From f08d49909c20864e7793424bbf20affc0675297e Mon Sep 17 00:00:00 2001 From: John Smith Date: Sun, 26 Jul 2026 12:08:41 -0400 Subject: [PATCH 1/9] fix: batch remediation - resolve 12 open issues MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Fix #56: Create CHANGELOG.md and PR/issue templates - Fix #57: Update CodeQL to autobuild for JS/TS and Rust - Fix #58: Remove unwrap panic in torrential download.rs - Fix #59: Document console.error in client-side error handler - Fix #46: Remove @ts-expect-error by aligning authMecs type - Fix #47: Add content-collections typegen script for sites/promo - Fix #49: Update starlight-links-validator to Astro 7 compatible - Fix #50: Add prettier-plugin-astro to sites/docs - Fix #55: Replace OSV-Scanner reusable workflow with CLI - Fix #62: Complete jsonwebtoken → jose migration - Fix #63: Pin all Tauri sub-crate wildcard dependencies Closes #46, #47, #49, #50, #55, #56, #57, #58, #59, #62, #63 --- .github/ISSUE_TEMPLATE/bug.yml | 102 ++++++++++++ .github/ISSUE_TEMPLATE/feature.yml | 74 +++++++++ .github/PULL_REQUEST_TEMPLATE.md | 36 +++++ .github/workflows/codeql.yml | 4 +- .github/workflows/osv-scanner.yml | 56 +++---- CHANGELOG.md | 29 ++++ desktop/src-tauri/Cargo.toml | 2 +- desktop/src-tauri/client/Cargo.toml | 12 +- desktop/src-tauri/database/Cargo.toml | 2 +- desktop/src-tauri/download_manager/Cargo.toml | 2 +- desktop/src-tauri/games/Cargo.toml | 8 +- desktop/src-tauri/process/Cargo.toml | 4 +- desktop/src-tauri/remote/Cargo.toml | 2 +- desktop/src-tauri/tailscale/Cargo.toml | 2 +- pnpm-lock.yaml | 146 +++++++----------- server/composables/users.ts | 3 +- server/package.json | 1 - server/plugins/error-handler.ts | 3 + .../server/internal/clients/event-handler.ts | 12 +- sites/docs/package.json | 6 +- sites/promo/package.json | 3 +- torrential/src/downloads/download.rs | 34 +--- 22 files changed, 366 insertions(+), 177 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/bug.yml create mode 100644 .github/ISSUE_TEMPLATE/feature.yml create mode 100644 .github/PULL_REQUEST_TEMPLATE.md create mode 100644 CHANGELOG.md diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml new file mode 100644 index 000000000..1fe294c95 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -0,0 +1,102 @@ +name: Bug Report +description: Report a bug or issue with Drop +title: "[Bug]: " +labels: ["bug"] +body: + - type: markdown + attributes: + value: | + Thanks for taking the time to report a bug! Please fill out the information below to help us investigate. + + - type: textarea + id: description + attributes: + label: Bug Description + description: A clear and concise description of what the bug is. + placeholder: Tell us what happened... + validations: + required: true + + - type: textarea + id: steps + attributes: + label: Steps to Reproduce + description: Steps to reproduce the behavior. + placeholder: | + 1. Go to '...' + 2. Click on '...' + 3. Scroll down to '...' + 4. See error + validations: + required: true + + - type: textarea + id: expected + attributes: + label: Expected Behavior + description: A clear and concise description of what you expected to happen. + validations: + required: true + + - type: textarea + id: actual + attributes: + label: Actual Behavior + description: A clear and concise description of what actually happened. + validations: + required: true + + - type: textarea + id: screenshots + attributes: + label: Screenshots + description: If applicable, add screenshots to help explain your problem. + + - type: dropdown + id: component + attributes: + label: Affected Component + description: Which part of Drop is affected? + options: + - Server (API/Backend) + - Desktop Client + - CLI + - Documentation + - CI/CD + - Other + validations: + required: true + + - type: input + id: version + attributes: + label: Version + description: What version of Drop are you running? + placeholder: e.g., 1.0.0 + + - type: textarea + id: environment + attributes: + label: Environment + description: | + Any relevant environment details: + - OS: [e.g., Ubuntu 22.04, Windows 11, macOS 14] + - Browser (if applicable): [e.g., Chrome 120, Firefox 121] + - Node.js version (if applicable): + - pnpm version (if applicable): + + - type: textarea + id: logs + attributes: + label: Relevant Logs + description: Please copy and paste any relevant log output. + render: shell + + - type: checkboxes + id: terms + attributes: + label: Code of Conduct + description: By submitting this issue, you agree to follow our Code of Conduct + options: + - label: I agree to follow this project's Code of Conduct + required: true diff --git a/.github/ISSUE_TEMPLATE/feature.yml b/.github/ISSUE_TEMPLATE/feature.yml new file mode 100644 index 000000000..613133c0f --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature.yml @@ -0,0 +1,74 @@ +name: Feature Request +description: Suggest a new feature or enhancement for Drop +title: "[Feature]: " +labels: ["enhancement"] +body: + - type: markdown + attributes: + value: | + Thanks for suggesting a feature! Please fill out the information below to help us understand your request. + + - type: textarea + id: problem + attributes: + label: Problem Statement + description: A clear and concise description of what problem this feature would solve. + placeholder: I'm always frustrated when... + validations: + required: true + + - type: textarea + id: solution + attributes: + label: Proposed Solution + description: A clear and concise description of what you want to happen. + validations: + required: true + + - type: textarea + id: alternatives + attributes: + label: Alternatives Considered + description: A clear and concise description of any alternative solutions or features you've considered. + + - type: dropdown + id: component + attributes: + label: Affected Component + description: Which part of Drop would this affect? + options: + - Server (API/Backend) + - Desktop Client + - CLI + - Documentation + - CI/CD + - Other + validations: + required: true + + - type: dropdown + id: priority + attributes: + label: Priority + description: How important is this feature to you? + options: + - Nice to have + - Important + - Critical for my use case + validations: + required: true + + - type: textarea + id: additional + attributes: + label: Additional Context + description: Add any other context, screenshots, or examples about the feature request here. + + - type: checkboxes + id: terms + attributes: + label: Code of Conduct + description: By submitting this issue, you agree to follow our Code of Conduct + options: + - label: I agree to follow this project's Code of Conduct + required: true diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 000000000..8a83b38d4 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,36 @@ +## Description + + + +## Related Issues + + + +## Type of Change + +- [ ] Bug fix (non-breaking change which fixes an issue) +- [ ] New feature (non-breaking change which adds functionality) +- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) +- [ ] Documentation update +- [ ] Refactoring (no functional changes) +- [ ] CI/CD improvement +- [ ] Dependency update + +## Checklist + +- [ ] My code follows the project's coding style +- [ ] I have performed a self-review of my own code +- [ ] I have commented my code, particularly in hard-to-understand areas +- [ ] I have made corresponding changes to the documentation +- [ ] My changes generate no new warnings +- [ ] I have added tests that prove my fix is effective or that my feature works +- [ ] New and existing unit tests pass locally with my changes +- [ ] Any dependent changes have been merged and published + +## Testing + + + +## Screenshots (if applicable) + + diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 150e68d93..8413f9dbd 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -48,9 +48,9 @@ jobs: - language: go build-mode: autobuild - language: javascript-typescript - build-mode: none + build-mode: autobuild - language: rust - build-mode: none + build-mode: autobuild # No Swift project in repo — remove entry. Re-add when Swift files need analysis. # - language: swift # build-mode: autobuild diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 369b04c0c..36f04e89d 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -1,14 +1,3 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# A sample workflow which sets up periodic OSV-Scanner scanning for vulnerabilities, -# in addition to a PR check which fails if new vulnerabilities are introduced. -# -# For more examples and options, including how to ignore specific vulnerabilities, -# see https://google.github.io/osv-scanner/github-action/ - name: OSV-Scanner on: @@ -22,27 +11,40 @@ on: branches: ["develop"] permissions: - # Require writing security events to upload SARIF file to security tab security-events: write - # Read commit contents contents: read jobs: scan-scheduled: if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@764c91816374ff2d8fc2095dab36eecd42d61638" # v1.9.2 - with: - # Example of specifying custom arguments - scan-args: |- - -r - --skip-git - ./ + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + persist-credentials: false + + - name: Run OSV-Scanner + uses: google/osv-scanner-action/osv-scanner-cli@v2.3.8 + with: + scan-args: |- + -r + --skip-git + ./ + scan-pr: if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@764c91816374ff2d8fc2095dab36eecd42d61638" # v1.9.2 - with: - # Example of specifying custom arguments - scan-args: |- - -r - --skip-git - ./ + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + persist-credentials: false + + - name: Run OSV-Scanner + uses: google/osv-scanner-action/osv-scanner-cli@v2.3.8 + with: + scan-args: |- + -r + --skip-git + ./ diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 000000000..e822f4292 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,29 @@ +# Changelog + +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [Unreleased] + +### Added +- CI workflows for sites/promo, sites/docs, and desktop/main +- Pre-commit hooks for Rust formatting and fallow gate +- Reference test for auth route handlers (h3 factory pattern) +- Fallow.toml with Nuxt path excludes +- PR and issue templates + +### Fixed +- SonarQube exclusion for Prisma migrations +- libarchive recursive read_block() converted to iterative loop +- ESLint no-prisma-delete rule narrowed to entity allowlist +- Tauri plugin versions pinned in root Cargo.toml +- Prisma indexes on Client and Session tables +- Promise boolean await in session signout + +### Changed +- Migrated partial jsonwebtoken usage to jose + +### Security +- Replaced MD5 with SHA-256 for non-security use cases diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index da7d2c954..6856c781f 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -100,7 +100,7 @@ utils = { path = "./utils" } # utils walkdir = "2.5.0" webbrowser = "1.0.2" whoami = "1.6.0" -wry = { version = "*", features = [] } +wry = { version = "0.53.5", features = [] } zstd = "0.13.3" [dependencies.log4rs] diff --git a/desktop/src-tauri/client/Cargo.toml b/desktop/src-tauri/client/Cargo.toml index 03dd6c3b6..1febb1e44 100644 --- a/desktop/src-tauri/client/Cargo.toml +++ b/desktop/src-tauri/client/Cargo.toml @@ -4,9 +4,9 @@ version = "0.1.0" edition = "2024" [dependencies] -bitcode = "*" -database = { version = "*", path = "../database" } -log = "*" -serde = { version = "*", features = ["derive"] } -tauri = "*" -tauri-plugin-autostart = "*" +bitcode = "0.6.9" +database = { version = "0.1.0", path = "../database" } +log = "0.4.29" +serde = { version = "1.0.228", features = ["derive"] } +tauri = "2.9.5" +tauri-plugin-autostart = "2.5.1" diff --git a/desktop/src-tauri/database/Cargo.toml b/desktop/src-tauri/database/Cargo.toml index 6b14a4116..a789412a5 100644 --- a/desktop/src-tauri/database/Cargo.toml +++ b/desktop/src-tauri/database/Cargo.toml @@ -5,7 +5,7 @@ edition = "2024" [dependencies] aes = "0.8.4" -anyhow = "*" +anyhow = "1.0.101" chrono = "0.4.42" ctr = "0.9.2" dirs = "6.0.0" diff --git a/desktop/src-tauri/download_manager/Cargo.toml b/desktop/src-tauri/download_manager/Cargo.toml index 5a1578c2a..643d1aab0 100644 --- a/desktop/src-tauri/download_manager/Cargo.toml +++ b/desktop/src-tauri/download_manager/Cargo.toml @@ -14,7 +14,7 @@ parking_lot = "0.12.5" remote = { version = "0.1.0", path = "../remote" } serde = "1.0.228" serde_with = "3.15.0" -tauri = "*" +tauri = "2.9.5" throttle_my_fn = "0.2.6" tokio = { version = "1.48.0", features = ["sync"] } utils = { version = "0.1.0", path = "../utils" } diff --git a/desktop/src-tauri/games/Cargo.toml b/desktop/src-tauri/games/Cargo.toml index 4720a8723..7aee3f7c7 100644 --- a/desktop/src-tauri/games/Cargo.toml +++ b/desktop/src-tauri/games/Cargo.toml @@ -15,7 +15,7 @@ ctr = "0.9.2" database = { path = "../database", version = "0.1.0" } download_manager = { path = "../download_manager", version = "0.1.0" } droplet_types = { path = "../../../libraries/droplet_types" } -futures-util = "*" +futures-util = "0.3.31" hex = "0.4.3" log = "0.4.28" pot = "3.0.1" @@ -27,8 +27,8 @@ serde_json = "1.0.145" serde_with = "3.15.0" sha2 = "0.10.9" sysinfo = "0.37.2" -tauri = "*" +tauri = "2.9.5" throttle_my_fn = "0.2.6" -tokio = { version = "*", features = ["rt", "sync"] } -tokio-util = { version = "*", features = ["io"] } +tokio = { version = "1.49.0", features = ["rt", "sync"] } +tokio-util = { version = "0.7.18", features = ["io"] } utils = { path = "../utils", version = "0.1.0" } diff --git a/desktop/src-tauri/process/Cargo.toml b/desktop/src-tauri/process/Cargo.toml index c83b6ba01..937302791 100644 --- a/desktop/src-tauri/process/Cargo.toml +++ b/desktop/src-tauri/process/Cargo.toml @@ -16,6 +16,6 @@ serde = "1.0.228" serde_with = "3.15.0" shared_child = "1.1.1" shell-words = "1.1.1" -tauri = "*" -tauri-plugin-opener = "*" +tauri = "2.9.5" +tauri-plugin-opener = "2.5.3" utils = { path = "../utils", version = "0.1.0" } diff --git a/desktop/src-tauri/remote/Cargo.toml b/desktop/src-tauri/remote/Cargo.toml index 85d38e6f6..2de2508bd 100644 --- a/desktop/src-tauri/remote/Cargo.toml +++ b/desktop/src-tauri/remote/Cargo.toml @@ -29,6 +29,6 @@ reqwest-middleware = { version = "0.4.2", features = ["json"] } reqwest-websocket = "0.5.1" serde = "1.0.228" serde_with = "3.15.0" -tauri = "*" +tauri = "2.9.5" url = "2.5.7" utils = { path = "../utils", version = "0.1.0" } diff --git a/desktop/src-tauri/tailscale/Cargo.toml b/desktop/src-tauri/tailscale/Cargo.toml index e7d332365..c7e201c03 100644 --- a/desktop/src-tauri/tailscale/Cargo.toml +++ b/desktop/src-tauri/tailscale/Cargo.toml @@ -4,7 +4,7 @@ version = "0.1.0" edition = "2024" [build-dependencies] -bindgen = "*" +bindgen = "0.72.1" abs-file-macro = "0.1.2" [dependencies] diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 14e13fc7c..4096ea73e 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -196,9 +196,6 @@ importers: jose: specifier: ^6.1.3 version: 6.2.4 - jsonwebtoken: - specifier: ^9.0.3 - version: 9.0.3 kjua: specifier: ^0.10.0 version: 0.10.0 @@ -390,11 +387,18 @@ importers: specifier: ^0.14.2 version: 0.14.2(@astrojs/starlight@0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3))(supports-color@10.2.2) starlight-links-validator: - specifier: ^0.24.1 - version: 0.24.1(@astrojs/starlight@0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2) + specifier: ^0.25.2 + version: 0.25.2(@astrojs/starlight@0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2) starlight-theme-rapide: specifier: ^0.5.2 version: 0.5.2(@astrojs/starlight@0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3)) + devDependencies: + prettier: + specifier: ^3.6.2 + version: 3.9.6 + prettier-plugin-astro: + specifier: ^0.14.1 + version: 0.14.1 sites/promo: dependencies: @@ -479,7 +483,7 @@ importers: version: 4.3.0(prettier@3.9.6)(typescript@5.9.3)(vue-tsc@3.3.8(typescript@5.9.3)) prettier-plugin-tailwindcss: specifier: ^0.6.14 - version: 0.6.14(prettier-plugin-organize-imports@4.3.0(prettier@3.9.6)(typescript@5.9.3)(vue-tsc@3.3.8(typescript@5.9.3)))(prettier@3.9.6) + version: 0.6.14(prettier-plugin-astro@0.14.1)(prettier-plugin-organize-imports@4.3.0(prettier@3.9.6)(typescript@5.9.3)(vue-tsc@3.3.8(typescript@5.9.3)))(prettier@3.9.6) tailwindcss: specifier: ^4.1.11 version: 4.3.3 @@ -576,6 +580,9 @@ packages: resolution: {integrity: sha512-aT7xkgsbNoS6nriY5qKpbihK43slFHO41iqgHCTdOvn1ifaQxLCc5yXy+6GzAtiafoaC1zA7OwVXCXMsvUZOkg==} engines: {node: '>=22.12.0'} + '@astrojs/compiler@2.13.1': + resolution: {integrity: sha512-f3FN83d2G/v32ipNClRKgYv30onQlMZX1vCeZMjPsMMPl1mDpmbl0+N5BYo4S/ofzqJyS5hvwacEo0CCVDn/Qg==} + '@astrojs/internal-helpers@0.10.0': resolution: {integrity: sha512-Ry2R3VPeIN4uPCSA4xQc+e+vsJXkalKpEbDc07hV+a/o5Bs2N/s/uDcPJH/05L19DKh9tAy7e6JM3YZ6Cxfezw==} @@ -4649,9 +4656,6 @@ packages: resolution: {integrity: sha512-Db1SbgBS/fg/392AblrMJk97KggmvYhr4pB5ZIMTWtaivCPMWLkmb7m21cJvpvgK+J3nsU2CmmixNBZx4vFj/w==} engines: {node: '>=8.0.0'} - buffer-equal-constant-time@1.0.1: - resolution: {integrity: sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==} - buffer-fill@1.0.0: resolution: {integrity: sha512-T7zexNBwiiaCOGDg9xNX9PBmjrubblRkENuptryuI64URkXDFum9il/JGL8Lm8wYfAXpredVXXZz7eMHilimiQ==} @@ -5445,9 +5449,6 @@ packages: ecc-jsbn@0.1.2: resolution: {integrity: sha512-eh9O+hwRHNbG4BLTjEl3nw044CkGm5X6LoaCf7LPp7UU8Qrt47JYNi6nPX8xjW97TKGKm1ouctg0QSpZe9qrnw==} - ecdsa-sig-formatter@1.0.11: - resolution: {integrity: sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==} - editorconfig@1.0.7: resolution: {integrity: sha512-e0GOtq/aTQhVdNyDU9e02+wz9oDDM+SIOQxWME2QRjzRX5yyLAuHDE+0aE8vHb9XRC8XD37eO2u57+F09JqFhw==} engines: {node: '>=14'} @@ -7237,10 +7238,6 @@ packages: jsonfile@6.2.1: resolution: {integrity: sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==} - jsonwebtoken@9.0.3: - resolution: {integrity: sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==} - engines: {node: '>=12', npm: '>=6'} - jsprim@1.4.2: resolution: {integrity: sha512-P2bSOMAc/ciLz6DzgjVlGJP9+BrJWu5UDGK70C2iweC5QBIeFf0ZXRvGjEj2uYgrY2MkAAhsSWHDWlFtEroZWw==} engines: {node: '>=0.6.0'} @@ -7253,12 +7250,6 @@ packages: resolution: {integrity: sha512-pBxcB3LFc8QVgdggvZWyeys+hnrNWg4OcZIU/1X59k5jQdLBlCsYGRQaz234SqoRLTCgMH00fY0xRJH+F9METQ==} engines: {node: '>=8'} - jwa@2.0.1: - resolution: {integrity: sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==} - - jws@4.0.1: - resolution: {integrity: sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==} - keyv@4.5.4: resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==} @@ -7435,24 +7426,6 @@ packages: lodash.foreach@4.5.0: resolution: {integrity: sha512-aEXTF4d+m05rVOAUG3z4vZZ4xVexLKZGF0lIxuHZ1Hplpk/3B6Z1+/ICICYRLm7c41Z2xiejbkCkJoTlypoXhQ==} - lodash.includes@4.3.0: - resolution: {integrity: sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==} - - lodash.isboolean@3.0.3: - resolution: {integrity: sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==} - - lodash.isinteger@4.0.4: - resolution: {integrity: sha512-DBwtEWN2caHQ9/imiNeEA5ys1JoRtRfY3d7V9wkqtbycnAmTvRRmbHKDV4a0EYc678/dia0jrte4tjYwVBaZUA==} - - lodash.isnumber@3.0.3: - resolution: {integrity: sha512-QYqzpfwO3/CWf3XP+Z+tkQsfaLL/EnUlXWVkIk5FUPc4sBdTehEqZONuyRt2P67PXAk+NXmTBcc97zw9t1FQrw==} - - lodash.isplainobject@4.0.6: - resolution: {integrity: sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==} - - lodash.isstring@4.0.1: - resolution: {integrity: sha512-0wJxfxH1wgO3GrbuP+dTTk7op+6L41QCXbGINEmD+ny/G/eCqGzxyCsh7159S+mgDDcoarnBw6PC1PS5+wUGgw==} - lodash.map@4.6.0: resolution: {integrity: sha512-worNHGKLDetmcEYDvh2stPCrrQRkP20E4l0iIS7F8EvzMqBBi7ltvFN5m1HvTf1P7Jk1txKhvFcmYsCr8O2F1Q==} @@ -7462,9 +7435,6 @@ packages: lodash.merge@4.6.2: resolution: {integrity: sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==} - lodash.once@4.1.1: - resolution: {integrity: sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==} - lodash.pick@4.4.0: resolution: {integrity: sha512-hXt6Ul/5yWjfklSGvLQl8vM//l3FtyHZeuelpzK6mm99pNvN9yTDruNZPEJZD1oWrqo+izBmB7oUfWgcCX7s4Q==} deprecated: This package is deprecated. Use destructuring assignment syntax instead. @@ -8777,6 +8747,10 @@ packages: resolution: {integrity: sha512-BLxfZh+m6UiAiCPZFJ4+vYoL7NrRs5XgCTRrjseATAggXhdZKKxn+JUNmuVYWY23bDHgaEHodxw8mnmtVEDtHw==} engines: {node: '>=8'} + prettier-plugin-astro@0.14.1: + resolution: {integrity: sha512-RiBETaaP9veVstE4vUwSIcdATj6dKmXljouXc/DDNwBSPTp8FRkLGDSGFClKsAFeeg+13SB0Z1JZvbD76bigJw==} + engines: {node: ^14.15.0 || >=16.0.0} + prettier-plugin-organize-imports@4.3.0: resolution: {integrity: sha512-FxFz0qFhyBsGdIsb697f/EkvHzi5SZOhWAjxcx2dLt+Q532bAlhswcXGYB1yzjZ69kW8UoadFBw7TyNwlq96Iw==} peerDependencies: @@ -9330,6 +9304,9 @@ packages: resolution: {integrity: sha512-hTdwr+7yYNIT5n4AMYp85KA6yw2Va0FLa3Rguvbpa4W3I5xynaBZo41cM3XM+4Q6fRMj3sBYIR1VAmZMXYJvRQ==} engines: {npm: '>=2.0.0'} + s.color@0.0.15: + resolution: {integrity: sha512-AUNrbEUHeKY8XsYr/DYpl+qk5+aM+DChopnWOPEzn8YKzOhv4l2zH6LzZms3tOZP3wwdOyc0RmTciyi46HLIuA==} + safe-array-concat@1.1.4: resolution: {integrity: sha512-wtZlHyOje6OZTGqAoaDKxFkgRtkF9CnHAVnCHKfuj200wAgL+bSJhdsCD2l0Qx/2ekEXjPWcyKkfGb5CPboslg==} engines: {node: '>=0.4'} @@ -9358,6 +9335,9 @@ packages: sanitize-filename@1.6.4: resolution: {integrity: sha512-9ZyI08PsvdQl2r/bBIGubpVdR3RR9sY6RDiWFPreA21C/EFlQhmgo20UZlNjZMMZNubusLhAQozkA0Od5J21Eg==} + sass-formatter@0.7.9: + resolution: {integrity: sha512-CWZ8XiSim+fJVG0cFLStwDvft1VI7uvXdCNJYXhDvowiv+DsbD1nXLiQ4zrE5UBvj5DWZJ93cwN0NX5PMsr1Pw==} + sass@1.101.6: resolution: {integrity: sha512-j8qYug9WuX19eU5sxJWQlbR8RYhKgXiOYgGjkJRkcW35c3neWtxPdcUW0saN6Od2L0aqEp0AmH9R/QeAxrffMQ==} engines: {node: '>=20.19.0'} @@ -9653,12 +9633,12 @@ packages: peerDependencies: '@astrojs/starlight': '>=0.38.0' - starlight-links-validator@0.24.1: - resolution: {integrity: sha512-nATZ0xMLYnmO1YDBGEy9PdjF/WxhbKR7/gQo0dFs5UELcorKLPXcNLM62xbqII7g0AF7/D9wSzD4qSwIGTu8sw==} + starlight-links-validator@0.25.2: + resolution: {integrity: sha512-RQiHkM8FHKermsjMkSb+uS/q50Dv5P0O0ECWKxJyTv4stuO8QTorIEKnITDDLEf9/xyg7M69arxiK2ola3OMqA==} engines: {node: '>=22.12.0'} peerDependencies: - '@astrojs/starlight': '>=0.38.0' - astro: '>=6.0.0' + '@astrojs/starlight': '>=0.41.0' + astro: '>=7.0.2' starlight-theme-rapide@0.5.2: resolution: {integrity: sha512-4kNJutt0/3E0rjZvG9hvKeTTHGOHC97t2ZQDwDcokTM25yLgxavFu7BCm2Dm2UTw7fJpRXpu4gUWJ9xAOBmNww==} @@ -9870,6 +9850,9 @@ packages: stylis@4.3.6: resolution: {integrity: sha512-yQ3rwFWRfwNUY7H5vpU0wfdkNSnvnJinhF9830Swlaxl03zsOjCfmX0ugac+3LtK0lYSgwL/KXc8oYL3mG4YFQ==} + suf-log@2.5.3: + resolution: {integrity: sha512-KvC8OPjzdNOe+xQ4XWJV2whQA0aM1kGVczMQ8+dStAO6KfEB140JEVQ9dE76ONZ0/Ylf67ni4tILPJB41U0eow==} + supports-color@10.2.2: resolution: {integrity: sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==} engines: {node: '>=18'} @@ -11143,6 +11126,8 @@ snapshots: - '@emnapi/core' - '@emnapi/runtime' + '@astrojs/compiler@2.13.1': {} + '@astrojs/internal-helpers@0.10.0': dependencies: '@types/hast': 3.0.5 @@ -15848,8 +15833,6 @@ snapshots: buffer-crc32@1.0.0: {} - buffer-equal-constant-time@1.0.1: {} - buffer-fill@1.0.0: {} buffer-from@1.1.2: {} @@ -16699,10 +16682,6 @@ snapshots: jsbn: 0.1.1 safer-buffer: 2.1.2 - ecdsa-sig-formatter@1.0.11: - dependencies: - safe-buffer: 5.2.1 - editorconfig@1.0.7: dependencies: '@one-ini/wasm': 0.1.1 @@ -18973,19 +18952,6 @@ snapshots: optionalDependencies: graceful-fs: 4.2.11 - jsonwebtoken@9.0.3: - dependencies: - jws: 4.0.1 - lodash.includes: 4.3.0 - lodash.isboolean: 3.0.3 - lodash.isinteger: 4.0.4 - lodash.isnumber: 3.0.3 - lodash.isplainobject: 4.0.6 - lodash.isstring: 4.0.1 - lodash.once: 4.1.1 - ms: 2.1.3 - semver: 7.8.5 - jsprim@1.4.2: dependencies: assert-plus: 1.0.0 @@ -19002,17 +18968,6 @@ snapshots: junk@3.1.0: {} - jwa@2.0.1: - dependencies: - buffer-equal-constant-time: 1.0.1 - ecdsa-sig-formatter: 1.0.11 - safe-buffer: 5.2.1 - - jws@4.0.1: - dependencies: - jwa: 2.0.1 - safe-buffer: 5.2.1 - keyv@4.5.4: dependencies: json-buffer: 3.0.1 @@ -19176,26 +19131,12 @@ snapshots: lodash.foreach@4.5.0: {} - lodash.includes@4.3.0: {} - - lodash.isboolean@3.0.3: {} - - lodash.isinteger@4.0.4: {} - - lodash.isnumber@3.0.3: {} - - lodash.isplainobject@4.0.6: {} - - lodash.isstring@4.0.1: {} - lodash.map@4.6.0: {} lodash.memoize@4.1.2: {} lodash.merge@4.6.2: {} - lodash.once@4.1.1: {} - lodash.pick@4.4.0: {} lodash.reduce@4.6.0: {} @@ -21411,6 +21352,12 @@ snapshots: prepend-http@3.0.1: {} + prettier-plugin-astro@0.14.1: + dependencies: + '@astrojs/compiler': 2.13.1 + prettier: 3.9.6 + sass-formatter: 0.7.9 + prettier-plugin-organize-imports@4.3.0(prettier@3.9.6)(typescript@5.9.3)(vue-tsc@3.3.8(typescript@5.9.3)): dependencies: prettier: 3.9.6 @@ -21422,10 +21369,11 @@ snapshots: dependencies: prettier: 3.9.6 - prettier-plugin-tailwindcss@0.6.14(prettier-plugin-organize-imports@4.3.0(prettier@3.9.6)(typescript@5.9.3)(vue-tsc@3.3.8(typescript@5.9.3)))(prettier@3.9.6): + prettier-plugin-tailwindcss@0.6.14(prettier-plugin-astro@0.14.1)(prettier-plugin-organize-imports@4.3.0(prettier@3.9.6)(typescript@5.9.3)(vue-tsc@3.3.8(typescript@5.9.3)))(prettier@3.9.6): dependencies: prettier: 3.9.6 optionalDependencies: + prettier-plugin-astro: 0.14.1 prettier-plugin-organize-imports: 4.3.0(prettier@3.9.6)(typescript@5.9.3)(vue-tsc@3.3.8(typescript@5.9.3)) prettier@3.9.6: {} @@ -22048,6 +21996,8 @@ snapshots: dependencies: tslib: 1.14.1 + s.color@0.0.15: {} + safe-array-concat@1.1.4: dependencies: call-bind: 1.0.9 @@ -22079,6 +22029,10 @@ snapshots: dependencies: truncate-utf8-bytes: 1.0.2 + sass-formatter@0.7.9: + dependencies: + suf-log: 2.5.3 + sass@1.101.6: dependencies: chokidar: 5.0.0 @@ -22463,8 +22417,9 @@ snapshots: transitivePeerDependencies: - supports-color - starlight-links-validator@0.24.1(@astrojs/starlight@0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2): + starlight-links-validator@0.25.2(@astrojs/starlight@0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2): dependencies: + '@astrojs/markdown-satteri': 0.3.4 '@astrojs/starlight': 0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3) '@types/picomatch': 4.0.3 astro: 7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0) @@ -22474,6 +22429,7 @@ snapshots: mdast-util-mdx-jsx: 3.2.0(supports-color@10.2.2) mdast-util-to-hast: 13.2.1 picomatch: 4.0.5 + satteri: 0.9.5 terminal-link: 5.0.0 unist-util-visit: 5.1.0 yaml: 2.9.0 @@ -22697,6 +22653,10 @@ snapshots: stylis@4.3.6: {} + suf-log@2.5.3: + dependencies: + s.color: 0.0.15 + supports-color@10.2.2: {} supports-color@2.0.0: {} diff --git a/server/composables/users.ts b/server/composables/users.ts index a4448418d..9b66849a7 100644 --- a/server/composables/users.ts +++ b/server/composables/users.ts @@ -8,7 +8,7 @@ export const useUsers = () => | Array< SerializeObject< UserModel & { - authMecs?: Array<{ id: string; mec: AuthMec }>; + authMecs?: Array<{ mec: AuthMec }>; } > > @@ -20,7 +20,6 @@ export const fetchUsers = async () => { const users = useUsers(); const newValue = await $dropFetch("/api/v1/admin/users"); - // @ts-expect-error: API returns authMecs without `id`, but state type requires it users.value = newValue; return newValue; }; diff --git a/server/package.json b/server/package.json index 1b33db7a5..1b5132ad8 100644 --- a/server/package.json +++ b/server/package.json @@ -56,7 +56,6 @@ "file-type-mime": "^0.4.3", "jdenticon": "^3.3.0", "jose": "^6.1.3", - "jsonwebtoken": "^9.0.3", "kjua": "^0.10.0", "luxon": "^3.6.1", "micromark": "^4.0.1", diff --git a/server/plugins/error-handler.ts b/server/plugins/error-handler.ts index 62bab5e5d..b26da61cb 100644 --- a/server/plugins/error-handler.ts +++ b/server/plugins/error-handler.ts @@ -1,5 +1,8 @@ export default defineNuxtPlugin((nuxtApp) => { nuxtApp.hook("vue:error", (error, instance, info) => { + // Client-side error handler — console.error is appropriate here + // as pino is server-side only. Errors could be sent to a monitoring + // service (e.g., Sentry) for production use. console.error(info, error, instance); }); }); diff --git a/server/server/internal/clients/event-handler.ts b/server/server/internal/clients/event-handler.ts index ca8faf19c..a593f43ce 100644 --- a/server/server/internal/clients/event-handler.ts +++ b/server/server/internal/clients/event-handler.ts @@ -2,7 +2,7 @@ import type { ClientModel, UserModel } from "~/prisma/client/models"; import type { EventHandlerRequest, H3Event } from "h3"; import prisma from "../db/database"; import { useCertificateAuthority } from "~/server/plugins/ca"; -import jwt from "jsonwebtoken"; +import * as jose from "jose"; export type EventHandlerFunction = ( h3: H3Event, @@ -42,10 +42,12 @@ export function defineClientEventHandler(handler: EventHandlerFunction) { message: "Invalid client ID", }); - const valid = jwt.verify(jwtToken, certBundle.cert, { - clockTolerance: JWT_TIME_WIGGLE, - // algorithms: ["ES384"], - }); + const publicKey = await jose.importSPKI(certBundle.cert, "ES384"); + const valid = await jose + .jwtVerify(jwtToken, publicKey, { + clockTolerance: JWT_TIME_WIGGLE, + }) + .catch(() => null); if (!valid) throw createError({ statusCode: 403, diff --git a/sites/docs/package.json b/sites/docs/package.json index c07b7a1f5..05fb3fc59 100644 --- a/sites/docs/package.json +++ b/sites/docs/package.json @@ -17,7 +17,11 @@ "astro": "^7.1.0", "sharp": "^0.35.2", "starlight-image-zoom": "^0.14.2", - "starlight-links-validator": "^0.24.1", + "starlight-links-validator": "^0.25.2", "starlight-theme-rapide": "^0.5.2" + }, + "devDependencies": { + "prettier": "^3.6.2", + "prettier-plugin-astro": "^0.14.1" } } \ No newline at end of file diff --git a/sites/promo/package.json b/sites/promo/package.json index d40492391..ff7132eb8 100644 --- a/sites/promo/package.json +++ b/sites/promo/package.json @@ -10,7 +10,8 @@ "format:check": "prettier --check .", "format:fix": "prettier --write .", "lint:fix": "next lint --fix && prettier --write .", - "typegen": "sanity schema extract --path=src/sanity/extract.json && sanity typegen generate && rm ./src/sanity/extract.json" + "typegen": "content-collections build", + "typegen:sanity": "sanity schema extract --path=src/sanity/extract.json && sanity typegen generate && rm ./src/sanity/extract.json" }, "dependencies": { "@headlessui/react": "^2.2.6", diff --git a/torrential/src/downloads/download.rs b/torrential/src/downloads/download.rs index 36a6bad11..b0bc1d9f1 100644 --- a/torrential/src/downloads/download.rs +++ b/torrential/src/downloads/download.rs @@ -50,48 +50,22 @@ pub async fn create_download_context( } /// Creates a version backend using the filesystem location specified by the version data. - /// - /// Returns an internal server error when the backend configuration is invalid, the version - -/// path does not exist, or the backend cannot be constructed. Panics if the backend type is - -/// absent from `version_data.source`. - +/// path does not exist, or the backend cannot be constructed. /// - /// # Examples - /// - /// ```no_run - /// # let version_data: &VersionResponse = todo!(); - /// let backend = create_backend(version_data)?; - /// # Ok::<(), StatusCode>(()) - /// ``` - /// - /// # Errors - /// - /// Returns `StatusCode::INTERNAL_SERVER_ERROR` when the backend configuration, version path, - /// or backend construction is invalid. - -/// - -/// # Panics - -/// - -/// Panics if `version_data.source.backend` is `None`. fn create_backend( version_data: &VersionResponse, ) -> Result, StatusCode> { @@ -104,7 +78,11 @@ fn create_backend( let version_path = PathBuf::from(base_path); let version_path = version_path.join(version_data.library_path.clone()); - let version_path = match version_data.source.backend.unwrap() { + let backend_type = version_data.source.backend.ok_or_else(|| { + warn!("version_data.source.backend is None"); + StatusCode::INTERNAL_SERVER_ERROR + })?; + let version_path = match backend_type { LibraryBackend::FILESYSTEM => version_path.join(version_data.version_path.clone()), LibraryBackend::FLAT_FILESYSTEM => version_path, }; From d571994a79a6ed404131682e68d2d4eff00cfbe9 Mon Sep 17 00:00:00 2001 From: John Smith Date: Sun, 26 Jul 2026 12:21:06 -0400 Subject: [PATCH 2/9] fix: address code review feedback - Issue 1: Update @astrojs/starlight to ^0.41.0 for peer dep compatibility - Issue 2: Restore OSV-Scanner reusable workflow for diff-based PR gating - Issue 3: Add proper error handling and logging for JWT verification --- .github/workflows/osv-scanner.yml | 20 +-- pnpm-lock.yaml | 167 ++++++++---------- .../server/internal/clients/event-handler.ts | 21 ++- sites/docs/package.json | 2 +- 4 files changed, 96 insertions(+), 114 deletions(-) diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 36f04e89d..7e191b3ae 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -34,17 +34,9 @@ jobs: scan-pr: if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }} - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v4 - with: - persist-credentials: false - - - name: Run OSV-Scanner - uses: google/osv-scanner-action/osv-scanner-cli@v2.3.8 - with: - scan-args: |- - -r - --skip-git - ./ + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8" + with: + scan-args: |- + -r + --skip-git + ./ diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4096ea73e..424d59523 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -375,8 +375,8 @@ importers: sites/docs: dependencies: '@astrojs/starlight': - specifier: ^0.40.0 - version: 0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3) + specifier: ^0.41.0 + version: 0.41.4(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3) astro: specifier: ^7.1.0 version: 7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0) @@ -385,13 +385,13 @@ importers: version: 0.35.3(@types/node@24.13.3) starlight-image-zoom: specifier: ^0.14.2 - version: 0.14.2(@astrojs/starlight@0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3))(supports-color@10.2.2) + version: 0.14.2(@astrojs/starlight@0.41.4(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3))(supports-color@10.2.2) starlight-links-validator: specifier: ^0.25.2 - version: 0.25.2(@astrojs/starlight@0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2) + version: 0.25.2(@astrojs/starlight@0.41.4(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2) starlight-theme-rapide: specifier: ^0.5.2 - version: 0.5.2(@astrojs/starlight@0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3)) + version: 0.5.2(@astrojs/starlight@0.41.4(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3)) devDependencies: prettier: specifier: ^3.6.2 @@ -583,27 +583,21 @@ packages: '@astrojs/compiler@2.13.1': resolution: {integrity: sha512-f3FN83d2G/v32ipNClRKgYv30onQlMZX1vCeZMjPsMMPl1mDpmbl0+N5BYo4S/ofzqJyS5hvwacEo0CCVDn/Qg==} - '@astrojs/internal-helpers@0.10.0': - resolution: {integrity: sha512-Ry2R3VPeIN4uPCSA4xQc+e+vsJXkalKpEbDc07hV+a/o5Bs2N/s/uDcPJH/05L19DKh9tAy7e6JM3YZ6Cxfezw==} - '@astrojs/internal-helpers@0.10.1': resolution: {integrity: sha512-5phcroT/vmOOrYuuAxtkbPixy5hePtlz9i8K4OeDv3dNK6/UQRuXPOSRTxIOBbUY5Sonw2UaxjbuVc43Mcir6Q==} - '@astrojs/markdown-remark@7.2.0': - resolution: {integrity: sha512-+YxmVQu1Bd+MFfSzjq1rOJvD9+nIOJzz5YIIhdIH01RrxRkKbyKoEgyIqP3yv51MhzMDgd79QaPv+kCVPT8vHw==} - '@astrojs/markdown-remark@7.2.1': resolution: {integrity: sha512-jPVNIqTvk+yKviikszv/Y1U4jGUSKpp/Nw48QZV4qjWgp70j4Lkq3lhSDRbWwCfgKvEyO9GHuVbV1dM2WYXy1w==} '@astrojs/markdown-satteri@0.3.4': resolution: {integrity: sha512-6Lvt/bQZEBW+zzdhPblvfZEy5PGEYJaUsUqaCgwHeRPxZJL1gc9I+DRLKWJjjYTWDzVUTzXlMq4WwSK+X34CVw==} - '@astrojs/mdx@6.0.3': - resolution: {integrity: sha512-+4P3ZvwsRAqAbBgY+uZMewFo3ficlIBPZfu/Luk+v4ia/ZOuFhpsw7r+7672uT2Fc1UPdp7yW0eU5egvSq0wbw==} + '@astrojs/mdx@7.0.3': + resolution: {integrity: sha512-RxyIwU0uFam5ftwqKOjpIdhnFxZ/kEikeimLyQy3eGXbHT8WgRGzzesOIHVU8+m9TY8ag5WVOyvV24/GyqPdPQ==} engines: {node: '>=22.12.0'} peerDependencies: - '@astrojs/markdown-satteri': 0.3.0 - astro: ^6.4.0 + '@astrojs/markdown-satteri': ^0.3.1 + astro: ^7.0.0 peerDependenciesMeta: '@astrojs/markdown-satteri': optional: true @@ -615,13 +609,13 @@ packages: '@astrojs/sitemap@3.7.3': resolution: {integrity: sha512-f8euLVsyeAmAkSm/1M2Kb8sL8byQmfgbvBNaHFItCheTj/IpiJYSEWVcqDHZ/yEHxiS7+w87mQkzwZaPHmk5GA==} - '@astrojs/starlight@0.40.0': - resolution: {integrity: sha512-H1NBIXx4Xw6YzKMsoMkazYxFgnTTj6pD4IReUGWj1fqw82AOAgj+WnZLpTDWRExf3b9ZM7Popbl583i4IvDNVQ==} + '@astrojs/starlight@0.41.4': + resolution: {integrity: sha512-cRCKZhM2BKYViCakBiN68aVwPn5qj/XtMMq//G54xOWdXXcvic1gMMEI+veNlIKOqqC4QmIjcjk4jiFtlZ3mMg==} peerDependencies: - '@astrojs/markdown-satteri': ^0.2.0 - astro: ^6.4.5 + '@astrojs/markdown-remark': ^7.2.0 + astro: ^7.0.2 peerDependenciesMeta: - '@astrojs/markdown-satteri': + '@astrojs/markdown-remark': optional: true '@astrojs/telemetry@3.3.3': @@ -1391,17 +1385,17 @@ packages: resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} - '@expressive-code/core@0.43.1': - resolution: {integrity: sha512-H4rUJXKyS6y2q9Ig9bIp3dFhWhkZQIeH/jRGl3DROlslrGvfD4OC9qzmvKEFExm+/DtdvvHMQ8/Olmrcfxp+wQ==} + '@expressive-code/core@0.44.1': + resolution: {integrity: sha512-3dDo9N8D7hYrLNNMMWFovg3+aDUtnQm7c7z0GZc1c0LEFVBc0Q6lKG+tVT28gDadOvsgOANfCn35fgpe97Pmgg==} - '@expressive-code/plugin-frames@0.43.1': - resolution: {integrity: sha512-tENfLw2UDeq5h749tTLvUtQYvgjIiQc6W7PBCR5xQ4yuE/QftManKJfUQjwJo6RRsAimVQDN4alhFTJ3aq1Khg==} + '@expressive-code/plugin-frames@0.44.1': + resolution: {integrity: sha512-HC/bdRao9225ApcgO/e3jn8ZOhldKO7ob1O/Tcipvtv7Vb5nMphZhMtD9uuywpvxkPYBHJi3504WhrKg05Dwqg==} - '@expressive-code/plugin-shiki@0.43.1': - resolution: {integrity: sha512-NdceinYEROXODNgB/ix+7oCdIg+nGyok+E+p2lU9YlWd1xKshXdXpmmptKfkuU27MJ5jjnfhMCI78YYBGi9GtQ==} + '@expressive-code/plugin-shiki@0.44.1': + resolution: {integrity: sha512-YApiZt3buUzBwL5tqj8G+sYC5NjMjRCHgQwr9bmGl69rtcHy6fE9dooWUeKYB978fJT2BuxT5FeHcF47rA3SEg==} - '@expressive-code/plugin-text-markers@0.43.1': - resolution: {integrity: sha512-JWf8wdbZSNoGY4TFv3lmt3/NNDaCP7iYL6rRYD05g8YYjKL62hKUHLl5+B47+v0+bqbuMhXDN7qz2wywFUvMkg==} + '@expressive-code/plugin-text-markers@0.44.1': + resolution: {integrity: sha512-B3BsJoJ8CFMlcIX9f+X9tcI3C4zPDO601+YuLi9GheSTNro7ZfqSjLptMQKBHOWZvxnAtY5zvIX7iO/qtBhNBg==} '@fal-works/esbuild-plugin-global-externals@2.1.2': resolution: {integrity: sha512-cEee/Z+I12mZcFJshKcCqC8tuX5hG3s+d+9nZ3LabqKF1vKdF41B92pJVCBggjAGORAeOzyyDDKrZwIkLffeOQ==} @@ -4422,10 +4416,10 @@ packages: resolution: {integrity: sha512-LElXdjswlqjWrPpJFg1Fx4wpkOCxj1TDHlSV4PlaRxHGWko024xICaa97ZkMfs6DRKlCguiAI+rbXv5GWwXIkg==} hasBin: true - astro-expressive-code@0.43.1: - resolution: {integrity: sha512-xddgwQxFRwpnnAnU7kSfrO82SsOAq7sQrYpXxVcrN9k/0aqNlTH2+mLrOMm1wXm6jdFKepst3hd8/qWojwuunw==} + astro-expressive-code@0.44.1: + resolution: {integrity: sha512-DT1LnCqbHasBKlvzJ3m6LR4VI94wwx3W9EV/YbP1te4rqjOHsvsezHYuqb5MeLWLftXms/1FA9QBbwCo43DnJQ==} peerDependencies: - astro: ^4.0.0-beta || ^5.0.0-beta || ^3.3.0 || ^6.0.0-beta + astro: ^4.0.0-beta || ^5.0.0-beta || ^3.3.0 || ^6.0.0-beta || ^7.0.0 astro@7.1.3: resolution: {integrity: sha512-4dhPyAAXthf3xLEYnG8SeL7yr/nTPPABfY7e9YF0yuO+vK9Xp+8Q5j4xzsmL3GueukQv4oNwGNTBepLOiDGeJA==} @@ -5929,8 +5923,8 @@ packages: resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==} engines: {node: '>=12.0.0'} - expressive-code@0.43.1: - resolution: {integrity: sha512-JdOzanoU825iNvslmk6Kg8Ro61eSHmDK2Zz7BynOxObVrpIXZNzrIZOwQO2uDQcGsjSYShL/8vTrXgeWYnq3NA==} + expressive-code@0.44.1: + resolution: {integrity: sha512-GakidxhapWDzpKLqEaFQ8wGk6gAqEtPQibu8+yPBfnDLgev5Vdsh1pasTxnrXL/mzIknyqeTwhMHTghdaiUrTg==} exsolve@1.1.0: resolution: {integrity: sha512-D+42+T12DdIlJM3uepa55qGiL3sYdLBOxIl2ifQCzCHz4c7eiolaHsi3BIqEr7JxBzxv2pYZQX9kw16ziMcEmw==} @@ -9100,8 +9094,8 @@ packages: resolution: {integrity: sha512-NgRBy2Nx/bE+9F27nVHnqcN5HjyLmecqsqx2PJHu3/IEtADD4WuxuXIVExD5PoSDFVrl78dOonfcOe5O+5nbzQ==} hasBin: true - rehype-expressive-code@0.43.1: - resolution: {integrity: sha512-CUOGQVlUcSMSXZgpcq9xL6B+dZqnI3w1R6EZj932XpGgj2Hmy7H6oMqa9W/Z7X2HOILWLWhqu1b9kuYcD+nd6w==} + rehype-expressive-code@0.44.1: + resolution: {integrity: sha512-+VZgs7Evw4LXRN3owpoBNSTpYuW6GeOdjqcUT1TuY8o/4MGPtbd0EU7Bgrju7X8KrQ6SslOBAuGWJ5fV5TriJQ==} rehype-format@5.0.1: resolution: {integrity: sha512-zvmVru9uB0josBVpr946OR8ui7nJEdzZobwLOOqHb/OOD88W0Vk2SqLwoVOj0fM6IPCCO6TaV9CvQvJMWwukFQ==} @@ -10465,6 +10459,10 @@ packages: uri-js@4.4.1: resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==} + url-extras@0.1.0: + resolution: {integrity: sha512-8tzwTeXFPuX/5PHuCDQE5Dd9Ts4rwoq2t9aIT+HS4iAVpmj5l4Ao7Q+BuuFjvWRqrLswBhQDk8O96ZicgCqQqw==} + engines: {node: '>=20'} + url-parse@1.5.10: resolution: {integrity: sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==} @@ -11128,17 +11126,6 @@ snapshots: '@astrojs/compiler@2.13.1': {} - '@astrojs/internal-helpers@0.10.0': - dependencies: - '@types/hast': 3.0.5 - '@types/mdast': 4.0.4 - js-yaml: 4.3.0 - picomatch: 4.0.5 - retext-smartypants: 6.2.0 - shiki: 4.3.1 - smol-toml: 1.7.0 - unified: 11.0.5 - '@astrojs/internal-helpers@0.10.1': dependencies: '@types/hast': 3.0.5 @@ -11150,28 +11137,6 @@ snapshots: smol-toml: 1.7.0 unified: 11.0.5 - '@astrojs/markdown-remark@7.2.0(supports-color@10.2.2)': - dependencies: - '@astrojs/internal-helpers': 0.10.0 - '@astrojs/prism': 4.0.2 - github-slugger: 2.0.0 - hast-util-from-html: 2.0.3 - hast-util-to-text: 4.0.2 - mdast-util-definitions: 6.0.0 - rehype-raw: 7.0.0 - rehype-stringify: 10.0.1 - remark-gfm: 4.0.1(supports-color@10.2.2) - remark-parse: 11.0.0(supports-color@10.2.2) - remark-rehype: 11.1.2 - remark-smartypants: 3.0.2 - unified: 11.0.5 - unist-util-remove-position: 5.0.0 - unist-util-visit: 5.1.0 - unist-util-visit-parents: 6.0.2 - vfile: 6.0.3 - transitivePeerDependencies: - - supports-color - '@astrojs/markdown-remark@7.2.1(supports-color@10.2.2)': dependencies: '@astrojs/internal-helpers': 0.10.1 @@ -11202,10 +11167,10 @@ snapshots: hast-util-from-html: 2.0.3 satteri: 0.9.5 - '@astrojs/mdx@6.0.3(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)': + '@astrojs/mdx@7.0.3(@astrojs/markdown-satteri@0.3.4)(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)': dependencies: - '@astrojs/internal-helpers': 0.10.0 - '@astrojs/markdown-remark': 7.2.0(supports-color@10.2.2) + '@astrojs/internal-helpers': 0.10.1 + '@astrojs/markdown-remark': 7.2.1(supports-color@10.2.2) '@mdx-js/mdx': 3.1.1(supports-color@10.2.2) acorn: 8.17.0 astro: 7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0) @@ -11219,6 +11184,8 @@ snapshots: source-map: 0.7.6 unist-util-visit: 5.1.0 vfile: 6.0.3 + optionalDependencies: + '@astrojs/markdown-satteri': 0.3.4 transitivePeerDependencies: - supports-color @@ -11232,17 +11199,17 @@ snapshots: stream-replace-string: 2.0.0 zod: 4.4.3 - '@astrojs/starlight@0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3)': + '@astrojs/starlight@0.41.4(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3)': dependencies: - '@astrojs/markdown-remark': 7.2.1(supports-color@10.2.2) - '@astrojs/mdx': 6.0.3(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2) + '@astrojs/markdown-satteri': 0.3.4 + '@astrojs/mdx': 7.0.3(@astrojs/markdown-satteri@0.3.4)(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2) '@astrojs/sitemap': 3.7.3 '@pagefind/default-ui': 1.5.2 '@types/hast': 3.0.5 '@types/js-yaml': 4.0.9 '@types/mdast': 4.0.4 astro: 7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0) - astro-expressive-code: 0.43.1(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0)) + astro-expressive-code: 0.44.1(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0)) bcp-47: 2.1.1 hast-util-from-html: 2.0.3 hast-util-select: 6.0.4 @@ -11259,10 +11226,13 @@ snapshots: rehype: 13.0.2 rehype-format: 5.0.1 remark-directive: 4.0.0(supports-color@10.2.2) + satteri: 0.9.5 ultrahtml: 1.7.0 unified: 11.0.5 unist-util-visit: 5.1.0 vfile: 6.0.3 + optionalDependencies: + '@astrojs/markdown-remark': 7.2.1(supports-color@10.2.2) transitivePeerDependencies: - supports-color - typescript @@ -11983,7 +11953,7 @@ snapshots: '@eslint/core': 0.17.0 levn: 0.4.1 - '@expressive-code/core@0.43.1': + '@expressive-code/core@0.44.1': dependencies: '@ctrl/tinycolor': 4.2.0 hast-util-select: 6.0.4 @@ -11995,18 +11965,18 @@ snapshots: unist-util-visit: 5.1.0 unist-util-visit-parents: 6.0.2 - '@expressive-code/plugin-frames@0.43.1': + '@expressive-code/plugin-frames@0.44.1': dependencies: - '@expressive-code/core': 0.43.1 + '@expressive-code/core': 0.44.1 - '@expressive-code/plugin-shiki@0.43.1': + '@expressive-code/plugin-shiki@0.44.1': dependencies: - '@expressive-code/core': 0.43.1 + '@expressive-code/core': 0.44.1 shiki: 4.3.1 - '@expressive-code/plugin-text-markers@0.43.1': + '@expressive-code/plugin-text-markers@0.44.1': dependencies: - '@expressive-code/core': 0.43.1 + '@expressive-code/core': 0.44.1 '@fal-works/esbuild-plugin-global-externals@2.1.2': {} @@ -15539,10 +15509,11 @@ snapshots: astring@1.9.0: {} - astro-expressive-code@0.43.1(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0)): + astro-expressive-code@0.44.1(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0)): dependencies: astro: 7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0) - rehype-expressive-code: 0.43.1 + rehype-expressive-code: 0.44.1 + url-extras: 0.1.0 astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0): dependencies: @@ -17422,12 +17393,12 @@ snapshots: expect-type@1.4.0: {} - expressive-code@0.43.1: + expressive-code@0.44.1: dependencies: - '@expressive-code/core': 0.43.1 - '@expressive-code/plugin-frames': 0.43.1 - '@expressive-code/plugin-shiki': 0.43.1 - '@expressive-code/plugin-text-markers': 0.43.1 + '@expressive-code/core': 0.44.1 + '@expressive-code/plugin-frames': 0.44.1 + '@expressive-code/plugin-shiki': 0.44.1 + '@expressive-code/plugin-text-markers': 0.44.1 exsolve@1.1.0: {} @@ -21678,9 +21649,9 @@ snapshots: dependencies: jsesc: 3.1.0 - rehype-expressive-code@0.43.1: + rehype-expressive-code@0.44.1: dependencies: - expressive-code: 0.43.1 + expressive-code: 0.44.1 rehype-format@5.0.1: dependencies: @@ -22407,9 +22378,9 @@ snapshots: standard-as-callback@2.1.0: {} - starlight-image-zoom@0.14.2(@astrojs/starlight@0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3))(supports-color@10.2.2): + starlight-image-zoom@0.14.2(@astrojs/starlight@0.41.4(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3))(supports-color@10.2.2): dependencies: - '@astrojs/starlight': 0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3) + '@astrojs/starlight': 0.41.4(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3) mdast-util-mdx-jsx: 3.2.0(supports-color@10.2.2) rehype-raw: 7.0.0 unist-util-visit: 5.1.0 @@ -22417,10 +22388,10 @@ snapshots: transitivePeerDependencies: - supports-color - starlight-links-validator@0.25.2(@astrojs/starlight@0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2): + starlight-links-validator@0.25.2(@astrojs/starlight@0.41.4(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2): dependencies: '@astrojs/markdown-satteri': 0.3.4 - '@astrojs/starlight': 0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3) + '@astrojs/starlight': 0.41.4(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3) '@types/picomatch': 4.0.3 astro: 7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0) github-slugger: 2.0.0 @@ -22436,9 +22407,9 @@ snapshots: transitivePeerDependencies: - supports-color - starlight-theme-rapide@0.5.2(@astrojs/starlight@0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3)): + starlight-theme-rapide@0.5.2(@astrojs/starlight@0.41.4(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3)): dependencies: - '@astrojs/starlight': 0.40.0(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3) + '@astrojs/starlight': 0.41.4(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(astro@7.1.3(@astrojs/markdown-remark@7.2.1(supports-color@10.2.2))(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@24.13.3)(db0@0.3.4(@electric-sql/pglite@0.4.1)(mysql2@3.15.3))(ioredis@5.11.1(supports-color@10.2.2))(jiti@2.7.0)(rollup@4.62.2)(sass@1.101.6)(terser@5.49.0)(yaml@2.9.0))(supports-color@10.2.2)(typescript@5.9.3) statuses@2.0.2: {} @@ -23413,6 +23384,8 @@ snapshots: dependencies: punycode: 2.3.1 + url-extras@0.1.0: {} + url-parse@1.5.10: dependencies: querystringify: 2.2.0 diff --git a/server/server/internal/clients/event-handler.ts b/server/server/internal/clients/event-handler.ts index a593f43ce..be0520147 100644 --- a/server/server/internal/clients/event-handler.ts +++ b/server/server/internal/clients/event-handler.ts @@ -2,6 +2,7 @@ import type { ClientModel, UserModel } from "~/prisma/client/models"; import type { EventHandlerRequest, H3Event } from "h3"; import prisma from "../db/database"; import { useCertificateAuthority } from "~/server/plugins/ca"; +import { logger } from "../logging"; import * as jose from "jose"; export type EventHandlerFunction = ( @@ -42,12 +43,28 @@ export function defineClientEventHandler(handler: EventHandlerFunction) { message: "Invalid client ID", }); - const publicKey = await jose.importSPKI(certBundle.cert, "ES384"); + let publicKey: jose.CryptoKey; + try { + publicKey = await jose.importSPKI(certBundle.cert, "ES384"); + } catch (err) { + logger.warn( + { err, clientId }, + "failed to import client certificate SPKI", + ); + throw createError({ + statusCode: 403, + message: "Invalid client certificate", + }); + } + const valid = await jose .jwtVerify(jwtToken, publicKey, { clockTolerance: JWT_TIME_WIGGLE, }) - .catch(() => null); + .catch((err) => { + logger.debug({ err, clientId }, "JWT verification failed"); + return null; + }); if (!valid) throw createError({ statusCode: 403, diff --git a/sites/docs/package.json b/sites/docs/package.json index 05fb3fc59..ec4d0a349 100644 --- a/sites/docs/package.json +++ b/sites/docs/package.json @@ -13,7 +13,7 @@ "astro": "astro" }, "dependencies": { - "@astrojs/starlight": "^0.40.0", + "@astrojs/starlight": "^0.41.0", "astro": "^7.1.0", "sharp": "^0.35.2", "starlight-image-zoom": "^0.14.2", From 4f52f3f08b2ec388e987f8e6d476e1867c24c4ac Mon Sep 17 00:00:00 2001 From: John Smith Date: Sun, 26 Jul 2026 12:33:31 -0400 Subject: [PATCH 3/9] fix: address review feedback - SHA pinning, JWT fixes, cleanup - Add redaction warning to bug template logs textarea - Pin actions/checkout and osv-scanner-cli to commit SHAs - Change JWT_TIME_WIGGLE to seconds (jose expects seconds) - Use importX509 for X.509 certificates instead of importSPKI - Wrap typegen:sanity cleanup to always run rm --- .github/ISSUE_TEMPLATE/bug.yml | 4 +++- .github/workflows/osv-scanner.yml | 4 ++-- server/server/internal/clients/event-handler.ts | 7 +++---- sites/promo/package.json | 2 +- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml index 1fe294c95..56fd44105 100644 --- a/.github/ISSUE_TEMPLATE/bug.yml +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -89,7 +89,9 @@ body: id: logs attributes: label: Relevant Logs - description: Please copy and paste any relevant log output. + description: | + Please copy and paste any relevant log output. + **Before submitting, redact any tokens, passwords, private keys, and personal information.** render: shell - type: checkboxes diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 7e191b3ae..48838610e 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -20,12 +20,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false - name: Run OSV-Scanner - uses: google/osv-scanner-action/osv-scanner-cli@v2.3.8 + uses: google/osv-scanner-action/osv-scanner-cli@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 with: scan-args: |- -r diff --git a/server/server/internal/clients/event-handler.ts b/server/server/internal/clients/event-handler.ts index be0520147..6390e5e77 100644 --- a/server/server/internal/clients/event-handler.ts +++ b/server/server/internal/clients/event-handler.ts @@ -16,8 +16,7 @@ type ClientUtils = { fetchUser: () => Promise; }; -// I forgot how to spell leniancne -const JWT_TIME_WIGGLE = 30_000; +const JWT_TIME_WIGGLE_SECONDS = 30; export function defineClientEventHandler(handler: EventHandlerFunction) { return defineEventHandler(async (h3) => { @@ -45,7 +44,7 @@ export function defineClientEventHandler(handler: EventHandlerFunction) { let publicKey: jose.CryptoKey; try { - publicKey = await jose.importSPKI(certBundle.cert, "ES384"); + publicKey = await jose.importX509(certBundle.cert, "ES384"); } catch (err) { logger.warn( { err, clientId }, @@ -59,7 +58,7 @@ export function defineClientEventHandler(handler: EventHandlerFunction) { const valid = await jose .jwtVerify(jwtToken, publicKey, { - clockTolerance: JWT_TIME_WIGGLE, + clockTolerance: JWT_TIME_WIGGLE_SECONDS, }) .catch((err) => { logger.debug({ err, clientId }, "JWT verification failed"); diff --git a/sites/promo/package.json b/sites/promo/package.json index ff7132eb8..b32251feb 100644 --- a/sites/promo/package.json +++ b/sites/promo/package.json @@ -11,7 +11,7 @@ "format:fix": "prettier --write .", "lint:fix": "next lint --fix && prettier --write .", "typegen": "content-collections build", - "typegen:sanity": "sanity schema extract --path=src/sanity/extract.json && sanity typegen generate && rm ./src/sanity/extract.json" + "typegen:sanity": "sanity schema extract --path=src/sanity/extract.json && sanity typegen generate; status=$?; rm -f ./src/sanity/extract.json; exit $status" }, "dependencies": { "@headlessui/react": "^2.2.6", From b08cdff671c1230c288a8edc36f0d69a26fac594 Mon Sep 17 00:00:00 2001 From: John Smith Date: Sun, 26 Jul 2026 12:58:58 -0400 Subject: [PATCH 4/9] fix: resolve SonarCloud issues across codebase - Use Set instead of Array for blacklistedFunctions in no-prisma-delete rule - Replace Object.prototype.hasOwnProperty.call with Object.hasOwn - Fix Vue :key bindings in v-for directives (Header, LibrarySearch, etc.) - Replace role=status with element for accessibility - Associate form labels with controls in Metadata editor - Extract nested ternaries into readable conditionals - Extract nested template literals into variables - Use project slug instead of array index as React key - Pin GitHub Actions reusable workflow to full SHA hash - Move security-events permission to job level in osv-scanner --- .github/workflows/osv-scanner.yml | 6 ++- desktop/main/components/Header.vue | 15 +++---- desktop/main/components/HeaderUserWidget.vue | 2 +- desktop/main/components/LibrarySearch.vue | 6 +-- desktop/main/pages/auth/code.vue | 6 +-- desktop/main/pages/library/[id]/index.vue | 6 +-- desktop/main/pages/queue.vue | 3 +- libraries/base/components/LoadingButton.vue | 4 +- server/components/CodeInput.vue | 2 +- server/components/GameEditor/Metadata.vue | 7 +++- .../components/GameEditor/VersionConfig.vue | 2 +- server/components/Selector/MultiItem.vue | 4 +- server/pages/admin/library/index.vue | 4 +- server/rules/no-prisma-delete.ts | 4 +- server/server/internal/metadata/giantbomb.ts | 5 ++- server/server/internal/metadata/steam.ts | 5 ++- sites/promo/src/components/comparison.tsx | 39 ++++++++++++------- sites/promo/src/components/news.tsx | 13 ++++--- 18 files changed, 77 insertions(+), 56 deletions(-) diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 48838610e..db3e0959e 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -11,13 +11,15 @@ on: branches: ["develop"] permissions: - security-events: write contents: read jobs: scan-scheduled: if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }} runs-on: ubuntu-latest + permissions: + security-events: write + contents: read steps: - name: Checkout uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 @@ -34,7 +36,7 @@ jobs: scan-pr: if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@9a498708959aeaef5ef730655706c5a1df1edbc2" # v2.3.8 with: scan-args: |- -r diff --git a/desktop/main/components/Header.vue b/desktop/main/components/Header.vue index 7af7cd23e..8b8e1223a 100644 --- a/desktop/main/components/Header.vue +++ b/desktop/main/components/Header.vue @@ -9,6 +9,7 @@
    window.startDragging()" - class="flex cursor-pointer grow h-full" - /> +
      -
    1. - +
    2. +
      3. @@ -43,7 +38,7 @@
    - + diff --git a/desktop/main/components/HeaderUserWidget.vue b/desktop/main/components/HeaderUserWidget.vue index d3d16424c..f498e2e21 100644 --- a/desktop/main/components/HeaderUserWidget.vue +++ b/desktop/main/components/HeaderUserWidget.vue @@ -45,7 +45,7 @@ Admin Dashboard - + diff --git a/server/components/CodeInput.vue b/server/components/CodeInput.vue index b31782a96..80ae4e73d 100644 --- a/server/components/CodeInput.vue +++ b/server/components/CodeInput.vue @@ -51,7 +51,7 @@ function input(index: number) { codeElements.value[index + 1].focus(); } - if (!(index - 1 < 0) && !v) { + if (index >= 1 && !v) { codeElements.value[index - 1].focus(); } diff --git a/server/components/GameEditor/Metadata.vue b/server/components/GameEditor/Metadata.vue index af8574762..6497f3dd2 100644 --- a/server/components/GameEditor/Metadata.vue +++ b/server/components/GameEditor/Metadata.vue @@ -53,7 +53,10 @@
    -