diff --git a/osv-scanner.toml b/osv-scanner.toml new file mode 100644 index 0000000..d4e07bf --- /dev/null +++ b/osv-scanner.toml @@ -0,0 +1,7 @@ +# Mark-approved 2026-10-12. Time-boxed ignore for braces GHSA-vfj7-8cjw-p6xm only. +# Ignores nothing else. + +[[IgnoredVulns]] +id = "GHSA-vfj7-8cjw-p6xm" +ignoreUntil = 2026-11-11 +reason = "Removed as soon as upstream publishes a same-major fix. braces 3.0.3 has no patched npm release." diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4787293..e3fecfd 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -8,21 +8,26 @@ overrides: '@babel/core': 7.29.7 '@hono/node-server': 2.0.11 '@humanfs/node@<0.16.8': 0.16.8 + '@modelcontextprotocol/sdk@<1.31.0': 1.31.0 adm-zip@<0.6.1: 0.6.1 - brace-expansion@<5.0.9: 5.0.9 + brace-expansion@<5.0.12: 5.0.12 browserslist@<4.28.7: 4.28.7 esbuild@>=0.27.3 <0.28.1: 0.28.1 flatted@<3.4.2: ^3.4.2 fast-uri@>=3.0.0 <3.1.7: 3.1.7 + handlebars@<4.7.10: 4.7.10 hono@<4.13.5: 4.13.5 - ip-address@<10.3.1: ^10.3.1 + ip-address@<=10.5.0: 10.7.1 minimatch@<10: ^10.2.1 nanoid@>=3.0.0 <3.3.18: 3.3.18 postcss@<=8.5.22: 8.5.23 - sharp@<0.35.4: 0.35.4 + proxy-addr@<2.0.8: 2.0.8 + sharp@<0.35.5: 0.35.5 + source-map-js@<1.2.2: 1.2.2 tar@<7.5.21: ^7.5.21 + tinypool@<2.1.2: 2.1.2 undici@>=6.0.0 <6.27.0: ^6.27.0 - undici@>=7.0.0 <7.29.0: ^7.29.0 + undici@>=7.0.0 <7.29.1: 7.29.1 ws@>=8.0.0 <8.21.0: ^8.21.0 importers: @@ -444,7 +449,7 @@ packages: resolution: { integrity: sha512-bjD221KPLoJTWUwso1J6fGKiTXEUFedG/s0visavY4zakFPkeGURMRNly+FhBHs7T8Dz4qHaZIMX9ZoJHSJtKA== } engines: { node: '>=20' } peerDependencies: - hono: ^4.12.34 + hono: 4.13.5 '@humanfs/core@0.19.2': resolution: { integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA== } @@ -470,160 +475,160 @@ packages: resolution: { integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ== } engines: { node: '>=18' } - '@img/sharp-darwin-arm64@0.35.4': - resolution: { integrity: sha512-Uhfl4V4lhP2nbUVF9+hyH1+luj86f1gUFeo8ALYxFoULoU+G87D43BfeMP8XHsk9boxAnCY/bf2EHwhA7MuGsA== } + '@img/sharp-darwin-arm64@0.35.5': + resolution: { integrity: sha512-QRUlFQ0WxvdWyqqG/WtI3iupfD5rBzmCHXSdPsY91sAtVtTo7Q4cb6zOccZ3gqEqkr0f1As1ehLqmEpDsRf+lg== } engines: { node: '>=20.9.0' } cpu: [arm64] os: [darwin] - '@img/sharp-darwin-x64@0.35.4': - resolution: { integrity: sha512-hWniXY3bG5qKpkKrAwPe4y+VTPmf086YQAnkxWh7uA1YrlRouWGa0M0Mxj3ZjnXFkv7/TD1bTy9lGUK26vRvWw== } + '@img/sharp-darwin-x64@0.35.5': + resolution: { integrity: sha512-+BR255RhDlpygUpOc/Jdt1nT6DQ3XG/ERo5wbcdOf5Q320dKtPCKPLR1LJs9VGXRaMa8l1uUa0tkCNOXiAxZUw== } engines: { node: '>=20.9.0' } cpu: [x64] os: [darwin] - '@img/sharp-freebsd-wasm32@0.35.4': - resolution: { integrity: sha512-lIsKw/BU+kjB4eZjxrYrZmwOJYi3Ajrv66iAlBmUPyKc3HpnloevB1g3wxGD9P/5BbQ1brBGl65VRRrCvQDEqA== } + '@img/sharp-freebsd-wasm32@0.35.5': + resolution: { integrity: sha512-Y/z91nEZ4uIBX5X3nfTovjU9lHNKFYbL2lpHCLVNmXQK03VIZvXBBt0KxbPGp2SdGSF+2mQU4e+hQaWOt86iAw== } engines: { node: '>=20.9.0' } os: [freebsd] - '@img/sharp-libvips-darwin-arm64@1.3.3': - resolution: { integrity: sha512-suTBPTDGrI9WodccaDdwZItTSaBYASlBk1NSfElSHrUfzu3szG6lvIF58+WiFvnfzuK8ZBFS5zE00PxqxnRiPg== } + '@img/sharp-libvips-darwin-arm64@1.3.4': + resolution: { integrity: sha512-5R89nBYiRdUlSWJxPhO+GVtaXzXSxKnRu/xqMn3KTA3L9EB9Oy/P+Nn2f2vlhPuUdy/Zusb2DarbyTpGCfEDuw== } cpu: [arm64] os: [darwin] - '@img/sharp-libvips-darwin-x64@1.3.3': - resolution: { integrity: sha512-FVJZ5mITMobmXIz/hPDTw0EintTW5H3WfrxwLqEqjiIihlu+hVRyGrFQ60xl0Lxn7Bt3zdpevPaQi0HEzqz9fw== } + '@img/sharp-libvips-darwin-x64@1.3.4': + resolution: { integrity: sha512-iR2OKH80yi0U+dUplyh3/xdpFvps6YkCwsXenIJxqxR1v9o+xtKTGbS9H7cps+2Vxjc8B1j96p75NmTGjIhtpQ== } cpu: [x64] os: [darwin] - '@img/sharp-libvips-linux-arm64@1.3.3': - resolution: { integrity: sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A== } + '@img/sharp-libvips-linux-arm64@1.3.4': + resolution: { integrity: sha512-Y3dgX/6lE2QhQb+Gxy0WZxfg9MEm/JBjamZpS2IklP7xIQoKN4hzAm7KcMVGtaVDt3neE9OKBC7vAfonA/Lr1A== } cpu: [arm64] os: [linux] libc: [glibc] - '@img/sharp-libvips-linux-arm@1.3.3': - resolution: { integrity: sha512-3rbU4vqXXc3hY/OiXdl52xZvT0F1yEngWfvqudtPJg/KkyiaQw2DRsFrNzpmLvfavbwOq3qXn36GP8obHRULQA== } + '@img/sharp-libvips-linux-arm@1.3.4': + resolution: { integrity: sha512-LmRtTsOHuvM2+wlO2Db37dx5MiZhB0FvSunciw48YjdOkZz9KAiRbm8ujeMOA1INqmei5NapFxYEK1D1ZSidmw== } cpu: [arm] os: [linux] libc: [glibc] - '@img/sharp-libvips-linux-ppc64@1.3.3': - resolution: { integrity: sha512-cdn1OvUBwsXhbC0zSzJnNzf5MZ/mTrobawDvNXBTxe8VtqKAm0sRuEY2Evzovb/w9JMk4TvRxqt1mekSuJz64w== } + '@img/sharp-libvips-linux-ppc64@1.3.4': + resolution: { integrity: sha512-Le6boB8Tai0Nis+gIxIpKx68UDVVIqdR8Tin5Yf1z2LJJQLDJvCDRqRu+jC2qCoD+eIomonmOwB4smBRxfVpYQ== } cpu: [ppc64] os: [linux] libc: [glibc] - '@img/sharp-libvips-linux-riscv64@1.3.3': - resolution: { integrity: sha512-HjPVx7yKz+0lqdhDlTw1tt90wamBoxhiXpvl1XZpJLiHH4RCJ5yDTqH+VlYPv2fwFs89JFw4c1IexYOcQUi4IQ== } + '@img/sharp-libvips-linux-riscv64@1.3.4': + resolution: { integrity: sha512-aHkkIEHPRdQEegJN20MLmGtxYD9R2wQr3Cwpddnu5+YKMt6Uzax7S9h5gpZTo8wyrGuZSlfQ63OevL5mTyOC7Q== } cpu: [riscv64] os: [linux] libc: [glibc] - '@img/sharp-libvips-linux-s390x@1.3.3': - resolution: { integrity: sha512-neWLh+3yCNThxnfy3c4BbVBeGgt9aftno+XbT56iK28RgeDs3UOFWviLWlUu0bArYVYJaFDK+RRohbicUNCm8Q== } + '@img/sharp-libvips-linux-s390x@1.3.4': + resolution: { integrity: sha512-ra/mB6MikESDUO7Yg+Mi95bFBb9GsObURuhnOv3OqknjGe9sZrG8tCe9q0xSIGrtLgvgw0gKnFWcK4blSgQOuQ== } cpu: [s390x] os: [linux] libc: [glibc] - '@img/sharp-libvips-linux-x64@1.3.3': - resolution: { integrity: sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA== } + '@img/sharp-libvips-linux-x64@1.3.4': + resolution: { integrity: sha512-GJ//SSXbnwSDes02umB3nDJLFcQzw8a18V8fyhqr6tV515tOEMdImjjxj1AoafMRz56F3PHgftnj1QEKSU1zkw== } cpu: [x64] os: [linux] libc: [glibc] - '@img/sharp-libvips-linuxmusl-arm64@1.3.3': - resolution: { integrity: sha512-Y9kQaLMuNoB0bPYOOdcZMaseNrFpPodIWWMrx+CZyydf2xn68j9WYc6sWWRrDwNkzCQjKYfc68L7jKjGlHMibw== } + '@img/sharp-libvips-linuxmusl-arm64@1.3.4': + resolution: { integrity: sha512-hvulFwtjUcagsis6BBxHwGFwWoNZjgYmULGVrZcyfNbjA8hKILbRxGg15/7w5HDyXHXUos/j6baAWqnCyQ2DWA== } cpu: [arm64] os: [linux] libc: [musl] - '@img/sharp-libvips-linuxmusl-x64@1.3.3': - resolution: { integrity: sha512-fj8Mv0HHfD1Rr+4I68+3agJynxDWtBFgicTbSOb9Bke6pIwzGcJ+RX/yHjmiEGFMCavY/dxvem7MyNaJF+wDiw== } + '@img/sharp-libvips-linuxmusl-x64@1.3.4': + resolution: { integrity: sha512-6zXKeE/p39I1AmA3cJG35eyBGNqNddLnUXjhwBnsGjFPWqf5VKkDBEqaEkPDoTEtkxwi2vv8Tcr2mDyP4So7Fg== } cpu: [x64] os: [linux] libc: [musl] - '@img/sharp-linux-arm64@0.35.4': - resolution: { integrity: sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ== } + '@img/sharp-linux-arm64@0.35.5': + resolution: { integrity: sha512-LYVx5JTsOM2CBzmxreh+nl64/3H6Xb09iSLknqH47z2T2DFFxDeFLP5y4dJwe6H7uGQlHPyEEtIqyo3DYsRwdQ== } engines: { node: '>=20.9.0' } cpu: [arm64] os: [linux] libc: [glibc] - '@img/sharp-linux-arm@0.35.4': - resolution: { integrity: sha512-7OAS8gI0EReKGVN2HssHlM6umJgxF5VI3xN0p9FA91p/YO+ou5hiNghLdZ5BEHztwaaK5+bLKRf8x/o2L2nk9A== } + '@img/sharp-linux-arm@0.35.5': + resolution: { integrity: sha512-LEaXK2WdXVK5ykcw0buWyPMsmLLL2vpHLD6yrNSW+JGEL3BZPA4tpKN6iaMc4AxTTAoaX/sU1rOL51lcIz48ZQ== } engines: { node: '>=20.9.0' } cpu: [arm] os: [linux] libc: [glibc] - '@img/sharp-linux-ppc64@0.35.4': - resolution: { integrity: sha512-2oYZJeIl4kCcMGk4ouZVjnkCtFrpQFlNEtJ6GbxzhHQchwH0NH/qEb9ykmOl29dqwMq+JhFdZn+1ak2FKhI9fQ== } + '@img/sharp-linux-ppc64@0.35.5': + resolution: { integrity: sha512-QVxAAq8evVRI9ia2vqgwrmWucn5Dfv+JdWzj75pD8omHLPSP7f8p20O8jxzjCcuCEQEOtYOZUmX1hkiZ0kdevA== } engines: { node: '>=20.9.0' } cpu: [ppc64] os: [linux] libc: [glibc] - '@img/sharp-linux-riscv64@0.35.4': - resolution: { integrity: sha512-cPbNChoRURAWdebDIHSenxRpgEdy7JkPydSnUxRm9VvKD7m0/xVaR/8Fzlu81pk5nHEvHH87UZUA7cTtwnbJSA== } + '@img/sharp-linux-riscv64@0.35.5': + resolution: { integrity: sha512-LtdreXguaavKODPIfzJ4kffx7UNt1omwtK0rch4EBbbSTXPnxWmYSayXdLJw0fJzQ97kHt1gL/yh4tvU+nCyRQ== } engines: { node: '>=20.9.0' } cpu: [riscv64] os: [linux] libc: [glibc] - '@img/sharp-linux-s390x@0.35.4': - resolution: { integrity: sha512-RY0JFY8Fd6RonCBtHz+DvadaPkXDSI1AUn6yWL9TipqkZ1vY8w8evqdgyDFnkm4/K1ve1TvZiaePP5oSd4+WVQ== } + '@img/sharp-linux-s390x@0.35.5': + resolution: { integrity: sha512-UZasTOFiYzotTsGOCu42BfUzP6Tu6Do/947iRm1RsLKvlllxwGcn4RN27LibGWceix4Y+Pmw3jsnTcCQIgWjqA== } engines: { node: '>=20.9.0' } cpu: [s390x] os: [linux] libc: [glibc] - '@img/sharp-linux-x64@0.35.4': - resolution: { integrity: sha512-9qvvEAuk8k89TfWUoX2htWjbAMX8p+NxCppjpcg5k6xMsjhBQPTsoIh36h9Qde4WRuGpJeYnOjdosDn/cnv+OA== } + '@img/sharp-linux-x64@0.35.5': + resolution: { integrity: sha512-SxFtLTeJInhAA9Q836kux2vZNeOBQEx658qvbboZScr0wIARym3IcGmW7KpVD5sbVg0Ojy+udFQdayYIZyoNog== } engines: { node: '>=20.9.0' } cpu: [x64] os: [linux] libc: [glibc] - '@img/sharp-linuxmusl-arm64@0.35.4': - resolution: { integrity: sha512-KB5jxpfWQTr0nc3xdHtWChdbifHrBGsd2SM62Eyxrl8afikm+f5qGBU75SJIZBT/S1MC8XyacdlXBMSWq6OURA== } + '@img/sharp-linuxmusl-arm64@0.35.5': + resolution: { integrity: sha512-9HbMclmI1zlNkFRs3z9/eBtDjfD0sGlrX1z6b1qwmiFY5ElDLh4BC0LPBdVp7z1DXFiKlIcznf+ZlsuZzLxQqg== } engines: { node: '>=20.9.0' } cpu: [arm64] os: [linux] libc: [musl] - '@img/sharp-linuxmusl-x64@0.35.4': - resolution: { integrity: sha512-f+eZJZIQNEEd26RPSW+76chwOf1XtA2Y/O+5ocVyLliHkeih3e+jhLVBdNTd2rS3IbNXK8+ug93Vf5ZXtF5Lxg== } + '@img/sharp-linuxmusl-x64@0.35.5': + resolution: { integrity: sha512-4KOphqB035HrVdqLZfCgMzzERrQkkzOwRhl4OAkRO1YCldbaFjySXMaK534Mo0V+LndnlJk+sbUyLeU0ULyD1A== } engines: { node: '>=20.9.0' } cpu: [x64] os: [linux] libc: [musl] - '@img/sharp-wasm32@0.35.4': - resolution: { integrity: sha512-zQnl4Kwp7Q6NHsENtU2T/00Zi+w3AQNwz3+UaTyVBy2FpXrzXzGjndpK61onhZjRtRpQXxCTeqw19bVyXOh7jA== } + '@img/sharp-wasm32@0.35.5': + resolution: { integrity: sha512-Ptsga1su4tQx+LLF1ECS9U6nz5kmrXKo6XVbtR48Ke3ZRxxgaWBu7IDtEe1quo8hiupwm6WFqxVlXaSf7IINGQ== } engines: { node: '>=20.9.0' } - '@img/sharp-webcontainers-wasm32@0.35.4': - resolution: { integrity: sha512-ESfNkywmCfPNyaZjxooddJQiQ+l/nTpGEOGthxiLnIHXC/CmcBixnfwUleX9mCz9ovrUUvKMap/pm8RYbzfwaA== } + '@img/sharp-webcontainers-wasm32@0.35.5': + resolution: { integrity: sha512-hfhF/FmoQyTUkA0bIKFOtw536BQSeBMe6BF6QyWlrPxT754+TFLaZ7sKKTfvvM0yJgKgaYTwnFCIZ/GuDw5SUA== } engines: { node: '>=20.9.0' } cpu: [wasm32] - '@img/sharp-win32-arm64@0.35.4': - resolution: { integrity: sha512-iNdlBX9gLVvqe2I3uIJSIKTq6wckP/DYxZtcqxm09x5Gi24DnFBmPAWZmr60ZyYMG0xlzo6goG3670ar+RXvRw== } + '@img/sharp-win32-arm64@0.35.5': + resolution: { integrity: sha512-X4t7g+7ZA5DKblCBEXGjUqqemj4vczING/5viFwAL8h4N3qYeyjwdCvRLHi4EdOUI+2Z7UFlp1VM+p/AuEtm6Q== } engines: { node: '>=20.9.0' } cpu: [arm64] os: [win32] - '@img/sharp-win32-ia32@0.35.4': - resolution: { integrity: sha512-kqRsbaa5CS6KHlpxnN7WhE6vAAugXyZButpRdvDWetlv6Qv4N9WTcrWzF7tXfB9T7MsoadqdI8hmwLq6UlLvtw== } + '@img/sharp-win32-ia32@0.35.5': + resolution: { integrity: sha512-5Zm82LoBc43nhwNybZlG7Y1KO//Zhsn306fQl29ZOuStHLGTo3BWL83q3cznX0poxSAMuYL1On/BHBxkBeKr6A== } engines: { node: ^20.9.0 } cpu: [ia32] os: [win32] - '@img/sharp-win32-x64@0.35.4': - resolution: { integrity: sha512-XtmnYhBcrORsJ4XJngyzr/EWP0hRZLAZRFaApdKuviyqF78+ylxh2y06ZmtULAMOnObJ3ucpN0AcwSWnMowTRg== } + '@img/sharp-win32-x64@0.35.5': + resolution: { integrity: sha512-x76eH0vEiHlcMQu8Y8IenntaACtddpT6W0wmXtWrnKcnKI7ME5DdgqhAD6SEWOEl1v2zDvkZDhFA9KnURwpfqg== } engines: { node: '>=20.9.0' } cpu: [x64] os: [win32] @@ -655,8 +660,8 @@ packages: '@jridgewell/trace-mapping@0.3.9': resolution: { integrity: sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ== } - '@modelcontextprotocol/sdk@1.29.0': - resolution: { integrity: sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ== } + '@modelcontextprotocol/sdk@1.31.0': + resolution: { integrity: sha512-UvTMgnNlnIBO/22ob2RcVGDlcvOslQs8T59+FTGdA0L27a39fdGF/EDETNtDVK4DZGpwomlsYpRdA8UXcVL/pw== } engines: { node: '>=18' } peerDependencies: '@cfworker/json-schema': ^4.1.1 @@ -1268,8 +1273,8 @@ packages: boundary@2.0.0: resolution: { integrity: sha512-rJKn5ooC9u8q13IMCrW0RSp31pxBCHE3y9V/tp3TdWSLf8Em3p6Di4NBpfzbJge9YjjFEsD0RtFEjtvHL5VyEA== } - brace-expansion@5.0.9: - resolution: { integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg== } + brace-expansion@5.0.12: + resolution: { integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ== } engines: { node: 20 || >=22 } braces@3.0.3: @@ -1612,8 +1617,8 @@ packages: gpt-tokenizer@3.4.0: resolution: { integrity: sha512-wxFLnhIXTDjYebd9A9pGl3e31ZpSypbpIJSOswbgop5jLte/AsZVDvjlbEuVFlsqZixVKqbcoNmRlFDf6pz/UQ== } - handlebars@4.7.9: - resolution: { integrity: sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ== } + handlebars@4.7.10: + resolution: { integrity: sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg== } engines: { node: '>=0.4.7' } hasBin: true @@ -1659,8 +1664,8 @@ packages: inherits@2.0.4: resolution: { integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ== } - ip-address@10.5.0: - resolution: { integrity: sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g== } + ip-address@10.7.1: + resolution: { integrity: sha512-4OUAqU9Z1i3vCnS05hzGiFnEMDpQ+62pAD/MVQOp83fYyNC8GleCqaS0QikQBmcWCrKFiUs/B8ztRRiYOAXuCA== } engines: { node: '>= 12' } ipaddr.js@1.9.1: @@ -1963,8 +1968,8 @@ packages: protocols@2.0.2: resolution: { integrity: sha512-hHVTzba3wboROl0/aWRRG9dMytgH6ow//STBZh43l/wQgmMhYhOFi0EHWAPtoCz9IAUymsyP0TSBHkhgMEGNnQ== } - proxy-addr@2.0.7: - resolution: { integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg== } + proxy-addr@2.0.8: + resolution: { integrity: sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ== } engines: { node: '>= 0.10' } punycode@2.3.1: @@ -2041,8 +2046,8 @@ packages: setprototypeof@1.2.0: resolution: { integrity: sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw== } - sharp@0.35.4: - resolution: { integrity: sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA== } + sharp@0.35.5: + resolution: { integrity: sha512-Ywn4OnzGukp7CDMrp08RQ50YKmuwG47brZgIVPTvBaaAfQlRlygrRqSrxdCiL9M+LlzLBiJ68IR1QqvzHyjC7g== } engines: { node: '>=20.9.0' } peerDependencies: '@types/node': '*' @@ -2088,8 +2093,8 @@ packages: resolution: { integrity: sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ== } engines: { node: '>= 18' } - source-map-js@1.2.1: - resolution: { integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA== } + source-map-js@1.2.2: + resolution: { integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw== } engines: { node: '>=0.10.0' } source-map@0.6.1: @@ -2140,8 +2145,8 @@ packages: resolution: { integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g== } engines: { node: '>=12.0.0' } - tinypool@2.1.0: - resolution: { integrity: sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw== } + tinypool@2.1.2: + resolution: { integrity: sha512-9YodfrxS9g9IbFr/KOjE5bAeJ0p61n3bW6mqvy0jtoeKd1kTW1Cxm0oulm6KX2lyM9Gl6WIe8nEbY7LWv5ZJww== } engines: { node: ^20.0.0 || >=22.0.0 } tinyrainbow@3.1.1: @@ -2194,8 +2199,8 @@ packages: resolution: { integrity: sha512-b7zoBQvpWp0vuN5q2vK2RRBR2SvuruQAs50DApdDveBSn3eSYd84IaHodFqQIMlvY9K2VnyBUEXgwOBuGU9GBg== } engines: { node: '>=14' } - undici@7.29.0: - resolution: { integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw== } + undici@7.29.1: + resolution: { integrity: sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q== } engines: { node: '>=20.18.1' } unenv@2.0.0-rc.24: @@ -2748,108 +2753,108 @@ snapshots: '@img/colour@1.1.0': {} - '@img/sharp-darwin-arm64@0.35.4': + '@img/sharp-darwin-arm64@0.35.5': optionalDependencies: - '@img/sharp-libvips-darwin-arm64': 1.3.3 + '@img/sharp-libvips-darwin-arm64': 1.3.4 optional: true - '@img/sharp-darwin-x64@0.35.4': + '@img/sharp-darwin-x64@0.35.5': optionalDependencies: - '@img/sharp-libvips-darwin-x64': 1.3.3 + '@img/sharp-libvips-darwin-x64': 1.3.4 optional: true - '@img/sharp-freebsd-wasm32@0.35.4': + '@img/sharp-freebsd-wasm32@0.35.5': dependencies: - '@img/sharp-wasm32': 0.35.4 + '@img/sharp-wasm32': 0.35.5 optional: true - '@img/sharp-libvips-darwin-arm64@1.3.3': + '@img/sharp-libvips-darwin-arm64@1.3.4': optional: true - '@img/sharp-libvips-darwin-x64@1.3.3': + '@img/sharp-libvips-darwin-x64@1.3.4': optional: true - '@img/sharp-libvips-linux-arm64@1.3.3': + '@img/sharp-libvips-linux-arm64@1.3.4': optional: true - '@img/sharp-libvips-linux-arm@1.3.3': + '@img/sharp-libvips-linux-arm@1.3.4': optional: true - '@img/sharp-libvips-linux-ppc64@1.3.3': + '@img/sharp-libvips-linux-ppc64@1.3.4': optional: true - '@img/sharp-libvips-linux-riscv64@1.3.3': + '@img/sharp-libvips-linux-riscv64@1.3.4': optional: true - '@img/sharp-libvips-linux-s390x@1.3.3': + '@img/sharp-libvips-linux-s390x@1.3.4': optional: true - '@img/sharp-libvips-linux-x64@1.3.3': + '@img/sharp-libvips-linux-x64@1.3.4': optional: true - '@img/sharp-libvips-linuxmusl-arm64@1.3.3': + '@img/sharp-libvips-linuxmusl-arm64@1.3.4': optional: true - '@img/sharp-libvips-linuxmusl-x64@1.3.3': + '@img/sharp-libvips-linuxmusl-x64@1.3.4': optional: true - '@img/sharp-linux-arm64@0.35.4': + '@img/sharp-linux-arm64@0.35.5': optionalDependencies: - '@img/sharp-libvips-linux-arm64': 1.3.3 + '@img/sharp-libvips-linux-arm64': 1.3.4 optional: true - '@img/sharp-linux-arm@0.35.4': + '@img/sharp-linux-arm@0.35.5': optionalDependencies: - '@img/sharp-libvips-linux-arm': 1.3.3 + '@img/sharp-libvips-linux-arm': 1.3.4 optional: true - '@img/sharp-linux-ppc64@0.35.4': + '@img/sharp-linux-ppc64@0.35.5': optionalDependencies: - '@img/sharp-libvips-linux-ppc64': 1.3.3 + '@img/sharp-libvips-linux-ppc64': 1.3.4 optional: true - '@img/sharp-linux-riscv64@0.35.4': + '@img/sharp-linux-riscv64@0.35.5': optionalDependencies: - '@img/sharp-libvips-linux-riscv64': 1.3.3 + '@img/sharp-libvips-linux-riscv64': 1.3.4 optional: true - '@img/sharp-linux-s390x@0.35.4': + '@img/sharp-linux-s390x@0.35.5': optionalDependencies: - '@img/sharp-libvips-linux-s390x': 1.3.3 + '@img/sharp-libvips-linux-s390x': 1.3.4 optional: true - '@img/sharp-linux-x64@0.35.4': + '@img/sharp-linux-x64@0.35.5': optionalDependencies: - '@img/sharp-libvips-linux-x64': 1.3.3 + '@img/sharp-libvips-linux-x64': 1.3.4 optional: true - '@img/sharp-linuxmusl-arm64@0.35.4': + '@img/sharp-linuxmusl-arm64@0.35.5': optionalDependencies: - '@img/sharp-libvips-linuxmusl-arm64': 1.3.3 + '@img/sharp-libvips-linuxmusl-arm64': 1.3.4 optional: true - '@img/sharp-linuxmusl-x64@0.35.4': + '@img/sharp-linuxmusl-x64@0.35.5': optionalDependencies: - '@img/sharp-libvips-linuxmusl-x64': 1.3.3 + '@img/sharp-libvips-linuxmusl-x64': 1.3.4 optional: true - '@img/sharp-wasm32@0.35.4': + '@img/sharp-wasm32@0.35.5': dependencies: '@emnapi/runtime': 1.11.3 optional: true - '@img/sharp-webcontainers-wasm32@0.35.4': + '@img/sharp-webcontainers-wasm32@0.35.5': dependencies: - '@img/sharp-wasm32': 0.35.4 + '@img/sharp-wasm32': 0.35.5 optional: true - '@img/sharp-win32-arm64@0.35.4': + '@img/sharp-win32-arm64@0.35.5': optional: true - '@img/sharp-win32-ia32@0.35.4': + '@img/sharp-win32-ia32@0.35.5': optional: true - '@img/sharp-win32-x64@0.35.4': + '@img/sharp-win32-x64@0.35.5': optional: true '@isaacs/fs-minipass@4.0.1': @@ -2882,7 +2887,7 @@ snapshots: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.5.5 - '@modelcontextprotocol/sdk@1.29.0(supports-color@10.2.2)(zod@4.4.3)': + '@modelcontextprotocol/sdk@1.31.0(supports-color@10.2.2)(zod@4.4.3)': dependencies: '@hono/node-server': 2.0.11(hono@4.13.5) ajv: 8.20.0 @@ -3384,7 +3389,7 @@ snapshots: boundary@2.0.0: {} - brace-expansion@5.0.9: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -3605,7 +3610,7 @@ snapshots: express-rate-limit@8.5.2(express@5.2.1(supports-color@10.2.2)): dependencies: express: 5.2.1(supports-color@10.2.2) - ip-address: 10.5.0 + ip-address: 10.7.1 express@5.2.1(supports-color@10.2.2): dependencies: @@ -3628,7 +3633,7 @@ snapshots: on-finished: 2.4.1 once: 1.4.0 parseurl: 1.3.3 - proxy-addr: 2.0.7 + proxy-addr: 2.0.8 qs: 6.15.3 range-parser: 1.3.0 router: 2.2.0(supports-color@10.2.2) @@ -3777,7 +3782,7 @@ snapshots: gpt-tokenizer@3.4.0: {} - handlebars@4.7.9: + handlebars@4.7.10: dependencies: minimist: 1.2.8 neo-async: 2.6.2 @@ -3818,7 +3823,7 @@ snapshots: inherits@2.0.4: {} - ip-address@10.5.0: {} + ip-address@10.7.1: {} ipaddr.js@1.9.1: {} @@ -3924,7 +3929,7 @@ snapshots: dependencies: '@babel/parser': 7.29.7 '@babel/types': 7.29.7 - source-map-js: 1.2.1 + source-map-js: 1.2.2 make-dir@4.0.0: dependencies: @@ -3952,8 +3957,8 @@ snapshots: miniflare@4.20260317.3: dependencies: '@cspotcode/source-map-support': 0.8.1 - sharp: 0.35.4 - undici: 7.29.0 + sharp: 0.35.5 + undici: 7.29.1 workerd: 1.20260317.1 ws: 8.21.0 youch: 4.1.0-beta.10 @@ -3965,8 +3970,8 @@ snapshots: miniflare@5.20260811.1-alpha: dependencies: '@cspotcode/source-map-support': 0.8.1 - sharp: 0.35.4 - undici: 7.29.0 + sharp: 0.35.5 + undici: 7.29.1 workerd: 1.20260811.1 ws: 8.21.0 youch: 4.1.0-beta.10 @@ -3977,7 +3982,7 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 minimist@1.2.8: {} @@ -4113,7 +4118,7 @@ snapshots: dependencies: nanoid: 3.3.18 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 prelude-ls@1.2.1: {} @@ -4121,7 +4126,7 @@ snapshots: protocols@2.0.2: {} - proxy-addr@2.0.7: + proxy-addr@2.0.8: dependencies: forwarded: 0.2.0 ipaddr.js: 1.9.1 @@ -4149,7 +4154,7 @@ snapshots: repomix@1.18.0(supports-color@10.2.2)(typescript@5.9.3): dependencies: '@clack/prompts': 0.11.0 - '@modelcontextprotocol/sdk': 1.29.0(supports-color@10.2.2)(zod@4.4.3) + '@modelcontextprotocol/sdk': 1.31.0(supports-color@10.2.2)(zod@4.4.3) '@repomix/strip-comments': 2.4.2 '@repomix/tree-sitter-wasms': 0.1.17 '@secretlint/core': 13.0.4(supports-color@10.2.2) @@ -4160,7 +4165,7 @@ snapshots: git-url-parse: 16.1.0 globby: 16.2.4 gpt-tokenizer: 3.4.0 - handlebars: 4.7.9 + handlebars: 4.7.10 iconv-lite: 0.7.3 is-binary-path: 3.0.0 isbinaryfile: 5.0.7 @@ -4172,7 +4177,7 @@ snapshots: picospinner: 3.0.0 tar: 7.5.22 tinyclip: 0.1.15 - tinypool: 2.1.0 + tinypool: 2.1.2 valibot: 1.4.2(typescript@5.9.3) web-tree-sitter: 0.26.13 zod: 4.4.3 @@ -4265,37 +4270,37 @@ snapshots: setprototypeof@1.2.0: {} - sharp@0.35.4: + sharp@0.35.5: dependencies: '@img/colour': 1.1.0 detect-libc: 2.1.2 semver: 7.8.5 optionalDependencies: - '@img/sharp-darwin-arm64': 0.35.4 - '@img/sharp-darwin-x64': 0.35.4 - '@img/sharp-freebsd-wasm32': 0.35.4 - '@img/sharp-libvips-darwin-arm64': 1.3.3 - '@img/sharp-libvips-darwin-x64': 1.3.3 - '@img/sharp-libvips-linux-arm': 1.3.3 - '@img/sharp-libvips-linux-arm64': 1.3.3 - '@img/sharp-libvips-linux-ppc64': 1.3.3 - '@img/sharp-libvips-linux-riscv64': 1.3.3 - '@img/sharp-libvips-linux-s390x': 1.3.3 - '@img/sharp-libvips-linux-x64': 1.3.3 - '@img/sharp-libvips-linuxmusl-arm64': 1.3.3 - '@img/sharp-libvips-linuxmusl-x64': 1.3.3 - '@img/sharp-linux-arm': 0.35.4 - '@img/sharp-linux-arm64': 0.35.4 - '@img/sharp-linux-ppc64': 0.35.4 - '@img/sharp-linux-riscv64': 0.35.4 - '@img/sharp-linux-s390x': 0.35.4 - '@img/sharp-linux-x64': 0.35.4 - '@img/sharp-linuxmusl-arm64': 0.35.4 - '@img/sharp-linuxmusl-x64': 0.35.4 - '@img/sharp-webcontainers-wasm32': 0.35.4 - '@img/sharp-win32-arm64': 0.35.4 - '@img/sharp-win32-ia32': 0.35.4 - '@img/sharp-win32-x64': 0.35.4 + '@img/sharp-darwin-arm64': 0.35.5 + '@img/sharp-darwin-x64': 0.35.5 + '@img/sharp-freebsd-wasm32': 0.35.5 + '@img/sharp-libvips-darwin-arm64': 1.3.4 + '@img/sharp-libvips-darwin-x64': 1.3.4 + '@img/sharp-libvips-linux-arm': 1.3.4 + '@img/sharp-libvips-linux-arm64': 1.3.4 + '@img/sharp-libvips-linux-ppc64': 1.3.4 + '@img/sharp-libvips-linux-riscv64': 1.3.4 + '@img/sharp-libvips-linux-s390x': 1.3.4 + '@img/sharp-libvips-linux-x64': 1.3.4 + '@img/sharp-libvips-linuxmusl-arm64': 1.3.4 + '@img/sharp-libvips-linuxmusl-x64': 1.3.4 + '@img/sharp-linux-arm': 0.35.5 + '@img/sharp-linux-arm64': 0.35.5 + '@img/sharp-linux-ppc64': 0.35.5 + '@img/sharp-linux-riscv64': 0.35.5 + '@img/sharp-linux-s390x': 0.35.5 + '@img/sharp-linux-x64': 0.35.5 + '@img/sharp-linuxmusl-arm64': 0.35.5 + '@img/sharp-linuxmusl-x64': 0.35.5 + '@img/sharp-webcontainers-wasm32': 0.35.5 + '@img/sharp-win32-arm64': 0.35.5 + '@img/sharp-win32-ia32': 0.35.5 + '@img/sharp-win32-x64': 0.35.5 shebang-command@2.0.0: dependencies: @@ -4339,7 +4344,7 @@ snapshots: smol-toml@1.8.0: {} - source-map-js@1.2.1: {} + source-map-js@1.2.2: {} source-map@0.6.1: {} @@ -4380,7 +4385,7 @@ snapshots: fdir: 6.5.0(picomatch@4.0.5) picomatch: 4.0.5 - tinypool@2.1.0: {} + tinypool@2.1.2: {} tinyrainbow@3.1.1: {} @@ -4425,7 +4430,7 @@ snapshots: unbash@4.0.10: {} - undici@7.29.0: {} + undici@7.29.1: {} unenv@2.0.0-rc.24: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index bd47832..a52c8de 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -3,24 +3,38 @@ overrides: '@hono/node-server': 2.0.11 # @humanfs/node ≥0.16.8 floor for GHSA-p498-v437-472g — REMOVE when lockfile resolves ≥0.16.8 without this pin and that alert is gone. '@humanfs/node@<0.16.8': 0.16.8 + # @modelcontextprotocol/sdk ≥1.31.0 floor for GHSA-6qxp-vccf-f47h — REMOVE when lockfile resolves ≥1.31.0 without this pin and that alert is gone. + '@modelcontextprotocol/sdk@<1.31.0': 1.31.0 # adm-zip ≥0.6.1 floor for GHSA-vwc7 / GHSA-xcpc — REMOVE when lockfile resolves ≥0.6.1 without this pin and those alerts are gone. adm-zip@<0.6.1: 0.6.1 - brace-expansion@<5.0.9: 5.0.9 + # brace-expansion ≥5.0.12 floor for GHSA-6j4f-fj2g-mc7p / GHSA-qhr7-859c-m2p7 / GHSA-q2hr-2g5m-vwhr — REMOVE when lockfile resolves ≥5.0.12 without this pin and those alerts are gone. + brace-expansion@<5.0.12: 5.0.12 browserslist@<4.28.7: 4.28.7 esbuild@>=0.27.3 <0.28.1: 0.28.1 flatted@<3.4.2: ^3.4.2 # fast-uri ≥3.1.7 floor for GHSA-58mr-gqgx-xq4g / GHSA-qw65-cvwx-89v3 — REMOVE when lockfile resolves ≥3.1.7 without this pin and those alerts are gone. fast-uri@>=3.0.0 <3.1.7: 3.1.7 + # handlebars ≥4.7.10 floor for GHSA-8r5x-fm3f-whwj / GHSA-p8wg-vrv2-v86f / GHSA-xw65-4hp5-5hc7 — REMOVE when lockfile resolves ≥4.7.10 without this pin and those alerts are gone. + handlebars@<4.7.10: 4.7.10 # hono ≥4.13.5 floor for GHSA-crvj-82cr-hjcx / GHSA-gqvv-2mrq-wpjv — REMOVE when lockfile resolves ≥4.13.5 without this pin and those alerts are gone. hono@<4.13.5: 4.13.5 - ip-address@<10.3.1: ^10.3.1 + # ip-address ≥10.7.1 floor for GHSA-rpw4-54j3-4h4q / GHSA-2vr4-cq9g-pvrc — REMOVE when lockfile resolves ≥10.7.1 without this pin and those alerts are gone. + ip-address@<=10.5.0: 10.7.1 minimatch@<10: ^10.2.1 nanoid@>=3.0.0 <3.3.18: 3.3.18 postcss@<=8.5.22: 8.5.23 - sharp@<0.35.4: 0.35.4 + # proxy-addr ≥2.0.8 floor for GHSA-jqcg-44mw-7w3h — REMOVE when lockfile resolves ≥2.0.8 without this pin and that alert is gone. + proxy-addr@<2.0.8: 2.0.8 + # sharp ≥0.35.5 floor for GHSA-wq5f-xc86-pv6w — REMOVE when lockfile resolves ≥0.35.5 without this pin and that alert is gone. + sharp@<0.35.5: 0.35.5 + # source-map-js ≥1.2.2 floor for GHSA-68fv-2mgg-jv7q — REMOVE when lockfile resolves ≥1.2.2 without this pin and that alert is gone. + source-map-js@<1.2.2: 1.2.2 tar@<7.5.21: ^7.5.21 + # tinypool ≥2.1.2 floor for GHSA-5gmw-xhrv-c9v3 / GHSA-85c8-ppgw-ccpr — REMOVE when lockfile resolves ≥2.1.2 without this pin and those alerts are gone. + tinypool@<2.1.2: 2.1.2 undici@>=6.0.0 <6.27.0: ^6.27.0 - undici@>=7.0.0 <7.29.0: ^7.29.0 + # undici ≥7.29.1 floor for GHSA-w293-vg96-wgc3 — REMOVE when lockfile resolves ≥7.29.1 without this pin and that alert is gone. + undici@>=7.0.0 <7.29.1: 7.29.1 ws@>=8.0.0 <8.21.0: ^8.21.0 allowBuilds: