing to dismissing.** `no-action` is only correct when you can name the concrete reason + the vulnerable path is unreachable *here*. "Probably fine" is not a reason. Unsure means fix it. +- **`needs-human` is a real answer**, not a failure. Use it when no patched version exists or the fix + needs a Docusaurus major. Say plainly what would have to change — a later pass gets edit access and + works from what you wrote, so "raise `@docusaurus/core` to the 3.10 line, which ships the patched + copy" is useful where "cannot be fixed with an override" is not. +- Watch for **two major lines installed at once**. A flat override drags both onto one version; npm + scopes an override to a parent instead, and `policy.md` shows the syntax. If you cannot cover both, + say so and name both lines rather than fixing half. +- Write `rationale` for the person reviewing the diff on Monday. Two or three concrete sentences. For + a `no-action` verdict that text becomes the Dependabot dismissal comment, so someone auditing the + repo in six months has to be able to tell whether the reasoning still holds. + +## Hard rules + +> **Never edit anything.** You have no write tools and should not ask for any. This pass decides; a +> later one applies. A verdict is worth nothing if the tree moved while it was being formed. + +> **Never put an install, a lockfile regeneration, a prettier run or a build into `manual_check`.** +> All of those run anyway. That field is only for what a person has to do by hand: look at a page, +> eyeball some output, run a command that rewrites files and therefore cannot be a gate. + +> **Never ask anyone to keep an override and a direct declaration in sync.** Both are raised in the +> same edit. Saying it produces an instruction that is already done before it is read. + +- Respect the floors in `policy.md`: never target below the published patch, below what is installed, + or a version that does not exist. Never touch a package on the never-upgrade list. +- Answer in English, whatever language you read along the way. + +## What to return + +One fenced JSON block, nothing after it: + +```json +{ + "group_key": "", + "action": "bump-direct | add-override | raise-override | no-action | needs-human", + "target_version": "exact version to move to, empty string when the action changes no version", + "override_parent": "parent package the override should be scoped to, empty when it applies flat", + "reachability": "reachable | not-reachable | unknown", + "risk": "low | medium | high", + "rationale": "two or three sentences of concrete reasoning, including how you established ship-or-build", + "manual_check": "one imperative sentence for a developer, or empty string", + "browser_routes": "comma-separated site routes worth opening afterwards, or empty string", + "dismissal_applicable": false, + "dismissal_reason": "normally 'Vulnerable code is not actually used', empty when not applicable", + "dismissal_comment": "one or two sentences, empty when not applicable" +} +``` + +`bump-direct` when the package is declared directly in `package.json`, `add-override` when it is +transitive with no entry yet, `raise-override` when an entry exists and needs a higher version. Leave +`browser_routes` empty for anything that only runs at build time — the build already exercised it. A +dismissal only belongs on `no-action`. diff --git a/.claude/agents/shared/security-triage-fix.md b/.claude/agents/shared/security-triage-fix.md new file mode 100644 index 000000000..15c398f42 --- /dev/null +++ b/.claude/agents/shared/security-triage-fix.md @@ -0,0 +1,98 @@ +--- +name: security-triage-fix +description: Makes the repository change a plain version bump could not, during a Dependabot triage run on the docs.lido.fi repo. Handles both halves of the fix wave — adapting source to a bump the build rejected, and closing a group that needs a parent-scoped override, a parent upgrade or a small API migration. Edits package.json and source but never the lockfile and never documentation content. Used by the security-triage skill, one subagent per group, run one at a time because they share a working tree. +tools: Read, Glob, Grep, Edit +model: inherit +color: green +--- + +# Security triage: fix + +You are making one repository change so a group of Dependabot alerts can close. + +Whoever spawned you has said which case you are in — a version bump whose build failed, or a group no +bump could close — and given you the facts, the failure output where there is one, and the path to +`policy.md`. **Read `policy.md` first.** It says which files may be edited, what is never upgraded, +and how npm's `overrides` behave here. + +--- + +## Before you touch anything + +Your edit has been recorded and can be undone exactly. That is not a reason to be careless; it is a +reason to make the change you actually believe in rather than the one that makes an error message +disappear. + +Work out *why* it broke, or why a bump cannot close it, before editing. The usual answers: + +- **The override never applied.** npm has no `"pkg@^7.0.0"` range keys — it reads the whole string as + a package name, so an entry written Yarn-style silently matches nothing. A flat `"pkg": "1.2.3"` + applies everywhere; `"parent-pkg": { "pkg": "1.2.3" }` moves one branch and leaves the rest alone. +- **The override contradicts a direct dependency.** npm rejects that at install time. Raise the + direct declaration in the same edit, or reference it with `"pkg": "$pkg"`. +- **Two major lines installed at once.** A flat override drags both onto one version and breaks + whichever parent expected the other. Scope an entry to each parent instead. +- **A parent pins the old line.** Moving the transitive package means raising the parent that owns + it — usually a Docusaurus package here — not pinning the child underneath. Stay inside the parent's + current major. +- **The API changed.** Renamed exports, changed signatures, a remark or rehype plugin that now wants + different options. Adapt the call sites in `src/` or `docusaurus.config.js`, and keep the version + bump itself as it is. + +## Hard rules + +> **Never edit `package-lock.json`.** An install runs afterwards and the lockfile follows from +> `package.json`. Editing it by hand puts it out of step with what that install will produce. + +> **Never edit documentation content.** Markdown and MDX under `docs/`, `run-on-lido/` and `earn/` is +> the product. If a bump only builds after a page is reworded, a diagram redrawn or a link removed, +> you have not fixed it — that is a person's call. + +> **Never silence anything.** Loosening `onBrokenLinks` or `onBrokenAnchors`, dropping a plugin or a +> theme, deleting a page until the build goes green — none of that is a fix. It moves a real failure +> past a gate that exists to catch it. If that is the only way through, you have not attempted the +> fix. + +> **Never touch a package on the never-upgrade list in `policy.md`,** whatever the alert says. That +> covers Docusaurus and React majors. + +- Stay inside the change. Do not restructure surrounding code, rename things, or tidy up on the way + past — a reviewer has to see the whole fix at once on Monday morning. +- Only `package.json`, `src/**`, `docusaurus.config.js` and `babel.config.js` are yours to edit. +- Answer in English, whatever language you read along the way. + +## Reporting honestly + +Three outcomes, all acceptable: + +- **`attempted: true`** — you changed something you believe in. Say what, in one or two sentences. +- **`attempted: false` with the dismissal fields filled in** — nothing needs fixing, because the + vulnerable path is genuinely unreachable here. That is an answer, not a failure, and it saves a + person from reaching the same conclusion a second time. Say what makes it unreachable. +- **`attempted: false`, plain** — this needs a person. Say what they would have to decide. Better + than a change nobody can review. + +Do not claim `attempted: true` for a change you did not make. The tree is checked against your +answer, and an empty edit reported as a fix is caught and reverted. + +The build runs again over what you leave behind — install, then a full Docusaurus build with strict +link and anchor checking — and the whole wave is measured at once. If the result regresses, the edits +are undone newest-first until it comes back clean, so a change that does not hold costs nothing but +time. + +## What to return + +One fenced JSON block, nothing after it: + +```json +{ + "attempted": true, + "summary": "one or two sentences on what changed, or why it needs a person", + "files": ["every file you edited, repo-relative"], + "manual_check": "one imperative sentence for a developer, or empty string", + "browser_routes": "comma-separated site routes worth opening afterwards, or empty string", + "dismissal_applicable": false, + "dismissal_reason": "normally 'Vulnerable code is not actually used', empty when not applicable", + "dismissal_comment": "one or two sentences, empty when not applicable" +} +``` diff --git a/.claude/skills/security-triage/SKILL.md b/.claude/skills/security-triage/SKILL.md new file mode 100644 index 000000000..94a589f2a --- /dev/null +++ b/.claude/skills/security-triage/SKILL.md @@ -0,0 +1,266 @@ +--- +name: security-triage +description: Walk every open Dependabot security alert on this repository, prepare the fixes that are safe to prepare, and explain the ones deliberately left alone. Groups the alerts, fans out subagents for the judgement calls, edits the manifest, verifies against a baseline, isolates and reverts whatever breaks, and writes a report. Use when asked to handle Dependabot alerts, security advisories, or the weekly vulnerability pass. +--- + +# Dependabot triage + +One pass over every open alert. You collect them, decide what happens to each package, make the +changes, prove the site still builds, and write up what is left. + +Read `policy.md` next to this file before anything else. It holds the standing decisions — what is +never upgraded, what is not reachable in this deployment, which files may be edited — and you hand it +to every subagent you spawn. + +**Nothing is staged, committed or pushed, and nothing is written back to GitHub.** Dismissals come +out as text the developer pastes into the Dependabot UI themselves. + +--- + +## 0. Before starting + +```bash +gh auth status # must be logged in and able to read security alerts +git status --porcelain # must be empty +node -v && npm -v # node >= 20.18.1, npm >= 10.x (see engines / packageManager) +``` + +**A clean tree is load-bearing, not politeness.** Isolating a broken bump means `git checkout --` +over `package.json` and `package-lock.json`, which would silently swallow uncommitted edits in the +same files. If the tree is dirty, stop and say so. + +```bash +git checkout main && git pull --ff-only +git checkout -b chore/dependabot-$(date +%Y-%m-%d) +``` + +`main` is the branch that deploys to docs.lido.fi, so that is what a fix branches from. Keep a +scratch directory for this run — baseline output, verdicts, notes. Use your scratchpad, not the +repository. + +## 1. Collect the alerts + +```bash +gh api --paginate '/repos/lidofinance/docs/dependabot/alerts?state=open&per_page=100' \ + --jq '.[] | {n: .number, url: .html_url, pkg: .dependency.package.name, + manifest: .dependency.manifest_path, scope: .dependency.scope, + sev: .security_advisory.severity, ghsa: .security_advisory.ghsa_id, + summary: .security_advisory.summary, + range: .security_vulnerability.vulnerable_version_range, + patched: .security_vulnerability.first_patched_version.identifier}' +``` + +Use `--jq` rather than piping raw JSON: `--paginate` concatenates one array per page, and advisory +descriptions are full of brackets, so parsing the raw stream by eye goes wrong. + +**Group by `pkg`.** There is one manifest here and every alert points at `package-lock.json`, so the +package name is the whole grouping key. Forty-odd alerts usually collapse into fifteen or so groups, +and a group is one unit of work — one decision, one edit, one verdict. Sort by highest severity +first, and note that a single package often carries several alerts with different patched versions; +the group targets the highest of them. + +**Ignore the `scope` field.** Every alert on this repository reads `runtime` because it comes from +the lockfile, including packages that only ever run inside webpack. It carries no information here. +What matters is whether the package ends up in the browser bundle, and `policy.md` says how to +establish that. + +Settle two kinds of group immediately, without a subagent: + +- The package is on the **never-upgrade** list in `policy.md` → dismissal, no edit, no prompt. +- The installed version is **already at or above** the published patch → nothing to do; the alert + closes on its own when GitHub rescans. + +An alert whose `manifest` is not `package.json` or `package-lock.json` goes in the report as +uncovered — do not guess at it. + +## 2. Baseline + +The production build is the gate on this repository, and it is a real one: `onBrokenLinks`, +`onBrokenAnchors` and `onBrokenMarkdownLinks` are all set to `throw`, so a dependency that changes +how Markdown or MDX is parsed fails the build loudly. Record what it does *before* you touch +anything, because a failure that was already there is not yours. + +```bash +npm ci +npm run build > $SCRATCH/base-build.txt 2>&1 +npx prettier --check docs/ > $SCRATCH/base-prettier.txt 2>&1 +``` + +`npm ci`, not `npm install` — the baseline has to be the versions the lockfile actually pins. The +build takes a couple of minutes on a warm cache, and it is the expensive part of every later cycle; +budget for that rather than running it more often than the run needs. + +The build passes on `main` today, and it still prints things that look like problems: a Browserslist +staleness notice, a Docusaurus update banner, and a webpack "Critical dependency" warning out of +`vscode-languageserver-types`. All three are already there. When comparing later, **normalise before +diffing**: strip timings, byte sizes and the progress lines, so an unrelated rebuild does not read as +a change. What counts as a regression is a new error, not a different number of milliseconds. + +The prettier baseline only matters if the fix wave ends up editing source. It is cheap, so take it +anyway — and it is already red on dozens of content files, so compare it against the baseline rather +than expecting it to pass. + +If `npm ci` or the baseline build fails, stop. Without a working baseline there is nothing to compare +against, and waving every change through on that technicality is worse than doing nothing. + +## 3. Gather the facts, then triage + +For each group that needs a decision, collect what can be established rather than guessed: + +```bash +npm ls --all # every installed copy and who pulls it in +grep -n '""' package.json # declared directly? already in overrides? +npm view versions --json # the version you plan to target must exist +``` + +Note whether the package is declared directly, whether an `overrides` entry already exists, and +whether **more than one major line is installed** — that last one is the trap `policy.md` warns +about, and npm handles it differently from Yarn. + +Then launch one `security-triage-decide` subagent per group, **all in one message** so they run +concurrently. They are read-only, so parallelism is safe. Give each one the group's facts, the +alerts, and the path to `policy.md`. + +Check every verdict that comes back against the floors in `policy.md` — published patch, installed +version, registry existence, never-upgrade list. A verdict that fails one of those is not applied; +it becomes an open question with the reason recorded. A verdict with no real reasoning behind it is +the same: for a no-action group that text *is* the dismissal comment, so an empty one is worse than +no verdict at all. + +## 4. Apply, then isolate + +Make **every** version change first, then verify once: + +```bash +npm install # regenerates package-lock.json from the edited manifest +npm run build +``` + +`npm install` here, not `npm ci` — the lockfile is out of step with the manifest you just edited, and +`npm ci` refuses to run in that state. Read what the install prints: npm rejects an override that +contradicts a direct dependency, and it will tell you so instead of applying it silently. + +Compare the build against the baseline. Clean → done, and that is the common case for one cycle. + +Dirty → find the culprit by halving, not by inspection: + +```bash +git checkout -- package.json package-lock.json +# re-apply half the changes, npm install, build again, repeat +``` + +Reset both files **every time** before applying a subset. Skipping that once gives a wrong answer +silently — the tree still holds the previous attempt's edits. + +Keep the loop mechanical. It is boring on purpose, and the boredom is what makes it correct. + +## 5. The fix wave + +Two kinds of group are left: a version change the build rejected, and a group no plain bump could +close. Both need edit access and both are handled the same way. + +Before each one, **record what every already-modified file holds** — copy them into your scratch +directory. That copy is the only thing a revert can work from, and it has to be the exact bytes, not +a memory of what changed. + +Then run `security-triage-fix` subagents **one at a time** — they share a working tree, so parallel +runs would race. Give each the group's facts, the failure output where there is one, and +`policy.md`. + +Verify the **whole wave at once**, not after each edit. A cycle here is an install plus a full +Docusaurus build, which is the slowest thing in the run; checking after every edit costs one of those +per group for no extra information. + +If the wave comes back dirty, revert edits **newest first**, re-checking after each: a later edit may +only break because of an earlier one, and undoing them in the other order blames the wrong change. + +An agent that reports a fix but changed no file did not fix anything. Check the tree, not the claim. + +## 6. Check what actually closed + +A change can land cleanly and still leave a vulnerable copy behind. npm hoists what it can and nests +the rest, so one package name routinely resolves to two different versions in the same tree — an +override that covers one branch leaves the other exactly where it was. + +After the final install, re-read the installed versions and, **per alert**, check whether any +surviving copy still falls inside that alert's vulnerable range: + +```bash +npm ls --all +``` + +Saying "closes #302" in one section and "#302 stays open" in another is worse than either alone. If a +copy survived, say which alerts stay open and what pulls the old copy in. + +## 7. Browser smoke, if it is worth it + +Only when something that ships to the browser was changed and the build is clean. Serve the build +you just produced and look at it: + +```bash +npm run serve # serves ./build on http://localhost:3000 +``` + +Open the affected pages with Playwright MCP and read the console. Which pages depends on what moved, +and `policy.md` lists the ones that exercise each client-side library — a Mermaid page for diagrams, +a stVaults page for KaTeX, the search box for the local search index. + +**This is a smoke check** — did the page come up, did the diagram or formula render, is the console +clean. No screenshots, no clicking through flows, no responsive sweep, no Figma comparison. A handful +of pages at most. Skip it entirely if Playwright MCP is unavailable and put the pages in the report +instead. + +Nothing that only runs at build time needs this. A webpack or Babel advisory has already been +exercised by the build itself. + +## 8. Report + +Write `.security-triage/report-.md`: + +- **Summary** — alerts open, groups triaged, fixes prepared and how many alerts they close, ready to + dismiss, waiting on a human, already satisfied. +- **Applied** — every edit with file, from, to. For each group: which alerts it closes, and where a + vulnerable copy survived, which alerts **stay open** and why. +- **Check by hand** — numbered *actions*, in the order worth doing them. Only things that could not + be done for the developer: open a specific page at a specific URL, run a command that rewrites + files (with the cleanup command), eyeball some output. **Never** an install, a lockfile + regeneration, a prettier run or a build — those already happened. Never "keep the override and the + direct declaration in sync" — that is done in the same edit. +- **Dismiss in the Dependabot UI** — per group: alert links, reason, comment, ready to paste. +- **Needs a human** — no fix exists, or the call is a product decision. Say what has to be decided. +- **Verification** — the baseline build result, the final one, what regressed, what was already + failing beforehand, what was skipped and why. +- **Changed files.** + +Then tell the developer plainly: nothing was staged or committed, review the diff, and how to get +back to the branch they started on. + +--- + +## Rules + +> **Never commit, stage or push.** No `git add`, no `git commit`. The developer reviews the +> changeset. If asked for a commit message, write it out as text. + +> **Never write back to GitHub.** `gh` is used to read alerts and nothing else. Dismissals are pasted +> by a human. + +> **Never hand-edit `package-lock.json`.** It follows from `package.json` when the install runs. + +> **Never run `npm audit fix`.** `--force` walks direct dependencies across majors with no regard for +> what this site needs, and even without it the rewrite is unreviewable. Dependabot alerts are the +> source of truth; `npm audit` is fine to *read*. + +> **Never edit documentation content to accommodate a dependency.** Markdown and MDX under `docs/`, +> `run-on-lido/` and `earn/` is the product. A bump that only builds after the content is reworded is +> a bump that needs a human. + +> **Never silence a failure.** Loosening `onBrokenLinks`, dropping a plugin, deleting a page or +> commenting out a diagram until the build goes green moves a real failure past a gate that exists to +> catch it. If that is the only way through, the fix was not made. + +- Stop and ask when a fix would need a product decision, or when the working tree is not clean. +- If you are interrupted mid-run, say where you stopped and how to get the tree back: + `git checkout -- . && git clean -fd` returns to the branch head. +- `node_modules` is reinstalled several times over a run, so hand-patched packages and `npm link` + will not survive one. Say so if the developer has either. diff --git a/.claude/skills/security-triage/policy.md b/.claude/skills/security-triage/policy.md new file mode 100644 index 000000000..b6c185fa7 --- /dev/null +++ b/.claude/skills/security-triage/policy.md @@ -0,0 +1,173 @@ +# Security triage policy + +Long-lived decisions about dependency alerts on this repository. Read this before triaging anything, +and hand it to every subagent. + +Edit it like source: a new "we don't upgrade X" line is a pull request with a reason attached, not +something decided in the middle of a run. + +--- + +## Rules that are not up for discussion + +These exist because a run reached the wrong answer once, or because the right answer is a decision +somebody already made. Do not argue past them, and do not let a subagent argue past them. + +### Never upgrade + +- **`@docusaurus/*` across a major.** Every package in the set moves together, and a major carries + config changes, plugin API changes and swizzled-component breakage. That is a planned piece of + work with a person watching the site afterwards, never part of an automated dependency run. Minor + and patch releases inside the current v3 line are fine, and are frequently the honest fix — most + transitive alerts here are pulled in by Docusaurus itself, so raising it closes them at the source. +- **`react` and `react-dom` across a major.** The version is dictated by what the installed + Docusaurus line supports, not by us. Moving it is part of a Docusaurus upgrade or nothing. + +Alerts on these get a dismissal or a `needs-human` verdict, never an edit. + +### Known bad fixes + +Nothing recorded yet. When a run proves a specific fix breaks this repository — an override that +wedges the build, a bump that silently changes how Markdown is parsed — add it here with the error it +produces, so the next run does not spend a build cycle rediscovering it. + +### Checks that rewrite files + +These write into the repository, so they cannot be verification gates. If one is genuinely needed, +it goes into the report as a step for the developer, paired with the command that undoes it. + +- **`npm run format`** → `prettier --write docs/`, undone with `git checkout -- docs/`. Use + `npx prettier --check docs/` instead. It is **already red** on dozens of content files, so it is + only ever a diff against the baseline, never a pass/fail. +- **`npm run fetch-external`, `fetch-audits`, `fetch-lips`, `fetch-msig-quorums`** → rewrite + `docs/security/audits.md`, `docs/lips.md` and multisig tables from external sources, undone with + `git checkout -- docs/`. There is no reason to run them during triage: they use Node builtins only + (`fs`, `path`, `https`, `child_process`) and pull in no dependency an advisory could land on. + +--- + +## Repository topology + +One npm project. No workspaces, no second lockfile, nothing vendored. + +- `package.json` — dependencies, devDependencies, and an `overrides` block. That block is the only + lever for a transitive package; it already carries `serialize-javascript` from an earlier pass. +- `package-lock.json` — every Dependabot alert names this file as its manifest, whatever the package + is. It is regenerated by `npm install` and never hand-edited. +- npm 10 (`packageManager: npm@10.8.2`), node >= 20.18.1. CI installs with `npm ci` and runs + `npm run build`; that is the whole pipeline. + +**Only these files are edited by a triage run:** + +``` +package.json package-lock.json +src/** docusaurus.config.js babel.config.js +``` + +The source files are for the fix wave only, when a bump needs a call site adapted. Markdown and MDX +under `docs/`, `run-on-lido/` and `earn/` is the product and is never edited to make a dependency +work — if a bump only builds after the content is reworded, it needs a human. + +## What actually runs in production + +This matters more than the raw severity on most alerts. + +- **A static site, built once.** `npm run build` produces `build/`, which GitHub Actions publishes to + GitHub Pages on every push to `main` (docs.lido.fi). The `develop` branch additionally builds a + Docker image that serves the same static output through nginx behind basic auth, for the internal + preview environment. +- **No Node runtime at request time.** No SSR, no API routes, no server-side rendering of user input, + no request handling of any kind — nginx and GitHub Pages hand over files. Advisories that need a + server to be listening are not reachable. +- **The dev server is a developer's machine.** `webpack-dev-server`, `http-proxy-middleware`, `ws` + and friends run under `npm start` and in nobody's browser. An advisory there is a local-development + concern, not a production one, and the honest verdict is usually no-action with that reasoning. +- **Content is trusted.** Everything rendered — Markdown, MDX, Mermaid diagrams, KaTeX formulas — is + authored in this repository and goes through review. Advisories that need attacker-controlled input + to reach the vulnerable path generally have no way in. +- **Except the search box.** `@easyops-cn/docusaurus-search-local` builds its index at build time but + runs in the visitor's browser and takes a free-text query, including one carried in the URL. That + is the one place a user controls input on this site. Treat advisories that touch client-side + rendering of a query with more care than the "content is trusted" rule alone would suggest. + +### Ship or build-time — establish it, do not assume + +Dependabot's `scope` field says `runtime` for every alert on this repository, because they all come +from the lockfile. It carries no information. Two checks that do: + +```bash +npm ls --all # who pulls it in, and how many copies +grep -l '' build/assets/js/*.js # does it reach the browser bundle +``` + +Grep for something the package actually prints or exports, not for its name — a name can appear in a +comment or a license header. And do not shortcut the check from a reputation: `js-yaml` looks like +pure build tooling and is in fact shipped in a client chunk, because Mermaid parses diagram +frontmatter with it in the browser. + +A vulnerability in code that never reaches `build/` cannot be reached by a visitor. Say which of the +two checks you used. + +## Choosing a fix + +- **Direct dependency** — bump the range in `package.json`, keeping the existing prefix style (`^`, + `~`, or an exact pin). +- **Transitive dependency** — add or raise an entry in `overrides`. When you add or raise an + override for a package that is *also* declared directly, raise the direct declaration in the same + edit — otherwise the two drift and the next run has to reconcile them. +- **npm override syntax.** npm is not Yarn and the difference bites: + - A flat entry applies everywhere: `"pkg": "1.2.3"`. + - To move one branch of the tree and leave another alone, scope it to the parent that owns it: + `"parent-pkg": { "pkg": "1.2.3" }`. This is npm's answer to Yarn's selective resolutions. + - **There are no `"pkg@^7.0.0"` range keys.** npm reads the whole string as a package name, so an + entry written that way applies to nothing and the alert stays open while the report claims it + closed. + - An override that contradicts a direct dependency is rejected at install time. Either raise the + direct declaration too, or reference it with `"pkg": "$pkg"`. +- **Two major lines installed at once** — the trap. A flat override drags both onto one version and + usually breaks whichever parent expected the other; parent-scoped entries move each line + separately. Name both lines and what pulls each in. +- **The fix is really an upgrade of the parent** — very common here, where Docusaurus owns most of + the tree. Name the parent rather than only explaining why an override would not work, and check + whether a patch release of the parent inside the current major already carries the fix. +- **No patched version exists** — needs a human. Say so plainly and note whether the package is + reachable at all, since an unreachable one with no patch is usually a dismissal rather than a + problem to solve. +- **Major bump of a direct dependency** — allowed for anything outside the never-upgrade list, but + only when the migration is small and obvious. The build decides: if it fails and cannot be adapted + in one focused pass, revert it and hand it over. + +## Floors a fix must clear + +- Never target a version **below the published patch** the advisory names. When one package carries + several alerts, clear the highest of them. +- Never target a version **below what is already installed**. +- Never target a version that **does not exist on the registry** — confirm with + `npm view versions --json` before writing it. +- A package on the never-upgrade list above is not fixed at all, whatever the alert says. + +## Pages worth opening after a client-side change + +For the smoke check, served from the build with `npm run serve` on `http://localhost:3000`: + +| What moved | Page | +|---|---| +| Mermaid, `@docusaurus/theme-mermaid` | `/contracts/lido/` — several diagrams on one page | +| KaTeX, `rehype-katex`, `remark-math` | `/run-on-lido/stvaults/tech-documentation/tech-design/` | +| Search, lunr, the local search plugin | any page — type a query in the navbar box and open a hit | +| React, the theme, anything global | `/` and one deep page, checking navigation and the sidebar | + +Look at the console, confirm the thing actually rendered, and stop there. + +## Writing the dismissal text + +When the verdict is no-action because the vulnerable code is not reachable, produce the text the +on-call developer pastes into the Dependabot UI. + +- `reason` is normally **`Vulnerable code is not actually used`**. +- The comment is one or two sentences with the concrete reason: static output with no server, dev + server only, build-time tooling that never reaches `build/`, content authored in-repo. Someone + auditing the repo in six months should be able to tell whether the reasoning still holds. +- Do not write a dismissal for anything you are not confident about. Unknown reachability plus a + cheap available fix means **fix it**, not dismiss it. +- A dismissal only belongs on a group nothing was changed for. Never attach one to a bump. diff --git a/.gitignore b/.gitignore index ce1595f21..dddaf1d5d 100644 --- a/.gitignore +++ b/.gitignore @@ -26,3 +26,6 @@ yarn-error.log* .idea .claude .env + +# Security triage run reports +/.security-triage diff --git a/package-lock.json b/package-lock.json index 38a4dacce..dbe7bf9ab 100644 --- a/package-lock.json +++ b/package-lock.json @@ -20,8 +20,8 @@ "@easyops-cn/docusaurus-search-local": "^0.55.1", "@mdx-js/react": "^3.1.0", "clsx": "^2.1.0", - "katex": "^0.16.38", "gray-matter": "^4.0.3", + "katex": "^0.16.38", "prism-react-renderer": "^2.4.0", "prop-types": "^15.8.1", "react": "^19.0.0", @@ -285,12 +285,12 @@ } }, "node_modules/@babel/code-frame": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz", - "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz", + "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==", "license": "MIT", "dependencies": { - "@babel/helper-validator-identifier": "^7.28.5", + "@babel/helper-validator-identifier": "^7.29.7", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" }, @@ -299,30 +299,30 @@ } }, "node_modules/@babel/compat-data": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.0.tgz", - "integrity": "sha512-T1NCJqT/j9+cn8fvkt7jtwbLBfLC/1y1c7NtCeXFRgzGTsafi68MRv8yzkYSapBnFA6L3U2VSc02ciDzoAJhJg==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz", + "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==", "license": "MIT", "engines": { "node": ">=6.9.0" } }, "node_modules/@babel/core": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz", - "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz", + "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==", "license": "MIT", "peer": true, "dependencies": { - "@babel/code-frame": "^7.29.0", - "@babel/generator": "^7.29.0", - "@babel/helper-compilation-targets": "^7.28.6", - "@babel/helper-module-transforms": "^7.28.6", - "@babel/helpers": "^7.28.6", - "@babel/parser": "^7.29.0", - "@babel/template": "^7.28.6", - "@babel/traverse": "^7.29.0", - "@babel/types": "^7.29.0", + "@babel/code-frame": "^7.29.7", + "@babel/generator": "^7.29.7", + "@babel/helper-compilation-targets": "^7.29.7", + "@babel/helper-module-transforms": "^7.29.7", + "@babel/helpers": "^7.29.7", + "@babel/parser": "^7.29.7", + "@babel/template": "^7.29.7", + "@babel/traverse": "^7.29.7", + "@babel/types": "^7.29.7", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", @@ -348,13 +348,13 @@ } }, "node_modules/@babel/generator": { - "version": "7.29.1", - "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz", - "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==", + "version": "7.29.8", + "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz", + "integrity": "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==", "license": "MIT", "dependencies": { - "@babel/parser": "^7.29.0", - "@babel/types": "^7.29.0", + "@babel/parser": "^7.29.8", + "@babel/types": "^7.29.8", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" @@ -376,13 +376,13 @@ } }, "node_modules/@babel/helper-compilation-targets": { - "version": "7.28.6", - "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz", - "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz", + "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==", "license": "MIT", "dependencies": { - "@babel/compat-data": "^7.28.6", - "@babel/helper-validator-option": "^7.27.1", + "@babel/compat-data": "^7.29.7", + "@babel/helper-validator-option": "^7.29.7", "browserslist": "^4.24.0", "lru-cache": "^5.1.1", "semver": "^6.3.1" @@ -473,9 +473,9 @@ } }, "node_modules/@babel/helper-globals": { - "version": "7.28.0", - "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz", - "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz", + "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==", "license": "MIT", "engines": { "node": ">=6.9.0" @@ -495,27 +495,27 @@ } }, "node_modules/@babel/helper-module-imports": { - "version": "7.28.6", - "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz", - "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz", + "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==", "license": "MIT", "dependencies": { - "@babel/traverse": "^7.28.6", - "@babel/types": "^7.28.6" + "@babel/traverse": "^7.29.7", + "@babel/types": "^7.29.7" }, "engines": { "node": ">=6.9.0" } }, "node_modules/@babel/helper-module-transforms": { - "version": "7.28.6", - "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz", - "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz", + "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==", "license": "MIT", "dependencies": { - "@babel/helper-module-imports": "^7.28.6", - "@babel/helper-validator-identifier": "^7.28.5", - "@babel/traverse": "^7.28.6" + "@babel/helper-module-imports": "^7.29.7", + "@babel/helper-validator-identifier": "^7.29.7", + "@babel/traverse": "^7.29.7" }, "engines": { "node": ">=6.9.0" @@ -537,9 +537,9 @@ } }, "node_modules/@babel/helper-plugin-utils": { - "version": "7.28.6", - "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.28.6.tgz", - "integrity": "sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz", + "integrity": "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==", "license": "MIT", "engines": { "node": ">=6.9.0" @@ -593,27 +593,27 @@ } }, "node_modules/@babel/helper-string-parser": { - "version": "7.27.1", - "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz", - "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz", + "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==", "license": "MIT", "engines": { "node": ">=6.9.0" } }, "node_modules/@babel/helper-validator-identifier": { - "version": "7.28.5", - "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz", - "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz", + "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==", "license": "MIT", "engines": { "node": ">=6.9.0" } }, "node_modules/@babel/helper-validator-option": { - "version": "7.27.1", - "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz", - "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz", + "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==", "license": "MIT", "engines": { "node": ">=6.9.0" @@ -634,25 +634,25 @@ } }, "node_modules/@babel/helpers": { - "version": "7.28.6", - "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.28.6.tgz", - "integrity": "sha512-xOBvwq86HHdB7WUDTfKfT/Vuxh7gElQ+Sfti2Cy6yIWNW05P8iUslOVcZ4/sKbE+/jQaukQAdz/gf3724kYdqw==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz", + "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==", "license": "MIT", "dependencies": { - "@babel/template": "^7.28.6", - "@babel/types": "^7.28.6" + "@babel/template": "^7.29.7", + "@babel/types": "^7.29.7" }, "engines": { "node": ">=6.9.0" } }, "node_modules/@babel/parser": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.0.tgz", - "integrity": "sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww==", + "version": "7.29.8", + "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz", + "integrity": "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==", "license": "MIT", "dependencies": { - "@babel/types": "^7.29.0" + "@babel/types": "^7.29.8" }, "bin": { "parser": "bin/babel-parser.js" @@ -1237,15 +1237,15 @@ } }, "node_modules/@babel/plugin-transform-modules-systemjs": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.29.0.tgz", - "integrity": "sha512-PrujnVFbOdUpw4UHiVwKvKRLMMic8+eC0CuNlxjsyZUiBjhFdPsewdXCkveh2KqBA9/waD0W1b4hXSOBQJezpQ==", + "version": "7.29.8", + "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.29.8.tgz", + "integrity": "sha512-6iSnEK0zlkLKU4heofK/AdmRD4e2SHVpJMtrwnTCzhnaM98ria4rTrOXBBi45BTTYnJtO8txnPsX4fChYXkmeA==", "license": "MIT", "dependencies": { - "@babel/helper-module-transforms": "^7.28.6", - "@babel/helper-plugin-utils": "^7.28.6", - "@babel/helper-validator-identifier": "^7.28.5", - "@babel/traverse": "^7.29.0" + "@babel/helper-module-transforms": "^7.29.7", + "@babel/helper-plugin-utils": "^7.29.7", + "@babel/helper-validator-identifier": "^7.29.7", + "@babel/traverse": "^7.29.8" }, "engines": { "node": ">=6.9.0" @@ -1954,31 +1954,31 @@ } }, "node_modules/@babel/template": { - "version": "7.28.6", - "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz", - "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz", + "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==", "license": "MIT", "dependencies": { - "@babel/code-frame": "^7.28.6", - "@babel/parser": "^7.28.6", - "@babel/types": "^7.28.6" + "@babel/code-frame": "^7.29.7", + "@babel/parser": "^7.29.7", + "@babel/types": "^7.29.7" }, "engines": { "node": ">=6.9.0" } }, "node_modules/@babel/traverse": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz", - "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==", + "version": "7.29.8", + "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.8.tgz", + "integrity": "sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==", "license": "MIT", "dependencies": { - "@babel/code-frame": "^7.29.0", - "@babel/generator": "^7.29.0", - "@babel/helper-globals": "^7.28.0", - "@babel/parser": "^7.29.0", - "@babel/template": "^7.28.6", - "@babel/types": "^7.29.0", + "@babel/code-frame": "^7.29.7", + "@babel/generator": "^7.29.8", + "@babel/helper-globals": "^7.29.7", + "@babel/parser": "^7.29.8", + "@babel/template": "^7.29.7", + "@babel/types": "^7.29.8", "debug": "^4.3.1" }, "engines": { @@ -1986,13 +1986,13 @@ } }, "node_modules/@babel/types": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz", - "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==", + "version": "7.29.8", + "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz", + "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==", "license": "MIT", "dependencies": { - "@babel/helper-string-parser": "^7.27.1", - "@babel/helper-validator-identifier": "^7.28.5" + "@babel/helper-string-parser": "^7.29.7", + "@babel/helper-validator-identifier": "^7.29.7" }, "engines": { "node": ">=6.9.0" @@ -2004,45 +2004,12 @@ "integrity": "sha512-jigsZK+sMF/cuiB7sERuo9V7N9jx+dhmHHnQyDSVdpZwVutaBu7WvNYqMDLSgFgfB30n452TP3vjDAvFC973mA==", "license": "MIT" }, - "node_modules/@chevrotain/cst-dts-gen": { - "version": "11.1.2", - "resolved": "https://registry.npmjs.org/@chevrotain/cst-dts-gen/-/cst-dts-gen-11.1.2.tgz", - "integrity": "sha512-XTsjvDVB5nDZBQB8o0o/0ozNelQtn2KrUVteIHSlPd2VAV2utEb6JzyCJaJ8tGxACR4RiBNWy5uYUHX2eji88Q==", - "license": "Apache-2.0", - "dependencies": { - "@chevrotain/gast": "11.1.2", - "@chevrotain/types": "11.1.2", - "lodash-es": "4.17.23" - } - }, - "node_modules/@chevrotain/gast": { - "version": "11.1.2", - "resolved": "https://registry.npmjs.org/@chevrotain/gast/-/gast-11.1.2.tgz", - "integrity": "sha512-Z9zfXR5jNZb1Hlsd/p+4XWeUFugrHirq36bKzPWDSIacV+GPSVXdk+ahVWZTwjhNwofAWg/sZg58fyucKSQx5g==", - "license": "Apache-2.0", - "dependencies": { - "@chevrotain/types": "11.1.2", - "lodash-es": "4.17.23" - } - }, - "node_modules/@chevrotain/regexp-to-ast": { - "version": "11.1.2", - "resolved": "https://registry.npmjs.org/@chevrotain/regexp-to-ast/-/regexp-to-ast-11.1.2.tgz", - "integrity": "sha512-nMU3Uj8naWer7xpZTYJdxbAs6RIv/dxYzkYU8GSwgUtcAAlzjcPfX1w+RKRcYG8POlzMeayOQ/znfwxEGo5ulw==", - "license": "Apache-2.0" - }, "node_modules/@chevrotain/types": { "version": "11.1.2", "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-11.1.2.tgz", "integrity": "sha512-U+HFai5+zmJCkK86QsaJtoITlboZHBqrVketcO2ROv865xfCMSFpELQoz1GkX5GzME8pTa+3kbKrZHQtI0gdbw==", "license": "Apache-2.0" }, - "node_modules/@chevrotain/utils": { - "version": "11.1.2", - "resolved": "https://registry.npmjs.org/@chevrotain/utils/-/utils-11.1.2.tgz", - "integrity": "sha512-4mudFAQ6H+MqBTfqLmU7G1ZwRzCLfJEooL/fsF6rCX5eePMbGhoy5n4g+G4vlh2muDcsCTJtL+uKbOzWxs5LHA==", - "license": "Apache-2.0" - }, "node_modules/@colors/colors": { "version": "1.5.0", "resolved": "https://registry.npmjs.org/@colors/colors/-/colors-1.5.0.tgz", @@ -4922,12 +4889,12 @@ } }, "node_modules/@mermaid-js/parser": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.0.1.tgz", - "integrity": "sha512-opmV19kN1JsK0T6HhhokHpcVkqKpF+x2pPDKKM2ThHtZAB5F4PROopk0amuVYK5qMrIA4erzpNm8gmPNJgMDxQ==", + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.2.0.tgz", + "integrity": "sha512-oYPyv8A4As1yH5Bx+04iQEQxXuIQDe0GKCNSRgao6z8AM9jixXIfP0vsppRLvGf+nKIOb9/LdpWA4YuJiVvESA==", "license": "MIT", "dependencies": { - "langium": "^4.0.0" + "@chevrotain/types": "~11.1.2" } }, "node_modules/@napi-rs/wasm-runtime": { @@ -7102,9 +7069,9 @@ } }, "node_modules/body-parser": { - "version": "1.20.4", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.4.tgz", - "integrity": "sha512-ZTgYYLMOXY9qKU/57FAo8F+HA2dGX7bqGc71txDRC1rS4frdFI5R7NhluHxH6M0YItAP0sHB4uqAOcYKxO6uGA==", + "version": "1.20.6", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.6.tgz", + "integrity": "sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==", "license": "MIT", "dependencies": { "bytes": "~3.1.2", @@ -7115,7 +7082,7 @@ "http-errors": "~2.0.1", "iconv-lite": "~0.4.24", "on-finished": "~2.4.1", - "qs": "~6.14.0", + "qs": "~6.15.1", "raw-body": "~2.5.3", "type-is": "~1.6.18", "unpipe": "~1.0.0" @@ -7161,6 +7128,22 @@ "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==", "license": "MIT" }, + "node_modules/body-parser/node_modules/qs": { + "version": "6.15.3", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz", + "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==", + "license": "BSD-3-Clause", + "dependencies": { + "es-define-property": "^1.0.1", + "side-channel": "^1.1.1" + }, + "engines": { + "node": ">=0.6" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, "node_modules/bonjour-service": { "version": "1.3.0", "resolved": "https://registry.npmjs.org/bonjour-service/-/bonjour-service-1.3.0.tgz", @@ -7200,9 +7183,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.12", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz", - "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -7544,33 +7527,6 @@ "url": "https://github.com/sponsors/fb55" } }, - "node_modules/chevrotain": { - "version": "11.1.2", - "resolved": "https://registry.npmjs.org/chevrotain/-/chevrotain-11.1.2.tgz", - "integrity": "sha512-opLQzEVriiH1uUQ4Kctsd49bRoFDXGGSC4GUqj7pGyxM3RehRhvTlZJc1FL/Flew2p5uwxa1tUDWKzI4wNM8pg==", - "license": "Apache-2.0", - "peer": true, - "dependencies": { - "@chevrotain/cst-dts-gen": "11.1.2", - "@chevrotain/gast": "11.1.2", - "@chevrotain/regexp-to-ast": "11.1.2", - "@chevrotain/types": "11.1.2", - "@chevrotain/utils": "11.1.2", - "lodash-es": "4.17.23" - } - }, - "node_modules/chevrotain-allstar": { - "version": "0.3.1", - "resolved": "https://registry.npmjs.org/chevrotain-allstar/-/chevrotain-allstar-0.3.1.tgz", - "integrity": "sha512-b7g+y9A0v4mxCW1qUhf3BSVPg+/NvGErk/dOkrDaHA0nQIQGAtrOjlX//9OQtRlSCy+x9rfB5N8yC71lH1nvMw==", - "license": "MIT", - "dependencies": { - "lodash-es": "^4.17.21" - }, - "peerDependencies": { - "chevrotain": "^11.0.0" - } - }, "node_modules/chokidar": { "version": "3.6.0", "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz", @@ -8570,9 +8526,9 @@ "license": "MIT" }, "node_modules/cytoscape": { - "version": "3.33.1", - "resolved": "https://registry.npmjs.org/cytoscape/-/cytoscape-3.33.1.tgz", - "integrity": "sha512-iJc4TwyANnOGR1OmWhsS9ayRS3s+XQ185FmuHObThD+5AeJCakAAbWv8KimMTt08xCCLNgneQwFp+JRJOr9qGQ==", + "version": "3.34.0", + "resolved": "https://registry.npmjs.org/cytoscape/-/cytoscape-3.34.0.tgz", + "integrity": "sha512-62rNSrioXw93uliKFBwjukeQyeWwH2PqDrTac31r2P6464u3AUvTk0xS4LVvT251g7IgkFunrI48ZEZGjywSOg==", "license": "MIT", "peer": true, "engines": { @@ -9080,9 +9036,9 @@ } }, "node_modules/dayjs": { - "version": "1.11.19", - "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.19.tgz", - "integrity": "sha512-t5EcLVS6QPBNqM2z8fakk/NKel+Xzshgt8FFKAn+qwlD1pzZWxh0nVCrvFK7ZDb6XucZeF9z8C7CBWTRIVApAw==", + "version": "1.11.21", + "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.21.tgz", + "integrity": "sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA==", "license": "MIT" }, "node_modules/debounce": { @@ -9394,13 +9350,10 @@ } }, "node_modules/dompurify": { - "version": "3.3.2", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.2.tgz", - "integrity": "sha512-6obghkliLdmKa56xdbLOpUZ43pAR6xFy1uOrxBaIDjT+yaRuuybLjGS9eVBoSR/UPU5fq3OXClEHLJNGvbxKpQ==", + "version": "3.4.13", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz", + "integrity": "sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==", "license": "(MPL-2.0 OR Apache-2.0)", - "engines": { - "node": ">=20" - }, "optionalDependencies": { "@types/trusted-types": "^2.0.7" } @@ -9614,6 +9567,17 @@ "node": ">= 0.4" } }, + "node_modules/es-toolkit": { + "version": "1.50.0", + "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.50.0.tgz", + "integrity": "sha512-OyZKhUVvEep9ITEiwHn8GKnMRQIVqoSIX7WnRbkWgJkllCujilqP2rD0u979tkl8wqyc8ICwlc1UBVv/Sl1G6w==", + "license": "MIT", + "workspaces": [ + "docs", + "benchmarks", + "tests/types" + ] + }, "node_modules/esast-util-from-estree": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/esast-util-from-estree/-/esast-util-from-estree-2.0.0.tgz", @@ -9998,9 +9962,9 @@ "license": "MIT" }, "node_modules/express/node_modules/path-to-regexp": { - "version": "0.1.12", - "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz", - "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==", + "version": "0.1.13", + "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz", + "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==", "license": "MIT" }, "node_modules/express/node_modules/range-parser": { @@ -10059,9 +10023,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz", - "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==", + "version": "3.1.5", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", + "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", "funding": [ { "type": "github", @@ -10301,9 +10265,9 @@ } }, "node_modules/follow-redirects": { - "version": "1.15.11", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.11.tgz", - "integrity": "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==", + "version": "1.16.0", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz", + "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==", "funding": [ { "type": "individual", @@ -10624,9 +10588,9 @@ } }, "node_modules/gray-matter/node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", + "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", "license": "MIT", "dependencies": { "argparse": "^1.0.7", @@ -11232,9 +11196,9 @@ } }, "node_modules/http-proxy-middleware": { - "version": "2.0.9", - "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.9.tgz", - "integrity": "sha512-c1IyJYLYppU574+YI7R4QyX2ystMtVXZwIdzazUIPIJsHuWNd+mho2j+bKoHftndicGj9yh+xjd+l0yj7VeT1Q==", + "version": "2.0.10", + "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.10.tgz", + "integrity": "sha512-RKzRWNPxUZqbuk3BC5mGVJbBnWgr+diEnjJexIOytFbBzDy88Fbh/YvBr3DsNrl1jYAfjWfpATEv0NO35FDuPQ==", "license": "MIT", "dependencies": { "@types/http-proxy": "^1.17.8", @@ -11842,9 +11806,9 @@ } }, "node_modules/joi": { - "version": "17.13.3", - "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.3.tgz", - "integrity": "sha512-otDA4ldcIx+ZXsKHWmp0YizCweVRZG96J10b0FevjfuncLO1oX59THoAmHkNubYJ+9gWsYsp5k8v4ib6oDv1fA==", + "version": "17.13.4", + "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.4.tgz", + "integrity": "sha512-1RuuER6kmt8K8I3nIWvPZKi5RQCb568ZPyY4Pwjlua+yo+63ZTmIwxLZH0heBmiKN4uxjvCiarDrjaeH84xicQ==", "license": "BSD-3-Clause", "dependencies": { "@hapi/hoek": "^9.3.0", @@ -11861,9 +11825,19 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", - "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], "license": "MIT", "dependencies": { "argparse": "^2.0.1" @@ -11927,9 +11901,9 @@ } }, "node_modules/katex": { - "version": "0.16.38", - "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.38.tgz", - "integrity": "sha512-cjHooZUmIAUmDsHBN+1n8LaZdpmbj03LtYeYPyuYB7OuloiaeaV6N4LcfjcnHVzGWjVQmKrxxTrpDcmSzEZQwQ==", + "version": "0.16.47", + "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz", + "integrity": "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==", "funding": [ "https://opencollective.com/katex", "https://github.com/sponsors/katex" @@ -11992,23 +11966,6 @@ "node": ">=6" } }, - "node_modules/langium": { - "version": "4.2.1", - "resolved": "https://registry.npmjs.org/langium/-/langium-4.2.1.tgz", - "integrity": "sha512-zu9QWmjpzJcomzdJQAHgDVhLGq5bLosVak1KVa40NzQHXfqr4eAHupvnPOVXEoLkg6Ocefvf/93d//SB7du4YQ==", - "license": "MIT", - "dependencies": { - "chevrotain": "~11.1.1", - "chevrotain-allstar": "~0.3.1", - "vscode-languageserver": "~9.0.1", - "vscode-languageserver-textdocument": "~1.0.11", - "vscode-uri": "~3.1.0" - }, - "engines": { - "node": ">=20.10.0", - "npm": ">=10.2.3" - } - }, "node_modules/latest-version": { "version": "7.0.0", "resolved": "https://registry.npmjs.org/latest-version/-/latest-version-7.0.0.tgz", @@ -12025,13 +11982,13 @@ } }, "node_modules/launch-editor": { - "version": "2.13.1", - "resolved": "https://registry.npmjs.org/launch-editor/-/launch-editor-2.13.1.tgz", - "integrity": "sha512-lPSddlAAluRKJ7/cjRFoXUFzaX7q/YKI7yPHuEvSJVqoXvFnJov1/Ud87Aa4zULIbA9Nja4mSPK8l0z/7eV2wA==", + "version": "2.14.1", + "resolved": "https://registry.npmjs.org/launch-editor/-/launch-editor-2.14.1.tgz", + "integrity": "sha512-QWBrQsMpH7gPr965dsKD/3cKWiNoTjpATQf++Xq63N6sKRGMwlVXz41O1IZTMfZQgBctD/K5Zt06+/I6pP6+HA==", "license": "MIT", "dependencies": { "picocolors": "^1.1.1", - "shell-quote": "^1.8.3" + "shell-quote": "^1.8.4" } }, "node_modules/layout-base": { @@ -12110,15 +12067,15 @@ } }, "node_modules/lodash": { - "version": "4.17.23", - "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz", - "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==", + "version": "4.18.1", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz", + "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==", "license": "MIT" }, "node_modules/lodash-es": { - "version": "4.17.23", - "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.23.tgz", - "integrity": "sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg==", + "version": "4.18.1", + "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.18.1.tgz", + "integrity": "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==", "license": "MIT" }, "node_modules/lodash.debounce": { @@ -12742,32 +12699,32 @@ } }, "node_modules/mermaid": { - "version": "11.13.0", - "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.13.0.tgz", - "integrity": "sha512-fEnci+Immw6lKMFI8sqzjlATTyjLkRa6axrEgLV2yHTfv8r+h1wjFbV6xeRtd4rUV1cS4EpR9rwp3Rci7TRWDw==", + "version": "11.16.1", + "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.16.1.tgz", + "integrity": "sha512-TQsq6u22fAn3rek5VOubrhKPo1g5hwC3FXUN9hiyupTckcYiGuuKGkNQrKYwGJkXUxZdojwRG46gsSCFZMDp4g==", "license": "MIT", "dependencies": { - "@braintree/sanitize-url": "^7.1.1", + "@braintree/sanitize-url": "^7.1.2", "@iconify/utils": "^3.0.2", - "@mermaid-js/parser": "^1.0.1", + "@mermaid-js/parser": "^1.2.0", "@types/d3": "^7.4.3", "@upsetjs/venn.js": "^2.0.0", - "cytoscape": "^3.33.1", + "cytoscape": "^3.33.3", "cytoscape-cose-bilkent": "^4.1.0", "cytoscape-fcose": "^2.2.0", "d3": "^7.9.0", "d3-sankey": "^0.12.3", "dagre-d3-es": "7.0.14", - "dayjs": "^1.11.19", - "dompurify": "^3.3.1", - "katex": "^0.16.25", + "dayjs": "^1.11.20", + "dompurify": "^3.3.3", + "es-toolkit": "^1.45.1", + "katex": "^0.16.45", "khroma": "^2.1.0", - "lodash-es": "^4.17.23", "marked": "^16.3.0", "roughjs": "^4.6.6", "stylis": "^4.3.6", "ts-dedent": "^2.2.0", - "uuid": "^11.1.0" + "uuid": "^11.1.0 || ^12 || ^13 || ^14.0.0" } }, "node_modules/methods": { @@ -14793,9 +14750,9 @@ } }, "node_modules/nanoid": { - "version": "3.3.11", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz", - "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "funding": [ { "type": "github", @@ -15433,9 +15390,9 @@ "license": "ISC" }, "node_modules/picomatch": { - "version": "2.3.1", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz", - "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==", + "version": "2.3.2", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz", + "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==", "license": "MIT", "engines": { "node": ">=8.6" @@ -15504,9 +15461,9 @@ } }, "node_modules/postcss": { - "version": "8.5.8", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.8.tgz", - "integrity": "sha512-OW/rX8O/jXnm82Ey1k44pObPtdblfiuWnrd8X7GJ7emImCOstunGbXUpp7HdBrFQX6rJzn3sPT397Wp5aCwCHg==", + "version": "8.5.26", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz", + "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==", "funding": [ { "type": "opencollective", @@ -15524,7 +15481,7 @@ "license": "MIT", "peer": true, "dependencies": { - "nanoid": "^3.3.11", + "nanoid": "^3.3.17", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, @@ -18250,9 +18207,9 @@ } }, "node_modules/serialize-javascript": { - "version": "7.0.4", - "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.4.tgz", - "integrity": "sha512-DuGdB+Po43Q5Jxwpzt1lhyFSYKryqoNjQSA9M92tyw0lyHIOur+XCalOUe0KTJpyqzT8+fQ5A0Jf7vCx/NKmIg==", + "version": "7.1.0", + "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.0.tgz", + "integrity": "sha512-RNEqWOyhhUQYN9V1GfHwu9AR/g+NTciH6Z5u3/no6X3/w+04J2lVDL+svFQVXgXrEGBMG2puMVN3gq2SNGuTGw==", "license": "BSD-3-Clause", "engines": { "node": ">=20.0.0" @@ -18449,9 +18406,9 @@ } }, "node_modules/shell-quote": { - "version": "1.8.3", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz", - "integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==", + "version": "1.10.0", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz", + "integrity": "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==", "license": "MIT", "engines": { "node": ">= 0.4" @@ -18461,14 +18418,14 @@ } }, "node_modules/side-channel": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz", - "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==", + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz", + "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==", "license": "MIT", "dependencies": { "es-errors": "^1.3.0", - "object-inspect": "^1.13.3", - "side-channel-list": "^1.0.0", + "object-inspect": "^1.13.4", + "side-channel-list": "^1.0.1", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" }, @@ -18480,13 +18437,13 @@ } }, "node_modules/side-channel-list": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz", - "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==", + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz", + "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==", "license": "MIT", "dependencies": { "es-errors": "^1.3.0", - "object-inspect": "^1.13.3" + "object-inspect": "^1.13.4" }, "engines": { "node": ">= 0.4" @@ -18947,9 +18904,9 @@ "license": "MIT" }, "node_modules/svgo": { - "version": "3.3.3", - "resolved": "https://registry.npmjs.org/svgo/-/svgo-3.3.3.tgz", - "integrity": "sha512-+wn7I4p7YgJhHs38k2TNjy1vCfPIfLIJWR5MnCStsN8WuuTcBnRKcMHQLMM2ijxGZmDoZwNv8ipl5aTTen62ng==", + "version": "3.3.4", + "resolved": "https://registry.npmjs.org/svgo/-/svgo-3.3.4.tgz", + "integrity": "sha512-GsNRis4e8jxn2Y9ENz/8lbJ93CstG8svtMnuRaHbiF2LTJ5tK0/q3t/URPq9Zc7zVWBJnNnJMIp6bevK7bSmNg==", "license": "MIT", "dependencies": { "commander": "^7.2.0", @@ -19293,9 +19250,9 @@ "license": "MIT" }, "node_modules/undici": { - "version": "7.22.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.22.0.tgz", - "integrity": "sha512-RqslV2Us5BrllB+JeiZnK4peryVTndy9Dnqq62S3yYRRTj0tFQCwEniUy2167skdGOy3vqRzEvl1Dm4sV2ReDg==", + "version": "7.29.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", + "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", "license": "MIT", "engines": { "node": ">=20.18.1" @@ -19759,16 +19716,16 @@ } }, "node_modules/uuid": { - "version": "11.1.0", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz", - "integrity": "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==", + "version": "14.0.1", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.1.tgz", + "integrity": "sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==", "funding": [ "https://github.com/sponsors/broofa", "https://github.com/sponsors/ctavan" ], "license": "MIT", "bin": { - "uuid": "dist/esm/bin/uuid" + "uuid": "dist-node/bin/uuid" } }, "node_modules/value-equal": { @@ -19828,55 +19785,6 @@ "url": "https://opencollective.com/unified" } }, - "node_modules/vscode-jsonrpc": { - "version": "8.2.0", - "resolved": "https://registry.npmjs.org/vscode-jsonrpc/-/vscode-jsonrpc-8.2.0.tgz", - "integrity": "sha512-C+r0eKJUIfiDIfwJhria30+TYWPtuHJXHtI7J0YlOmKAo7ogxP20T0zxB7HZQIFhIyvoBPwWskjxrvAtfjyZfA==", - "license": "MIT", - "engines": { - "node": ">=14.0.0" - } - }, - "node_modules/vscode-languageserver": { - "version": "9.0.1", - "resolved": "https://registry.npmjs.org/vscode-languageserver/-/vscode-languageserver-9.0.1.tgz", - "integrity": "sha512-woByF3PDpkHFUreUa7Hos7+pUWdeWMXRd26+ZX2A8cFx6v/JPTtd4/uN0/jB6XQHYaOlHbio03NTHCqrgG5n7g==", - "license": "MIT", - "dependencies": { - "vscode-languageserver-protocol": "3.17.5" - }, - "bin": { - "installServerIntoExtension": "bin/installServerIntoExtension" - } - }, - "node_modules/vscode-languageserver-protocol": { - "version": "3.17.5", - "resolved": "https://registry.npmjs.org/vscode-languageserver-protocol/-/vscode-languageserver-protocol-3.17.5.tgz", - "integrity": "sha512-mb1bvRJN8SVznADSGWM9u/b07H7Ecg0I3OgXDuLdn307rl/J3A9YD6/eYOssqhecL27hK1IPZAsaqh00i/Jljg==", - "license": "MIT", - "dependencies": { - "vscode-jsonrpc": "8.2.0", - "vscode-languageserver-types": "3.17.5" - } - }, - "node_modules/vscode-languageserver-textdocument": { - "version": "1.0.12", - "resolved": "https://registry.npmjs.org/vscode-languageserver-textdocument/-/vscode-languageserver-textdocument-1.0.12.tgz", - "integrity": "sha512-cxWNPesCnQCcMPeenjKKsOCKQZ/L6Tv19DTRIGuLWe32lyzWhihGVJ/rcckZXJxfdKCFvRLS3fpBIsV/ZGX4zA==", - "license": "MIT" - }, - "node_modules/vscode-languageserver-types": { - "version": "3.17.5", - "resolved": "https://registry.npmjs.org/vscode-languageserver-types/-/vscode-languageserver-types-3.17.5.tgz", - "integrity": "sha512-Ld1VelNuX9pdF39h2Hgaeb5hEZM2Z3jUrrMgWQAu82jMtZp7p3vJT3BzToKtZI7NgQssZje5o0zryOrhQvzQAg==", - "license": "MIT" - }, - "node_modules/vscode-uri": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/vscode-uri/-/vscode-uri-3.1.0.tgz", - "integrity": "sha512-/BpdSx+yCQGnCvecbyXdxHDkuk55/G3xwnC0GqY4gmQ3j+A+g8kzzgB4Nk/SINjqn6+waqw3EgbVF2QKExkRxQ==", - "license": "MIT" - }, "node_modules/watchpack": { "version": "2.5.1", "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.5.1.tgz", @@ -20057,9 +19965,9 @@ } }, "node_modules/webpack-dev-server": { - "version": "5.2.3", - "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.3.tgz", - "integrity": "sha512-9Gyu2F7+bg4Vv+pjbovuYDhHX+mqdqITykfzdM9UyKqKHlsE5aAjRhR+oOEfXW5vBeu8tarzlJFIZva4ZjAdrQ==", + "version": "5.2.6", + "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.6.tgz", + "integrity": "sha512-HNLRmamRvVavZQ+avceZifmv8hmdUjg43t6MI4SqJDwFdW7RPQwH5vzGhDRZSX59SgfbeHhLnq3g+uooWo7pVw==", "license": "MIT", "dependencies": { "@types/bonjour": "^3.5.13", @@ -20080,7 +19988,7 @@ "graceful-fs": "^4.2.6", "http-proxy-middleware": "^2.0.9", "ipaddr.js": "^2.1.0", - "launch-editor": "^2.6.1", + "launch-editor": "^2.14.1", "open": "^10.0.3", "p-retry": "^6.2.0", "schema-utils": "^4.2.0", @@ -20144,9 +20052,9 @@ } }, "node_modules/webpack-dev-server/node_modules/ws": { - "version": "8.19.0", - "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz", - "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==", + "version": "8.21.3", + "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz", + "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==", "license": "MIT", "engines": { "node": ">=10.0.0" @@ -20281,9 +20189,9 @@ } }, "node_modules/websocket-driver": { - "version": "0.7.4", - "resolved": "https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.4.tgz", - "integrity": "sha512-b17KeDIQVjvb0ssuSDF2cYXSg2iztliJ4B9WdsuB6J952qCPKmnVq4DyW5motImXHDC1cBT/1UezrJVsKw5zjg==", + "version": "0.7.5", + "resolved": "https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.5.tgz", + "integrity": "sha512-ZL2+3c7kMBdIRCMz6l8jQMHyGVxj+UL+xVk74Ombiciboca8rHa15L86B19E5oh1pL9Ii/uj54gtsIrZGMo6zA==", "license": "Apache-2.0", "dependencies": { "http-parser-js": ">=0.5.1", @@ -20430,9 +20338,9 @@ } }, "node_modules/ws": { - "version": "7.5.10", - "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.10.tgz", - "integrity": "sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ==", + "version": "7.5.13", + "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.13.tgz", + "integrity": "sha512-rsKI6xDBFVf4r/x8XyChGK04QR/XHroxs/jUcoWvtEZM8TPU/X/uIY9B1CsSzYws9ZJb/6bbBu7dPhFW00CAoA==", "license": "MIT", "engines": { "node": ">=8.3.0" diff --git a/package.json b/package.json index ee153aca1..cf8cdae47 100644 --- a/package.json +++ b/package.json @@ -61,6 +61,6 @@ "node": ">=20.18.1" }, "overrides": { - "serialize-javascript": "^7.0.3" + "serialize-javascript": "^7.0.5" } }