diff --git a/.agents/skills/dep-upgrade/instructions.md b/.agents/skills/dep-upgrade/instructions.md index b5e59ea39..c4ae5bc00 100644 --- a/.agents/skills/dep-upgrade/instructions.md +++ b/.agents/skills/dep-upgrade/instructions.md @@ -66,4 +66,10 @@ pnpm test:unit > **`pnpm check` tip:** If type errors appear and you have uncommitted changes, run `git stash && pnpm check 2>&1 | tail -5` to confirm whether errors are pre-existing. Restore with `git stash pop`. If there is nothing to stash, skip this check — without a baseline to compare against, it gives no useful signal. +**Compare outputs, not only exit codes.** Passing commands do not prove that nothing changed. Before the change, save the outputs: ESLint JSON, the list and hashes of build files, and generated files. After the change, compare them. + +- First build twice with no change. Some files always differ (e.g. version stamps); leave them out of the comparison. +- Check that the code you care about actually ran, for example by logging calls to the updated package during the build. If it never ran, "identical output" proves nothing. +- A new version in the lockfile does not prove that the running code changed. Some packages bundle their own copy of a dependency, so check the entry point that is actually loaded. + When done, rewrite plan.md as `AGENTS.md` Implementation Workflow step 6 describes, recording the verification results among the facts. diff --git a/.claude/rules/dependencies.md b/.claude/rules/dependencies.md new file mode 120000 index 000000000..42df84ecd --- /dev/null +++ b/.claude/rules/dependencies.md @@ -0,0 +1 @@ +../../docs/guides/agent-rules/dependencies.md \ No newline at end of file diff --git a/AGENTS.md b/AGENTS.md index 04649a06d..62e74b691 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -41,17 +41,18 @@ See `docs/guides/architecture.md` for detailed placement rules. Before planning or changing a matching path, read the corresponding document under `docs/guides/agent-rules/`. -| Path | Rules | -| ------------------------------------ | ------------------------------------------------------------- | -| All source and plans | `coding-style.md` | -| `prisma/**`, server and service code | `prisma-db.md` | -| `**/*.test.ts`, `src/test/**` | `testing.md` | -| `**/*.spec.ts`, `e2e/**` | `testing-e2e.md` | -| Svelte components and stores | `svelte-components.md`, `svelte-runes.md`, `accessibility.md` | -| SvelteKit routes | `sveltekit.md` | -| Authentication and admin paths | `auth.md` | -| Server cache modules | `server-cache.md` | -| `.github/workflows/**` | `github-actions.md` | +| Path | Rules | +| ------------------------------------------------------ | ------------------------------------------------------------- | +| All source and plans | `coding-style.md` | +| `prisma/**`, server and service code | `prisma-db.md` | +| `**/*.test.ts`, `src/test/**` | `testing.md` | +| `**/*.spec.ts`, `e2e/**` | `testing-e2e.md` | +| Svelte components and stores | `svelte-components.md`, `svelte-runes.md`, `accessibility.md` | +| SvelteKit routes | `sveltekit.md` | +| Authentication and admin paths | `auth.md` | +| Server cache modules | `server-cache.md` | +| `.github/workflows/**` | `github-actions.md` | +| `package.json`, `pnpm-workspace.yaml`, `renovate.json` | `dependencies.md` | Use project-specific workflows from `.agents/skills/` when a task matches a skill description. Each `.agents/skills//instructions.md` is a plain Markdown checklist — read it directly when doing that task by hand, not only when an agent loads it automatically. diff --git a/docs/guides/agent-rules/dependencies.md b/docs/guides/agent-rules/dependencies.md new file mode 100644 index 000000000..c2db04a23 --- /dev/null +++ b/docs/guides/agent-rules/dependencies.md @@ -0,0 +1,26 @@ +--- +description: Dependency update and security override rules +paths: + - 'package.json' + - 'pnpm-workspace.yaml' + - 'renovate.json' +--- + +# Dependencies + +## Fixing a Vulnerable Transitive Dependency + +Try these in order: + +1. **Remove it.** Check that the direct dependency that pulls it in is still used. If it is not, delete it. +2. **Update the lockfile.** If the parent's declared range already allows the fixed version (e.g. `^8.12.1` and the fix is `8.12.3`), run `pnpm update `. No override is needed. +3. **Add an override.** Use it only when the fix is outside the parent's range. + +Before you choose 2 or 3, read the advisory's trigger conditions and check whether this project can reach them. If it cannot, dismissing the alert is a valid choice. Judge each advisory on its own: do not reuse the reasoning for one advisory to dismiss another advisory of the same package. + +## Writing Overrides + +- Make the upper bound equal to the pin: `'pkg@>=1.0.0 <1.1.21': '1.1.21'`. If they differ (`<1.1.13': '1.1.18'`), the pin can become vulnerable later, and the selector will never match it again. +- Overrides ignore the parent's declared range. Pick the lowest fixed version that the parent accepts, not the latest one. +- When you cross a major on purpose, check the API the parent actually uses, and add a comment that says when to remove the override. +- When you review alerts, also check that each existing override still matches a package and that its pin is not vulnerable. diff --git a/package.json b/package.json index 30189fb57..d9255a955 100644 --- a/package.json +++ b/package.json @@ -25,7 +25,6 @@ "devDependencies": { "@dnd-kit/abstract": "0.5.3", "@dnd-kit/dom": "0.5.3", - "@eslint/eslintrc": "3.3.7", "@playwright/test": "1.64.1", "@quramy/prisma-fabbrica": "2.3.3", "@sveltejs/adapter-vercel": "7.0.2", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 67a6adf80..741125504 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -167,7 +167,7 @@ overrides: minimatch@>=10.0.0 <10.2.3: 10.2.6 effect@>=3.0.0 <3.20.0: 3.22.4 defu@<6.1.5: 6.1.7 - brace-expansion@>=1.0.0 <1.1.13: 1.1.18 + deepmerge-ts@<8.0.0: 8.0.2 postcss@>=8.0.0 <8.5.10: 8.5.32 importers: @@ -205,9 +205,6 @@ importers: '@dnd-kit/dom': specifier: 0.5.3 version: 0.5.3 - '@eslint/eslintrc': - specifier: 3.3.7 - version: 3.3.7(supports-color@7.2.0) '@playwright/test': specifier: 1.64.1 version: 1.64.1 @@ -628,10 +625,6 @@ packages: resolution: {integrity: sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==} engines: {node: ^20.19.0 || ^22.13.0 || >=24} - '@eslint/eslintrc@3.3.7': - resolution: {integrity: sha512-F42g89Qd5oAWtp0k0nnSrjziAKza7w8SVT4mStc18LZMaRb4J1HQAHLCalEtDCxrTuksx7NU9qsmeLwpOfPqWw==} - engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} - '@eslint/object-schema@3.0.5': resolution: {integrity: sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw==} engines: {node: ^20.19.0 || ^22.13.0 || >=24} @@ -1687,9 +1680,6 @@ packages: arg@5.0.2: resolution: {integrity: sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==} - argparse@2.0.1: - resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==} - aria-query@5.3.1: resolution: {integrity: sha512-Z/ZeOgVl7bcSYZ/u/rh0fOpvEpq//LZmdbkXyc7syVzjPAhfOa9ebsdTSjEBDU4vs5nC98Kfduj1uFo0qyET3g==} engines: {node: '>= 0.4'} @@ -1714,9 +1704,6 @@ packages: resolution: {integrity: sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==} engines: {node: '>= 0.4'} - balanced-match@1.0.2: - resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} - balanced-match@4.0.4: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} @@ -1727,11 +1714,8 @@ packages: bindings@1.5.0: resolution: {integrity: sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==} - brace-expansion@1.1.18: - resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} - - brace-expansion@5.0.8: - resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} c12@3.1.0: @@ -1745,10 +1729,6 @@ packages: cacheable@2.5.0: resolution: {integrity: sha512-60cyAOytib/OzBw1JNSoSV/boK1AtHryDIjvVBk7XbN4ugfkM3+Sry7fEjNgPMGgOjuaZPAp8ruZ0Cxafwyq9g==} - callsites@3.1.0: - resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==} - engines: {node: '>=6'} - camelcase@9.0.0: resolution: {integrity: sha512-TO9xmyXTZ9HUHI8M1OnvExxYB0eYVS/1e5s7IDMTAoIcwUd+aNcFODs6Xk83mobk0velyHFQgA1yIrvYc6wclw==} engines: {node: '>=20'} @@ -1778,9 +1758,6 @@ packages: commander@2.20.3: resolution: {integrity: sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==} - concat-map@0.0.1: - resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==} - confbox@0.2.2: resolution: {integrity: sha512-1NB+BKqhtNipMsov4xI/NnhCKp9XG9NamYp5PVm9klAT0fsrNPjaFICsCFhNhwZJKNh7zB/3q8qXz0E9oaMNtQ==} @@ -1836,9 +1813,9 @@ packages: deep-is@0.1.4: resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==} - deepmerge-ts@7.1.5: - resolution: {integrity: sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==} - engines: {node: '>=16.0.0'} + deepmerge-ts@8.0.2: + resolution: {integrity: sha512-uqbvqLUMrc6p0MO+WBRtTxY55hmyh94WRwI5a++PZe54X+bfVh59FSN7uWCBCW1CCVjzjnrwzfI8zidE2obMMw==} + engines: {node: '>=16.9.0'} deepmerge@4.3.1: resolution: {integrity: sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==} @@ -2059,10 +2036,6 @@ packages: resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==} engines: {node: 18 || 20 || >=22} - globals@14.0.0: - resolution: {integrity: sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==} - engines: {node: '>=18'} - globals@16.5.0: resolution: {integrity: sha512-c/c15i26VrJ4IRt5Z89DnIzCGDn9EcebibhAOjw5ibqEHsE1wLUgkPn9RDmNcUKyU87GeaL633nyJ+pplFR2ZQ==} engines: {node: '>=18'} @@ -2108,10 +2081,6 @@ packages: resolution: {integrity: sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==} engines: {node: '>= 4'} - import-fresh@3.3.1: - resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==} - engines: {node: '>=6'} - imurmurhash@0.1.4: resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==} engines: {node: '>=0.8.19'} @@ -2147,16 +2116,12 @@ packages: resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==} hasBin: true - joi@17.13.8: - resolution: {integrity: sha512-iPKOGmiRw1jxf/JOPwxmCcUQAOdF359mdzYiP2DJ+TMX0YK2zjK3D+zYOaGjpumWxOFF/l2xVWjRVK5bGSLdEw==} + joi@17.13.9: + resolution: {integrity: sha512-llFCT2rVtfwgBCaIqxtjim+iHqrgss4ONiGSYiiGH9jnjWq90ppSRffqmqKvwpa8W+YfILyQV6XyGcegXX2T4g==} js-tokens@10.0.0: resolution: {integrity: sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==} - js-yaml@4.3.2: - resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} - hasBin: true - jsdom@30.1.3: resolution: {integrity: sha512-hQMUPvRgN7KxsfIytDQji7bimuJeRQa6Qo5+iuiZQk5CafeRxLIA10/cG5YCBFNpD9RO3oqIiN4CO1Y44kxqXg==} engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0} @@ -2370,9 +2335,6 @@ packages: resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==} engines: {node: 18 || 20 || >=22} - minimatch@3.1.5: - resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==} - minipass@7.1.3: resolution: {integrity: sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==} engines: {node: '>=16 || 14 >=14.17'} @@ -2493,10 +2455,6 @@ packages: resolution: {integrity: sha512-P2wrCri3bhGLPo3kX7qYVXbo/5GvaVATU0DpO24CbeT53Y4z35t8JUWku04ERpXHUYB5rPMi3TkWE3fmJgx5rA==} engines: {node: '>=22'} - parent-module@1.0.1: - resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==} - engines: {node: '>=6'} - parse5@8.0.1: resolution: {integrity: sha512-z1e/HMG90obSGeidlli3hj7cbocou0/wa5HacvI3ASx34PecNjNQeaHNo5WIZpWofN9kgkqV1q5YvXe3F0FoPw==} @@ -2574,8 +2532,8 @@ packages: peerDependencies: postcss: 8.5.32 - postcss-selector-parser@7.1.1: - resolution: {integrity: sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==} + postcss-selector-parser@7.1.7: + resolution: {integrity: sha512-wWBro/7hJ40ye6TPiXkUQoXKCw23xSsjriUvqd7Uls9Sso3oLiON1flc18cCdnjgCRXw4fBVqUJJeOdDTh3P3g==} engines: {node: '>=4'} postcss@8.5.31: @@ -2631,10 +2589,6 @@ packages: resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==} engines: {node: '>=0.10.0'} - resolve-from@4.0.0: - resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==} - engines: {node: '>=4'} - resolve-from@5.0.0: resolution: {integrity: sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==} engines: {node: '>=8'} @@ -2698,10 +2652,6 @@ packages: std-env@4.3.0: resolution: {integrity: sha512-OtU/EgQ1kIm5KwqQpBC6ZEMXrZRui11w8zgfTWp8cdO9B8OaPsbA8bTHO2P+HNo1VlUTGMVBwPhydu6poeXiag==} - strip-json-comments@3.1.1: - resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==} - engines: {node: '>=8'} - super-sitemap@1.0.12: resolution: {integrity: sha512-C3gfAS1RZxL5bbZGtgnIOitMhfqAt8RmhW8AWTia6c8n9RW3Zx7f/SxVeFWZD0I1nUAx2pkxuWazVtev0Nmb5w==} peerDependencies: @@ -2875,8 +2825,8 @@ packages: undici-types@8.9.0: resolution: {integrity: sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==} - undici@8.12.1: - resolution: {integrity: sha512-usz3OVQBeh1LxNn0DzU0voLXMgn5CU/WUdpBsY6Ti5afNao+vTkmn4H/NxoXolc10cOqe2+YIG0Hspq2rsl64w==} + undici@8.12.3: + resolution: {integrity: sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw==} engines: {node: '>=22.19.0'} universalify@2.0.1: @@ -3307,20 +3257,6 @@ snapshots: dependencies: '@types/json-schema': 7.0.15 - '@eslint/eslintrc@3.3.7(supports-color@7.2.0)': - dependencies: - ajv: 6.15.0 - debug: 4.4.3(supports-color@7.2.0) - espree: 10.4.0 - globals: 14.0.0 - ignore: 5.3.2 - import-fresh: 3.3.1 - js-yaml: 4.3.2 - minimatch: 3.1.5 - strip-json-comments: 3.1.1 - transitivePeerDependencies: - - supports-color - '@eslint/object-schema@3.0.5': {} '@eslint/plugin-kit@0.7.3': @@ -3612,7 +3548,7 @@ snapshots: '@prisma/config@6.19.0': dependencies: c12: 3.1.0 - deepmerge-ts: 7.1.5 + deepmerge-ts: 8.0.2 effect: 3.22.4 empathic: 2.0.0 transitivePeerDependencies: @@ -4208,8 +4144,6 @@ snapshots: arg@5.0.2: {} - argparse@2.0.1: {} - aria-query@5.3.1: {} arkregex@0.0.13: @@ -4236,8 +4170,6 @@ snapshots: axobject-query@4.1.0: {} - balanced-match@1.0.2: {} - balanced-match@4.0.4: {} bidi-js@1.1.0: @@ -4248,12 +4180,7 @@ snapshots: dependencies: file-uri-to-path: 1.0.0 - brace-expansion@1.1.18: - dependencies: - balanced-match: 1.0.2 - concat-map: 0.0.1 - - brace-expansion@5.0.8: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -4280,8 +4207,6 @@ snapshots: keyv: 5.6.0 qified: 0.10.1 - callsites@3.1.0: {} - camelcase@9.0.0: optional: true @@ -4308,8 +4233,6 @@ snapshots: commander@2.20.3: {} - concat-map@0.0.1: {} - confbox@0.2.2: {} consola@3.4.2: {} @@ -4355,7 +4278,7 @@ snapshots: deep-is@0.1.4: {} - deepmerge-ts@7.1.5: {} + deepmerge-ts@8.0.2: {} deepmerge@4.3.1: {} @@ -4637,8 +4560,6 @@ snapshots: minipass: 7.1.3 path-scurry: 2.0.2 - globals@14.0.0: {} - globals@16.5.0: {} globals@17.14.0: {} @@ -4677,11 +4598,6 @@ snapshots: ignore@7.0.5: {} - import-fresh@3.3.1: - dependencies: - parent-module: 1.0.1 - resolve-from: 4.0.0 - imurmurhash@0.1.4: {} is-core-module@2.16.1: @@ -4708,7 +4624,7 @@ snapshots: jiti@2.7.0: {} - joi@17.13.8: + joi@17.13.9: dependencies: '@hapi/hoek': 9.3.0 '@hapi/topo': 5.1.0 @@ -4719,10 +4635,6 @@ snapshots: js-tokens@10.0.0: {} - js-yaml@4.3.2: - dependencies: - argparse: 2.0.1 - jsdom@30.1.3: dependencies: '@asamuzakjp/css-color': 7.1.3 @@ -4739,7 +4651,7 @@ snapshots: parse5: 8.0.1 saxes: 6.0.0 tough-cookie: 6.0.2 - undici: 8.12.1 + undici: 8.12.3 w3c-xmlserializer: 6.0.0 webidl-conversions: 8.0.1 whatwg-mimetype: 5.0.0 @@ -4912,11 +4824,7 @@ snapshots: minimatch@10.2.6: dependencies: - brace-expansion: 5.0.8 - - minimatch@3.1.5: - dependencies: - brace-expansion: 1.1.18 + brace-expansion: 5.0.12 minipass@7.1.3: {} @@ -5037,10 +4945,6 @@ snapshots: p-queue@10.0.0: {} - parent-module@1.0.1: - dependencies: - callsites: 3.1.0 - parse5@8.0.1: dependencies: entities: 8.0.0 @@ -5110,7 +5014,7 @@ snapshots: dependencies: postcss: 8.5.32 - postcss-selector-parser@7.1.1: + postcss-selector-parser@7.1.7: dependencies: cssesc: 3.0.0 util-deprecate: 1.0.2 @@ -5166,8 +5070,6 @@ snapshots: require-from-string@2.0.2: {} - resolve-from@4.0.0: {} - resolve-from@5.0.0: {} resolve@1.22.11: @@ -5238,8 +5140,6 @@ snapshots: std-env@4.3.0: {} - strip-json-comments@3.1.1: {} - super-sitemap@1.0.12(svelte@5.57.3(@typescript-eslint/types@8.72.1)): dependencies: svelte: 5.57.3(@typescript-eslint/types@8.72.1) @@ -5274,7 +5174,7 @@ snapshots: espree: 10.4.0 postcss: 8.5.32 postcss-scss: 4.0.9(postcss@8.5.32) - postcss-selector-parser: 7.1.1 + postcss-selector-parser: 7.1.7 semver: 7.8.5 optionalDependencies: svelte: 5.57.3(@typescript-eslint/types@8.72.1) @@ -5321,7 +5221,7 @@ snapshots: arktype: 2.2.8 class-validator: 0.14.4 effect: 3.22.4 - joi: 17.13.8 + joi: 17.13.9 json-schema-to-ts: 3.1.1 superstruct: 2.0.2 typebox: 1.4.2 @@ -5429,7 +5329,7 @@ snapshots: undici-types@8.9.0: {} - undici@8.12.1: {} + undici@8.12.3: {} universalify@2.0.1: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index f66a124fe..839ab0936 100755 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -47,6 +47,7 @@ overrides: 'minimatch@>=10.0.0 <10.2.3': '10.2.6' 'effect@>=3.0.0 <3.20.0': '3.22.4' 'defu@<6.1.5': '6.1.7' + # Crosses a major on purpose: @prisma/config 6.x pins 7.1.5; remove with @quramy/prisma-fabbrica + 'deepmerge-ts@<8.0.0': '8.0.2' # moderate - 'brace-expansion@>=1.0.0 <1.1.13': '1.1.18' 'postcss@>=8.0.0 <8.5.10': '8.5.32'