From 8240f4ec7020b1345bd3320eec8dcfc3c8f50b5a Mon Sep 17 00:00:00 2001 From: Eric Andrechek Date: Tue, 18 Aug 2026 15:50:24 -0400 Subject: [PATCH 1/2] deps: clear 14 pnpm advisories and land the weekly dep groups Folds the three open Dependabot PRs into one change and closes #486. pnpm 11.1.3 -> 11.21.0 across all six files that declare it, eight lines in total (the issue listed four sites; development.md's verify snippet, README.md and AGENTS.md were missed). 11.1.3 sat below the first_patched_version of fourteen advisories in the 11.x line, floor 11.8.0. 11.21.0 over the newer 11.22.0 because the repo's own minimumReleaseAge: 10080 encodes a 7-day cooldown and 11.22.0 is three days old; both clear every advisory. lockfileVersion stays at 9.0. Dependabot's `directory: /` for github-actions reaches .github/workflows/ and does not descend into .github/actions/*/action.yml, so the setup-env composite action -- which owns every cache in CI -- went untracked, so its pins went stale against upstream and diverged from publish-npm.yml, a workflow Dependabot DOES track and which does not call setup-env (actions/setup-node v7.0.0 there vs v6.4.0 here; pnpm/action-setup v6.0.9 vs v6.0.8). actions/cache was uniformly v5.0.5 everywhere, simply a major behind upstream. The config moves to `directories: [/, /.github/actions/setup-env]` and the action is brought up to the versions #480 proposed for the workflows. Groups landed: actions-deps (#480) verbatim, go-deps (#481) verbatim, and four of the five npm-deps bumps (#482). typescript 6 -> 7 is held: tsup 8.5.1 vendors rollup-plugin-dts 6.1.1, which reaches for TS 5-era compiler internals and throws on `dts: true` inside clients/ts's prepare script -- i.e. inside pnpm install, taking every Node job down at once. rollup-plugin-dts >= 6.5.0 declares TS 7 support, so the unblock is a tsup release that vendors it; dependabot.yml ignores the typescript major until then. Also makes housekeeping.yml's documented "labeling failures are non-fatal" contract true -- the labeler step never carried continue-on-error, which is why a transient GitHub 500 reddened #481. Closes #486. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01YEwX2gCkH2BSzEfX6bUvDV --- .github/actions/setup-env/action.yml | 18 +- .github/dependabot.yml | 24 +- .github/workflows/ci.yml | 2 +- .github/workflows/housekeeping.yml | 7 +- .github/workflows/publish-dev.yml | 8 +- .github/workflows/publish-npm.yml | 8 +- .github/workflows/release.yml | 6 +- AGENTS.md | 2 +- CHANGELOG.md | 4 + README.md | 2 +- clients/ts/package.json | 2 +- docs/package.json | 4 +- docs/src/content/docs/development.md | 21 +- go.mod | 25 +- go.sum | 48 +-- package.json | 2 +- pnpm-lock.yaml | 468 +++++++++++++++------------ pnpm-workspace.yaml | 2 +- 18 files changed, 368 insertions(+), 285 deletions(-) diff --git a/.github/actions/setup-env/action.yml b/.github/actions/setup-env/action.yml index e7b1b76b..18132f4e 100644 --- a/.github/actions/setup-env/action.yml +++ b/.github/actions/setup-env/action.yml @@ -112,7 +112,7 @@ runs: # All Go jobs miss this key together on a dependency bump and all try to # save; the backend keeps the first and the rest log a benign "already # exists" (same trade-off as the rest of the inventory, see header). - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 if: ${{ inputs.go == 'true' }} id: gomod-cache with: @@ -140,7 +140,7 @@ runs: # (~/go/pkg/mod moved out, above). Saves only happen on an exact-key # miss, so without a bump the old v2 entry would exact-hit forever and # the new, smaller content would never be saved. - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 if: ${{ inputs.go == 'true' }} id: gobuild-cache with: @@ -167,7 +167,7 @@ runs: restore-keys: | gobuild-v3-${{ runner.os }}-go${{ inputs.go-cache-suffix }}- - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 if: ${{ inputs.golangci == 'true' }} id: golangci-cache with: @@ -196,10 +196,10 @@ runs: # pnpm must install before its cache step so the store path can be # resolved from pnpm itself. - - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 if: ${{ inputs.node == 'true' }} with: - version: "11.1.3" + version: "11.21.0" run_install: false - name: Resolve pnpm store directory @@ -208,7 +208,7 @@ runs: shell: bash run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT" - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 if: ${{ inputs.node == 'true' }} id: pnpm-cache with: @@ -222,7 +222,7 @@ runs: # Chromium during install-playwright-docs — adds 30-60s per run. Keyed # on the root pnpm-lock.yaml since that's where the Playwright version # is locked. Closes the Playwright half of #132. - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 if: ${{ inputs.playwright == 'true' }} id: playwright-cache with: @@ -238,7 +238,7 @@ runs: # the cache shape; intra-key content changes are caught by Astro's # own file-hash check inside data-store.json. Closes the build-cache # half of #132. - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 if: ${{ inputs.astro == 'true' }} id: astro-cache with: @@ -247,7 +247,7 @@ runs: restore-keys: | astro-${{ runner.os }}- - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 if: ${{ inputs.node == 'true' }} with: node-version-file: ".nvmrc" diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c0934c72..122cd1f2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,8 +13,19 @@ updates: prefix: "deps" # GitHub Actions + # + # TWO directories, not one. `directory: /` only reaches .github/workflows/ — + # it does NOT descend into .github/actions/*/action.yml. The setup-env + # composite action therefore went untracked, and its pins went stale against + # upstream and diverged from publish-npm.yml — a workflow Dependabot DOES + # track, and which doesn't call setup-env (actions/setup-node v7.0.0 there + # vs v6.4.0 here; pnpm/action-setup v6.0.9 vs v6.0.8). Adding a composite + # action under .github/actions/ means adding its directory below; nothing + # else catches the drift. - package-ecosystem: github-actions - directory: / + directories: + - / + - /.github/actions/setup-env schedule: interval: weekly day: monday @@ -52,5 +63,16 @@ updates: groups: npm-deps: patterns: ["*"] + ignore: + # TypeScript 7 (the native port) is held back by tsup: tsup 8.5.1 — the + # current release — vendors rollup-plugin-dts 6.1.1, which reaches for + # TS 5-era internals and dies with "Cannot read properties of undefined + # (reading 'useCaseSensitiveFileNames')" the moment `dts: true` runs. + # That is clients/ts's `prepare` script, so the crash lands inside + # `pnpm install` and takes every Node job down with it (#482). + # rollup-plugin-dts >= 6.5.0 declares TS 7 support; drop this ignore once + # tsup ships a release that vendors it. Tracked in #487. + - dependency-name: "typescript" + update-types: ["version-update:semver-major"] commit-message: prefix: "deps" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2102cf49..3c0b05f9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -389,7 +389,7 @@ jobs: github.event.pull_request.head.repo.full_name == github.repository) ) }} continue-on-error: true - uses: actions/upload-code-coverage@1c15be36fc3733ba839b1dd643bd9556e4426dc1 # v1.4.1 + uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2 with: file: tmp/coverage/go-coverage.xml language: go diff --git a/.github/workflows/housekeeping.yml b/.github/workflows/housekeeping.yml index 8410e0fd..3de824e0 100644 --- a/.github/workflows/housekeeping.yml +++ b/.github/workflows/housekeeping.yml @@ -56,7 +56,12 @@ jobs: # `sync-labels: true` removes labels when their matching files # leave the diff, so labels track the current change set. - name: Apply file-path labels - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0 + # Non-fatal on purpose (the header's contract): labeling is a + # convenience, the title mirror below is the point. Without this a + # transient labeler API 500 aborts the job before the mirror runs — + # which is exactly what reddened #481. + continue-on-error: true + uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0 with: configuration-path: .github/labeler.yml sync-labels: true diff --git a/.github/workflows/publish-dev.yml b/.github/workflows/publish-dev.yml index a09e6002..de51b6ef 100644 --- a/.github/workflows/publish-dev.yml +++ b/.github/workflows/publish-dev.yml @@ -74,7 +74,7 @@ jobs: # other can't use. Same `gobuild-v3` family and key inputs as # setup-env's (see .github/workflows/README.md); ~0.5 GB rather than # the ~1 GB the bundled cache held. - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/go-build key: gobuild-v3-${{ runner.os }}-go-release-${{ hashFiles('**/go.mod', '**/go.sum') }} @@ -91,7 +91,7 @@ jobs: # shares — it never runs `go mod download` for the full graph (see the # cov note in the Makefile for why a partial save there is corrosive). # Restore-only writes nothing, so it costs 0 GB of the budget. - - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/go/pkg/mod key: gomod-v1-${{ runner.os }}-${{ hashFiles('**/go.mod', '**/go.sum') }} @@ -107,7 +107,7 @@ jobs: uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Login to GitHub Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -150,7 +150,7 @@ jobs: echo "Resolved $ref -> $digest" - name: Attest dev image provenance - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-name: ghcr.io/wave-rf/wavehouse subject-digest: ${{ steps.image.outputs.digest }} diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index f7db04df..31aafb19 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -48,9 +48,9 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 with: - version: "11.1.3" + version: "11.21.0" run_install: false # Node 24 ships npm >= 11.5.1 for OIDC trusted publishing, and dodges the @@ -102,9 +102,9 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 with: - version: "11.1.3" + version: "11.21.0" run_install: false # Node 24 ships npm >= 11.5.1 for OIDC trusted publishing — see the dev job. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 74b1ebb2..7f7b6204 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,7 +57,7 @@ jobs: uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Login to GitHub Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -78,7 +78,7 @@ jobs: # in goreleaser's checksums.txt. Image: attest the multi-arch # manifest-list digest and store the attestation alongside it in GHCR. - name: Attest binary provenance - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-checksums: dist/checksums.txt @@ -94,7 +94,7 @@ jobs: echo "Resolved $ref -> $digest" - name: Attest image provenance - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-name: ghcr.io/wave-rf/wavehouse subject-digest: ${{ steps.image.outputs.digest }} diff --git a/AGENTS.md b/AGENTS.md index 00076ca1..723d5588 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -111,7 +111,7 @@ Tooling notes (the non-obvious bits `make help` won't tell you): - Dev tools (`gotestsum`, `gofumpt`, `goimports`, `govulncheck`, `go-test-coverage`, `gocover-cobertura`, `deadcode`, `gsa`, `goda`) are pinned in `go.mod` via `tool` directives — `go tool `, no manual install. - `golangci-lint` is pinned in the Makefile (v2.11.4), auto-installed to `.bin/` on first `make lint` — kept out of `go.mod` (its deps conflict with the main module). -- `pnpm` (≥ 11.1) + `Node 22 LTS` (`.nvmrc`, matches CI) must be on PATH; `make tools` runs one root `pnpm install --frozen-lockfile` across the three workspaces (SDK `clients/ts/`, E2E `tests/e2e/sdk/`, docs `docs/`). +- `pnpm` (≥ 11.21) + `Node 22 LTS` (`.nvmrc`, matches CI) must be on PATH; `make tools` runs one root `pnpm install --frozen-lockfile` across the three workspaces (SDK `clients/ts/`, E2E `tests/e2e/sdk/`, docs `docs/`). - **GNU Make 4+** required (uses `--output-sync=target`); macOS BSD Make 3.81 won't parse it. Full setup: `docs/src/content/docs/development.md` § Prerequisites. - **Lint split**: Biome owns JS/TS/JSON, markdownlint owns Markdown *style*, misspell owns spelling (all under `make lint`/`make fix`); accuracy/clarity/doc-sync is the `docs-reviewer` gate (§Docs review). - **Worktrunk** (`wt`, `.config/wt.toml`): `wt switch --create` seeds `.bin/` + `node_modules/` from main, then runs `make tools`. diff --git a/CHANGELOG.md b/CHANGELOG.md index b36478e2..c8480eb8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -25,6 +25,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed +- **Dependabot now watches the `setup-env` composite action, and the three weekly update groups land in one pass** (`.github/dependabot.yml`, `.github/workflows/{ci,housekeeping,publish-dev,publish-npm,release}.yml`, `.github/actions/setup-env/action.yml`, `go.mod`, `go.sum`, `clients/ts/package.json`, `docs/package.json`, `pnpm-workspace.yaml`, `pnpm-lock.yaml`, `docs/src/content/docs/development.md`): `directory: /` under `package-ecosystem: github-actions` reaches `.github/workflows/` and does not descend into `.github/actions/*/action.yml`, so `setup-env` — which owns every cache in CI — had been invisible to Dependabot since it was created, so its pins went stale against upstream and diverged from `publish-npm.yml`, a workflow Dependabot *does* track and which doesn't call `setup-env` (`actions/setup-node` v7.0.0 there vs v6.4.0 here, `pnpm/action-setup` v6.0.9 vs v6.0.8; `actions/cache` was uniformly v5.0.5 everywhere, simply a major behind upstream). The config moves to `directories: [/, /.github/actions/setup-env]` and the action is brought up to what its peers already carry: #480's bumps for `actions/cache` (5.0.5→6.1.0) and `pnpm/action-setup` (6.0.8→6.0.10), plus `actions/setup-node` v6.4.0→**v7.0.0** — a major for the action that provisions Node in every CI job, which #480 never proposed because `publish-npm.yml` was already on it (ESM migration, no config-surface change). Landed alongside it: the actions group (#480 — `labeler` 6.2.0→7.0.0 — whose step is now `continue-on-error` so a transient labeler API failure can't abort the job before the PR-title mirror runs, the contract housekeeping.yml's header already claimed and #481 disproved — `cache` + `cache/restore` 5.0.5→6.1.0, `upload-code-coverage` 1.4.1→1.4.2, `docker/login-action` 4.4.0→4.6.0, `attest-build-provenance` 4.1.1→4.2.2, `pnpm/action-setup` 6.0.9→6.0.10), the go group (#481 — `nats-server` 2.14.4→2.14.5, `nats.go` 1.52.0→1.53.1, `testify` 1.11.1→1.12.0, `testcontainers-go` 0.43.0→0.44.0), and four of the five npm bumps (#482 — `tsx` 4.23.5→4.23.12, `@astrojs/starlight` 0.41.6→0.41.7, `katex` 0.18.1→0.18.4, `@types/node` catalog ^26.1.2→^26.2.0). `typescript` is held at `^6.0.3`: `tsup` 8.5.1 vendors `rollup-plugin-dts` 6.1.1 into its own bundle, and that copy reaches for TS 5-era compiler internals and throws `Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')` the moment `dts: true` runs — inside `clients/ts`'s `prepare`, so inside `pnpm install`, so every Node job fails at once. `rollup-plugin-dts` >= 6.5.0 declares TS 7 support, making the unblock a `tsup` release that vendors it; until then `.github/dependabot.yml` ignores `version-update:semver-major` for `typescript`, tracked in #487. + - **BREAKING (API): every admin-gated endpoint now lives under one `/v1/ops/*` prefix** (`internal/api/router.go`, `internal/api/errors.go`, `clients/ts/src/{sql,policy,pipes,schema,dlq,table,cli/codegen}.ts`, docs throughout, plus tests in `internal/api`, `tests/integration`, `tests/e2e/sdk`, and the SDK): the admin surface was split across two shapes — the `/v1/admin/*` subtree (raw SQL, policy CRUD, pipes CRUD) plus three individually-gated top-level routes (`GET /v1/schema`, `POST /v1/schema/refresh`, `GET /v1/dlq/stats`) — so the path alone couldn't tell you what the `RequireAdmin` gate covered. All of them merge into a single `/v1/ops` subtree behind one tree-level gate: `/v1/admin/{query,policy,pipes…}` → `/v1/ops/{query,policy,pipes…}`, `/v1/schema[/refresh]` → `/v1/ops/schema[/refresh]`, `/v1/dlq/stats` → `/v1/ops/dlq/stats`. The gate itself is unchanged (`policy.AdminRole`, operator-key break-glass included). No aliases are kept for the old paths (pre-1.0; the SDK's path constants are updated in the same change, so its method surface — `wh.sql`, `wh.policy`, `wh.pipes`, `wh.schema`, `wh.dlq` — is unaffected). If you fenced `/v1/admin/` at your reverse proxy or ingress (deny rule, IP allowlist, internal-only listener), that rule silently stops matching after this rename — move it to `/v1/ops/` (see `docs/src/content/docs/reverse-proxy.mdx` §"Fencing the admin surface"). One observable log change: an authorization denial on the former top-level schema route now records the tree pattern `route:"/v1/ops/*"` (as `/v1/admin/*` denials always did) instead of the full route template — the `gate:"admin"` attribute already identifies the check. The docs pass riding along also closed accuracy gaps surfaced in review: `reverse-proxy.mdx`'s body-cap table is relabeled by body shape instead of a control/data-plane split that clashed with the ops naming, the `RequireAdmin` denial contract now reads 401-for-a-present-but-invalid-token vs 403-for-a-non-admin-role everywhere it's described (`api.md`, `architecture.md`, `sdk/queries.md`), and the `gh attestation verify` examples in `deployment.md` and `SECURITY.md` pin `--signer-workflow` to the workflow that publishes the artifact, since `--repo` alone accepts an attestation from any workflow in the repo. - **BREAKING (SDK): `PipeRef.fetch` no longer accepts a `limit` it silently ignored** (`clients/ts/src/pipes.ts`, `clients/ts/src/client.test.ts`, `docs/src/content/docs/sdk/pipes.md`, `docs/src/content/docs/sdk/reference.md`): closes #464, raised by CodeRabbit on #456. It took the same per-call options type as the query builder — which carries `limit` — but forwarded only `signal`, so `wh.pipe('top_pages').fetch({ limit: 10 })` type-checked, ran, and quietly returned whatever the pipe's SQL returned. `QueryBuilder.fetch` and `TableRef.fetch` both honour `limit`, so the inconsistency sat inside one shared type. There is nothing to forward: the endpoint binds the request body as the pipe's *parameters* (`internal/api/pipes.go` → `pipes.BindParams`), and a key the SQL doesn't declare is ignored, so a client-side row cap is not something the pipes surface offers. The parameter is now a dedicated `PipeRequestOptions` (exported) declaring `signal?: AbortSignal` and `limit?: never`, making the dead option a compile error rather than a silent no-op. `never` rather than simply omitting `limit`, because omitting it only rejects fresh object literals — TypeScript's excess-property check doesn't apply to a *variable*, so a shared `const opts: RequestOptions` carrying a limit would still have passed and still been dropped, which is the defect rather than a narrower version of it. Both cases are pinned by `@ts-expect-error` tests. **Note the collateral effect**, which is the half most consumers will actually meet: a value *declared* `RequestOptions` no longer assigns to a pipe `.fetch()` at all, even when it carries no limit at runtime, because the declared type permits one and assignability is decided on the type. Type a shared options object as `PipeRequestOptions` — the table and query-builder `.fetch()` accept it too, so it works everywhere — or inline `{ signal }` at the pipe call. Structural wrappers are unaffected: method parameters compare bivariantly, so an `interface Fetchable { fetch(opts?: RequestOptions): … }` is still satisfied by `PipeRef`. **Migration:** declare a `{{limit}}` parameter in the pipe's SQL and pass it as a pipe parameter — `wh.pipe(name, { limit })` — which is what the docs already showed. Pre-existing rather than introduced by #456, folded in there because that PR renames the type in question. @@ -47,6 +49,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Security +- **pnpm 11.1.3 → 11.21.0 across every declaration site, clearing fourteen published advisories (eight high, six medium)** (`package.json`, `.github/actions/setup-env/action.yml`, `.github/workflows/publish-npm.yml`, `docs/src/content/docs/development.md`, `README.md`, `AGENTS.md`, `pnpm-lock.yaml`): 11.1.3 sat below the `first_patched_version` of fourteen advisories in the 11.x line, the highest floor being [GHSA-qrv3-253h-g69c](https://github.com/advisories/GHSA-qrv3-253h-g69c) at 11.8.0. That is not theoretical here — `pnpm-workspace.yaml` sets `allowBuilds:` for `esbuild`, `sharp`, and `workerd`, so postinstall scripts do run in CI, and [GHSA-5wx6-mg75-v57r](https://github.com/advisories/GHSA-5wx6-mg75-v57r) is precisely "manifest identity spoof satisfies `allowBuilds` and runs attacker code". pnpm runs in every CI job via `setup-env` and in `publish-npm.yml`, the workflow that holds `id-token: write` for npm trusted publishing. 11.21.0 rather than the newer 11.22.0 because the repo's own `minimumReleaseAge: 10080` encodes a 7-day cooldown against compromised releases, 11.22.0 is three days old, and 11.21.0 clears every advisory just as completely. `lockfileVersion` stays at `9.0`: 11.21.0 reads and writes the existing format, so the regenerated lockfile carries no format migration. Closes #486. + - **Live SSE streams now apply a role's row-`filter` per subscriber, closing a query/stream row-level-security drift** (`internal/stream/hub.go`, `internal/stream/subscriber.go`, `internal/stream/metrics.go`, `internal/policy/policy.go`, `internal/policy/{rowfilter,canonical,numeric}.go` (new — predicate evaluation, operand rendering, and storage-domain comparison as three focused files), `internal/discovery/validation.go`, `internal/discovery/timestamp.go`, `internal/api/stream.go`, `cmd/wavehouse/main.go`, `docs/src/content/docs/access-control.mdx`, `docs/src/content/docs/architecture.md`, `docs/src/content/docs/api.md`, `docs/src/content/docs/sdk/streaming.md`, `AGENTS.md`, `SECURITY.md`, `internal/stream/doc.go`, plus tests in `internal/policy/rowfilter_test.go` (new), `tests/integration/rowfilter_narrowing_test.go` (new), `internal/policy/policy_test.go`, `internal/discovery/validation_test.go`, `internal/discovery/timestamp_test.go`, `internal/stream/hub_test.go`, `tests/e2e/sdk/streaming.test.ts`): closes #319. The SSE delivery path stripped denied columns but never applied a role's row-level `filter` predicate, so a subscriber received rows the structured-query path would have filtered out for that same role — a data-exposure on the streaming surface for any table that combines a row-policy with a shared or role-scoped stream (harmless on the public Stats table today, which carries no restrictive row-policy, but real for any private/PII table fronted by a stream). The row-filter is now resolved once into predicates that feed **both** read surfaces — the query path renders them to SQL, the stream evaluates them in memory (`ResolvedPermissions.RowVisible`, evaluated per subscriber against that subscriber's claims via the same `Evaluate` call the query path uses) — so the two can't drift (the row-level analogue of the shared `IsColumnAllowed` decision from #223). Because a row-filter resolves against each subscriber's JWT claims, the #294/#353 once-per-role projection is now claims-aware: a role **without** a filter keeps the pure once-per-role fast path unchanged (zero regression on the public stream), while a role **with** a filter keeps the shared column projection but delivers it only to the subscribers whose claims admit each row (evaluated against the full event, so a filter may key on a column the role can't select). The in-memory comparison is type-aware and **fails closed on anything it can't prove** (`policy.ColumnKind`, seeded from the schema registry): numeric columns (`Int*`/`UInt*`/`Float*`/`Decimal*`) compare in the column's **storage domain**, built on the same canonical machinery #457 landed for claims rather than a parallel stack: BOTH operands render to exact canonical decimal form (`CanonicalScalar`/`CanonicalNumericLiteral` — digit-bounded, so an over-long client-controlled operand is refused before any superlinear work; the hub decodes payloads with `UseNumber`, so 64-bit IDs keep exact digits whether string-encoded — the JS-precision-loss escape hatch — or bare, and big integers stay byte-faithful on the SSE wire) and a digit-string comparator (`compareCanonicalDecimals`) orders them — the former float64/`math/big` comparison stack is deleted. The operands are then narrowed the way ClickHouse narrows the stored value at insert AND the bound constant at compare (`policy.NumericSpec`, classified per column by `discovery.NumericStorageOf`): `Float32`/`Float64` round to the column's width, `Decimal` truncates at its scale, and integer columns are exact at any width, refusing fractional operands and non-plain constant spellings (`'1e3'` errors ClickHouse's integer cast per query, so the stream withholds to match; Float and Decimal casts accept every JSON-number spelling — verified — so those compare by value). Both operands are also **range-gated** per column (`Int*`/`UInt*` width bounds, the Decimal precision budget): ClickHouse's reading of an out-of-range constant was measured to vary on a single release between a query error (a negative bound on an unsigned column — the role reads no rows), a mathematical promotion (`'256'` against a `UInt8`), and a width-boundary wrap onto a *different* value than written (`'9223372036854775808'` against an `Int64` compares as −2^63, where exact-precision comparison would have admitted the −2^63 rows SQL hides under `_neq`) — so the stream refuses all of them rather than model any one behavior, an out-of-range payload was never storable regardless, and the differential oracle asserts strict parity for the error class plus the never-admit-where-SQL-hides direction for the promotion/wrap class. This closes the review-raised ordering fail-open where a pre-narrowing payload (`16777217` into a `Float32`) satisfied `_gt: "16777216"` on the stream while the stored row (`16777216`) failed it in SQL, and `tests/integration/rowfilter_narrowing_test.go` holds every stream verdict equal to a live ClickHouse's across column shapes × payloads × constants × operators — ClickHouse itself as the oracle, the same differential rigor as #402's timestamp grammar. An operand outside the JSON number grammar (`NaN`, any `Inf` spelling) or beyond the float domain's range withholds the row — `String` columns compare bytewise (exactly ClickHouse's String semantics, equality *and* ordering) — `DateTime`/`DateTime64` columns compare as **instants**, both operands read through the very grammar ingest canonicalization (#402) uses (`discovery.Column.TimeParser`: same spellings and zone rule, truncated to the column's precision, out-of-range instants that insert-time saturation would move refused), so a zone-less filter constant — the spelling query-path SQL wants — matches the canonical RFC 3339 payload the stream carries, time-window `_gt`/`_lt` policies work, and either operand the grammar can't read withholds the row — and every other type (`Enum`, `UUID`, `Date`/`Date32`, `Bool`, IPs, `FixedString`, …) — plus every column when no schema is available (an unknown table, or the boot-time discovery-failure window where the server serves while retrying) — trusts byte-equality only: `_eq`/`_in` admit exactly the event's own text rendering, while `_neq`/`_gt`/`_lt` withhold the row, because a byte difference can be pure representation and admitting on it would deliver rows the query path excludes (an uppercase UUID under `_neq`; `"9" > "100"` as text under `_gt`). The filter *constants* are claims-derived, so the same exactness holds on that side too: the auth middleware parses JWTs with `WithJSONNumber` and every bound constant routes through the shared `policy.CanonicalScalar` rule (both landed with the claim-template entry below — before them, a Snowflake-scale `tenant` claim rendered as `"1e+16"` and the stream *delivered the float64-equal neighbor tenant's rows* while withholding the subscriber's own), and this PR extends `CanonicalScalar` in depth for claims maps that never passed through that parser (a plain `json.Unmarshal` decodes numbers as float64): a float64 at or past 2^53 is refused outright — the predicate then matches **no** rows on either surface (`1 = 0` in SQL, unconditionally false in memory), the same two-surface verdict an unresolvable claim gets — and smaller floats render positionally (`"1000000"`, never the `"1e+06"` spelling ClickHouse integer columns reject with a type error). Ambiguity therefore always costs availability (a row withheld), never confidentiality — a guarantee about the ingested payload the stream evaluates, whose one residual payload-vs-stored asymmetry — an event whose insert later fails outright (out-of-range value, batch error → DLQ) after it was already streamed — is documented in the enforcement caution — and each withhold is observable via the new `wavehouse_sse_rows_withheld_total` counter (labeled by table and role, on the live and replay paths alike), separating "no matching rows" from "a fail-closed filter is withholding everything". Subscriber claims are fixed at construction (a `stream.NewSubscriber` argument — no setter), so the fan-out's unsynchronized claims read is race-free structurally, with a dedicated `-race` test driving concurrent row-filtered broadcasts. Replay (gap-fill) applies the same per-connection row check via `Hub.ReplayProjector`, which now holds one policy snapshot for the whole gap-fill (one store read per replay instead of one per replayed event; a policy reload landing mid-replay applies from the first live event) and caches the per-table column-kind lookup across the replay loop. **Perf note:** on a topic whose role carries a row-filter, part of the #294/#353 once-per-role fan-out gain is traded back for correctness — `policy.Evaluate` runs per subscriber per event there (the column projection stays shared; roles without a filter are unaffected); #435 tracks memoizing it, and `BenchmarkBroadcast_RowFilteredFanout` exists to measure it. The resource limits (`max_rows`, `max_execution_time`, …) remain a query-path property and are still **not** applied to the stream (a separate, documented boundary). Supersedes the "stream path applies no row-level filter" invariant originally noted in the #294/#353 Changed entry (under **Changed** in this same block, which now points back here). - **Row-filter claim templates now fail closed on every operator when the token doesn't carry the claim** (`internal/policy/policy.go`, `internal/policy/policy_test.go`, `internal/query/builder.go`, `internal/query/builder_test.go`, `internal/api/structured_query.go`, `internal/api/structured_query_test.go`, `internal/api/ingest.go`, `internal/api/ingest_test.go`, `internal/auth/auth.go`, `internal/auth/auth_test.go`, `internal/stream/hub_test.go`, `docs/src/content/docs/{access-control.mdx,configuration.mdx,deployment.md,pipes.mdx,architecture.md,api.md}`): closes [#385](https://github.com/Wave-RF/WaveHouse/issues/385) — the remaining fail-open half of the class [#224](https://github.com/Wave-RF/WaveHouse/issues/224) opened — and [#322](https://github.com/Wave-RF/WaveHouse/issues/322). An unresolvable `{{ jwt.* }}` template in a `filter` rendered as the empty string and still bound a real predicate for `_eq`/`_neq`/`_gt`/`_lt` — so a validly-signed token missing the claim (mixed IdP audiences, service tokens) got `WHERE tenant_id = ''` (leaking every empty-valued row), and `_neq`/`_gt` on a string column (`col != ''` / `col > ''`) matched essentially all rows, erasing the restriction entirely. Only a bare-claim `_in` failed closed. Now any filter template containing an unresolvable claim path emits the same constant-false predicate `_in` already used (`1 = 0`): on the structured-query path (`POST /v1/query`) the role sees no rows, matching what `access-control.mdx` promised all along (the SSE stream applies the same fail-closed rule per subscriber — see the row-`filter` entry above ([#381](https://github.com/Wave-RF/WaveHouse/pull/381)) — and named pipes authorize by role, not row filter). A template-free literal value — including an explicit `""` — still binds exactly as written, and an `_in` template with surrounding text joins the fail-closed path too (previously it bound the partial literal). A claim that resolves to a JSON **object or array** — usually a dropped path segment, `{{ jwt.app_metadata }}` where `{{ jwt.app_metadata.tenant_id }}` was meant — now also fails closed instead of binding its `map[…]`/`[…]` stringification (the bare-claim `_in` array keeps its multi-tenant semantics, and its **elements** now follow the same rule: one object, null, or nested-array element fails the whole set closed rather than binding a `map[…]`/`` rendering no row legitimately carries), and the JWT parser now decodes numeric claims as `json.Number` (`jwt.WithJSONNumber`), so a numeric id above 2^53 binds digit-exact instead of float64-rounding to a neighboring value. Every bound value flows through one rule, `policy.CanonicalScalar`, which also renders numeric claims in **canonical decimal form** rather than the token's spelling — `1.0`/`1e3` bind as `1`/`1000`, because the literal spelling raises a per-query `TYPE_MISMATCH` against a numeric ClickHouse column. The canonical form is **exact** at every width and precision — integers via big-int, fractions and exponents by digit-string arithmetic, never a float64 round-trip, so `0.1000000000000000000001` keeps every digit and `1e-400` fails closed instead of collapsing to `0` — while a magnitude only JSON can hold (`1e400`, `1e-400`) or a literal (or exact form) past 100 digits fails closed (the exact paths are length-bounded up front — big-int cost is superlinear in digit count and the ingest check path hands it client-controlled literals, so an unbounded literal was a single-request CPU sink) — and the insert-`check` comparison canonicalizes its payload side through the same function, so a numeric insert value matches a numeric claim by value, not by spelling. One deliberate JWT-validation shift rides along with `json.Number` decoding: a literal `exp: 0`, which float64 decoding special-cased as never-expiring, now reads as the epoch, so such tokens are rejected as expired and fall back to the roleless `default_role` like any invalid token. Breaking only for deployments that relied on the fail-open: a role whose token lacks a templated claim now reads nothing instead of *more* than intended. Insert-`check` `_eq` semantics are unchanged — the template still renders (unresolvable placeholder → empty string, surrounding literal text kept) and that rendered value is auto-injected (the required-value question is [#463](https://github.com/Wave-RF/WaveHouse/issues/463)) — but a `check: _in` template with surrounding text and an unresolvable claim now resolves to the empty set (every insert to that column rejected) instead of requiring membership in the partial literal, since the `_in` resolver is shared with the filter path. This PR also closes two adjacent fail-open paths in the same class surfaced in review: a claim template whose path is outside the `{{ jwt. }}` grammar (a hyphen, or a namespaced OIDC URL) is now **rejected when the policy is written** rather than bound as literal `{{…}}` text — a read leak for `_neq`/`_lt` and silent write corruption for `check`. That boundary is asymmetric for a running deployment: a bootstrap policy file carrying such a template makes the server **refuse to start** when the store is seeded from it (a populated KV store skips the file), an admin `PUT` on `/v1/ops/policy` (or a `POST` to its `validate` sibling) returns `400`, and a policy already stored in KV is *not* re-validated when a node loads it ([#461](https://github.com/Wave-RF/WaveHouse/issues/461)) — re-`PUT` it once after upgrading. And the row-filter predicate plus the role's `max_rows` cap are now emitted by `Build` itself, as part of the WHERE/LIMIT assembly it already does (the #322 half of this PR): splicing them into rendered SQL afterward let a crafted aggregation alias or `ORDER BY` alias-reference swallow the `WHERE` splice and delete the row filter — valid SQL returning the whole table, reachable precisely when a filter failed closed — and `ApplyMaxRows`'s uppercase-then-index offset drifted on length-changing runes (a column named `ıı`), silently dropping the cap. `InjectPermissionFilters`, `ApplyMaxRows`, and `findInsertPoint` are deleted, and no interim clause-keyword alias guard ships (one existed only between commits of this PR): a keyword-bearing alias (`Total order by region`) stays a legal identifier, contained by backtick quoting. One more member of that case-folding family: the aggregation-function allowlist is now **ASCII-exact** — `strings.ToLower` folds `İ` (U+0130) to `i`, so an aggregation named `mİn` passed the allowlist and reached ClickHouse verbatim as an unknown function, a per-query `500` where the builder's `400` belongs. Canonicalization is symmetric end to end: the insert-`check` comparison runs its **required side** through `CanonicalScalar` as well as the payload side, and a `check` value with **no placeholder** — which carries no JSON type — additionally matches by its numeric reading at compare time (a static `_eq: "1.0"` accepts an inserted `1.0` and an inserted `"1.0"` alike; without that reading the canonical payload side rejects every numeric insert the check was written to allow) while still binding and auto-injecting exactly as written, so read filters never move (`_neq: "1.0"` on a `String` version column keeps excluding exactly `'1.0'`). The second reading is gated **by type** (`policy.LiteralValue`, which `Evaluate` reserves for placeholder-free values), so a claim-derived value keeps strict canonical equality — a string-typed claim of `"1e3"` never accepts an inserted `1000`. The 100-digit literal bound counts **digits, not bytes** — sign, decimal point, and exponent marker ride free, so `-1e99` and its 101-byte written-out form both bind (the exact-form gate leaves two characters of slack past the bound, so a borderline exponent spelling like `1e101` can resolve where its written-out digits could not — the literal-side gate is the stricter of the two). The exact-form bound is **stricter than the old float64 path for wide magnitudes**: values like `1e150` or `1e-150`, whose exact decimal expansions exceed 100 digits, previously resolved (rounded) and now fail closed — on a read filter the role sees no rows; on an insert `check` the claim routes to the #463 auto-inject path, where an integer or `Decimal` column coerces the stamped `''` to `0`. **Upgrade note (data migration):** a pre-upgrade build auto-injected numeric claims above 2^53 in float64-rounded form, so rows it stamped carry a neighboring value of the true id (Snowflake-scale ids, ~1.7e18, are wide enough); the exact filter binds the true value, so those rows don't become wrong after upgrading — they become silently **unreachable** through the writer's own row filter. Before relying on the new filter, reconcile such rows (e.g. `ALTER TABLE … UPDATE` the scoped column from the rounded value to the exact claim value) — rounded and exact ids differ only above 2^53. - **A `?token=` query credential is now stripped from the request URL whichever credential wins, not only when it is the one used** (`internal/auth/auth.go`, `internal/auth/auth_test.go`, `docs/src/content/docs/api.md`, `docs/src/content/docs/reverse-proxy.mdx`, `docs/src/content/docs/sdk/index.mdx`): raised by CodeRabbit on [#448](https://github.com/Wave-RF/WaveHouse/pull/448). `bearerToken` returned from the `Authorization: Bearer` branch *before* the strip, so a request presenting both credentials — which any caller can do — left the unused JWT sitting in `r.URL` for the rest of the request's life. The operator-key path had the same shape one frame up, returning before `bearerToken` ran at all, so the strip is now resolved ahead of that branch too. Not an active leak today (WaveHouse's own request logging only ever records `r.URL.Path`, and the OTel HTTP instrumentation records no query attribute), so this is defense in depth rather than a fix for an observed exposure — but it closed an inconsistency in an invariant the code already asserted on the query-only path, where any later handler or future logging change would have turned it into one. The strip now runs once, before either credential path returns; header precedence is unchanged, unrelated query parameters survive, and both cases are pinned by tests. The docs correspondingly drop the "the header path leaves the query parameter untouched" caveat that described the old behavior. diff --git a/README.md b/README.md index 966bc683..1474468f 100644 --- a/README.md +++ b/README.md @@ -121,7 +121,7 @@ Track what's shipped, in progress, and planned on the [**project board**](https: ## 💻 Local Development -You'll need **Go 1.26+, GNU Make 4+, Docker (Compose v2), Node.js 22 LTS, and pnpm 11+**. See [development docs](https://wavehouse.dev/development) for the authoritative source of truth with the full list, version requirements, and gotchas. +You'll need **Go 1.26+, GNU Make 4+, Docker (Compose v2), Node.js 22 LTS, and pnpm 11.21+**. See [development docs](https://wavehouse.dev/development) for the authoritative source of truth with the full list, version requirements, and gotchas. ```bash make tools # one-time bootstrap diff --git a/clients/ts/package.json b/clients/ts/package.json index b11bbd13..857d8f58 100644 --- a/clients/ts/package.json +++ b/clients/ts/package.json @@ -44,7 +44,7 @@ "@types/node": "catalog:", "@vitest/coverage-v8": "^4.1.10", "tsup": "^8.0.0", - "tsx": "^4.22.4", + "tsx": "^4.23.12", "typescript": "catalog:", "vitest": "catalog:" }, diff --git a/docs/package.json b/docs/package.json index 345636e5..5fcd2a45 100644 --- a/docs/package.json +++ b/docs/package.json @@ -13,7 +13,7 @@ }, "dependencies": { "@astrojs/check": "^0.9.10", - "@astrojs/starlight": "^0.41.6", + "@astrojs/starlight": "^0.41.7", "@astrojs/starlight-tailwind": "^5.0.0", "@fontsource-variable/inter": "^5.3.0", "@fontsource-variable/jetbrains-mono": "^5.3.0", @@ -24,7 +24,7 @@ "@wavehouse/sdk": "workspace:*", "astro": "^7.1.1", "astro-vtbot": "^3.0.1", - "katex": "^0.18.1", + "katex": "^0.18.4", "rehype-katex": "^7.0.1", "rehype-mermaid": "^3.0.0", "remark-math": "^6.0.0", diff --git a/docs/src/content/docs/development.md b/docs/src/content/docs/development.md index c5aa9d21..b6d7f7a8 100644 --- a/docs/src/content/docs/development.md +++ b/docs/src/content/docs/development.md @@ -18,7 +18,7 @@ You need these on your `PATH` before any `make` recipe will work end-to-end: | **bash** | 4+ recommended | Recipes are pinned to `bash`; the helper scripts under `scripts/` use `set -euo pipefail` and bash arrays | macOS default is bash 3.2 (works for current recipes, but `brew install bash` is safer); Linux distros ship 4+ | | **Docker** *(or Podman)* | Engine 20.10+ with the Compose **v2** plugin (`docker compose`, no hyphen) | Compose stacks under `deployments/compose/`; the E2E and integration suites boot ClickHouse via testcontainers (no compose file) | [Docker Desktop](https://docs.docker.com/get-docker/), [colima](https://github.com/abiosoft/colima), or [Podman](https://podman.io) with `podman-compose` / the `podman compose` plugin. The testcontainers Go library also honors `DOCKER_HOST` for rootless Podman setups | | **Node.js** | 22 LTS — pinned via `.nvmrc` at the repo root | Runtime for pnpm and the Vitest suites. Pinned to match CI (`setup-node` uses 22) and to avoid Node-major surprises; older Vitest versions in this repo were known to crash on Node 26 with a V8 heap-allocation abort | [nodejs.org](https://nodejs.org/) or `nvm use` / `fnm use` / `volta` (all read `.nvmrc`) | -| **pnpm** | 11.1+ (pinned via `packageManager` in the root `package.json`) | Package manager for the TypeScript SDK, E2E test harness, and docs site (managed as a single pnpm workspace from the repo root); `make build-ts`, `make test-ts`, `make test-e2e`, `make build-docs`, `make dev-docs`, `make preview-docs` all shell out to `pnpm` | `corepack enable && corepack prepare pnpm@11.1.3 --activate` (recommended), or `npm i -g pnpm` | +| **pnpm** | 11.21+ (pinned via `packageManager` in the root `package.json`) | Package manager for the TypeScript SDK, E2E test harness, and docs site (managed as a single pnpm workspace from the repo root); `make build-ts`, `make test-ts`, `make test-e2e`, `make build-docs`, `make dev-docs`, `make preview-docs` all shell out to `pnpm` | `corepack enable && corepack prepare pnpm@11.21.0 --activate` (recommended), or `npm i -g pnpm` | | **git** + **curl** | any recent | `git` for source + version metadata in builds; `curl` is used by the Makefile to fetch the pinned `golangci-lint` binary into `.bin/` | usually preinstalled | ### Auto-installed by `make tools` @@ -37,7 +37,7 @@ go version # go1.26+ make --version # GNU Make 4.x docker compose version node --version # v22.x (matches .nvmrc and CI) -pnpm --version # 11.1+ +pnpm --version # 11.21+ ``` If any of those are wrong/missing, the Makefile recipes will fail with confusing errors (e.g. `--output-sync` is unrecognized on Make 3.81; `pnpm: command not found` on `make test-ts`). @@ -556,11 +556,26 @@ For a combined security scan, run `make verify` — it runs `vulncheck` alongsid Dependabot is configured in `.github/dependabot.yml` to open weekly grouped PRs for three update configs: - **Go modules** (root) — outdated or vulnerable Go dependencies, commit prefix `deps:` -- **GitHub Actions** (root) — outdated action versions tracked against the SHA pins in `ci.yml` / `release.yml`, commit prefix `ci:` +- **GitHub Actions** (root **and** `/.github/actions/setup-env`) — outdated action versions tracked against the SHA pins across `.github/workflows/*` and the `setup-env` composite action, commit prefix `ci:` - **npm — pnpm workspace** (root) — covers all three TypeScript packages (the docs site, the SDK, and the E2E tests) in one grouped PR, commit prefix `deps:` PRs are grouped per config to reduce noise. The npm config is pointed at the workspace **root** (`directory: /`), not the individual member directories. The repo has a single root `pnpm-lock.yaml`, and Dependabot only updates a lockfile co-located with the manifest it targets — so a per-member config (the previous setup) bumped a member's `package.json` without regenerating the root lockfile, and every such PR then failed CI's `pnpm install --frozen-lockfile` with `ERR_PNPM_OUTDATED_LOCKFILE`. Pointing at the root lets Dependabot read `pnpm-workspace.yaml`, walk every member, and update the one lockfile. +The GitHub Actions config names **two** directories. `directory: /` reaches +`.github/workflows/` but does not descend into `.github/actions/*/action.yml`, +so the `setup-env` composite action — which owns every cache in CI — was +invisible to Dependabot, and its pins went stale against upstream and diverged +from `publish-npm.yml`, which Dependabot *does* track and which doesn't call +`setup-env`. Listing its directory under `directories:` brings it into the same +weekly group; **adding a composite action means adding its directory there**, +because nothing else catches the drift. + +`typescript` majors are held back (`ignore: version-update:semver-major`) +because `tsup` vendors a `rollup-plugin-dts` that crashes on TypeScript 7 +during `clients/ts`'s `prepare` script — i.e. inside `pnpm install`, which +takes every Node job down at once. See the comment in `.github/dependabot.yml` +for the condition that lets it be removed. + **No auto-merge.** Dependabot PRs go through the same merge gate as any other PR — an approval from the `@Wave-RF/wavehouse-admins` team (the ruleset's `required_reviewers` rule) plus the required checks. (The former `dependabot-automerge.yml`, which auto-approved and merged patch/minor bumps hands-off, was removed — every bump now gets a human admin review.) ## Releasing the SDK diff --git a/go.mod b/go.mod index 9cfe6851..0858660a 100644 --- a/go.mod +++ b/go.mod @@ -24,13 +24,13 @@ require ( github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/uuid v1.6.0 github.com/ilyakaznacheev/cleanenv v1.5.0 - github.com/nats-io/nats-server/v2 v2.14.4 - github.com/nats-io/nats.go v1.52.0 + github.com/nats-io/nats-server/v2 v2.14.5 + github.com/nats-io/nats.go v1.53.1 github.com/prometheus/client_golang v1.24.1 github.com/samber/slog-multi v1.8.0 github.com/samber/slog-sampling v1.6.0 - github.com/stretchr/testify v1.11.1 - github.com/testcontainers/testcontainers-go v0.43.0 + github.com/stretchr/testify v1.12.0 + github.com/testcontainers/testcontainers-go v0.44.0 go.opentelemetry.io/contrib/bridges/otelslog v0.20.0 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 go.opentelemetry.io/contrib/instrumentation/runtime v0.70.0 @@ -131,7 +131,7 @@ require ( github.com/jedib0t/go-pretty/v6 v6.7.10 // indirect github.com/jmespath/go-jmespath v0.4.0 // indirect github.com/joho/godotenv v1.5.1 // indirect - github.com/klauspost/compress v1.19.1 // indirect + github.com/klauspost/compress v1.19.2 // indirect github.com/knadh/profiler v0.2.0 // indirect github.com/kr/pretty v0.3.1 // indirect github.com/kr/text v0.2.0 // indirect @@ -149,7 +149,7 @@ require ( github.com/moby/moby/api v1.55.0 // indirect github.com/moby/moby/client v0.5.1 // indirect github.com/moby/patternmatcher v0.6.1 // indirect - github.com/moby/sys/sequential v0.6.0 // indirect + github.com/moby/sys/sequential v0.7.0 // indirect github.com/moby/sys/user v0.4.0 // indirect github.com/moby/sys/userns v0.1.0 // indirect github.com/moby/term v0.5.2 // indirect @@ -170,7 +170,6 @@ require ( github.com/pierrec/lz4/v4 v4.1.27 // indirect github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect github.com/pkg/errors v0.9.1 // indirect - github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect github.com/prometheus/client_model v0.6.2 // indirect github.com/prometheus/common v0.70.1 // indirect @@ -183,7 +182,7 @@ require ( github.com/samber/lo v1.53.0 // indirect github.com/samber/slog-common v0.21.0 // indirect github.com/segmentio/asm v1.2.1 // indirect - github.com/shirou/gopsutil/v4 v4.26.5 // indirect + github.com/shirou/gopsutil/v4 v4.26.6 // indirect github.com/shopspring/decimal v1.4.0 // indirect github.com/sirupsen/logrus v1.9.4 // indirect github.com/tklauser/go-sysconf v0.4.0 // indirect @@ -194,17 +193,17 @@ require ( go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect golang.org/x/arch v0.26.0 // indirect - golang.org/x/crypto v0.54.0 // indirect + golang.org/x/crypto v0.55.0 // indirect golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa // indirect golang.org/x/image v0.41.0 // indirect - golang.org/x/mod v0.37.0 // indirect + golang.org/x/mod v0.38.0 // indirect golang.org/x/net v0.57.0 // indirect golang.org/x/sys v0.47.0 // indirect - golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57 // indirect + golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 // indirect golang.org/x/term v0.45.0 // indirect - golang.org/x/text v0.40.0 // indirect + golang.org/x/text v0.41.0 // indirect golang.org/x/time v0.15.0 // indirect - golang.org/x/tools v0.47.0 // indirect + golang.org/x/tools v0.48.0 // indirect golang.org/x/vuln v1.3.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect diff --git a/go.sum b/go.sum index 9ffc7165..7b30c17c 100644 --- a/go.sum +++ b/go.sum @@ -215,8 +215,8 @@ github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0= github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk= -github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8= +github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/knadh/profiler v0.2.0 h1:jaY0xlQs8iaWxKdvGHOftaZnX7d8l7yrCGQPSecwnng= github.com/knadh/profiler v0.2.0/go.mod h1:LqNkAu++MfFkbEDA63AmRaIf6UkGrLXyZ5VQQdekZiI= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= @@ -254,8 +254,8 @@ github.com/moby/moby/client v0.5.1 h1:tYNaJno4c0HXz12y5BiqEDy0rVTYkWzI26lGvnTMiJ github.com/moby/moby/client v0.5.1/go.mod h1:odLstlZ6uSnfvAgVxMpvgmb8SUdd+siH2T0GBuxVAlM= github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U= github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc= -github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU= -github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko= +github.com/moby/sys/sequential v0.7.0 h1:ASQNGNROJSuOO6LL6bPHbKvuZu6NU8P4ldPWk31zj/8= +github.com/moby/sys/sequential v0.7.0/go.mod h1:NfSTAp6V3fw4tmkD62PEcOKeZKquXT8VKCkf7aVR79o= github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs= github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs= github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g= @@ -276,10 +276,10 @@ github.com/narqo/go-badge v0.0.0-20230821190521-c9a75c019a59 h1:kbREB9muGo4sHLoZ github.com/narqo/go-badge v0.0.0-20230821190521-c9a75c019a59/go.mod h1:m9BzkaxwU4IfPQi9ko23cmuFltayFe8iS0dlRlnEWiM= github.com/nats-io/jwt/v2 v2.8.2 h1:XXRgB60MSTnqsRwejQurVDs/hcv2dkt+86GjI+I/bMc= github.com/nats-io/jwt/v2 v2.8.2/go.mod h1:Ag/56sq9OblL4JgdYufDd16Egb17Kr/8WwwuO/forVc= -github.com/nats-io/nats-server/v2 v2.14.4 h1:efgjZ8cdExAKRuqSg8UPJFprb+l7NlBtSDPhDlw3rO4= -github.com/nats-io/nats-server/v2 v2.14.4/go.mod h1:BltdpOYestjbtQSnVO2zGHdg5SGBZjt+GYTgB9LZq/I= -github.com/nats-io/nats.go v1.52.0 h1:n3avV4VBsCgsdwh71TppsTwtv+QdPs7ntSKM8qJLGsc= -github.com/nats-io/nats.go v1.52.0/go.mod h1:26HypzazeOkyO3/mqd1zZd53STJN0EjCYF9Uy2ZOBno= +github.com/nats-io/nats-server/v2 v2.14.5 h1:M6yeo/Xb7khi97RSEVELof3DForDqmYza3P4tHCPFWw= +github.com/nats-io/nats-server/v2 v2.14.5/go.mod h1:1D3iocrisKvWaD1B/imqarTqmaGrWMqALMLbEDo3v7Q= +github.com/nats-io/nats.go v1.53.1 h1:Otsq3uLc/kLdjmkNHkXH0jBqwUquwdKFoe3fq6/3/Xo= +github.com/nats-io/nats.go v1.53.1/go.mod h1:26HypzazeOkyO3/mqd1zZd53STJN0EjCYF9Uy2ZOBno= github.com/nats-io/nkeys v0.4.16 h1:rd5oAuLOb8mnAycB0xleuEBNS1pVVnN0fv/FF34Eypg= github.com/nats-io/nkeys v0.4.16/go.mod h1:llLgWoI0o4z/Q57q2R1kHfmocyhGV6VG/U18Glg1Afs= github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw= @@ -343,8 +343,8 @@ github.com/segmentio/asm v1.2.1 h1:DTNbBqs57ioxAD4PrArqftgypG4/qNpXoJx8TVXxPR0= github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs= github.com/shabbyrobe/gocovmerge v0.0.0-20190829150210-3e036491d500 h1:WnNuhiq+FOY3jNj6JXFT+eLN3CQ/oPIsDPRanvwsmbI= github.com/shabbyrobe/gocovmerge v0.0.0-20190829150210-3e036491d500/go.mod h1:+njLrG5wSeoG4Ds61rFgEzKvenR2UHbjMoDHsczxly0= -github.com/shirou/gopsutil/v4 v4.26.5 h1:RPcBXkpz7kOj9PqGFQOlBPZHsyaPvPVQc098y9RmCNM= -github.com/shirou/gopsutil/v4 v4.26.5/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ= +github.com/shirou/gopsutil/v4 v4.26.6 h1:Mzr/npDtQC/xpeEuQKHZt8Zo9CmPvhTj8nkR8w5TLDs= +github.com/shirou/gopsutil/v4 v4.26.6/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ= github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k= github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME= github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w= @@ -353,10 +353,10 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+ github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -github.com/testcontainers/testcontainers-go v0.43.0 h1:oEQx5MW2DGd9z3AeEQfB2lPM0eLs7ztyaGRu75bFo5A= -github.com/testcontainers/testcontainers-go v0.43.0/go.mod h1:+VxkT2NQnKOZPKi6praMuMKYHYyOGXr0XSBSlSMCzFo= +github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI= +github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw= +github.com/testcontainers/testcontainers-go v0.44.0 h1:/Fwh6HY1mIikhnm9e7HwoxGycx0lzRAE0f5VQpjFxzI= +github.com/testcontainers/testcontainers-go v0.44.0/go.mod h1:IcnwQrYTO86xHXu5bvMaBH7ATlbS3Qn1M1QWW3c66rE= github.com/tklauser/go-sysconf v0.4.0 h1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU= github.com/tklauser/go-sysconf v0.4.0/go.mod h1:8mTNWyog7H+MpKijp4VmKJAd2bbYQ2zuUwkYRbUArPI= github.com/tklauser/numcpus v0.12.0 h1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4= @@ -418,16 +418,16 @@ golang.org/x/arch v0.26.0/go.mod h1:0X+GdSIP+kL5wPmpK7sdkEVTt2XoYP0cSjQSbZBwOi8= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= -golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa h1:Zt3DZoOFFYkKhDT3v7Lm9FDMEV06GpzjG2jrqW+QTE0= golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA= golang.org/x/image v0.41.0 h1:8wS72eGJMJaBxK6okTzd4WaXumUlTVlb753MlsSvTCo= golang.org/x/image v0.41.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= +golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= +golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= @@ -451,22 +451,22 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57 h1:nwGZBCt+FnXUrGsj5vjzAsEmkcaFvd82BbOjECiFYZc= -golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57/go.mod h1:3AWMyWHS+caVoiEXpiq6+tzKA40J4vQT3MYr80ZtQpc= +golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 h1:RJhm5l6Fo4rmEIcndxDllNhhf/fAx8qIm4t6A7vpm2A= +golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959/go.mod h1:LV7u5Oco+Z/g6XI7PqN+EUUUGGkEcmB1uj2ceI0fOVg= golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= -golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM= golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY= golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM= diff --git a/package.json b/package.json index f3b2fac9..d588f12a 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,7 @@ "name": "wavehouse-monorepo", "private": true, "type": "module", - "packageManager": "pnpm@11.1.3", + "packageManager": "pnpm@11.21.0", "engines": { "node": ">=22" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 36e1a6b4..ea6d7596 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,8 +7,8 @@ settings: catalogs: default: '@types/node': - specifier: ^26.1.2 - version: 26.1.2 + specifier: ^26.2.0 + version: 26.2.0 typescript: specifier: ^6.0.3 version: 6.0.3 @@ -25,31 +25,31 @@ importers: version: 2.5.6 markdownlint-cli2: specifier: ^0.23.2 - version: 0.23.2 + version: 0.23.2(supports-color@10.2.2) nyc: specifier: ^18.0.0 - version: 18.0.0 + version: 18.0.0(supports-color@10.2.2) clients/ts: devDependencies: '@types/node': specifier: 'catalog:' - version: 26.1.2 + version: 26.2.0 '@vitest/coverage-v8': specifier: ^4.1.10 version: 4.1.10(vitest@4.1.10) tsup: specifier: ^8.0.0 - version: 8.5.1(jiti@2.7.0)(postcss@8.5.25)(tsx@4.23.5)(typescript@6.0.3)(yaml@2.9.0) + version: 8.5.1(jiti@2.7.0)(postcss@8.5.25)(supports-color@10.2.2)(tsx@4.23.12)(typescript@6.0.3)(yaml@2.9.0) tsx: - specifier: ^4.22.4 - version: 4.23.5 + specifier: ^4.23.12 + version: 4.23.12 typescript: specifier: 'catalog:' version: 6.0.3 vitest: specifier: 'catalog:' - version: 4.1.10(@types/node@26.1.2)(@vitest/coverage-v8@4.1.10)(vite@8.2.0(@types/node@26.1.2)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0)) + version: 4.1.10(@types/node@26.2.0)(@vitest/coverage-v8@4.1.10)(vite@8.2.0(@types/node@26.2.0)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0)) docs: dependencies: @@ -57,11 +57,11 @@ importers: specifier: ^0.9.10 version: 0.9.10(prettier@3.9.6)(typescript@6.0.3) '@astrojs/starlight': - specifier: ^0.41.6 - version: 0.41.6(@astrojs/markdown-remark@7.2.2)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(typescript@6.0.3) + specifier: ^0.41.7 + version: 0.41.7(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3) '@astrojs/starlight-tailwind': specifier: ^5.0.0 - version: 5.0.0(@astrojs/starlight@0.41.6(@astrojs/markdown-remark@7.2.2)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(typescript@6.0.3))(tailwindcss@4.3.3) + version: 5.0.0(@astrojs/starlight@0.41.7(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3))(tailwindcss@4.3.3) '@fontsource-variable/inter': specifier: ^5.3.0 version: 5.3.0 @@ -70,28 +70,28 @@ importers: version: 5.3.0 '@tailwindcss/vite': specifier: ^4.3.3 - version: 4.3.3(vite@8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0)) + version: 4.3.3(vite@8.2.0(@types/node@26.2.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0)) '@wave-rf/astro-themed-mermaid': specifier: ^0.3.1 - version: 0.3.1(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(rehype-mermaid@3.0.0(playwright@1.62.1)) + version: 0.3.1(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(rehype-mermaid@3.0.0(playwright@1.62.1)) '@wave-rf/cloudflare-md-router': specifier: ^0.2.1 version: 0.2.1(@cloudflare/workers-types@4.20260702.1) '@wave-rf/starlight-llm-tools': specifier: ^0.3.1 - version: 0.3.1(@astrojs/starlight@0.41.6(@astrojs/markdown-remark@7.2.2)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(typescript@6.0.3))(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0)) + version: 0.3.1(@astrojs/starlight@0.41.7(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0)) '@wavehouse/sdk': specifier: workspace:* version: link:../clients/ts astro: specifier: ^7.1.1 - version: 7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0) + version: 7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0) astro-vtbot: specifier: ^3.0.1 version: 3.0.1 katex: - specifier: ^0.18.1 - version: 0.18.1 + specifier: ^0.18.4 + version: 0.18.4 rehype-katex: specifier: ^7.0.1 version: 7.0.1 @@ -100,16 +100,16 @@ importers: version: 3.0.0(playwright@1.62.1) remark-math: specifier: ^6.0.0 - version: 6.0.0 + version: 6.0.0(supports-color@10.2.2) sharp: specifier: ^0.35.3 - version: 0.35.3(@types/node@26.1.2) + version: 0.35.3(@types/node@26.2.0) starlight-image-zoom: specifier: ^0.15.0 - version: 0.15.0(@astrojs/starlight@0.41.6(@astrojs/markdown-remark@7.2.2)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(typescript@6.0.3)) + version: 0.15.0(@astrojs/starlight@0.41.7(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3))(supports-color@10.2.2) starlight-links-validator: specifier: ^0.25.2 - version: 0.25.2(@astrojs/starlight@0.41.6(@astrojs/markdown-remark@7.2.2)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(typescript@6.0.3))(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0)) + version: 0.25.2(@astrojs/starlight@0.41.7(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2) tailwindcss: specifier: ^4.3.3 version: 4.3.3 @@ -135,7 +135,7 @@ importers: devDependencies: '@types/node': specifier: 'catalog:' - version: 26.1.2 + version: 26.2.0 '@vitest/coverage-v8': specifier: ^4.1.10 version: 4.1.10(vitest@4.1.10) @@ -147,7 +147,7 @@ importers: version: 6.0.3 vitest: specifier: 'catalog:' - version: 4.1.10(@types/node@26.1.2)(@vitest/coverage-v8@4.1.10)(vite@8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0)) + version: 4.1.10(@types/node@26.2.0)(@vitest/coverage-v8@4.1.10)(vite@8.2.0(@types/node@26.2.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0)) packages: @@ -272,8 +272,8 @@ packages: '@astrojs/starlight': '>=0.38.0' tailwindcss: ^4.0.0 - '@astrojs/starlight@0.41.6': - resolution: {integrity: sha512-Dt0/wY2JbFGUpxMgclw1j2Iqks2GG0LHYKgP7TfBXsFrs4LIbKvQ596lzyhXLz6nFcnPdIB9ZRFyDJeuVcx3Ug==} + '@astrojs/starlight@0.41.7': + resolution: {integrity: sha512-579VJuZgo20UpNQPm9EIez5W3DFSrD16uiV2YX6rUlpLtjgKSdnc69TxVTZXn4AtI2B731TI2qhW1O3K+vwtrQ==} peerDependencies: '@astrojs/markdown-remark': ^7.2.0 astro: ^7.0.2 @@ -1862,6 +1862,9 @@ packages: '@types/node@26.1.2': resolution: {integrity: sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg==} + '@types/node@26.2.0': + resolution: {integrity: sha512-5IviulTZeRNp2vAJ514cc/HUlY5nZ9fCbq9DMyC52BrhFZACo3nI0R7qBxhQmo/d27NFe96ur/b7Wwxklda+kg==} + '@types/picomatch@4.0.3': resolution: {integrity: sha512-iG0T6+nYJ9FAPmx9SsUlnwcq1ZVRuCXcVEvWnntoPlrOpwtSTKNDC9uVAxTsC3PUvJ+99n4RpAcNgBbHX3JSnQ==} @@ -1931,15 +1934,30 @@ packages: '@volar/language-server@2.4.28': resolution: {integrity: sha512-NqcLnE5gERKuS4PUFwlhMxf6vqYo7hXtbMFbViXcbVkbZ905AIVWhnSo0ZNBC2V127H1/2zP7RvVOVnyITFfBw==} + peerDependencies: + typescript: '*' + peerDependenciesMeta: + typescript: + optional: true '@volar/language-service@2.4.28': resolution: {integrity: sha512-Rh/wYCZJrI5vCwMk9xyw/Z+MsWxlJY1rmMZPsxUoJKfzIRjS/NF1NmnuEcrMbEVGja00aVpCsInJfixQTMdvLw==} + peerDependencies: + typescript: '*' + peerDependenciesMeta: + typescript: + optional: true '@volar/source-map@2.4.28': resolution: {integrity: sha512-yX2BDBqJkRXfKw8my8VarTyjv48QwxdJtvRgUpNE5erCsgEUdI2DsLbpa+rOQVAJYshY99szEcRDmyHbF10ggQ==} '@volar/typescript@2.4.28': resolution: {integrity: sha512-Ja6yvWrbis2QtN4ClAKreeUZPVYMARDYZl9LMEv1iQ1QdepB6wn0jTRxA9MftYmYa4DQ4k/DaSZpFPUfxl8giw==} + peerDependencies: + typescript: '*' + peerDependenciesMeta: + typescript: + optional: true '@vscode/emmet-helper@2.11.0': resolution: {integrity: sha512-QLxjQR3imPZPQltfbWRnHU6JecWTF1QSWhx3GAKQpslx7y3Dp6sIIXhKjiUJ/BR9FX8PVthjr9PD6pNwOJfAzw==} @@ -3046,8 +3064,8 @@ packages: resolution: {integrity: sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==} hasBin: true - katex@0.18.1: - resolution: {integrity: sha512-Td8GCYSxDAoMhHOlKmCFMJ/hz5qlAAb71n66Dryw9nfCVfumLo7nhuotbvKom/XPADmrYC3O5QR71EPq4DarJQ==} + katex@0.18.4: + resolution: {integrity: sha512-IMPntbRLOU+eu88XDiFKqQ8Akhr9Tv7jDMXqPhjG9SI1JMA4DIgXk4x9k4skJz2NZJXBRbC+2pYBLj9olqcZow==} hasBin: true khroma@2.1.0: @@ -4192,8 +4210,8 @@ packages: typescript: optional: true - tsx@4.23.5: - resolution: {integrity: sha512-rw55FUaqOoI7RvlQwLbhO4nSDApnQ4/CykPuiQ/EPvtrX3WA9Ig55jIt9VvbBJbzJuj12ueRu4PMZ2SxPVbihg==} + tsx@4.23.12: + resolution: {integrity: sha512-FDf4L4sYzKtzWYhU/Xm0AQFdTjdIxNo9ElTf2mxXM6k8YMHXzYUe4yODVaXP4V9uMFbVg8c0qyBccK2OOxb45Q==} engines: {node: '>=18.0.0'} hasBin: true @@ -4499,17 +4517,23 @@ packages: resolution: {integrity: sha512-9K2k72s4n7rV9s4bX0MyjbX9iBribvKZbBJKuEmTCZfeWJXs6Yh7bGpY4eoc7UufAjvpheBqwyZCOIPBvxCv0A==} peerDependencies: '@volar/language-service': ~2.4.0 + typescript: '*' peerDependenciesMeta: '@volar/language-service': optional: true + typescript: + optional: true volar-service-typescript@0.0.71: resolution: {integrity: sha512-yTtM/BVT6hoyEYnDtaCyAtNhdNeS/mhTTABlBOdw3NNiRBUin3IznFJpgfjer4c6RYopiPjjQjc9VFhxVl1mLw==} peerDependencies: '@volar/language-service': ~2.4.0 + typescript: '*' peerDependenciesMeta: '@volar/language-service': optional: true + typescript: + optional: true volar-service-yaml@0.0.71: resolution: {integrity: sha512-qYGWGuVpUTnZGu5P/CR4KLK4aIR8RrcVnmfZ2eRcj9q/I8VZCoC5yy9FtEvfNvnDp4MU17yhdJcvpQPIqhJS2Q==} @@ -4767,17 +4791,17 @@ snapshots: '@jridgewell/sourcemap-codec': 1.5.5 '@volar/kit': 2.4.28(typescript@6.0.3) '@volar/language-core': 2.4.28 - '@volar/language-server': 2.4.28 - '@volar/language-service': 2.4.28 + '@volar/language-server': 2.4.28(typescript@6.0.3) + '@volar/language-service': 2.4.28(typescript@6.0.3) muggle-string: 0.4.1 tinyglobby: 0.2.17 - volar-service-css: 0.0.71(@volar/language-service@2.4.28) - volar-service-emmet: 0.0.71(@volar/language-service@2.4.28) - volar-service-html: 0.0.71(@volar/language-service@2.4.28) - volar-service-prettier: 0.0.71(@volar/language-service@2.4.28)(prettier@3.9.6) - volar-service-typescript: 0.0.71(@volar/language-service@2.4.28) - volar-service-typescript-twoslash-queries: 0.0.71(@volar/language-service@2.4.28) - volar-service-yaml: 0.0.71(@volar/language-service@2.4.28) + volar-service-css: 0.0.71(@volar/language-service@2.4.28(typescript@6.0.3)) + volar-service-emmet: 0.0.71(@volar/language-service@2.4.28(typescript@6.0.3)) + volar-service-html: 0.0.71(@volar/language-service@2.4.28(typescript@6.0.3)) + volar-service-prettier: 0.0.71(@volar/language-service@2.4.28(typescript@6.0.3))(prettier@3.9.6) + volar-service-typescript: 0.0.71(@volar/language-service@2.4.28(typescript@6.0.3))(typescript@6.0.3) + volar-service-typescript-twoslash-queries: 0.0.71(@volar/language-service@2.4.28(typescript@6.0.3))(typescript@6.0.3) + volar-service-yaml: 0.0.71(@volar/language-service@2.4.28(typescript@6.0.3)) vscode-html-languageservice: 5.6.2 vscode-uri: 3.1.0 optionalDependencies: @@ -4785,7 +4809,7 @@ snapshots: transitivePeerDependencies: - typescript - '@astrojs/markdown-remark@7.2.2': + '@astrojs/markdown-remark@7.2.2(supports-color@10.2.2)': dependencies: '@astrojs/internal-helpers': 0.10.2 '@astrojs/prism': 4.0.2 @@ -4795,8 +4819,8 @@ snapshots: mdast-util-definitions: 6.0.0 rehype-raw: 7.0.0 rehype-stringify: 10.0.1 - remark-gfm: 4.0.1 - remark-parse: 11.0.0 + remark-gfm: 4.0.1(supports-color@10.2.2) + remark-parse: 11.0.0(supports-color@10.2.2) remark-rehype: 11.1.2 remark-smartypants: 3.0.3 unified: 11.0.5 @@ -4815,19 +4839,19 @@ snapshots: hast-util-from-html: 2.0.3 satteri: 0.9.5 - '@astrojs/mdx@7.0.5(@astrojs/markdown-satteri@0.3.5)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))': + '@astrojs/mdx@7.0.5(@astrojs/markdown-satteri@0.3.5)(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)': dependencies: '@astrojs/internal-helpers': 0.10.2 - '@astrojs/markdown-remark': 7.2.2 - '@mdx-js/mdx': 3.1.1 + '@astrojs/markdown-remark': 7.2.2(supports-color@10.2.2) + '@mdx-js/mdx': 3.1.1(supports-color@10.2.2) acorn: 8.18.0 - astro: 7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0) + astro: 7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0) es-module-lexer: 2.3.1 estree-util-visit: 2.0.0 hast-util-to-html: 9.0.5 piccolore: 0.1.3 rehype-raw: 7.0.0 - remark-gfm: 4.0.1 + remark-gfm: 4.0.1(supports-color@10.2.2) remark-smartypants: 3.0.3 source-map: 0.7.6 unist-util-visit: 5.1.0 @@ -4847,22 +4871,22 @@ snapshots: stream-replace-string: 2.0.0 zod: 4.4.3 - '@astrojs/starlight-tailwind@5.0.0(@astrojs/starlight@0.41.6(@astrojs/markdown-remark@7.2.2)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(typescript@6.0.3))(tailwindcss@4.3.3)': + '@astrojs/starlight-tailwind@5.0.0(@astrojs/starlight@0.41.7(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3))(tailwindcss@4.3.3)': dependencies: - '@astrojs/starlight': 0.41.6(@astrojs/markdown-remark@7.2.2)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(typescript@6.0.3) + '@astrojs/starlight': 0.41.7(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3) tailwindcss: 4.3.3 - '@astrojs/starlight@0.41.6(@astrojs/markdown-remark@7.2.2)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(typescript@6.0.3)': + '@astrojs/starlight@0.41.7(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3)': dependencies: '@astrojs/markdown-satteri': 0.3.5 - '@astrojs/mdx': 7.0.5(@astrojs/markdown-satteri@0.3.5)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0)) + '@astrojs/mdx': 7.0.5(@astrojs/markdown-satteri@0.3.5)(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2) '@astrojs/sitemap': 3.7.3 '@pagefind/default-ui': 1.5.2 '@types/hast': 3.0.5 '@types/js-yaml': 4.0.9 '@types/mdast': 4.0.4 - astro: 7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0) - astro-expressive-code: 0.44.1(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0)) + astro: 7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0) + astro-expressive-code: 0.44.1(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0)) bcp-47: 2.1.1 hast-util-from-html: 2.0.3 hast-util-select: 6.0.4 @@ -4872,20 +4896,20 @@ snapshots: js-yaml: 4.3.1 klona: 2.0.6 magic-string: 0.30.21 - mdast-util-directive: 3.1.0 + mdast-util-directive: 3.1.0(supports-color@10.2.2) mdast-util-to-markdown: 2.1.2 mdast-util-to-string: 4.0.0 pagefind: 1.5.2 rehype: 13.0.2 rehype-format: 5.0.1 - remark-directive: 4.0.0 + remark-directive: 4.0.0(supports-color@10.2.2) satteri: 0.9.5 ultrahtml: 1.7.0 unified: 11.0.5 unist-util-visit: 5.1.0 vfile: 6.0.3 optionalDependencies: - '@astrojs/markdown-remark': 7.2.2 + '@astrojs/markdown-remark': 7.2.2(supports-color@10.2.2) transitivePeerDependencies: - supports-color - typescript @@ -4909,20 +4933,20 @@ snapshots: '@babel/compat-data@7.29.7': {} - '@babel/core@7.29.7': + '@babel/core@7.29.7(supports-color@10.2.2)': dependencies: '@babel/code-frame': 7.29.7 '@babel/generator': 7.29.8 '@babel/helper-compilation-targets': 7.29.7 - '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7) + '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7(supports-color@10.2.2))(supports-color@10.2.2) '@babel/helpers': 7.29.7 '@babel/parser': 7.29.8 '@babel/template': 7.29.7 - '@babel/traverse': 7.29.8 + '@babel/traverse': 7.29.8(supports-color@10.2.2) '@babel/types': 7.29.8 '@jridgewell/remapping': 2.3.5 convert-source-map: 2.0.0 - debug: 4.4.3 + debug: 4.4.3(supports-color@10.2.2) gensync: 1.0.0-beta.2 json5: 2.2.3 semver: 6.3.1 @@ -4947,19 +4971,19 @@ snapshots: '@babel/helper-globals@7.29.7': {} - '@babel/helper-module-imports@7.29.7': + '@babel/helper-module-imports@7.29.7(supports-color@10.2.2)': dependencies: - '@babel/traverse': 7.29.8 + '@babel/traverse': 7.29.8(supports-color@10.2.2) '@babel/types': 7.29.8 transitivePeerDependencies: - supports-color - '@babel/helper-module-transforms@7.29.7(@babel/core@7.29.7)': + '@babel/helper-module-transforms@7.29.7(@babel/core@7.29.7(supports-color@10.2.2))(supports-color@10.2.2)': dependencies: - '@babel/core': 7.29.7 - '@babel/helper-module-imports': 7.29.7 + '@babel/core': 7.29.7(supports-color@10.2.2) + '@babel/helper-module-imports': 7.29.7(supports-color@10.2.2) '@babel/helper-validator-identifier': 7.29.7 - '@babel/traverse': 7.29.8 + '@babel/traverse': 7.29.8(supports-color@10.2.2) transitivePeerDependencies: - supports-color @@ -4984,7 +5008,7 @@ snapshots: '@babel/parser': 7.29.8 '@babel/types': 7.29.8 - '@babel/traverse@7.29.8': + '@babel/traverse@7.29.8(supports-color@10.2.2)': dependencies: '@babel/code-frame': 7.29.7 '@babel/generator': 7.29.8 @@ -4992,7 +5016,7 @@ snapshots: '@babel/parser': 7.29.8 '@babel/template': 7.29.7 '@babel/types': 7.29.8 - debug: 4.4.3 + debug: 4.4.3(supports-color@10.2.2) transitivePeerDependencies: - supports-color @@ -5603,7 +5627,7 @@ snapshots: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.5.5 - '@mdx-js/mdx@3.1.1': + '@mdx-js/mdx@3.1.1(supports-color@10.2.2)': dependencies: '@types/estree': 1.0.9 '@types/estree-jsx': 1.0.5 @@ -5615,14 +5639,14 @@ snapshots: estree-util-is-identifier-name: 3.0.0 estree-util-scope: 1.0.0 estree-walker: 3.0.3 - hast-util-to-jsx-runtime: 2.3.6 + hast-util-to-jsx-runtime: 2.3.6(supports-color@10.2.2) markdown-extensions: 2.0.0 recma-build-jsx: 1.0.0 recma-jsx: 1.0.1(acorn@8.18.0) recma-stringify: 1.0.0 - rehype-recma: 1.0.0 - remark-mdx: 3.1.1 - remark-parse: 11.0.0 + rehype-recma: 1.0.0(supports-color@10.2.2) + remark-mdx: 3.1.1(supports-color@10.2.2) + remark-parse: 11.0.0(supports-color@10.2.2) remark-rehype: 11.1.2 source-map: 0.7.6 unified: 11.0.5 @@ -5941,12 +5965,12 @@ snapshots: '@tailwindcss/oxide-win32-arm64-msvc': 4.3.3 '@tailwindcss/oxide-win32-x64-msvc': 4.3.3 - '@tailwindcss/vite@4.3.3(vite@8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0))': + '@tailwindcss/vite@4.3.3(vite@8.2.0(@types/node@26.2.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0))': dependencies: '@tailwindcss/node': 4.3.3 '@tailwindcss/oxide': 4.3.3 tailwindcss: 4.3.3 - vite: 8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0) + vite: 8.2.0(@types/node@26.2.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0) '@tybys/wasm-util@0.10.3': dependencies: @@ -6117,11 +6141,15 @@ snapshots: dependencies: undici-types: 8.3.0 + '@types/node@26.2.0': + dependencies: + undici-types: 8.3.0 + '@types/picomatch@4.0.3': {} '@types/sax@1.2.7': dependencies: - '@types/node': 24.13.3 + '@types/node': 26.1.2 '@types/trusted-types@2.0.7': optional: true @@ -6149,7 +6177,7 @@ snapshots: obug: 2.1.4 std-env: 4.2.0 tinyrainbow: 3.1.1 - vitest: 4.1.10(@types/node@26.1.2)(@vitest/coverage-v8@4.1.10)(vite@8.2.0(@types/node@26.1.2)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0)) + vitest: 4.1.10(@types/node@26.2.0)(@vitest/coverage-v8@4.1.10)(vite@8.2.0(@types/node@26.2.0)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0)) '@vitest/expect@4.1.10': dependencies: @@ -6160,21 +6188,21 @@ snapshots: chai: 6.2.2 tinyrainbow: 3.1.1 - '@vitest/mocker@4.1.10(vite@8.2.0(@types/node@26.1.2)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0))': + '@vitest/mocker@4.1.10(vite@8.2.0(@types/node@26.2.0)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0))': dependencies: '@vitest/spy': 4.1.10 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: - vite: 8.2.0(@types/node@26.1.2)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0) + vite: 8.2.0(@types/node@26.2.0)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0) - '@vitest/mocker@4.1.10(vite@8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0))': + '@vitest/mocker@4.1.10(vite@8.2.0(@types/node@26.2.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0))': dependencies: '@vitest/spy': 4.1.10 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: - vite: 8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0) + vite: 8.2.0(@types/node@26.2.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0) '@vitest/pretty-format@4.1.10': dependencies: @@ -6202,8 +6230,8 @@ snapshots: '@volar/kit@2.4.28(typescript@6.0.3)': dependencies: - '@volar/language-service': 2.4.28 - '@volar/typescript': 2.4.28 + '@volar/language-service': 2.4.28(typescript@6.0.3) + '@volar/typescript': 2.4.28(typescript@6.0.3) typesafe-path: 0.2.2 typescript: 6.0.3 vscode-languageserver-textdocument: 1.0.12 @@ -6213,32 +6241,38 @@ snapshots: dependencies: '@volar/source-map': 2.4.28 - '@volar/language-server@2.4.28': + '@volar/language-server@2.4.28(typescript@6.0.3)': dependencies: '@volar/language-core': 2.4.28 - '@volar/language-service': 2.4.28 - '@volar/typescript': 2.4.28 + '@volar/language-service': 2.4.28(typescript@6.0.3) + '@volar/typescript': 2.4.28(typescript@6.0.3) path-browserify: 1.0.1 request-light: 0.7.0 vscode-languageserver: 9.0.1 vscode-languageserver-protocol: 3.18.2 vscode-languageserver-textdocument: 1.0.12 vscode-uri: 3.1.0 + optionalDependencies: + typescript: 6.0.3 - '@volar/language-service@2.4.28': + '@volar/language-service@2.4.28(typescript@6.0.3)': dependencies: '@volar/language-core': 2.4.28 vscode-languageserver-protocol: 3.18.2 vscode-languageserver-textdocument: 1.0.12 vscode-uri: 3.1.0 + optionalDependencies: + typescript: 6.0.3 '@volar/source-map@2.4.28': {} - '@volar/typescript@2.4.28': + '@volar/typescript@2.4.28(typescript@6.0.3)': dependencies: '@volar/language-core': 2.4.28 path-browserify: 1.0.1 vscode-uri: 3.1.0 + optionalDependencies: + typescript: 6.0.3 '@vscode/emmet-helper@2.11.0': dependencies: @@ -6260,9 +6294,9 @@ snapshots: '@vtbag/utensil-drawer@1.2.18': {} - '@wave-rf/astro-themed-mermaid@0.3.1(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(rehype-mermaid@3.0.0(playwright@1.62.1))': + '@wave-rf/astro-themed-mermaid@0.3.1(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(rehype-mermaid@3.0.0(playwright@1.62.1))': dependencies: - astro: 7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0) + astro: 7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0) rehype-mermaid: 3.0.0(playwright@1.62.1) unist-util-visit: 5.1.0 @@ -6270,10 +6304,10 @@ snapshots: dependencies: '@cloudflare/workers-types': 4.20260702.1 - '@wave-rf/starlight-llm-tools@0.3.1(@astrojs/starlight@0.41.6(@astrojs/markdown-remark@7.2.2)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(typescript@6.0.3))(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))': + '@wave-rf/starlight-llm-tools@0.3.1(@astrojs/starlight@0.41.7(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))': dependencies: - '@astrojs/starlight': 0.41.6(@astrojs/markdown-remark@7.2.2)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(typescript@6.0.3) - astro: 7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0) + '@astrojs/starlight': 0.41.7(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3) + astro: 7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0) acorn-jsx@5.3.2(acorn@8.18.0): dependencies: @@ -6354,9 +6388,9 @@ snapshots: astring@1.9.0: {} - astro-expressive-code@0.44.1(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0)): + astro-expressive-code@0.44.1(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0)): dependencies: - astro: 7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0) + astro: 7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0) rehype-expressive-code: 0.44.1 url-extras: 0.1.0 @@ -6368,7 +6402,7 @@ snapshots: '@vtbag/turn-signal': 1.3.1 '@vtbag/utensil-drawer': 1.2.18 - astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0): + astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0): dependencies: '@astrojs/compiler-rs': 0.3.2(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3) '@astrojs/internal-helpers': 0.10.2 @@ -6418,14 +6452,14 @@ snapshots: ultrahtml: 1.7.0 unifont: 0.7.4 unstorage: 1.17.5 - vite: 8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0) - vitefu: 1.1.3(vite@8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0)) + vite: 8.2.0(@types/node@26.2.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0) + vitefu: 1.1.3(vite@8.2.0(@types/node@26.2.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0)) xxhash-wasm: 1.1.0 yargs-parser: 22.0.0 zod: 4.4.3 optionalDependencies: - '@astrojs/markdown-remark': 7.2.2 - sharp: 0.35.3(@types/node@26.1.2) + '@astrojs/markdown-remark': 7.2.2(supports-color@10.2.2) + sharp: 0.35.3(@types/node@26.2.0) transitivePeerDependencies: - '@azure/app-configuration' - '@azure/cosmos' @@ -6821,9 +6855,11 @@ snapshots: dayjs@1.11.21: {} - debug@4.4.3: + debug@4.4.3(supports-color@10.2.2): dependencies: ms: 2.1.3 + optionalDependencies: + supports-color: 10.2.2 decamelize@1.2.0: {} @@ -7294,7 +7330,7 @@ snapshots: unist-util-visit: 5.1.0 zwitch: 2.0.4 - hast-util-to-estree@3.1.3: + hast-util-to-estree@3.1.3(supports-color@10.2.2): dependencies: '@types/estree': 1.0.9 '@types/estree-jsx': 1.0.5 @@ -7304,9 +7340,9 @@ snapshots: estree-util-attach-comments: 3.0.0 estree-util-is-identifier-name: 3.0.0 hast-util-whitespace: 3.0.0 - mdast-util-mdx-expression: 2.0.1 - mdast-util-mdx-jsx: 3.2.0 - mdast-util-mdxjs-esm: 2.0.1 + mdast-util-mdx-expression: 2.0.1(supports-color@10.2.2) + mdast-util-mdx-jsx: 3.2.0(supports-color@10.2.2) + mdast-util-mdxjs-esm: 2.0.1(supports-color@10.2.2) property-information: 7.2.0 space-separated-tokens: 2.0.2 style-to-js: 1.1.21 @@ -7329,7 +7365,7 @@ snapshots: stringify-entities: 4.0.4 zwitch: 2.0.4 - hast-util-to-jsx-runtime@2.3.6: + hast-util-to-jsx-runtime@2.3.6(supports-color@10.2.2): dependencies: '@types/estree': 1.0.9 '@types/hast': 3.0.5 @@ -7338,9 +7374,9 @@ snapshots: devlop: 1.1.0 estree-util-is-identifier-name: 3.0.0 hast-util-whitespace: 3.0.0 - mdast-util-mdx-expression: 2.0.1 - mdast-util-mdx-jsx: 3.2.0 - mdast-util-mdxjs-esm: 2.0.1 + mdast-util-mdx-expression: 2.0.1(supports-color@10.2.2) + mdast-util-mdx-jsx: 3.2.0(supports-color@10.2.2) + mdast-util-mdxjs-esm: 2.0.1(supports-color@10.2.2) property-information: 7.2.0 space-separated-tokens: 2.0.2 style-to-js: 1.1.21 @@ -7459,9 +7495,9 @@ snapshots: dependencies: append-transform: 2.0.0 - istanbul-lib-instrument@6.0.3: + istanbul-lib-instrument@6.0.3(supports-color@10.2.2): dependencies: - '@babel/core': 7.29.7 + '@babel/core': 7.29.7(supports-color@10.2.2) '@babel/parser': 7.29.8 '@istanbuljs/schema': 0.1.6 istanbul-lib-coverage: 3.2.2 @@ -7483,9 +7519,9 @@ snapshots: make-dir: 4.0.0 supports-color: 7.2.0 - istanbul-lib-source-maps@4.0.1: + istanbul-lib-source-maps@4.0.1(supports-color@10.2.2): dependencies: - debug: 4.4.3 + debug: 4.4.3(supports-color@10.2.2) istanbul-lib-coverage: 3.2.2 source-map: 0.6.1 transitivePeerDependencies: @@ -7533,7 +7569,7 @@ snapshots: dependencies: commander: 8.3.0 - katex@0.18.1: + katex@0.18.4: dependencies: commander: 8.3.0 @@ -7706,27 +7742,27 @@ snapshots: markdown-table@3.0.4: {} - markdownlint-cli2-formatter-default@0.0.6(markdownlint-cli2@0.23.2): + markdownlint-cli2-formatter-default@0.0.6(markdownlint-cli2@0.23.2(supports-color@10.2.2)): dependencies: - markdownlint-cli2: 0.23.2 + markdownlint-cli2: 0.23.2(supports-color@10.2.2) - markdownlint-cli2@0.23.2: + markdownlint-cli2@0.23.2(supports-color@10.2.2): dependencies: globby: 16.2.2 js-yaml: 5.2.2 jsonc-parser: 3.3.1 jsonpointer: 5.0.1 markdown-it: 14.3.0 - markdownlint: 0.41.1 - markdownlint-cli2-formatter-default: 0.0.6(markdownlint-cli2@0.23.2) + markdownlint: 0.41.1(supports-color@10.2.2) + markdownlint-cli2-formatter-default: 0.0.6(markdownlint-cli2@0.23.2(supports-color@10.2.2)) micromatch: 4.0.8 smol-toml: 1.7.0 transitivePeerDependencies: - supports-color - markdownlint@0.41.1: + markdownlint@0.41.1(supports-color@10.2.2): dependencies: - micromark: 4.0.2 + micromark: 4.0.2(supports-color@10.2.2) micromark-core-commonmark: 2.0.3 micromark-extension-directive: 4.0.0 micromark-extension-gfm-autolink-literal: 2.1.0 @@ -7746,13 +7782,13 @@ snapshots: '@types/unist': 3.0.3 unist-util-visit: 5.1.0 - mdast-util-directive@3.1.0: + mdast-util-directive@3.1.0(supports-color@10.2.2): dependencies: '@types/mdast': 4.0.4 '@types/unist': 3.0.3 ccount: 2.0.1 devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3 + mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) mdast-util-to-markdown: 2.1.2 parse-entities: 4.0.2 stringify-entities: 4.0.4 @@ -7767,14 +7803,14 @@ snapshots: unist-util-is: 6.0.1 unist-util-visit-parents: 6.0.2 - mdast-util-from-markdown@2.0.3: + mdast-util-from-markdown@2.0.3(supports-color@10.2.2): dependencies: '@types/mdast': 4.0.4 '@types/unist': 3.0.3 decode-named-character-reference: 1.3.0 devlop: 1.1.0 mdast-util-to-string: 4.0.0 - micromark: 4.0.2 + micromark: 4.0.2(supports-color@10.2.2) micromark-util-decode-numeric-character-reference: 2.0.2 micromark-util-decode-string: 2.0.1 micromark-util-normalize-identifier: 2.0.1 @@ -7792,79 +7828,79 @@ snapshots: mdast-util-find-and-replace: 3.0.2 micromark-util-character: 2.1.1 - mdast-util-gfm-footnote@2.1.0: + mdast-util-gfm-footnote@2.1.0(supports-color@10.2.2): dependencies: '@types/mdast': 4.0.4 devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3 + mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) mdast-util-to-markdown: 2.1.2 micromark-util-normalize-identifier: 2.0.1 transitivePeerDependencies: - supports-color - mdast-util-gfm-strikethrough@2.0.0: + mdast-util-gfm-strikethrough@2.0.0(supports-color@10.2.2): dependencies: '@types/mdast': 4.0.4 - mdast-util-from-markdown: 2.0.3 + mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) mdast-util-to-markdown: 2.1.2 transitivePeerDependencies: - supports-color - mdast-util-gfm-table@2.0.0: + mdast-util-gfm-table@2.0.0(supports-color@10.2.2): dependencies: '@types/mdast': 4.0.4 devlop: 1.1.0 markdown-table: 3.0.4 - mdast-util-from-markdown: 2.0.3 + mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) mdast-util-to-markdown: 2.1.2 transitivePeerDependencies: - supports-color - mdast-util-gfm-task-list-item@2.0.0: + mdast-util-gfm-task-list-item@2.0.0(supports-color@10.2.2): dependencies: '@types/mdast': 4.0.4 devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3 + mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) mdast-util-to-markdown: 2.1.2 transitivePeerDependencies: - supports-color - mdast-util-gfm@3.1.0: + mdast-util-gfm@3.1.0(supports-color@10.2.2): dependencies: - mdast-util-from-markdown: 2.0.3 + mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) mdast-util-gfm-autolink-literal: 2.0.1 - mdast-util-gfm-footnote: 2.1.0 - mdast-util-gfm-strikethrough: 2.0.0 - mdast-util-gfm-table: 2.0.0 - mdast-util-gfm-task-list-item: 2.0.0 + mdast-util-gfm-footnote: 2.1.0(supports-color@10.2.2) + mdast-util-gfm-strikethrough: 2.0.0(supports-color@10.2.2) + mdast-util-gfm-table: 2.0.0(supports-color@10.2.2) + mdast-util-gfm-task-list-item: 2.0.0(supports-color@10.2.2) mdast-util-to-markdown: 2.1.2 transitivePeerDependencies: - supports-color - mdast-util-math@3.0.0: + mdast-util-math@3.0.0(supports-color@10.2.2): dependencies: '@types/hast': 3.0.5 '@types/mdast': 4.0.4 devlop: 1.1.0 longest-streak: 3.1.0 - mdast-util-from-markdown: 2.0.3 + mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) mdast-util-to-markdown: 2.1.2 unist-util-remove-position: 5.0.0 transitivePeerDependencies: - supports-color - mdast-util-mdx-expression@2.0.1: + mdast-util-mdx-expression@2.0.1(supports-color@10.2.2): dependencies: '@types/estree-jsx': 1.0.5 '@types/hast': 3.0.5 '@types/mdast': 4.0.4 devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3 + mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) mdast-util-to-markdown: 2.1.2 transitivePeerDependencies: - supports-color - mdast-util-mdx-jsx@3.2.0: + mdast-util-mdx-jsx@3.2.0(supports-color@10.2.2): dependencies: '@types/estree-jsx': 1.0.5 '@types/hast': 3.0.5 @@ -7872,7 +7908,7 @@ snapshots: '@types/unist': 3.0.3 ccount: 2.0.1 devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3 + mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) mdast-util-to-markdown: 2.1.2 parse-entities: 4.0.2 stringify-entities: 4.0.4 @@ -7881,23 +7917,23 @@ snapshots: transitivePeerDependencies: - supports-color - mdast-util-mdx@3.0.0: + mdast-util-mdx@3.0.0(supports-color@10.2.2): dependencies: - mdast-util-from-markdown: 2.0.3 - mdast-util-mdx-expression: 2.0.1 - mdast-util-mdx-jsx: 3.2.0 - mdast-util-mdxjs-esm: 2.0.1 + mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) + mdast-util-mdx-expression: 2.0.1(supports-color@10.2.2) + mdast-util-mdx-jsx: 3.2.0(supports-color@10.2.2) + mdast-util-mdxjs-esm: 2.0.1(supports-color@10.2.2) mdast-util-to-markdown: 2.1.2 transitivePeerDependencies: - supports-color - mdast-util-mdxjs-esm@2.0.1: + mdast-util-mdxjs-esm@2.0.1(supports-color@10.2.2): dependencies: '@types/estree-jsx': 1.0.5 '@types/hast': 3.0.5 '@types/mdast': 4.0.4 devlop: 1.1.0 - mdast-util-from-markdown: 2.0.3 + mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) mdast-util-to-markdown: 2.1.2 transitivePeerDependencies: - supports-color @@ -8237,10 +8273,10 @@ snapshots: micromark-util-types@2.0.2: {} - micromark@4.0.2: + micromark@4.0.2(supports-color@10.2.2): dependencies: '@types/debug': 4.1.13 - debug: 4.4.3 + debug: 4.4.3(supports-color@10.2.2) decode-named-character-reference: 1.3.0 devlop: 1.1.0 micromark-core-commonmark: 2.0.3 @@ -8327,7 +8363,7 @@ snapshots: dependencies: boolbase: 1.0.0 - nyc@18.0.0: + nyc@18.0.0(supports-color@10.2.2): dependencies: '@istanbuljs/load-nyc-config': 1.1.0 '@istanbuljs/schema': 0.1.6 @@ -8341,10 +8377,10 @@ snapshots: glob: 13.0.6 istanbul-lib-coverage: 3.2.2 istanbul-lib-hook: 3.0.0 - istanbul-lib-instrument: 6.0.3 + istanbul-lib-instrument: 6.0.3(supports-color@10.2.2) istanbul-lib-processinfo: 3.0.1 istanbul-lib-report: 3.0.1 - istanbul-lib-source-maps: 4.0.1 + istanbul-lib-source-maps: 4.0.1(supports-color@10.2.2) istanbul-reports: 3.2.0 make-dir: 3.1.0 node-preload: 0.2.1 @@ -8500,13 +8536,13 @@ snapshots: path-data-parser: 0.1.0 points-on-curve: 0.2.0 - postcss-load-config@6.0.1(jiti@2.7.0)(postcss@8.5.25)(tsx@4.23.5)(yaml@2.9.0): + postcss-load-config@6.0.1(jiti@2.7.0)(postcss@8.5.25)(tsx@4.23.12)(yaml@2.9.0): dependencies: lilconfig: 3.1.3 optionalDependencies: jiti: 2.7.0 postcss: 8.5.25 - tsx: 4.23.5 + tsx: 4.23.12 yaml: 2.9.0 postcss-nested@6.2.0(postcss@8.5.25): @@ -8631,11 +8667,11 @@ snapshots: hast-util-raw: 9.1.0 vfile: 6.0.3 - rehype-recma@1.0.0: + rehype-recma@1.0.0(supports-color@10.2.2): dependencies: '@types/estree': 1.0.9 '@types/hast': 3.0.5 - hast-util-to-estree: 3.1.3 + hast-util-to-estree: 3.1.3(supports-color@10.2.2) transitivePeerDependencies: - supports-color @@ -8656,46 +8692,46 @@ snapshots: dependencies: es6-error: 4.1.1 - remark-directive@4.0.0: + remark-directive@4.0.0(supports-color@10.2.2): dependencies: '@types/mdast': 4.0.4 - mdast-util-directive: 3.1.0 + mdast-util-directive: 3.1.0(supports-color@10.2.2) micromark-extension-directive: 4.0.0 unified: 11.0.5 transitivePeerDependencies: - supports-color - remark-gfm@4.0.1: + remark-gfm@4.0.1(supports-color@10.2.2): dependencies: '@types/mdast': 4.0.4 - mdast-util-gfm: 3.1.0 + mdast-util-gfm: 3.1.0(supports-color@10.2.2) micromark-extension-gfm: 3.0.0 - remark-parse: 11.0.0 + remark-parse: 11.0.0(supports-color@10.2.2) remark-stringify: 11.0.0 unified: 11.0.5 transitivePeerDependencies: - supports-color - remark-math@6.0.0: + remark-math@6.0.0(supports-color@10.2.2): dependencies: '@types/mdast': 4.0.4 - mdast-util-math: 3.0.0 + mdast-util-math: 3.0.0(supports-color@10.2.2) micromark-extension-math: 3.1.0 unified: 11.0.5 transitivePeerDependencies: - supports-color - remark-mdx@3.1.1: + remark-mdx@3.1.1(supports-color@10.2.2): dependencies: - mdast-util-mdx: 3.0.0 + mdast-util-mdx: 3.0.0(supports-color@10.2.2) micromark-extension-mdxjs: 3.0.0 transitivePeerDependencies: - supports-color - remark-parse@11.0.0: + remark-parse@11.0.0(supports-color@10.2.2): dependencies: '@types/mdast': 4.0.4 - mdast-util-from-markdown: 2.0.3 + mdast-util-from-markdown: 2.0.3(supports-color@10.2.2) micromark-util-types: 2.0.2 unified: 11.0.5 transitivePeerDependencies: @@ -8894,7 +8930,7 @@ snapshots: '@img/sharp-win32-ia32': 0.35.2 '@img/sharp-win32-x64': 0.35.2 - sharp@0.35.3(@types/node@26.1.2): + sharp@0.35.3(@types/node@26.2.0): dependencies: '@img/colour': 1.1.0 detect-libc: 2.1.2 @@ -8925,7 +8961,7 @@ snapshots: '@img/sharp-win32-arm64': 0.35.3 '@img/sharp-win32-ia32': 0.35.3 '@img/sharp-win32-x64': 0.35.3 - '@types/node': 26.1.2 + '@types/node': 26.2.0 shebang-command@2.0.0: dependencies: @@ -8987,26 +9023,26 @@ snapshots: stackback@0.0.2: {} - starlight-image-zoom@0.15.0(@astrojs/starlight@0.41.6(@astrojs/markdown-remark@7.2.2)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(typescript@6.0.3)): + starlight-image-zoom@0.15.0(@astrojs/starlight@0.41.7(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3))(supports-color@10.2.2): dependencies: - '@astrojs/starlight': 0.41.6(@astrojs/markdown-remark@7.2.2)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(typescript@6.0.3) - mdast-util-mdx-jsx: 3.2.0 + '@astrojs/starlight': 0.41.7(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3) + mdast-util-mdx-jsx: 3.2.0(supports-color@10.2.2) rehype-raw: 7.0.0 unist-util-visit: 5.1.0 unist-util-visit-parents: 6.0.2 transitivePeerDependencies: - supports-color - starlight-links-validator@0.25.2(@astrojs/starlight@0.41.6(@astrojs/markdown-remark@7.2.2)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(typescript@6.0.3))(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0)): + starlight-links-validator@0.25.2(@astrojs/starlight@0.41.7(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2): dependencies: '@astrojs/markdown-satteri': 0.3.5 - '@astrojs/starlight': 0.41.6(@astrojs/markdown-remark@7.2.2)(astro@7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0))(typescript@6.0.3) + '@astrojs/starlight': 0.41.7(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(astro@7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3) '@types/picomatch': 4.0.3 - astro: 7.1.6(@astrojs/markdown-remark@7.2.2)(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.1.2)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.5)(yaml@2.9.0) + astro: 7.1.6(@astrojs/markdown-remark@7.2.2(supports-color@10.2.2))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@26.2.0)(jiti@2.7.0)(rollup@4.62.4)(tsx@4.23.12)(yaml@2.9.0) github-slugger: 2.0.0 hast-util-from-html: 2.0.3 is-absolute-url: 5.0.0 - mdast-util-mdx-jsx: 3.2.0 + mdast-util-mdx-jsx: 3.2.0(supports-color@10.2.2) mdast-util-to-hast: 13.2.1 picomatch: 4.0.5 satteri: 0.9.5 @@ -9155,18 +9191,18 @@ snapshots: tslib@2.8.1: optional: true - tsup@8.5.1(jiti@2.7.0)(postcss@8.5.25)(tsx@4.23.5)(typescript@6.0.3)(yaml@2.9.0): + tsup@8.5.1(jiti@2.7.0)(postcss@8.5.25)(supports-color@10.2.2)(tsx@4.23.12)(typescript@6.0.3)(yaml@2.9.0): dependencies: bundle-require: 5.1.0(esbuild@0.27.7) cac: 6.7.14 chokidar: 4.0.3 consola: 3.4.2 - debug: 4.4.3 + debug: 4.4.3(supports-color@10.2.2) esbuild: 0.27.7 fix-dts-default-cjs-exports: 1.0.1 joycon: 3.1.1 picocolors: 1.1.1 - postcss-load-config: 6.0.1(jiti@2.7.0)(postcss@8.5.25)(tsx@4.23.5)(yaml@2.9.0) + postcss-load-config: 6.0.1(jiti@2.7.0)(postcss@8.5.25)(tsx@4.23.12)(yaml@2.9.0) resolve-from: 5.0.0 rollup: 4.62.4 source-map: 0.7.6 @@ -9183,7 +9219,7 @@ snapshots: - tsx - yaml - tsx@4.23.5: + tsx@4.23.12: dependencies: esbuild: 0.28.1 optionalDependencies: @@ -9323,7 +9359,7 @@ snapshots: '@types/unist': 3.0.3 vfile-message: 4.0.3 - vite@8.2.0(@types/node@26.1.2)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0): + vite@8.2.0(@types/node@26.2.0)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0): dependencies: lightningcss: 1.33.0 picomatch: 4.0.5 @@ -9331,14 +9367,14 @@ snapshots: rolldown: 1.2.2 tinyglobby: 0.2.17 optionalDependencies: - '@types/node': 26.1.2 + '@types/node': 26.2.0 esbuild: 0.27.7 fsevents: 2.3.3 jiti: 2.7.0 - tsx: 4.23.5 + tsx: 4.23.12 yaml: 2.9.0 - vite@8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0): + vite@8.2.0(@types/node@26.2.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0): dependencies: lightningcss: 1.33.0 picomatch: 4.0.5 @@ -9346,21 +9382,21 @@ snapshots: rolldown: 1.2.2 tinyglobby: 0.2.17 optionalDependencies: - '@types/node': 26.1.2 + '@types/node': 26.2.0 esbuild: 0.28.1 fsevents: 2.3.3 jiti: 2.7.0 - tsx: 4.23.5 + tsx: 4.23.12 yaml: 2.9.0 - vitefu@1.1.3(vite@8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0)): + vitefu@1.1.3(vite@8.2.0(@types/node@26.2.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0)): optionalDependencies: - vite: 8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0) + vite: 8.2.0(@types/node@26.2.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0) - vitest@4.1.10(@types/node@26.1.2)(@vitest/coverage-v8@4.1.10)(vite@8.2.0(@types/node@26.1.2)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0)): + vitest@4.1.10(@types/node@26.2.0)(@vitest/coverage-v8@4.1.10)(vite@8.2.0(@types/node@26.2.0)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0)): dependencies: '@vitest/expect': 4.1.10 - '@vitest/mocker': 4.1.10(vite@8.2.0(@types/node@26.1.2)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0)) + '@vitest/mocker': 4.1.10(vite@8.2.0(@types/node@26.2.0)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0)) '@vitest/pretty-format': 4.1.10 '@vitest/runner': 4.1.10 '@vitest/snapshot': 4.1.10 @@ -9377,18 +9413,18 @@ snapshots: tinyexec: 1.3.0 tinyglobby: 0.2.17 tinyrainbow: 3.1.1 - vite: 8.2.0(@types/node@26.1.2)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0) + vite: 8.2.0(@types/node@26.2.0)(esbuild@0.27.7)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0) why-is-node-running: 2.3.0 optionalDependencies: - '@types/node': 26.1.2 + '@types/node': 26.2.0 '@vitest/coverage-v8': 4.1.10(vitest@4.1.10) transitivePeerDependencies: - msw - vitest@4.1.10(@types/node@26.1.2)(@vitest/coverage-v8@4.1.10)(vite@8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0)): + vitest@4.1.10(@types/node@26.2.0)(@vitest/coverage-v8@4.1.10)(vite@8.2.0(@types/node@26.2.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0)): dependencies: '@vitest/expect': 4.1.10 - '@vitest/mocker': 4.1.10(vite@8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0)) + '@vitest/mocker': 4.1.10(vite@8.2.0(@types/node@26.2.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0)) '@vitest/pretty-format': 4.1.10 '@vitest/runner': 4.1.10 '@vitest/snapshot': 4.1.10 @@ -9405,53 +9441,54 @@ snapshots: tinyexec: 1.3.0 tinyglobby: 0.2.17 tinyrainbow: 3.1.1 - vite: 8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.5)(yaml@2.9.0) + vite: 8.2.0(@types/node@26.2.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.12)(yaml@2.9.0) why-is-node-running: 2.3.0 optionalDependencies: - '@types/node': 26.1.2 + '@types/node': 26.2.0 '@vitest/coverage-v8': 4.1.10(vitest@4.1.10) transitivePeerDependencies: - msw - volar-service-css@0.0.71(@volar/language-service@2.4.28): + volar-service-css@0.0.71(@volar/language-service@2.4.28(typescript@6.0.3)): dependencies: vscode-css-languageservice: 6.3.10 vscode-languageserver-textdocument: 1.0.12 vscode-uri: 3.1.0 optionalDependencies: - '@volar/language-service': 2.4.28 + '@volar/language-service': 2.4.28(typescript@6.0.3) - volar-service-emmet@0.0.71(@volar/language-service@2.4.28): + volar-service-emmet@0.0.71(@volar/language-service@2.4.28(typescript@6.0.3)): dependencies: '@emmetio/css-parser': 0.4.1 '@emmetio/html-matcher': 1.3.0 '@vscode/emmet-helper': 2.11.0 vscode-uri: 3.1.0 optionalDependencies: - '@volar/language-service': 2.4.28 + '@volar/language-service': 2.4.28(typescript@6.0.3) - volar-service-html@0.0.71(@volar/language-service@2.4.28): + volar-service-html@0.0.71(@volar/language-service@2.4.28(typescript@6.0.3)): dependencies: vscode-html-languageservice: 5.6.2 vscode-languageserver-textdocument: 1.0.12 vscode-uri: 3.1.0 optionalDependencies: - '@volar/language-service': 2.4.28 + '@volar/language-service': 2.4.28(typescript@6.0.3) - volar-service-prettier@0.0.71(@volar/language-service@2.4.28)(prettier@3.9.6): + volar-service-prettier@0.0.71(@volar/language-service@2.4.28(typescript@6.0.3))(prettier@3.9.6): dependencies: vscode-uri: 3.1.0 optionalDependencies: - '@volar/language-service': 2.4.28 + '@volar/language-service': 2.4.28(typescript@6.0.3) prettier: 3.9.6 - volar-service-typescript-twoslash-queries@0.0.71(@volar/language-service@2.4.28): + volar-service-typescript-twoslash-queries@0.0.71(@volar/language-service@2.4.28(typescript@6.0.3))(typescript@6.0.3): dependencies: vscode-uri: 3.1.0 optionalDependencies: - '@volar/language-service': 2.4.28 + '@volar/language-service': 2.4.28(typescript@6.0.3) + typescript: 6.0.3 - volar-service-typescript@0.0.71(@volar/language-service@2.4.28): + volar-service-typescript@0.0.71(@volar/language-service@2.4.28(typescript@6.0.3))(typescript@6.0.3): dependencies: path-browserify: 1.0.1 semver: 7.8.5 @@ -9460,14 +9497,15 @@ snapshots: vscode-nls: 5.2.0 vscode-uri: 3.1.0 optionalDependencies: - '@volar/language-service': 2.4.28 + '@volar/language-service': 2.4.28(typescript@6.0.3) + typescript: 6.0.3 - volar-service-yaml@0.0.71(@volar/language-service@2.4.28): + volar-service-yaml@0.0.71(@volar/language-service@2.4.28(typescript@6.0.3)): dependencies: vscode-uri: 3.1.0 yaml-language-server: 1.23.0 optionalDependencies: - '@volar/language-service': 2.4.28 + '@volar/language-service': 2.4.28(typescript@6.0.3) vscode-css-languageservice@6.3.10: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 1b819a4c..441a4168 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -33,4 +33,4 @@ engineStrict: true catalog: typescript: "^6.0.3" vitest: "^4.1.10" - "@types/node": "^26.1.2" + "@types/node": "^26.2.0" From 2c7ae22d7becd12d12814dabe8777be1856e5d23 Mon Sep 17 00:00:00 2001 From: Eric Andrechek Date: Tue, 18 Aug 2026 17:19:33 -0400 Subject: [PATCH 2/2] minor tweaks --- CHANGELOG.md | 2 +- docs/src/content/docs/development.md | 17 +++-------------- 2 files changed, 4 insertions(+), 15 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d13adaf8..cc73e390 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -29,7 +29,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed -- **Dependabot now watches the `setup-env` composite action, and the three weekly update groups land in one pass** (`.github/dependabot.yml`, `.github/workflows/{ci,housekeeping,publish-dev,publish-npm,release}.yml`, `.github/actions/setup-env/action.yml`, `go.mod`, `go.sum`, `clients/ts/package.json`, `docs/package.json`, `pnpm-workspace.yaml`, `pnpm-lock.yaml`, `docs/src/content/docs/development.md`): `directory: /` under `package-ecosystem: github-actions` reaches `.github/workflows/` and does not descend into `.github/actions/*/action.yml`, so `setup-env` — which owns every cache in CI — had been invisible to Dependabot since it was created, so its pins went stale against upstream and diverged from `publish-npm.yml`, a workflow Dependabot *does* track and which doesn't call `setup-env` (`actions/setup-node` v7.0.0 there vs v6.4.0 here, `pnpm/action-setup` v6.0.9 vs v6.0.8; `actions/cache` was uniformly v5.0.5 everywhere, simply a major behind upstream). The config moves to `directories: [/, /.github/actions/setup-env]` and the action is brought up to what its peers already carry: #480's bumps for `actions/cache` (5.0.5→6.1.0) and `pnpm/action-setup` (6.0.8→6.0.10), plus `actions/setup-node` v6.4.0→**v7.0.0** — a major for the action that provisions Node in every CI job, which #480 never proposed because `publish-npm.yml` was already on it (ESM migration, no config-surface change). Landed alongside it: the actions group (#480 — `labeler` 6.2.0→7.0.0 — whose step is now `continue-on-error` so a transient labeler API failure can't abort the job before the PR-title mirror runs, the contract housekeeping.yml's header already claimed and #481 disproved — `cache` + `cache/restore` 5.0.5→6.1.0, `upload-code-coverage` 1.4.1→1.4.2, `docker/login-action` 4.4.0→4.6.0, `attest-build-provenance` 4.1.1→4.2.2, `pnpm/action-setup` 6.0.9→6.0.10), the go group (#481 — `nats-server` 2.14.4→2.14.5, `nats.go` 1.52.0→1.53.1, `testify` 1.11.1→1.12.0, `testcontainers-go` 0.43.0→0.44.0), and four of the five npm bumps (#482 — `tsx` 4.23.5→4.23.12, `@astrojs/starlight` 0.41.6→0.41.7, `katex` 0.18.1→0.18.4, `@types/node` catalog ^26.1.2→^26.2.0). `typescript` is held at `^6.0.3`: `tsup` 8.5.1 vendors `rollup-plugin-dts` 6.1.1 into its own bundle, and that copy reaches for TS 5-era compiler internals and throws `Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')` the moment `dts: true` runs — inside `clients/ts`'s `prepare`, so inside `pnpm install`, so every Node job fails at once. `rollup-plugin-dts` >= 6.5.0 declares TS 7 support, making the unblock a `tsup` release that vendors it; until then `.github/dependabot.yml` ignores `version-update:semver-major` for `typescript`, tracked in #487. +- **Dependabot now watches the `setup-env` composite action, and the three weekly update groups land in one pass** (`.github/dependabot.yml`, `.github/workflows/{ci,housekeeping,publish-dev,publish-npm,release}.yml`, `.github/actions/setup-env/action.yml`, `go.mod`, `go.sum`, `clients/ts/package.json`, `docs/package.json`, `pnpm-workspace.yaml`, `pnpm-lock.yaml`, `docs/src/content/docs/development.md`): `directory: /` under `package-ecosystem: github-actions` reaches `.github/workflows/` and does not descend into `.github/actions/*/action.yml`, so `setup-env` — which owns every cache in `ci.yml` — had been invisible to Dependabot since it was created, and its pins went stale against upstream and diverged from `publish-npm.yml`, a workflow Dependabot *does* track and which doesn't call `setup-env` (`actions/setup-node` v7.0.0 there vs v6.4.0 here, `pnpm/action-setup` v6.0.9 vs v6.0.8; `actions/cache` was uniformly v5.0.5 everywhere, simply a major behind upstream). The config moves to `directories: [/, /.github/actions/setup-env]` and the action is brought up to what its peers already carry: `actions/cache` 5.0.5→6.1.0 and `pnpm/action-setup` 6.0.8→6.0.10, both landing on the targets #480 proposed for the workflows, plus `actions/setup-node` v6.4.0→**v7.0.0** — a major for the action that provisions Node for every CI job that needs it, which #480 never proposed because `publish-npm.yml` was already on it (ESM migration, no config-surface change). Landed alongside it: the actions group (#480 — `labeler` 6.2.0→7.0.0 — whose step is now `continue-on-error` so a transient labeler API failure can't abort the job before the PR-title mirror runs, the contract housekeeping.yml's header already claimed and #481 disproved — `cache` + `cache/restore` 5.0.5→6.1.0, `upload-code-coverage` 1.4.1→1.4.2, `docker/login-action` 4.4.0→4.6.0, `attest-build-provenance` 4.1.1→4.2.2, `pnpm/action-setup` 6.0.9→6.0.10), the go group (#481 — `nats-server` 2.14.4→2.14.5, `nats.go` 1.52.0→1.53.1, `testify` 1.11.1→1.12.0, `testcontainers-go` 0.43.0→0.44.0), and four of the five npm bumps (#482 — `tsx` 4.23.5→4.23.12, `@astrojs/starlight` 0.41.6→0.41.7, `katex` 0.18.1→0.18.4, `@types/node` catalog ^26.1.2→^26.2.0). `typescript` is held at `^6.0.3`: `tsup` 8.5.1 vendors `rollup-plugin-dts` 6.1.1 into its own bundle, and that copy reaches for TS 5-era compiler internals and throws `Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')` the moment `dts: true` runs — inside `clients/ts`'s `prepare`, so inside `pnpm install`, so every Node job fails at once. `rollup-plugin-dts` >= 6.5.0 declares TS 7 support, making the unblock a `tsup` release that vendors it; until then `.github/dependabot.yml` ignores `version-update:semver-major` for `typescript`, tracked in #487. - **BREAKING (API): every admin-gated endpoint now lives under one `/v1/ops/*` prefix** (`internal/api/router.go`, `internal/api/errors.go`, `clients/ts/src/{sql,policy,pipes,schema,dlq,table,cli/codegen}.ts`, docs throughout, plus tests in `internal/api`, `tests/integration`, `tests/e2e/sdk`, and the SDK): the admin surface was split across two shapes — the `/v1/admin/*` subtree (raw SQL, policy CRUD, pipes CRUD) plus three individually-gated top-level routes (`GET /v1/schema`, `POST /v1/schema/refresh`, `GET /v1/dlq/stats`) — so the path alone couldn't tell you what the `RequireAdmin` gate covered. All of them merge into a single `/v1/ops` subtree behind one tree-level gate: `/v1/admin/{query,policy,pipes…}` → `/v1/ops/{query,policy,pipes…}`, `/v1/schema[/refresh]` → `/v1/ops/schema[/refresh]`, `/v1/dlq/stats` → `/v1/ops/dlq/stats`. The gate itself is unchanged (`policy.AdminRole`, operator-key break-glass included). No aliases are kept for the old paths (pre-1.0; the SDK's path constants are updated in the same change, so its method surface — `wh.sql`, `wh.policy`, `wh.pipes`, `wh.schema`, `wh.dlq` — is unaffected). If you fenced `/v1/admin/` at your reverse proxy or ingress (deny rule, IP allowlist, internal-only listener), that rule silently stops matching after this rename — move it to `/v1/ops/` (see `docs/src/content/docs/reverse-proxy.mdx` §"Fencing the admin surface"). One observable log change: an authorization denial on the former top-level schema route now records the tree pattern `route:"/v1/ops/*"` (as `/v1/admin/*` denials always did) instead of the full route template — the `gate:"admin"` attribute already identifies the check. The docs pass riding along also closed accuracy gaps surfaced in review: `reverse-proxy.mdx`'s body-cap table is relabeled by body shape instead of a control/data-plane split that clashed with the ops naming, the `RequireAdmin` denial contract now reads 401-for-a-present-but-invalid-token vs 403-for-a-non-admin-role everywhere it's described (`api.md`, `architecture.md`, `sdk/queries.md`), and the `gh attestation verify` examples in `deployment.md` and `SECURITY.md` pin `--signer-workflow` to the workflow that publishes the artifact, since `--repo` alone accepts an attestation from any workflow in the repo. diff --git a/docs/src/content/docs/development.md b/docs/src/content/docs/development.md index b6d7f7a8..408e267d 100644 --- a/docs/src/content/docs/development.md +++ b/docs/src/content/docs/development.md @@ -561,20 +561,9 @@ Dependabot is configured in `.github/dependabot.yml` to open weekly grouped PRs PRs are grouped per config to reduce noise. The npm config is pointed at the workspace **root** (`directory: /`), not the individual member directories. The repo has a single root `pnpm-lock.yaml`, and Dependabot only updates a lockfile co-located with the manifest it targets — so a per-member config (the previous setup) bumped a member's `package.json` without regenerating the root lockfile, and every such PR then failed CI's `pnpm install --frozen-lockfile` with `ERR_PNPM_OUTDATED_LOCKFILE`. Pointing at the root lets Dependabot read `pnpm-workspace.yaml`, walk every member, and update the one lockfile. -The GitHub Actions config names **two** directories. `directory: /` reaches -`.github/workflows/` but does not descend into `.github/actions/*/action.yml`, -so the `setup-env` composite action — which owns every cache in CI — was -invisible to Dependabot, and its pins went stale against upstream and diverged -from `publish-npm.yml`, which Dependabot *does* track and which doesn't call -`setup-env`. Listing its directory under `directories:` brings it into the same -weekly group; **adding a composite action means adding its directory there**, -because nothing else catches the drift. - -`typescript` majors are held back (`ignore: version-update:semver-major`) -because `tsup` vendors a `rollup-plugin-dts` that crashes on TypeScript 7 -during `clients/ts`'s `prepare` script — i.e. inside `pnpm install`, which -takes every Node job down at once. See the comment in `.github/dependabot.yml` -for the condition that lets it be removed. +The GitHub Actions config names **two** directories. `directory: /` reaches `.github/workflows/` but does not descend into `.github/actions/*/action.yml`, so the `setup-env` composite action — which owns every cache in `ci.yml` — was invisible to Dependabot, and its pins went stale against upstream and diverged from `publish-npm.yml`, which Dependabot *does* track and which doesn't call `setup-env`. Listing its directory under `directories:` brings it into the same weekly group; **adding a composite action means adding its directory there**, because nothing else catches the drift. + +`typescript` majors are held back (`ignore: version-update:semver-major`) because `tsup` vendors a `rollup-plugin-dts` that crashes on TypeScript 7 during `clients/ts`'s `prepare` script — i.e. inside `pnpm install`, which takes every Node job down at once. See the comment in `.github/dependabot.yml` for the condition that lets it be removed. **No auto-merge.** Dependabot PRs go through the same merge gate as any other PR — an approval from the `@Wave-RF/wavehouse-admins` team (the ruleset's `required_reviewers` rule) plus the required checks. (The former `dependabot-automerge.yml`, which auto-approved and merged patch/minor bumps hands-off, was removed — every bump now gets a human admin review.)