From 6e7b9e5b923472248682b85bcdca83b6d1224573 Mon Sep 17 00:00:00 2001 From: Laith Al-Saadoon Date: Thu, 8 Oct 2026 15:34:29 +0000 Subject: [PATCH 1/5] build(mise): re-resolve latest tools and refresh python 3.13 betterleaks 1.8.1 -> 1.9.0, grype 0.119.0 -> 0.120.1, semgrep 1.178.0 -> 1.179.0, syft 1.52.0 -> 1.54.1, trivy 0.74.0 -> 0.75.0, uv 0.12.19 -> 0.12.23, python 3.13.15 -> 3.13.16. node stays on 24 (24.21.0 already newest); pnpm unchanged here. Co-Authored-By: Claude Sonnet 5.5 --- mise.lock | 82 +++++++++++++++++++++++++++---------------------------- 1 file changed, 41 insertions(+), 41 deletions(-) diff --git a/mise.lock b/mise.lock index 6a915d2..db11cea 100644 --- a/mise.lock +++ b/mise.lock @@ -1,19 +1,19 @@ # @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html [[tools."aqua:betterleaks/betterleaks"]] -version = "1.8.1" +version = "1.9.0" backend = "aqua:betterleaks/betterleaks" [tools."aqua:betterleaks/betterleaks"."platforms.linux-x64"] -checksum = "sha256:efa407244e1ea8e35f582b8a42becdeac08bdead04f68eb752adda722d583c2a" -url = "https://github.com/betterleaks/betterleaks/releases/download/v1.8.1/betterleaks_1.8.1_linux_x64.tar.gz" -url_api = "https://api.github.com/repos/betterleaks/betterleaks/releases/assets/519981768" +checksum = "sha256:f8b185a39ffcece2a1ca82bf3a4e7435cd81963ffd16b7a9128daf75f35f6de7" +url = "https://github.com/betterleaks/betterleaks/releases/download/v1.9.0/betterleaks_1.9.0_linux_x64.tar.gz" +url_api = "https://api.github.com/repos/betterleaks/betterleaks/releases/assets/599108929" provenance = "cosign" [tools."aqua:betterleaks/betterleaks"."platforms.macos-arm64"] -checksum = "sha256:8e80f33b5f2a7426b390347b9fd466033723cb94b6bdffa7572632e2eaec964e" -url = "https://github.com/betterleaks/betterleaks/releases/download/v1.8.1/betterleaks_1.8.1_darwin_arm64.tar.gz" -url_api = "https://api.github.com/repos/betterleaks/betterleaks/releases/assets/519981770" +checksum = "sha256:83dd7eaab13d44a1e8e347a17064cdef153a1478db473276d41b38d55613d3f2" +url = "https://github.com/betterleaks/betterleaks/releases/download/v1.9.0/betterleaks_1.9.0_darwin_arm64.tar.gz" +url_api = "https://api.github.com/repos/betterleaks/betterleaks/releases/assets/599108927" provenance = "cosign" [[tools."aqua:rhysd/actionlint"]] @@ -49,18 +49,18 @@ url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067 provenance = "github-attestations" [[tools.grype]] -version = "0.119.0" +version = "0.120.1" backend = "aqua:anchore/grype" [tools.grype."platforms.linux-x64"] -checksum = "sha256:3fa2dc4b924621ab65404cf08d0b8438d896d80ab949c9d5a4ca283c36004c9b" -url = "https://github.com/anchore/grype/releases/download/v0.119.0/grype_0.119.0_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/anchore/grype/releases/assets/570620608" +checksum = "sha256:0a9ee97ef5ae2ee953b0a80098105052e846cdbe319a57d808b519c33cd1343d" +url = "https://github.com/anchore/grype/releases/download/v0.120.1/grype_0.120.1_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/anchore/grype/releases/assets/616618032" [tools.grype."platforms.macos-arm64"] -checksum = "sha256:500c9b2b6c089d21481815f57a553fabbd441ec7d1e79d95e3aaf40c3bfc7e36" -url = "https://github.com/anchore/grype/releases/download/v0.119.0/grype_0.119.0_darwin_arm64.tar.gz" -url_api = "https://api.github.com/repos/anchore/grype/releases/assets/570630905" +checksum = "sha256:cf97957fa467d25575ec2cc3228289f391ea51cf88b9cffc5f83dc03d4cbc732" +url = "https://github.com/anchore/grype/releases/download/v0.120.1/grype_0.120.1_darwin_arm64.tar.gz" +url_api = "https://api.github.com/repos/anchore/grype/releases/assets/616618097" [[tools.node]] version = "24.21.0" @@ -119,21 +119,21 @@ url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/577602575" provenance = "github-attestations" [[tools.python]] -version = "3.13.15" +version = "3.13.16" backend = "core:python" [tools.python."platforms.linux-x64"] -checksum = "sha256:d0b640eed27fbdd6f5f2bd33444aee53df2c8863f8b2a96f4094717411e3de9c" -url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260924/cpython-3.13.15+20260924-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz" +checksum = "sha256:4595c5589fff7bf0cb158d9a88a797e0d791fa33830770fcb7bf3f4b104feeae" +url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261003/cpython-3.13.16+20261003-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz" provenance = "github-attestations" [tools.python."platforms.macos-arm64"] -checksum = "sha256:064afb7c2fc0bbf511d886288adf98696af5105e36c138cdf2c199c0146fcf68" -url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260924/cpython-3.13.15+20260924-aarch64-apple-darwin-install_only_stripped.tar.gz" +checksum = "sha256:9e01f63bbb08576cd9c8bc2d0564d098cb30c8453a0cd4bcf6aef458f6d2a147" +url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261003/cpython-3.13.16+20261003-aarch64-apple-darwin-install_only_stripped.tar.gz" provenance = "github-attestations" [[tools.semgrep]] -version = "1.178.0" +version = "1.179.0" backend = "pipx:semgrep" [[tools.shellcheck]] @@ -151,47 +151,47 @@ url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellche url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056932" [[tools.syft]] -version = "1.52.0" +version = "1.54.1" backend = "aqua:anchore/syft" [tools.syft."platforms.linux-x64"] -checksum = "sha256:caeedb81fb0491615f1ebd1761e4145d41ee86dd2cc7bf80669f9f5ad9d6133d" -url = "https://github.com/anchore/syft/releases/download/v1.52.0/syft_1.52.0_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/anchore/syft/releases/assets/570445809" +checksum = "sha256:c069905b391cc4c20a5ba65ad5c10be2a7ba074f8ea6ad203e24d14e303dad47" +url = "https://github.com/anchore/syft/releases/download/v1.54.1/syft_1.54.1_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/anchore/syft/releases/assets/615916330" [tools.syft."platforms.macos-arm64"] -checksum = "sha256:014d561b6d13059124155f74a6c5a9a99501f5e209313638dd884f39eb418ee6" -url = "https://github.com/anchore/syft/releases/download/v1.52.0/syft_1.52.0_darwin_arm64.tar.gz" -url_api = "https://api.github.com/repos/anchore/syft/releases/assets/570445806" +checksum = "sha256:b4319c3abaa87a0170ab76ee83ea2260ca34b53aecfa3ab0dd5428d2319d744f" +url = "https://github.com/anchore/syft/releases/download/v1.54.1/syft_1.54.1_darwin_arm64.tar.gz" +url_api = "https://api.github.com/repos/anchore/syft/releases/assets/615916332" [[tools.trivy]] -version = "0.74.0" +version = "0.75.0" backend = "aqua:aquasecurity/trivy" [tools.trivy."platforms.linux-x64"] -checksum = "sha256:2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a" -url = "https://github.com/aquasecurity/trivy/releases/download/v0.74.0/trivy_0.74.0_Linux-64bit.tar.gz" -url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/514339431" +checksum = "sha256:c6e65abddb348e25f10549df887045629cf28cc72453cd1c63acb717316b3f3f" +url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_Linux-64bit.tar.gz" +url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335432" provenance = "cosign" [tools.trivy."platforms.macos-arm64"] -checksum = "sha256:1caada5e0e2091909357c7525d3aa76f4b660b13821bc143b190c7483e31cc11" -url = "https://github.com/aquasecurity/trivy/releases/download/v0.74.0/trivy_0.74.0_macOS-ARM64.tar.gz" -url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/514339464" +checksum = "sha256:4a77108cccf8e55c8d6823e1e759939a622277e66cd0daa3c1fc621ed69e4568" +url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_macOS-ARM64.tar.gz" +url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335435" provenance = "cosign" [[tools.uv]] -version = "0.12.19" +version = "0.12.23" backend = "aqua:astral-sh/uv" [tools.uv."platforms.linux-x64"] -checksum = "sha256:db7278c9f57981338fddff1fb250e11964bc0a4fafcb9eed8303fdb117dc067b" -url = "https://github.com/astral-sh/uv/releases/download/0.12.19/uv-x86_64-unknown-linux-musl.tar.gz" -url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/587159021" +checksum = "sha256:1cff8783850e794470aadb73f54b749542a511fc57b0ce6468b64bd3852e0ade" +url = "https://github.com/astral-sh/uv/releases/download/0.12.23/uv-x86_64-unknown-linux-musl.tar.gz" +url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/608232639" provenance = "github-attestations" [tools.uv."platforms.macos-arm64"] -checksum = "sha256:a9a8df1eedeb192f2e47e40e2faabfb387db4b850209118786d42f89dde3e0ba" -url = "https://github.com/astral-sh/uv/releases/download/0.12.19/uv-aarch64-apple-darwin.tar.gz" -url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/587158826" +checksum = "sha256:50487ae565ccd96e499056b4674d438f4c53170202617b4c759defe0c6a1b544" +url = "https://github.com/astral-sh/uv/releases/download/0.12.23/uv-aarch64-apple-darwin.tar.gz" +url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/608232483" provenance = "github-attestations" From 05717c2a35f1544f29ad7ca5a0fed8af786b7149 Mon Sep 17 00:00:00 2001 From: Laith Al-Saadoon Date: Thu, 8 Oct 2026 15:35:24 +0000 Subject: [PATCH 2/5] build(mise): pnpm 11.27.1 -> 12.10.1 mise.toml and packageManager in site/package.json move together. pnpm 12 writes the pinned package manager into the lockfile as a leading env document (pnpm and its @pnpm/exe platform binaries); no resolved site dependency changed. docs:install (--frozen-lockfile) and docs:gate pass on it. Co-Authored-By: Claude Sonnet 5.5 --- mise.lock | 14 ++-- mise.toml | 2 +- site/package.json | 2 +- site/pnpm-lock.yaml | 158 ++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 167 insertions(+), 9 deletions(-) diff --git a/mise.lock b/mise.lock index db11cea..d93ec79 100644 --- a/mise.lock +++ b/mise.lock @@ -103,19 +103,19 @@ version = "1.1.414" backend = "pipx:pyright" [[tools.pnpm]] -version = "11.27.1" +version = "12.10.1" backend = "aqua:pnpm/pnpm" [tools.pnpm."platforms.linux-x64"] -checksum = "sha256:6be1426540406747b7731564a46c5b30d3023ea6c19e4ce99f994c4ec122f3d2" -url = "https://github.com/pnpm/pnpm/releases/download/v11.27.1/pnpm-linux-x64.tar.gz" -url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/577602576" +checksum = "sha256:502a275984a4cd01e5579ac72049a241091cac5118e44becf84951130c3e079e" +url = "https://github.com/pnpm/pnpm/releases/download/v12.10.1/pnpm-linux-x64.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/616153639" provenance = "github-attestations" [tools.pnpm."platforms.macos-arm64"] -checksum = "sha256:352f67ceaaa5aba294a53f483da93c376005b4c7e785fe5411e0ce720fe74741" -url = "https://github.com/pnpm/pnpm/releases/download/v11.27.1/pnpm-darwin-arm64.tar.gz" -url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/577602575" +checksum = "sha256:a617ae6a55c8b3cd494c611ada88d65cb7c3cf6d7828e91b2f44b4bed1bee217" +url = "https://github.com/pnpm/pnpm/releases/download/v12.10.1/pnpm-darwin-arm64.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/616153633" provenance = "github-attestations" [[tools.python]] diff --git a/mise.toml b/mise.toml index c8b3637..1dae563 100644 --- a/mise.toml +++ b/mise.toml @@ -60,7 +60,7 @@ shellcheck = "latest" # declaration order, and node's own bin holds a `pnpm` shim wherever `corepack enable` has # run — so with node first, every pnpm call goes through corepack and this pin is inert. # This version and `packageManager` in site/package.json must agree. -pnpm = "11.27.1" +pnpm = "12.10.1" node = "24" [env] diff --git a/site/package.json b/site/package.json index b600ed0..8bff67b 100644 --- a/site/package.json +++ b/site/package.json @@ -5,7 +5,7 @@ "type": "module", "description": "Documentation site for atif-sql, with the machine-readable surface an agent fetches.", "license": "Apache-2.0", - "packageManager": "pnpm@11.27.1", + "packageManager": "pnpm@12.10.1", "engines": { "node": ">=22" }, diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml index 40f828f..cb420d6 100644 --- a/site/pnpm-lock.yaml +++ b/site/pnpm-lock.yaml @@ -1,3 +1,161 @@ +--- +lockfileVersion: '9.0' + +importers: + + .: + configDependencies: {} + packageManagerDependencies: + pnpm: + specifier: 12.10.1 + version: 12.10.1 + +packages: + + '@pnpm/exe.android-arm64@12.10.1': + resolution: {integrity: sha512-CVTlHPwNvadQCJD9bGSMzWIhFX8QpjtqC2c27dhdnn/9iKzEjZ3qL62o3gHpKbIuo6qn4WxTKRoaokgNdReBig==} + cpu: [arm64] + os: [android] + + '@pnpm/exe.android-x64@12.10.1': + resolution: {integrity: sha512-NFiYLIaodY7da0XIebwcU3JoP7IK/lzF7zgKSSP+9H+QcFnQ1GDfBkuBKCYJzZ+Xu0WH54neIPLBBCaOjaaauA==} + cpu: [x64] + os: [android] + + '@pnpm/exe.darwin-arm64@12.10.1': + resolution: {integrity: sha512-0O8tdQ8ijlPJudXspLMTcitMkdBEz6uUflazL5uQE0WMs85oQIp0U+5hfEktMFB64QqEhjqlvvujTwbzdr9oMg==} + cpu: [arm64] + os: [darwin] + + '@pnpm/exe.darwin-x64@12.10.1': + resolution: {integrity: sha512-ud+1/uZOKEo8P/AsPynOJc/LNwfI0j6WwCElibj71rU9l4nIBnsSn+wWTIPZPkZ4BBSH5+82azSnAARMyJ1lNA==} + cpu: [x64] + os: [darwin] + + '@pnpm/exe.freebsd-x64@12.10.1': + resolution: {integrity: sha512-mj9PE5rf8uAfQQ2K66HSATMSut+lNiB4eSqFd5+azFVCMnxNSy/32xpZQJT21PhnN3Y4qbK+iKHe5nWAxSuRhw==} + cpu: [x64] + os: [freebsd] + + '@pnpm/exe.linux-arm64-musl@12.10.1': + resolution: {integrity: sha512-xba+00wZJ8Um6rBJJjWl88uJj0tydB8dtomvjlCLvi0uL32vpa9CRP8Vv26FIXvbiZ1bo2RCzYt/eChxJVV52w==} + cpu: [arm64] + os: [linux] + libc: [musl] + + '@pnpm/exe.linux-arm64@12.10.1': + resolution: {integrity: sha512-oBdMp69ScC9UnniG4qZAQVr2fBDSXjm4yk/72vkEVyrlwS23yMxcRQl7Qdo3sgXPAygY6TWnPRKm4rXzjoyW7w==} + cpu: [arm64] + os: [linux] + libc: [glibc] + + '@pnpm/exe.linux-ppc64@12.10.1': + resolution: {integrity: sha512-Yyb3wu09h3c7mLme270uHFiVaAIUHC411Ru9LIU2BKUIstrGlXa9OqqVWoXaRgYRdFdOFknkwG7GNn6ygwLbnw==} + cpu: [ppc64] + os: [linux] + libc: [glibc] + + '@pnpm/exe.linux-riscv64@12.10.1': + resolution: {integrity: sha512-PdkeUFFkybknnGkWP0H22eMpIiS4OZXL5BcQzF4lh+vmrW3IaC2HOkbANKgot/PKO0Kl77pzA/6PKFxgbgfXIQ==} + cpu: [riscv64] + os: [linux] + libc: [glibc] + + '@pnpm/exe.linux-s390x@12.10.1': + resolution: {integrity: sha512-1okKuHKJwJPAbofDxfhZWAUxEWtee4ZSf7Pah8kcvocaJkf2WxFJ5KVTiNIvDml5GLidDQsgf7Pcf/WHbCak7Q==} + cpu: [s390x] + os: [linux] + libc: [glibc] + + '@pnpm/exe.linux-x64-musl@12.10.1': + resolution: {integrity: sha512-e6IqzVNkPa7srFKJKnY23uWJ+qz0LaRWiTUo/sHfFXRRMRzB5uNOr6qWWip/jqhdGwU91n9J7LrEYZ6e0tRczw==} + cpu: [x64] + os: [linux] + libc: [musl] + + '@pnpm/exe.linux-x64@12.10.1': + resolution: {integrity: sha512-ZByV0DRgWzGaDSjT5ddRBASdwz+r/qPMYh7o6RGmPQjtRGNFbSl94xY2DcAM8mqCOZJUUDtAXQ+wpBXcdpKlkg==} + cpu: [x64] + os: [linux] + libc: [glibc] + + '@pnpm/exe.win32-arm64@12.10.1': + resolution: {integrity: sha512-I7QZHcjioG7orFeCRUFUHByJ1G0zFPnAlaGGyrUvb6MGkv5oeNwNPl7t+Gp+7zHfnMcgLGJ1a+Wfim0IDw3lOw==} + cpu: [arm64] + os: [win32] + + '@pnpm/exe.win32-x64@12.10.1': + resolution: {integrity: sha512-4WJFdp58EKlCj0zLobrXU0vpszSZIr4X/3y/uNbAQqGW0zE+VdruZB0gFc3L2kzsUzVwTYbaCn+XEhnCYSAlTg==} + cpu: [x64] + os: [win32] + + pnpm@12.10.1: + resolution: {integrity: sha512-ukCjfrGjcNYP6oxM8dNkwTvMzvUY6YrSvO6VT1OdONo3RY5YJho/pV4GUjRQ6g//+fSXsTW+QfLBXBZCusrObA==} + engines: {node: '>=18.*'} + hasBin: true + +snapshots: + + '@pnpm/exe.android-arm64@12.10.1': + optional: true + + '@pnpm/exe.android-x64@12.10.1': + optional: true + + '@pnpm/exe.darwin-arm64@12.10.1': + optional: true + + '@pnpm/exe.darwin-x64@12.10.1': + optional: true + + '@pnpm/exe.freebsd-x64@12.10.1': + optional: true + + '@pnpm/exe.linux-arm64-musl@12.10.1': + optional: true + + '@pnpm/exe.linux-arm64@12.10.1': + optional: true + + '@pnpm/exe.linux-ppc64@12.10.1': + optional: true + + '@pnpm/exe.linux-riscv64@12.10.1': + optional: true + + '@pnpm/exe.linux-s390x@12.10.1': + optional: true + + '@pnpm/exe.linux-x64-musl@12.10.1': + optional: true + + '@pnpm/exe.linux-x64@12.10.1': + optional: true + + '@pnpm/exe.win32-arm64@12.10.1': + optional: true + + '@pnpm/exe.win32-x64@12.10.1': + optional: true + + pnpm@12.10.1: + optionalDependencies: + '@pnpm/exe.android-arm64': 12.10.1 + '@pnpm/exe.android-x64': 12.10.1 + '@pnpm/exe.darwin-arm64': 12.10.1 + '@pnpm/exe.darwin-x64': 12.10.1 + '@pnpm/exe.freebsd-x64': 12.10.1 + '@pnpm/exe.linux-arm64': 12.10.1 + '@pnpm/exe.linux-arm64-musl': 12.10.1 + '@pnpm/exe.linux-ppc64': 12.10.1 + '@pnpm/exe.linux-riscv64': 12.10.1 + '@pnpm/exe.linux-s390x': 12.10.1 + '@pnpm/exe.linux-x64': 12.10.1 + '@pnpm/exe.linux-x64-musl': 12.10.1 + '@pnpm/exe.win32-arm64': 12.10.1 + '@pnpm/exe.win32-x64': 12.10.1 + +--- lockfileVersion: '9.0' settings: From 28efac69ef7d24e936c021a3fd955eeb428ecb63 Mon Sep 17 00:00:00 2001 From: Laith Al-Saadoon Date: Thu, 8 Oct 2026 15:36:18 +0000 Subject: [PATCH 3/5] chore(deps): site starlight 0.42.5 and vitest 5.0.3 The newest releases past the factory's 7-day cooldown. astro 7.3.7, @astrojs/markdown-remark 7.3.2, @astrojs/markdown-satteri 0.4.3 and @tabler/icons-astro 3.49.0 are younger than 7 days and stay held. The lockfile also resolves the optional @types/node peer to 24.19.0 (was 26.6.3). Co-Authored-By: Claude Sonnet 5.5 --- site/package.json | 4 +- site/pnpm-lock.yaml | 150 ++++++++++++++++++++------------------------ 2 files changed, 71 insertions(+), 83 deletions(-) diff --git a/site/package.json b/site/package.json index 8bff67b..34e4143 100644 --- a/site/package.json +++ b/site/package.json @@ -26,7 +26,7 @@ "dependencies": { "@astrojs/markdown-remark": "7.3.1", "@astrojs/markdown-satteri": "0.4.2", - "@astrojs/starlight": "0.42.4", + "@astrojs/starlight": "0.42.5", "@tabler/icons-astro": "3.48.0", "astro": "7.3.5", "beautiful-mermaid": "1.1.3", @@ -39,6 +39,6 @@ "devDependencies": { "@astrojs/check": "^0.9.10", "typescript": "~6.0.3", - "vitest": "5.0.2" + "vitest": "5.0.3" } } diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml index cb420d6..19e0ee3 100644 --- a/site/pnpm-lock.yaml +++ b/site/pnpm-lock.yaml @@ -173,14 +173,14 @@ importers: specifier: 0.4.2 version: 0.4.2 '@astrojs/starlight': - specifier: 0.42.4 - version: 0.42.4(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3) + specifier: 0.42.5 + version: 0.42.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3) '@tabler/icons-astro': specifier: 3.48.0 - version: 3.48.0(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1)) + version: 3.48.0(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1)) astro: specifier: 7.3.5 - version: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1) + version: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1) beautiful-mermaid: specifier: 1.1.3 version: 1.1.3 @@ -189,16 +189,16 @@ importers: version: 0.10.5 starlight-base-path: specifier: 0.2.1 - version: 0.2.1(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@astrojs/starlight@0.42.4(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1)) + version: 0.2.1(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@astrojs/starlight@0.42.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1)) starlight-links-validator: specifier: 0.26.0 - version: 0.26.0(@astrojs/starlight@0.42.4(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2) + version: 0.26.0(@astrojs/starlight@0.42.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2) starlight-llms-txt: specifier: 0.12.0 - version: 0.12.0(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@astrojs/markdown-satteri@0.4.2)(@astrojs/starlight@0.42.4(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2) + version: 0.12.0(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@astrojs/markdown-satteri@0.4.2)(@astrojs/starlight@0.42.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2) starlight-md-txt: specifier: 0.1.0 - version: 0.1.0(@astrojs/starlight@0.42.4(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2) + version: 0.1.0(@astrojs/starlight@0.42.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2) devDependencies: '@astrojs/check': specifier: ^0.9.10 @@ -207,8 +207,8 @@ importers: specifier: ~6.0.3 version: 6.0.3 vitest: - specifier: 5.0.2 - version: 5.0.2(@types/node@26.6.3)(vite@8.3.1(@types/node@26.6.3)(esbuild@0.28.2)(yaml@2.9.1)) + specifier: 5.0.3 + version: 5.0.3(@types/node@24.19.0)(vite@8.3.1(@types/node@24.19.0)(esbuild@0.28.2)(yaml@2.9.1)) packages: @@ -332,8 +332,8 @@ packages: '@astrojs/sitemap@3.7.4': resolution: {integrity: sha512-LbKNC24bdUWcQf/pThB6qLlSqHojxGjZDURIzFocY8rlWnAn2t74nnhnK6S5x0NHriHoAduLEpVjRykmeGiVvA==} - '@astrojs/starlight@0.42.4': - resolution: {integrity: sha512-EsQsqGJ1uTBQcIMojvLqqg4Ku9idwi6PSNuppIOoYmvVP18xjoUkijMdKoDkhmmwKdhbB4ctLhGjPRJzxaq+Jw==} + '@astrojs/starlight@0.42.5': + resolution: {integrity: sha512-S6hjUexk9rrKtjJF3WR8T9dM1woNR7X2XU8e3wj4OpRT4X15AXk/mzPjWe/Qd5+P8whHj2+ves+k06qirBzimg==} peerDependencies: '@astrojs/markdown-remark': ^7.3.0 astro: ^7.2.10 @@ -1046,9 +1046,6 @@ packages: '@types/node@24.19.0': resolution: {integrity: sha512-zY+5tKxXdhGh1PYI0ac+7juvEu4OI6vWtVVoj5i2m42jxAY1U+zHGt6QCyOFwykdP62sM3MJ9stoYYUw5aCWew==} - '@types/node@26.6.3': - resolution: {integrity: sha512-dsqMQQoeTLqu9wynDD00q573mNzso3IdQOAfHRJqLCcmCFPoGo9A1bDpUcv/9tnKpErQWv9uKeGfl37EIS02Yg==} - '@types/picomatch@4.0.3': resolution: {integrity: sha512-iG0T6+nYJ9FAPmx9SsUlnwcq1ZVRuCXcVEvWnntoPlrOpwtSTKNDC9uVAxTsC3PUvJ+99n4RpAcNgBbHX3JSnQ==} @@ -1064,8 +1061,8 @@ packages: '@ungap/structured-clone@1.4.0': resolution: {integrity: sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ==} - '@vitest/mocker@5.0.2': - resolution: {integrity: sha512-Z5FS00Q1SJHkB35xATsmWGdQ5WA1/0MV3CDjqyv7GavHv1OfOj145MNfHOlHk7QLes21dKFDHr8EO2zvL+9WGA==} + '@vitest/mocker@5.0.3': + resolution: {integrity: sha512-T8sWAIbkSyAjkwTcaEc3Iu0o9A27X1/kdXrizhZkGuSKScRQtRzclfAMpOTcGdXCsqxeWlpGy3XjqaW8CpLORg==} peerDependencies: msw: ^2.4.9 vite: ^6.0.0 || ^7.0.0 || ^8.0.0 @@ -1075,8 +1072,8 @@ packages: vite: optional: true - '@vitest/spy@5.0.2': - resolution: {integrity: sha512-Ijc7T1nT9efNb5LxvjaBrEqw3f/QwUv5EE0nKqZxgqsaV/FxAAZ8baGylA8X/Z2oS4Lp+K74Jr6dTJsDKxJDeg==} + '@vitest/spy@5.0.3': + resolution: {integrity: sha512-XhFysQTB8AZ+P4gMi+Lpo99vg2AZi0qKpaB9yXQl37+CaMEAPO3iH/wGVnSyL5MPERiLezpqTVtrR6UZH5GCXg==} '@volar/kit@2.4.28': resolution: {integrity: sha512-cKX4vK9dtZvDRaAzeoUdaAJEew6IdxHNCRrdp5Kvcl6zZOqb6jTOfk3kXkIkG3T7oTFXguEMt5+9ptyqYR84Pg==} @@ -2343,9 +2340,6 @@ packages: undici-types@7.24.6: resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==} - undici-types@8.9.0: - resolution: {integrity: sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==} - undici@8.11.2: resolution: {integrity: sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==} engines: {node: '>=22.19.0'} @@ -2522,20 +2516,20 @@ packages: vite: optional: true - vitest@5.0.2: - resolution: {integrity: sha512-7MQrx9pDv5aHiUcovIb/70Ys3tgtkUVgCtledvKdCmEO+/1Dicq5ZqoSxOW034m03oqC+oHOKui2dM6qtMLoJg==} + vitest@5.0.3: + resolution: {integrity: sha512-xMw97S3rjdtj5dkVat7jCsqWBpvchs3RlpQctUqwJD0KkERk40vz2fJ77lDwW/Vzh/pk18eItYAzkodhSes3jQ==} engines: {node: ^22.12.0 || ^24.0.0 || >=26.0.0} hasBin: true peerDependencies: '@edge-runtime/vm': '*' '@opentelemetry/api': ^1.9.0 '@types/node': ^22.0.0 || >=24.0.0 - '@vitest/browser-playwright': 5.0.2 - '@vitest/browser-preview': 5.0.2 + '@vitest/browser-playwright': 5.0.3 + '@vitest/browser-preview': 5.0.3 '@vitest/browser-webdriverio': ^5.0.0-beta.5 || >=5.0.0 - '@vitest/coverage-istanbul': 5.0.2 - '@vitest/coverage-v8': 5.0.2 - '@vitest/ui': 5.0.2 + '@vitest/coverage-istanbul': 5.0.3 + '@vitest/coverage-v8': 5.0.3 + '@vitest/ui': 5.0.3 happy-dom: '*' jsdom: '*' vite: ^6.4.0 || ^7.0.0 || ^8.0.0 @@ -2674,8 +2668,8 @@ packages: web-namespaces@2.0.1: resolution: {integrity: sha512-bKr1DkiNa2krS7qxNtdrtHAmzuYGFQLiQ13TsorsdT6ULTkPLKuu5+GsFpDlg6JFjUTwX2DyhMPG2be8uPrqsQ==} - why-is-node-running@3.2.2: - resolution: {integrity: sha512-NKUzAelcoCXhXL4dJzKIwXeR8iEVqsA0Lq6Vnd0UXvgaKbzVo4ZTHROF2Jidrv+SgxOQ03fMinnNhzZATxOD3A==} + why-is-node-running@3.2.1: + resolution: {integrity: sha512-Tb2FUhB4vUsGQlfSquQLYkApkuPAFQXGFzxWKHHumVz2dK+X1RUm/HnID4+TfIGYJ1kTcwOaCk/buYCEJr6YjQ==} engines: {node: '>=20.11'} hasBin: true @@ -2864,11 +2858,11 @@ snapshots: github-slugger: 2.0.0 satteri: 0.10.5 - '@astrojs/mdx@8.0.2(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@astrojs/markdown-satteri@0.4.2)(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))': + '@astrojs/mdx@8.0.2(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@astrojs/markdown-satteri@0.4.2)(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))': dependencies: '@astrojs/internal-helpers': 0.11.0 '@astrojs/markdown-satteri': 0.4.2 - astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1) + astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1) es-module-lexer: 2.3.2 optionalDependencies: '@astrojs/markdown-remark': 7.3.1(supports-color@10.2.2) @@ -2882,17 +2876,17 @@ snapshots: sitemap: 9.0.1 zod: 4.6.5 - '@astrojs/starlight@0.42.4(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3)': + '@astrojs/starlight@0.42.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3)': dependencies: '@astrojs/markdown-satteri': 0.4.2 - '@astrojs/mdx': 8.0.2(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@astrojs/markdown-satteri@0.4.2)(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1)) + '@astrojs/mdx': 8.0.2(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@astrojs/markdown-satteri@0.4.2)(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1)) '@astrojs/sitemap': 3.7.4 '@pagefind/default-ui': 1.5.2 '@types/hast': 3.0.5 '@types/js-yaml': 4.0.9 '@types/mdast': 4.0.4 - astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1) - astro-expressive-code: 0.44.2(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1)) + astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1) + astro-expressive-code: 0.44.2(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1)) bcp-47: 2.1.1 hast-util-format: 1.1.0 hast-util-select: 6.0.4 @@ -3420,10 +3414,10 @@ snapshots: '@shikijs/vscode-textmate@10.0.2': {} - '@tabler/icons-astro@3.48.0(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))': + '@tabler/icons-astro@3.48.0(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))': dependencies: '@tabler/icons': 3.48.0 - astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1) + astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1) '@tabler/icons@3.48.0': {} @@ -3476,15 +3470,11 @@ snapshots: dependencies: undici-types: 7.24.6 - '@types/node@26.6.3': - dependencies: - undici-types: 8.9.0 - '@types/picomatch@4.0.3': {} '@types/sax@1.2.7': dependencies: - '@types/node': 26.6.3 + '@types/node': 24.19.0 '@types/unist@2.0.11': {} @@ -3492,16 +3482,16 @@ snapshots: '@ungap/structured-clone@1.4.0': {} - '@vitest/mocker@5.0.2(vite@8.3.1(@types/node@26.6.3)(esbuild@0.28.2)(yaml@2.9.1))': + '@vitest/mocker@5.0.3(vite@8.3.1(@types/node@24.19.0)(esbuild@0.28.2)(yaml@2.9.1))': dependencies: '@jridgewell/trace-mapping': 0.3.31 - '@vitest/spy': 5.0.2 + '@vitest/spy': 5.0.3 estree-walker: 3.0.3 magic-string: 1.4.2 optionalDependencies: - vite: 8.3.1(@types/node@26.6.3)(esbuild@0.28.2)(yaml@2.9.1) + vite: 8.3.1(@types/node@24.19.0)(esbuild@0.28.2)(yaml@2.9.1) - '@vitest/spy@5.0.2': {} + '@vitest/spy@5.0.3': {} '@volar/kit@2.4.28(typescript@6.0.3)': dependencies: @@ -3609,13 +3599,13 @@ snapshots: astring@1.9.0: {} - astro-expressive-code@0.44.2(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1)): + astro-expressive-code@0.44.2(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1)): dependencies: - astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1) + astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1) rehype-expressive-code: 0.44.2 url-extras: 0.1.0 - astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1): + astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1): dependencies: '@astrojs/compiler-rs': 0.5.1 '@astrojs/internal-helpers': 0.11.0 @@ -3665,14 +3655,14 @@ snapshots: unifont: 0.7.5 unstorage: 1.17.5 verkit: 0.4.1 - vite: 8.3.1(@types/node@26.6.3)(esbuild@0.28.2)(yaml@2.9.1) - vitefu: 1.1.3(vite@8.3.1(@types/node@26.6.3)(esbuild@0.28.2)(yaml@2.9.1)) + vite: 8.3.1(@types/node@24.19.0)(esbuild@0.28.2)(yaml@2.9.1) + vitefu: 1.1.3(vite@8.3.1(@types/node@24.19.0)(esbuild@0.28.2)(yaml@2.9.1)) xxhash-wasm: 1.1.0 yargs-parser: 22.0.0 zod: 4.6.5 optionalDependencies: '@astrojs/markdown-remark': 7.3.1(supports-color@10.2.2) - sharp: 0.35.4(@types/node@26.6.3) + sharp: 0.35.4(@types/node@24.19.0) transitivePeerDependencies: - '@azure/app-configuration' - '@azure/cosmos' @@ -5161,7 +5151,7 @@ snapshots: semver@7.8.5: {} - sharp@0.35.4(@types/node@26.6.3): + sharp@0.35.4(@types/node@24.19.0): dependencies: '@img/colour': 1.1.0 detect-libc: 2.1.2 @@ -5192,7 +5182,7 @@ snapshots: '@img/sharp-win32-arm64': 0.35.4 '@img/sharp-win32-ia32': 0.35.4 '@img/sharp-win32-x64': 0.35.4 - '@types/node': 26.6.3 + '@types/node': 24.19.0 optional: true shiki@4.4.3: @@ -5223,20 +5213,20 @@ snapshots: space-separated-tokens@2.0.2: {} - starlight-base-path@0.2.1(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@astrojs/starlight@0.42.4(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1)): + starlight-base-path@0.2.1(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@astrojs/starlight@0.42.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1)): dependencies: - '@astrojs/starlight': 0.42.4(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3) - astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1) + '@astrojs/starlight': 0.42.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3) + astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1) unist-util-visit: 5.1.0 optionalDependencies: '@astrojs/markdown-remark': 7.3.1(supports-color@10.2.2) - starlight-links-validator@0.26.0(@astrojs/starlight@0.42.4(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2): + starlight-links-validator@0.26.0(@astrojs/starlight@0.42.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2): dependencies: '@astrojs/markdown-satteri': 0.4.2 - '@astrojs/starlight': 0.42.4(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3) + '@astrojs/starlight': 0.42.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3) '@types/picomatch': 4.0.3 - astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1) + astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1) github-slugger: 2.0.0 hast-util-from-html: 2.0.3 is-absolute-url: 5.0.0 @@ -5250,13 +5240,13 @@ snapshots: transitivePeerDependencies: - supports-color - starlight-llms-txt@0.12.0(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@astrojs/markdown-satteri@0.4.2)(@astrojs/starlight@0.42.4(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2): + starlight-llms-txt@0.12.0(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@astrojs/markdown-satteri@0.4.2)(@astrojs/starlight@0.42.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2): dependencies: - '@astrojs/mdx': 8.0.2(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@astrojs/markdown-satteri@0.4.2)(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1)) - '@astrojs/starlight': 0.42.4(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3) + '@astrojs/mdx': 8.0.2(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@astrojs/markdown-satteri@0.4.2)(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1)) + '@astrojs/starlight': 0.42.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3) '@types/hast': 3.0.5 '@types/micromatch': 4.0.10 - astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1) + astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1) github-slugger: 2.0.0 hast-util-select: 6.0.4 micromatch: 4.0.8 @@ -5271,10 +5261,10 @@ snapshots: - '@astrojs/markdown-satteri' - supports-color - starlight-md-txt@0.1.0(@astrojs/starlight@0.42.4(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2): + starlight-md-txt@0.1.0(@astrojs/starlight@0.42.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2): dependencies: - '@astrojs/starlight': 0.42.4(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3) - astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@26.6.3)(yaml@2.9.1) + '@astrojs/starlight': 0.42.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(astro@7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1))(supports-color@10.2.2)(typescript@6.0.3) + astro: 7.3.5(@astrojs/markdown-remark@7.3.1(supports-color@10.2.2))(@types/node@24.19.0)(yaml@2.9.1) remark-mdx: 3.1.1(supports-color@10.2.2) remark-parse: 11.0.0(supports-color@10.2.2) remark-stringify: 11.0.0 @@ -5376,8 +5366,6 @@ snapshots: undici-types@7.24.6: {} - undici-types@8.9.0: {} - undici@8.11.2: {} unified@11.0.5: @@ -5480,7 +5468,7 @@ snapshots: '@types/unist': 3.0.3 vfile-message: 4.0.3 - vite@8.3.1(@types/node@26.6.3)(esbuild@0.28.2)(yaml@2.9.1): + vite@8.3.1(@types/node@24.19.0)(esbuild@0.28.2)(yaml@2.9.1): dependencies: lightningcss: 1.33.0 picomatch: 4.0.7 @@ -5488,19 +5476,19 @@ snapshots: rolldown: 1.2.11 tinyglobby: 0.2.17 optionalDependencies: - '@types/node': 26.6.3 + '@types/node': 24.19.0 esbuild: 0.28.2 fsevents: 2.3.3 yaml: 2.9.1 - vitefu@1.1.3(vite@8.3.1(@types/node@26.6.3)(esbuild@0.28.2)(yaml@2.9.1)): + vitefu@1.1.3(vite@8.3.1(@types/node@24.19.0)(esbuild@0.28.2)(yaml@2.9.1)): optionalDependencies: - vite: 8.3.1(@types/node@26.6.3)(esbuild@0.28.2)(yaml@2.9.1) + vite: 8.3.1(@types/node@24.19.0)(esbuild@0.28.2)(yaml@2.9.1) - vitest@5.0.2(@types/node@26.6.3)(vite@8.3.1(@types/node@26.6.3)(esbuild@0.28.2)(yaml@2.9.1)): + vitest@5.0.3(@types/node@24.19.0)(vite@8.3.1(@types/node@24.19.0)(esbuild@0.28.2)(yaml@2.9.1)): dependencies: '@types/chai': 5.2.3 - '@vitest/mocker': 5.0.2(vite@8.3.1(@types/node@26.6.3)(esbuild@0.28.2)(yaml@2.9.1)) + '@vitest/mocker': 5.0.3(vite@8.3.1(@types/node@24.19.0)(esbuild@0.28.2)(yaml@2.9.1)) chai: 6.2.2 es-module-lexer: 2.3.2 expect-type: 1.4.0 @@ -5511,10 +5499,10 @@ snapshots: tinybench: 6.2.0 tinyexec: 1.3.1 tinyglobby: 0.2.17 - vite: 8.3.1(@types/node@26.6.3)(esbuild@0.28.2)(yaml@2.9.1) - why-is-node-running: 3.2.2 + vite: 8.3.1(@types/node@24.19.0)(esbuild@0.28.2)(yaml@2.9.1) + why-is-node-running: 3.2.1 optionalDependencies: - '@types/node': 26.6.3 + '@types/node': 24.19.0 transitivePeerDependencies: - msw @@ -5628,7 +5616,7 @@ snapshots: web-namespaces@2.0.1: {} - why-is-node-running@3.2.2: {} + why-is-node-running@3.2.1: {} wrap-ansi@9.0.2: dependencies: From 692672449535a3d5428430223b6fdf61b78eb1a6 Mon Sep 17 00:00:00 2001 From: Laith Al-Saadoon Date: Thu, 8 Oct 2026 17:38:18 +0000 Subject: [PATCH 4/5] chore(deps): site sharp 0.35.5 and source-map-js 1.2.2 pnpm update sharp source-map-js --depth 99 moves the two transitive packages inside the ranges their parents (astro, css-tree) already admit, so no pnpm.overrides entry is needed. sharp 0.35.5 carries libvips 1.3.4 and clears GHSA-wq5f-xc86-pv6w (librsvg CVE-2026-96889); source-map-js 1.2.2 clears CVE-2026-93749. Co-Authored-By: Claude Sonnet 5.5 --- site/pnpm-lock.yaml | 252 ++++++++++++++++++++++---------------------- 1 file changed, 126 insertions(+), 126 deletions(-) diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml index 19e0ee3..2c51488 100644 --- a/site/pnpm-lock.yaml +++ b/site/pnpm-lock.yaml @@ -641,160 +641,160 @@ packages: resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==} engines: {node: '>=18'} - '@img/sharp-darwin-arm64@0.35.4': - resolution: {integrity: sha512-Uhfl4V4lhP2nbUVF9+hyH1+luj86f1gUFeo8ALYxFoULoU+G87D43BfeMP8XHsk9boxAnCY/bf2EHwhA7MuGsA==} + '@img/sharp-darwin-arm64@0.35.5': + resolution: {integrity: sha512-QRUlFQ0WxvdWyqqG/WtI3iupfD5rBzmCHXSdPsY91sAtVtTo7Q4cb6zOccZ3gqEqkr0f1As1ehLqmEpDsRf+lg==} engines: {node: '>=20.9.0'} cpu: [arm64] os: [darwin] - '@img/sharp-darwin-x64@0.35.4': - resolution: {integrity: sha512-hWniXY3bG5qKpkKrAwPe4y+VTPmf086YQAnkxWh7uA1YrlRouWGa0M0Mxj3ZjnXFkv7/TD1bTy9lGUK26vRvWw==} + '@img/sharp-darwin-x64@0.35.5': + resolution: {integrity: sha512-+BR255RhDlpygUpOc/Jdt1nT6DQ3XG/ERo5wbcdOf5Q320dKtPCKPLR1LJs9VGXRaMa8l1uUa0tkCNOXiAxZUw==} engines: {node: '>=20.9.0'} cpu: [x64] os: [darwin] - '@img/sharp-freebsd-wasm32@0.35.4': - resolution: {integrity: sha512-lIsKw/BU+kjB4eZjxrYrZmwOJYi3Ajrv66iAlBmUPyKc3HpnloevB1g3wxGD9P/5BbQ1brBGl65VRRrCvQDEqA==} + '@img/sharp-freebsd-wasm32@0.35.5': + resolution: {integrity: sha512-Y/z91nEZ4uIBX5X3nfTovjU9lHNKFYbL2lpHCLVNmXQK03VIZvXBBt0KxbPGp2SdGSF+2mQU4e+hQaWOt86iAw==} engines: {node: '>=20.9.0'} os: [freebsd] - '@img/sharp-libvips-darwin-arm64@1.3.3': - resolution: {integrity: sha512-suTBPTDGrI9WodccaDdwZItTSaBYASlBk1NSfElSHrUfzu3szG6lvIF58+WiFvnfzuK8ZBFS5zE00PxqxnRiPg==} + '@img/sharp-libvips-darwin-arm64@1.3.4': + resolution: {integrity: sha512-5R89nBYiRdUlSWJxPhO+GVtaXzXSxKnRu/xqMn3KTA3L9EB9Oy/P+Nn2f2vlhPuUdy/Zusb2DarbyTpGCfEDuw==} cpu: [arm64] os: [darwin] - '@img/sharp-libvips-darwin-x64@1.3.3': - resolution: {integrity: sha512-FVJZ5mITMobmXIz/hPDTw0EintTW5H3WfrxwLqEqjiIihlu+hVRyGrFQ60xl0Lxn7Bt3zdpevPaQi0HEzqz9fw==} + '@img/sharp-libvips-darwin-x64@1.3.4': + resolution: {integrity: sha512-iR2OKH80yi0U+dUplyh3/xdpFvps6YkCwsXenIJxqxR1v9o+xtKTGbS9H7cps+2Vxjc8B1j96p75NmTGjIhtpQ==} cpu: [x64] os: [darwin] - '@img/sharp-libvips-linux-arm64@1.3.3': - resolution: {integrity: sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A==} + '@img/sharp-libvips-linux-arm64@1.3.4': + resolution: {integrity: sha512-Y3dgX/6lE2QhQb+Gxy0WZxfg9MEm/JBjamZpS2IklP7xIQoKN4hzAm7KcMVGtaVDt3neE9OKBC7vAfonA/Lr1A==} cpu: [arm64] os: [linux] libc: [glibc] - '@img/sharp-libvips-linux-arm@1.3.3': - resolution: {integrity: sha512-3rbU4vqXXc3hY/OiXdl52xZvT0F1yEngWfvqudtPJg/KkyiaQw2DRsFrNzpmLvfavbwOq3qXn36GP8obHRULQA==} + '@img/sharp-libvips-linux-arm@1.3.4': + resolution: {integrity: sha512-LmRtTsOHuvM2+wlO2Db37dx5MiZhB0FvSunciw48YjdOkZz9KAiRbm8ujeMOA1INqmei5NapFxYEK1D1ZSidmw==} cpu: [arm] os: [linux] libc: [glibc] - '@img/sharp-libvips-linux-ppc64@1.3.3': - resolution: {integrity: sha512-cdn1OvUBwsXhbC0zSzJnNzf5MZ/mTrobawDvNXBTxe8VtqKAm0sRuEY2Evzovb/w9JMk4TvRxqt1mekSuJz64w==} + '@img/sharp-libvips-linux-ppc64@1.3.4': + resolution: {integrity: sha512-Le6boB8Tai0Nis+gIxIpKx68UDVVIqdR8Tin5Yf1z2LJJQLDJvCDRqRu+jC2qCoD+eIomonmOwB4smBRxfVpYQ==} cpu: [ppc64] os: [linux] libc: [glibc] - '@img/sharp-libvips-linux-riscv64@1.3.3': - resolution: {integrity: sha512-HjPVx7yKz+0lqdhDlTw1tt90wamBoxhiXpvl1XZpJLiHH4RCJ5yDTqH+VlYPv2fwFs89JFw4c1IexYOcQUi4IQ==} + '@img/sharp-libvips-linux-riscv64@1.3.4': + resolution: {integrity: sha512-aHkkIEHPRdQEegJN20MLmGtxYD9R2wQr3Cwpddnu5+YKMt6Uzax7S9h5gpZTo8wyrGuZSlfQ63OevL5mTyOC7Q==} cpu: [riscv64] os: [linux] libc: [glibc] - '@img/sharp-libvips-linux-s390x@1.3.3': - resolution: {integrity: sha512-neWLh+3yCNThxnfy3c4BbVBeGgt9aftno+XbT56iK28RgeDs3UOFWviLWlUu0bArYVYJaFDK+RRohbicUNCm8Q==} + '@img/sharp-libvips-linux-s390x@1.3.4': + resolution: {integrity: sha512-ra/mB6MikESDUO7Yg+Mi95bFBb9GsObURuhnOv3OqknjGe9sZrG8tCe9q0xSIGrtLgvgw0gKnFWcK4blSgQOuQ==} cpu: [s390x] os: [linux] libc: [glibc] - '@img/sharp-libvips-linux-x64@1.3.3': - resolution: {integrity: sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA==} + '@img/sharp-libvips-linux-x64@1.3.4': + resolution: {integrity: sha512-GJ//SSXbnwSDes02umB3nDJLFcQzw8a18V8fyhqr6tV515tOEMdImjjxj1AoafMRz56F3PHgftnj1QEKSU1zkw==} cpu: [x64] os: [linux] libc: [glibc] - '@img/sharp-libvips-linuxmusl-arm64@1.3.3': - resolution: {integrity: sha512-Y9kQaLMuNoB0bPYOOdcZMaseNrFpPodIWWMrx+CZyydf2xn68j9WYc6sWWRrDwNkzCQjKYfc68L7jKjGlHMibw==} + '@img/sharp-libvips-linuxmusl-arm64@1.3.4': + resolution: {integrity: sha512-hvulFwtjUcagsis6BBxHwGFwWoNZjgYmULGVrZcyfNbjA8hKILbRxGg15/7w5HDyXHXUos/j6baAWqnCyQ2DWA==} cpu: [arm64] os: [linux] libc: [musl] - '@img/sharp-libvips-linuxmusl-x64@1.3.3': - resolution: {integrity: sha512-fj8Mv0HHfD1Rr+4I68+3agJynxDWtBFgicTbSOb9Bke6pIwzGcJ+RX/yHjmiEGFMCavY/dxvem7MyNaJF+wDiw==} + '@img/sharp-libvips-linuxmusl-x64@1.3.4': + resolution: {integrity: sha512-6zXKeE/p39I1AmA3cJG35eyBGNqNddLnUXjhwBnsGjFPWqf5VKkDBEqaEkPDoTEtkxwi2vv8Tcr2mDyP4So7Fg==} cpu: [x64] os: [linux] libc: [musl] - '@img/sharp-linux-arm64@0.35.4': - resolution: {integrity: sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ==} + '@img/sharp-linux-arm64@0.35.5': + resolution: {integrity: sha512-LYVx5JTsOM2CBzmxreh+nl64/3H6Xb09iSLknqH47z2T2DFFxDeFLP5y4dJwe6H7uGQlHPyEEtIqyo3DYsRwdQ==} engines: {node: '>=20.9.0'} cpu: [arm64] os: [linux] libc: [glibc] - '@img/sharp-linux-arm@0.35.4': - resolution: {integrity: sha512-7OAS8gI0EReKGVN2HssHlM6umJgxF5VI3xN0p9FA91p/YO+ou5hiNghLdZ5BEHztwaaK5+bLKRf8x/o2L2nk9A==} + '@img/sharp-linux-arm@0.35.5': + resolution: {integrity: sha512-LEaXK2WdXVK5ykcw0buWyPMsmLLL2vpHLD6yrNSW+JGEL3BZPA4tpKN6iaMc4AxTTAoaX/sU1rOL51lcIz48ZQ==} engines: {node: '>=20.9.0'} cpu: [arm] os: [linux] libc: [glibc] - '@img/sharp-linux-ppc64@0.35.4': - resolution: {integrity: sha512-2oYZJeIl4kCcMGk4ouZVjnkCtFrpQFlNEtJ6GbxzhHQchwH0NH/qEb9ykmOl29dqwMq+JhFdZn+1ak2FKhI9fQ==} + '@img/sharp-linux-ppc64@0.35.5': + resolution: {integrity: sha512-QVxAAq8evVRI9ia2vqgwrmWucn5Dfv+JdWzj75pD8omHLPSP7f8p20O8jxzjCcuCEQEOtYOZUmX1hkiZ0kdevA==} engines: {node: '>=20.9.0'} cpu: [ppc64] os: [linux] libc: [glibc] - '@img/sharp-linux-riscv64@0.35.4': - resolution: {integrity: sha512-cPbNChoRURAWdebDIHSenxRpgEdy7JkPydSnUxRm9VvKD7m0/xVaR/8Fzlu81pk5nHEvHH87UZUA7cTtwnbJSA==} + '@img/sharp-linux-riscv64@0.35.5': + resolution: {integrity: sha512-LtdreXguaavKODPIfzJ4kffx7UNt1omwtK0rch4EBbbSTXPnxWmYSayXdLJw0fJzQ97kHt1gL/yh4tvU+nCyRQ==} engines: {node: '>=20.9.0'} cpu: [riscv64] os: [linux] libc: [glibc] - '@img/sharp-linux-s390x@0.35.4': - resolution: {integrity: sha512-RY0JFY8Fd6RonCBtHz+DvadaPkXDSI1AUn6yWL9TipqkZ1vY8w8evqdgyDFnkm4/K1ve1TvZiaePP5oSd4+WVQ==} + '@img/sharp-linux-s390x@0.35.5': + resolution: {integrity: sha512-UZasTOFiYzotTsGOCu42BfUzP6Tu6Do/947iRm1RsLKvlllxwGcn4RN27LibGWceix4Y+Pmw3jsnTcCQIgWjqA==} engines: {node: '>=20.9.0'} cpu: [s390x] os: [linux] libc: [glibc] - '@img/sharp-linux-x64@0.35.4': - resolution: {integrity: sha512-9qvvEAuk8k89TfWUoX2htWjbAMX8p+NxCppjpcg5k6xMsjhBQPTsoIh36h9Qde4WRuGpJeYnOjdosDn/cnv+OA==} + '@img/sharp-linux-x64@0.35.5': + resolution: {integrity: sha512-SxFtLTeJInhAA9Q836kux2vZNeOBQEx658qvbboZScr0wIARym3IcGmW7KpVD5sbVg0Ojy+udFQdayYIZyoNog==} engines: {node: '>=20.9.0'} cpu: [x64] os: [linux] libc: [glibc] - '@img/sharp-linuxmusl-arm64@0.35.4': - resolution: {integrity: sha512-KB5jxpfWQTr0nc3xdHtWChdbifHrBGsd2SM62Eyxrl8afikm+f5qGBU75SJIZBT/S1MC8XyacdlXBMSWq6OURA==} + '@img/sharp-linuxmusl-arm64@0.35.5': + resolution: {integrity: sha512-9HbMclmI1zlNkFRs3z9/eBtDjfD0sGlrX1z6b1qwmiFY5ElDLh4BC0LPBdVp7z1DXFiKlIcznf+ZlsuZzLxQqg==} engines: {node: '>=20.9.0'} cpu: [arm64] os: [linux] libc: [musl] - '@img/sharp-linuxmusl-x64@0.35.4': - resolution: {integrity: sha512-f+eZJZIQNEEd26RPSW+76chwOf1XtA2Y/O+5ocVyLliHkeih3e+jhLVBdNTd2rS3IbNXK8+ug93Vf5ZXtF5Lxg==} + '@img/sharp-linuxmusl-x64@0.35.5': + resolution: {integrity: sha512-4KOphqB035HrVdqLZfCgMzzERrQkkzOwRhl4OAkRO1YCldbaFjySXMaK534Mo0V+LndnlJk+sbUyLeU0ULyD1A==} engines: {node: '>=20.9.0'} cpu: [x64] os: [linux] libc: [musl] - '@img/sharp-wasm32@0.35.4': - resolution: {integrity: sha512-zQnl4Kwp7Q6NHsENtU2T/00Zi+w3AQNwz3+UaTyVBy2FpXrzXzGjndpK61onhZjRtRpQXxCTeqw19bVyXOh7jA==} + '@img/sharp-wasm32@0.35.5': + resolution: {integrity: sha512-Ptsga1su4tQx+LLF1ECS9U6nz5kmrXKo6XVbtR48Ke3ZRxxgaWBu7IDtEe1quo8hiupwm6WFqxVlXaSf7IINGQ==} engines: {node: '>=20.9.0'} - '@img/sharp-webcontainers-wasm32@0.35.4': - resolution: {integrity: sha512-ESfNkywmCfPNyaZjxooddJQiQ+l/nTpGEOGthxiLnIHXC/CmcBixnfwUleX9mCz9ovrUUvKMap/pm8RYbzfwaA==} + '@img/sharp-webcontainers-wasm32@0.35.5': + resolution: {integrity: sha512-hfhF/FmoQyTUkA0bIKFOtw536BQSeBMe6BF6QyWlrPxT754+TFLaZ7sKKTfvvM0yJgKgaYTwnFCIZ/GuDw5SUA==} engines: {node: '>=20.9.0'} cpu: [wasm32] - '@img/sharp-win32-arm64@0.35.4': - resolution: {integrity: sha512-iNdlBX9gLVvqe2I3uIJSIKTq6wckP/DYxZtcqxm09x5Gi24DnFBmPAWZmr60ZyYMG0xlzo6goG3670ar+RXvRw==} + '@img/sharp-win32-arm64@0.35.5': + resolution: {integrity: sha512-X4t7g+7ZA5DKblCBEXGjUqqemj4vczING/5viFwAL8h4N3qYeyjwdCvRLHi4EdOUI+2Z7UFlp1VM+p/AuEtm6Q==} engines: {node: '>=20.9.0'} cpu: [arm64] os: [win32] - '@img/sharp-win32-ia32@0.35.4': - resolution: {integrity: sha512-kqRsbaa5CS6KHlpxnN7WhE6vAAugXyZButpRdvDWetlv6Qv4N9WTcrWzF7tXfB9T7MsoadqdI8hmwLq6UlLvtw==} + '@img/sharp-win32-ia32@0.35.5': + resolution: {integrity: sha512-5Zm82LoBc43nhwNybZlG7Y1KO//Zhsn306fQl29ZOuStHLGTo3BWL83q3cznX0poxSAMuYL1On/BHBxkBeKr6A==} engines: {node: ^20.9.0} cpu: [ia32] os: [win32] - '@img/sharp-win32-x64@0.35.4': - resolution: {integrity: sha512-XtmnYhBcrORsJ4XJngyzr/EWP0hRZLAZRFaApdKuviyqF78+ylxh2y06ZmtULAMOnObJ3ucpN0AcwSWnMowTRg==} + '@img/sharp-win32-x64@0.35.5': + resolution: {integrity: sha512-x76eH0vEiHlcMQu8Y8IenntaACtddpT6W0wmXtWrnKcnKI7ME5DdgqhAD6SEWOEl1v2zDvkZDhFA9KnURwpfqg==} engines: {node: '>=20.9.0'} cpu: [x64] os: [win32] @@ -2176,8 +2176,8 @@ packages: engines: {node: '>=10'} hasBin: true - sharp@0.35.4: - resolution: {integrity: sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA==} + sharp@0.35.5: + resolution: {integrity: sha512-Ywn4OnzGukp7CDMrp08RQ50YKmuwG47brZgIVPTvBaaAfQlRlygrRqSrxdCiL9M+LlzLBiJ68IR1QqvzHyjC7g==} engines: {node: '>=20.9.0'} peerDependencies: '@types/node': '*' @@ -2201,8 +2201,8 @@ packages: resolution: {integrity: sha512-hpd+HLON7HdZXqYchMM/+LaTTbdK0AU3NngIJ4KVyWbY9bfQqdL9cD+4yf6dUoU2Ap4VsU0JkQi6FxAI1B2mXQ==} engines: {node: '>= 18'} - source-map-js@1.2.1: - resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} + source-map-js@1.2.2: + resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==} engines: {node: '>=0.10.0'} source-map@0.7.6: @@ -3144,108 +3144,108 @@ snapshots: '@img/colour@1.1.0': optional: true - '@img/sharp-darwin-arm64@0.35.4': + '@img/sharp-darwin-arm64@0.35.5': optionalDependencies: - '@img/sharp-libvips-darwin-arm64': 1.3.3 + '@img/sharp-libvips-darwin-arm64': 1.3.4 optional: true - '@img/sharp-darwin-x64@0.35.4': + '@img/sharp-darwin-x64@0.35.5': optionalDependencies: - '@img/sharp-libvips-darwin-x64': 1.3.3 + '@img/sharp-libvips-darwin-x64': 1.3.4 optional: true - '@img/sharp-freebsd-wasm32@0.35.4': + '@img/sharp-freebsd-wasm32@0.35.5': dependencies: - '@img/sharp-wasm32': 0.35.4 + '@img/sharp-wasm32': 0.35.5 optional: true - '@img/sharp-libvips-darwin-arm64@1.3.3': + '@img/sharp-libvips-darwin-arm64@1.3.4': optional: true - '@img/sharp-libvips-darwin-x64@1.3.3': + '@img/sharp-libvips-darwin-x64@1.3.4': optional: true - '@img/sharp-libvips-linux-arm64@1.3.3': + '@img/sharp-libvips-linux-arm64@1.3.4': optional: true - '@img/sharp-libvips-linux-arm@1.3.3': + '@img/sharp-libvips-linux-arm@1.3.4': optional: true - '@img/sharp-libvips-linux-ppc64@1.3.3': + '@img/sharp-libvips-linux-ppc64@1.3.4': optional: true - '@img/sharp-libvips-linux-riscv64@1.3.3': + '@img/sharp-libvips-linux-riscv64@1.3.4': optional: true - '@img/sharp-libvips-linux-s390x@1.3.3': + '@img/sharp-libvips-linux-s390x@1.3.4': optional: true - '@img/sharp-libvips-linux-x64@1.3.3': + '@img/sharp-libvips-linux-x64@1.3.4': optional: true - '@img/sharp-libvips-linuxmusl-arm64@1.3.3': + '@img/sharp-libvips-linuxmusl-arm64@1.3.4': optional: true - '@img/sharp-libvips-linuxmusl-x64@1.3.3': + '@img/sharp-libvips-linuxmusl-x64@1.3.4': optional: true - '@img/sharp-linux-arm64@0.35.4': + '@img/sharp-linux-arm64@0.35.5': optionalDependencies: - '@img/sharp-libvips-linux-arm64': 1.3.3 + '@img/sharp-libvips-linux-arm64': 1.3.4 optional: true - '@img/sharp-linux-arm@0.35.4': + '@img/sharp-linux-arm@0.35.5': optionalDependencies: - '@img/sharp-libvips-linux-arm': 1.3.3 + '@img/sharp-libvips-linux-arm': 1.3.4 optional: true - '@img/sharp-linux-ppc64@0.35.4': + '@img/sharp-linux-ppc64@0.35.5': optionalDependencies: - '@img/sharp-libvips-linux-ppc64': 1.3.3 + '@img/sharp-libvips-linux-ppc64': 1.3.4 optional: true - '@img/sharp-linux-riscv64@0.35.4': + '@img/sharp-linux-riscv64@0.35.5': optionalDependencies: - '@img/sharp-libvips-linux-riscv64': 1.3.3 + '@img/sharp-libvips-linux-riscv64': 1.3.4 optional: true - '@img/sharp-linux-s390x@0.35.4': + '@img/sharp-linux-s390x@0.35.5': optionalDependencies: - '@img/sharp-libvips-linux-s390x': 1.3.3 + '@img/sharp-libvips-linux-s390x': 1.3.4 optional: true - '@img/sharp-linux-x64@0.35.4': + '@img/sharp-linux-x64@0.35.5': optionalDependencies: - '@img/sharp-libvips-linux-x64': 1.3.3 + '@img/sharp-libvips-linux-x64': 1.3.4 optional: true - '@img/sharp-linuxmusl-arm64@0.35.4': + '@img/sharp-linuxmusl-arm64@0.35.5': optionalDependencies: - '@img/sharp-libvips-linuxmusl-arm64': 1.3.3 + '@img/sharp-libvips-linuxmusl-arm64': 1.3.4 optional: true - '@img/sharp-linuxmusl-x64@0.35.4': + '@img/sharp-linuxmusl-x64@0.35.5': optionalDependencies: - '@img/sharp-libvips-linuxmusl-x64': 1.3.3 + '@img/sharp-libvips-linuxmusl-x64': 1.3.4 optional: true - '@img/sharp-wasm32@0.35.4': + '@img/sharp-wasm32@0.35.5': dependencies: '@emnapi/runtime': 1.11.3 optional: true - '@img/sharp-webcontainers-wasm32@0.35.4': + '@img/sharp-webcontainers-wasm32@0.35.5': dependencies: - '@img/sharp-wasm32': 0.35.4 + '@img/sharp-wasm32': 0.35.5 optional: true - '@img/sharp-win32-arm64@0.35.4': + '@img/sharp-win32-arm64@0.35.5': optional: true - '@img/sharp-win32-ia32@0.35.4': + '@img/sharp-win32-ia32@0.35.5': optional: true - '@img/sharp-win32-x64@0.35.4': + '@img/sharp-win32-x64@0.35.5': optional: true '@jridgewell/resolve-uri@3.1.2': {} @@ -3662,7 +3662,7 @@ snapshots: zod: 4.6.5 optionalDependencies: '@astrojs/markdown-remark': 7.3.1(supports-color@10.2.2) - sharp: 0.35.4(@types/node@24.19.0) + sharp: 0.35.5(@types/node@24.19.0) transitivePeerDependencies: - '@azure/app-configuration' - '@azure/cosmos' @@ -3777,12 +3777,12 @@ snapshots: css-tree@2.2.1: dependencies: mdn-data: 2.0.28 - source-map-js: 1.2.1 + source-map-js: 1.2.2 css-tree@3.2.1: dependencies: mdn-data: 2.27.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 css-what@7.0.0: {} @@ -4329,7 +4329,7 @@ snapshots: dependencies: '@babel/parser': 7.29.9 '@babel/types': 7.29.8 - source-map-js: 1.2.1 + source-map-js: 1.2.2 markdown-extensions@2.0.0: {} @@ -4921,7 +4921,7 @@ snapshots: dependencies: nanoid: 3.3.18 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 prettier@3.9.9: {} @@ -5151,37 +5151,37 @@ snapshots: semver@7.8.5: {} - sharp@0.35.4(@types/node@24.19.0): + sharp@0.35.5(@types/node@24.19.0): dependencies: '@img/colour': 1.1.0 detect-libc: 2.1.2 semver: 7.8.5 optionalDependencies: - '@img/sharp-darwin-arm64': 0.35.4 - '@img/sharp-darwin-x64': 0.35.4 - '@img/sharp-freebsd-wasm32': 0.35.4 - '@img/sharp-libvips-darwin-arm64': 1.3.3 - '@img/sharp-libvips-darwin-x64': 1.3.3 - '@img/sharp-libvips-linux-arm': 1.3.3 - '@img/sharp-libvips-linux-arm64': 1.3.3 - '@img/sharp-libvips-linux-ppc64': 1.3.3 - '@img/sharp-libvips-linux-riscv64': 1.3.3 - '@img/sharp-libvips-linux-s390x': 1.3.3 - '@img/sharp-libvips-linux-x64': 1.3.3 - '@img/sharp-libvips-linuxmusl-arm64': 1.3.3 - '@img/sharp-libvips-linuxmusl-x64': 1.3.3 - '@img/sharp-linux-arm': 0.35.4 - '@img/sharp-linux-arm64': 0.35.4 - '@img/sharp-linux-ppc64': 0.35.4 - '@img/sharp-linux-riscv64': 0.35.4 - '@img/sharp-linux-s390x': 0.35.4 - '@img/sharp-linux-x64': 0.35.4 - '@img/sharp-linuxmusl-arm64': 0.35.4 - '@img/sharp-linuxmusl-x64': 0.35.4 - '@img/sharp-webcontainers-wasm32': 0.35.4 - '@img/sharp-win32-arm64': 0.35.4 - '@img/sharp-win32-ia32': 0.35.4 - '@img/sharp-win32-x64': 0.35.4 + '@img/sharp-darwin-arm64': 0.35.5 + '@img/sharp-darwin-x64': 0.35.5 + '@img/sharp-freebsd-wasm32': 0.35.5 + '@img/sharp-libvips-darwin-arm64': 1.3.4 + '@img/sharp-libvips-darwin-x64': 1.3.4 + '@img/sharp-libvips-linux-arm': 1.3.4 + '@img/sharp-libvips-linux-arm64': 1.3.4 + '@img/sharp-libvips-linux-ppc64': 1.3.4 + '@img/sharp-libvips-linux-riscv64': 1.3.4 + '@img/sharp-libvips-linux-s390x': 1.3.4 + '@img/sharp-libvips-linux-x64': 1.3.4 + '@img/sharp-libvips-linuxmusl-arm64': 1.3.4 + '@img/sharp-libvips-linuxmusl-x64': 1.3.4 + '@img/sharp-linux-arm': 0.35.5 + '@img/sharp-linux-arm64': 0.35.5 + '@img/sharp-linux-ppc64': 0.35.5 + '@img/sharp-linux-riscv64': 0.35.5 + '@img/sharp-linux-s390x': 0.35.5 + '@img/sharp-linux-x64': 0.35.5 + '@img/sharp-linuxmusl-arm64': 0.35.5 + '@img/sharp-linuxmusl-x64': 0.35.5 + '@img/sharp-webcontainers-wasm32': 0.35.5 + '@img/sharp-win32-arm64': 0.35.5 + '@img/sharp-win32-ia32': 0.35.5 + '@img/sharp-win32-x64': 0.35.5 '@types/node': 24.19.0 optional: true @@ -5207,7 +5207,7 @@ snapshots: smol-toml@1.9.0: {} - source-map-js@1.2.1: {} + source-map-js@1.2.2: {} source-map@0.7.6: {} From b69ccd37e20183b4eebb4ab49ee77a80b7ac3a33 Mon Sep 17 00:00:00 2001 From: Laith Al-Saadoon Date: Thu, 8 Oct 2026 17:39:32 +0000 Subject: [PATCH 5/5] chore(security): VEX statements for braces 3.0.3 and http-cache-semantics 4.2.0 Both advisories (CVE-2026-93687, CVE-2026-93748) list no patched release, so the docs site's trivy finding cannot be cleared by a bump. Each is reached only by the site's build toolchain: braces through starlight-llms-txt -> micromatch on repo-authored literal patterns, and http-cache-semantics through astro's remote-image cache, which the site never reaches because it has no remote image. The ledger records the path and the revisit conditions; osv-scanner.toml is regenerated from it. Co-Authored-By: Claude Sonnet 5.5 --- osv-scanner.toml | 53 ++++++++++++++++++++++++++++++---- security/atif-sql.openvex.json | 52 +++++++++++++++++++++++++++++++-- 2 files changed, 98 insertions(+), 7 deletions(-) diff --git a/osv-scanner.toml b/osv-scanner.toml index bf0f24e..2344fab 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -17,8 +17,51 @@ # emitted, and the version scoping is enforced by the generator instead: it asserts every PURL # version in the ledger against uv.lock and FAILS when a bump moves the package, which turns a # silent stale suppression into a red gate. -# -# The ledger carries no statements. That is the intended state: nothing this repository ships -# currently needs a suppression, and every scanner reported zero on the run that produced this -# file. The pipeline exists and is exercised anyway — see security/examples/ for the shape a -# real statement takes. + +[[IgnoredVulns]] +id = "GHSA-vfj7-8cjw-p6xm" +reason = ''' +not_affected: vulnerable_code_cannot_be_controlled_by_adversary + +Products: pkg:npm/braces@3.0.3 + +braces reaches the docs site (site/) on exactly one path, read with `pnpm why braces` on 2026-10-08: starlight-llms-txt 0.12.0 -> micromatch 4.0.8 -> braces 3.0.3. It is a build-time dependency of the static docs site and ships in no atif-sql package or CLI. The vulnerable input is the brace PATTERN, and the only call sites are `micromatch.isMatch(doc.id, pattern)` in starlight-llms-txt's generator.ts, where the doc id is the string matched and never expanded. The only patterns that reach it are the literals `["agents", "index*"]` that site/astro.config.ts passes as `promote`; `include`, `exclude` and `demote` are unset. Those literals are authored in this repository, contain no braces and are reviewed in pull requests, so no outside party chooses a pattern, and a crash would abort a local or CI docs build rather than serve anyone. Revisit when the docs build takes patterns from the environment, a content file or a contributor-supplied config, or when braces publishes a release newer than 3.0.3. + +Recorded in security/atif-sql.openvex.json (OpenVEX statements[0]). Do not edit this file directly; edit the ledger and run `mise run security:vex`. +''' + +[[IgnoredVulns]] +id = "CVE-2026-93687" +reason = ''' +not_affected: vulnerable_code_cannot_be_controlled_by_adversary + +Products: pkg:npm/braces@3.0.3 + +braces reaches the docs site (site/) on exactly one path, read with `pnpm why braces` on 2026-10-08: starlight-llms-txt 0.12.0 -> micromatch 4.0.8 -> braces 3.0.3. It is a build-time dependency of the static docs site and ships in no atif-sql package or CLI. The vulnerable input is the brace PATTERN, and the only call sites are `micromatch.isMatch(doc.id, pattern)` in starlight-llms-txt's generator.ts, where the doc id is the string matched and never expanded. The only patterns that reach it are the literals `["agents", "index*"]` that site/astro.config.ts passes as `promote`; `include`, `exclude` and `demote` are unset. Those literals are authored in this repository, contain no braces and are reviewed in pull requests, so no outside party chooses a pattern, and a crash would abort a local or CI docs build rather than serve anyone. Revisit when the docs build takes patterns from the environment, a content file or a contributor-supplied config, or when braces publishes a release newer than 3.0.3. + +Recorded in security/atif-sql.openvex.json (OpenVEX statements[0]). Do not edit this file directly; edit the ledger and run `mise run security:vex`. +''' + +[[IgnoredVulns]] +id = "GHSA-ch52-4w7c-c8xp" +reason = ''' +not_affected: vulnerable_code_not_in_execute_path + +Products: pkg:npm/http-cache-semantics@4.2.0 + +http-cache-semantics reaches the docs site (site/) on exactly one path, read with `pnpm why http-cache-semantics` on 2026-10-08: astro 7.3.5 -> http-cache-semantics 4.2.0, a build-time dependency that ships in no atif-sql package or CLI. astro's only use is `dist/assets/build/remote.js`, which builds a CachePolicy to decide how long a downloaded REMOTE image may be cached during `astro build`. The docs site has no remote image: site/astro.config.ts sets no `image` option (no `domains`, no `remotePatterns`, so astro's default allows none), and grep over site/src, site/authored and docs/ finds no `astro:assets` image component and no markdown image with an http(s) source on 2026-10-08. The advisory needs a shared cache that answers many users' requests; here the one request is the build's own fetch, built by astro without a max-stale directive, in one process, and the output is a static directory. Nothing serves other users' cached responses. Revisit when the site adds a remote image, an SSR adapter or any shared HTTP cache, or when a release newer than 4.2.0 appears. + +Recorded in security/atif-sql.openvex.json (OpenVEX statements[1]). Do not edit this file directly; edit the ledger and run `mise run security:vex`. +''' + +[[IgnoredVulns]] +id = "CVE-2026-93748" +reason = ''' +not_affected: vulnerable_code_not_in_execute_path + +Products: pkg:npm/http-cache-semantics@4.2.0 + +http-cache-semantics reaches the docs site (site/) on exactly one path, read with `pnpm why http-cache-semantics` on 2026-10-08: astro 7.3.5 -> http-cache-semantics 4.2.0, a build-time dependency that ships in no atif-sql package or CLI. astro's only use is `dist/assets/build/remote.js`, which builds a CachePolicy to decide how long a downloaded REMOTE image may be cached during `astro build`. The docs site has no remote image: site/astro.config.ts sets no `image` option (no `domains`, no `remotePatterns`, so astro's default allows none), and grep over site/src, site/authored and docs/ finds no `astro:assets` image component and no markdown image with an http(s) source on 2026-10-08. The advisory needs a shared cache that answers many users' requests; here the one request is the build's own fetch, built by astro without a max-stale directive, in one process, and the output is a static directory. Nothing serves other users' cached responses. Revisit when the site adds a remote image, an SSR adapter or any shared HTTP cache, or when a release newer than 4.2.0 appears. + +Recorded in security/atif-sql.openvex.json (OpenVEX statements[1]). Do not edit this file directly; edit the ledger and run `mise run security:vex`. +''' diff --git a/security/atif-sql.openvex.json b/security/atif-sql.openvex.json index 2401bf5..2d05fa2 100644 --- a/security/atif-sql.openvex.json +++ b/security/atif-sql.openvex.json @@ -4,7 +4,55 @@ "author": "atif-sql maintainers", "role": "document creator", "timestamp": "2026-08-28T17:06:14Z", - "version": 1, + "version": 2, "tooling": "hand-authored; rendered to osv-scanner.toml by scripts/vex_to_osv_config.py", - "statements": [] + "statements": [ + { + "@id": "https://github.com/laithalsaadoon/atif-sql/security/atif-sql.openvex.json#braces-3.0.3", + "vulnerability": { + "name": "GHSA-vfj7-8cjw-p6xm", + "@id": "https://github.com/advisories/GHSA-vfj7-8cjw-p6xm", + "aliases": [ + "CVE-2026-93687" + ], + "description": "braces through 3.0.3: stack exhaustion in the recursive AST walkers on deeply nested brace patterns. No patched release exists." + }, + "timestamp": "2026-10-08T17:45:00Z", + "products": [ + { + "@id": "pkg:npm/braces@3.0.3", + "identifiers": { + "purl": "pkg:npm/braces@3.0.3" + } + } + ], + "status": "not_affected", + "justification": "vulnerable_code_cannot_be_controlled_by_adversary", + "impact_statement": "braces reaches the docs site (site/) on exactly one path, read with `pnpm why braces` on 2026-10-08: starlight-llms-txt 0.12.0 -> micromatch 4.0.8 -> braces 3.0.3. It is a build-time dependency of the static docs site and ships in no atif-sql package or CLI. The vulnerable input is the brace PATTERN, and the only call sites are `micromatch.isMatch(doc.id, pattern)` in starlight-llms-txt's generator.ts, where the doc id is the string matched and never expanded. The only patterns that reach it are the literals `[\"agents\", \"index*\"]` that site/astro.config.ts passes as `promote`; `include`, `exclude` and `demote` are unset. Those literals are authored in this repository, contain no braces and are reviewed in pull requests, so no outside party chooses a pattern, and a crash would abort a local or CI docs build rather than serve anyone. Revisit when the docs build takes patterns from the environment, a content file or a contributor-supplied config, or when braces publishes a release newer than 3.0.3." + }, + { + "@id": "https://github.com/laithalsaadoon/atif-sql/security/atif-sql.openvex.json#http-cache-semantics-4.2.0", + "vulnerability": { + "name": "GHSA-ch52-4w7c-c8xp", + "@id": "https://github.com/advisories/GHSA-ch52-4w7c-c8xp", + "aliases": [ + "CVE-2026-93748" + ], + "description": "http-cache-semantics through 4.2.0: a shared-cache entry zeroed for security can be returned for a client max-stale request, disclosing another user's cached Set-Cookie. No patched release exists." + }, + "timestamp": "2026-10-08T17:45:00Z", + "products": [ + { + "@id": "pkg:npm/http-cache-semantics@4.2.0", + "identifiers": { + "purl": "pkg:npm/http-cache-semantics@4.2.0" + } + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "http-cache-semantics reaches the docs site (site/) on exactly one path, read with `pnpm why http-cache-semantics` on 2026-10-08: astro 7.3.5 -> http-cache-semantics 4.2.0, a build-time dependency that ships in no atif-sql package or CLI. astro's only use is `dist/assets/build/remote.js`, which builds a CachePolicy to decide how long a downloaded REMOTE image may be cached during `astro build`. The docs site has no remote image: site/astro.config.ts sets no `image` option (no `domains`, no `remotePatterns`, so astro's default allows none), and grep over site/src, site/authored and docs/ finds no `astro:assets` image component and no markdown image with an http(s) source on 2026-10-08. The advisory needs a shared cache that answers many users' requests; here the one request is the build's own fetch, built by astro without a max-stale directive, in one process, and the output is a static directory. Nothing serves other users' cached responses. Revisit when the site adds a remote image, an SSR adapter or any shared HTTP cache, or when a release newer than 4.2.0 appears." + } + ], + "last_updated": "2026-10-08T17:45:00Z" }