From 777f2ac15ab188953313f625f0b954496c4862f6 Mon Sep 17 00:00:00 2001 From: Jean Paul Elisa NIYOKWIZERWA Date: Sat, 1 Aug 2026 20:05:22 +0200 Subject: [PATCH] security: close the last 5 advisories via verified resolution overrides MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Takes open Dependabot alerts from 5 to 0. Each of these is pinned by an upstream package rather than declared here, so no manifest or lockfile bump could reach the patched version. A Yarn `resolutions` entry is the only mechanism available — applied only after verifying the forced version works. Root package.json: esbuild ^0.28.1 tsup 8.5.1 (latest) declares esbuild ^0.27.0, so the tree was stuck at 0.27.7, inside the vulnerable range >= 0.27.3 < 0.28.1. #50 Forcing 0.28.1 collapses the tree to a single esbuild copy. Verified that the packages that declared ^0.27.0 / ~0.27.0 still work: tsup builds the library, tsx runs scripts, storybook builds, 286 tests pass at 92.9% statement coverage, typecheck and lint clean. examples/nextjs-demo/package.json: postcss ^8.5.25 next depends on exactly postcss@8.4.31 — still true in next 16.2.12, so even a major upgrade would not have helped. #24, #102, #104 sharp ^0.35.3 next declares sharp ^0.34.5; the fix is 0.35.0, outside that range. #87 Verified: next build compiles and prerenders all 3 static pages. These overrides are liabilities, not fixes we own — they force versions the upstream packages did not test against. SECURITY.md now documents each one with what pins it, which advisory it answers, the exact condition for removing it, and the commands to check whether upstream has caught up. --- SECURITY.md | 38 ++++ examples/nextjs-demo/package.json | 4 + examples/nextjs-demo/yarn.lock | 296 ++++++++++++++++-------------- package.json | 3 + yarn.lock | 273 +-------------------------- 5 files changed, 206 insertions(+), 408 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 034e848..2f124fa 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -19,3 +19,41 @@ Use this section to tell people how to report a vulnerability. Tell them where to go, how often they can expect to get an update on a reported vulnerability, what to expect if the vulnerability is accepted or declined, etc. + +## Dependency overrides + +Some advisories cannot be closed by a version bump, because the vulnerable +package is pinned by an upstream dependency rather than declared here. Where +that happens we use a Yarn `resolutions` entry, but only after verifying the +forced version actually works. + +Each override below is a liability, not a fix we own: it forces a version the +upstream package did not test against. **Remove the entry as soon as upstream +ships a release that satisfies the advisory on its own**, and re-run the +verification listed beside it. + +### `package.json` (root) + +| Override | Pinned by | Advisory | Remove when | +| --- | --- | --- | --- | +| `esbuild: ^0.28.1` | `tsup` declares `esbuild@^0.27.0`, which cannot reach the patched 0.28.1 | GHSA-g7r4-m6w7-qqqr | `tsup` ships a release depending on `esbuild@^0.28` | + +Verified with: `yarn build` (tsup), `yarn test:coverage`, `yarn build-storybook`, +`yarn typecheck`, `yarn lint`, and a `tsx` script run (`yarn clean`). + +### `examples/nextjs-demo/package.json` + +| Override | Pinned by | Advisory | Remove when | +| --- | --- | --- | --- | +| `postcss: ^8.5.25` | `next` depends on exactly `postcss@8.4.31` | GHSA-r28c-9q8g-f849, GHSA-6g55-p6wh-862q, GHSA-qx2v-qp2m-jg93 | `next` depends on `postcss >= 8.5.18` | +| `sharp: ^0.35.3` | `next` declares `sharp@^0.34.5` | GHSA-f88m-g3jw-g9cj | `next` declares `sharp@^0.35` | + +Verified with: `yarn build` in `examples/nextjs-demo` (compiles and prerenders +all static pages). + +To check whether an override is still needed: + +```sh +npm view tsup dependencies.esbuild +npm view next dependencies.postcss optionalDependencies.sharp +``` diff --git a/examples/nextjs-demo/package.json b/examples/nextjs-demo/package.json index c444f75..b04b3f9 100644 --- a/examples/nextjs-demo/package.json +++ b/examples/nextjs-demo/package.json @@ -18,5 +18,9 @@ "@types/react": "^19.1.8", "@types/react-dom": "^19.1.6", "typescript": "^5.9.3" + }, + "resolutions": { + "postcss": "^8.5.25", + "sharp": "^0.35.3" } } diff --git a/examples/nextjs-demo/yarn.lock b/examples/nextjs-demo/yarn.lock index 8ae9027..495c654 100644 --- a/examples/nextjs-demo/yarn.lock +++ b/examples/nextjs-demo/yarn.lock @@ -5,12 +5,12 @@ __metadata: version: 8 cacheKey: 10c0 -"@emnapi/runtime@npm:^1.7.0": - version: 1.9.1 - resolution: "@emnapi/runtime@npm:1.9.1" +"@emnapi/runtime@npm:^1.11.1": + version: 1.11.3 + resolution: "@emnapi/runtime@npm:1.11.3" dependencies: tslib: "npm:^2.4.0" - checksum: 10c0/750edca117e0363ab2de10622f8ee60e57d8690c2f29c49704813da5cd627c641798d7f3cb0d953c62fdc71688e02e333ddbf2c1204f38b47e3e40657332a6f5 + checksum: 10c0/a00f1020fefb9d4145c367f93a9fddb383a00da8ffd7871e20b19659890379b83aeecb9f84d7d0eda5456343f4a09eb05b0acb5153b0d3d889539dedb1ed87c3 languageName: node linkType: hard @@ -40,18 +40,18 @@ __metadata: languageName: node linkType: hard -"@img/colour@npm:^1.0.0": +"@img/colour@npm:^1.1.0": version: 1.1.0 resolution: "@img/colour@npm:1.1.0" checksum: 10c0/2ebea2c0bbaee73b99badcefa04e1e71d83f36e5369337d3121dca841f4569533c4e2faddda6d62dd247f0d5cca143711f9446c59bcce81e427ba433a7a94a17 languageName: node linkType: hard -"@img/sharp-darwin-arm64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-darwin-arm64@npm:0.34.5" +"@img/sharp-darwin-arm64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-darwin-arm64@npm:0.35.3" dependencies: - "@img/sharp-libvips-darwin-arm64": "npm:1.2.4" + "@img/sharp-libvips-darwin-arm64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-darwin-arm64": optional: true @@ -59,11 +59,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-darwin-x64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-darwin-x64@npm:0.34.5" +"@img/sharp-darwin-x64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-darwin-x64@npm:0.35.3" dependencies: - "@img/sharp-libvips-darwin-x64": "npm:1.2.4" + "@img/sharp-libvips-darwin-x64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-darwin-x64": optional: true @@ -71,81 +71,90 @@ __metadata: languageName: node linkType: hard -"@img/sharp-libvips-darwin-arm64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-darwin-arm64@npm:1.2.4" +"@img/sharp-freebsd-wasm32@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-freebsd-wasm32@npm:0.35.3" + dependencies: + "@img/sharp-wasm32": "npm:0.35.3" + conditions: os=freebsd + languageName: node + linkType: hard + +"@img/sharp-libvips-darwin-arm64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-darwin-arm64@npm:1.3.2" conditions: os=darwin & cpu=arm64 languageName: node linkType: hard -"@img/sharp-libvips-darwin-x64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-darwin-x64@npm:1.2.4" +"@img/sharp-libvips-darwin-x64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-darwin-x64@npm:1.3.2" conditions: os=darwin & cpu=x64 languageName: node linkType: hard -"@img/sharp-libvips-linux-arm64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linux-arm64@npm:1.2.4" +"@img/sharp-libvips-linux-arm64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linux-arm64@npm:1.3.2" conditions: os=linux & cpu=arm64 & libc=glibc languageName: node linkType: hard -"@img/sharp-libvips-linux-arm@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linux-arm@npm:1.2.4" +"@img/sharp-libvips-linux-arm@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linux-arm@npm:1.3.2" conditions: os=linux & cpu=arm & libc=glibc languageName: node linkType: hard -"@img/sharp-libvips-linux-ppc64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linux-ppc64@npm:1.2.4" +"@img/sharp-libvips-linux-ppc64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linux-ppc64@npm:1.3.2" conditions: os=linux & cpu=ppc64 & libc=glibc languageName: node linkType: hard -"@img/sharp-libvips-linux-riscv64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linux-riscv64@npm:1.2.4" +"@img/sharp-libvips-linux-riscv64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linux-riscv64@npm:1.3.2" conditions: os=linux & cpu=riscv64 & libc=glibc languageName: node linkType: hard -"@img/sharp-libvips-linux-s390x@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linux-s390x@npm:1.2.4" +"@img/sharp-libvips-linux-s390x@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linux-s390x@npm:1.3.2" conditions: os=linux & cpu=s390x & libc=glibc languageName: node linkType: hard -"@img/sharp-libvips-linux-x64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linux-x64@npm:1.2.4" +"@img/sharp-libvips-linux-x64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linux-x64@npm:1.3.2" conditions: os=linux & cpu=x64 & libc=glibc languageName: node linkType: hard -"@img/sharp-libvips-linuxmusl-arm64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linuxmusl-arm64@npm:1.2.4" +"@img/sharp-libvips-linuxmusl-arm64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linuxmusl-arm64@npm:1.3.2" conditions: os=linux & cpu=arm64 & libc=musl languageName: node linkType: hard -"@img/sharp-libvips-linuxmusl-x64@npm:1.2.4": - version: 1.2.4 - resolution: "@img/sharp-libvips-linuxmusl-x64@npm:1.2.4" +"@img/sharp-libvips-linuxmusl-x64@npm:1.3.2": + version: 1.3.2 + resolution: "@img/sharp-libvips-linuxmusl-x64@npm:1.3.2" conditions: os=linux & cpu=x64 & libc=musl languageName: node linkType: hard -"@img/sharp-linux-arm64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linux-arm64@npm:0.34.5" +"@img/sharp-linux-arm64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linux-arm64@npm:0.35.3" dependencies: - "@img/sharp-libvips-linux-arm64": "npm:1.2.4" + "@img/sharp-libvips-linux-arm64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linux-arm64": optional: true @@ -153,11 +162,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-linux-arm@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linux-arm@npm:0.34.5" +"@img/sharp-linux-arm@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linux-arm@npm:0.35.3" dependencies: - "@img/sharp-libvips-linux-arm": "npm:1.2.4" + "@img/sharp-libvips-linux-arm": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linux-arm": optional: true @@ -165,11 +174,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-linux-ppc64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linux-ppc64@npm:0.34.5" +"@img/sharp-linux-ppc64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linux-ppc64@npm:0.35.3" dependencies: - "@img/sharp-libvips-linux-ppc64": "npm:1.2.4" + "@img/sharp-libvips-linux-ppc64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linux-ppc64": optional: true @@ -177,11 +186,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-linux-riscv64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linux-riscv64@npm:0.34.5" +"@img/sharp-linux-riscv64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linux-riscv64@npm:0.35.3" dependencies: - "@img/sharp-libvips-linux-riscv64": "npm:1.2.4" + "@img/sharp-libvips-linux-riscv64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linux-riscv64": optional: true @@ -189,11 +198,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-linux-s390x@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linux-s390x@npm:0.34.5" +"@img/sharp-linux-s390x@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linux-s390x@npm:0.35.3" dependencies: - "@img/sharp-libvips-linux-s390x": "npm:1.2.4" + "@img/sharp-libvips-linux-s390x": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linux-s390x": optional: true @@ -201,11 +210,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-linux-x64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linux-x64@npm:0.34.5" +"@img/sharp-linux-x64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linux-x64@npm:0.35.3" dependencies: - "@img/sharp-libvips-linux-x64": "npm:1.2.4" + "@img/sharp-libvips-linux-x64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linux-x64": optional: true @@ -213,11 +222,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-linuxmusl-arm64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linuxmusl-arm64@npm:0.34.5" +"@img/sharp-linuxmusl-arm64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linuxmusl-arm64@npm:0.35.3" dependencies: - "@img/sharp-libvips-linuxmusl-arm64": "npm:1.2.4" + "@img/sharp-libvips-linuxmusl-arm64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linuxmusl-arm64": optional: true @@ -225,11 +234,11 @@ __metadata: languageName: node linkType: hard -"@img/sharp-linuxmusl-x64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-linuxmusl-x64@npm:0.34.5" +"@img/sharp-linuxmusl-x64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-linuxmusl-x64@npm:0.35.3" dependencies: - "@img/sharp-libvips-linuxmusl-x64": "npm:1.2.4" + "@img/sharp-libvips-linuxmusl-x64": "npm:1.3.2" dependenciesMeta: "@img/sharp-libvips-linuxmusl-x64": optional: true @@ -237,32 +246,41 @@ __metadata: languageName: node linkType: hard -"@img/sharp-wasm32@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-wasm32@npm:0.34.5" +"@img/sharp-wasm32@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-wasm32@npm:0.35.3" + dependencies: + "@emnapi/runtime": "npm:^1.11.1" + checksum: 10c0/627125c330ab96e324c888d3c43fa72eb7c975e653277755121df14447373b7b47b011a1eae9c8c360a9535a7072bd6205b6498974006124b513c033a07e0e32 + languageName: node + linkType: hard + +"@img/sharp-webcontainers-wasm32@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-webcontainers-wasm32@npm:0.35.3" dependencies: - "@emnapi/runtime": "npm:^1.7.0" + "@img/sharp-wasm32": "npm:0.35.3" conditions: cpu=wasm32 languageName: node linkType: hard -"@img/sharp-win32-arm64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-win32-arm64@npm:0.34.5" +"@img/sharp-win32-arm64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-win32-arm64@npm:0.35.3" conditions: os=win32 & cpu=arm64 languageName: node linkType: hard -"@img/sharp-win32-ia32@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-win32-ia32@npm:0.34.5" +"@img/sharp-win32-ia32@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-win32-ia32@npm:0.35.3" conditions: os=win32 & cpu=ia32 languageName: node linkType: hard -"@img/sharp-win32-x64@npm:0.34.5": - version: 0.34.5 - resolution: "@img/sharp-win32-x64@npm:0.34.5" +"@img/sharp-win32-x64@npm:0.35.3": + version: 0.35.3 + resolution: "@img/sharp-win32-x64@npm:0.35.3" conditions: os=win32 & cpu=x64 languageName: node linkType: hard @@ -914,12 +932,12 @@ __metadata: languageName: node linkType: hard -"nanoid@npm:^3.3.6": - version: 3.3.11 - resolution: "nanoid@npm:3.3.11" +"nanoid@npm:^3.3.16": + version: 3.3.16 + resolution: "nanoid@npm:3.3.16" bin: nanoid: bin/nanoid.cjs - checksum: 10c0/40e7f70b3d15f725ca072dfc4f74e81fcf1fbb02e491cf58ac0c79093adc9b0a73b152bcde57df4b79cd097e13023d7504acb38404a4da7bc1cd8e887b82fe0b + checksum: 10c0/bbf2dcffe22d2b62d16de2711752070b539c0f644c7916f823ad6521986b2078cbe524f2d6240f58c46e9141ea0c7b87a029e100c0f7f175228cacaf30e41bba languageName: node linkType: hard @@ -1004,21 +1022,21 @@ __metadata: languageName: node linkType: hard -"picocolors@npm:^1.0.0": +"picocolors@npm:^1.1.1": version: 1.1.1 resolution: "picocolors@npm:1.1.1" checksum: 10c0/e2e3e8170ab9d7c7421969adaa7e1b31434f789afb9b3f115f6b96d91945041ac3ceb02e9ec6fe6510ff036bcc0bf91e69a1772edc0b707e12b19c0f2d6bcf58 languageName: node linkType: hard -"postcss@npm:8.4.31": - version: 8.4.31 - resolution: "postcss@npm:8.4.31" +"postcss@npm:^8.5.25": + version: 8.5.25 + resolution: "postcss@npm:8.5.25" dependencies: - nanoid: "npm:^3.3.6" - picocolors: "npm:^1.0.0" - source-map-js: "npm:^1.0.2" - checksum: 10c0/748b82e6e5fc34034dcf2ae88ea3d11fd09f69b6c50ecdd3b4a875cfc7cdca435c958b211e2cb52355422ab6fccb7d8f2f2923161d7a1b281029e4a913d59acf + nanoid: "npm:^3.3.16" + picocolors: "npm:^1.1.1" + source-map-js: "npm:^1.2.1" + checksum: 10c0/0a12c1e74b456c57122e81f684e02fd98ff4d57526f794d10c996df1147158808f5ae373ac82b988c8de6cbbaa82dbd7b13803b14f5dd3cf7cc6a42ccad5c9f2 languageName: node linkType: hard @@ -1280,51 +1298,54 @@ __metadata: languageName: node linkType: hard -"semver@npm:^7.7.3": - version: 7.7.4 - resolution: "semver@npm:7.7.4" +"semver@npm:^7.8.5": + version: 7.8.5 + resolution: "semver@npm:7.8.5" bin: semver: bin/semver.js - checksum: 10c0/5215ad0234e2845d4ea5bb9d836d42b03499546ddafb12075566899fc617f68794bb6f146076b6881d755de17d6c6cc73372555879ec7dce2c2feee947866ad2 + checksum: 10c0/b1f3127a5be8125a94f37188b361c212466c292c6910adce3ec106cff5dc211ccaedc4739c11bb70fda59d6fc1f040a9bca289f4e093451521a2372e5231fe0c languageName: node linkType: hard -"sharp@npm:^0.34.3": - version: 0.34.5 - resolution: "sharp@npm:0.34.5" +"sharp@npm:^0.35.3": + version: 0.35.3 + resolution: "sharp@npm:0.35.3" dependencies: - "@img/colour": "npm:^1.0.0" - "@img/sharp-darwin-arm64": "npm:0.34.5" - "@img/sharp-darwin-x64": "npm:0.34.5" - "@img/sharp-libvips-darwin-arm64": "npm:1.2.4" - "@img/sharp-libvips-darwin-x64": "npm:1.2.4" - "@img/sharp-libvips-linux-arm": "npm:1.2.4" - "@img/sharp-libvips-linux-arm64": "npm:1.2.4" - "@img/sharp-libvips-linux-ppc64": "npm:1.2.4" - "@img/sharp-libvips-linux-riscv64": "npm:1.2.4" - "@img/sharp-libvips-linux-s390x": "npm:1.2.4" - "@img/sharp-libvips-linux-x64": "npm:1.2.4" - "@img/sharp-libvips-linuxmusl-arm64": "npm:1.2.4" - "@img/sharp-libvips-linuxmusl-x64": "npm:1.2.4" - "@img/sharp-linux-arm": "npm:0.34.5" - "@img/sharp-linux-arm64": "npm:0.34.5" - "@img/sharp-linux-ppc64": "npm:0.34.5" - "@img/sharp-linux-riscv64": "npm:0.34.5" - "@img/sharp-linux-s390x": "npm:0.34.5" - "@img/sharp-linux-x64": "npm:0.34.5" - "@img/sharp-linuxmusl-arm64": "npm:0.34.5" - "@img/sharp-linuxmusl-x64": "npm:0.34.5" - "@img/sharp-wasm32": "npm:0.34.5" - "@img/sharp-win32-arm64": "npm:0.34.5" - "@img/sharp-win32-ia32": "npm:0.34.5" - "@img/sharp-win32-x64": "npm:0.34.5" + "@img/colour": "npm:^1.1.0" + "@img/sharp-darwin-arm64": "npm:0.35.3" + "@img/sharp-darwin-x64": "npm:0.35.3" + "@img/sharp-freebsd-wasm32": "npm:0.35.3" + "@img/sharp-libvips-darwin-arm64": "npm:1.3.2" + "@img/sharp-libvips-darwin-x64": "npm:1.3.2" + "@img/sharp-libvips-linux-arm": "npm:1.3.2" + "@img/sharp-libvips-linux-arm64": "npm:1.3.2" + "@img/sharp-libvips-linux-ppc64": "npm:1.3.2" + "@img/sharp-libvips-linux-riscv64": "npm:1.3.2" + "@img/sharp-libvips-linux-s390x": "npm:1.3.2" + "@img/sharp-libvips-linux-x64": "npm:1.3.2" + "@img/sharp-libvips-linuxmusl-arm64": "npm:1.3.2" + "@img/sharp-libvips-linuxmusl-x64": "npm:1.3.2" + "@img/sharp-linux-arm": "npm:0.35.3" + "@img/sharp-linux-arm64": "npm:0.35.3" + "@img/sharp-linux-ppc64": "npm:0.35.3" + "@img/sharp-linux-riscv64": "npm:0.35.3" + "@img/sharp-linux-s390x": "npm:0.35.3" + "@img/sharp-linux-x64": "npm:0.35.3" + "@img/sharp-linuxmusl-arm64": "npm:0.35.3" + "@img/sharp-linuxmusl-x64": "npm:0.35.3" + "@img/sharp-webcontainers-wasm32": "npm:0.35.3" + "@img/sharp-win32-arm64": "npm:0.35.3" + "@img/sharp-win32-ia32": "npm:0.35.3" + "@img/sharp-win32-x64": "npm:0.35.3" detect-libc: "npm:^2.1.2" - semver: "npm:^7.7.3" + semver: "npm:^7.8.5" dependenciesMeta: "@img/sharp-darwin-arm64": optional: true "@img/sharp-darwin-x64": optional: true + "@img/sharp-freebsd-wasm32": + optional: true "@img/sharp-libvips-darwin-arm64": optional: true "@img/sharp-libvips-darwin-x64": @@ -1361,7 +1382,7 @@ __metadata: optional: true "@img/sharp-linuxmusl-x64": optional: true - "@img/sharp-wasm32": + "@img/sharp-webcontainers-wasm32": optional: true "@img/sharp-win32-arm64": optional: true @@ -1369,11 +1390,14 @@ __metadata: optional: true "@img/sharp-win32-x64": optional: true - checksum: 10c0/fd79e29df0597a7d5704b8461c51f944ead91a5243691697be6e8243b966402beda53ddc6f0a53b96ea3cb8221f0b244aa588114d3ebf8734fb4aefd41ab802f + peerDependenciesMeta: + "@types/node": + optional: true + checksum: 10c0/d99d60fc716aacbf42fcb0eb6d129142e0912eb23310adf48bc94e6989e27c838c5b5f507b928c723c72d265f9ceea3d4b1207e8fd5929797b23005663ce1d07 languageName: node linkType: hard -"source-map-js@npm:^1.0.2": +"source-map-js@npm:^1.2.1": version: 1.2.1 resolution: "source-map-js@npm:1.2.1" checksum: 10c0/7bda1fc4c197e3c6ff17de1b8b2c20e60af81b63a52cb32ec5a5d67a20a7d42651e2cb34ebe93833c5a2a084377e17455854fee3e21e7925c64a51b6a52b0faf diff --git a/package.json b/package.json index f9124b4..a9c0b4c 100644 --- a/package.json +++ b/package.json @@ -122,5 +122,8 @@ "typescript": "^5.9.3", "vite": "^8.0.16", "vitest": "^4.1.0" + }, + "resolutions": { + "esbuild": "^0.28.1" } } diff --git a/yarn.lock b/yarn.lock index c671c4b..dc018b1 100644 --- a/yarn.lock +++ b/yarn.lock @@ -379,13 +379,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/aix-ppc64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/aix-ppc64@npm:0.27.7" - conditions: os=aix & cpu=ppc64 - languageName: node - linkType: hard - "@esbuild/aix-ppc64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/aix-ppc64@npm:0.28.1" @@ -393,13 +386,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/android-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/android-arm64@npm:0.27.7" - conditions: os=android & cpu=arm64 - languageName: node - linkType: hard - "@esbuild/android-arm64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/android-arm64@npm:0.28.1" @@ -407,13 +393,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/android-arm@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/android-arm@npm:0.27.7" - conditions: os=android & cpu=arm - languageName: node - linkType: hard - "@esbuild/android-arm@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/android-arm@npm:0.28.1" @@ -421,13 +400,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/android-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/android-x64@npm:0.27.7" - conditions: os=android & cpu=x64 - languageName: node - linkType: hard - "@esbuild/android-x64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/android-x64@npm:0.28.1" @@ -435,13 +407,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/darwin-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/darwin-arm64@npm:0.27.7" - conditions: os=darwin & cpu=arm64 - languageName: node - linkType: hard - "@esbuild/darwin-arm64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/darwin-arm64@npm:0.28.1" @@ -449,13 +414,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/darwin-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/darwin-x64@npm:0.27.7" - conditions: os=darwin & cpu=x64 - languageName: node - linkType: hard - "@esbuild/darwin-x64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/darwin-x64@npm:0.28.1" @@ -463,13 +421,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/freebsd-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/freebsd-arm64@npm:0.27.7" - conditions: os=freebsd & cpu=arm64 - languageName: node - linkType: hard - "@esbuild/freebsd-arm64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/freebsd-arm64@npm:0.28.1" @@ -477,13 +428,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/freebsd-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/freebsd-x64@npm:0.27.7" - conditions: os=freebsd & cpu=x64 - languageName: node - linkType: hard - "@esbuild/freebsd-x64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/freebsd-x64@npm:0.28.1" @@ -491,13 +435,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-arm64@npm:0.27.7" - conditions: os=linux & cpu=arm64 - languageName: node - linkType: hard - "@esbuild/linux-arm64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/linux-arm64@npm:0.28.1" @@ -505,13 +442,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-arm@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-arm@npm:0.27.7" - conditions: os=linux & cpu=arm - languageName: node - linkType: hard - "@esbuild/linux-arm@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/linux-arm@npm:0.28.1" @@ -519,13 +449,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-ia32@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-ia32@npm:0.27.7" - conditions: os=linux & cpu=ia32 - languageName: node - linkType: hard - "@esbuild/linux-ia32@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/linux-ia32@npm:0.28.1" @@ -533,13 +456,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-loong64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-loong64@npm:0.27.7" - conditions: os=linux & cpu=loong64 - languageName: node - linkType: hard - "@esbuild/linux-loong64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/linux-loong64@npm:0.28.1" @@ -547,13 +463,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-mips64el@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-mips64el@npm:0.27.7" - conditions: os=linux & cpu=mips64el - languageName: node - linkType: hard - "@esbuild/linux-mips64el@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/linux-mips64el@npm:0.28.1" @@ -561,13 +470,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-ppc64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-ppc64@npm:0.27.7" - conditions: os=linux & cpu=ppc64 - languageName: node - linkType: hard - "@esbuild/linux-ppc64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/linux-ppc64@npm:0.28.1" @@ -575,13 +477,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-riscv64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-riscv64@npm:0.27.7" - conditions: os=linux & cpu=riscv64 - languageName: node - linkType: hard - "@esbuild/linux-riscv64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/linux-riscv64@npm:0.28.1" @@ -589,13 +484,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-s390x@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-s390x@npm:0.27.7" - conditions: os=linux & cpu=s390x - languageName: node - linkType: hard - "@esbuild/linux-s390x@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/linux-s390x@npm:0.28.1" @@ -603,13 +491,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-x64@npm:0.27.7" - conditions: os=linux & cpu=x64 - languageName: node - linkType: hard - "@esbuild/linux-x64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/linux-x64@npm:0.28.1" @@ -617,13 +498,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/netbsd-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/netbsd-arm64@npm:0.27.7" - conditions: os=netbsd & cpu=arm64 - languageName: node - linkType: hard - "@esbuild/netbsd-arm64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/netbsd-arm64@npm:0.28.1" @@ -631,13 +505,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/netbsd-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/netbsd-x64@npm:0.27.7" - conditions: os=netbsd & cpu=x64 - languageName: node - linkType: hard - "@esbuild/netbsd-x64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/netbsd-x64@npm:0.28.1" @@ -645,13 +512,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/openbsd-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/openbsd-arm64@npm:0.27.7" - conditions: os=openbsd & cpu=arm64 - languageName: node - linkType: hard - "@esbuild/openbsd-arm64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/openbsd-arm64@npm:0.28.1" @@ -659,13 +519,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/openbsd-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/openbsd-x64@npm:0.27.7" - conditions: os=openbsd & cpu=x64 - languageName: node - linkType: hard - "@esbuild/openbsd-x64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/openbsd-x64@npm:0.28.1" @@ -673,13 +526,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/openharmony-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/openharmony-arm64@npm:0.27.7" - conditions: os=openharmony & cpu=arm64 - languageName: node - linkType: hard - "@esbuild/openharmony-arm64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/openharmony-arm64@npm:0.28.1" @@ -687,13 +533,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/sunos-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/sunos-x64@npm:0.27.7" - conditions: os=sunos & cpu=x64 - languageName: node - linkType: hard - "@esbuild/sunos-x64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/sunos-x64@npm:0.28.1" @@ -701,13 +540,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/win32-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/win32-arm64@npm:0.27.7" - conditions: os=win32 & cpu=arm64 - languageName: node - linkType: hard - "@esbuild/win32-arm64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/win32-arm64@npm:0.28.1" @@ -715,13 +547,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/win32-ia32@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/win32-ia32@npm:0.27.7" - conditions: os=win32 & cpu=ia32 - languageName: node - linkType: hard - "@esbuild/win32-ia32@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/win32-ia32@npm:0.28.1" @@ -729,13 +554,6 @@ __metadata: languageName: node linkType: hard -"@esbuild/win32-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/win32-x64@npm:0.27.7" - conditions: os=win32 & cpu=x64 - languageName: node - linkType: hard - "@esbuild/win32-x64@npm:0.28.1": version: 0.28.1 resolution: "@esbuild/win32-x64@npm:0.28.1" @@ -3710,7 +3528,7 @@ __metadata: languageName: node linkType: hard -"esbuild@npm:^0.18.0 || ^0.19.0 || ^0.20.0 || ^0.21.0 || ^0.22.0 || ^0.23.0 || ^0.24.0 || ^0.25.0 || ^0.26.0 || ^0.27.0 || ^0.28.0": +"esbuild@npm:^0.28.1": version: 0.28.1 resolution: "esbuild@npm:0.28.1" dependencies: @@ -3799,95 +3617,6 @@ __metadata: languageName: node linkType: hard -"esbuild@npm:^0.27.0, esbuild@npm:~0.27.0": - version: 0.27.7 - resolution: "esbuild@npm:0.27.7" - dependencies: - "@esbuild/aix-ppc64": "npm:0.27.7" - "@esbuild/android-arm": "npm:0.27.7" - "@esbuild/android-arm64": "npm:0.27.7" - "@esbuild/android-x64": "npm:0.27.7" - "@esbuild/darwin-arm64": "npm:0.27.7" - "@esbuild/darwin-x64": "npm:0.27.7" - "@esbuild/freebsd-arm64": "npm:0.27.7" - "@esbuild/freebsd-x64": "npm:0.27.7" - "@esbuild/linux-arm": "npm:0.27.7" - "@esbuild/linux-arm64": "npm:0.27.7" - "@esbuild/linux-ia32": "npm:0.27.7" - "@esbuild/linux-loong64": "npm:0.27.7" - "@esbuild/linux-mips64el": "npm:0.27.7" - "@esbuild/linux-ppc64": "npm:0.27.7" - "@esbuild/linux-riscv64": "npm:0.27.7" - "@esbuild/linux-s390x": "npm:0.27.7" - "@esbuild/linux-x64": "npm:0.27.7" - "@esbuild/netbsd-arm64": "npm:0.27.7" - "@esbuild/netbsd-x64": "npm:0.27.7" - "@esbuild/openbsd-arm64": "npm:0.27.7" - "@esbuild/openbsd-x64": "npm:0.27.7" - "@esbuild/openharmony-arm64": "npm:0.27.7" - "@esbuild/sunos-x64": "npm:0.27.7" - "@esbuild/win32-arm64": "npm:0.27.7" - "@esbuild/win32-ia32": "npm:0.27.7" - "@esbuild/win32-x64": "npm:0.27.7" - dependenciesMeta: - "@esbuild/aix-ppc64": - optional: true - "@esbuild/android-arm": - optional: true - "@esbuild/android-arm64": - optional: true - "@esbuild/android-x64": - optional: true - "@esbuild/darwin-arm64": - optional: true - "@esbuild/darwin-x64": - optional: true - "@esbuild/freebsd-arm64": - optional: true - "@esbuild/freebsd-x64": - optional: true - "@esbuild/linux-arm": - optional: true - "@esbuild/linux-arm64": - optional: true - "@esbuild/linux-ia32": - optional: true - "@esbuild/linux-loong64": - optional: true - "@esbuild/linux-mips64el": - optional: true - "@esbuild/linux-ppc64": - optional: true - "@esbuild/linux-riscv64": - optional: true - "@esbuild/linux-s390x": - optional: true - "@esbuild/linux-x64": - optional: true - "@esbuild/netbsd-arm64": - optional: true - "@esbuild/netbsd-x64": - optional: true - "@esbuild/openbsd-arm64": - optional: true - "@esbuild/openbsd-x64": - optional: true - "@esbuild/openharmony-arm64": - optional: true - "@esbuild/sunos-x64": - optional: true - "@esbuild/win32-arm64": - optional: true - "@esbuild/win32-ia32": - optional: true - "@esbuild/win32-x64": - optional: true - bin: - esbuild: bin/esbuild - checksum: 10c0/ccd51f0555708bc9ff4ec9dc3ac92d3daacd45ecaac949ca8645984c5c323bf8cefe98c2df307418685e0b4ce37f9a3bdbfe8e3651fe632a0059a436195a17d4 - languageName: node - linkType: hard - "escalade@npm:^3.1.1, escalade@npm:^3.2.0": version: 3.2.0 resolution: "escalade@npm:3.2.0"