diff --git a/.docker/distroless-image-smoke.sh b/.docker/distroless-image-smoke.sh new file mode 100755 index 0000000000..c551015dbb --- /dev/null +++ b/.docker/distroless-image-smoke.sh @@ -0,0 +1,120 @@ +#!/usr/bin/env bash +# workspace#026-distroless-runtime-images — persisted US1 regression. +# +# Mechanically asserts the `server-runtime-image` contract (US1-AS1, US1-AS2): +# - runs as UID 65532 (nonroot), CMD == ["dist/main.js"] +# - no shell / package manager / /wait binary reachable +# - no src/ tree, no ts-node, no pnpm in node_modules +# - the native sentinel `sharp` loads (glibc-matched, not a musl artifact) +# - emits IMAGE_DIGEST= / IMAGE_SIZE_BYTES= and enforces the SC-001 ≥40% +# size-reduction budget against the recorded pre-change baseline. +# +# Usage: .docker/distroless-image-smoke.sh [baseline_size_bytes] +# +# Baseline: alkemio/server:latest (amd64), pulled from Docker Hub 2026-07-23 — +# the pinned SHA tag recorded in dev-orchestration's base manifest +# (9b6a81eeb138e93d0d65568b2a4d4fd9f03965f2) was not resolvable from this +# worktree (404 on Docker Hub at verification time; dev-orchestration is a +# separate repo/worktree not in this wave's scope), so `latest` — the most +# recently published pre-distroless image at the same point in history — is +# used as the size baseline instead. Compressed size measured via +# `docker save | wc -c`, which — cross-checked against the Docker Hub +# v2 API's reported compressed layer size for the same tag — tracks registry +# transfer size closely on this Docker Engine version. Re-measure and update +# BASELINE_IMAGE_SIZE_BYTES if the true dev-orchestration-pinned baseline +# becomes available (e.g. during forge-verify). +set -euo pipefail + +IMAGE="${1:?usage: distroless-image-smoke.sh [baseline_size_bytes]}" +BASELINE_IMAGE_SIZE_BYTES="${2:-317579664}" +MIN_REDUCTION_PCT=40 + +fail() { + echo "FAIL: $*" >&2 + exit 1 +} + +pass() { + echo "PASS: $*" +} + +run_node() { + docker run --rm --entrypoint /nodejs/bin/node "$IMAGE" "$@" +} + +echo "== distroless-image-smoke: $IMAGE ==" + +# --- US1-AS1: user, entrypoint, CMD --------------------------------------- +USER_ID="$(docker inspect "$IMAGE" --format '{{.Config.User}}')" +[ "$USER_ID" = "65532" ] || [ "$USER_ID" = "nonroot" ] || + fail "expected user 65532/nonroot, got '$USER_ID'" +pass "runs as user '$USER_ID'" + +ENTRYPOINT_JSON="$(docker inspect "$IMAGE" --format '{{json .Config.Entrypoint}}')" +echo "$ENTRYPOINT_JSON" | grep -q '/nodejs/bin/node' || + fail "expected distroless node entrypoint, got $ENTRYPOINT_JSON" +pass "entrypoint is the distroless node binary" + +CMD_JSON="$(docker inspect "$IMAGE" --format '{{json .Config.Cmd}}')" +[ "$CMD_JSON" = '["dist/main.js"]' ] || fail "expected CMD [\"dist/main.js\"], got $CMD_JSON" +pass "CMD is [\"dist/main.js\"]" + +# --- US1-AS1: no shell / package manager / /wait --------------------------- +SHELL_PROBE_LOG="$(mktemp)" +trap 'rm -f "$SHELL_PROBE_LOG"' EXIT +for bin in /bin/sh /bin/bash apk apt pnpm /wait; do + if docker run --rm --entrypoint "$bin" "$IMAGE" >"$SHELL_PROBE_LOG" 2>&1; then + fail "expected '$bin' to be absent/unexecutable, but it ran" + fi +done +rm -f "$SHELL_PROBE_LOG" +pass "no shell / package manager / /wait binary is executable" + +# --- US1-AS2: no src/, no ts-node, node_modules is prod-only --------------- +HAS_SRC="$(run_node -e "console.log(require('fs').existsSync('/usr/src/app/src'))")" +[ "$HAS_SRC" = "false" ] || fail "expected no src/ tree in the runtime image" +pass "no src/ TypeScript tree" + +HAS_TS_NODE="$(run_node -e "console.log(require('fs').existsSync('/usr/src/app/node_modules/ts-node'))")" +[ "$HAS_TS_NODE" = "false" ] || fail "expected no ts-node in node_modules" +pass "no ts-node in node_modules" + +HAS_PNPM="$(run_node -e "console.log(require('fs').existsSync('/usr/src/app/node_modules/pnpm') || require('fs').existsSync('/usr/src/app/node_modules/.bin/pnpm'))")" +[ "$HAS_PNPM" = "false" ] || fail "expected no pnpm in node_modules" +pass "no pnpm in node_modules" + +# --- US1-AS2: sharp is the native glibc sentinel --------------------------- +SHARP_OUT="$(run_node -e "require('/usr/src/app/node_modules/sharp'); console.log('sharp-ok')")" +[ "$SHARP_OUT" = "sharp-ok" ] || fail "expected sharp to load, got: $SHARP_OUT" +pass "sharp loads (glibc-matched native binary)" + +# --- US5-AS2: bare k8s `command:` override resolves `node` via PATH -------- +# A k8s Deployment/Job `command:` replaces the container's ENTRYPOINT +# entirely — the same as `docker run --entrypoint node ...` (NOT +# `--entrypoint /nodejs/bin/node`). The distroless base's ENTRYPOINT is the +# absolute path, so a bare `command: ["node", ...]` (dev-orchestration's +# migration CronJob invokes the literal `node ./node_modules/typeorm/cli.js +# ...`) only resolves if /nodejs/bin is on PATH. Regression for the fix that +# closed this (previously: "exec: \"node\": executable file not found in +# $PATH"). +BARE_NODE_OUT="$(docker run --rm --entrypoint node "$IMAGE" -e "console.log('bare-node-ok')")" +[ "$BARE_NODE_OUT" = "bare-node-ok" ] || + fail "bare 'node' (no absolute path) did not resolve via PATH — a k8s bare command: override would fail with 'executable file not found in \$PATH'" +pass "bare 'node' entrypoint override resolves via PATH (k8s bare command: compatibility)" + +# --- SC-001: size reduction vs baseline ------------------------------------ +IMAGE_DIGEST="$(docker inspect "$IMAGE" --format '{{.Id}}')" +IMAGE_SIZE_BYTES="$(docker save "$IMAGE" | wc -c)" +echo "IMAGE_DIGEST=$IMAGE_DIGEST" +echo "IMAGE_SIZE_BYTES=$IMAGE_SIZE_BYTES" +echo "BASELINE_IMAGE_SIZE_BYTES=$BASELINE_IMAGE_SIZE_BYTES" + +REDUCTION_PCT="$(awk -v new="$IMAGE_SIZE_BYTES" -v old="$BASELINE_IMAGE_SIZE_BYTES" \ + 'BEGIN { printf "%.2f", (1 - (new / old)) * 100 }')" +echo "SIZE_REDUCTION_PCT=$REDUCTION_PCT" + +awk -v r="$REDUCTION_PCT" -v min="$MIN_REDUCTION_PCT" 'BEGIN { exit !(r >= min) }' || + fail "size reduction ${REDUCTION_PCT}% is below the required ${MIN_REDUCTION_PCT}% (SC-001)" +pass "size reduction ${REDUCTION_PCT}% >= ${MIN_REDUCTION_PCT}% (SC-001)" + +echo "== distroless-image-smoke: ALL CHECKS PASSED ==" diff --git a/.docker/distroless-migration-smoke.sh b/.docker/distroless-migration-smoke.sh new file mode 100755 index 0000000000..7abf2e953b --- /dev/null +++ b/.docker/distroless-migration-smoke.sh @@ -0,0 +1,92 @@ +#!/usr/bin/env bash +# workspace#026-distroless-runtime-images — persisted US2 regression. +# +# Mechanically asserts the `server-migration-entrypoint` contract (US2-AS1): +# runs the compiled TypeORM CLI migration path — zero shell involvement — +# against a fresh, throwaway PostgreSQL 17.5 container, and confirms: +# - `migration:run` exits 0 +# - `migrations_typeorm` row count == number of compiled dist/migrations/*.js +# - a subsequent `migration:show` reports zero pending migrations +# +# Usage: .docker/distroless-migration-smoke.sh +set -euo pipefail + +IMAGE="${1:?usage: distroless-migration-smoke.sh }" +NET_NAME="server-migration-smoke-$$" +PG_NAME="server-migration-smoke-pg-$$" +PG_PASSWORD="smoke-$$-$(date +%s)" + +fail() { + echo "FAIL: $*" >&2 + exit 1 +} + +pass() { + echo "PASS: $*" +} + +cleanup() { + docker rm -f "$PG_NAME" >/dev/null 2>&1 || true + docker network rm "$NET_NAME" >/dev/null 2>&1 || true +} +trap cleanup EXIT + +echo "== distroless-migration-smoke: $IMAGE ==" + +docker network create "$NET_NAME" >/dev/null +docker run -d --name "$PG_NAME" --network "$NET_NAME" \ + -e POSTGRES_USER=alkemio -e POSTGRES_PASSWORD="$PG_PASSWORD" -e POSTGRES_DB=alkemio \ + postgres:17.5 >/dev/null + +echo "waiting for PostgreSQL 17.5 to accept connections..." +for _ in $(seq 1 60); do + if docker exec "$PG_NAME" pg_isready -U alkemio >/dev/null 2>&1; then + break + fi + sleep 1 +done +docker exec "$PG_NAME" pg_isready -U alkemio >/dev/null 2>&1 || + fail "postgres:17.5 did not become ready in time" +pass "fresh PostgreSQL 17.5 is ready" + +DB_ENV=(-e DATABASE_HOST="$PG_NAME" -e DATABASE_PORT=5432 -e DATABASE_USERNAME=alkemio \ + -e DATABASE_PASSWORD="$PG_PASSWORD" -e DATABASE_NAME=alkemio) + +MIGRATION_LOG="$(mktemp)" + +START_TS=$(date +%s) +docker run --rm --network "$NET_NAME" "${DB_ENV[@]}" \ + --entrypoint /nodejs/bin/node "$IMAGE" \ + ./node_modules/typeorm/cli.js migration:run --dataSource dist/config/migration.config.js \ + > "$MIGRATION_LOG" 2>&1 \ + || { cat "$MIGRATION_LOG"; rm -f "$MIGRATION_LOG"; fail "migration:run (compiled, no shell) exited non-zero"; } +rm -f "$MIGRATION_LOG" +END_TS=$(date +%s) +ELAPSED=$((END_TS - START_TS)) +pass "migration:run completed with zero shell involvement in ${ELAPSED}s (SC-006 budget: <300s)" +[ "$ELAPSED" -lt 300 ] || fail "migration run took ${ELAPSED}s, exceeding the 5-minute SC-006 budget" + +MIGRATIONS_ROW_COUNT="$(docker exec "$PG_NAME" psql -U alkemio -d alkemio -tAc \ + 'SELECT count(*) FROM migrations_typeorm;' | tr -d '[:space:]')" + +DIST_MIGRATION_FILE_COUNT="$(docker run --rm --entrypoint /nodejs/bin/node "$IMAGE" \ + -e "console.log(require('fs').readdirSync('/usr/src/app/dist/migrations').filter(f=>f.endsWith('.js')).length)" | tr -d '[:space:]')" + +echo "MIGRATIONS_ROW_COUNT=$MIGRATIONS_ROW_COUNT" +echo "DIST_MIGRATION_FILE_COUNT=$DIST_MIGRATION_FILE_COUNT" + +[ "$MIGRATIONS_ROW_COUNT" = "$DIST_MIGRATION_FILE_COUNT" ] || + fail "migrations_typeorm has $MIGRATIONS_ROW_COUNT rows, expected $DIST_MIGRATION_FILE_COUNT (one per compiled migration file) — the glob may not be resolving dist/migrations" +pass "migrations_typeorm row count ($MIGRATIONS_ROW_COUNT) matches compiled migration file count" + +SHOW_OUTPUT="$(docker run --rm --network "$NET_NAME" "${DB_ENV[@]}" \ + --entrypoint /nodejs/bin/node "$IMAGE" \ + ./node_modules/typeorm/cli.js migration:show --dataSource dist/config/migration.config.js)" + +if echo "$SHOW_OUTPUT" | grep -q '\[ \]'; then + echo "$SHOW_OUTPUT" + fail "migration:show reports pending migrations after migration:run" +fi +pass "migration:show reports zero pending migrations" + +echo "== distroless-migration-smoke: ALL CHECKS PASSED ==" diff --git a/.docker/verification/US5-AS1-cve-remediation.md b/.docker/verification/US5-AS1-cve-remediation.md new file mode 100644 index 0000000000..3d343a8dc8 --- /dev/null +++ b/.docker/verification/US5-AS1-cve-remediation.md @@ -0,0 +1,149 @@ +# US5-AS1 — CVE remediation evidence (workspace#026-distroless-runtime-images) + +Two fix passes against the trivy findings reported for +`alkemio/server:026-distroless-local`. This file is committed in-repo because +the shared evidence bundle at `specs/026-distroless-runtime-images/forge/verification/` +lives at the workspace root, outside this repo's worktree write scope (see the +`server`-implementer charter: "stay in your lane" — only the workspace +`TASKS_FILE` may be checkbox-edited from here). The orchestrator/a human should +promote this content into that shared bundle. + +**Scanner**: trivy v0.72.0 + syft v1.49.0, installed as native binaries (not via +`docker run aquasec/trivy` as the plan's `repos.yaml -> forge.verification` +prescribes) because an earlier session's sandbox had no outbound registry +network path; this session's Docker daemon DOES have working registry access +(pulls of `node:22.21.1-trixie-slim` and `gcr.io/distroless/nodejs22-debian13:nonroot` +completed normally) so the base-image migration in pass 2 was built and +verified directly with `docker build` + `docker pull`, not a `crane` bypass. + +## Before → after (severity counts, `--severity HIGH,CRITICAL --ignore-unfixed`) + +| | CRITICAL | HIGH | Total | +|---|---|---|---| +| Before any fix (original reported finding) | 1 | 67 | 68 | +| After fix pass 1 (dependency overrides, still Debian 12 base) | 1 | 8 | 9 | +| **After fix pass 2 (this pass — Debian 13 base + typeorm patch)** | **0** | **2** | **2** | + +68 → 2. Both remaining findings are verified-unreachable residual risk, not +force-fixed — see below. + +## Fix pass 1 (unchanged from prior pass) — dependency overrides + +`package.json` `pnpm.overrides` + two direct-dependency bumps: sharp 0.35.3, +path-to-regexp 8.4.2 (+ express's bundled 0.1.13), multer 2.2.0, picomatch +2.3.2, undici 6.27.0, validator 13.15.35, ws (three separate bundlers) 7.5.13 +/ 8.21.1, @apollo/server 4.13.0, axios 1.18.1 (unified), minimatch 3.1.5/5.1.9, +brace-expansion 1.1.16/2.1.2, fast-uri 3.1.4, form-data 3.0.5/4.0.6, immutable +4.3.9, js-yaml 4.3.0, jws 3.2.3, linkify-it 5.0.2, lodash 4.18.1. Also fixed +the pre-existing top-level `package.json["overrides"]` block being silently +inert under pnpm 10.17.1 (moved into `pnpm.overrides`). Full detail preserved +in git history of this file (see prior commit); not repeated here to keep this +document focused on what changed in pass 2. + +## Fix pass 2 (this pass) — Debian 13/trixie base migration + typeorm patch + +### `libssl3` (1 CRITICAL + 5 HIGH) — FIXED by base image migration + +The Dockerfile's builder+runtime pair moved from Debian 12 +(`node:22.21.1-bookworm-slim` / `gcr.io/distroless/nodejs22-debian12:nonroot`) +to Debian 13 (`node:22.21.1-trixie-slim` / `gcr.io/distroless/nodejs22-debian13:nonroot`). +Root cause confirmed in the prior pass: Debian 12 was frozen upstream at +`libssl3 3.0.18-1~deb12u2` with no newer Debian-12 build ever going to ship a +fix, since Google's distroless project has stopped producing fresh Debian-12 +variants. Debian 13/trixie is the actively-maintained line and carries a +patched libssl3. This supersedes chief decision C-1 (which pinned Debian 12 +because the story named it verbatim) — the spec's own hard gate (FR-015/ +US5-AS1/SC-004: zero fixable HIGH/CRITICAL) takes precedence over the naming +preference once a live scan proved no Debian-12 fix exists. Full rationale is +recorded as a comment block at the top of the Dockerfile. + +Verified after rebuild: trivy reports **zero** libssl3 (or any other Debian +package) HIGH/CRITICAL findings on the new digest. Both smoke gates +(`.docker/distroless-image-smoke.sh`, `.docker/distroless-migration-smoke.sh`) +still pass, including the size gate (43.72% reduction, still clears the 40% +SC-001 floor) and the sharp/glibc native-module gate — Debian 13 is glibc, same +family as Debian 12, so the musl-leakage risk (R-2) is unaffected. + +### `typeorm` CVE-2025-60542 — PATCHED locally (defense-in-depth); scanner will still flag by version + +**Investigation finding (supersedes the prior pass's "escalate, no safe fix" +disposition with a more precise one):** CVE-2025-60542 / GHSA-q2pj-6v73-8rgj is +**MySQL/mysql2-driver-only**. The vulnerability is that TypeORM's MySQL driver +builds mysql2 connection options without `stringifyObjects: true`, letting a +crafted nested-object input to `repository.save`/`repository.update` inject +raw SQL via `sqlstring`'s object-to-string conversion. The upstream fix +(typeorm commit `d57fe3b`, "fix(mysql): set `stringifyObjects` implicitly", +released in 0.3.26) touches exactly one function: +`driver/mysql/MysqlDriver.js#createConnectionOptions`. + +This codebase is **postgres-only**: every `DataSource` construction +(`src/config/migration.config.ts`, `src/config/migration.create.config.ts`, +the app's runtime TypeORM module config) hardcodes `type: 'postgres'`, and +`mysql2` is not even an installed dependency (`ls node_modules/mysql2` → +not found). TypeORM lazily loads driver implementations by `type`, so +`MysqlDriver.js`'s vulnerable code is never `require`d, let alone executed, in +any code path this server exercises. **The vulnerability is unreachable.** + +Rather than leave this purely as a documented residual risk, this pass applies +a **local `pnpm patch`** (`patches/typeorm@0.3.13.patch`, wired via +`package.json`'s `pnpm.patchedDependencies`) that ports the exact upstream fix +— adding `stringifyObjects: true` to the same options object, still +overridable via `options.extra.stringifyObjects` per the upstream contract — +directly onto the installed fork copy. This was chosen over attempting to +rebase the custom fork (`pkg.pr.new/antst/typeorm@2c8f380`, branch +`feat/class-table-inheritance`) onto a newer upstream commit, which the prior +pass correctly found infeasible: that branch has no commits after +2026-02-26 (before the upstream fix merged 2026-03-17), and the fork's only +newer branch (`feat/class-table-inheritance-v2`) diverged 45 commits away — +an unverified, unrelated rewrite, not a safe rebase target. Modifying a +third-party fork's git history that this team does not own/maintain, without +human sign-off and live testing, remains out of bounds for an autonomous pass. + +**Why trivy still reports this finding after the patch**: trivy's npm/yarn/ +pnpm vulnerability matching is version-string-based (reads the installed +`typeorm` package's declared version, `0.3.13`, against the advisory's affected +range `< 0.3.26`) — it has no visibility into a `pnpm patch` overlay's actual +code changes. The patched source is present in the built image (verified: +`grep 'stringifyObjects: true' node_modules/typeorm/driver/mysql/MysqlDriver.js` +inside the built image returns a match), but this codebase never constructs a +mysql/mariadb `DataSource` (postgres-only; `mysql2` is not installed), so +`MysqlDriver.js#createConnectionOptions` is never exercised and there is no +live code path in which to assert the merged connection options at runtime — +the grep is source-presence evidence, not a runtime behavioral proof, and this +disposition does not claim otherwise. The grep also cannot change what version +string the scanner reads, since that requires the fork itself to publish a +build whose `package.json.version` is bumped past `0.3.26` — which requires +exactly the unsafe fork-rebase this pass declined to do. + +**Disposition**: residual risk, recorded (not silently waived) — verified +unreachable in this deployment (postgres-only, mysql2 not installed) AND the +patched source (`stringifyObjects: true`) is present in-image via the +committed patch, pending a proper upstream-fork rebase as a tracked follow-up +once a verified newer base commit exists on the CTI fork. + +### `@nestjs/microservices` CVE-2026-40879 — accepted as documented residual risk (unchanged) + +`10.4.20`, fix only in `11.1.19` (no 10.x backport) — DoS via recursive +`handleData` in `JsonSocket`, **`Transport.TCP` only**. `grep -rn +"Transport\.TCP\|JsonSocket" src` returns nothing — this codebase exclusively +uses `Transport.RMQ`. Fixing requires a synchronized NestJS 10→11 major bump +across the entire `@nestjs/*` dependency graph (10+ packages, framework-wide +breaking changes) — disproportionate blast radius for a CVE whose vulnerable +transport this deployment never instantiates. Recorded as residual risk; +scheduling the NestJS 11 major bump is a tracked follow-up, not blocking this +feature. + +## Reproduction + +```bash +# native binaries used in place of `docker run aquasec/trivy` / `anchore/syft` +docker build -t alkemio/server:026-distroless-local . +docker save alkemio/server:026-distroless-local -o server.tar +trivy image --input server.tar --severity HIGH,CRITICAL --ignore-unfixed --format json +syft docker-archive:server.tar -o cyclonedx-json + +# verify the typeorm patch landed in the built image +docker run --rm --entrypoint /nodejs/bin/node alkemio/server:026-distroless-local -e " + console.log(require('fs').readFileSync('/usr/src/app/node_modules/typeorm/driver/mysql/MysqlDriver.js','utf8').includes('stringifyObjects: true')) +" +``` diff --git a/.docker/verification/sizes.md b/.docker/verification/sizes.md new file mode 100644 index 0000000000..a455c691ed --- /dev/null +++ b/.docker/verification/sizes.md @@ -0,0 +1,44 @@ +# Image size / digest evidence (US5-AS1, SC-001) — post Debian-13 CVE-remediation rebuild + +Superseded reading of `.docker/distroless-image-smoke.sh`'s baseline note (T001): +baseline is `alkemio/server:latest` (Docker Hub, amd64, pulled 2026-07-23), +`317,579,664` compressed bytes (`docker save | wc -c`) — the dev-orchestration-pinned +SHA tag 404'd from this worktree; see the smoke script header for full provenance. + +| Image | Digest (`docker inspect --format '{{.Id}}'`) | Size (docker save, bytes) | Reduction vs baseline | +|---|---|---|---| +| Baseline (`alkemio/server:latest`, pre-distroless) | n/a (Docker Hub tag, not locally re-verified this pass) | 317,579,664 | — | +| Pre-fix distroless (68 fixable HIGH/CRITICAL, Debian 12 pair) | `sha256:6fce68d58647a00a867f90ba295d73436e5ba147847f1852ddef9406e1ade5f5` | 176,709,632 | 44.36% | +| CVE-fix pass 1 (8 remaining, Debian 12 pair — dependency overrides only) | `sha256:c14fb0f23db00811c6ff8bbe72d9002f7a005bc41a8f126be7c54851f036ab20` | 176,721,920 | 44.35% | +| **CVE-fix pass 2 — Debian 13/trixie base pair + typeorm patch (this pass, 2 remaining, both verified-unreachable residual risk)** | `sha256:2d1e86ef63b54c7302adce0f83c2b908d2175d1a99cba4aafb45e38f4de64986` | 178,728,448 | **43.72%** | + +Pass 2 delta vs pass 1: +2,006,528 bytes (Debian 13/trixie base packages are +marginally larger than Debian 12/bookworm's). Still comfortably clears the +SC-001 40% floor (43.72%). + +## Base image digests (re-verified live against their registries 2026-07-23, +both pulled and confirmed via `docker buildx imagetools inspect` in this pass) + +| Base | Tag | Digest | +|---|---|---| +| Builder / proddeps | `node:22.21.1-trixie-slim` | `sha256:c3bf4cf764467f1bf9789fde549971a2cf8e720196df6cf3f95bafa590e5f4af` | +| Runtime | `gcr.io/distroless/nodejs22-debian13:nonroot` | `sha256:a2723a2817c5b01b8e7b98d567bc8b5a6b0e713e25bfb0a82b6ade4b9db06f50` | + +Superseded (Debian 12 pair, replaced this pass because Google's distroless +project no longer builds fresh Debian-12 variants and the Node 22.21.1 tag is +itself frozen upstream — no newer Debian-12 build could ever clear the +libssl3 CVEs below): + +| Base | Tag | Digest | +|---|---|---| +| Builder / proddeps (superseded) | `node:22.21.1-bookworm-slim` | `sha256:25b3eb23a00590b7499f2a2ce939322727fcce1b15fdd69754fcd09536a3ae2c` | +| Runtime (superseded) | `gcr.io/distroless/nodejs22-debian12:nonroot` | `sha256:13593b7570658e8477de39e2f4a1dd25db2f836d68a0ba771251572d23bb4f8e` | + +## Reproduce + +```bash +docker build -t alkemio/server:026-distroless-local . +docker inspect alkemio/server:026-distroless-local --format '{{.Id}}' +docker save alkemio/server:026-distroless-local | wc -c +bash .docker/distroless-image-smoke.sh alkemio/server:026-distroless-local +``` diff --git a/.dockerignore b/.dockerignore index affbeb9788..e9ed57a775 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,6 +1,7 @@ **/.classpath **/.dockerignore **/.env +**/.env.* **/.git **/.gitignore **/.project @@ -25,3 +26,41 @@ README.md .scannerwork/ coverage*/ sonar-project.properties + +# Three-stage distroless build (workspace#026-distroless-runtime-images): +# only src/, tsconfig*.json, nest-cli.json, alkemio.yml, package.json, +# pnpm-lock.yaml are COPYed into the builder stage. Everything below is +# dev/test/doc/tooling context that must never reach the build graph. +.build/ +.claude/ +.codex/ +.devcontainer/ +.github/ +.husky/ +.lintstagedrc.json +.mcp.json +.npmrc +.scripts/ +.sonarlint/ +.specify/ +LICENSE +agents.md +biome.json +contract-tests/ +docs/ +gql-pipeline-agent-teams.md +graphql-samples/ +manifests/ +overlays/ +quickstart-services*.yml +schema-baseline.graphql +schema-lite.graphql +schema.graphql +scripts/ +specs/ +test/ +tmp/ +uploads/ +vitest.config.ts +change-report.json +deprecations.json diff --git a/Dockerfile b/Dockerfile index b54eb607d5..0760b648f5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,33 +1,118 @@ -############### -# Single-stage build (includes sources & dev tooling for migrations) -############### -FROM node:22.21.1-alpine -WORKDIR /usr/src/app +############################################################################### +# workspace#026-distroless-runtime-images +# +# Three-stage build producing a distroless, non-root runtime image: +# 1. builder — glibc (Debian trixie), installs full deps, compiles TS +# 2. proddeps — glibc, fresh `pnpm install --prod` (NEVER copied from an +# Alpine/musl layer — this is the sentinel that keeps native +# modules such as `sharp` glibc-linked; see spec R-2) +# 3. runtime — gcr.io/distroless/nodejs22-debian13:nonroot: no shell, no +# package manager, no sources, no dev deps, no /wait binary. +# +# Base images are pinned by digest (resolved via +# `docker buildx imagetools inspect :`). Re-resolve and update +# both the tag *and* the digest together when bumping. +# +# node:22.21.1-trixie-slim (matches Volta pin 22.21.1, glibc/Debian 13) +# digest: sha256:c3bf4cf764467f1bf9789fde549971a2cf8e720196df6cf3f95bafa590e5f4af +# gcr.io/distroless/nodejs22-debian13:nonroot +# digest: sha256:a2723a2817c5b01b8e7b98d567bc8b5a6b0e713e25bfb0a82b6ade4b9db06f50 +# +# US5-AS1 fix-pass correction (post-verification): the feature's original +# chief decision C-1 pinned the Debian 12 pair (bookworm builder + +# distroless/nodejs22-debian12:nonroot) because the story named "debian12" +# verbatim. Live CVE verification (trivy on the exact tested digest) found +# `libssl3` on that Debian 12 pair carries 1 CRITICAL + 5 HIGH fixable CVEs +# with NO newer Debian-12 build available — Google's distroless project has +# frozen Debian 12 variants (only Debian 13/trixie receives fresh builds) and +# this Node patch tag (22.21.1) is itself frozen upstream. Zero fixable +# HIGH/CRITICAL is a hard spec gate (FR-015/US5-AS1/SC-004); it supersedes the +# story's naming preference. Moved to the Debian 13/trixie matched pair — +# same glibc family, same Volta-pinned Node version, actively maintained base. +# +# Migrations: the compiled entrypoint consumers (dev-orchestration CronJob, +# infra-ops at release time — spec R-8) MUST invoke: +# node ./node_modules/typeorm/cli.js migration:run --dataSource dist/config/migration.config.js +# from WORKDIR /usr/src/app, with zero shell involvement. This is the +# `server-migration-entrypoint` contract (see workspace repos.yaml). +############################################################################### ARG GRAPHQL_ENDPOINT_PORT_ARG=4000 ARG ENV_ARG=production -ENV NODE_ENV=$ENV_ARG -ENV GRAPHQL_ENDPOINT_PORT=$GRAPHQL_ENDPOINT_PORT_ARG -ENV NODE_OPTIONS=--max-old-space-size=2048 + +############################################################################### +# Stage 1: builder — full deps (incl. dev), compile TypeScript -> dist/ +############################################################################### +FROM node:22.21.1-trixie-slim@sha256:c3bf4cf764467f1bf9789fde549971a2cf8e720196df6cf3f95bafa590e5f4af AS builder +WORKDIR /usr/src/app # Install pnpm (locked version to align with repo) RUN npm i -g pnpm@10.17.1 -# Dependencies (full set so ts-node & dev scripts work) -COPY package*.json pnpm-lock.yaml ./ +# Dependencies (full set so the Nest CLI build toolchain is available) +COPY package.json pnpm-lock.yaml ./ +COPY patches ./patches RUN pnpm install --frozen-lockfile # Copy sources & build COPY tsconfig.json tsconfig.build.json nest-cli.json alkemio.yml ./ COPY src ./src RUN pnpm run build +# postbuild (package.json) already copies alkemio.yml -> dist/alkemio.yml + +############################################################################### +# Stage 2: proddeps — FRESH glibc install of production deps only. +# NEVER copy node_modules from an Alpine/musl-built layer into this stage or +# the runtime stage below — `sharp`'s prebuilt binaries are ABI-specific and +# a musl artifact silently segfaults (or fails to load) on glibc (spec R-2, +# edge case "musl artifact leakage"). This stage installs on the SAME glibc +# base as `builder`, so `sharp` resolves `@img/sharp-linux-x64` (glibc). +############################################################################### +FROM node:22.21.1-trixie-slim@sha256:c3bf4cf764467f1bf9789fde549971a2cf8e720196df6cf3f95bafa590e5f4af AS proddeps +WORKDIR /usr/src/app -# Optional pruning: remove dev deps after build if you want (commented out) -# RUN pnpm prune --prod +RUN npm i -g pnpm@10.17.1 +COPY package.json pnpm-lock.yaml ./ +COPY patches ./patches +RUN pnpm install --frozen-lockfile --prod -# Wait script for orchestrated startup -ADD https://github.com/ufoscout/docker-compose-wait/releases/download/2.7.3/wait /wait -RUN chmod +x /wait +############################################################################### +# Stage 3: runtime — distroless, non-root (UID 65532), no shell, no package +# manager, no sources, no dev dependencies, no /wait binary (removal verified +# consumer-safe: the server Deployment's readiness gating uses a +# `groundnuty/k8s-wait-for` initContainer, not the image's own /wait — spec +# C-2). +############################################################################### +FROM gcr.io/distroless/nodejs22-debian13:nonroot@sha256:a2723a2817c5b01b8e7b98d567bc8b5a6b0e713e25bfb0a82b6ade4b9db06f50 AS runtime + +ARG GRAPHQL_ENDPOINT_PORT_ARG +ARG ENV_ARG +ENV NODE_ENV=$ENV_ARG +ENV GRAPHQL_ENDPOINT_PORT=$GRAPHQL_ENDPOINT_PORT_ARG +ENV NODE_OPTIONS=--max-old-space-size=2048 +# US5-AS2 fix: the distroless base sets ENTRYPOINT ["/nodejs/bin/node"], but a +# bare k8s `command:` override (dev-orchestration's migration CronJob invokes +# the literal `node ./node_modules/typeorm/cli.js ...`, per the +# server-migration-entrypoint contract) REPLACES that entrypoint entirely, so +# the container runtime resolves "node" via PATH lookup before exec — which +# fails ("exec: \"node\": executable file not found in $PATH") because +# distroless's default PATH does not include /nodejs/bin. Prepending it here +# makes the documented literal `node ...` command resolve for any bare +# command: override, without requiring every consumer to know the absolute +# binary path. +ENV PATH="/nodejs/bin:${PATH}" + +WORKDIR /usr/src/app + +# package.json is required at runtime: the `_moduleAliases` field +# (module-alias, consumed by src/config/aliases.ts) resolves `@src` against +# it when dist/main.js boots. +COPY --from=proddeps /usr/src/app/node_modules ./node_modules +COPY --from=builder /usr/src/app/package.json ./package.json +COPY --from=builder /usr/src/app/dist ./dist +COPY --from=builder /usr/src/app/alkemio.yml ./alkemio.yml EXPOSE ${GRAPHQL_ENDPOINT_PORT_ARG} -CMD ["node", "dist/main.js"] + +USER nonroot +CMD ["dist/main.js"] diff --git a/docs/PublishingImages.md b/docs/PublishingImages.md index 4c466dd510..c654ae521a 100644 --- a/docs/PublishingImages.md +++ b/docs/PublishingImages.md @@ -7,3 +7,82 @@ To automaticly trigger the build up to dockerhub the following steps should be t - Ensure that the code that you would like to create the container from is pushed / merged into the `develop` branch. - Create a github release and tag it with the appropriate version number ie. `v0.1.3` - Go to github actions and view the `push to docker` action to see if everything ran correctly. + +## Runtime image shape (distroless, non-root) + +Since `workspace#026-distroless-runtime-images`, the production image is built by a +three-stage `Dockerfile`: + +1. **`builder`** — `node:22.21.1-trixie-slim` (glibc/Debian 13, matches the repo's + Volta pin). Installs the full dependency set (incl. dev) and compiles TypeScript + (`pnpm run build` → `dist/`). +2. **`proddeps`** — the **same glibc base**, a fresh `pnpm install --frozen-lockfile --prod`. + This stage is never skipped or copied from an Alpine/musl layer: native modules + (`sharp`) must be installed on the exact glibc runtime they'll execute on, or + they silently fail to load (musl artifacts are ABI-incompatible with glibc). + `package.json`'s `pnpm.supportedArchitectures.libc: ["glibc"]` reinforces this by + preventing musl-variant optional dependencies from ever being resolved. +3. **`runtime`** — `gcr.io/distroless/nodejs22-debian13:nonroot`, digest-pinned. No + shell, no package manager, no `/wait` binary, no `src/` sources, no dev + dependencies. Runs as UID 65532 (`nonroot`). Entrypoint is the distroless `node` + binary; `CMD ["dist/main.js"]`. + +Both base image tags are pinned by digest in the `Dockerfile` header comment. +Re-resolve with `docker buildx imagetools inspect :` and update the tag +and digest together when bumping either base. + +### Running database migrations against this image + +The runtime image has no shell and no `pnpm`. Migrations run via a direct, +compiled invocation of the TypeORM CLI: + +```bash +node ./node_modules/typeorm/cli.js migration:run --dataSource dist/config/migration.config.js +``` + +from `WORKDIR /usr/src/app`, as the image's non-root user, with zero shell +involvement. This is the `server-migration-entrypoint` contract consumed by +dev-orchestration's migration CronJob and, at release time, by +infrastructure-operations (see workspace spec `026-distroless-runtime-images`, +risk R-8). The command string above must stay copy-paste identical to whatever +consumers invoke. + +The TypeORM CLI config (`src/config/typeorm.cli.config.run.ts`) resolves its +`migrations` glob relative to `__dirname`, not the process CWD, so the same +config file serves both execution modes: + +- **ts-node (developer flow)**: `__dirname` is `src/config` → resolves + `src/migrations/*.ts`. `pnpm run migration:run|revert|show|generate` is + unaffected by this change. +- **compiled (this image)**: `__dirname` is `dist/config` → resolves + `dist/migrations/*.js`. + +### What was removed from the runtime image + +- The `/wait` binary (`ufoscout/docker-compose-wait`) — verified consumer-safe: + no Kubernetes manifest invokes the server image's own `/wait`; the server + Deployment's readiness gating uses a separate `groundnuty/k8s-wait-for` + initContainer. +- `pnpm`, `ts-node`, `tsconfig-paths` — these are developer/CI-only tools now + declared under `devDependencies` (they were previously miscategorized as + production `dependencies`, which is what let them leak into a full + `pnpm install --prod`). +- The full `src/` TypeScript tree and all `devDependencies`. + +### Persisted regression scripts + +- `.docker/distroless-image-smoke.sh ` — asserts non-root/no-shell/no-`/wait`, + absence of `src/`/`ts-node`/`pnpm`, that `sharp` loads (the glibc native-module + sentinel), and enforces the ≥40% image-size reduction budget (SC-001). +- `.docker/distroless-migration-smoke.sh ` — runs the compiled migration + entrypoint above against a throwaway PostgreSQL 17.5 container and asserts the + applied-migration count matches the compiled `dist/migrations/*.js` count, with + zero pending migrations afterward. + +Run both against any locally built image before publishing: + +```bash +docker build -t alkemio/server:local . +.docker/distroless-image-smoke.sh alkemio/server:local +.docker/distroless-migration-smoke.sh alkemio/server:local +``` diff --git a/package.json b/package.json index f82cf92276..b0cc57ff46 100644 --- a/package.json +++ b/package.json @@ -52,20 +52,12 @@ "schema:sort": "ts-node -r tsconfig-paths/register src/tools/schema/sort-sdl.ts schema.graphql", "schema:diff": "ts-node -r tsconfig-paths/register src/tools/schema/diff-schema.ts --old tmp/prev.schema.graphql --new schema.graphql --out change-report.json --deprecations deprecations.json", "schema:validate": "ts-node -r tsconfig-paths/register src/tools/schema/validate-artifacts.ts change-report.json deprecations.json", - "prepare": "husky" - }, - "overrides": { - "fs-capacitor": "6.2.0", - "jsonwebtoken": "9.0.0", - "tough-cookie": "4.1.3", - "@nestjs/schematics": { - "typescript": "npm:@typescript/typescript6@6.0.2" - } + "prepare": "husky || true" }, "dependencies": { "@alkemio/matrix-adapter-lib": "0.8.16", "@alkemio/notifications-lib": "0.18.0", - "@apollo/server": "^4.10.4", + "@apollo/server": "^4.13.0", "@elastic/elasticsearch": "^8.12.2", "@golevelup/nestjs-rabbitmq": "^6.1.0", "@hedger/nestjs-encryption": "^0.1.5", @@ -136,7 +128,7 @@ "passport": "^0.7.0", "passport-custom": "^1.1.1", "passport-jwt": "^4.0.1", - "path-to-regexp": "^8.2.0", + "path-to-regexp": "^8.4.2", "pg": "^8.13.1", "prosemirror-markdown": "^1.13.2", "prosemirror-model": "^1.25.3", @@ -144,9 +136,7 @@ "reflect-metadata": "^0.2.2", "replace-special-characters": "^1.2.7", "rxjs": "^7.8.1", - "sharp": "^0.34.5", - "ts-node": "^10.9.2", - "tsconfig-paths": "4.2.0", + "sharp": "^0.35.3", "typeorm": "https://pkg.pr.new/antst/typeorm@2c8f380", "uuid": "^13.0.0", "web-push": "^3.6.7", @@ -181,6 +171,7 @@ "@types/pg": "^8.15.5", "@types/supertest": "^6.0.2", "@types/web-push": "^3.6.4", + "@typescript/native": "npm:typescript@7.0.2", "@vitest/coverage-v8": "^4.0.17", "ajv-formats": "^3.0.1", "coveralls": "^3.1.1", @@ -188,8 +179,9 @@ "lint-staged": "^15.2.7", "rimraf": "^6.0.1", "supertest": "^7.0.0", + "ts-node": "^10.9.2", + "tsconfig-paths": "4.2.0", "typescript": "npm:@typescript/typescript6@6.0.2", - "@typescript/native": "npm:typescript@7.0.2", "unplugin-swc": "^1.5.9", "vite-tsconfig-paths": "^6.0.4", "vitest": "^4.0.17" @@ -205,7 +197,56 @@ "pnpm": { "onlyBuiltDependencies": [ "sharp" - ] + ], + "supportedArchitectures": { + "os": [ + "current" + ], + "cpu": [ + "current" + ], + "libc": [ + "glibc" + ] + }, + "overrides": { + "fs-capacitor": "6.2.0", + "jsonwebtoken": "9.0.0", + "tough-cookie": "4.1.3", + "@nestjs/schematics>typescript": "npm:@typescript/typescript6@6.0.2", + "multer": "^2.2.0", + "express>path-to-regexp": "^0.1.13", + "micromatch>picomatch": "^2.3.2", + "undici": "^6.27.0", + "validator": "^13.15.22", + "subscriptions-transport-ws>ws": "^7.5.11", + "@nestjs/graphql>ws": "^8.21.0", + "jsdom>ws": "^8.21.0", + "axios": "^1.16.0", + "minimatch@3": "^3.1.4", + "minimatch@5": "^5.1.8", + "brace-expansion@1": "^1.1.16", + "brace-expansion@2": "^2.1.2", + "fast-uri": "^3.1.4", + "form-data@3": "^3.0.5", + "form-data@4": "^4.0.6", + "immutable": "^4.3.9", + "js-yaml": "^4.3.0", + "jsonwebtoken>jws": "^3.2.3", + "linkify-it": "^5.0.2", + "lodash": "^4.18.0", + "@img/sharp-libvips-linuxmusl-x64": "false", + "@img/sharp-libvips-linuxmusl-arm64": "false", + "@img/sharp-linuxmusl-x64": "false", + "@img/sharp-linuxmusl-arm64": "false", + "@napi-rs/canvas-linux-x64-musl": "false", + "@napi-rs/canvas-linux-arm64-musl": "false", + "@swc/core-linux-x64-musl": "false", + "@swc/core-linux-arm64-musl": "false" + }, + "patchedDependencies": { + "typeorm@0.3.13": "patches/typeorm@0.3.13.patch" + } }, "volta": { "node": "22.21.1" diff --git a/patches/typeorm@0.3.13.patch b/patches/typeorm@0.3.13.patch new file mode 100644 index 0000000000..45f5b666af --- /dev/null +++ b/patches/typeorm@0.3.13.patch @@ -0,0 +1,23 @@ +diff --git a/driver/mysql/MysqlDriver.js b/driver/mysql/MysqlDriver.js +index 8eb53e26989be1cb517478a3c2f4855ea576d754..82513704363b2e06023110d787629c4fe6a7202c 100644 +--- a/driver/mysql/MysqlDriver.js ++++ b/driver/mysql/MysqlDriver.js +@@ -974,6 +974,18 @@ class MysqlDriver { + trace: options.trace, + multipleStatements: options.multipleStatements, + flags: options.flags, ++ // CVE-2025-60542 (GHSA-q2pj-6v73-8rgj) backport: mysql/mysql2 default ++ // stringifyObjects to false, which lets a crafted nested-object input ++ // to repository.save/update inject raw SQL. Upstream fix (typeorm ++ // commit d57fe3b, released 0.3.26) sets this implicitly to true; ++ // `options.extra.stringifyObjects` (spread last, below) can still ++ // override it, preserving the documented escape hatch. This codebase ++ // never configures a mysql/mariadb DataSource (postgres-only; mysql2 ++ // is not even an installed dependency) so the vulnerable path is ++ // unreachable here — patched anyway for defense-in-depth since the ++ // upstream fix could not be rebased onto this fork's pinned commit ++ // (see server/.docker/verification/US5-AS1-cve-remediation.md). ++ stringifyObjects: true, + }, { + host: credentials.host, + user: credentials.username, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 00f9b9d168..def2871dd3 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,46 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + fs-capacitor: 6.2.0 + jsonwebtoken: 9.0.0 + tough-cookie: 4.1.3 + '@nestjs/schematics>typescript': npm:@typescript/typescript6@6.0.2 + multer: ^2.2.0 + express>path-to-regexp: ^0.1.13 + micromatch>picomatch: ^2.3.2 + undici: ^6.27.0 + validator: ^13.15.22 + subscriptions-transport-ws>ws: ^7.5.11 + '@nestjs/graphql>ws': ^8.21.0 + jsdom>ws: ^8.21.0 + axios: ^1.16.0 + minimatch@3: ^3.1.4 + minimatch@5: ^5.1.8 + brace-expansion@1: ^1.1.16 + brace-expansion@2: ^2.1.2 + fast-uri: ^3.1.4 + form-data@3: ^3.0.5 + form-data@4: ^4.0.6 + immutable: ^4.3.9 + js-yaml: ^4.3.0 + jsonwebtoken>jws: ^3.2.3 + linkify-it: ^5.0.2 + lodash: ^4.18.0 + '@img/sharp-libvips-linuxmusl-x64': 'false' + '@img/sharp-libvips-linuxmusl-arm64': 'false' + '@img/sharp-linuxmusl-x64': 'false' + '@img/sharp-linuxmusl-arm64': 'false' + '@napi-rs/canvas-linux-x64-musl': 'false' + '@napi-rs/canvas-linux-arm64-musl': 'false' + '@swc/core-linux-x64-musl': 'false' + '@swc/core-linux-arm64-musl': 'false' + +patchedDependencies: + typeorm@0.3.13: + hash: 900fefc861876e5a2e5379bc9477be4434233cdbad5d3043cf8c810b26cc80a4 + path: patches/typeorm@0.3.13.patch + importers: .: @@ -15,8 +55,8 @@ importers: specifier: 0.18.0 version: 0.18.0(@types/express@4.17.23) '@apollo/server': - specifier: ^4.10.4 - version: 4.12.2(graphql@16.11.0) + specifier: ^4.13.0 + version: 4.13.0(graphql@16.11.0) '@elastic/elasticsearch': specifier: ^8.12.2 version: 8.19.1 @@ -31,10 +71,10 @@ importers: version: 1.29.0(zod@4.4.3) '@nestjs/apollo': specifier: ^12.2.0 - version: 12.2.2(@apollo/server@4.12.2(graphql@16.11.0))(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(@nestjs/graphql@12.2.2(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(class-transformer@0.5.1)(class-validator@0.14.0)(graphql@16.11.0)(reflect-metadata@0.2.2))(graphql@16.11.0) + version: 12.2.2(@apollo/server@4.13.0(graphql@16.11.0))(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(@nestjs/graphql@12.2.2(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(class-transformer@0.5.1)(class-validator@0.14.0)(graphql@16.11.0)(reflect-metadata@0.2.2))(graphql@16.11.0) '@nestjs/axios': specifier: ^3.0.2 - version: 3.1.3(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(axios@1.12.2)(rxjs@7.8.2) + version: 3.1.3(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(axios@1.18.1)(rxjs@7.8.2) '@nestjs/cache-manager': specifier: ^2.2.2 version: 2.3.0(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(cache-manager@5.7.6)(rxjs@7.8.2) @@ -73,7 +113,7 @@ importers: version: 4.1.2(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20) '@nestjs/typeorm': specifier: 10.0.2 - version: 10.0.2(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@https://pkg.pr.new/antst/typeorm@2c8f380(ioredis@5.10.1)(mysql2@3.15.1)(pg@8.16.3)(redis@3.1.2)(ts-node@10.9.2(@swc/core@1.15.8(@swc/helpers@0.5.17))(@types/node@22.19.2)(@typescript/typescript6@6.0.2))) + version: 10.0.2(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@https://pkg.pr.new/antst/typeorm@2c8f380(patch_hash=900fefc861876e5a2e5379bc9477be4434233cdbad5d3043cf8c810b26cc80a4)(ioredis@5.10.1)(mysql2@3.15.1)(pg@8.16.3)(redis@3.1.2)(ts-node@10.9.2(@swc/core@1.15.8(@swc/helpers@0.5.17))(@types/node@22.19.2)(@typescript/typescript6@6.0.2))) '@ory/kratos-client': specifier: ^26.2.0 version: 26.2.0 @@ -102,8 +142,8 @@ importers: specifier: 0.10.9 version: 0.10.9 axios: - specifier: ^1.12.2 - version: 1.12.2 + specifier: ^1.16.0 + version: 1.18.1 body-parser: specifier: 1.20.3 version: 1.20.3 @@ -144,8 +184,8 @@ importers: specifier: ^1.19.0 version: 1.19.0 form-data: - specifier: ^4.0.5 - version: 4.0.5 + specifier: ^4.0.6 + version: 4.0.6 graphql: specifier: ^16.9.0 version: 16.11.0 @@ -198,8 +238,8 @@ importers: specifier: ^3.1.2 version: 3.1.2 lodash: - specifier: ^4.17.21 - version: 4.17.21 + specifier: ^4.18.0 + version: 4.18.1 logform: specifier: ^2.6.1 version: 2.7.0 @@ -228,8 +268,8 @@ importers: specifier: ^4.0.1 version: 4.0.1 path-to-regexp: - specifier: ^8.2.0 - version: 8.3.0 + specifier: ^8.4.2 + version: 8.4.2 pg: specifier: ^8.13.1 version: 8.16.3 @@ -252,17 +292,11 @@ importers: specifier: ^7.8.1 version: 7.8.2 sharp: - specifier: ^0.34.5 - version: 0.34.5 - ts-node: - specifier: ^10.9.2 - version: 10.9.2(@swc/core@1.15.8(@swc/helpers@0.5.17))(@types/node@22.19.2)(@typescript/typescript6@6.0.2) - tsconfig-paths: - specifier: 4.2.0 - version: 4.2.0 + specifier: ^0.35.3 + version: 0.35.3(@types/node@22.19.2) typeorm: specifier: https://pkg.pr.new/antst/typeorm@2c8f380 - version: https://pkg.pr.new/antst/typeorm@2c8f380(ioredis@5.10.1)(mysql2@3.15.1)(pg@8.16.3)(redis@3.1.2)(ts-node@10.9.2(@swc/core@1.15.8(@swc/helpers@0.5.17))(@types/node@22.19.2)(@typescript/typescript6@6.0.2)) + version: https://pkg.pr.new/antst/typeorm@2c8f380(patch_hash=900fefc861876e5a2e5379bc9477be4434233cdbad5d3043cf8c810b26cc80a4)(ioredis@5.10.1)(mysql2@3.15.1)(pg@8.16.3)(redis@3.1.2)(ts-node@10.9.2(@swc/core@1.15.8(@swc/helpers@0.5.17))(@types/node@22.19.2)(@typescript/typescript6@6.0.2)) uuid: specifier: ^13.0.0 version: 13.0.0 @@ -381,6 +415,12 @@ importers: supertest: specifier: ^7.0.0 version: 7.1.4 + ts-node: + specifier: ^10.9.2 + version: 10.9.2(@swc/core@1.15.8(@swc/helpers@0.5.17))(@types/node@22.19.2)(@typescript/typescript6@6.0.2) + tsconfig-paths: + specifier: 4.2.0 + version: 4.2.0 typescript: specifier: npm:@typescript/typescript6@6.0.2 version: '@typescript/typescript6@6.0.2' @@ -464,10 +504,10 @@ packages: peerDependencies: '@apollo/server': ^4.0.0 - '@apollo/server@4.12.2': - resolution: {integrity: sha512-jKRlf+sBMMdKYrjMoiWKne42Eb6paBfDOr08KJnUaeaiyWFj+/040FjVPQI7YGLfdwnYIsl1NUUqS2UdgezJDg==} + '@apollo/server@4.13.0': + resolution: {integrity: sha512-t4GzaRiYIcPwYy40db6QjZzgvTr9ztDKBddykUXmBb2SVjswMKXbkaJ5nPeHqmT3awr9PAaZdCZdZhRj55I/8A==} engines: {node: '>=14.16.0'} - deprecated: Apollo Server v4 is deprecated and will transition to end-of-life on January 26, 2026. As long as you are already using a non-EOL version of Node.js, upgrading to v5 should take only a few minutes. See https://www.apollographql.com/docs/apollo-server/previous-versions for details. + deprecated: Apollo Server v4 is end-of-life since January 26, 2026. As long as you are already using a non-EOL version of Node.js, upgrading to v5 should take only a few minutes. See https://www.apollographql.com/docs/apollo-server/previous-versions for details. peerDependencies: graphql: ^16.6.0 @@ -854,24 +894,28 @@ packages: engines: {node: '>=14.21.3'} cpu: [arm64] os: [linux] + libc: [musl] '@biomejs/cli-linux-arm64@2.3.13': resolution: {integrity: sha512-xvOiFkrDNu607MPMBUQ6huHmBG1PZLOrqhtK6pXJW3GjfVqJg0Z/qpTdhXfcqWdSZHcT+Nct2fOgewZvytESkw==} engines: {node: '>=14.21.3'} cpu: [arm64] os: [linux] + libc: [glibc] '@biomejs/cli-linux-x64-musl@2.3.13': resolution: {integrity: sha512-0bdwFVSbbM//Sds6OjtnmQGp4eUjOTt6kHvR/1P0ieR9GcTUAlPNvPC3DiavTqq302W34Ae2T6u5VVNGuQtGlQ==} engines: {node: '>=14.21.3'} cpu: [x64] os: [linux] + libc: [musl] '@biomejs/cli-linux-x64@2.3.13': resolution: {integrity: sha512-s+YsZlgiXNq8XkgHs6xdvKDFOj/bwTEevqEY6rC2I3cBHbxXYU1LOZstH3Ffw9hE5tE1sqT7U23C00MzkXztMw==} engines: {node: '>=14.21.3'} cpu: [x64] os: [linux] + libc: [glibc] '@biomejs/cli-win32-arm64@2.3.13': resolution: {integrity: sha512-QweDxY89fq0VvrxME+wS/BXKmqMrOTZlN9SqQ79kQSIc3FrEwvW/PvUegQF6XIVaekncDykB5dzPqjbwSKs9DA==} @@ -954,8 +998,8 @@ packages: resolution: {integrity: sha512-Xd62ZtgdrJuaunTLk0LqYtkUtJ3D2/NQ4QyLWPYj0c2h97SNUaNkrQH9lzb6r2P0Bdjx/HwKtW3X8kO5LJ7qEQ==} engines: {node: '>=18'} - '@emnapi/runtime@1.8.1': - resolution: {integrity: sha512-mehfKSMWjjNol8659Z8KxEMrdSJDDot5SXMq00dM8BN4o+CLNXQ0xH2V7EchNHV4RmbZLmmPdEaXZc5H2FXmDg==} + '@emnapi/runtime@1.11.2': + resolution: {integrity: sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==} '@esbuild/aix-ppc64@0.27.2': resolution: {integrity: sha512-GZMB+a0mOMZs4MpDbj8RJp4cw+w1WV5NYD6xzgvzUJ5Ek2jerwfO2eADyI6ExDSUED+1X8aMbegahsJi+8mgpw==} @@ -1246,140 +1290,139 @@ packages: peerDependencies: hono: ^4 - '@img/colour@1.0.0': - resolution: {integrity: sha512-A5P/LfWGFSl6nsckYtjw9da+19jB8hkJ6ACTGcDfEJ0aE+l2n2El7dsVM7UVHZQ9s2lmYMWlrS21YLy2IR1LUw==} + '@img/colour@1.1.0': + resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==} engines: {node: '>=18'} - '@img/sharp-darwin-arm64@0.34.5': - resolution: {integrity: sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} + '@img/sharp-darwin-arm64@0.35.3': + resolution: {integrity: sha512-RMnFX7YQsMoh7lWfcM4NEHHymBX/rLuKNPVM84XE9ONPcaSCDgE7CHIHpSgPcO2xcRthgBy1HfNO319mwhIAkg==} + engines: {node: '>=20.9.0'} cpu: [arm64] os: [darwin] - '@img/sharp-darwin-x64@0.34.5': - resolution: {integrity: sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} + '@img/sharp-darwin-x64@0.35.3': + resolution: {integrity: sha512-Xo+5uFBtLN0BKqieTxiFzFPQAUlBbbH5iBKyRX/z1JrbnYsHTfKJnUfL8+p2TPXr1pXqao4eeL4Rl144uDpK9w==} + engines: {node: '>=20.9.0'} cpu: [x64] os: [darwin] - '@img/sharp-libvips-darwin-arm64@1.2.4': - resolution: {integrity: sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==} + '@img/sharp-freebsd-wasm32@0.35.3': + resolution: {integrity: sha512-lUxcqWIj2wMQ9BrwNjngcr1gWUr5xgaGThBRqPPalIC2n67Cqj1uPh8NnA/ZhAg8hUbKl+kVHKwgUIwe6ZYPrg==} + engines: {node: '>=20.9.0'} + os: [freebsd] + + '@img/sharp-libvips-darwin-arm64@1.3.2': + resolution: {integrity: sha512-9J6ypZFpQBj4YnePGoq/S38w6nz+vqg5WZLrLGY4YuSemdMq47GMLBPO42MzwdGwpg/agZ7xzZcFHa48xlywfg==} cpu: [arm64] os: [darwin] - '@img/sharp-libvips-darwin-x64@1.2.4': - resolution: {integrity: sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==} + '@img/sharp-libvips-darwin-x64@1.3.2': + resolution: {integrity: sha512-m2pW1n6cns9VaubNwsZ+c3CRYjxNQWgJ5gPlnL1nbBcpkBvFm6SCFN5o0psFHI8w9n11NKhFkeEDns98tiqbEw==} cpu: [x64] os: [darwin] - '@img/sharp-libvips-linux-arm64@1.2.4': - resolution: {integrity: sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==} + '@img/sharp-libvips-linux-arm64@1.3.2': + resolution: {integrity: sha512-dqVSFynCox4C/J8kT16V7SIFAns0IjgLwkvYT7p8LQVmJ5OS5b6tI9IGflxTeuBS//zXeFIUbwt5dwxyZ17cnA==} cpu: [arm64] os: [linux] + libc: [glibc] - '@img/sharp-libvips-linux-arm@1.2.4': - resolution: {integrity: sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==} + '@img/sharp-libvips-linux-arm@1.3.2': + resolution: {integrity: sha512-1eMLzy92I4J6rmi4mAT8yC3HxOtniyGELlzGbNMLLeqe052ahFQ0h6LFq+lh5DsDIdYViIDst08abvSbcEdLXQ==} cpu: [arm] os: [linux] + libc: [glibc] - '@img/sharp-libvips-linux-ppc64@1.2.4': - resolution: {integrity: sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==} + '@img/sharp-libvips-linux-ppc64@1.3.2': + resolution: {integrity: sha512-3z0NHDxD6n5I9gc05U1eW1AyRm+Gznzq3naMrthPNqE6oYykcogW0l/jfpJdjYnuNl8R7yI9pNbE1XiUeyq0Aw==} cpu: [ppc64] os: [linux] + libc: [glibc] - '@img/sharp-libvips-linux-riscv64@1.2.4': - resolution: {integrity: sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==} + '@img/sharp-libvips-linux-riscv64@1.3.2': + resolution: {integrity: sha512-bsb4rI+NldGOsXuej2r8OdSS8+zXDVaCWxyWrcv6kneTOlgAHtZABRzBBCwdsPiD90J4myNJuHpg6kA20ImW/w==} cpu: [riscv64] os: [linux] + libc: [glibc] - '@img/sharp-libvips-linux-s390x@1.2.4': - resolution: {integrity: sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==} + '@img/sharp-libvips-linux-s390x@1.3.2': + resolution: {integrity: sha512-/ABshyj8gCpyIrNXnHn4LorDJ0HHm1VhXPBlxZ8zAtfVPAaSafXPGn+sUSIRiwaSBy0mmFjSjiXI5mkcwdChKQ==} cpu: [s390x] os: [linux] + libc: [glibc] - '@img/sharp-libvips-linux-x64@1.2.4': - resolution: {integrity: sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==} + '@img/sharp-libvips-linux-x64@1.3.2': + resolution: {integrity: sha512-ITPEtgffGJ0S6G9dRyw/366tJQqFRcHWPHhC+Stpg3Z8AEMrDrTr2lhdz4f/Y/HMbRh//7Z5mBzEpVdi62Oc3w==} cpu: [x64] os: [linux] + libc: [glibc] - '@img/sharp-libvips-linuxmusl-arm64@1.2.4': - resolution: {integrity: sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==} + '@img/sharp-linux-arm64@0.35.3': + resolution: {integrity: sha512-QgKDspHPnrU+GQ55XPhGwyhC8acLVOOSyAvo1oVfFmrIXLkDNmGWzAfDZ4xK8oSA1qBQrALcHX0G5UZni/SuFQ==} + engines: {node: '>=20.9.0'} cpu: [arm64] os: [linux] + libc: [glibc] - '@img/sharp-libvips-linuxmusl-x64@1.2.4': - resolution: {integrity: sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==} - cpu: [x64] - os: [linux] - - '@img/sharp-linux-arm64@0.34.5': - resolution: {integrity: sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} - cpu: [arm64] - os: [linux] - - '@img/sharp-linux-arm@0.34.5': - resolution: {integrity: sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} + '@img/sharp-linux-arm@0.35.3': + resolution: {integrity: sha512-affVWCTLooy8TSxbDx2qkzuDeaWLNVBA+P//FNBirHsXpP2fuBhk5AuboYUnrDnzoXes8GFjpTx0SBFOCRg+FA==} + engines: {node: '>=20.9.0'} cpu: [arm] os: [linux] + libc: [glibc] - '@img/sharp-linux-ppc64@0.34.5': - resolution: {integrity: sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} + '@img/sharp-linux-ppc64@0.35.3': + resolution: {integrity: sha512-sMd8rDxmpLOwv/7N44klFjOD5DUO7FLdjiXDI0hoxYaf7Ar262dQIEkosE98bps+5HPLtp/EvNqeqQtOycP/IA==} + engines: {node: '>=20.9.0'} cpu: [ppc64] os: [linux] + libc: [glibc] - '@img/sharp-linux-riscv64@0.34.5': - resolution: {integrity: sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} + '@img/sharp-linux-riscv64@0.35.3': + resolution: {integrity: sha512-0Eob78yjlYPfL5vMNWAW55l3R9Y6BQS/gOfe0ZcP9mEz9ohhKSt4im1hayiknXgf8AWrFqMvJcKIdmLmEe7yeQ==} + engines: {node: '>=20.9.0'} cpu: [riscv64] os: [linux] + libc: [glibc] - '@img/sharp-linux-s390x@0.34.5': - resolution: {integrity: sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} + '@img/sharp-linux-s390x@0.35.3': + resolution: {integrity: sha512-KgAxQ0DxpNOq1rG2t5cgTgShJFGSuU7XO45cqC+1NVOuZnP6tlgZRuSYOfNupGkHID0o3cJOsw4DVeJpMovcGw==} + engines: {node: '>=20.9.0'} cpu: [s390x] os: [linux] + libc: [glibc] - '@img/sharp-linux-x64@0.34.5': - resolution: {integrity: sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} + '@img/sharp-linux-x64@0.35.3': + resolution: {integrity: sha512-8pqvxubL2PGdhlPy6GLqzDYMUjyRmKAwKHYKixpdJYBUK7PJ0C029XdsnpFIdgRZG68fZiGdHVWcKPvtiPB4cA==} + engines: {node: '>=20.9.0'} cpu: [x64] os: [linux] + libc: [glibc] - '@img/sharp-linuxmusl-arm64@0.34.5': - resolution: {integrity: sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} - cpu: [arm64] - os: [linux] - - '@img/sharp-linuxmusl-x64@0.34.5': - resolution: {integrity: sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} - cpu: [x64] - os: [linux] + '@img/sharp-wasm32@0.35.3': + resolution: {integrity: sha512-cZ0XkcYGpHZkqW6iCkqTcmUC0CD9DhD5d/qeZlZkfRBn6GnHniZXLUo5+9xw8Iv76YE6LQFN9YNBlKREcCG76w==} + engines: {node: '>=20.9.0'} - '@img/sharp-wasm32@0.34.5': - resolution: {integrity: sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} + '@img/sharp-webcontainers-wasm32@0.35.3': + resolution: {integrity: sha512-2rnq7bX3NzeR2T4YWgz8qiG4h3TSdMe+vN1iQXpJleSJ3SM5zQ8Fy2SyyXAWlbxpEZ2Y+Z4u1BePgJEYbSy80Q==} + engines: {node: '>=20.9.0'} cpu: [wasm32] - '@img/sharp-win32-arm64@0.34.5': - resolution: {integrity: sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} + '@img/sharp-win32-arm64@0.35.3': + resolution: {integrity: sha512-4bPwFdMbeC4JQ8L8LOyWp6nsHcboP5fxkp6iPOXz2Vg49R42TuMs2whkJ5OAP4/Ul035qOzy0AecOF9VOscn4w==} + engines: {node: '>=20.9.0'} cpu: [arm64] os: [win32] - '@img/sharp-win32-ia32@0.34.5': - resolution: {integrity: sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} + '@img/sharp-win32-ia32@0.35.3': + resolution: {integrity: sha512-r53mXsBN6lFUDiST764SvgwUdHAqM4rPAiDzAmf4fLoB6X/rkfyTrLCg6+g17wJJiCmB3JYgHuUldCWUIRFSXw==} + engines: {node: ^20.9.0} cpu: [ia32] os: [win32] - '@img/sharp-win32-x64@0.34.5': - resolution: {integrity: sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} + '@img/sharp-win32-x64@0.35.3': + resolution: {integrity: sha512-D4y1vNeZrIIJCN+uHaWVtH86B+aCrdMYYjicy9pXHvbGZeGYLLSd3wdVuC37FxVXlU1ARsk84eKWfWMXGYEqvA==} + engines: {node: '>=20.9.0'} cpu: [x64] os: [win32] @@ -1470,30 +1513,21 @@ packages: engines: {node: '>= 10'} cpu: [arm64] os: [linux] - - '@napi-rs/canvas-linux-arm64-musl@0.1.100': - resolution: {integrity: sha512-K3mDW66N+xT2/V439u1alFANiBUjdEx2gLiNYnCmUsva5jZMxWTjafBYwTzYK+EMFMHrUoabuU+T1BIP5CgbYQ==} - engines: {node: '>= 10'} - cpu: [arm64] - os: [linux] + libc: [glibc] '@napi-rs/canvas-linux-riscv64-gnu@0.1.100': resolution: {integrity: sha512-mooqUBTIsccZpnoQC4NgrC1v6C1vof39etLNMnBwCY+p0gajWJvAHLGQ6g/gGyS5YrpDW+GefSN4+Cvcr08UWw==} engines: {node: '>= 10'} cpu: [riscv64] os: [linux] + libc: [glibc] '@napi-rs/canvas-linux-x64-gnu@0.1.100': resolution: {integrity: sha512-1eCvkDCazm7FFhsT7DfGOdSaHgZVK3bt/dSBl5EWHOWmnz+I7j8tPseJqqD81NF+MH21jKUK4wQSDjN0mdhnTg==} engines: {node: '>= 10'} cpu: [x64] os: [linux] - - '@napi-rs/canvas-linux-x64-musl@0.1.100': - resolution: {integrity: sha512-20arT6lnI19S68qNlii73TSEDbECNgzMz2EpldC1V3mZFuRkeujXkcebRk0LRJe9SEUAooYiLokfMViY8IX7yA==} - engines: {node: '>= 10'} - cpu: [x64] - os: [linux] + libc: [glibc] '@napi-rs/canvas-win32-arm64-msvc@0.1.100': resolution: {integrity: sha512-DZFFT1wIAg37LJw37yhMRFfjATd3vTQzjZ1Yki8u2vhO6Hi5VE6BVaGQ1aaDu7xb4iMErz+9EOwjpS7xcxFeBw==} @@ -1534,7 +1568,7 @@ packages: resolution: {integrity: sha512-RZ/63c1tMxGLqyG3iOCVt7A72oy4x1eM6QEhd4KzCYpaVWW0igq0WSREeRoEZhIxRcZfDfIIkvsOMiM7yfVGZQ==} peerDependencies: '@nestjs/common': ^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 - axios: ^1.3.1 + axios: ^1.16.0 rxjs: ^6.0.0 || ^7.0.0 '@nestjs/cache-manager@2.3.0': @@ -1876,66 +1910,79 @@ packages: resolution: {integrity: sha512-Rn3n+FUk2J5VWx+ywrG/HGPTD9jXNbicRtTM11e/uorplArnXZYsVifnPPqNNP5BsO3roI4n8332ukpY/zN7rQ==} cpu: [arm] os: [linux] + libc: [glibc] '@rollup/rollup-linux-arm-musleabihf@4.55.1': resolution: {integrity: sha512-grPNWydeKtc1aEdrJDWk4opD7nFtQbMmV7769hiAaYyUKCT1faPRm2av8CX1YJsZ4TLAZcg9gTR1KvEzoLjXkg==} cpu: [arm] os: [linux] + libc: [musl] '@rollup/rollup-linux-arm64-gnu@4.55.1': resolution: {integrity: sha512-a59mwd1k6x8tXKcUxSyISiquLwB5pX+fJW9TkWU46lCqD/GRDe9uDN31jrMmVP3feI3mhAdvcCClhV8V5MhJFQ==} cpu: [arm64] os: [linux] + libc: [glibc] '@rollup/rollup-linux-arm64-musl@4.55.1': resolution: {integrity: sha512-puS1MEgWX5GsHSoiAsF0TYrpomdvkaXm0CofIMG5uVkP6IBV+ZO9xhC5YEN49nsgYo1DuuMquF9+7EDBVYu4uA==} cpu: [arm64] os: [linux] + libc: [musl] '@rollup/rollup-linux-loong64-gnu@4.55.1': resolution: {integrity: sha512-r3Wv40in+lTsULSb6nnoudVbARdOwb2u5fpeoOAZjFLznp6tDU8kd+GTHmJoqZ9lt6/Sys33KdIHUaQihFcu7g==} cpu: [loong64] os: [linux] + libc: [glibc] '@rollup/rollup-linux-loong64-musl@4.55.1': resolution: {integrity: sha512-MR8c0+UxAlB22Fq4R+aQSPBayvYa3+9DrwG/i1TKQXFYEaoW3B5b/rkSRIypcZDdWjWnpcvxbNaAJDcSbJU3Lw==} cpu: [loong64] os: [linux] + libc: [musl] '@rollup/rollup-linux-ppc64-gnu@4.55.1': resolution: {integrity: sha512-3KhoECe1BRlSYpMTeVrD4sh2Pw2xgt4jzNSZIIPLFEsnQn9gAnZagW9+VqDqAHgm1Xc77LzJOo2LdigS5qZ+gw==} cpu: [ppc64] os: [linux] + libc: [glibc] '@rollup/rollup-linux-ppc64-musl@4.55.1': resolution: {integrity: sha512-ziR1OuZx0vdYZZ30vueNZTg73alF59DicYrPViG0NEgDVN8/Jl87zkAPu4u6VjZST2llgEUjaiNl9JM6HH1Vdw==} cpu: [ppc64] os: [linux] + libc: [musl] '@rollup/rollup-linux-riscv64-gnu@4.55.1': resolution: {integrity: sha512-uW0Y12ih2XJRERZ4jAfKamTyIHVMPQnTZcQjme2HMVDAHY4amf5u414OqNYC+x+LzRdRcnIG1YodLrrtA8xsxw==} cpu: [riscv64] os: [linux] + libc: [glibc] '@rollup/rollup-linux-riscv64-musl@4.55.1': resolution: {integrity: sha512-u9yZ0jUkOED1BFrqu3BwMQoixvGHGZ+JhJNkNKY/hyoEgOwlqKb62qu+7UjbPSHYjiVy8kKJHvXKv5coH4wDeg==} cpu: [riscv64] os: [linux] + libc: [musl] '@rollup/rollup-linux-s390x-gnu@4.55.1': resolution: {integrity: sha512-/0PenBCmqM4ZUd0190j7J0UsQ/1nsi735iPRakO8iPciE7BQ495Y6msPzaOmvx0/pn+eJVVlZrNrSh4WSYLxNg==} cpu: [s390x] os: [linux] + libc: [glibc] '@rollup/rollup-linux-x64-gnu@4.55.1': resolution: {integrity: sha512-a8G4wiQxQG2BAvo+gU6XrReRRqj+pLS2NGXKm8io19goR+K8lw269eTrPkSdDTALwMmJp4th2Uh0D8J9bEV1vg==} cpu: [x64] os: [linux] + libc: [glibc] '@rollup/rollup-linux-x64-musl@4.55.1': resolution: {integrity: sha512-bD+zjpFrMpP/hqkfEcnjXWHMw5BIghGisOKPj+2NaNDuVT+8Ds4mPf3XcPHuat1tz89WRL+1wbcxKY3WSbiT7w==} cpu: [x64] os: [linux] + libc: [musl] '@rollup/rollup-openbsd-x64@4.55.1': resolution: {integrity: sha512-eLXw0dOiqE4QmvikfQ6yjgkg/xDM+MdU9YJuP4ySTibXU0oAvnEWXt7UDJmD4UkYialMfOGFPJnIHSe/kdzPxg==} @@ -1996,24 +2043,14 @@ packages: engines: {node: '>=10'} cpu: [arm64] os: [linux] - - '@swc/core-linux-arm64-musl@1.15.8': - resolution: {integrity: sha512-koiCqL09EwOP1S2RShCI7NbsQuG6r2brTqUYE7pV7kZm9O17wZ0LSz22m6gVibpwEnw8jI3IE1yYsQTVpluALw==} - engines: {node: '>=10'} - cpu: [arm64] - os: [linux] + libc: [glibc] '@swc/core-linux-x64-gnu@1.15.8': resolution: {integrity: sha512-4p6lOMU3bC+Vd5ARtKJ/FxpIC5G8v3XLoPEZ5s7mLR8h7411HWC/LmTXDHcrSXRC55zvAVia1eldy6zDLz8iFQ==} engines: {node: '>=10'} cpu: [x64] os: [linux] - - '@swc/core-linux-x64-musl@1.15.8': - resolution: {integrity: sha512-z3XBnbrZAL+6xDGAhJoN4lOueIxC/8rGrJ9tg+fEaeqLEuAtHSW2QHDHxDwkxZMjuF/pZ6MUTjHjbp8wLbuRLA==} - engines: {node: '>=10'} - cpu: [x64] - os: [linux] + libc: [glibc] '@swc/core-win32-arm64-msvc@1.15.8': resolution: {integrity: sha512-djQPJ9Rh9vP8GTS/Df3hcc6XP6xnG5c8qsngWId/BLA9oX6C7UzCPAn74BG/wGb9a6j4w3RINuoaieJB3t+7iQ==} @@ -2662,6 +2699,10 @@ packages: after-all-results@2.0.0: resolution: {integrity: sha512-2zHEyuhSJOuCrmas9YV0YL/MFCWLxe1dS6k/ENhgYrb/JqyMnadLN4iIAc9kkZrbElMDyyAGH/0J18OPErOWLg==} + agent-base@6.0.2: + resolution: {integrity: sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==} + engines: {node: '>= 6.0.0'} + agent-base@7.1.4: resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==} engines: {node: '>= 14'} @@ -2764,9 +2805,6 @@ packages: arg@4.1.3: resolution: {integrity: sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==} - argparse@1.0.10: - resolution: {integrity: sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==} - argparse@2.0.1: resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==} @@ -2837,11 +2875,8 @@ packages: aws4@1.13.2: resolution: {integrity: sha512-lHe62zvbTB5eEABUVi/AwVh0ZKY9rMMDhmm+eeyuuUQbQ3+J+fONVQOZyj+DdrvD4BY33uYniyRJ4UJIaSKAfw==} - axios@0.21.4: - resolution: {integrity: sha512-ut5vewkiu8jjGBdqpM44XxjuCjq9LAKeHVmoVfHVzy8eHgxxq8SbAVQNovDA8mVi05kP0Ea/n/UzcSHcTJQfNg==} - - axios@1.12.2: - resolution: {integrity: sha512-vMJzPewAlRyOgxV2dU0Cuz2O8zzzx9VYtbJOaBgXFeLc4IV/Eg50n4LowmehOOR61S8ZMpc2K5Sa7g6A4jfkUw==} + axios@1.18.1: + resolution: {integrity: sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==} babel-plugin-syntax-trailing-function-commas@7.0.0-beta.0: resolution: {integrity: sha512-Xj9XuRuz3nTSbaTXWv3itLOcxyF4oPD8douBBmj7U9BBC6nEBYfyOJYQMf/8PJAFotC62UY5dFfIGEPr7WswzQ==} @@ -2901,11 +2936,11 @@ packages: resolution: {integrity: sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==} engines: {node: '>=18'} - brace-expansion@1.1.12: - resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==} + brace-expansion@1.1.16: + resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==} - brace-expansion@2.0.2: - resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==} + brace-expansion@2.1.2: + resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==} braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} @@ -3650,8 +3685,8 @@ packages: fast-stream-to-buffer@1.0.0: resolution: {integrity: sha512-bI/544WUQlD2iXBibQbOMSmG07Hay7YrpXlKaeGTPT7H7pC0eitt3usak5vUwEvCGK/O7rUAM3iyQValGU22TQ==} - fast-uri@3.1.0: - resolution: {integrity: sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==} + fast-uri@3.1.4: + resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==} fastq@1.19.1: resolution: {integrity: sha512-GwLTyxkCXjXbxqIhTsMI2Nui8huMPtnxg7krajPJAjnEG/iiOS7i+zCtWGZR9G0NBKbXKh6X9m9UIsYX/N6vvQ==} @@ -3723,8 +3758,8 @@ packages: fn.name@1.1.0: resolution: {integrity: sha512-GRnmB5gPyJpAhTQdSZTSp9uaPSvl09KoYcMQtsB9rQoOmzs9dH6ffeccH+Z+cv6P68Hu5bC6JjRh4Ah/mHSNRw==} - follow-redirects@1.15.11: - resolution: {integrity: sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==} + follow-redirects@1.16.0: + resolution: {integrity: sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==} engines: {node: '>=4.0'} peerDependencies: debug: '*' @@ -3754,12 +3789,12 @@ packages: resolution: {integrity: sha512-1lLKB2Mu3aGP1Q/2eCOx0fNbRMe7XdwktwOruhfqqd0rIJWwN4Dh+E3hrPSlDCXnSR7UtZ1N38rVXm+6+MEhJQ==} engines: {node: '>= 0.12'} - form-data@3.0.4: - resolution: {integrity: sha512-f0cRzm6dkyVYV3nPoooP8XlccPQukegwhAnpoLcXy+X+A8KfpGOoXwDr9FLZd3wzgLaBGQBE3lY93Zm/i1JvIQ==} + form-data@3.0.5: + resolution: {integrity: sha512-j23EibVLnp4zNXGW7LjryXYa2X6U/M96yoOX+ybZxwkYajdxRNEqYY3zhh7y0i6kfISKS2jr+EJq1YTUDEv5+w==} engines: {node: '>= 6'} - form-data@4.0.5: - resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==} + form-data@4.0.6: + resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==} engines: {node: '>= 6'} formidable@3.5.4: @@ -3785,10 +3820,6 @@ packages: resolution: {integrity: sha512-nKcE1UduoSKX27NSZlg879LdQc94OtbOsEmKMN2MBNudXREvijRKx2GEBsTMTfws+BrbkJoEuynbGSVRSpauvw==} engines: {node: '>=10'} - fs-capacitor@8.0.0: - resolution: {integrity: sha512-+Lk6iSKajdGw+7XYxUkwIzreJ2G1JFlYOdnKJv5PzwFLVsoJYBpCuS7WPIUSNT1IbQaEWT1nhYU63Ud03DyzLA==} - engines: {node: ^14.17.0 || >=16.0.0} - fs-extra@10.1.0: resolution: {integrity: sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==} engines: {node: '>=12'} @@ -3979,6 +4010,10 @@ packages: resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==} engines: {node: '>= 0.4'} + hasown@2.0.4: + resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==} + engines: {node: '>= 0.4'} + header-case@2.0.4: resolution: {integrity: sha512-H/vuk5TEEVZwrR0lp2zed9OCo1uAILMlx0JEMgC26rzyJJ3N1v6XkwHHXJQdR2doSjcGPM6OKPYoJgf0plJ11Q==} @@ -4039,6 +4074,10 @@ packages: resolution: {integrity: sha512-JrF8SSLVmcvc5NducxgyOrKXe3EsyHMgBFgSaIUGmArKe+rwr0uphRkRXvwiom3I+fpIfoItveHrfudL8/rxuA==} engines: {node: '>=16'} + https-proxy-agent@5.0.1: + resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==} + engines: {node: '>= 6'} + https-proxy-agent@7.0.6: resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==} engines: {node: '>= 14'} @@ -4067,15 +4106,18 @@ packages: resolution: {integrity: sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==} engines: {node: '>=0.10.0'} + iconv-lite@0.7.3: + resolution: {integrity: sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==} + engines: {node: '>=0.10.0'} + idb-keyval@6.2.5: resolution: {integrity: sha512-eKQkTnS0relYsSOYomx8ozIbmdsQCKUdhyuIaQ2DZgKuaxtyQQMkyD/wlnQN32pO3yutN1b1L8uqwcDKaJd7/Q==} ieee754@1.2.1: resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==} - immutable@3.7.6: - resolution: {integrity: sha512-AizQPcaofEtO11RZhPPHBOJRdo/20MKQF9mBLnVkBoyHi1/zXK8fzVdnEpSV9gxqtnh6Qomfp3F0xT5qP/vThw==} - engines: {node: '>=0.8.0'} + immutable@4.3.9: + resolution: {integrity: sha512-ObHy4YN7ycwZOUCLI1/6svfyAFu7vL8RhAvVu/bh/RZW9EPlOyDaQ9jDQWCtdqzaXUjgXZCW1migtHE7YI7UGQ==} import-fresh@3.3.1: resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==} @@ -4291,12 +4333,8 @@ packages: js-tokens@9.0.1: resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==} - js-yaml@3.14.1: - resolution: {integrity: sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==} - hasBin: true - - js-yaml@4.1.0: - resolution: {integrity: sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==} + js-yaml@4.3.0: + resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} hasBin: true jsbn@0.1.1: @@ -4355,8 +4393,8 @@ packages: jsonfile@6.2.0: resolution: {integrity: sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==} - jsonwebtoken@9.0.2: - resolution: {integrity: sha512-PRp66vJ865SSqOlgqS8hujT5U4AOgMfhrwYIuIhfKaoSCZcirrmASQr8CX7cUg+RMih+hgznrjp99o+W4pJLHQ==} + jsonwebtoken@9.0.0: + resolution: {integrity: sha512-tuGfYXxkQGDPnLJ7SibiQgVgeDgfbPq2k2ICcbgqW8WxWLBAxKQM/ZCu/IT8SOSwmaYl4dpTFCW5xZv7YbbWUw==} engines: {node: '>=12', npm: '>=6'} jsprim@1.4.2: @@ -4373,8 +4411,8 @@ packages: resolution: {integrity: sha512-IODtn1SwEm7n6GQZnQLY0oxKDrMh7n/jRH1MzE8mlxWMrh2NnMyOsXTebu8vJ1qCpmuTJcL4DdiE0E4h8jnwsA==} engines: {node: '>=10 < 13 || >=14'} - jws@3.2.2: - resolution: {integrity: sha512-YHlZCB6lMTllWDtSPHz/ZXTsi8S00usEV6v1tjq8tOUZzw7DpSDWVXjXDre6ed1w/pd495ODpHZYSdkRTsa0HA==} + jws@3.2.3: + resolution: {integrity: sha512-byiJ0FLRdLdSVSReO/U4E7RoEyOCKnEnEPMjq3HxWtvzLsV08/i5RQKsFVNkCldrCaPr2vDNAOMsfs8T/Hze7g==} jws@4.0.1: resolution: {integrity: sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==} @@ -4416,8 +4454,8 @@ packages: lines-and-columns@1.2.4: resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==} - linkify-it@5.0.0: - resolution: {integrity: sha512-5aHCbzQRADcdP+ATqnDuhhJ/MRIqDkZX5pyjFHRRysS8vZ5AbqGEoFIb6pYHPZ+L/OC2Lc+xT8uHVVR5CAK/wQ==} + linkify-it@5.0.2: + resolution: {integrity: sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==} linkifyjs@4.3.2: resolution: {integrity: sha512-NT1CJtq3hHIreOianA8aSXn6Cw0JzYOuDQbOrSPe7gqFnCpKP++MQe3ODgO3oh2GJFORkAAdqredOa60z63GbA==} @@ -4452,39 +4490,18 @@ packages: lodash.defaults@4.2.0: resolution: {integrity: sha512-qjxPLHd3r5DnsdGacqOMU6pb/avJzdh9tFX2ymgoZE27BmjXrNy/y4LoaiTeAb+O3gL8AfpJGtqfX/ae2leYYQ==} - lodash.includes@4.3.0: - resolution: {integrity: sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==} - lodash.isarguments@3.1.0: resolution: {integrity: sha512-chi4NHZlZqZD18a0imDHnZPrDeBbTtVN7GXMwuGdRH9qotxAjYs3aVLKc7zNOG9eddR5Ksd8rvFEBc9SsggPpg==} - lodash.isboolean@3.0.3: - resolution: {integrity: sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==} - - lodash.isinteger@4.0.4: - resolution: {integrity: sha512-DBwtEWN2caHQ9/imiNeEA5ys1JoRtRfY3d7V9wkqtbycnAmTvRRmbHKDV4a0EYc678/dia0jrte4tjYwVBaZUA==} - - lodash.isnumber@3.0.3: - resolution: {integrity: sha512-QYqzpfwO3/CWf3XP+Z+tkQsfaLL/EnUlXWVkIk5FUPc4sBdTehEqZONuyRt2P67PXAk+NXmTBcc97zw9t1FQrw==} - - lodash.isplainobject@4.0.6: - resolution: {integrity: sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==} - - lodash.isstring@4.0.1: - resolution: {integrity: sha512-0wJxfxH1wgO3GrbuP+dTTk7op+6L41QCXbGINEmD+ny/G/eCqGzxyCsh7159S+mgDDcoarnBw6PC1PS5+wUGgw==} - lodash.omit@4.5.0: resolution: {integrity: sha512-XeqSp49hNGmlkj2EJlfrQFIzQ6lXdNro9sddtQzcJY8QaoC2GO0DT7xaIokHeyM+mIT0mPMlPvkYzg2xCuHdZg==} deprecated: This package is deprecated. Use destructuring assignment syntax instead. - lodash.once@4.1.1: - resolution: {integrity: sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==} - lodash.sortby@4.7.0: resolution: {integrity: sha512-HDWXG8isMntAyRF5vZ7xKuEvOhT4AhlRt/3czTSjvGUxjYCBVRQY48ViDHyfYz9VIoBkW4TMGQNapx+l3RUwdA==} - lodash@4.17.21: - resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==} + lodash@4.18.1: + resolution: {integrity: sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==} log-driver@1.2.7: resolution: {integrity: sha512-U7KCmLdqsGHBLeWqYlFA0V0Sl6P08EE1ZrmA9cxjUE0WVqT9qnyVDPz1kzpFEP0jdJuFnasWIfSd7fsaNXkpbg==} @@ -4684,11 +4701,11 @@ packages: resolution: {integrity: sha512-IPZ167aShDZZUMdRk66cyQAW3qr0WzbHkPdMYa8bzZhlHhO3jALbKdxcaak7W9FfT2rZNpQuUu4Od7ILEpXSaw==} engines: {node: 20 || >=22} - minimatch@3.1.2: - resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==} + minimatch@3.1.5: + resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==} - minimatch@5.1.6: - resolution: {integrity: sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==} + minimatch@5.1.9: + resolution: {integrity: sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==} engines: {node: '>=10'} minimatch@9.0.5: @@ -4702,10 +4719,6 @@ packages: resolution: {integrity: sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==} engines: {node: '>=16 || 14 >=14.17'} - mkdirp@0.5.6: - resolution: {integrity: sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==} - hasBin: true - mkdirp@2.1.6: resolution: {integrity: sha512-+hEnITedc8LAtIP9u3HJDFIdcLV2vXP33sqLLIzkv1Db1zO/1OxbvYf0Y1OC/S/Qo5dxHXepofhmxL02PsKe+A==} engines: {node: '>=10'} @@ -4726,8 +4739,8 @@ packages: ms@2.1.3: resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==} - multer@2.0.2: - resolution: {integrity: sha512-u7f2xaZ/UG8oLXHvtF/oWTRvT44p9ecwBBqTwgJVq0+4BW1g8OW01TyMEGWBHbyMOYVHXslaut7qEQ1meATXgw==} + multer@2.2.0: + resolution: {integrity: sha512-6rdyFg2kLrMh9Jee7/BMPuV9lEAd7lLW2YUpF9/YxR7njyoUwwQ0ZPh3TaIY50Sw6vlyD2HW3wGOkTS4P79xrQ==} engines: {node: '>= 10.16.0'} multibase@4.0.6: @@ -5040,14 +5053,14 @@ packages: resolution: {integrity: sha512-ypGJsmGtdXUOeM5u93TyeIEfEhM6s+ljAhrk5vAvSx8uyY/02OvrZnA0YNGUrPXfpJMgI1ODd3nwz8Npx4O4cg==} engines: {node: 20 || >=22} - path-to-regexp@0.1.12: - resolution: {integrity: sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==} + path-to-regexp@0.1.13: + resolution: {integrity: sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==} path-to-regexp@3.3.0: resolution: {integrity: sha512-qyCH421YQPS2WFDxDjftfc1ZR5WKQzVzqsp4n9M2kQhVOo/ByahFoUNJfl58kOcEGfQ//7weFTDhm+ss8Ecxgw==} - path-to-regexp@8.3.0: - resolution: {integrity: sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA==} + path-to-regexp@8.4.2: + resolution: {integrity: sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==} path-type@4.0.0: resolution: {integrity: sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==} @@ -5107,6 +5120,10 @@ packages: resolution: {integrity: sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==} engines: {node: '>=8.6'} + picomatch@2.3.2: + resolution: {integrity: sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==} + engines: {node: '>=8.6'} + picomatch@4.0.1: resolution: {integrity: sha512-xUXwsxNjwTQ8K3GnT4pCJm+xq3RUPQbmkYJTP5aFIfNIvbcc/4MUxgBaaRSZJ6yGJZiGSyYlM6MzwTsRk8SYCg==} engines: {node: '>=12'} @@ -5245,8 +5262,9 @@ packages: resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==} engines: {node: '>= 0.10'} - proxy-from-env@1.1.0: - resolution: {integrity: sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==} + proxy-from-env@2.1.0: + resolution: {integrity: sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==} + engines: {node: '>=10'} psl@1.15.0: resolution: {integrity: sha512-JZd3gMVBAVQkSs6HdNZo9Sdo0LNcQeMNP3CozBJb3JYC/QUYZTnKxP+f8oWRX4rHP5EurWxqAHTSwUCjlNKa1w==} @@ -5502,6 +5520,11 @@ packages: engines: {node: '>=10'} hasBin: true + semver@7.8.5: + resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==} + engines: {node: '>=10'} + hasBin: true + send@0.19.0: resolution: {integrity: sha512-dW41u5VfLXu8SJh5bwRmyYUbAoSB3c9uQh6L8h/KtsFREPWpbX1lrljJo186Jc4nmci/sGUZ9a0a0J2zgfq2hw==} engines: {node: '>= 0.8.0'} @@ -5548,9 +5571,14 @@ packages: shallow-clone-shim@2.0.0: resolution: {integrity: sha512-YRNymdiL3KGOoS67d73TEmk4tdPTO9GSMCoiphQsTcC9EtC+AOmMPjkyBkRoCJfW9ASsaZw1craaiw1dPN2D3Q==} - sharp@0.34.5: - resolution: {integrity: sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==} - engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0} + sharp@0.35.3: + resolution: {integrity: sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q==} + engines: {node: '>=20.9.0'} + peerDependencies: + '@types/node': '*' + peerDependenciesMeta: + '@types/node': + optional: true shebang-command@2.0.0: resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==} @@ -5633,9 +5661,6 @@ packages: sponge-case@1.0.1: resolution: {integrity: sha512-dblb9Et4DAtiZ5YSUZHLl4XhH4uK80GhAZrVXdN4O2P4gQ40Wa5UIOPUHlA/nFd2PLblBZWUioLMMAVrgpoYcA==} - sprintf-js@1.0.3: - resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==} - sql-summary@1.0.1: resolution: {integrity: sha512-IpCr2tpnNkP3Jera4ncexsZUp0enJBLr+pHCyTweMUBrbJsTgQeLWx1FXLhoBj/MvcnUQpkgOn2EY8FKOkUzww==} @@ -5838,13 +5863,6 @@ packages: title-case@3.0.3: resolution: {integrity: sha512-e1zGYRvbffpcHIrnuqT0Dh+gEJtDaxDSoG4JAIpq4oDFyooziLBIiYQv0GBT4FUAnUop5uZ1hiIAj7oAF6sOCA==} - tldts-core@7.0.19: - resolution: {integrity: sha512-lJX2dEWx0SGH4O6p+7FPwYmJ/bu1JbcGJ8RLaG9b7liIgZ85itUVEPbMtWRVrde/0fnDPEPHW10ZsKW3kVsE9A==} - - tldts@7.0.19: - resolution: {integrity: sha512-8PWx8tvC4jDB39BQw1m4x8y5MH1BcQ5xHeL2n7UVFulMPH/3Q0uiamahFJ3lXA0zO2SUyRXuVVbWSDmstlt9YA==} - hasBin: true - tmp@0.0.33: resolution: {integrity: sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==} engines: {node: '>=0.6.0'} @@ -5869,13 +5887,9 @@ packages: resolution: {integrity: sha512-dRXchy+C0IgK8WPC6xvCHFRIWYUbqqdEIKPaKo/AcTUNzwLTK6AH7RjdLWsEZcAN/TBdtfUw3PYEgPr5VPr6ww==} engines: {node: '>=14.16'} - tough-cookie@2.5.0: - resolution: {integrity: sha512-nlLsUzgm1kfLXSXfRZMc1KLAugd4hqJHDTvc2hDIwS3mZAfMEuMbc03SujMF+GEcpaX/qboeycw6iO8JwVv2+g==} - engines: {node: '>=0.8'} - - tough-cookie@6.0.0: - resolution: {integrity: sha512-kXuRi1mtaKMrsLUxz3sQYvVl37B0Ns6MzfrtV5DvJceE9bPyspOqk9xxv7XbZWcfLWbFmm997vl83qUWVJA64w==} - engines: {node: '>=16'} + tough-cookie@4.1.3: + resolution: {integrity: sha512-aX/y5pVRkfRnfmuX+OdbSdXvPe6ieKX/G2s7e98f4poJHnqH3281gDPm/metm6E/WRamfx7WC4HUqkWHfQHprw==} + engines: {node: '>=6'} tr46@0.0.3: resolution: {integrity: sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==} @@ -6073,8 +6087,8 @@ packages: undici-types@7.12.0: resolution: {integrity: sha512-goOacqME2GYyOZZfb5Lgtu+1IDmAlAEu5xnD3+xTzS10hT0vzpf0SPjkXwAw9Jm+4n/mQGDP3LO8CPbYROeBfQ==} - undici@6.21.3: - resolution: {integrity: sha512-gBLkYIlEnSp8pFbT64yFgGE6UIB9tAkhukC23PmMDCe5Nd+cRqKxSjw5y54MK2AZMgZfJWMaNE4nYUHgi1XEOw==} + undici@6.27.0: + resolution: {integrity: sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==} engines: {node: '>=18.17'} unicode-byte-truncate@1.0.0: @@ -6083,6 +6097,10 @@ packages: unicode-substring@0.1.0: resolution: {integrity: sha512-36Xaw9wXi7MB/3/EQZZHkZyyiRNa9i3k9YtPAz2KfqMVH2xutdXyMHn4Igarmnvr+wOrfWa/6njhY+jPpXN2EQ==} + universalify@0.2.0: + resolution: {integrity: sha512-CJ1QgKmNg3CwvAv/kOFmtnEN05f0D/cn9QntgNOQlQF9dgvVTHj3t+8JPdjqawCHk7V/KA+fbUqzZ9XWhcqPUg==} + engines: {node: '>= 4.0.0'} + universalify@2.0.1: resolution: {integrity: sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==} engines: {node: '>= 10.0.0'} @@ -6156,8 +6174,8 @@ packages: v8-compile-cache-lib@3.0.1: resolution: {integrity: sha512-wa7YjyUGfNZngI/vtK0UHAN+lgDCxBPCylVXGp0zu59Fz5aiGtNXaq3DhIov063MorB+VfufLh3JlF2KdTK3xg==} - validator@13.15.15: - resolution: {integrity: sha512-BgWVbCI72aIQy937xbawcs+hrVaN/CZ2UwutgaJ36hGqRrLNM+f5LUT/YPRbo8IV/ASeFzXszezV+y2+rq3l8A==} + validator@13.15.35: + resolution: {integrity: sha512-TQ5pAGhd5whStmqWvYF4OjQROlmv9SMFVt37qoCBdqRffuuklWYQlCNnEs2ZaIBD1kZRNnikiZOS1eqgkar0iw==} engines: {node: '>= 0.10'} value-or-promise@1.0.12: @@ -6386,8 +6404,8 @@ packages: wrappy@1.0.2: resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==} - ws@7.5.10: - resolution: {integrity: sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ==} + ws@7.5.13: + resolution: {integrity: sha512-rsKI6xDBFVf4r/x8XyChGK04QR/XHroxs/jUcoWvtEZM8TPU/X/uIY9B1CsSzYws9ZJb/6bbBu7dPhFW00CAoA==} engines: {node: '>=8.3.0'} peerDependencies: bufferutil: ^4.0.1 @@ -6398,20 +6416,8 @@ packages: utf-8-validate: optional: true - ws@8.18.0: - resolution: {integrity: sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==} - engines: {node: '>=10.0.0'} - peerDependencies: - bufferutil: ^4.0.1 - utf-8-validate: '>=5.0.2' - peerDependenciesMeta: - bufferutil: - optional: true - utf-8-validate: - optional: true - - ws@8.19.0: - resolution: {integrity: sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==} + ws@8.21.1: + resolution: {integrity: sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==} engines: {node: '>=10.0.0'} peerDependencies: bufferutil: ^4.0.1 @@ -6525,7 +6531,7 @@ snapshots: '@graphql-codegen/typescript-graphql-request': 4.5.9(graphql-request@3.7.0(graphql@16.11.0))(graphql-tag@2.12.6(graphql@16.11.0))(graphql@16.11.0) '@graphql-codegen/typescript-operations': 2.5.13(graphql@16.11.0) '@types/graphql-upload': 8.0.12 - axios: 0.21.4 + axios: 1.18.1 graphql: 16.11.0 graphql-request: 3.7.0(graphql@16.11.0) graphql-tag: 2.12.6(graphql@16.11.0) @@ -6633,12 +6639,12 @@ snapshots: '@apollo/utils.logger': 2.0.1 graphql: 16.11.0 - '@apollo/server-plugin-landing-page-graphql-playground@4.0.0(@apollo/server@4.12.2(graphql@16.11.0))': + '@apollo/server-plugin-landing-page-graphql-playground@4.0.0(@apollo/server@4.13.0(graphql@16.11.0))': dependencies: - '@apollo/server': 4.12.2(graphql@16.11.0) + '@apollo/server': 4.13.0(graphql@16.11.0) '@apollographql/graphql-playground-html': 1.6.29 - '@apollo/server@4.12.2(graphql@16.11.0)': + '@apollo/server@4.13.0(graphql@16.11.0)': dependencies: '@apollo/cache-control-types': 1.0.3(graphql@16.11.0) '@apollo/server-gateway-interface': 1.1.1(graphql@16.11.0) @@ -6655,6 +6661,7 @@ snapshots: '@types/express-serve-static-core': 4.19.6 '@types/node-fetch': 2.6.13 async-retry: 1.3.3 + content-type: 1.0.5 cors: 2.8.5 express: 4.21.2 graphql: 16.11.0 @@ -6740,7 +6747,7 @@ snapshots: fbjs: 3.0.5 glob: 7.2.3 graphql: 16.11.0 - immutable: 3.7.6 + immutable: 4.3.9 invariant: 2.2.4 nullthrows: 1.1.1 relay-runtime: 12.0.0 @@ -7206,11 +7213,11 @@ snapshots: ms: 2.1.3 secure-json-parse: 3.0.2 tslib: 2.8.1 - undici: 6.21.3 + undici: 6.27.0 transitivePeerDependencies: - supports-color - '@emnapi/runtime@1.8.1': + '@emnapi/runtime@1.11.2': dependencies: tslib: 2.8.1 optional: true @@ -7301,7 +7308,7 @@ snapshots: dependencies: '@nestjs/common': 10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2) '@nestjs/core': 10.4.20(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/microservices@10.4.20)(@nestjs/platform-express@10.4.20)(reflect-metadata@0.2.2)(rxjs@7.8.2) - lodash: 4.17.21 + lodash: 4.18.1 '@golevelup/nestjs-rabbitmq@6.1.0(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(reflect-metadata@0.2.2)(rxjs@7.8.2)': dependencies: @@ -7310,7 +7317,7 @@ snapshots: '@nestjs/core': 10.4.20(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/microservices@10.4.20)(@nestjs/platform-express@10.4.20)(reflect-metadata@0.2.2)(rxjs@7.8.2) amqp-connection-manager: 4.1.15(amqplib@0.10.9) amqplib: 0.10.9 - lodash: 4.17.21 + lodash: 4.18.1 reflect-metadata: 0.2.2 rxjs: 7.8.2 @@ -7323,7 +7330,7 @@ snapshots: common-tags: 1.8.2 graphql: 16.11.0 import-from: 4.0.0 - lodash: 4.17.21 + lodash: 4.18.1 tslib: 2.4.1 '@graphql-codegen/plugin-helpers@3.1.2(graphql@16.11.0)': @@ -7333,7 +7340,7 @@ snapshots: common-tags: 1.8.2 graphql: 16.11.0 import-from: 4.0.0 - lodash: 4.17.21 + lodash: 4.18.1 tslib: 2.4.1 '@graphql-codegen/schema-ast@2.6.1(graphql@16.11.0)': @@ -7488,100 +7495,94 @@ snapshots: dependencies: hono: 4.12.25 - '@img/colour@1.0.0': {} + '@img/colour@1.1.0': {} - '@img/sharp-darwin-arm64@0.34.5': + '@img/sharp-darwin-arm64@0.35.3': optionalDependencies: - '@img/sharp-libvips-darwin-arm64': 1.2.4 + '@img/sharp-libvips-darwin-arm64': 1.3.2 optional: true - '@img/sharp-darwin-x64@0.34.5': + '@img/sharp-darwin-x64@0.35.3': optionalDependencies: - '@img/sharp-libvips-darwin-x64': 1.2.4 + '@img/sharp-libvips-darwin-x64': 1.3.2 optional: true - '@img/sharp-libvips-darwin-arm64@1.2.4': - optional: true - - '@img/sharp-libvips-darwin-x64@1.2.4': - optional: true - - '@img/sharp-libvips-linux-arm64@1.2.4': + '@img/sharp-freebsd-wasm32@0.35.3': + dependencies: + '@img/sharp-wasm32': 0.35.3 optional: true - '@img/sharp-libvips-linux-arm@1.2.4': + '@img/sharp-libvips-darwin-arm64@1.3.2': optional: true - '@img/sharp-libvips-linux-ppc64@1.2.4': + '@img/sharp-libvips-darwin-x64@1.3.2': optional: true - '@img/sharp-libvips-linux-riscv64@1.2.4': + '@img/sharp-libvips-linux-arm64@1.3.2': optional: true - '@img/sharp-libvips-linux-s390x@1.2.4': + '@img/sharp-libvips-linux-arm@1.3.2': optional: true - '@img/sharp-libvips-linux-x64@1.2.4': + '@img/sharp-libvips-linux-ppc64@1.3.2': optional: true - '@img/sharp-libvips-linuxmusl-arm64@1.2.4': + '@img/sharp-libvips-linux-riscv64@1.3.2': optional: true - '@img/sharp-libvips-linuxmusl-x64@1.2.4': + '@img/sharp-libvips-linux-s390x@1.3.2': optional: true - '@img/sharp-linux-arm64@0.34.5': - optionalDependencies: - '@img/sharp-libvips-linux-arm64': 1.2.4 + '@img/sharp-libvips-linux-x64@1.3.2': optional: true - '@img/sharp-linux-arm@0.34.5': + '@img/sharp-linux-arm64@0.35.3': optionalDependencies: - '@img/sharp-libvips-linux-arm': 1.2.4 + '@img/sharp-libvips-linux-arm64': 1.3.2 optional: true - '@img/sharp-linux-ppc64@0.34.5': + '@img/sharp-linux-arm@0.35.3': optionalDependencies: - '@img/sharp-libvips-linux-ppc64': 1.2.4 + '@img/sharp-libvips-linux-arm': 1.3.2 optional: true - '@img/sharp-linux-riscv64@0.34.5': + '@img/sharp-linux-ppc64@0.35.3': optionalDependencies: - '@img/sharp-libvips-linux-riscv64': 1.2.4 + '@img/sharp-libvips-linux-ppc64': 1.3.2 optional: true - '@img/sharp-linux-s390x@0.34.5': + '@img/sharp-linux-riscv64@0.35.3': optionalDependencies: - '@img/sharp-libvips-linux-s390x': 1.2.4 + '@img/sharp-libvips-linux-riscv64': 1.3.2 optional: true - '@img/sharp-linux-x64@0.34.5': + '@img/sharp-linux-s390x@0.35.3': optionalDependencies: - '@img/sharp-libvips-linux-x64': 1.2.4 + '@img/sharp-libvips-linux-s390x': 1.3.2 optional: true - '@img/sharp-linuxmusl-arm64@0.34.5': + '@img/sharp-linux-x64@0.35.3': optionalDependencies: - '@img/sharp-libvips-linuxmusl-arm64': 1.2.4 + '@img/sharp-libvips-linux-x64': 1.3.2 optional: true - '@img/sharp-linuxmusl-x64@0.34.5': - optionalDependencies: - '@img/sharp-libvips-linuxmusl-x64': 1.2.4 + '@img/sharp-wasm32@0.35.3': + dependencies: + '@emnapi/runtime': 1.11.2 optional: true - '@img/sharp-wasm32@0.34.5': + '@img/sharp-webcontainers-wasm32@0.35.3': dependencies: - '@emnapi/runtime': 1.8.1 + '@img/sharp-wasm32': 0.35.3 optional: true - '@img/sharp-win32-arm64@0.34.5': + '@img/sharp-win32-arm64@0.35.3': optional: true - '@img/sharp-win32-ia32@0.34.5': + '@img/sharp-win32-ia32@0.35.3': optional: true - '@img/sharp-win32-x64@0.34.5': + '@img/sharp-win32-x64@0.35.3': optional: true '@ioredis/commands@1.5.1': {} @@ -7675,18 +7676,12 @@ snapshots: '@napi-rs/canvas-linux-arm64-gnu@0.1.100': optional: true - '@napi-rs/canvas-linux-arm64-musl@0.1.100': - optional: true - '@napi-rs/canvas-linux-riscv64-gnu@0.1.100': optional: true '@napi-rs/canvas-linux-x64-gnu@0.1.100': optional: true - '@napi-rs/canvas-linux-x64-musl@0.1.100': - optional: true - '@napi-rs/canvas-win32-arm64-msvc@0.1.100': optional: true @@ -7700,18 +7695,16 @@ snapshots: '@napi-rs/canvas-darwin-x64': 0.1.100 '@napi-rs/canvas-linux-arm-gnueabihf': 0.1.100 '@napi-rs/canvas-linux-arm64-gnu': 0.1.100 - '@napi-rs/canvas-linux-arm64-musl': 0.1.100 '@napi-rs/canvas-linux-riscv64-gnu': 0.1.100 '@napi-rs/canvas-linux-x64-gnu': 0.1.100 - '@napi-rs/canvas-linux-x64-musl': 0.1.100 '@napi-rs/canvas-win32-arm64-msvc': 0.1.100 '@napi-rs/canvas-win32-x64-msvc': 0.1.100 optional: true - '@nestjs/apollo@12.2.2(@apollo/server@4.12.2(graphql@16.11.0))(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(@nestjs/graphql@12.2.2(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(class-transformer@0.5.1)(class-validator@0.14.0)(graphql@16.11.0)(reflect-metadata@0.2.2))(graphql@16.11.0)': + '@nestjs/apollo@12.2.2(@apollo/server@4.13.0(graphql@16.11.0))(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(@nestjs/graphql@12.2.2(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(class-transformer@0.5.1)(class-validator@0.14.0)(graphql@16.11.0)(reflect-metadata@0.2.2))(graphql@16.11.0)': dependencies: - '@apollo/server': 4.12.2(graphql@16.11.0) - '@apollo/server-plugin-landing-page-graphql-playground': 4.0.0(@apollo/server@4.12.2(graphql@16.11.0)) + '@apollo/server': 4.13.0(graphql@16.11.0) + '@apollo/server-plugin-landing-page-graphql-playground': 4.0.0(@apollo/server@4.13.0(graphql@16.11.0)) '@nestjs/common': 10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2) '@nestjs/core': 10.4.20(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/microservices@10.4.20)(@nestjs/platform-express@10.4.20)(reflect-metadata@0.2.2)(rxjs@7.8.2) '@nestjs/graphql': 12.2.2(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(class-transformer@0.5.1)(class-validator@0.14.0)(graphql@16.11.0)(reflect-metadata@0.2.2) @@ -7720,10 +7713,10 @@ snapshots: lodash.omit: 4.5.0 tslib: 2.8.1 - '@nestjs/axios@3.1.3(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(axios@1.12.2)(rxjs@7.8.2)': + '@nestjs/axios@3.1.3(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(axios@1.18.1)(rxjs@7.8.2)': dependencies: '@nestjs/common': 10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2) - axios: 1.12.2 + axios: 1.18.1 rxjs: 7.8.2 '@nestjs/cache-manager@2.3.0(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(cache-manager@5.7.6)(rxjs@7.8.2)': @@ -7780,7 +7773,7 @@ snapshots: '@nestjs/common': 10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2) dotenv: 16.4.5 dotenv-expand: 10.0.0 - lodash: 4.17.21 + lodash: 4.18.1 rxjs: 7.8.2 '@nestjs/core@10.4.20(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/microservices@10.4.20)(@nestjs/platform-express@10.4.20)(reflect-metadata@0.2.2)(rxjs@7.8.2)': @@ -7827,13 +7820,13 @@ snapshots: graphql: 16.11.0 graphql-tag: 2.12.6(graphql@16.11.0) graphql-ws: 5.16.0(graphql@16.11.0) - lodash: 4.17.21 + lodash: 4.18.1 normalize-path: 3.0.0 reflect-metadata: 0.2.2 subscriptions-transport-ws: 0.11.0(graphql@16.11.0) tslib: 2.8.1 uuid: 11.0.3 - ws: 8.18.0 + ws: 8.21.1 optionalDependencies: class-transformer: 0.5.1 class-validator: 0.14.0 @@ -7845,7 +7838,7 @@ snapshots: dependencies: '@nestjs/common': 10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2) '@types/jsonwebtoken': 9.0.5 - jsonwebtoken: 9.0.2 + jsonwebtoken: 9.0.0 '@nestjs/mapped-types@2.0.6(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)': dependencies: @@ -7881,7 +7874,7 @@ snapshots: body-parser: 1.20.3 cors: 2.8.5 express: 4.21.2 - multer: 2.0.2 + multer: 2.2.0 tslib: 2.8.1 transitivePeerDependencies: - supports-color @@ -7924,13 +7917,13 @@ snapshots: '@nestjs/microservices': 10.4.20(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(amqp-connection-manager@4.1.15(amqplib@0.10.9))(amqplib@0.10.9)(cache-manager@5.7.6)(ioredis@5.10.1)(reflect-metadata@0.2.2)(rxjs@7.8.2) '@nestjs/platform-express': 10.4.20(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20) - '@nestjs/typeorm@10.0.2(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@https://pkg.pr.new/antst/typeorm@2c8f380(ioredis@5.10.1)(mysql2@3.15.1)(pg@8.16.3)(redis@3.1.2)(ts-node@10.9.2(@swc/core@1.15.8(@swc/helpers@0.5.17))(@types/node@22.19.2)(@typescript/typescript6@6.0.2)))': + '@nestjs/typeorm@10.0.2(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@10.4.20)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@https://pkg.pr.new/antst/typeorm@2c8f380(patch_hash=900fefc861876e5a2e5379bc9477be4434233cdbad5d3043cf8c810b26cc80a4)(ioredis@5.10.1)(mysql2@3.15.1)(pg@8.16.3)(redis@3.1.2)(ts-node@10.9.2(@swc/core@1.15.8(@swc/helpers@0.5.17))(@types/node@22.19.2)(@typescript/typescript6@6.0.2)))': dependencies: '@nestjs/common': 10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2) '@nestjs/core': 10.4.20(@nestjs/common@10.4.20(class-transformer@0.5.1)(class-validator@0.14.0)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/microservices@10.4.20)(@nestjs/platform-express@10.4.20)(reflect-metadata@0.2.2)(rxjs@7.8.2) reflect-metadata: 0.2.2 rxjs: 7.8.2 - typeorm: https://pkg.pr.new/antst/typeorm@2c8f380(ioredis@5.10.1)(mysql2@3.15.1)(pg@8.16.3)(redis@3.1.2)(ts-node@10.9.2(@swc/core@1.15.8(@swc/helpers@0.5.17))(@types/node@22.19.2)(@typescript/typescript6@6.0.2)) + typeorm: https://pkg.pr.new/antst/typeorm@2c8f380(patch_hash=900fefc861876e5a2e5379bc9477be4434233cdbad5d3043cf8c810b26cc80a4)(ioredis@5.10.1)(mysql2@3.15.1)(pg@8.16.3)(redis@3.1.2)(ts-node@10.9.2(@swc/core@1.15.8(@swc/helpers@0.5.17))(@types/node@22.19.2)(@typescript/typescript6@6.0.2)) uuid: 9.0.1 '@noble/hashes@1.8.0': {} @@ -7985,9 +7978,10 @@ snapshots: '@ory/kratos-client@26.2.0': dependencies: - axios: 1.12.2 + axios: 1.18.1 transitivePeerDependencies: - debug + - supports-color '@panva/asn1.js@1.0.0': {} @@ -8122,15 +8116,9 @@ snapshots: '@swc/core-linux-arm64-gnu@1.15.8': optional: true - '@swc/core-linux-arm64-musl@1.15.8': - optional: true - '@swc/core-linux-x64-gnu@1.15.8': optional: true - '@swc/core-linux-x64-musl@1.15.8': - optional: true - '@swc/core-win32-arm64-msvc@1.15.8': optional: true @@ -8149,9 +8137,7 @@ snapshots: '@swc/core-darwin-x64': 1.15.8 '@swc/core-linux-arm-gnueabihf': 1.15.8 '@swc/core-linux-arm64-gnu': 1.15.8 - '@swc/core-linux-arm64-musl': 1.15.8 '@swc/core-linux-x64-gnu': 1.15.8 - '@swc/core-linux-x64-musl': 1.15.8 '@swc/core-win32-arm64-msvc': 1.15.8 '@swc/core-win32-ia32-msvc': 1.15.8 '@swc/core-win32-x64-msvc': 1.15.8 @@ -8450,7 +8436,7 @@ snapshots: dependencies: '@types/express': 4.17.23 '@types/koa': 3.0.0 - fs-capacitor: 8.0.0 + fs-capacitor: 6.2.0 graphql: 16.11.0 '@types/heic-convert@2.1.0': {} @@ -8523,7 +8509,7 @@ snapshots: '@types/node-fetch@2.6.13': dependencies: '@types/node': 22.19.2 - form-data: 4.0.5 + form-data: 4.0.6 '@types/node@22.19.2': dependencies: @@ -8579,7 +8565,7 @@ snapshots: '@types/cookiejar': 2.1.5 '@types/methods': 1.1.4 '@types/node': 22.19.2 - form-data: 4.0.5 + form-data: 4.0.6 '@types/supertest@6.0.3': dependencies: @@ -8821,6 +8807,12 @@ snapshots: after-all-results@2.0.0: {} + agent-base@6.0.2: + dependencies: + debug: 4.4.3 + transitivePeerDependencies: + - supports-color + agent-base@7.1.4: {} agentkeepalive@4.6.0: @@ -8865,7 +8857,7 @@ snapshots: ajv@8.17.1: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.0 + fast-uri: 3.1.4 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -8926,10 +8918,6 @@ snapshots: arg@4.1.3: {} - argparse@1.0.10: - dependencies: - sprintf-js: 1.0.3 - argparse@2.0.1: {} array-back@6.2.2: {} @@ -8990,19 +8978,15 @@ snapshots: aws4@1.13.2: {} - axios@0.21.4: - dependencies: - follow-redirects: 1.15.11 - transitivePeerDependencies: - - debug - - axios@1.12.2: + axios@1.18.1: dependencies: - follow-redirects: 1.15.11 - form-data: 4.0.5 - proxy-from-env: 1.1.0 + follow-redirects: 1.16.0 + form-data: 4.0.6 + https-proxy-agent: 5.0.1 + proxy-from-env: 2.1.0 transitivePeerDependencies: - debug + - supports-color babel-plugin-syntax-trailing-function-commas@7.0.0-beta.0: {} @@ -9106,12 +9090,12 @@ snapshots: transitivePeerDependencies: - supports-color - brace-expansion@1.1.12: + brace-expansion@1.1.16: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.0.2: + brace-expansion@2.1.2: dependencies: balanced-match: 1.0.2 @@ -9304,7 +9288,7 @@ snapshots: dependencies: '@types/validator': 13.15.3 libphonenumber-js: 1.12.22 - validator: 13.15.15 + validator: 13.15.35 cli-cursor@3.1.0: dependencies: @@ -9491,7 +9475,7 @@ snapshots: cosmiconfig@8.3.6(typescript@5.3.3): dependencies: import-fresh: 3.3.1 - js-yaml: 4.1.0 + js-yaml: 4.3.0 parse-json: 5.2.0 path-type: 4.0.0 optionalDependencies: @@ -9499,7 +9483,7 @@ snapshots: coveralls@3.1.1: dependencies: - js-yaml: 3.14.1 + js-yaml: 4.3.0 lcov-parse: 1.0.0 log-driver: 1.2.7 minimist: 1.2.8 @@ -9748,7 +9732,7 @@ snapshots: es-errors: 1.3.0 get-intrinsic: 1.3.0 has-tostringtag: 1.0.2 - hasown: 2.0.2 + hasown: 2.0.4 esbuild@0.27.2: optionalDependencies: @@ -9881,7 +9865,7 @@ snapshots: methods: 1.1.2 on-finished: 2.4.1 parseurl: 1.3.3 - path-to-regexp: 0.1.12 + path-to-regexp: 0.1.13 proxy-addr: 2.0.7 qs: 6.13.0 range-parser: 1.2.1 @@ -9961,7 +9945,7 @@ snapshots: dependencies: end-of-stream: 1.4.5 - fast-uri@3.1.0: {} + fast-uri@3.1.4: {} fastq@1.19.1: dependencies: @@ -10053,7 +10037,7 @@ snapshots: fn.name@1.1.0: {} - follow-redirects@1.15.11: {} + follow-redirects@1.16.0: {} for-each@0.3.5: dependencies: @@ -10075,7 +10059,7 @@ snapshots: deepmerge: 4.3.1 fs-extra: 10.1.0 memfs: 3.5.3 - minimatch: 3.1.2 + minimatch: 3.1.5 node-abort-controller: 3.1.1 schema-utils: 3.3.0 semver: 7.7.2 @@ -10089,20 +10073,20 @@ snapshots: combined-stream: 1.0.8 mime-types: 2.1.35 - form-data@3.0.4: + form-data@3.0.5: dependencies: asynckit: 0.4.0 combined-stream: 1.0.8 es-set-tostringtag: 2.1.0 - hasown: 2.0.2 + hasown: 2.0.4 mime-types: 2.1.35 - form-data@4.0.5: + form-data@4.0.6: dependencies: asynckit: 0.4.0 combined-stream: 1.0.8 es-set-tostringtag: 2.1.0 - hasown: 2.0.2 + hasown: 2.0.4 mime-types: 2.1.35 formidable@3.5.4: @@ -10121,8 +10105,6 @@ snapshots: fs-capacitor@6.2.0: {} - fs-capacitor@8.0.0: {} - fs-extra@10.1.0: dependencies: graceful-fs: 4.2.11 @@ -10202,7 +10184,7 @@ snapshots: fs.realpath: 1.0.0 inflight: 1.0.6 inherits: 2.0.4 - minimatch: 3.1.2 + minimatch: 3.1.5 once: 1.4.0 path-is-absolute: 1.0.1 @@ -10211,7 +10193,7 @@ snapshots: fs.realpath: 1.0.0 inflight: 1.0.6 inherits: 2.0.4 - minimatch: 5.1.6 + minimatch: 5.1.9 once: 1.4.0 globrex@0.1.2: {} @@ -10242,7 +10224,7 @@ snapshots: dependencies: cross-fetch: 3.2.0 extract-files: 9.0.0 - form-data: 3.0.4 + form-data: 3.0.5 graphql: 16.11.0 transitivePeerDependencies: - encoding @@ -10274,7 +10256,7 @@ snapshots: '@types/node': 22.19.2 '@types/object-path': 0.11.4 busboy: 1.6.0 - fs-capacitor: 8.0.0 + fs-capacitor: 6.2.0 graphql: 16.11.0 http-errors: 2.0.1 object-path: 0.11.8 @@ -10316,6 +10298,10 @@ snapshots: dependencies: function-bind: 1.1.2 + hasown@2.0.4: + dependencies: + function-bind: 1.1.2 + header-case@2.0.4: dependencies: capital-case: 1.0.4 @@ -10390,6 +10376,13 @@ snapshots: http_ece@1.2.0: {} + https-proxy-agent@5.0.1: + dependencies: + agent-base: 6.0.2 + debug: 4.4.3 + transitivePeerDependencies: + - supports-color + https-proxy-agent@7.0.6: dependencies: agent-base: 7.1.4 @@ -10417,11 +10410,16 @@ snapshots: dependencies: safer-buffer: 2.1.2 + iconv-lite@0.7.3: + dependencies: + safer-buffer: 2.1.2 + optional: true + idb-keyval@6.2.5: {} ieee754@1.2.1: {} - immutable@3.7.6: {} + immutable@4.3.9: {} import-fresh@3.3.1: dependencies: @@ -10452,7 +10450,7 @@ snapshots: cli-width: 3.0.0 external-editor: 3.1.0 figures: 3.2.0 - lodash: 4.17.21 + lodash: 4.18.1 mute-stream: 0.0.8 ora: 5.4.1 run-async: 2.4.1 @@ -10471,7 +10469,7 @@ snapshots: cli-width: 4.1.0 external-editor: 3.1.0 figures: 3.2.0 - lodash: 4.17.21 + lodash: 4.18.1 mute-stream: 1.0.0 ora: 5.4.1 run-async: 3.0.0 @@ -10648,12 +10646,7 @@ snapshots: js-tokens@9.0.1: {} - js-yaml@3.14.1: - dependencies: - argparse: 1.0.10 - esprima: 4.0.1 - - js-yaml@4.1.0: + js-yaml@4.3.0: dependencies: argparse: 2.0.1 @@ -10674,12 +10667,12 @@ snapshots: parse5: 8.0.0 saxes: 6.0.0 symbol-tree: 3.2.4 - tough-cookie: 6.0.0 + tough-cookie: 4.1.3 w3c-xmlserializer: 5.0.0 webidl-conversions: 8.0.1 whatwg-mimetype: 4.0.0 whatwg-url: 15.1.0 - ws: 8.19.0 + ws: 8.21.1 xml-name-validator: 5.0.0 transitivePeerDependencies: - '@noble/hashes' @@ -10719,18 +10712,12 @@ snapshots: optionalDependencies: graceful-fs: 4.2.11 - jsonwebtoken@9.0.2: + jsonwebtoken@9.0.0: dependencies: - jws: 3.2.2 - lodash.includes: 4.3.0 - lodash.isboolean: 3.0.3 - lodash.isinteger: 4.0.4 - lodash.isnumber: 3.0.3 - lodash.isplainobject: 4.0.6 - lodash.isstring: 4.0.1 - lodash.once: 4.1.1 + jws: 3.2.3 + lodash: 4.18.1 ms: 2.1.3 - semver: 7.7.2 + semver: 7.8.5 jsprim@1.4.2: dependencies: @@ -10762,7 +10749,7 @@ snapshots: transitivePeerDependencies: - supports-color - jws@3.2.2: + jws@3.2.3: dependencies: jwa: 1.4.2 safe-buffer: 5.2.1 @@ -10796,7 +10783,7 @@ snapshots: lines-and-columns@1.2.4: {} - linkify-it@5.0.0: + linkify-it@5.0.2: dependencies: uc.micro: 2.1.0 @@ -10840,27 +10827,13 @@ snapshots: lodash.defaults@4.2.0: {} - lodash.includes@4.3.0: {} - lodash.isarguments@3.1.0: {} - lodash.isboolean@3.0.3: {} - - lodash.isinteger@4.0.4: {} - - lodash.isnumber@3.0.3: {} - - lodash.isplainobject@4.0.6: {} - - lodash.isstring@4.0.1: {} - lodash.omit@4.5.0: {} - lodash.once@4.1.1: {} - lodash.sortby@4.7.0: {} - lodash@4.17.21: {} + lodash@4.18.1: {} log-driver@1.2.7: {} @@ -10961,7 +10934,7 @@ snapshots: dependencies: argparse: 2.0.1 entities: 4.5.0 - linkify-it: 5.0.0 + linkify-it: 5.0.2 mdurl: 2.0.0 punycode.js: 2.3.1 uc.micro: 2.1.0 @@ -11005,7 +10978,7 @@ snapshots: micromatch@4.0.8: dependencies: braces: 3.0.3 - picomatch: 2.3.1 + picomatch: 2.3.2 mime-db@1.52.0: {} @@ -11035,26 +11008,22 @@ snapshots: dependencies: '@isaacs/brace-expansion': 5.0.0 - minimatch@3.1.2: + minimatch@3.1.5: dependencies: - brace-expansion: 1.1.12 + brace-expansion: 1.1.16 - minimatch@5.1.6: + minimatch@5.1.9: dependencies: - brace-expansion: 2.0.2 + brace-expansion: 2.1.2 minimatch@9.0.5: dependencies: - brace-expansion: 2.0.2 + brace-expansion: 2.1.2 minimist@1.2.8: {} minipass@7.1.2: {} - mkdirp@0.5.6: - dependencies: - minimist: 1.2.8 - mkdirp@2.1.6: {} module-alias@2.2.3: {} @@ -11067,15 +11036,12 @@ snapshots: ms@2.1.3: {} - multer@2.0.2: + multer@2.2.0: dependencies: append-field: 1.0.0 busboy: 1.6.0 concat-stream: 2.0.0 - mkdirp: 0.5.6 - object-assign: 4.1.1 type-is: 1.6.18 - xtend: 4.0.2 multibase@4.0.6: dependencies: @@ -11103,7 +11069,7 @@ snapshots: aws-ssl-profiles: 1.1.2 denque: 2.1.0 generate-function: 2.3.1 - iconv-lite: 0.7.2 + iconv-lite: 0.7.3 long: 5.3.2 lru.min: 1.1.4 named-placeholders: 1.1.6 @@ -11149,7 +11115,7 @@ snapshots: node-emoji@1.11.0: dependencies: - lodash: 4.17.21 + lodash: 4.18.1 node-fetch@2.7.0: dependencies: @@ -11332,7 +11298,7 @@ snapshots: passport-jwt@4.0.1: dependencies: - jsonwebtoken: 9.0.2 + jsonwebtoken: 9.0.0 passport-strategy: 1.0.0 passport-strategy@1.0.0: {} @@ -11374,11 +11340,11 @@ snapshots: lru-cache: 11.2.2 minipass: 7.1.2 - path-to-regexp@0.1.12: {} + path-to-regexp@0.1.13: {} path-to-regexp@3.3.0: {} - path-to-regexp@8.3.0: {} + path-to-regexp@8.4.2: {} path-type@4.0.0: {} @@ -11432,6 +11398,8 @@ snapshots: picomatch@2.3.1: {} + picomatch@2.3.2: {} + picomatch@4.0.1: {} picomatch@4.0.3: {} @@ -11603,7 +11571,7 @@ snapshots: forwarded: 0.2.0 ipaddr.js: 1.9.1 - proxy-from-env@1.1.0: {} + proxy-from-env@2.1.0: {} psl@1.15.0: dependencies: @@ -11738,7 +11706,7 @@ snapshots: performance-now: 2.1.0 qs: 6.5.3 safe-buffer: 5.2.1 - tough-cookie: 2.5.0 + tough-cookie: 4.1.3 tunnel-agent: 0.6.0 uuid: 3.4.0 @@ -11826,7 +11794,7 @@ snapshots: depd: 2.0.0 is-promise: 4.0.0 parseurl: 1.3.3 - path-to-regexp: 8.3.0 + path-to-regexp: 8.4.2 transitivePeerDependencies: - supports-color @@ -11883,6 +11851,8 @@ snapshots: semver@7.7.4: {} + semver@7.8.5: {} + send@0.19.0: dependencies: debug: 2.6.9 @@ -11971,36 +11941,34 @@ snapshots: shallow-clone-shim@2.0.0: {} - sharp@0.34.5: + sharp@0.35.3(@types/node@22.19.2): dependencies: - '@img/colour': 1.0.0 + '@img/colour': 1.1.0 detect-libc: 2.1.2 - semver: 7.7.4 + semver: 7.8.5 optionalDependencies: - '@img/sharp-darwin-arm64': 0.34.5 - '@img/sharp-darwin-x64': 0.34.5 - '@img/sharp-libvips-darwin-arm64': 1.2.4 - '@img/sharp-libvips-darwin-x64': 1.2.4 - '@img/sharp-libvips-linux-arm': 1.2.4 - '@img/sharp-libvips-linux-arm64': 1.2.4 - '@img/sharp-libvips-linux-ppc64': 1.2.4 - '@img/sharp-libvips-linux-riscv64': 1.2.4 - '@img/sharp-libvips-linux-s390x': 1.2.4 - '@img/sharp-libvips-linux-x64': 1.2.4 - '@img/sharp-libvips-linuxmusl-arm64': 1.2.4 - '@img/sharp-libvips-linuxmusl-x64': 1.2.4 - '@img/sharp-linux-arm': 0.34.5 - '@img/sharp-linux-arm64': 0.34.5 - '@img/sharp-linux-ppc64': 0.34.5 - '@img/sharp-linux-riscv64': 0.34.5 - '@img/sharp-linux-s390x': 0.34.5 - '@img/sharp-linux-x64': 0.34.5 - '@img/sharp-linuxmusl-arm64': 0.34.5 - '@img/sharp-linuxmusl-x64': 0.34.5 - '@img/sharp-wasm32': 0.34.5 - '@img/sharp-win32-arm64': 0.34.5 - '@img/sharp-win32-ia32': 0.34.5 - '@img/sharp-win32-x64': 0.34.5 + '@img/sharp-darwin-arm64': 0.35.3 + '@img/sharp-darwin-x64': 0.35.3 + '@img/sharp-freebsd-wasm32': 0.35.3 + '@img/sharp-libvips-darwin-arm64': 1.3.2 + '@img/sharp-libvips-darwin-x64': 1.3.2 + '@img/sharp-libvips-linux-arm': 1.3.2 + '@img/sharp-libvips-linux-arm64': 1.3.2 + '@img/sharp-libvips-linux-ppc64': 1.3.2 + '@img/sharp-libvips-linux-riscv64': 1.3.2 + '@img/sharp-libvips-linux-s390x': 1.3.2 + '@img/sharp-libvips-linux-x64': 1.3.2 + '@img/sharp-linux-arm': 0.35.3 + '@img/sharp-linux-arm64': 0.35.3 + '@img/sharp-linux-ppc64': 0.35.3 + '@img/sharp-linux-riscv64': 0.35.3 + '@img/sharp-linux-s390x': 0.35.3 + '@img/sharp-linux-x64': 0.35.3 + '@img/sharp-webcontainers-wasm32': 0.35.3 + '@img/sharp-win32-arm64': 0.35.3 + '@img/sharp-win32-ia32': 0.35.3 + '@img/sharp-win32-x64': 0.35.3 + '@types/node': 22.19.2 shebang-command@2.0.0: dependencies: @@ -12088,8 +12056,6 @@ snapshots: dependencies: tslib: 2.8.1 - sprintf-js@1.0.3: {} - sql-summary@1.0.1: {} sqlstring@2.3.3: @@ -12182,7 +12148,7 @@ snapshots: graphql: 16.11.0 iterall: 1.3.0 symbol-observable: 1.2.0 - ws: 7.5.10 + ws: 7.5.13 transitivePeerDependencies: - bufferutil - utf-8-validate @@ -12193,7 +12159,7 @@ snapshots: cookiejar: 2.1.4 debug: 4.4.3 fast-safe-stringify: 2.1.1 - form-data: 4.0.5 + form-data: 4.0.6 formidable: 3.5.4 methods: 1.1.2 mime: 2.6.0 @@ -12300,12 +12266,6 @@ snapshots: dependencies: tslib: 2.8.1 - tldts-core@7.0.19: {} - - tldts@7.0.19: - dependencies: - tldts-core: 7.0.19 - tmp@0.0.33: dependencies: os-tmpdir: 1.0.2 @@ -12334,14 +12294,12 @@ snapshots: '@tokenizer/token': 0.3.0 ieee754: 1.2.1 - tough-cookie@2.5.0: + tough-cookie@4.1.3: dependencies: psl: 1.15.0 punycode: 2.3.1 - - tough-cookie@6.0.0: - dependencies: - tldts: 7.0.19 + universalify: 0.2.0 + url-parse: 1.5.10 tr46@0.0.3: {} @@ -12424,7 +12382,7 @@ snapshots: typedarray@0.0.6: {} - typeorm@https://pkg.pr.new/antst/typeorm@2c8f380(ioredis@5.10.1)(mysql2@3.15.1)(pg@8.16.3)(redis@3.1.2)(ts-node@10.9.2(@swc/core@1.15.8(@swc/helpers@0.5.17))(@types/node@22.19.2)(@typescript/typescript6@6.0.2)): + typeorm@https://pkg.pr.new/antst/typeorm@2c8f380(patch_hash=900fefc861876e5a2e5379bc9477be4434233cdbad5d3043cf8c810b26cc80a4)(ioredis@5.10.1)(mysql2@3.15.1)(pg@8.16.3)(redis@3.1.2)(ts-node@10.9.2(@swc/core@1.15.8(@swc/helpers@0.5.17))(@types/node@22.19.2)(@typescript/typescript6@6.0.2)): dependencies: '@sqltools/formatter': 1.2.5 app-root-path: 3.1.0 @@ -12434,7 +12392,7 @@ snapshots: debug: 4.4.3 dotenv: 16.4.5 glob: 8.1.0 - js-yaml: 4.1.0 + js-yaml: 4.3.0 mkdirp: 2.1.6 reflect-metadata: 0.1.14 sha.js: 2.4.12 @@ -12506,7 +12464,7 @@ snapshots: undici-types@7.12.0: {} - undici@6.21.3: {} + undici@6.27.0: {} unicode-byte-truncate@1.0.0: dependencies: @@ -12515,6 +12473,8 @@ snapshots: unicode-substring@0.1.0: {} + universalify@0.2.0: {} + universalify@2.0.1: {} unpipe@1.0.0: {} @@ -12578,7 +12538,7 @@ snapshots: v8-compile-cache-lib@3.0.1: {} - validator@13.15.15: {} + validator@13.15.35: {} value-or-promise@1.0.12: {} @@ -12821,11 +12781,9 @@ snapshots: wrappy@1.0.2: {} - ws@7.5.10: {} - - ws@8.18.0: {} + ws@7.5.13: {} - ws@8.19.0: {} + ws@8.21.1: {} xml-name-validator@5.0.0: {} diff --git a/src/config/typeorm.cli.config.run.spec.ts b/src/config/typeorm.cli.config.run.spec.ts index 2af8d311e3..c4a7f63990 100644 --- a/src/config/typeorm.cli.config.run.spec.ts +++ b/src/config/typeorm.cli.config.run.spec.ts @@ -1,3 +1,6 @@ +import { readdirSync, readFileSync } from 'fs'; +import { join } from 'path'; + describe('typeormCliConfig (run)', () => { it('should export a valid DataSourceOptions object', async () => { const mod = await import('./typeorm.cli.config.run'); @@ -16,4 +19,46 @@ describe('typeormCliConfig (run)', () => { expect(config.entities).toBeUndefined(); }); + + it('should resolve the migrations glob relative to __dirname (not CWD) so it works under ts-node (src/) and compiled (dist/) execution', async () => { + const mod = await import('./typeorm.cli.config.run'); + const config = mod.typeormCliConfig as any; + + expect(Array.isArray(config.migrations)).toBe(true); + const [migrationsGlob] = config.migrations as string[]; + // __dirname here resolves to this test file's own directory (src/config, + // whether run via ts-node or compiled to dist/config) — the glob must be + // anchored one level up in `migrations`, not in the process CWD. + expect(migrationsGlob).toBe( + join(__dirname, '..', 'migrations', '*.{ts,js}') + ); + // Anchored to this module's own directory (whatever it is — src/config + // under ts-node, dist/config compiled), not a fixed 'src/migrations' + // string relative to the process CWD. + expect(migrationsGlob.endsWith(join('migrations', '*.{ts,js}'))).toBe(true); + }); + + it('mechanical guard: every migration file imports only typeorm and node builtins (no path-aliased imports, which would break the plain-Node compiled CLI path)', () => { + const migrationsDir = join(__dirname, '..', 'migrations'); + const migrationFiles = readdirSync(migrationsDir).filter(f => + f.endsWith('.ts') + ); + expect(migrationFiles.length).toBeGreaterThan(0); + + const allowedImportPattern = /^(typeorm|node:|crypto$)/; + const importLineRegex = /^import\s+[^'"]*from\s+['"]([^'"]+)['"];?/gm; + + const offenders: string[] = []; + for (const file of migrationFiles) { + const content = readFileSync(join(migrationsDir, file), 'utf-8'); + for (const match of content.matchAll(importLineRegex)) { + const specifier = match[1]; + if (!allowedImportPattern.test(specifier)) { + offenders.push(`${file}: ${specifier}`); + } + } + } + + expect(offenders).toEqual([]); + }); }); diff --git a/src/config/typeorm.cli.config.run.ts b/src/config/typeorm.cli.config.run.ts index be91500fe5..1d339655f7 100644 --- a/src/config/typeorm.cli.config.run.ts +++ b/src/config/typeorm.cli.config.run.ts @@ -4,12 +4,19 @@ import { DataSourceOptions } from 'typeorm'; dotenv.config(); +// __dirname-relative (not CWD-relative) so this identical config resolves +// migrations correctly under both execution modes: +// - ts-node from sources: src/config/typeorm.cli.config.run.ts -> src/migrations/*.ts +// - compiled (distroless): dist/config/typeorm.cli.config.run.js -> dist/migrations/*.js +// A CWD-relative glob would silently match zero files when run from a +// distroless image's WORKDIR with a compiled dist/ tree (see spec 026 edge case +// "Migration glob duality"). const commonConfig = { cache: true, synchronize: false, logger: 'advanced-console' as const, logging: process.env.ENABLE_ORM_LOGGING === 'true', - migrations: [join('src', 'migrations', '*.{ts,js}')], + migrations: [join(__dirname, '..', 'migrations', '*.{ts,js}')], migrationsTableName: 'migrations_typeorm', migrationsRun: true, }; diff --git a/src/domain/access/role-set/role.set.resolver.mutations.membership.spec.ts b/src/domain/access/role-set/role.set.resolver.mutations.membership.spec.ts index e7f0ee7077..7cf06bf94b 100644 --- a/src/domain/access/role-set/role.set.resolver.mutations.membership.spec.ts +++ b/src/domain/access/role-set/role.set.resolver.mutations.membership.spec.ts @@ -1,5 +1,4 @@ import { CommunityMembershipStatus } from '@common/enums/community.membership.status'; -import { RoleName } from '@common/enums/role.name'; import { RoleSetInvitationResultType } from '@common/enums/role.set.invitation.result.type'; import { RoleSetType } from '@common/enums/role.set.type'; import { ValidationException } from '@common/exceptions';