From 152951066fbea6ee5cbb99cb5e9d155e2f99ef8d Mon Sep 17 00:00:00 2001 From: Musiker15 Date: Thu, 6 Aug 2026 10:01:10 +0200 Subject: [PATCH] chore(deps): bump dev dependencies and close undici/fast-uri advisories Supersedes #230, whose lockfile no longer applied after #231 landed. Carries the same dev-group bumps (@types/node 26.1.2, prisma 7.9.1, turbo 2.10.7, postcss 8.5.25) and adds two override bumps on top, so the tree is resolved once instead of twice. Bumping the Prisma CLI is not optional here: #231 moved @prisma/client and @prisma/adapter-pg to 7.9.1, and Prisma requires the CLI to match. undici: GHSA-8xcm-r25x-g524, GHSA-m8rv-5g2x-5cg5 and GHSA-v3r7-h72x-cjcm are all first patched in 6.28.0. It reaches us through discord.js, which pins the version exactly, so the existing <6.27.0 override is the only lever. fast-uri: GHSA-7p8r-x3mc-p8w7 lands on top of GHSA-4c8g-83qw-93j6 and flags everything below 3.1.5. Dev-only, via ajv, and still capped below 4 because that is the line ajv asks for. Both old copies are gone from the lockfile rather than merely duplicated. --- apps/web/package.json | 2 +- package.json | 6 +- packages/db/package.json | 2 +- pnpm-lock.yaml | 322 +++++++++++++++------------------------ pnpm-workspace.yaml | 10 +- 5 files changed, 138 insertions(+), 204 deletions(-) diff --git a/apps/web/package.json b/apps/web/package.json index 0c450f7..db12905 100644 --- a/apps/web/package.json +++ b/apps/web/package.json @@ -41,7 +41,7 @@ "@types/react": "^19.2.18", "@types/react-dom": "^19.2.4", "autoprefixer": "^10.5.4", - "postcss": "^8.5.23", + "postcss": "^8.5.25", "tailwindcss": "^3.4.17", "tailwindcss-animate": "^1.0.7", "typescript": "^5.7.2", diff --git a/package.json b/package.json index b3df97a..f2dd675 100644 --- a/package.json +++ b/package.json @@ -28,13 +28,13 @@ }, "devDependencies": { "@eslint/js": "^9.17.0", - "@types/node": "^26.1.1", + "@types/node": "^26.1.2", "dotenv": "^17.4.2", "eslint": "^10.8.0", "prettier": "^3.9.6", "prettier-plugin-tailwindcss": "^0.8.1", - "prisma": "^7.9.0", - "turbo": "^2.10.6", + "prisma": "^7.9.1", + "turbo": "^2.10.7", "typescript": "^5.7.2", "typescript-eslint": "^8.65.0" } diff --git a/packages/db/package.json b/packages/db/package.json index 6743ec2..03f4250 100644 --- a/packages/db/package.json +++ b/packages/db/package.json @@ -25,7 +25,7 @@ "devDependencies": { "@types/pg": "^8.11.10", "pg": "^8.22.0", - "prisma": "^7.9.0", + "prisma": "^7.9.1", "tsx": "^4.23.1", "typescript": "^5.7.2", "vitest": "^4.1.10" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 21cf98e..9dd2456 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,10 +7,10 @@ settings: overrides: esbuild@<0.28.1: '>=0.28.1' postcss@<8.5.10: '>=8.5.10' - undici@<6.27.0: ^6.27.0 + undici@<6.28.0: ^6.28.0 uuid@<11.1.1: '>=11.1.1' find-my-way@<9.7.0: '>=9.7.0 <10' - fast-uri@<3.1.3: '>=3.1.3 <4' + fast-uri@<3.1.5: '>=3.1.5 <4' sharp@<0.35.0: '>=0.35.0' minimatch@<10: '>=10 <11' brace-expansion@>=3.0.0 <5.0.8: '>=5.0.8' @@ -23,8 +23,8 @@ importers: specifier: ^9.17.0 version: 9.39.4 '@types/node': - specifier: ^26.1.1 - version: 26.1.1 + specifier: ^26.1.2 + version: 26.1.2 dotenv: specifier: ^17.4.2 version: 17.4.2 @@ -38,11 +38,11 @@ importers: specifier: ^0.8.1 version: 0.8.1(prettier@3.9.6) prisma: - specifier: ^7.9.0 - version: 7.9.0(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3) + specifier: ^7.9.1 + version: 7.9.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3) turbo: - specifier: ^2.10.6 - version: 2.10.6 + specifier: ^2.10.7 + version: 2.10.8 typescript: specifier: ^5.7.2 version: 5.9.3 @@ -70,7 +70,7 @@ importers: version: 5.9.3 vitest: specifier: ^4.1.10 - version: 4.1.10(@types/node@26.1.1)(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)) + version: 4.1.10(@types/node@26.1.2)(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)) apps/realtime: dependencies: @@ -95,7 +95,7 @@ importers: version: 5.9.3 vitest: specifier: ^4.1.10 - version: 4.1.10(@types/node@26.1.1)(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)) + version: 4.1.10(@types/node@26.1.2)(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)) apps/web: dependencies: @@ -134,7 +134,7 @@ importers: version: 8.0.4 next: specifier: ^16.2.12 - version: 16.2.12(@types/node@26.1.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) + version: 16.2.12(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) next-themes: specifier: ^0.4.4 version: 0.4.6(react-dom@19.2.8(react@19.2.8))(react@19.2.8) @@ -152,10 +152,10 @@ importers: version: 19.2.8(react@19.2.8) sharp: specifier: ^0.35.3 - version: 0.35.3(@types/node@26.1.0) + version: 0.35.3(@types/node@26.1.2) stripe: specifier: ^22.4.0 - version: 22.4.0(@types/node@26.1.1) + version: 22.4.0(@types/node@26.1.2) tailwind-merge: specifier: ^3.6.0 version: 3.6.0 @@ -177,10 +177,10 @@ importers: version: 19.2.4(@types/react@19.2.18) autoprefixer: specifier: ^10.5.4 - version: 10.5.4(postcss@8.5.23) + version: 10.5.4(postcss@8.5.25) postcss: - specifier: ^8.5.23 - version: 8.5.23 + specifier: ^8.5.25 + version: 8.5.25 tailwindcss: specifier: ^3.4.17 version: 3.4.19(tsx@4.23.1) @@ -192,7 +192,7 @@ importers: version: 5.9.3 vitest: specifier: ^4.1.10 - version: 4.1.10(@types/node@26.1.1)(vite@7.3.5(@types/node@26.1.2)(jiti@1.21.7)(tsx@4.23.1)) + version: 4.1.10(@types/node@26.1.2)(vite@7.3.5(@types/node@26.1.2)(jiti@1.21.7)(tsx@4.23.1)) packages/db: dependencies: @@ -201,7 +201,7 @@ importers: version: 7.9.1 '@prisma/client': specifier: ^7.9.1 - version: 7.9.1(prisma@7.9.0(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3))(typescript@5.9.3) + version: 7.9.1(prisma@7.9.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3))(typescript@5.9.3) devDependencies: '@types/pg': specifier: ^8.11.10 @@ -210,8 +210,8 @@ importers: specifier: ^8.22.0 version: 8.22.0 prisma: - specifier: ^7.9.0 - version: 7.9.0(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3) + specifier: ^7.9.1 + version: 7.9.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3) tsx: specifier: ^4.23.1 version: 4.23.1 @@ -220,7 +220,7 @@ importers: version: 5.9.3 vitest: specifier: ^4.1.10 - version: 4.1.10(@types/node@26.1.1)(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)) + version: 4.1.10(@types/node@26.1.2)(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)) packages/i18n: devDependencies: @@ -229,7 +229,7 @@ importers: version: 5.9.3 vitest: specifier: ^4.1.10 - version: 4.1.10(@types/node@26.1.1)(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)) + version: 4.1.10(@types/node@26.1.2)(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)) packages/shared: dependencies: @@ -242,7 +242,7 @@ importers: version: 5.9.3 vitest: specifier: ^4.1.10 - version: 4.1.10(@types/node@26.1.1)(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)) + version: 4.1.10(@types/node@26.1.2)(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)) packages/ui: dependencies: @@ -264,7 +264,7 @@ importers: version: 5.9.3 vitest: specifier: ^4.1.10 - version: 4.1.10(@types/node@26.1.1)(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)) + version: 4.1.10(@types/node@26.1.2)(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)) packages: @@ -283,6 +283,9 @@ packages: '@aws-sdk/core@3.977.4': resolution: {integrity: sha512-CEkcQlMOQJCvul60U7wdAOACjtdgFWDsfJI+6wUOGdhGNV2lGbuJpi/R50QLpFG3Tp+sQxa/RmzC3X7KHbhuTA==} engines: {node: '>=20.0.0'} + deprecated: |- + Deprecated due to Document number parsing bug in JSON, see + https://github.com/aws/aws-sdk-js-v3/issues/8246. Newer version available. '@aws-sdk/credential-provider-env@3.972.65': resolution: {integrity: sha512-lJT2aRw9wCV8jPHyFJjdZLD4HTydL6/22AnCSOB8e/LqOc55nEJGLHkJQeSxhn8QiqyjFwPKQFtMw0ovjRUY/g==} @@ -880,20 +883,17 @@ packages: typescript: optional: true - '@prisma/config@7.9.0': - resolution: {integrity: sha512-CsoK2mhl0u+N4/8V+XroQMOUNIic4isqD+E2HBG8l1yGEKo62CFDu3FHo0FdwItjl6XkW+omA1STSzeN1DAXlg==} + '@prisma/config@7.9.1': + resolution: {integrity: sha512-4znKhxTmXmuPye9Z6pbIyYb5VZlkZ05qG1L6Dr4g+7oTwc6V50Bs9XirFBDdjWt+H/AabMn9aUnxBcvj8z05aA==} '@prisma/debug@7.2.0': resolution: {integrity: sha512-YSGTiSlBAVJPzX4ONZmMotL+ozJwQjRmZweQNIq/ER0tQJKJynNkRB3kyvt37eOfsbMCXk3gnLF6J9OJ4QWftw==} - '@prisma/debug@7.9.0': - resolution: {integrity: sha512-i0KdVQuKUE6N9NloHs+sUNAk2c9svR3myBndQbA3BoeoArsSpwtNgTdHZL+wBtCLCcdS2OOC/PKhgTe36jkF5A==} - '@prisma/debug@7.9.1': resolution: {integrity: sha512-/cpVZ4itxtcgB8GHBvZtcmuEjq+lWsLrRJxFMbwZrT1RIdtuKmUm7PPGo/wzfbYpBrk+9WmmBE8CHJw2rybKDQ==} - '@prisma/dev@0.24.14': - resolution: {integrity: sha512-NhFO49O2JPTdzYiLHvceQn/HiwmcKF/iGV39ko3CpYsoGqS3rz3ko6gzuxFSIeHNwNJeuNcDexyyGeTO3DW80A==} + '@prisma/dev@0.24.17': + resolution: {integrity: sha512-UvdZzmpFwknnfreh6Jije84ekkYGPYEJhXG1tFzCsCfQyzJifrOo38eZc0qajzvaC6OLUOrN9ML5XfCnEZL9DA==} '@prisma/driver-adapter-utils@7.9.1': resolution: {integrity: sha512-vmHehG7nn/heW32DXXpp13DxxAxVVe6n250oEt3dOL2E/4bt3olktKZN0mzSuxMMronyMSkbeW2uCOn3F4g8RQ==} @@ -901,17 +901,17 @@ packages: '@prisma/engines-version@7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad': resolution: {integrity: sha512-2BsPPFksz3CQUXG6af3rVCtJKg6+JJGJTtfgu2fU8DdXhOfkBjulCq8mwybCd6ge0/jhZq2kOtLAbmUDMyI1nA==} - '@prisma/engines@7.9.0': - resolution: {integrity: sha512-lDWJp/pgSWCLfYsupmmNo96jfsbQnH1yjia8XVM2Kh8nRZhD0bQU2jCHuy3ZTPMLR3apRD3k145ybENalAYjYw==} + '@prisma/engines@7.9.1': + resolution: {integrity: sha512-UprXSMNXx2NF5ow4pqaQtE8OuBz6K78B0wc0tn2L28G5r933iWp1DR9Do2qWrsNvvFIP3x6mpEWnQtckMO0Uhg==} - '@prisma/fetch-engine@7.9.0': - resolution: {integrity: sha512-F0XlIgjbE3EywRVR/HpCerNI/dxo40vK66tHcWpsWYwH/Jk9+FsICEzATeMsZ7bdnpZz93hkD4sAb5rKLsCCpA==} + '@prisma/fetch-engine@7.9.1': + resolution: {integrity: sha512-9DwxrNTeT25Orbu9CWh0CZvVlyY1lmscpbaeLZcOnuR7zcuFrt91YSmmOfIm7zJ08YOZ6mVzURKwLoMwEBcK8w==} '@prisma/get-platform@7.2.0': resolution: {integrity: sha512-k1V0l0Td1732EHpAfi2eySTezyllok9dXb6UQanajkJQzPUGi3vO2z7jdkz67SypFTdmbnyGYxvEvYZdZsMAVA==} - '@prisma/get-platform@7.9.0': - resolution: {integrity: sha512-4awv6ATdgrHdLms0XKikCyfArn8BrUHZfqg0mtCKrI4+WJe24nmpsdwsypM9ozd03wa846AngY+zSbnngkMrXQ==} + '@prisma/get-platform@7.9.1': + resolution: {integrity: sha512-PK8R60YZRQvYxBrGG9i7l2/rFyzy+2MuI1dKtmtrCqPH8YpiJx/MfiC7LRzX5786rZDEv7BngcjfIJW4/9ADuw==} '@prisma/query-plan-executor@7.2.0': resolution: {integrity: sha512-EOZmNzcV8uJ0mae3DhTsiHgoNCuu1J9mULQpGCh62zN3PxPTd+qI9tJvk5jOst8WHKQNwJWR3b39t0XvfBB0WQ==} @@ -1208,33 +1208,33 @@ packages: '@tabler/icons@3.46.0': resolution: {integrity: sha512-f2RYFl3fzPwj5WO82x6en0dmkjefxEfOm16D1ByM6cj/McNiwOkL4VaPUoP9VVIrXAD9WnTSVFr70px703b//A==} - '@turbo/darwin-64@2.10.6': - resolution: {integrity: sha512-S+yIyZkmjYBQbIM7sTqMAwnLeMjSK60Q9grUDPbTWvkRjbsn5k1Rt5sPvTX80M4PnlYQBwLiYsjlu6tHsuIqQQ==} + '@turbo/darwin-64@2.10.8': + resolution: {integrity: sha512-po+7rfJfUnFXjWlcoN2RwhErgzCdRtBc1T26vYPcywHlggmCQiQe1uWaE4j+BibI2uY9/2pDoFzMN0rmSaPFOw==} cpu: [x64] os: [darwin] - '@turbo/darwin-arm64@2.10.6': - resolution: {integrity: sha512-gnS8G78EjvJzDc1+tFES5BYXdlF+292n+h57G9G+5LJYelRh195f4Ed22RCo4EFIbI4Du9S5xfE9YjrqhoZaxQ==} + '@turbo/darwin-arm64@2.10.8': + resolution: {integrity: sha512-+zB2btDJ00lnPRuqOvpVvgl4x34k/djZQGZTTCfjn7JgNCl8QFY5Njo5+dqkY1g/+9gbbsnAvWm9CmJg9ebcXA==} cpu: [arm64] os: [darwin] - '@turbo/linux-64@2.10.6': - resolution: {integrity: sha512-lPv5AVkzvhs4z6Isr2ZE2UYt9Ndym5aWSMEIRh9OROnAdyEG1CFugJwAn/aFuDMmiCoHasyvD5tTDmVVTTrYxw==} + '@turbo/linux-64@2.10.8': + resolution: {integrity: sha512-K1dxqiVisyN7cViVsfQLs6xscQbYuI8aO2nbUhFURDACgEDfZRdP/b4CCxeosBJpcMfhYyiibWqJorCnvz9kKg==} cpu: [x64] - os: [linux] + os: [android, linux] - '@turbo/linux-arm64@2.10.6': - resolution: {integrity: sha512-yeQ24es8pz+FhZxt25HIXj4ml7HpWMrmOL1BtCP4XUz7mBJZdAfC7z7HGF+wPSUZoKmoSZbL4r4QWbRddhPZIQ==} + '@turbo/linux-arm64@2.10.8': + resolution: {integrity: sha512-Gi77ibVnrE1fEmvr+/wBD/yvRqhwp/RQuCp2+//lv1U1wNFFyVg0V7Wj8FG9FXPFAw5QHReo8rxc9+wBSDZjzA==} cpu: [arm64] - os: [linux] + os: [android, linux] - '@turbo/windows-64@2.10.6': - resolution: {integrity: sha512-JiFscBN83F43VG3oM+QU2LvgHcf11tgirLJ3c1QDJBtulTCbDwupzIjqB9yBlfiMWAe6g3ssD6gqLP6a4g7FzA==} + '@turbo/windows-64@2.10.8': + resolution: {integrity: sha512-znnLO1haJPYTHoKMKwlAvlkjRiYbbhBzME6wIGaMd+fwir23U6jVd1ecaTWWi1fbnRVqxMfgDBKseQ/hLKb83g==} cpu: [x64] os: [win32] - '@turbo/windows-arm64@2.10.6': - resolution: {integrity: sha512-emWVdriXsaSVS5VXJxy4DppQ0UnGD+PUKu40DGjC3E5JXeoszL09B/1xU6B+Y8lJQg38cFoaB1NqGC4ayY5SQQ==} + '@turbo/windows-arm64@2.10.8': + resolution: {integrity: sha512-VN30vh3b3Czh2WzYHNTfF1FE0YMZ5aHsLO8dBMGHJewA6792wX6iJR8ZxlzFW6WdOu0gEAKIvlYhfyT81Wkm4Q==} cpu: [arm64] os: [win32] @@ -1295,12 +1295,6 @@ packages: '@types/node@14.18.63': resolution: {integrity: sha512-fAtCfv4jJg+ExtXhvCkCqUKZ+4ok/JQk01qDKhL5BDDoS3AxKXhV5/MAVUZyQnSEd2GT92fkgZl0pz0Q0AzcIQ==} - '@types/node@26.1.0': - resolution: {integrity: sha512-O0A1G3xPGy4w7AgQdAQYUlQ+BKk2Oovw8eRpofyp5KdBZULnbe+WqaOVNrm705SHphCiG4XHsACrSmPu1f+Kgw==} - - '@types/node@26.1.1': - resolution: {integrity: sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==} - '@types/node@26.1.2': resolution: {integrity: sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg==} @@ -1925,8 +1919,8 @@ packages: fast-querystring@1.1.2: resolution: {integrity: sha512-g6KuKWmFXc0fID8WWH0jit4g0AGBoJhCkJMb1RmbsSEUNvQ+ZC8D6CUZ+GtF8nMzSPXnhiePyyqqipzNNEnHjg==} - fast-uri@3.1.4: - resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==} + fast-uri@3.1.5: + resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} fastq@1.20.1: resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==} @@ -2473,14 +2467,6 @@ packages: postcss-value-parser@4.2.0: resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==} - postcss@8.5.22: - resolution: {integrity: sha512-KBDEIpLrvpv16pp3K0Fw+UCoZfopFjjgeB+0tA/aaThfEE74kKDLrgg603YvOWJyg3+WYtyq3xYsQWsIyZlPqQ==} - engines: {node: ^10 || ^12 || >=14} - - postcss@8.5.23: - resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==} - engines: {node: ^10 || ^12 || >=14} - postcss@8.5.25: resolution: {integrity: sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==} engines: {node: ^10 || ^12 || >=14} @@ -2573,8 +2559,8 @@ packages: engines: {node: '>=14'} hasBin: true - prisma@7.9.0: - resolution: {integrity: sha512-isQTJEK4pyOlAVzm6kBUDjzgdsgs0A/snpB38ycTHeOHW34qfepP+ClQltgDXqjZBnXALhEtE4duh9L3tN5fHw==} + prisma@7.9.1: + resolution: {integrity: sha512-aPqePoZIqwlAchbgbFDO/wHqGB+7H1nj9gaM+OsL9h77S5S3TnLd9BgD3LnoeDikULo7cl2HSUrEyQ55Z7DYbg==} engines: {node: ^20.19 || ^22.12 || >=24.0} hasBin: true peerDependencies: @@ -2903,8 +2889,8 @@ packages: engines: {node: '>=18.0.0'} hasBin: true - turbo@2.10.6: - resolution: {integrity: sha512-3VfH7fK7WQ/ZHYjvfWyVnPRpcNaX3ZqXfGDMdc82eGdM0ESATyxFK4R4PM3wNsVFsdkUFZ4pZpkNeG37dxOv+g==} + turbo@2.10.8: + resolution: {integrity: sha512-9+8YX5QOkGXzZxcIykTHgaooRHGMWO+jfdyRK0o+rN0U7hBIig2MrJ8r/aNzIPDPhdA73SGb0O+tIztaModTMg==} hasBin: true type-check@0.4.0: @@ -2929,8 +2915,8 @@ packages: undici-types@8.3.0: resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==} - undici@6.27.0: - resolution: {integrity: sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==} + undici@6.28.0: + resolution: {integrity: sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==} engines: {node: '>=18.17'} unzipper@0.10.14: @@ -2952,8 +2938,8 @@ packages: resolution: {integrity: sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==} hasBin: true - valibot@1.2.0: - resolution: {integrity: sha512-mm1rxUsmOxzrwnX5arGS+U4T25RdvpPjPN4yR0u9pUBov9+zGVtO84tif1eY4r6zWxVxu3KzIyknJy3rxfRZZg==} + valibot@1.4.2: + resolution: {integrity: sha512-gjdCvJ6d3RyHAneqxMYMW9QMCwYMb3jpOO0IyHZV1bnRHFBHrX3VkIILt5XYR0WhwHiH7Mty8ovuPZ/O3gamrg==} peerDependencies: typescript: '>=5' peerDependenciesMeta: @@ -3324,7 +3310,7 @@ snapshots: discord-api-types: 0.38.50 magic-bytes.js: 1.13.0 tslib: 2.8.1 - undici: 6.27.0 + undici: 6.28.0 '@discordjs/util@1.2.0': dependencies: @@ -3689,14 +3675,14 @@ snapshots: '@prisma/client-runtime-utils@7.9.1': {} - '@prisma/client@7.9.1(prisma@7.9.0(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3))(typescript@5.9.3)': + '@prisma/client@7.9.1(prisma@7.9.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3))(typescript@5.9.3)': dependencies: '@prisma/client-runtime-utils': 7.9.1 optionalDependencies: - prisma: 7.9.0(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3) + prisma: 7.9.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3) typescript: 5.9.3 - '@prisma/config@7.9.0': + '@prisma/config@7.9.1': dependencies: c12: 3.3.4 deepmerge-ts: 7.1.5 @@ -3707,11 +3693,9 @@ snapshots: '@prisma/debug@7.2.0': {} - '@prisma/debug@7.9.0': {} - '@prisma/debug@7.9.1': {} - '@prisma/dev@0.24.14(typescript@5.9.3)': + '@prisma/dev@0.24.17(typescript@5.9.3)': dependencies: '@electric-sql/pglite': 0.4.3 '@electric-sql/pglite-socket': 0.1.3(@electric-sql/pglite@0.4.3) @@ -3726,7 +3710,7 @@ snapshots: proper-lockfile: 4.1.2 remeda: 2.33.4 std-env: 3.10.0 - valibot: 1.2.0(typescript@5.9.3) + valibot: 1.4.2(typescript@5.9.3) zeptomatch: 2.1.0 transitivePeerDependencies: - typescript @@ -3737,26 +3721,26 @@ snapshots: '@prisma/engines-version@7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad': {} - '@prisma/engines@7.9.0': + '@prisma/engines@7.9.1': dependencies: - '@prisma/debug': 7.9.0 + '@prisma/debug': 7.9.1 '@prisma/engines-version': 7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad - '@prisma/fetch-engine': 7.9.0 - '@prisma/get-platform': 7.9.0 + '@prisma/fetch-engine': 7.9.1 + '@prisma/get-platform': 7.9.1 - '@prisma/fetch-engine@7.9.0': + '@prisma/fetch-engine@7.9.1': dependencies: - '@prisma/debug': 7.9.0 + '@prisma/debug': 7.9.1 '@prisma/engines-version': 7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad - '@prisma/get-platform': 7.9.0 + '@prisma/get-platform': 7.9.1 '@prisma/get-platform@7.2.0': dependencies: '@prisma/debug': 7.2.0 - '@prisma/get-platform@7.9.0': + '@prisma/get-platform@7.9.1': dependencies: - '@prisma/debug': 7.9.0 + '@prisma/debug': 7.9.1 '@prisma/query-plan-executor@7.2.0': {} @@ -3985,22 +3969,22 @@ snapshots: '@tabler/icons@3.46.0': {} - '@turbo/darwin-64@2.10.6': + '@turbo/darwin-64@2.10.8': optional: true - '@turbo/darwin-arm64@2.10.6': + '@turbo/darwin-arm64@2.10.8': optional: true - '@turbo/linux-64@2.10.6': + '@turbo/linux-64@2.10.8': optional: true - '@turbo/linux-arm64@2.10.6': + '@turbo/linux-arm64@2.10.8': optional: true - '@turbo/windows-64@2.10.6': + '@turbo/windows-64@2.10.8': optional: true - '@turbo/windows-arm64@2.10.6': + '@turbo/windows-arm64@2.10.8': optional: true '@types/chai@5.2.3': @@ -4052,21 +4036,13 @@ snapshots: '@types/node@14.18.63': {} - '@types/node@26.1.0': - dependencies: - undici-types: 8.3.0 - - '@types/node@26.1.1': - dependencies: - undici-types: 8.3.0 - '@types/node@26.1.2': dependencies: undici-types: 8.3.0 '@types/pg@8.20.0': dependencies: - '@types/node': 26.1.0 + '@types/node': 26.1.2 pg-protocol: 1.14.0 pg-types: 2.2.0 @@ -4078,7 +4054,7 @@ snapshots: '@types/qrcode@1.5.6': dependencies: - '@types/node': 26.1.0 + '@types/node': 26.1.2 '@types/react-dom@19.2.4(@types/react@19.2.18)': dependencies: @@ -4090,7 +4066,7 @@ snapshots: '@types/ws@8.18.1': dependencies: - '@types/node': 26.1.0 + '@types/node': 26.1.2 '@typescript-eslint/eslint-plugin@8.65.0(@typescript-eslint/parser@8.65.0(eslint@10.8.0(jiti@2.7.0))(typescript@5.9.3))(eslint@10.8.0(jiti@2.7.0))(typescript@5.9.3)': dependencies: @@ -4327,7 +4303,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.4 + fast-uri: 3.1.5 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -4386,13 +4362,13 @@ snapshots: async@3.2.6: {} - autoprefixer@10.5.4(postcss@8.5.23): + autoprefixer@10.5.4(postcss@8.5.25): dependencies: browserslist: 4.28.6 caniuse-lite: 1.0.30001806 fraction.js: 5.3.4 picocolors: 1.1.1 - postcss: 8.5.23 + postcss: 8.5.25 postcss-value-parser: 4.2.0 aws-ssl-profiles@1.1.2: {} @@ -4646,7 +4622,7 @@ snapshots: lodash.snakecase: 4.1.1 magic-bytes.js: 1.13.0 tslib: 2.8.1 - undici: 6.27.0 + undici: 6.28.0 transitivePeerDependencies: - bufferutil - utf-8-validate @@ -4830,7 +4806,7 @@ snapshots: dependencies: fast-decode-uri-component: 1.0.1 - fast-uri@3.1.4: {} + fast-uri@3.1.5: {} fastq@1.20.1: dependencies: @@ -5138,7 +5114,7 @@ snapshots: react: 19.2.8 react-dom: 19.2.8(react@19.2.8) - next@16.2.12(@types/node@26.1.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8): + next@16.2.12(@types/node@26.1.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8): dependencies: '@next/env': 16.2.12 '@swc/helpers': 0.5.15 @@ -5157,7 +5133,7 @@ snapshots: '@next/swc-linux-x64-musl': 16.2.12 '@next/swc-win32-arm64-msvc': 16.2.12 '@next/swc-win32-x64-msvc': 16.2.12 - sharp: 0.35.3(@types/node@26.1.1) + sharp: 0.35.3(@types/node@26.1.2) transitivePeerDependencies: - '@babel/core' - '@types/node' @@ -5282,29 +5258,29 @@ snapshots: pngjs@5.0.0: {} - postcss-import@15.1.0(postcss@8.5.22): + postcss-import@15.1.0(postcss@8.5.25): dependencies: - postcss: 8.5.22 + postcss: 8.5.25 postcss-value-parser: 4.2.0 read-cache: 1.0.0 resolve: 1.22.12 - postcss-js@4.1.0(postcss@8.5.22): + postcss-js@4.1.0(postcss@8.5.25): dependencies: camelcase-css: 2.0.1 - postcss: 8.5.22 + postcss: 8.5.25 - postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.22)(tsx@4.23.1): + postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.25)(tsx@4.23.1): dependencies: lilconfig: 3.1.3 optionalDependencies: jiti: 1.21.7 - postcss: 8.5.22 + postcss: 8.5.25 tsx: 4.23.1 - postcss-nested@6.2.0(postcss@8.5.22): + postcss-nested@6.2.0(postcss@8.5.25): dependencies: - postcss: 8.5.22 + postcss: 8.5.25 postcss-selector-parser: 6.1.4 postcss-selector-parser@6.1.4: @@ -5314,18 +5290,6 @@ snapshots: postcss-value-parser@4.2.0: {} - postcss@8.5.22: - dependencies: - nanoid: 3.3.16 - picocolors: 1.1.1 - source-map-js: 1.2.1 - - postcss@8.5.23: - dependencies: - nanoid: 3.3.16 - picocolors: 1.1.1 - source-map-js: 1.2.1 - postcss@8.5.25: dependencies: nanoid: 3.3.16 @@ -5354,11 +5318,11 @@ snapshots: prettier@3.9.6: {} - prisma@7.9.0(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3): + prisma@7.9.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3): dependencies: - '@prisma/config': 7.9.0 - '@prisma/dev': 0.24.14(typescript@5.9.3) - '@prisma/engines': 7.9.0 + '@prisma/config': 7.9.1 + '@prisma/dev': 0.24.17(typescript@5.9.3) + '@prisma/engines': 7.9.1 '@prisma/studio-core': 0.33.0(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) mysql2: 3.15.3 postgres: 3.4.7 @@ -5530,40 +5494,7 @@ snapshots: setimmediate@1.0.5: {} - sharp@0.35.3(@types/node@26.1.0): - dependencies: - '@img/colour': 1.1.0 - detect-libc: 2.1.2 - semver: 7.8.5 - optionalDependencies: - '@img/sharp-darwin-arm64': 0.35.3 - '@img/sharp-darwin-x64': 0.35.3 - '@img/sharp-freebsd-wasm32': 0.35.3 - '@img/sharp-libvips-darwin-arm64': 1.3.2 - '@img/sharp-libvips-darwin-x64': 1.3.2 - '@img/sharp-libvips-linux-arm': 1.3.2 - '@img/sharp-libvips-linux-arm64': 1.3.2 - '@img/sharp-libvips-linux-ppc64': 1.3.2 - '@img/sharp-libvips-linux-riscv64': 1.3.2 - '@img/sharp-libvips-linux-s390x': 1.3.2 - '@img/sharp-libvips-linux-x64': 1.3.2 - '@img/sharp-libvips-linuxmusl-arm64': 1.3.2 - '@img/sharp-libvips-linuxmusl-x64': 1.3.2 - '@img/sharp-linux-arm': 0.35.3 - '@img/sharp-linux-arm64': 0.35.3 - '@img/sharp-linux-ppc64': 0.35.3 - '@img/sharp-linux-riscv64': 0.35.3 - '@img/sharp-linux-s390x': 0.35.3 - '@img/sharp-linux-x64': 0.35.3 - '@img/sharp-linuxmusl-arm64': 0.35.3 - '@img/sharp-linuxmusl-x64': 0.35.3 - '@img/sharp-webcontainers-wasm32': 0.35.3 - '@img/sharp-win32-arm64': 0.35.3 - '@img/sharp-win32-ia32': 0.35.3 - '@img/sharp-win32-x64': 0.35.3 - '@types/node': 26.1.0 - - sharp@0.35.3(@types/node@26.1.1): + sharp@0.35.3(@types/node@26.1.2): dependencies: '@img/colour': 1.1.0 detect-libc: 2.1.2 @@ -5594,8 +5525,7 @@ snapshots: '@img/sharp-win32-arm64': 0.35.3 '@img/sharp-win32-ia32': 0.35.3 '@img/sharp-win32-x64': 0.35.3 - '@types/node': 26.1.1 - optional: true + '@types/node': 26.1.2 shebang-command@2.0.0: dependencies: @@ -5641,9 +5571,9 @@ snapshots: dependencies: ansi-regex: 5.0.1 - stripe@22.4.0(@types/node@26.1.1): + stripe@22.4.0(@types/node@26.1.2): optionalDependencies: - '@types/node': 26.1.1 + '@types/node': 26.1.2 styled-jsx@5.1.6(react@19.2.8): dependencies: @@ -5684,11 +5614,11 @@ snapshots: normalize-path: 3.0.0 object-hash: 3.0.0 picocolors: 1.1.1 - postcss: 8.5.22 - postcss-import: 15.1.0(postcss@8.5.22) - postcss-js: 4.1.0(postcss@8.5.22) - postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.22)(tsx@4.23.1) - postcss-nested: 6.2.0(postcss@8.5.22) + postcss: 8.5.25 + postcss-import: 15.1.0(postcss@8.5.25) + postcss-js: 4.1.0(postcss@8.5.25) + postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.25)(tsx@4.23.1) + postcss-nested: 6.2.0(postcss@8.5.25) postcss-selector-parser: 6.1.4 resolve: 1.22.12 sucrase: 3.35.1 @@ -5749,14 +5679,14 @@ snapshots: optionalDependencies: fsevents: 2.3.3 - turbo@2.10.6: + turbo@2.10.8: optionalDependencies: - '@turbo/darwin-64': 2.10.6 - '@turbo/darwin-arm64': 2.10.6 - '@turbo/linux-64': 2.10.6 - '@turbo/linux-arm64': 2.10.6 - '@turbo/windows-64': 2.10.6 - '@turbo/windows-arm64': 2.10.6 + '@turbo/darwin-64': 2.10.8 + '@turbo/darwin-arm64': 2.10.8 + '@turbo/linux-64': 2.10.8 + '@turbo/linux-arm64': 2.10.8 + '@turbo/windows-64': 2.10.8 + '@turbo/windows-arm64': 2.10.8 type-check@0.4.0: dependencies: @@ -5779,7 +5709,7 @@ snapshots: undici-types@8.3.0: {} - undici@6.27.0: {} + undici@6.28.0: {} unzipper@0.10.14: dependencies: @@ -5808,7 +5738,7 @@ snapshots: uuid@14.0.1: {} - valibot@1.2.0(typescript@5.9.3): + valibot@1.4.2(typescript@5.9.3): optionalDependencies: typescript: 5.9.3 @@ -5840,7 +5770,7 @@ snapshots: jiti: 2.7.0 tsx: 4.23.1 - vitest@4.1.10(@types/node@26.1.1)(vite@7.3.5(@types/node@26.1.2)(jiti@1.21.7)(tsx@4.23.1)): + vitest@4.1.10(@types/node@26.1.2)(vite@7.3.5(@types/node@26.1.2)(jiti@1.21.7)(tsx@4.23.1)): dependencies: '@vitest/expect': 4.1.10 '@vitest/mocker': 4.1.10(vite@7.3.5(@types/node@26.1.2)(jiti@1.21.7)(tsx@4.23.1)) @@ -5863,11 +5793,11 @@ snapshots: vite: 7.3.5(@types/node@26.1.2)(jiti@1.21.7)(tsx@4.23.1) why-is-node-running: 2.3.0 optionalDependencies: - '@types/node': 26.1.1 + '@types/node': 26.1.2 transitivePeerDependencies: - msw - vitest@4.1.10(@types/node@26.1.1)(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)): + vitest@4.1.10(@types/node@26.1.2)(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)): dependencies: '@vitest/expect': 4.1.10 '@vitest/mocker': 4.1.10(vite@7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1)) @@ -5890,7 +5820,7 @@ snapshots: vite: 7.3.5(@types/node@26.1.2)(jiti@2.7.0)(tsx@4.23.1) why-is-node-running: 2.3.0 optionalDependencies: - '@types/node': 26.1.1 + '@types/node': 26.1.2 transitivePeerDependencies: - msw diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 0899b77..f02508a 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -16,7 +16,10 @@ allowBuilds: overrides: "esbuild@<0.28.1": ">=0.28.1" "postcss@<8.5.10": ">=8.5.10" - "undici@<6.27.0": "^6.27.0" + # GHSA-8xcm-r25x-g524 / GHSA-m8rv-5g2x-5cg5 / GHSA-v3r7-h72x-cjcm — three undici + # advisories all first patched in 6.28.0. Transitive via discord.js, which pins + # the version exactly, so the bot only gets the fix through this override. + "undici@<6.28.0": "^6.28.0" # GHSA-w5hq-g745-h8pq — uuid missing buffer bounds check in v3/v5/v6 (transitive # via exceljs, which only uses v4). Force the patched line; v4 API is unchanged. "uuid@<11.1.1": ">=11.1.1" @@ -24,9 +27,10 @@ overrides: # @prisma/dev swapped hono for a pinned find-my-way 9.6.0. Dev-only, patched in # 9.7.0; the override is needed because the dependency is pinned exactly. "find-my-way@<9.7.0": ">=9.7.0 <10" - # GHSA-4c8g-83qw-93j6 — fast-uri host confusion via failed IDN canonicalization + # GHSA-4c8g-83qw-93j6 — fast-uri host confusion via failed IDN canonicalization, + # then GHSA-7p8r-x3mc-p8w7 on top, which flags everything below 3.1.5 # (transitive via ajv, dev-only). Stay on the 3.x line ajv asks for. - "fast-uri@<3.1.3": ">=3.1.3 <4" + "fast-uri@<3.1.5": ">=3.1.5 <4" # GHSA-f88m-g3jw-g9cj — libvips CVEs inherited by sharp. We depend on 0.35.x # directly; this only lifts the older copy next pulls in as an optional dep. "sharp@<0.35.0": ">=0.35.0"