From fb83ed0114a0d4005059db6c8512c68b88361cb9 Mon Sep 17 00:00:00 2001 From: "addon-stack-dependency-updates[bot]" <342192718+addon-stack-dependency-updates[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 11:30:34 +0000 Subject: [PATCH 1/2] deps: update dependencies --- package.json | 2 +- packages/@adnbn/plugin-reg-cs/package.json | 10 +- .../@adnbn/plugin-remote-config/package.json | 8 +- pnpm-lock.yaml | 171 +++++++++++------- .../plugin-reg-cs-consumer/package.json | 2 +- .../package.json | 2 +- 6 files changed, 122 insertions(+), 73 deletions(-) diff --git a/package.json b/package.json index 6d30a7f..4d6da26 100644 --- a/package.json +++ b/package.json @@ -42,7 +42,7 @@ "@stylistic/eslint-plugin": "^5.10.0", "@swc/core": "^1.16.2", "@swc/jest": "^0.2.36", - "@types/chrome": "^0.2.7", + "@types/chrome": "^0.3.5", "@types/jest": "^30.0.0", "@types/node": "^24.0.0", "eslint": "^10.11.0", diff --git a/packages/@adnbn/plugin-reg-cs/package.json b/packages/@adnbn/plugin-reg-cs/package.json index 24b77e1..d3b28ce 100644 --- a/packages/@adnbn/plugin-reg-cs/package.json +++ b/packages/@adnbn/plugin-reg-cs/package.json @@ -63,14 +63,14 @@ "verify": "pnpm typecheck && pnpm lint && pnpm test && pnpm types && pnpm pack:check" }, "dependencies": { - "@addon-core/browser": "^0.8.0", - "@addon-core/inject-css": "^0.4.0", - "@addon-core/inject-script": "^0.5.0", - "@addon-core/storage": "^0.7.0", + "@addon-core/browser": "^0.12.0", + "@addon-core/inject-css": "^0.4.1", + "@addon-core/inject-script": "^0.5.1", + "@addon-core/storage": "^0.8.3", "webext-patterns": "^3.0.0" }, "devDependencies": { - "@types/chrome": "^0.2.2", + "@types/chrome": "^0.3.5", "adnbn": "^0.10.0" }, "peerDependencies": { diff --git a/packages/@adnbn/plugin-remote-config/package.json b/packages/@adnbn/plugin-remote-config/package.json index ee2fa19..642f78e 100644 --- a/packages/@adnbn/plugin-remote-config/package.json +++ b/packages/@adnbn/plugin-remote-config/package.json @@ -68,14 +68,14 @@ "verify": "pnpm typecheck && pnpm lint && pnpm test && pnpm types && pnpm pack:check" }, "dependencies": { - "@addon-core/browser": "^0.8.0", - "@addon-core/storage": "^0.7.0", + "@addon-core/browser": "^0.12.0", + "@addon-core/storage": "^0.8.3", "dot-prop": "^10.2.0", - "type-fest": "^5.9.0" + "type-fest": "^5.10.0" }, "devDependencies": { "@rspack/core": "1.7.12", - "@types/chrome": "^0.2.2", + "@types/chrome": "^0.3.5", "@types/react": "^19.0.0", "@types/react-dom": "^19.0.0", "adnbn": "^0.10.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f8006d6..84a381f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -35,8 +35,8 @@ importers: specifier: ^0.2.36 version: 0.2.39(@swc/core@1.16.2(@swc/helpers@0.5.23)) '@types/chrome': - specifier: ^0.2.7 - version: 0.2.7 + specifier: ^0.3.5 + version: 0.3.5 '@types/jest': specifier: ^30.0.0 version: 30.0.0 @@ -77,49 +77,49 @@ importers: packages/@adnbn/plugin-reg-cs: dependencies: '@addon-core/browser': - specifier: ^0.8.0 - version: 0.8.0 + specifier: ^0.12.0 + version: 0.12.0 '@addon-core/inject-css': - specifier: ^0.4.0 - version: 0.4.0 + specifier: ^0.4.1 + version: 0.4.1 '@addon-core/inject-script': - specifier: ^0.5.0 - version: 0.5.0 + specifier: ^0.5.1 + version: 0.5.1 '@addon-core/storage': - specifier: ^0.7.0 - version: 0.7.0(@types/chrome@0.2.7)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) + specifier: ^0.8.3 + version: 0.8.3(@types/chrome@0.3.5)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3) webext-patterns: specifier: ^3.0.0 version: 3.0.0 devDependencies: '@types/chrome': - specifier: ^0.2.2 - version: 0.2.7 + specifier: ^0.3.5 + version: 0.3.5 adnbn: specifier: ^0.10.0 - version: 0.10.0(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(@rsbuild/core@2.2.1)(@swc/helpers@0.5.23)(@types/chrome@0.2.7)(@types/express@4.17.25)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(debug@4.4.3(supports-color@8.1.1))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)) + version: 0.10.0(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(@rsbuild/core@2.2.1)(@swc/helpers@0.5.23)(@types/chrome@0.3.5)(@types/express@4.17.25)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(debug@4.4.3(supports-color@8.1.1))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)) packages/@adnbn/plugin-remote-config: dependencies: '@addon-core/browser': - specifier: ^0.8.0 - version: 0.8.0 + specifier: ^0.12.0 + version: 0.12.0 '@addon-core/storage': - specifier: ^0.7.0 - version: 0.7.0(@types/chrome@0.2.7)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.5(react@19.2.5))(react@19.2.5) + specifier: ^0.8.3 + version: 0.8.3(@types/chrome@0.3.5)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.5(react@19.2.5))(react@19.2.5)(typescript@5.9.3) dot-prop: specifier: ^10.2.0 version: 10.2.0 type-fest: - specifier: ^5.9.0 - version: 5.9.0 + specifier: ^5.10.0 + version: 5.10.0 devDependencies: '@rspack/core': specifier: 1.7.12 version: 1.7.12(@swc/helpers@0.5.23) '@types/chrome': - specifier: ^0.2.2 - version: 0.2.7 + specifier: ^0.3.5 + version: 0.3.5 '@types/react': specifier: ^19.0.0 version: 19.2.18 @@ -128,7 +128,7 @@ importers: version: 19.2.7(@types/react@19.2.18) adnbn: specifier: ^0.10.0 - version: 0.10.0(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(@rsbuild/core@2.2.1)(@swc/helpers@0.5.23)(@types/chrome@0.2.7)(@types/express@4.17.25)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(debug@4.4.3(supports-color@8.1.1))(react-dom@19.2.5(react@19.2.5))(react@19.2.5)(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)) + version: 0.10.0(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(@rsbuild/core@2.2.1)(@swc/helpers@0.5.23)(@types/chrome@0.3.5)(@types/express@4.17.25)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(debug@4.4.3(supports-color@8.1.1))(react-dom@19.2.5(react@19.2.5))(react@19.2.5)(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)) react: specifier: 19.2.5 version: 19.2.5 @@ -142,11 +142,11 @@ importers: specifier: workspace:* version: link:../../../packages/@adnbn/plugin-reg-cs '@types/chrome': - specifier: 0.2.7 - version: 0.2.7 + specifier: 0.3.5 + version: 0.3.5 adnbn: specifier: 0.10.0 - version: 0.10.0(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(@rsbuild/core@2.2.1)(@swc/helpers@0.5.23)(@types/chrome@0.2.7)(@types/express@4.17.25)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(debug@4.4.3(supports-color@8.1.1))(react-dom@19.2.5(react@19.2.5))(react@19.2.5)(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)) + version: 0.10.0(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(@rsbuild/core@2.2.1)(@swc/helpers@0.5.23)(@types/chrome@0.3.5)(@types/express@4.17.25)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(debug@4.4.3(supports-color@8.1.1))(react-dom@19.2.5(react@19.2.5))(react@19.2.5)(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)) react: specifier: 19.2.5 version: 19.2.5 @@ -179,11 +179,11 @@ importers: specifier: 1.7.12 version: 1.7.12(@swc/helpers@0.5.23) '@types/chrome': - specifier: 0.2.7 - version: 0.2.7 + specifier: 0.3.5 + version: 0.3.5 adnbn: specifier: 0.10.0 - version: 0.10.0(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(@rsbuild/core@2.2.1)(@swc/helpers@0.5.23)(@types/chrome@0.2.7)(@types/express@4.17.25)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(debug@4.4.3(supports-color@8.1.1))(react-dom@19.2.5(react@19.2.5))(react@19.2.5)(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)) + version: 0.10.0(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(@rsbuild/core@2.2.1)(@swc/helpers@0.5.23)(@types/chrome@0.3.5)(@types/express@4.17.25)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(debug@4.4.3(supports-color@8.1.1))(react-dom@19.2.5(react@19.2.5))(react@19.2.5)(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)) react: specifier: 19.2.5 version: 19.2.5 @@ -221,6 +221,9 @@ importers: packages: + '@addon-core/browser@0.12.0': + resolution: {integrity: sha512-+mjbmhE87fX3dBa3lrlZ+UKfRoEyLqlrTEGPZ11U/bMSEqDjcDSYof5v95M+Bdl1ShHiRW3XiEDwCbnQS/GgWA==} + '@addon-core/browser@0.5.0': resolution: {integrity: sha512-xFi/dFcJYNblW+esBkJ2D5ind6Yydcj3yJnwVocILjDuV1oyxD9Qlh+K3FJnRprwdlqhxeo/E06KFoS6lWSO+g==} peerDependencies: @@ -229,14 +232,11 @@ packages: '@addon-core/browser@0.7.2': resolution: {integrity: sha512-noDIPQktJOl7HVFUBZONL1iAVK4Spq1K+JgtN3OTsNPSvkgogrWUvpjq00p99R02y+YWORR70gu3tR+NDh09vw==} - '@addon-core/browser@0.8.0': - resolution: {integrity: sha512-x4NJQ95B9Hy26i4B7Hd5TIImSzEuUs9UUgUT1TetVkeWQoz1iapHaw9DFbS6UyJVweZlp0DKN3Zt6sJaV0+BgA==} - - '@addon-core/inject-css@0.4.0': - resolution: {integrity: sha512-7Za2gEsnyzTj4pQxmagsTE8iPmNJ06/z41uvPvHoSjA1G5cZeyzLtWaJ4wUD086ihGceLXhAx/Ch525kG0EoiQ==} + '@addon-core/inject-css@0.4.1': + resolution: {integrity: sha512-couFS4imuKSAM0d4p0sJhFHvHbDQEYj14X3M19FmJgxedqfhTmIg0M0APnBW8Gvaz3QKAzHks3AcD4dcm1UT8g==} - '@addon-core/inject-script@0.5.0': - resolution: {integrity: sha512-YoeMjLwZQ584jbv1rcPLgH0gchYbAXoodmSUZsX24E8MXvPNLUV4twhd6+R3WFf99wnuMafkigm0YaS35p6cNw==} + '@addon-core/inject-script@0.5.1': + resolution: {integrity: sha512-zLBxQzAKfRhcnsuELHYT1e8cznntbRohpCvz3bwBCASyWOUMsO316/DsMAAZsA0ng2e9goJXa5Xhp7+nCgcERw==} '@addon-core/storage@0.7.0': resolution: {integrity: sha512-MINCKg6sMKKeqRUnhmfPLveYBUwrvDrEvSmZgo+7QMxD0bWrbdmbO8Eb15DJHzNF/dX3M/CBwW4dxSzZXr03Fg==} @@ -252,6 +252,23 @@ packages: '@types/react-dom': optional: true + '@addon-core/storage@0.8.3': + resolution: {integrity: sha512-gXi87mU7pNwug9nIn1fMeUQNMbCdBXlYKZo9BbacZxt9kiEweHnOPrSC/9g6jiA0Rq2FrUynvc7jney59FY+2A==} + peerDependencies: + '@types/chrome': '*' + '@types/react': ^18.0.0 || ^19.0.0 + '@types/react-dom': ^18.0.0 || ^19.0.0 + react: ^18.0.0 || ^19.0.0 + react-dom: ^18.0.0 || ^19.0.0 + typescript: '>=5.4' + peerDependenciesMeta: + '@types/react': + optional: true + '@types/react-dom': + optional: true + typescript: + optional: true + '@babel/code-frame@7.26.2': resolution: {integrity: sha512-RJlIHRueQgwWitWgF8OdFYGZX328Ax5BCemNGlqHfplnRT9ESi8JkFlvaVYbS+UubVY6dpv87Fs2u5M29iNFVQ==} engines: {node: '>=6.9.0'} @@ -2143,6 +2160,9 @@ packages: '@types/chrome@0.2.7': resolution: {integrity: sha512-9kjBozQ+jyDVt1eai3VZqjHDTN95JCuRmbRHOryOltBJmzrTmUw/9r/DznmjRaQ8WlyIfeCA4WNzoj0IvormJA==} + '@types/chrome@0.3.5': + resolution: {integrity: sha512-7HYsK7xalNxzLwGrP9lkCQPAA6V56VtPpOmv2CQnBnMzX5/Hpr+Iv5fqaIOIY/H/Q6ZBksLmurWh7zXPcZ4B7Q==} + '@types/connect-history-api-fallback@1.5.4': resolution: {integrity: sha512-n6Cr2xS1h4uAulPRdlw6Jl6s1oG8KrVilPN2yUITEs+K48EzMJJ3W1xy8K5eWuFvjp3R74AOIGSmp2UfBJ8HFw==} @@ -5101,8 +5121,8 @@ packages: resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==} engines: {node: '>=16'} - type-fest@5.9.0: - resolution: {integrity: sha512-yANm3Jr3GiJ1qgJlxGAVxTOIcEOk1rhQHamlXtnrCK7EHP4HeM9OGxtMg/W7HFdrVzw/ZWJKGVIJusVH85sLtw==} + type-fest@5.10.0: + resolution: {integrity: sha512-NoSdpq/WEiAg5sjmBkmV/hfxv6HJH4NqPNrqjtSO5CwRmpsDfaf4begxW34KdJykH/l1yHtwBWQkCRdoXO8mPA==} engines: {node: '>=20'} type-is@1.6.18: @@ -5364,47 +5384,71 @@ packages: snapshots: - '@addon-core/browser@0.5.0(@types/chrome@0.2.7)': + '@addon-core/browser@0.12.0': dependencies: - '@types/chrome': 0.2.7 + '@types/chrome': 0.3.5 + + '@addon-core/browser@0.5.0(@types/chrome@0.3.5)': + dependencies: + '@types/chrome': 0.3.5 '@addon-core/browser@0.7.2': dependencies: '@types/chrome': 0.2.7 - '@addon-core/browser@0.8.0': + '@addon-core/inject-css@0.4.1': dependencies: - '@types/chrome': 0.2.7 + '@addon-core/browser': 0.12.0 - '@addon-core/inject-css@0.4.0': + '@addon-core/inject-script@0.5.1': dependencies: - '@addon-core/browser': 0.7.2 + '@addon-core/browser': 0.12.0 - '@addon-core/inject-script@0.5.0': + '@addon-core/storage@0.7.0(@types/chrome@0.3.5)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.5(react@19.2.5))(react@19.2.5)': dependencies: - '@addon-core/browser': 0.7.2 + '@addon-core/browser': 0.5.0(@types/chrome@0.3.5) + '@types/chrome': 0.3.5 + dequal: 2.0.3 + react: 19.2.5 + react-dom: 19.2.5(react@19.2.5) + optionalDependencies: + '@types/react': 19.2.18 + '@types/react-dom': 19.2.7(@types/react@19.2.18) - '@addon-core/storage@0.7.0(@types/chrome@0.2.7)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.5(react@19.2.5))(react@19.2.5)': + '@addon-core/storage@0.7.0(@types/chrome@0.3.5)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)': dependencies: - '@addon-core/browser': 0.5.0(@types/chrome@0.2.7) - '@types/chrome': 0.2.7 + '@addon-core/browser': 0.5.0(@types/chrome@0.3.5) + '@types/chrome': 0.3.5 + dequal: 2.0.3 + react: 19.2.8 + react-dom: 19.2.8(react@19.2.8) + optionalDependencies: + '@types/react': 19.2.18 + '@types/react-dom': 19.2.7(@types/react@19.2.18) + + '@addon-core/storage@0.8.3(@types/chrome@0.3.5)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.5(react@19.2.5))(react@19.2.5)(typescript@5.9.3)': + dependencies: + '@addon-core/browser': 0.12.0 + '@types/chrome': 0.3.5 dequal: 2.0.3 react: 19.2.5 react-dom: 19.2.5(react@19.2.5) optionalDependencies: '@types/react': 19.2.18 '@types/react-dom': 19.2.7(@types/react@19.2.18) + typescript: 5.9.3 - '@addon-core/storage@0.7.0(@types/chrome@0.2.7)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)': + '@addon-core/storage@0.8.3(@types/chrome@0.3.5)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3)': dependencies: - '@addon-core/browser': 0.5.0(@types/chrome@0.2.7) - '@types/chrome': 0.2.7 + '@addon-core/browser': 0.12.0 + '@types/chrome': 0.3.5 dequal: 2.0.3 react: 19.2.8 react-dom: 19.2.8(react@19.2.8) optionalDependencies: '@types/react': 19.2.18 '@types/react-dom': 19.2.7(@types/react@19.2.18) + typescript: 5.9.3 '@babel/code-frame@7.26.2': dependencies: @@ -7756,6 +7800,11 @@ snapshots: '@types/filesystem': 0.0.36 '@types/har-format': 1.2.16 + '@types/chrome@0.3.5': + dependencies: + '@types/filesystem': 0.0.36 + '@types/har-format': 1.2.16 + '@types/connect-history-api-fallback@1.5.4': dependencies: '@types/express-serve-static-core': 4.19.9 @@ -8153,16 +8202,16 @@ snapshots: address@2.0.3: {} - adnbn@0.10.0(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(@rsbuild/core@2.2.1)(@swc/helpers@0.5.23)(@types/chrome@0.2.7)(@types/express@4.17.25)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(debug@4.4.3(supports-color@8.1.1))(react-dom@19.2.5(react@19.2.5))(react@19.2.5)(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)): + adnbn@0.10.0(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(@rsbuild/core@2.2.1)(@swc/helpers@0.5.23)(@types/chrome@0.3.5)(@types/express@4.17.25)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(debug@4.4.3(supports-color@8.1.1))(react-dom@19.2.5(react@19.2.5))(react@19.2.5)(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)): dependencies: '@addon-core/browser': 0.7.2 - '@addon-core/inject-script': 0.5.0 - '@addon-core/storage': 0.7.0(@types/chrome@0.2.7)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.5(react@19.2.5))(react@19.2.5) + '@addon-core/inject-script': 0.5.1 + '@addon-core/storage': 0.7.0(@types/chrome@0.3.5)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.5(react@19.2.5))(react@19.2.5) '@rsdoctor/rspack-plugin': 1.6.3(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(@rsbuild/core@2.2.1)(@rspack/core@1.7.12(@swc/helpers@0.5.23))(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)) '@rspack/cli': 1.7.12(@rspack/core@1.7.12(@swc/helpers@0.5.23))(@types/express@4.17.25)(debug@4.4.3(supports-color@8.1.1))(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)) '@rspack/core': 1.7.12(@swc/helpers@0.5.23) '@svgr/webpack': 8.1.0(supports-color@8.1.1)(typescript@5.9.3) - '@types/chrome': 0.2.7 + '@types/chrome': 0.3.5 await-lock: 3.0.0 c12: 3.3.4 cac: 6.7.14 @@ -8213,16 +8262,16 @@ snapshots: - webpack - webpack-cli - adnbn@0.10.0(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(@rsbuild/core@2.2.1)(@swc/helpers@0.5.23)(@types/chrome@0.2.7)(@types/express@4.17.25)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(debug@4.4.3(supports-color@8.1.1))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)): + adnbn@0.10.0(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(@rsbuild/core@2.2.1)(@swc/helpers@0.5.23)(@types/chrome@0.3.5)(@types/express@4.17.25)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(debug@4.4.3(supports-color@8.1.1))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)): dependencies: '@addon-core/browser': 0.7.2 - '@addon-core/inject-script': 0.5.0 - '@addon-core/storage': 0.7.0(@types/chrome@0.2.7)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) + '@addon-core/inject-script': 0.5.1 + '@addon-core/storage': 0.7.0(@types/chrome@0.3.5)(@types/react-dom@19.2.7(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) '@rsdoctor/rspack-plugin': 1.6.3(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)(@rsbuild/core@2.2.1)(@rspack/core@1.7.12(@swc/helpers@0.5.23))(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)) '@rspack/cli': 1.7.12(@rspack/core@1.7.12(@swc/helpers@0.5.23))(@types/express@4.17.25)(debug@4.4.3(supports-color@8.1.1))(supports-color@8.1.1)(webpack@5.110.2(@swc/core@1.16.2(@swc/helpers@0.5.23))(csso@5.0.5)(postcss@8.5.30)) '@rspack/core': 1.7.12(@swc/helpers@0.5.23) '@svgr/webpack': 8.1.0(supports-color@8.1.1)(typescript@5.9.3) - '@types/chrome': 0.2.7 + '@types/chrome': 0.3.5 await-lock: 3.0.0 c12: 3.3.4 cac: 6.7.14 @@ -8927,7 +8976,7 @@ snapshots: dot-prop@10.2.0: dependencies: - type-fest: 5.9.0 + type-fest: 5.10.0 dotenv-expand@12.0.3: dependencies: @@ -11112,7 +11161,7 @@ snapshots: type-fest@4.41.0: {} - type-fest@5.9.0: + type-fest@5.10.0: dependencies: tagged-tag: 1.0.0 diff --git a/tests/fixtures/plugin-reg-cs-consumer/package.json b/tests/fixtures/plugin-reg-cs-consumer/package.json index ab26616..d99c0b8 100644 --- a/tests/fixtures/plugin-reg-cs-consumer/package.json +++ b/tests/fixtures/plugin-reg-cs-consumer/package.json @@ -9,7 +9,7 @@ }, "dependencies": { "@adnbn/plugin-reg-cs": "workspace:*", - "@types/chrome": "0.2.7", + "@types/chrome": "0.3.5", "adnbn": "0.10.0", "react": "19.2.5", "react-dom": "19.2.5" diff --git a/tests/fixtures/plugin-remote-config-consumer/package.json b/tests/fixtures/plugin-remote-config-consumer/package.json index d5e0bbe..3318069 100644 --- a/tests/fixtures/plugin-remote-config-consumer/package.json +++ b/tests/fixtures/plugin-remote-config-consumer/package.json @@ -9,7 +9,7 @@ }, "dependencies": { "@adnbn/plugin-remote-config": "workspace:*", - "@types/chrome": "0.2.7", + "@types/chrome": "0.3.5", "adnbn": "0.10.0", "react": "19.2.5", "react-dom": "19.2.5", From 66a22a60709bf8a043b642c919ab2b6a74adc588 Mon Sep 17 00:00:00 2001 From: Anjey Tsibylskij <130153594+atldays@users.noreply.github.com> Date: Fri, 16 Oct 2026 18:49:21 +0300 Subject: [PATCH 2/2] ci(repo): unblock dependency update verification --- CONTRIBUTING.md | 57 +++++++++++-------- .../plugin-reg-cs/tests/helpers/browser.ts | 5 ++ pnpm-lock.yaml | 9 +-- pnpm-workspace.yaml | 9 +++ 4 files changed, 53 insertions(+), 27 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 492d1a7..a8de4aa 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -290,26 +290,37 @@ workflow checks for missing credentials before starting Renovate. `RELEASE_APP_I `release` environment and Trusted Publishing settings remain the existing manual release workflow's credentials. -### Security audit status (2026-10-14) - -The compatible security refresh updates Nx and `@nx/js` together from 23.2.1 to 23.3.0 (the Nx migrator reports no -required migrations), plus the vulnerable transitive `brace-expansion`, `compression`, `engine.io`, `proxy-addr`, -`shell-quote`, `source-map-js`, `fast-uri` and their compatible parents. `fast-uri` is locked to 3.1.8, which satisfies -Ajv's `^3.0.1` range; its registry integrity and the complete lockfile were verified by `pnpm install --frozen-lockfile`. -No peer ranges, public plugin versions or existing overrides were changed, and no new overrides were added. - -Audit findings decreased from **2 critical / 19 high / 11 moderate** to **0 critical / 3 high / 6 moderate / 3 low**. -The remaining findings are in development/release tooling: - -- Nx 23.3.0 pins `undici` to exactly 7.29.0; its advisories are fixed in 7.29.1, which requires an upstream Nx update - or an explicit override. The high advisories are - [GHSA-rfgv-xxqx-mfg5](https://github.com/advisories/GHSA-rfgv-xxqx-mfg5) and - [GHSA-w293-vg96-wgc3](https://github.com/advisories/GHSA-w293-vg96-wgc3). -- `braces` 3.0.3, used through the framework's development server/build tooling, has no published fixed version for - [GHSA-vfj7-8cjw-p6xm](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm). -- `sprintf-js` 1.0.3, through Jest's coverage configuration loader, has no published fixed version for the moderate - [GHSA-hp3w-g68c-fv3c](https://github.com/advisories/GHSA-hp3w-g68c-fv3c). - -`pnpm audit:security` and therefore `pnpm verify`, CI and the manual release workflow **remain blocked** by the -three high findings. The audit threshold has not been lowered and advisories have not been suppressed. Resolve -these upstream constraints before expecting a green CI/release; functional test success does not waive the audit. +### Security audit status (2026-10-16) + +Nx 23.3.0 pins `undici` to 7.29.0. A parent-scoped override replaces only that version with 7.29.1 to fix +[GHSA-rfgv-xxqx-mfg5](https://github.com/advisories/GHSA-rfgv-xxqx-mfg5) and +[GHSA-w293-vg96-wgc3](https://github.com/advisories/GHSA-w293-vg96-wgc3). Remove the override when Nx requires a +patched version. The framework remains on 0.10.0; public package versions and peer ranges are unchanged. + +`pnpm audit:security` still audits the full workspace and blocks high/critical findings. There is one temporary +exception for [GHSA-vfj7-8cjw-p6xm](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm) in `braces` 3.0.3, which has +no published fix. This exception does not fix the dependency or declare it safe for arbitrary consumers. + +The exception applies to the current repository's CI and release inputs: + +- The vulnerable operation recursively parses/expands deeply nested **patterns** supplied by an attacker. +- All current lockfile paths to `braces` pass through `adnbn` -> `@rspack/cli` -> `@rspack/dev-server`, then + `chokidar` 3.6.0 or `http-proxy-middleware` 2.0.10 -> `micromatch` 4.0.8 (including the webpack-dev-server paths). +- The packed-consumer and browser checks invoke `adnbn build` with checked-in fixture configuration. The installed + framework's build command uses `compiler.run()` and closes the compiler. CI/release do not start Rspack's dev server + or accept user-supplied watcher/proxy patterns. Watch roots and configuration belong to the checked-out source; + anyone who changes executable build configuration already controls code executed by that build. +- The smoke HTTP servers use Node's HTTP server on loopback and exact route comparisons, without glob parsing. + In the installed proxy middleware, `matchSingleGlobPath(pattern, uri)` passes the HTTP pathname as the string to + match and the configured context as the pattern. A request pathname is not parsed as a brace pattern. +- These server/watcher dependencies are build tooling, not imported by the plugins' extension runtime. An application + using these packages to process untrusted patterns, or exposing a different dev-server configuration, requires its + own assessment; this repository's audit exception is not included in published plugin manifests. + +Reassess this exception by **2026-11-16**, when the framework/dev-server/proxy dependency chain changes, or before +introducing external watch roots, patterns or server configuration. Remove it when a fixed `braces` version can be +resolved. Keep the exception limited to this GHSA; do not ignore the whole package, all unfixable findings or all dev +dependencies. This review date is a manual deadline, not an automatically enforced expiry. + +Moderate/low advisories, including `sprintf-js` through Jest's coverage configuration loader, remain visible and are +not suppressed. They remain below the existing `high` failure threshold. diff --git a/packages/@adnbn/plugin-reg-cs/tests/helpers/browser.ts b/packages/@adnbn/plugin-reg-cs/tests/helpers/browser.ts index 45a6036..83dd99f 100644 --- a/packages/@adnbn/plugin-reg-cs/tests/helpers/browser.ts +++ b/packages/@adnbn/plugin-reg-cs/tests/helpers/browser.ts @@ -25,6 +25,11 @@ export const setupBrowserHarness = ( profile: "chrome", }); + // New Browser harness versions expose storage by default, even for this no-permission fixture. + if (!withStorage) { + Reflect.deleteProperty(chrome, "storage"); + } + const storage = withStorage ? createStorageHarness() : undefined; const restoreStorage = storage ? installStorageHarness(storage) : undefined; diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 84a381f..e61ea1d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -5,6 +5,7 @@ settings: excludeLinksFromLockfile: false overrides: + nx>undici@7.29.0: 7.29.1 nx>smol-toml@<=1.7.0: 1.9.0 '@rspack/dev-server@1.1.5>webpack-dev-server': 5.2.6 sockjs@0.3.24>uuid: 11.1.1 @@ -5144,8 +5145,8 @@ packages: undici-types@7.18.2: resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==} - undici@7.29.0: - resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} + undici@7.29.1: + resolution: {integrity: sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==} engines: {node: '>=20.18.1'} unicode-canonical-property-names-ecmascript@2.0.1: @@ -10373,7 +10374,7 @@ snapshots: tmp: 0.2.7 tsconfig-paths: 4.2.0 tslib: 2.8.1 - undici: 7.29.0 + undici: 7.29.1 util-deprecate: 1.0.2 wcwidth: 1.0.1 which: 3.0.1 @@ -11185,7 +11186,7 @@ snapshots: undici-types@7.18.2: {} - undici@7.29.0: {} + undici@7.29.1: {} unicode-canonical-property-names-ecmascript@2.0.1: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 5c80568..cb2a87e 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -3,6 +3,9 @@ packages: - tests/fixtures/* overrides: + # Nx pins 7.29.0; 7.29.1 fixes GHSA-rfgv-xxqx-mfg5 and GHSA-w293-vg96-wgc3. + # Remove when Nx requires a patched version. + "nx>undici@7.29.0": "7.29.1" # Nx 23.2.1 pins 1.6.1. Remove when Nx requires a version fixed for GHSA-7w5x-hrqm-74c2. "nx>smol-toml@<=1.7.0": "1.9.0" # Rspack's 1.1.5 adapter pins 5.2.2. Remove when it requires the patched 5.2.6 or newer. @@ -11,6 +14,12 @@ overrides: # Remove when SockJS no longer requires vulnerable uuid versions. "sockjs@0.3.24>uuid": "11.1.1" +audit: + ignore: + # No untrusted brace patterns reach this build-only dependency in our CI/release flow. + # Reviewed 2026-10-16; reassess by 2026-11-16 or on input/toolchain changes. See CONTRIBUTING.md. + - GHSA-vfj7-8cjw-p6xm + allowBuilds: "@parcel/watcher": true "@swc/core": true