From fcbfe8316744900b122919cad794b4d50781a62d Mon Sep 17 00:00:00 2001 From: Jeff Huleatt <3759507+jhuleatt@users.noreply.github.com> Date: Wed, 29 Jul 2026 18:29:40 +0000 Subject: [PATCH 1/8] Use Google npm service for auth step --- .github/workflows/test.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 1d76cd68..02641d7e 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -112,7 +112,7 @@ jobs: uses: actions/setup-node@v4 with: node-version: '24' - registry-url: 'https://registry.npmjs.org' + registry-url: 'https://wombat-dressing-room.appspot.com' - name: 'Download Artifacts' uses: actions/download-artifact@v4 - name: Publish From 1650c89097995fcfcc48d5a57f4b441631a3a6e8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 31 Jul 2026 12:43:24 -0700 Subject: [PATCH 2/8] Bump re2 from 1.25.0 to 1.26.1 (#768) Bumps [re2](https://github.com/uhop/node-re2) from 1.25.0 to 1.26.1. - [Release notes](https://github.com/uhop/node-re2/releases) - [Commits](https://github.com/uhop/node-re2/compare/1.25.0...1.26.1) --- updated-dependencies: - dependency-name: re2 dependency-version: 1.26.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 39 ++++++++++++++++++++++----------------- 1 file changed, 22 insertions(+), 17 deletions(-) diff --git a/package-lock.json b/package-lock.json index 845fbc18..3e76a07e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9327,18 +9327,23 @@ } }, "node_modules/install-artifact-from-github": { - "version": "1.6.0", - "resolved": "https://registry.npmjs.org/install-artifact-from-github/-/install-artifact-from-github-1.6.0.tgz", - "integrity": "sha512-wKsuzN8fy8QK7iEUqyWTQmvZ1QFGPn1xyl3/1iIIDthDjS7Hn9HoPwHlNakZirWbCsbad0lZMkr6Xfbpe1pUzw==", + "version": "1.7.0", + "resolved": "https://registry.npmjs.org/install-artifact-from-github/-/install-artifact-from-github-1.7.0.tgz", + "integrity": "sha512-qAb91yAKVF9rFY4rVP21ZtYUyCScxAFt9udwzVWNLBE1pQcdQeB2gd1HlNPcQNYCzCDvJ/QJQPuWQ6aTmSlU8g==", "dev": true, "license": "BSD-3-Clause", "optional": true, "bin": { + "hash-github-cache": "bin/hash-github-cache.js", "install-from-cache": "bin/install-from-cache.js", "save-to-github-cache": "bin/save-to-github-cache.js" }, "engines": { "node": ">=18" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/uhop" } }, "node_modules/internal-slot": { @@ -11858,9 +11863,9 @@ } }, "node_modules/node-gyp": { - "version": "13.0.0", - "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-13.0.0.tgz", - "integrity": "sha512-FYYyBDWdc+kzoyPd5PqHUgM9DGs1C/Z4jxBZAOnA2GRUVXPivKRREq5q+VVPXVr9aGVqGMaMqyFHbviy/yb7Hg==", + "version": "13.0.1", + "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-13.0.1.tgz", + "integrity": "sha512-piOr0S10qy5THB+q5BdqkoOx65XL/tjTMUAit3vciPNp+snTOBnGunWH1Rz7XZUxf2T9uFrfT/Ty4+aC3yPeyg==", "dev": true, "license": "MIT", "optional": true, @@ -11873,7 +11878,7 @@ "semver": "^7.3.5", "tar": "^7.5.4", "tinyglobby": "^0.2.12", - "undici": "^6.25.0", + "undici": "^8.4.1", "which": "^7.0.0" }, "bin": { @@ -13162,17 +13167,17 @@ } }, "node_modules/re2": { - "version": "1.25.0", - "resolved": "https://registry.npmjs.org/re2/-/re2-1.25.0.tgz", - "integrity": "sha512-mtxKjWS+VYIt2ijgt6ohEdwzNlGPom1whyaEKJD40cBc/wqkO1vJoOyK539Qb8Xa9m4GA6hiPGDIbW/d3egSRQ==", + "version": "1.26.1", + "resolved": "https://registry.npmjs.org/re2/-/re2-1.26.1.tgz", + "integrity": "sha512-oi79a4h6EO3PAwNsDMWgeCcsRGQEUa52DIgOiFTZGDEZocEXG9h+oXy0qZqndo47huUeJuVWSoOJIEhOupqOcg==", "dev": true, "hasInstallScript": true, "license": "BSD-3-Clause", "optional": true, "dependencies": { - "install-artifact-from-github": "^1.6.0", - "nan": "^2.27.0", - "node-gyp": "^13.0.0" + "install-artifact-from-github": "^1.7.0", + "nan": "^2.28.0", + "node-gyp": "^13.0.1" }, "engines": { "node": "^22.22.2 || ^24.15.0 || >=26.0.0" @@ -15433,14 +15438,14 @@ } }, "node_modules/undici": { - "version": "6.27.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz", - "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==", + "version": "8.9.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-8.9.0.tgz", + "integrity": "sha512-aWZpUj7XoGonMClx4gdDRfgBjqeA+F473aDmROQQbM9n6PRfK/u1q/a0X4wMTgcHfT8H6fpbt98PFuDUwFg2YA==", "dev": true, "license": "MIT", "optional": true, "engines": { - "node": ">=18.17" + "node": ">=22.19.0" } }, "node_modules/undici-types": { From 72d66b974978892fd289cac303dec372f7ba0719 Mon Sep 17 00:00:00 2001 From: Tyler Reitz Date: Tue, 4 Aug 2026 10:26:37 -0700 Subject: [PATCH 3/8] ci: harden test.yaml and docs.yaml for zizmor (#767) Split out of #766 at Jeff's request, so that PR can stay focused on the release checks. This is a pre-existing, repo-wide condition rather than anything the gate introduced: the zizmor scan only runs when a workflow file changes, so it fires against whatever state the file was already in. Both workflows, since he asked for docs.yaml too: - **All 14 action references pinned to commit SHAs**, with the resolved release in a trailing comment so versions stay legible and Dependabot can still bump them. Clears `unpinned-uses`, the only mandatory audit. - **Top-level `permissions: contents: read`.** Neither workflow writes to the repo through GITHUB_TOKEN; the publish job authenticates to npm separately, now via the Google npm service. Clears `excessive-permissions`. - **`persist-credentials: false` on all four checkouts.** The token is not needed after the clone, and leaving it in .git/config exposes it to every later step. Clears `artipacked`. Result, measured with the version CI pins (1.25.2): test.yaml 8 medium, 17 high -> 0 medium, 5 high docs.yaml 2 medium, 2 high -> no findings at all CI fails on Medium or higher, so partial fixes would not have cleared it. The 5 remaining findings on test.yaml are all `cache-poisoning`, which the org scan suppresses; fixing those means restructuring how the workflow caches around the publish path and does not belong here. No functional change to any job. Verified that main's switch of the publish registry to wombat-dressing-room is preserved. --- .github/workflows/docs.yaml | 11 +++++++++-- .github/workflows/test.yaml | 35 +++++++++++++++++++++++------------ 2 files changed, 32 insertions(+), 14 deletions(-) diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 8c663e98..ad806bea 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -3,15 +3,22 @@ name: Check if Reference Docs need to be regenerated on: pull_request +# Least privilege. This workflow only regenerates docs and diffs them; it never +# pushes. +permissions: + contents: read + jobs: docs: runs-on: ubuntu-latest name: Build steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + persist-credentials: false - name: Setup node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '24' cache: 'npm' diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 02641d7e..d4158b35 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -13,15 +13,22 @@ on: types: - published +# Least privilege by default. No job writes to the repo through GITHUB_TOKEN; +# the publish job authenticates to npm with NODE_AUTH_TOKEN. +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest name: Build steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + persist-credentials: false - name: Setup node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '24' cache: 'npm' @@ -31,7 +38,7 @@ jobs: id: pack-dir run: ./build.sh - name: 'Upload Artifact' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: reactfire-${{ github.run_id }} path: | @@ -49,9 +56,11 @@ jobs: name: Test Node.js ${{ matrix.node }} (Ubuntu) steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + persist-credentials: false - name: Setup node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node }} check-latest: true @@ -59,7 +68,7 @@ jobs: - name: Install deps run: npm ci - name: Setup Java - uses: actions/setup-java@v4 + uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0 with: distribution: 'temurin' java-version: '21' @@ -67,12 +76,12 @@ jobs: run: npm install working-directory: ./functions - name: Firebase emulator cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ~/.cache/firebase/emulators key: firebase_emulators - name: 'Download Artifacts' - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 - name: Expand Artifact run: | chmod +x reactfire-${{ github.run_id }}/unpack.sh @@ -88,9 +97,11 @@ jobs: name: Type check (React ${{ matrix.react }}) steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + persist-credentials: false - name: Setup node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '24' cache: 'npm' @@ -109,12 +120,12 @@ jobs: if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'release' }} steps: - name: Setup node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '24' registry-url: 'https://wombat-dressing-room.appspot.com' - name: 'Download Artifacts' - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 - name: Publish run: | cd ./reactfire-${{ github.run_id }}/ From f7d3132a121992c833f233c4421d275e1db2934f Mon Sep 17 00:00:00 2001 From: Tyler Reitz Date: Tue, 4 Aug 2026 10:26:51 -0700 Subject: [PATCH 4/8] fix(types): use explicit .js extensions in relative imports (#770) The emitted .d.ts inherited source's extensionless relative specifiers (`from './useObservable'`, and `from '.'` in two files), which node16 and nodenext resolution reject. Consumers on those settings hit resolution errors reading our declarations, while the runtime bundles were fine, so nothing in the build surfaced it. `moduleResolution: bundler` accepts both forms in source, so this is a no-op for the build and for bundler consumers. Verified with @arethetypeswrong/cli against the packed build, with no ignore rules: before node16 (from ESM) internal resolution error after node16 (from ESM) pass node16 (from CJS) still reports "no types" on this branch; that is the missing `types` export condition, fixed separately in #766. With both changes applied, all four resolution modes pass with no suppression. Fixes #769. --- src/SuspenseSubject.ts | 2 +- src/auth.tsx | 4 ++-- src/database.tsx | 2 +- src/firestore.tsx | 4 ++-- src/functions.tsx | 4 ++-- src/index.ts | 22 +++++++++++----------- src/remote-config.tsx | 4 ++-- src/sdk.tsx | 6 +++--- src/storage.tsx | 4 ++-- src/useObservable.ts | 6 +++--- 10 files changed, 29 insertions(+), 29 deletions(-) diff --git a/src/SuspenseSubject.ts b/src/SuspenseSubject.ts index 0c52b9b5..5b7ef884 100644 --- a/src/SuspenseSubject.ts +++ b/src/SuspenseSubject.ts @@ -1,6 +1,6 @@ import { empty, Observable, Subject, Subscriber, Subscription } from 'rxjs'; import { catchError, shareReplay, tap } from 'rxjs/operators'; -import { ObservableStatus } from './useObservable'; +import { ObservableStatus } from './useObservable.js'; export class SuspenseSubject extends Subject { private _value: T | undefined; diff --git a/src/auth.tsx b/src/auth.tsx index 9fba1a46..6e74d6c5 100644 --- a/src/auth.tsx +++ b/src/auth.tsx @@ -1,9 +1,9 @@ import * as React from 'react'; import { user } from 'rxfire/auth'; -import { preloadObservable, ReactFireOptions, useAuth, useObservable, ObservableStatus, ReactFireError } from './'; +import { preloadObservable, ReactFireOptions, useAuth, useObservable, ObservableStatus, ReactFireError } from './index.js'; import { from, of, defer } from 'rxjs'; import { map, switchMap } from 'rxjs/operators'; -import { useSuspenseEnabledFromConfigAndContext } from './firebaseApp'; +import { useSuspenseEnabledFromConfigAndContext } from './firebaseApp.js'; import type { Auth, User, IdTokenResult } from 'firebase/auth'; type Claims = IdTokenResult['claims']; diff --git a/src/database.tsx b/src/database.tsx index 3cfa9224..5c5f998c 100644 --- a/src/database.tsx +++ b/src/database.tsx @@ -1,5 +1,5 @@ import { list, object, QueryChange, listVal, objectVal } from 'rxfire/database'; -import { ReactFireOptions, useObservable, checkIdField, ObservableStatus, ReactFireGlobals } from './'; +import { ReactFireOptions, useObservable, checkIdField, ObservableStatus, ReactFireGlobals } from './index.js'; import type { Query as DatabaseQuery, DatabaseReference } from 'firebase/database'; diff --git a/src/firestore.tsx b/src/firestore.tsx index d5efa8bd..ed504f97 100644 --- a/src/firestore.tsx +++ b/src/firestore.tsx @@ -1,6 +1,6 @@ import { collectionData, doc, docData, fromRef } from 'rxfire/firestore'; -import { ReactFireOptions, useObservable, checkIdField, ReactFireGlobals } from './'; -import { preloadObservable, ObservableStatus } from './useObservable'; +import { ReactFireOptions, useObservable, checkIdField, ReactFireGlobals } from './index.js'; +import { preloadObservable, ObservableStatus } from './useObservable.js'; import { first } from 'rxjs/operators'; import { Query as FirestoreQuery, QuerySnapshot, DocumentReference, queryEqual, DocumentData, DocumentSnapshot } from 'firebase/firestore'; diff --git a/src/functions.tsx b/src/functions.tsx index e9f1f34b..d30be15b 100644 --- a/src/functions.tsx +++ b/src/functions.tsx @@ -1,7 +1,7 @@ import { httpsCallable as rxHttpsCallable } from 'rxfire/functions'; import { defer } from 'rxjs'; -import { ReactFireOptions, useObservable, ObservableStatus } from './'; -import { useFunctions } from '.'; +import { ReactFireOptions, useObservable, ObservableStatus } from './index.js'; +import { useFunctions } from './index.js'; import type { HttpsCallableOptions } from 'firebase/functions'; diff --git a/src/index.ts b/src/index.ts index ab60a1fe..028a4a62 100644 --- a/src/index.ts +++ b/src/index.ts @@ -1,4 +1,4 @@ -import { SuspenseSubject } from './SuspenseSubject'; +import { SuspenseSubject } from './SuspenseSubject.js'; import type { Query as FirestoreQuery } from 'firebase/firestore'; import type { Query as DatabaseQuery } from 'firebase/database'; @@ -48,13 +48,13 @@ export function checkIdField(options: ReactFireOptions) { return checkOptions(options, 'idField'); } -export * from './auth'; -export * from './database'; -export * from './firebaseApp'; -export * from './firestore'; -export * from './functions'; -export * from './performance'; -export * from './remote-config'; -export * from './storage'; -export * from './useObservable'; -export * from './sdk'; +export * from './auth.js'; +export * from './database.js'; +export * from './firebaseApp.js'; +export * from './firestore.js'; +export * from './functions.js'; +export * from './performance.js'; +export * from './remote-config.js'; +export * from './storage.js'; +export * from './useObservable.js'; +export * from './sdk.js'; diff --git a/src/remote-config.tsx b/src/remote-config.tsx index 97376fb8..83b398a0 100644 --- a/src/remote-config.tsx +++ b/src/remote-config.tsx @@ -1,5 +1,5 @@ -import { useRemoteConfig } from './'; -import { useObservable, ObservableStatus } from './useObservable'; +import { useRemoteConfig } from './index.js'; +import { useObservable, ObservableStatus } from './useObservable.js'; import { getValue, getString, getBoolean, getNumber, getAll, AllParameters } from 'rxfire/remote-config'; import { Observable } from 'rxjs'; diff --git a/src/sdk.tsx b/src/sdk.tsx index ee66ffff..c3238604 100644 --- a/src/sdk.tsx +++ b/src/sdk.tsx @@ -9,11 +9,11 @@ import type { Functions } from 'firebase/functions'; import type { FirebasePerformance } from 'firebase/performance'; import type { FirebaseStorage } from 'firebase/storage'; import type { RemoteConfig } from 'firebase/remote-config'; -import { useFirebaseApp } from './firebaseApp'; +import { useFirebaseApp } from './firebaseApp.js'; import { FirebaseApp } from 'firebase/app'; -import { ObservableStatus, useObservable } from './useObservable'; +import { ObservableStatus, useObservable } from './useObservable.js'; import { from } from 'rxjs'; -import { ReactFireOptions } from '.'; +import { ReactFireOptions } from './index.js'; export const AppCheckSdkContext = React.createContext(undefined); export const AuthSdkContext = React.createContext(undefined); diff --git a/src/storage.tsx b/src/storage.tsx index 92f27a51..6bb1ccb3 100644 --- a/src/storage.tsx +++ b/src/storage.tsx @@ -1,8 +1,8 @@ import * as React from 'react'; import { getDownloadURL, fromTask } from 'rxfire/storage'; import { defer } from 'rxjs'; -import { ReactFireOptions, useObservable, ObservableStatus, useStorage } from './'; -import { useSuspenseEnabledFromConfigAndContext } from './firebaseApp'; +import { ReactFireOptions, useObservable, ObservableStatus, useStorage } from './index.js'; +import { useSuspenseEnabledFromConfigAndContext } from './firebaseApp.js'; import { ref } from 'firebase/storage'; import type { UploadTask, UploadTaskSnapshot, StorageReference, FirebaseStorage } from 'firebase/storage'; diff --git a/src/useObservable.ts b/src/useObservable.ts index 9e6173a8..f66a5522 100644 --- a/src/useObservable.ts +++ b/src/useObservable.ts @@ -1,9 +1,9 @@ import * as React from 'react'; import { useSyncExternalStore } from 'use-sync-external-store/shim'; import { Observable } from 'rxjs'; -import { SuspenseSubject } from './SuspenseSubject'; -import { useSuspenseEnabledFromConfigAndContext } from './firebaseApp'; -import { ReactFireGlobals, ReactFireOptions } from './'; +import { SuspenseSubject } from './SuspenseSubject.js'; +import { useSuspenseEnabledFromConfigAndContext } from './firebaseApp.js'; +import { ReactFireGlobals, ReactFireOptions } from './index.js'; const DEFAULT_TIMEOUT = 30_000; From 81b1fc8225f46ba8eb3aed6a162b9b9c556025f5 Mon Sep 17 00:00:00 2001 From: Tyler Reitz Date: Tue, 4 Aug 2026 10:27:03 -0700 Subject: [PATCH 5/8] chore: gitignore CLAUDE.local files (#771) `v5` already ignores these (line 1 of its .gitignore); `main` does not. The asymmetry means a local CLAUDE.local.md is untracked-but-unignored on any main-based branch, so it shows up in `git status` and a `git clean` deletes it. Matching v5 exactly keeps forward-integration a no-op. --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index df34806e..b2ebc657 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ +CLAUDE.local* .DS_Store npm-debug.log From 4596268dd875b586ce1126bf0545acacf4068888 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 10:30:38 -0700 Subject: [PATCH 6/8] Bump ip-address from 10.2.0 to 10.4.0 (#772) Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.2.0 to 10.4.0. - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.4.0) --- updated-dependencies: - dependency-name: ip-address dependency-version: 10.4.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 3e76a07e..a6f696ac 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9361,9 +9361,9 @@ } }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.4.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz", + "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==", "dev": true, "license": "MIT", "engines": { From 215afa3027935b7b7c6eca97bbbf9e00a0afb758 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 11:03:19 -0700 Subject: [PATCH 7/8] Bump fast-uri from 3.1.4 to 3.1.5 (#773) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.4...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index a6f696ac..be8bb8ad 100644 --- a/package-lock.json +++ b/package-lock.json @@ -7506,9 +7506,9 @@ "dev": true }, "node_modules/fast-uri": { - "version": "3.1.4", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", - "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", + "version": "3.1.5", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", + "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", "dev": true, "funding": [ { From d5e0ee408a308aae57cf1cb2a92c97b4632a3a72 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 11:03:45 -0700 Subject: [PATCH 8/8] Bump postcss from 8.5.15 to 8.5.25 (#774) Bumps [postcss](https://github.com/postcss/postcss) from 8.5.15 to 8.5.25. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.15...8.5.25) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.25 dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/package-lock.json b/package-lock.json index be8bb8ad..5e7c64cb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11695,9 +11695,9 @@ "optional": true }, "node_modules/nanoid": { - "version": "3.3.12", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz", - "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==", + "version": "3.3.17", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz", + "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==", "dev": true, "funding": [ { @@ -12681,9 +12681,9 @@ } }, "node_modules/postcss": { - "version": "8.5.15", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz", - "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==", + "version": "8.5.25", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz", + "integrity": "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==", "dev": true, "funding": [ { @@ -12701,7 +12701,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.12", + "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" },