fix: update brace-expansion to patch GHSA-3jxr-9vmj-r5cp (exponential-time DoS) (#1599)
Some checks failed
Basic validation / Basic validation (push) Failing after 4s
Check dist / Check dist/ (push) Failing after 0s
e2e-cache / Test npm (Node 22, ubuntu-latest) (push) Successful in 10m23s
e2e-cache / Test npm (Node 24, ubuntu-latest) (push) Successful in 10m13s
e2e-cache / Test npm (Node 26, ubuntu-latest) (push) Failing after 1m36s
e2e-cache / Test pnpm (Node 22, ubuntu-latest) (push) Failing after 5m32s
e2e-cache / Test pnpm (Node 24, ubuntu-latest) (push) Failing after 34s
e2e-cache / Test pnpm (Node 26, ubuntu-latest) (push) Failing after 17m10s
e2e-cache / Test yarn 1 (Node 22, ubuntu-latest) (push) Failing after 11s
e2e-cache / Test yarn 1 (Node 24, ubuntu-latest) (push) Failing after 6s
e2e-cache / Test yarn 1 (Node 26, ubuntu-latest) (push) Failing after 7s
e2e-cache / Test yarn 3 (Node 22, ubuntu-latest) (push) Failing after 7s
e2e-cache / Test yarn 3 (Node 24, ubuntu-latest) (push) Failing after 7s
e2e-cache / Test yarn 3 (Node 26, ubuntu-latest) (push) Failing after 7s
e2e-cache / Test yarn subprojects (22) (push) Failing after 7s
e2e-cache / Test yarn subprojects (24) (push) Failing after 8s
e2e-cache / Test yarn subprojects (26) (push) Failing after 8s
e2e-cache / Test yarn subprojects all locally managed (22) (push) Failing after 11s
e2e-cache / Test yarn subprojects all locally managed (24) (push) Failing after 10s
e2e-cache / Test yarn subprojects all locally managed (26) (push) Failing after 8s
e2e-cache / Test yarn subprojects some locally managed (22) (push) Failing after 6s
e2e-cache / Test yarn subprojects some locally managed (24) (push) Failing after 7s
e2e-cache / Test yarn subprojects some locally managed (26) (push) Failing after 6s
e2e-cache / Test yarn subprojects managed by git (22) (push) Failing after 7s
e2e-cache / Test yarn subprojects managed by git (24) (push) Failing after 8s
e2e-cache / Test yarn subprojects managed by git (26) (push) Failing after 8s
e2e-cache / Test auto cache with top-level packageManager (22, ubuntu-latest) (push) Successful in 9m32s
e2e-cache / Test auto cache with top-level packageManager (24, ubuntu-latest) (push) Failing after 2m54s
e2e-cache / Test auto cache with top-level packageManager (26, ubuntu-latest) (push) Failing after 17m1s
e2e-cache / Test auto cache with devEngines.packageManager (22, ubuntu-latest) (push) Successful in 9m42s
e2e-cache / Test auto cache with devEngines.packageManager (24, ubuntu-latest) (push) Successful in 9m44s
e2e-cache / Test auto cache with devEngines.packageManager (26, ubuntu-latest) (push) Failing after 17m11s
Licensed / Licensed (push) Failing after 5s
proxy / test-proxy (push) Failing after 1m9s
proxy / test-bypass-proxy (push) Failing after 17m0s
versions / local-cache (22, ubuntu-latest) (push) Successful in 24s
versions / local-cache (24, ubuntu-latest) (push) Successful in 19s
versions / local-cache (26, ubuntu-latest) (push) Successful in 18s
versions / lts-syntax (lts/*, ubuntu-latest) (push) Failing after 17s
versions / lts-syntax (lts/-1, ubuntu-latest) (push) Failing after 16s
versions / v8-canary-syntax (26-v8-canary, ubuntu-latest) (push) Successful in 16s
versions / v8-canary-syntax (26.0.0-v8-canary, ubuntu-latest) (push) Successful in 17s
versions / v8-canary-syntax (26.0.0-v8-canary20251016054584e5cf, ubuntu-latest) (push) Successful in 17s
versions / nightly-syntax (24.0.0-nightly, ubuntu-latest) (push) Successful in 17s
versions / nightly-syntax (25-nightly, ubuntu-latest) (push) Successful in 17s
versions / nightly-syntax (26-nightly, ubuntu-latest) (push) Successful in 16s
versions / rc-syntax (22.14.0-rc.1, ubuntu-latest) (push) Successful in 16s
versions / rc-syntax (24.0.0-rc.4, ubuntu-latest) (push) Successful in 16s
versions / rc-syntax (26.0.0-rc.1, ubuntu-latest) (push) Failing after 17m15s
versions / manifest (22.0.0, ubuntu-latest) (push) Successful in 26s
versions / manifest (24.9.0, ubuntu-latest) (push) Successful in 17s
versions / manifest (26.5.0, ubuntu-latest) (push) Successful in 17s
versions / check-latest (22, ubuntu-latest) (push) Successful in 26s
versions / check-latest (24, ubuntu-latest) (push) Successful in 26s
versions / check-latest (26, ubuntu-latest) (push) Successful in 25s
versions / version-file (.nvmrc, ubuntu-latest) (push) Successful in 17s
versions / version-file (.tool-versions, ubuntu-latest) (push) Successful in 16s
versions / version-file (.tool-versions-node, ubuntu-latest) (push) Successful in 15s
versions / version-file (package.json, ubuntu-latest) (push) Successful in 16s
versions / version-file-dev-engines (ubuntu-latest) (push) Successful in 22s
versions / version-file-volta (ubuntu-latest) (push) Successful in 17s
versions / version-file-volta-extends (ubuntu-latest) (push) Successful in 16s
versions / node-dist (21, ubuntu-latest) (push) Successful in 17s
versions / node-dist (23, ubuntu-latest) (push) Successful in 16s
versions / old-versions (ubuntu-latest) (push) Successful in 7s
versions / node-latest-aliases (current, ubuntu-latest) (push) Successful in 46s
versions / node-latest-aliases (latest, ubuntu-latest) (push) Successful in 22s
versions / node-latest-aliases (node, ubuntu-latest) (push) Successful in 19s
e2e-cache / Test npm (Node 22, macos-15-intel) (push) Has been cancelled
e2e-cache / Test npm (Node 22, macos-latest) (push) Has been cancelled
e2e-cache / Test npm (Node 22, windows-latest) (push) Has been cancelled
e2e-cache / Test npm (Node 24, macos-15-intel) (push) Has been cancelled
e2e-cache / Test npm (Node 24, macos-latest) (push) Has been cancelled
e2e-cache / Test npm (Node 24, windows-latest) (push) Has been cancelled
e2e-cache / Test npm (Node 26, macos-15-intel) (push) Has been cancelled
e2e-cache / Test npm (Node 26, macos-latest) (push) Has been cancelled
e2e-cache / Test npm (Node 26, windows-latest) (push) Has been cancelled
e2e-cache / Test pnpm (Node 22, macos-15-intel) (push) Has been cancelled
e2e-cache / Test pnpm (Node 22, macos-latest) (push) Has been cancelled
e2e-cache / Test pnpm (Node 22, windows-latest) (push) Has been cancelled
e2e-cache / Test pnpm (Node 24, macos-15-intel) (push) Has been cancelled
e2e-cache / Test pnpm (Node 24, macos-latest) (push) Has been cancelled
e2e-cache / Test pnpm (Node 24, windows-latest) (push) Has been cancelled
e2e-cache / Test pnpm (Node 26, macos-15-intel) (push) Has been cancelled
e2e-cache / Test pnpm (Node 26, macos-latest) (push) Has been cancelled
e2e-cache / Test pnpm (Node 26, windows-latest) (push) Has been cancelled
e2e-cache / Test yarn 1 (Node 22, macos-15-intel) (push) Has been cancelled
e2e-cache / Test yarn 1 (Node 22, macos-latest) (push) Has been cancelled
e2e-cache / Test yarn 1 (Node 22, windows-latest) (push) Has been cancelled
e2e-cache / Test yarn 1 (Node 24, macos-15-intel) (push) Has been cancelled
e2e-cache / Test yarn 1 (Node 24, macos-latest) (push) Has been cancelled
e2e-cache / Test yarn 1 (Node 24, windows-latest) (push) Has been cancelled
e2e-cache / Test yarn 1 (Node 26, macos-15-intel) (push) Has been cancelled
e2e-cache / Test yarn 1 (Node 26, macos-latest) (push) Has been cancelled
e2e-cache / Test yarn 1 (Node 26, windows-latest) (push) Has been cancelled
e2e-cache / Test yarn 3 (Node 22, macos-15-intel) (push) Has been cancelled
e2e-cache / Test yarn 3 (Node 22, macos-latest) (push) Has been cancelled
e2e-cache / Test yarn 3 (Node 22, windows-latest) (push) Has been cancelled
e2e-cache / Test yarn 3 (Node 24, macos-15-intel) (push) Has been cancelled
e2e-cache / Test yarn 3 (Node 24, macos-latest) (push) Has been cancelled
e2e-cache / Test yarn 3 (Node 24, windows-latest) (push) Has been cancelled
e2e-cache / Test yarn 3 (Node 26, macos-15-intel) (push) Has been cancelled
e2e-cache / Test yarn 3 (Node 26, macos-latest) (push) Has been cancelled
e2e-cache / Test yarn 3 (Node 26, windows-latest) (push) Has been cancelled
e2e-cache / Test auto cache with top-level packageManager (22, macos-15-intel) (push) Has been cancelled
e2e-cache / Test auto cache with top-level packageManager (22, macos-latest) (push) Has been cancelled
e2e-cache / Test auto cache with top-level packageManager (22, windows-latest) (push) Has been cancelled
e2e-cache / Test auto cache with top-level packageManager (24, macos-15-intel) (push) Has been cancelled
e2e-cache / Test auto cache with top-level packageManager (24, macos-latest) (push) Has been cancelled
e2e-cache / Test auto cache with top-level packageManager (24, windows-latest) (push) Has been cancelled
e2e-cache / Test auto cache with top-level packageManager (26, macos-15-intel) (push) Has been cancelled
e2e-cache / Test auto cache with top-level packageManager (26, macos-latest) (push) Has been cancelled
e2e-cache / Test auto cache with top-level packageManager (26, windows-latest) (push) Has been cancelled
e2e-cache / Test auto cache with devEngines.packageManager (22, macos-15-intel) (push) Has been cancelled
e2e-cache / Test auto cache with devEngines.packageManager (22, macos-latest) (push) Has been cancelled
e2e-cache / Test auto cache with devEngines.packageManager (22, windows-latest) (push) Has been cancelled
e2e-cache / Test auto cache with devEngines.packageManager (24, macos-15-intel) (push) Has been cancelled
e2e-cache / Test auto cache with devEngines.packageManager (24, macos-latest) (push) Has been cancelled
e2e-cache / Test auto cache with devEngines.packageManager (24, windows-latest) (push) Has been cancelled
e2e-cache / Test auto cache with devEngines.packageManager (26, macos-15-intel) (push) Has been cancelled
e2e-cache / Test auto cache with devEngines.packageManager (26, macos-latest) (push) Has been cancelled
e2e-cache / Test auto cache with devEngines.packageManager (26, windows-latest) (push) Has been cancelled
versions / local-cache (22, macos-15-intel) (push) Has been cancelled
versions / local-cache (22, macos-latest) (push) Has been cancelled
versions / local-cache (22, windows-latest) (push) Has been cancelled
versions / local-cache (24, macos-15-intel) (push) Has been cancelled
versions / local-cache (24, macos-latest) (push) Has been cancelled
versions / local-cache (24, windows-latest) (push) Has been cancelled
versions / local-cache (26, macos-15-intel) (push) Has been cancelled
versions / local-cache (26, macos-latest) (push) Has been cancelled
versions / local-cache (26, windows-latest) (push) Has been cancelled
versions / lts-syntax (lts/*, macos-15-intel) (push) Has been cancelled
versions / lts-syntax (lts/*, windows-latest) (push) Has been cancelled
versions / lts-syntax (lts/-1, macos-15-intel) (push) Has been cancelled
versions / lts-syntax (lts/-1, windows-latest) (push) Has been cancelled
versions / v8-canary-syntax (26-v8-canary, macos-15-intel) (push) Has been cancelled
versions / v8-canary-syntax (26-v8-canary, macos-latest) (push) Has been cancelled
versions / v8-canary-syntax (26-v8-canary, windows-latest) (push) Has been cancelled
versions / v8-canary-syntax (26.0.0-v8-canary, macos-15-intel) (push) Has been cancelled
versions / v8-canary-syntax (26.0.0-v8-canary, macos-latest) (push) Has been cancelled
versions / v8-canary-syntax (26.0.0-v8-canary, windows-latest) (push) Has been cancelled
versions / v8-canary-syntax (26.0.0-v8-canary20251016054584e5cf, macos-15-intel) (push) Has been cancelled
versions / v8-canary-syntax (26.0.0-v8-canary20251016054584e5cf, macos-latest) (push) Has been cancelled
versions / v8-canary-syntax (26.0.0-v8-canary20251016054584e5cf, windows-latest) (push) Has been cancelled
versions / nightly-syntax (24.0.0-nightly, macos-15-intel) (push) Has been cancelled
versions / nightly-syntax (24.0.0-nightly, macos-latest) (push) Has been cancelled
versions / nightly-syntax (24.0.0-nightly, windows-latest) (push) Has been cancelled
versions / nightly-syntax (25-nightly, macos-15-intel) (push) Has been cancelled
versions / nightly-syntax (25-nightly, macos-latest) (push) Has been cancelled
versions / nightly-syntax (25-nightly, windows-latest) (push) Has been cancelled
versions / nightly-syntax (26-nightly, macos-15-intel) (push) Has been cancelled
versions / nightly-syntax (26-nightly, macos-latest) (push) Has been cancelled
versions / nightly-syntax (26-nightly, windows-latest) (push) Has been cancelled
versions / rc-syntax (22.14.0-rc.1, macos-15-intel) (push) Has been cancelled
versions / rc-syntax (22.14.0-rc.1, macos-latest) (push) Has been cancelled
versions / rc-syntax (22.14.0-rc.1, windows-latest) (push) Has been cancelled
versions / rc-syntax (24.0.0-rc.4, macos-15-intel) (push) Has been cancelled
versions / rc-syntax (24.0.0-rc.4, macos-latest) (push) Has been cancelled
versions / rc-syntax (24.0.0-rc.4, windows-latest) (push) Has been cancelled
versions / rc-syntax (26.0.0-rc.1, macos-15-intel) (push) Has been cancelled
versions / rc-syntax (26.0.0-rc.1, macos-latest) (push) Has been cancelled
versions / rc-syntax (26.0.0-rc.1, windows-latest) (push) Has been cancelled
versions / manifest (22.0.0, macos-15-intel) (push) Has been cancelled
versions / manifest (22.0.0, macos-latest) (push) Has been cancelled
versions / manifest (22.0.0, windows-latest) (push) Has been cancelled
versions / manifest (24.9.0, macos-15-intel) (push) Has been cancelled
versions / manifest (24.9.0, macos-latest) (push) Has been cancelled
versions / manifest (24.9.0, windows-latest) (push) Has been cancelled
versions / manifest (26.5.0, macos-15-intel) (push) Has been cancelled
versions / manifest (26.5.0, macos-latest) (push) Has been cancelled
versions / manifest (26.5.0, windows-latest) (push) Has been cancelled
versions / check-latest (22, macos-15-intel) (push) Has been cancelled
versions / check-latest (22, macos-latest) (push) Has been cancelled
versions / check-latest (22, windows-latest) (push) Has been cancelled
versions / check-latest (24, macos-15-intel) (push) Has been cancelled
versions / check-latest (24, macos-latest) (push) Has been cancelled
versions / check-latest (24, windows-latest) (push) Has been cancelled
versions / check-latest (26, macos-15-intel) (push) Has been cancelled
versions / check-latest (26, macos-latest) (push) Has been cancelled
versions / check-latest (26, windows-latest) (push) Has been cancelled
versions / version-file (.nvmrc, macos-15-intel) (push) Has been cancelled
versions / version-file (.nvmrc, macos-latest) (push) Has been cancelled
versions / version-file (.nvmrc, windows-latest) (push) Has been cancelled
versions / version-file (.tool-versions, macos-15-intel) (push) Has been cancelled
versions / version-file (.tool-versions, macos-latest) (push) Has been cancelled
versions / version-file (.tool-versions, windows-latest) (push) Has been cancelled
versions / version-file (.tool-versions-node, macos-15-intel) (push) Has been cancelled
versions / version-file (.tool-versions-node, macos-latest) (push) Has been cancelled
versions / version-file (.tool-versions-node, windows-latest) (push) Has been cancelled
versions / version-file (package.json, macos-15-intel) (push) Has been cancelled
versions / version-file (package.json, macos-latest) (push) Has been cancelled
versions / version-file (package.json, windows-latest) (push) Has been cancelled
versions / version-file-dev-engines (macos-latest) (push) Has been cancelled
versions / version-file-dev-engines (windows-latest) (push) Has been cancelled
versions / version-file-volta (macos-15-intel) (push) Has been cancelled
versions / version-file-volta (macos-latest) (push) Has been cancelled
versions / version-file-volta (windows-latest) (push) Has been cancelled
versions / version-file-volta-extends (macos-15-intel) (push) Has been cancelled
versions / version-file-volta-extends (macos-latest) (push) Has been cancelled
versions / version-file-volta-extends (windows-latest) (push) Has been cancelled
versions / node-dist (21, macos-15-intel) (push) Has been cancelled
versions / node-dist (21, macos-latest) (push) Has been cancelled
versions / node-dist (21, windows-latest) (push) Has been cancelled
versions / node-dist (23, macos-15-intel) (push) Has been cancelled
versions / node-dist (23, macos-latest) (push) Has been cancelled
versions / node-dist (23, windows-latest) (push) Has been cancelled
versions / old-versions (macos-15-intel) (push) Has been cancelled
versions / old-versions (windows-latest) (push) Has been cancelled
versions / arch (push) Has been cancelled
versions / node-latest-aliases (current, macos-15-intel) (push) Has been cancelled
versions / node-latest-aliases (current, macos-latest) (push) Has been cancelled
versions / node-latest-aliases (current, windows-latest) (push) Has been cancelled
versions / node-latest-aliases (latest, macos-15-intel) (push) Has been cancelled
versions / node-latest-aliases (latest, macos-latest) (push) Has been cancelled
versions / node-latest-aliases (latest, windows-latest) (push) Has been cancelled
versions / node-latest-aliases (node, macos-15-intel) (push) Has been cancelled
versions / node-latest-aliases (node, macos-latest) (push) Has been cancelled
versions / node-latest-aliases (node, windows-latest) (push) Has been cancelled
Update configuration files / Update configuration files (push) Failing after 4s
CodeQL analysis / CodeQL analysis (push) Failing after 0s

* Initial plan

* fix: update brace-expansion to address GHSA-3jxr-9vmj-r5cp and rebuild dist

- brace-expansion 1.1.13 → 1.1.16 (GHSA-3jxr-9vmj-r5cp patched floor: 1.1.16)
- brace-expansion 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp patched floor: 2.1.2)
- brace-expansion 5.0.6 → 5.0.8 (GHSA-3jxr-9vmj-r5cp patched floor: 5.0.7; also fixes GHSA-mh99-v99m-4gvg)
- Regenerated package-lock.json
- Rebuilt dist/setup/index.js and dist/cache-save/index.js with patched dependency

Closes #1596

* fix: eliminate remaining brace-expansion vulnerabilities and update license cache

## Basic validation CI fix
Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x
from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages:
- `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the
  root @actions/glob@0.7.0 (minimatch@10.x → brace-expansion@5.0.8) instead
  of its bundled @actions/glob@0.6.1 (minimatch@3.x → brace-expansion@1.x)
- `"glob": {"minimatch": "^10.2.5"}` - forces glob@10.x to use
  minimatch@10.x → brace-expansion@5.0.8 instead of minimatch@9.x → brace-expansion@2.x
- `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that
  natively uses minimatch@10.x (instead of @3.x), removing brace-expansion@1.x
  from the jest coverage instrumentation path

`npm audit --audit-level=high` now reports 0 vulnerabilities.

## Licensed CI fix
Update .licenses/npm/ cache to match the new dependency tree:
- Add: brace-expansion-5.0.8.dep.yml
- Add: minimatch-10.2.6.dep.yml
- Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit)
- Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit)
- Remove stale: minimatch-3.1.5.dep.yml
- Remove stale: @actions/glob-0.6.1.dep.yml
- Remove stale: concat-map.dep.yml
- Remove stale: balanced-match-1.0.2.dep.yml

Rebuild dist artifacts to include updated brace-expansion.

* fix: replace brace-expansion workarounds with single override

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
This commit is contained in:
Copilot
2026-07-29 13:03:59 -05:00
committed by GitHub
parent 32f57ac043
commit e51e5fe84f
9 changed files with 3150 additions and 3112 deletions

336
package-lock.json generated
View File

@@ -69,6 +69,18 @@
"minimatch": "^3.0.4"
}
},
"node_modules/@actions/cache/node_modules/minimatch": {
"version": "3.1.5",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
"integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
"license": "ISC",
"dependencies": {
"brace-expansion": "^1.1.7"
},
"engines": {
"node": "*"
}
},
"node_modules/@actions/core": {
"version": "3.0.1",
"resolved": "https://registry.npmjs.org/@actions/core/-/core-3.0.1.tgz",
@@ -123,27 +135,6 @@
"minimatch": "^10.2.5"
}
},
"node_modules/@actions/glob/node_modules/balanced-match": {
"version": "4.0.4",
"resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
"integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
"license": "MIT",
"engines": {
"node": "18 || 20 || >=22"
}
},
"node_modules/@actions/glob/node_modules/brace-expansion": {
"version": "5.0.6",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
"integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
"license": "MIT",
"dependencies": {
"balanced-match": "^4.0.2"
},
"engines": {
"node": "18 || 20 || >=22"
}
},
"node_modules/@actions/glob/node_modules/minimatch": {
"version": "10.2.5",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
@@ -907,35 +898,38 @@
"license": "MIT"
},
"node_modules/@emnapi/core": {
"version": "1.10.0",
"resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
"integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
"version": "2.0.0-alpha.3",
"resolved": "https://registry.npmjs.org/@emnapi/core/-/core-2.0.0-alpha.3.tgz",
"integrity": "sha512-AZypUeJ/yByuxyS7BlSNRDOMLMlROYtjYdIAuBmJssVz1UJDSeYxLrdizhXCFYhedC5bqd/ASy8EuNXbVVXp9g==",
"dev": true,
"license": "MIT",
"optional": true,
"peer": true,
"dependencies": {
"@emnapi/wasi-threads": "1.2.1",
"@emnapi/wasi-threads": "2.0.1",
"tslib": "^2.4.0"
}
},
"node_modules/@emnapi/runtime": {
"version": "1.10.0",
"resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
"integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
"version": "2.0.0-alpha.3",
"resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-2.0.0-alpha.3.tgz",
"integrity": "sha512-hFPAhMUjJD9BSyCANEISPOogeXC9Zo9ZQl7L6vKnaVsMkCtzznaW/naYypeyl0Gv5rYfWYsZbpixTMpjDJzQeA==",
"dev": true,
"license": "MIT",
"optional": true,
"peer": true,
"dependencies": {
"tslib": "^2.4.0"
}
},
"node_modules/@emnapi/wasi-threads": {
"version": "1.2.1",
"resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
"integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
"version": "2.0.1",
"resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-2.0.1.tgz",
"integrity": "sha512-9DsSk+o5NBX0CCJT8s0EROGSGxjR/tKu6aBTaVyq+SjAEQH4XcdcRxPBRzsBLizTTJ49MJjF+jgu3qnO9GLQcQ==",
"dev": true,
"license": "MIT",
"optional": true,
"peer": true,
"dependencies": {
"tslib": "^2.4.0"
}
@@ -984,29 +978,6 @@
"node": "^20.19.0 || ^22.13.0 || >=24"
}
},
"node_modules/@eslint/config-array/node_modules/balanced-match": {
"version": "4.0.4",
"resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
"integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
"dev": true,
"license": "MIT",
"engines": {
"node": "18 || 20 || >=22"
}
},
"node_modules/@eslint/config-array/node_modules/brace-expansion": {
"version": "5.0.6",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
"integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
"dev": true,
"license": "MIT",
"dependencies": {
"balanced-match": "^4.0.2"
},
"engines": {
"node": "18 || 20 || >=22"
}
},
"node_modules/@eslint/config-array/node_modules/minimatch": {
"version": "10.2.5",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
@@ -1653,22 +1624,25 @@
}
},
"node_modules/@napi-rs/wasm-runtime": {
"version": "1.1.5",
"resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.5.tgz",
"integrity": "sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q==",
"version": "1.2.0",
"resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.0.tgz",
"integrity": "sha512-kDoONqMa+VnZ4vvvu/ZUurpJ4gkZU57e7g69qpNgWhYcZFPUHZM2CEMKm+cG6ufDVALbjMvfmMjFVqaK7uEMnA==",
"dev": true,
"license": "MIT",
"optional": true,
"dependencies": {
"@tybys/wasm-util": "^0.10.2"
"@tybys/wasm-util": "^0.10.3"
},
"engines": {
"node": "^20.19.0 || ^22.13.0 || >=23.5.0"
},
"funding": {
"type": "github",
"url": "https://github.com/sponsors/Brooooooklyn"
},
"peerDependencies": {
"@emnapi/core": "^1.7.1",
"@emnapi/runtime": "^1.7.1"
"@emnapi/core": "^2.0.0-alpha.3",
"@emnapi/runtime": "^2.0.0-alpha.3"
}
},
"node_modules/@nodable/entities": {
@@ -2210,29 +2184,6 @@
"typescript": ">=4.8.4 <6.1.0"
}
},
"node_modules/@typescript-eslint/typescript-estree/node_modules/balanced-match": {
"version": "4.0.4",
"resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
"integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
"dev": true,
"license": "MIT",
"engines": {
"node": "18 || 20 || >=22"
}
},
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
"version": "5.0.6",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
"integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
"dev": true,
"license": "MIT",
"dependencies": {
"balanced-match": "^4.0.2"
},
"engines": {
"node": "18 || 20 || >=22"
}
},
"node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
"version": "10.2.5",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
@@ -2431,6 +2382,9 @@
"arm64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
@@ -2445,6 +2399,9 @@
"arm64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MIT",
"optional": true,
"os": [
@@ -2459,6 +2416,9 @@
"loong64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
@@ -2473,6 +2433,9 @@
"loong64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MIT",
"optional": true,
"os": [
@@ -2487,6 +2450,9 @@
"ppc64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
@@ -2501,6 +2467,9 @@
"riscv64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
@@ -2515,6 +2484,9 @@
"riscv64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MIT",
"optional": true,
"os": [
@@ -2529,6 +2501,9 @@
"s390x"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
@@ -2596,6 +2571,40 @@
"node": ">=14.0.0"
}
},
"node_modules/@unrs/resolver-binding-wasm32-wasi/node_modules/@emnapi/core": {
"version": "1.10.0",
"resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
"integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
"dev": true,
"license": "MIT",
"optional": true,
"dependencies": {
"@emnapi/wasi-threads": "1.2.1",
"tslib": "^2.4.0"
}
},
"node_modules/@unrs/resolver-binding-wasm32-wasi/node_modules/@emnapi/runtime": {
"version": "1.10.0",
"resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
"integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
"dev": true,
"license": "MIT",
"optional": true,
"dependencies": {
"tslib": "^2.4.0"
}
},
"node_modules/@unrs/resolver-binding-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
"version": "1.2.1",
"resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
"integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
"dev": true,
"license": "MIT",
"optional": true,
"dependencies": {
"tslib": "^2.4.0"
}
},
"node_modules/@unrs/resolver-binding-win32-arm64-msvc": {
"version": "1.12.2",
"resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-arm64-msvc/-/resolver-binding-win32-arm64-msvc-1.12.2.tgz",
@@ -2808,6 +2817,56 @@
"node": ">=12"
}
},
"node_modules/babel-plugin-istanbul/node_modules/glob": {
"version": "7.2.3",
"resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
"integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
"deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
"dev": true,
"license": "ISC",
"dependencies": {
"fs.realpath": "^1.0.0",
"inflight": "^1.0.4",
"inherits": "2",
"minimatch": "^3.1.1",
"once": "^1.3.0",
"path-is-absolute": "^1.0.0"
},
"engines": {
"node": "*"
},
"funding": {
"url": "https://github.com/sponsors/isaacs"
}
},
"node_modules/babel-plugin-istanbul/node_modules/minimatch": {
"version": "3.1.5",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
"integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
"dev": true,
"license": "ISC",
"dependencies": {
"brace-expansion": "^1.1.7"
},
"engines": {
"node": "*"
}
},
"node_modules/babel-plugin-istanbul/node_modules/test-exclude": {
"version": "6.0.0",
"resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
"integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
"dev": true,
"license": "ISC",
"dependencies": {
"@istanbuljs/schema": "^0.1.2",
"glob": "^7.1.4",
"minimatch": "^3.0.4"
},
"engines": {
"node": ">=8"
}
},
"node_modules/babel-plugin-jest-hoist": {
"version": "30.4.0",
"resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-30.4.0.tgz",
@@ -2866,10 +2925,13 @@
}
},
"node_modules/balanced-match": {
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
"integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
"license": "MIT"
"version": "4.0.4",
"resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
"integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
"license": "MIT",
"engines": {
"node": "18 || 20 || >=22"
}
},
"node_modules/baseline-browser-mapping": {
"version": "2.10.38",
@@ -2891,13 +2953,15 @@
"license": "Apache-2.0"
},
"node_modules/brace-expansion": {
"version": "1.1.13",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
"version": "5.0.8",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
"integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
"license": "MIT",
"dependencies": {
"balanced-match": "^1.0.0",
"concat-map": "0.0.1"
"balanced-match": "^4.0.2"
},
"engines": {
"node": "20 || >=22"
}
},
"node_modules/browserslist": {
@@ -3171,12 +3235,6 @@
"dev": true,
"license": "MIT"
},
"node_modules/concat-map": {
"version": "0.0.1",
"resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
"integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
"license": "MIT"
},
"node_modules/convert-source-map": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
@@ -3563,29 +3621,6 @@
"url": "https://opencollective.com/eslint"
}
},
"node_modules/eslint/node_modules/balanced-match": {
"version": "4.0.4",
"resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
"integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
"dev": true,
"license": "MIT",
"engines": {
"node": "18 || 20 || >=22"
}
},
"node_modules/eslint/node_modules/brace-expansion": {
"version": "5.0.6",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
"integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
"dev": true,
"license": "MIT",
"dependencies": {
"balanced-match": "^4.0.2"
},
"engines": {
"node": "18 || 20 || >=22"
}
},
"node_modules/eslint/node_modules/eslint-visitor-keys": {
"version": "5.0.1",
"resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
@@ -4039,16 +4074,6 @@
"node": ">=10.13.0"
}
},
"node_modules/glob/node_modules/brace-expansion": {
"version": "2.1.1",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz",
"integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==",
"dev": true,
"license": "MIT",
"dependencies": {
"balanced-match": "^1.0.0"
}
},
"node_modules/glob/node_modules/minimatch": {
"version": "9.0.9",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
@@ -5207,18 +5232,6 @@
"node": ">=6"
}
},
"node_modules/minimatch": {
"version": "3.1.5",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
"integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
"license": "ISC",
"dependencies": {
"brace-expansion": "^1.1.7"
},
"engines": {
"node": "*"
}
},
"node_modules/minimist": {
"version": "1.2.8",
"resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
@@ -6074,43 +6087,6 @@
"url": "https://opencollective.com/webpack"
}
},
"node_modules/test-exclude": {
"version": "6.0.0",
"resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
"integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
"dev": true,
"license": "ISC",
"dependencies": {
"@istanbuljs/schema": "^0.1.2",
"glob": "^7.1.4",
"minimatch": "^3.0.4"
},
"engines": {
"node": ">=8"
}
},
"node_modules/test-exclude/node_modules/glob": {
"version": "7.2.3",
"resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
"integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
"deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
"dev": true,
"license": "ISC",
"dependencies": {
"fs.realpath": "^1.0.0",
"inflight": "^1.0.4",
"inherits": "2",
"minimatch": "^3.1.1",
"once": "^1.3.0",
"path-is-absolute": "^1.0.0"
},
"engines": {
"node": "*"
},
"funding": {
"url": "https://github.com/sponsors/isaacs"
}
},
"node_modules/tinyglobby": {
"version": "0.2.17",
"resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",