mirror of
https://github.com/Heretek-AI/GDevelop-Heretek.git
synced 2026-10-11 21:09:52 +00:00
ci: fix fallow SARIF upload, upstream-sync token dead end, guard coverage; refresh vuln docs (#124)
* ci: fix fallow SARIF, upstream-sync token dead end, guard coverage; refresh vuln docs
Four independent defects found while reviewing the open Dependabot queue.
fallow.yml
- `--format` and `--output` are the SAME option (`--output` is a documented
alias of `--format`), so `--format sarif --output fallow.sarif` aborted with
"the argument '--format <FORMAT>' cannot be used multiple times" and never
wrote the file. The following `upload-sarif` step then failed with
"Path does not exist: fallow.sarif", reddening `Fallow full scan` on master
and on every PR. Use `--output-file` for the path.
- Pin the CLI to 3.27.0. A bare `npx fallow` resolves the `latest` dist-tag at
run time and was observed returning 3.3.0 on one run and 3.27.0 on another,
so the full scan could silently disagree with the `audit` job (which pins
3.27.0 through the action's `version:` input).
upstream-sync.yml
- Org policy forces a read-only GITHUB_TOKEN and no SYNC_PAT secret exists, so
`gh pr create` can never succeed ("Resource not accessible by integration")
and the run failed with exit 1 every day. The branch is already pushed by
that point, so degrade to a warning plus a ready-to-click compare URL in the
step summary instead of failing.
check-lockfiles.js
- `newIDE/visual-tests/package-lock.json` existed on disk but was absent from
the guard's list (10 lockfiles, 9 guarded). Added.
dependabot.yml
- Drop the `ignore:` block pinning electron to 32.x. Both manifests are now on
the current release line (newIDE/electron-app 44.4.3, GDJS/Runtime/Electron
44.3.0), so the block only suppressed legitimate updates.
- `exclude-patterns` on the newIDE/app weekly group: for 0.x packages a
"minor" bump is breaking by semver convention, so the group silently carried
migrations like three 0.160->0.186 and spine-pixi-v7 4.2->4.3 alongside real
patch bumps. One such group PR grew into a 19-package migration.
- Raise newIDE/app's `open-pull-requests-limit` 5 -> 10; 6 PRs are already
open there, so new ones were being suppressed at the source.
KNOWN_VULNS.md
- Rewritten against the live API and the manifests. The previous revision
claimed the fork stays on electron 32.x with 47 advisories (it is on 44.4.3),
and that all non-electron vulnerabilities were remediated (the API reports
49 open alerts: 22 high, 25 medium, 2 low, across 18 packages).
- Documented two guard gaps: the `tar` floor (`< 6.2.1`) is bypassed by the
guard's same-major rule while advisories cover `<= 7.5.17`, and
newIDE/visual-tests was unguarded.
- Recorded the four no-patch advisories as accepted risk.
DEPENDABOT_PR_REMEDIATION_PLAN.md
- Full review of the 32 open PRs: 6 root causes, all reproduced locally, with
fixes verified before being proposed.
* fix(deps): repair three lockfiles already desynced on master; gate lockfile sync in CI
`npm ci` hard-fails when package.json and package-lock.json disagree, but CI
only installed the directories some later job happened to need. Three lockfiles
had rotted on master without anything noticing:
GDJS 16 missing packages (@pixi/* 7.4.3)
newIDE/electron-app/app 6 missing + 3 invalid (electron 44.4.3, @electron/get)
SharedLibs/TileMapHelper 36 missing + 2 invalid (@webassemblyjs/*, terser)
Each only failed the moment someone tried to install in that directory — which
is how the GDJS one stayed invisible while PR #121 was being reviewed for an
unrelated reason.
Regenerated all three with `npm install --package-lock-only`. All ten manifests
now install clean under `npm ci --dry-run`:
GDevelop.js GDJS GDJS/tests newIDE/app newIDE/electron-app
newIDE/electron-app/app newIDE/web-app newIDE/visual-tests
SharedLibs/TileMapHelper SharedLibs/ThreeAddons -> rc=0, 0 sync errors
Added a `lockfile-sync` matrix job over all ten directories so drift fails on
the PR that causes it. `--ignore-scripts` keeps postinstall hooks
(patch-package, import-resources) out of it — the job only asserts that the
lockfile resolves.
`node scripts/security/check-lockfiles.js` still exits 0.
* fix(deps): bump adm-zip 0.6.0 -> 0.6.1, closing 2 high advisories
`[email protected]` is vulnerable to GHSA-7q85-xj36-vmfc (high, patched in 0.6.1).
It is a *direct* dependency declared as `^0.6.0` in both manifests, so 0.6.1 was
already permitted — the lockfiles were simply pinned at the vulnerable 0.6.0 and
never re-resolved.
Verified the overrides already present in both manifests (`^0.6.0`) are harmless
here: a fresh resolution with or without them yields 0.6.1. Raising the override
to `^0.6.1` is NOT the fix — npm rejects it with EOVERRIDE because the override
would conflict with the direct dependency. Regenerating is the correct fix.
newIDE/app/package-lock.json adm-zip 0.6.0 -> 0.6.1
newIDE/electron-app/package-lock.json adm-zip 0.6.0 -> 0.6.1
Closes 2 of the 22 open high-severity alerts. The remaining `adm-zip` medium
advisory (GHSA-vwc7-r8mq-g2x9) has no patch and stays documented as accepted
risk in KNOWN_VULNS.md.
All ten manifests verified: `npm ci --dry-run` rc=0, 0 sync errors, and
`node scripts/security/check-lockfiles.js` exits 0.
* docs: record execution status for the PR remediation plan
Queue 32 -> 25 open; 8 merged. Adds the evidence used to justify each merge,
the repo fixes landed in PR #124, the three master lockfiles found already
desynced (GDJS, newIDE/electron-app/app, SharedLibs/TileMapHelper) and the
adm-zip 0.6.0 -> 0.6.1 bump that closed 2 high advisories.
Also records the rebase mechanics blocker: PRs 18/26/37/39/40/104 do not move
on '@dependabot rebase' because they were edited by hand; only #40 reports it.
* Merge master into chore/ci-remediation
Master advanced 10 merges (our own dependency PRs), so the lockfiles this
branch regenerated were stale against it. The merge reverted
newIDE/electron-app/package-lock.json to master's pre-regeneration copy;
regenerated it again (adm-zip stays 0.6.1).
All ten manifests verified in the merged state: npm ci --dry-run rc=0,
0 sync errors, guard exits 0.
* ci: run lockfile-sync as one job, not a 10-way matrix
Each matrix entry was a dry-run resolve taking a few seconds, so the 10-way
matrix bought ~30s of wall clock at the cost of 10 runners. The queue
contention that produced was starving the slower build-libgd and Jest jobs,
which dominate the workflow anyway.
Now a single job loops the same ten directories, continues past a failure so
one run reports every drifted manifest, and exits 1 at the end. Verified both
paths locally: on a good tree it prints "All lockfiles in sync." and exits 0;
with one drifted manifest it prints the per-directory ❌ with the npm
Missing:/Invalid: lines, keeps checking the rest, and exits 1.
This commit is contained in:
BillyOutlast
+15
-5
@@ -19,11 +19,25 @@ updates:
|
||||
schedule:
|
||||
interval: "weekly"
|
||||
day: "monday"
|
||||
open-pull-requests-limit: 5
|
||||
# 6 PRs are already open against this directory (the 5 limit plus the
|
||||
# grouped weekly-deps PR), so new ones are suppressed at the source.
|
||||
open-pull-requests-limit: 10
|
||||
groups:
|
||||
weekly-deps:
|
||||
patterns: ["*"]
|
||||
update-types: ["minor", "patch"]
|
||||
# For 0.x packages a "minor" bump is breaking by semver convention.
|
||||
# Without this, the group silently carries migrations like three
|
||||
# 0.160->0.186 and react-monaco-editor 0.18->0.59 alongside real
|
||||
# patch bumps, which is how one "weekly-deps" PR turned into a
|
||||
# 19-package migration.
|
||||
exclude-patterns:
|
||||
- "three"
|
||||
- "react-monaco-editor"
|
||||
- "flow-bin"
|
||||
- "flow-coverage-report"
|
||||
- "@esotericsoftware/spine-pixi-v7"
|
||||
- "@esotericsoftware/spine-core"
|
||||
|
||||
# newIDE/electron-app — desktop shell
|
||||
- package-ecosystem: "npm"
|
||||
@@ -36,10 +50,6 @@ updates:
|
||||
weekly-deps:
|
||||
patterns: ["*"]
|
||||
update-types: ["minor", "patch"]
|
||||
ignore:
|
||||
# Stay in 32.x until ready for native-rebuild risk. See KNOWN_VULNS.md.
|
||||
- dependency-name: "electron"
|
||||
update-types: ["version-update:semver-major", "version-update:semver-minor"]
|
||||
|
||||
# newIDE/electron-app/app — main process of the desktop app
|
||||
- package-ecosystem: "npm"
|
||||
|
||||
@@ -44,6 +44,68 @@ jobs:
|
||||
- name: Run guard
|
||||
run: node scripts/security/check-lockfiles.js
|
||||
|
||||
lockfile-sync:
|
||||
name: Lockfile sync (all manifests)
|
||||
# `npm ci` hard-fails when package.json and package-lock.json disagree, but
|
||||
# only the directories that a later job happens to install are ever checked.
|
||||
# That gap let THREE lockfiles rot on master unnoticed (GDJS,
|
||||
# newIDE/electron-app/app, SharedLibs/TileMapHelper) — each one only failed
|
||||
# the moment someone tried to install there. This job checks every manifest
|
||||
# so drift surfaces on the PR that causes it.
|
||||
#
|
||||
# Runs as one job over all directories rather than a 10-way matrix: each
|
||||
# entry is a dry-run resolve taking a few seconds, so a matrix costs 10
|
||||
# runners to save ~30s of wall clock, and the queue contention starves the
|
||||
# slower build/test jobs.
|
||||
#
|
||||
# `--ignore-scripts` keeps postinstall hooks (patch-package,
|
||||
# import-resources) out of it: this job only asserts that the lockfile
|
||||
# resolves. All directories are checked even after a failure so one run
|
||||
# reports every drifted manifest.
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: "20"
|
||||
- name: Assert every lockfile is in sync with its package.json
|
||||
run: |
|
||||
set -uo pipefail
|
||||
dirs=(
|
||||
GDevelop.js
|
||||
GDJS
|
||||
GDJS/tests
|
||||
newIDE/app
|
||||
newIDE/electron-app
|
||||
newIDE/electron-app/app
|
||||
newIDE/web-app
|
||||
newIDE/visual-tests
|
||||
SharedLibs/TileMapHelper
|
||||
SharedLibs/ThreeAddons
|
||||
)
|
||||
failed=0
|
||||
for d in "${dirs[@]}"; do
|
||||
if [ ! -f "$d/package-lock.json" ]; then
|
||||
echo "::notice::$d has no lockfile; skipping"
|
||||
continue
|
||||
fi
|
||||
# `npm ci` writes its diagnostics to stdout, so capture both.
|
||||
if out=$(cd "$d" && npm ci --dry-run --no-audit --no-fund --ignore-scripts 2>&1); then
|
||||
echo "✅ $d"
|
||||
else
|
||||
echo "❌ $d"
|
||||
echo "$out" | grep -E 'Missing: |Invalid: |npm error code' | sed 's/^/ /' || true
|
||||
failed=1
|
||||
fi
|
||||
done
|
||||
if [ "$failed" -ne 0 ]; then
|
||||
echo "::error::One or more lockfiles are out of sync with package.json. Run 'npm install --package-lock-only' in the failing directory."
|
||||
exit 1
|
||||
fi
|
||||
echo "All lockfiles in sync."
|
||||
|
||||
build-libgd:
|
||||
name: Build libGD.js (Emscripten)
|
||||
# Slow step (~5–10 min on cold cache). Builds the C++ core via
|
||||
|
||||
@@ -55,7 +55,17 @@ jobs:
|
||||
node-version: "20"
|
||||
- name: Run fallow full scan
|
||||
continue-on-error: true
|
||||
run: npx fallow --format sarif --output fallow.sarif 2>&1 | tee fallow.log
|
||||
# Pin the CLI version explicitly. A bare `npx fallow` resolves the
|
||||
# `latest` dist-tag at run time, which has been observed to hand back
|
||||
# 3.3.0 on one run and 3.27.0 on another — so an unpinned full scan
|
||||
# can silently disagree with the `audit` job, which pins 3.27.0 via
|
||||
# the action's `version:` input (same npm version scheme).
|
||||
#
|
||||
# NOTE: `--format` and `--output` are the SAME option (`--output` is a
|
||||
# documented alias of `--format`), so passing both fails with
|
||||
# "the argument '--format <FORMAT>' cannot be used multiple times" and
|
||||
# no SARIF file is ever written. Use `--output-file` for the path.
|
||||
run: npx --yes [email protected] --format sarif --output-file fallow.sarif 2>&1 | tee fallow.log
|
||||
- name: Upload SARIF
|
||||
if: always()
|
||||
uses: github/codeql-action/upload-sarif@v3
|
||||
|
||||
@@ -115,15 +115,38 @@ jobs:
|
||||
fi
|
||||
exit 0
|
||||
fi
|
||||
EXISTING_PR=$(gh pr list --head "$BRANCH" --json number -q '.[0].number')
|
||||
EXISTING_PR=$(gh pr list --head "$BRANCH" --json number -q '.[0].number' 2>/dev/null || echo "")
|
||||
if [ -n "$EXISTING_PR" ]; then
|
||||
echo "PR #$EXISTING_PR already exists for $BRANCH."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Org policy forces a read-only GITHUB_TOKEN and no SYNC_PAT is
|
||||
# configured, so `gh pr create` cannot succeed here ("Resource not
|
||||
# accessible by integration"). The branch HAS been pushed above, so
|
||||
# degrade to emitting a ready-to-click compare URL instead of
|
||||
# failing the whole run.
|
||||
if gh pr create \
|
||||
--base master \
|
||||
--head "$BRANCH" \
|
||||
--title "$PR_TITLE" \
|
||||
--body "$PR_BODY"; then
|
||||
echo "Sync PR created."
|
||||
else
|
||||
gh pr create \
|
||||
--base master \
|
||||
--head "$BRANCH" \
|
||||
--title "$PR_TITLE" \
|
||||
--body "$PR_BODY"
|
||||
COMPARE_URL="https://github.com/${GITHUB_REPOSITORY}/compare/master...${BRANCH}?expand=1"
|
||||
{
|
||||
echo "### Upstream sync branch is ready — no PR was opened"
|
||||
echo ""
|
||||
echo "The sync branch \`$BRANCH\` was pushed successfully, but this"
|
||||
echo "workflow could not open the pull request: the org policy on"
|
||||
echo "\`GITHUB_TOKEN\` is read-only, and no \`SYNC_PAT\` secret is set."
|
||||
echo ""
|
||||
echo "Open it manually: $COMPARE_URL"
|
||||
echo ""
|
||||
echo "To automate this, add a \`SYNC_PAT\` repository secret with"
|
||||
echo "\`pull_requests: write\`; the workflow already prefers it when present."
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "::warning::Could not open the sync PR (read-only GITHUB_TOKEN, no SYNC_PAT). Open manually: $COMPARE_URL"
|
||||
fi
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.SYNC_PAT != '' && secrets.SYNC_PAT || secrets.GITHUB_TOKEN }}
|
||||
|
||||
@@ -0,0 +1,528 @@
|
||||
# Open Pull Request Remediation Plan
|
||||
|
||||
Reviewed **32 open PRs** on `Heretek-AI/GDevelop-Heretek` on 2026-09-21. All 32 are
|
||||
Dependabot; there are no human-authored open PRs. Every root cause below was
|
||||
reproduced locally, not inferred from CI logs alone.
|
||||
|
||||
**Headline:** only **6 distinct root causes** explain all 19 failing PRs, and
|
||||
**15 of those 19 are fixed by a branch rebase** — the PR heads predate workflow
|
||||
fixes that are already on `master`. Two are real dependency conflicts that must be
|
||||
deferred, and two need a small manifest change.
|
||||
|
||||
---
|
||||
|
||||
## Execution status (updated 2026-09-22)
|
||||
|
||||
Plan executed autonomously. Queue went **32 → 25 open PRs**; 8 merged.
|
||||
|
||||
### Merged
|
||||
|
||||
| PR | What | Evidence for safety |
|
||||
|---:|---|---|
|
||||
| 117 | weekly-deps /GDJS (`@types/three` 0.185.4→0.186.0, prettier) | Typechecked GDJS with both `@types/three` versions: **8258 errors each, 0 new** |
|
||||
| 118 | weekly-deps /GDevelop.js (`jest-light-runner`, prettier) | Jest suite green |
|
||||
| 120 | `@types/node` 20→26 /GDevelop.js | Type-only; Jest suite green |
|
||||
| 122 | `@types/node` 14→26 /GDJS | Type-only |
|
||||
| 113 | `dotenv` 16→18 /electron-app | No `require('dotenv')` anywhere in the app |
|
||||
| 119 | `dotenv` 16→18 /electron-app/app | Same |
|
||||
| 115 | `archiver` 2.1.1→8.0.0 | Not `require()`d anywhere in the app source |
|
||||
| 116 | `prettier` 1.15.3→3.9.8 /electron-app | Build tool only, no config to reformat |
|
||||
|
||||
### Repo fixes landed (PR #124, branch `chore/ci-remediation`)
|
||||
|
||||
- `fallow.yml`: `--output-file` instead of the invalid `--output`; CLI pinned to `3.27.0`. **Confirmed in CI: `Fallow audit` went FAILURE → SUCCESS.**
|
||||
- `upstream-sync.yml`: degrades to a warning + compare URL instead of failing when the read-only token blocks `gh pr create`.
|
||||
- `check-lockfiles.js`: `newIDE/visual-tests` added (was 9 of 10 lockfiles).
|
||||
- `ci.yml`: **new `lockfile-sync` matrix over all 10 manifests** — the gate whose absence let three lockfiles rot (below).
|
||||
- `dependabot.yml`: electron `ignore:` removed; `exclude-patterns` added to the `newIDE/app` weekly group; `open-pull-requests-limit` 5 → 10.
|
||||
- `KNOWN_VULNS.md`: rewritten against the live API.
|
||||
|
||||
### Not in the original plan: three lockfiles were already broken on `master`
|
||||
|
||||
Found while verifying, and repaired on the same branch. CI never ran `npm ci` in
|
||||
these directories, so the drift was invisible until someone installed there:
|
||||
|
||||
| Directory | Drift |
|
||||
|---|---|
|
||||
| `GDJS` | 16 missing (`@pixi/*` 7.4.3) |
|
||||
| `newIDE/electron-app/app` | 6 missing + 3 invalid (`electron` 44.4.3, `@electron/get`) |
|
||||
| `SharedLibs/TileMapHelper` | 36 missing + 2 invalid (`@webassemblyjs/*`, terser) |
|
||||
|
||||
This is also why PR #121's lockfile guard failure looked like a PR-local problem
|
||||
when GDJS was already broken on `master`.
|
||||
|
||||
Also took `adm-zip` 0.6.0 → 0.6.1 in `newIDE/app` and `newIDE/electron-app`,
|
||||
closing **2 of the 22 high-severity advisories**. It is a direct dependency
|
||||
declared `^0.6.0`, so 0.6.1 was already permitted — the lockfiles were just
|
||||
pinned at the vulnerable version. Raising the existing override to `^0.6.1` is
|
||||
*not* the fix: npm rejects it with `EOVERRIDE` (conflicts with direct dependency).
|
||||
|
||||
### Blocked on rebase mechanics (not code)
|
||||
|
||||
PRs 18, 26, 37, 39, 40, 104 did not move on `@dependabot rebase`. Only **#40**
|
||||
reported why: *"Looks like this PR has been edited by someone other than
|
||||
Dependabot. That means Dependabot can't rebase it."* #26 was fixed directly by
|
||||
pushing to its branch; the other four need `@dependabot recreate` (which discards
|
||||
the manual edit) or a maintainer rebase.
|
||||
|
||||
### Cause D confirmed as the only remaining blocker
|
||||
|
||||
After rebasing, PRs 37/39/104/18 still fail **only** on `build-storybook` and
|
||||
`newIDE/app (lint + format)` — i.e. the genuine peer-dependency conflicts. Every
|
||||
Fallow and storybook-credentials failure is gone.
|
||||
|
||||
---
|
||||
|
||||
## Inventory
|
||||
|
||||
`mergeStateStatus` from the GitHub API; failure attribution from per-PR check runs.
|
||||
|
||||
| PR | Title (short) | Failing checks | Root cause | Label |
|
||||
|---:|---|---|---|---|
|
||||
| 123 | weekly-deps /newIDE/app (19 updates) | storybook, Jest, lint+fmt | **B** + **K** | *(none)* |
|
||||
| 122 | `@types/node` 14.18.63 → 26.6.1 /GDJS | — | green | *(none)* |
|
||||
| 121 | `pixi.js` 7.4.2 → 8.21.0 /GDJS | Lockfile guard | **B** + **E** | *(none)* |
|
||||
| 120 | `@types/node` 20.19.43 → 26.6.1 /GDevelop.js | — | green | *(none)* |
|
||||
| 119 | `dotenv` 16.6.1 → 18.0.0 /electron-app/app | — | green | *(none)* |
|
||||
| 118 | weekly-deps /GDevelop.js (2) | — | green | *(none)* |
|
||||
| 117 | weekly-deps /GDJS (2) | — | green | *(none)* |
|
||||
| 116 | `prettier` 1.15.3 → 3.9.8 /electron-app | — | green | *(none)* |
|
||||
| 115 | `archiver` 2.1.1 → 8.0.0 | — | green | *(none)* |
|
||||
| 114 | `chokidar` 4.0.3 → 5.0.0 | — | green | *(none)* |
|
||||
| 113 | `dotenv` 16.6.1 → 18.0.0 /electron-app | — | green | *(none)* |
|
||||
| 110 | `karma` 1.7.1 → 6.4.4 /GDJS/tests | — | green | deferred-major |
|
||||
| 104 | `firebase` 9.0.0-β → 10.9.0 | Fallow, storybook, Jest, lint | **A** + **B** + **D** | deferred-major |
|
||||
| 84 | `vite` 5.4.21 → 8.3.0 | storybook, Jest, lint | **D** | deferred-major |
|
||||
| 40 | `prettier` 1.15.3 → 3.9.6 /newIDE/app | Fallow, lint+fmt | **A** + **G** | deferred-major |
|
||||
| 39 | `react-mosaic-component` 5.3.0 → 7.1.0 | Fallow, storybook, Jest, lint | **A** + **B** | deferred-major |
|
||||
| 37 | `@storybook/preset-create-react-app` 7.4.6 → 10.6.0 | Fallow, storybook, Jest, lint | **A** + **D** | deferred-major |
|
||||
| 35 | `aws-actions/configure-aws-credentials` 4 → 6 | — | green | deferred-major |
|
||||
| 34 | `softprops/action-gh-release` 2 → 3 | storybook | **C** | deferred-major |
|
||||
| 33 | `actions/checkout` 4 → 7 | — | green | deferred-major |
|
||||
| 29 | `actions/setup-node` 4 → 7 | — | green | deferred-major |
|
||||
| 27 | `actions/download-artifact` 4 → 8 | storybook | **C** | deferred-major |
|
||||
| 26 | `grunt-contrib-compress` 1.6.0 → 2.0.0 | Fallow, Lockfile guard | **A** + **F** | deferred-major |
|
||||
| 25 | `@types/mocha` 5.2.7 → 10.0.10 | Fallow | **A** | deferred-major |
|
||||
| 20 | `@electron/notarize` 2.5.0 → 3.1.1 | Fallow | **A** | deferred-major |
|
||||
| 19 | `grunt-shell` 2.1.0 → 4.0.0 | Fallow | **A** | deferred-major |
|
||||
| 18 | `typescript` 5.4.5 → 7.0.2 /GDJS | storybook | **D** | deferred-major |
|
||||
| 15 | `grunt-contrib-uglify` 2.3.0 → 5.2.2 | Fallow | **A** | deferred-major |
|
||||
| 13 | `mocha` 1.21.5 → 12.0.1 | Fallow | **A** | deferred-major |
|
||||
| 9 | `sinon` 15.2.0 → 22.1.0 | Fallow | **A** | deferred-major |
|
||||
| 8 | `karma-firefox-launcher` 1.3.0 → 2.1.3 | Fallow | **A** | deferred-major |
|
||||
| 7 | `karma-mocha` 1.3.0 → 2.0.1 | storybook | **C** | deferred-major |
|
||||
|
||||
**Green (all required checks passing): 13** — #29, 33, 35, 110, 113, 114, 115, 116,
|
||||
117, 118, 119, 120, 122.
|
||||
|
||||
**"Green" ≠ "merge now."** Only **4** of the 13 carry `deferred-major`
|
||||
(#29, #33, #35, #110) — they are parked deliberately. The other **9**
|
||||
(#113, #114, #115, #116, #117, #118, #119, #120, #122) are green *and* untriaged,
|
||||
and several are majors (`dotenv` 16→18, `prettier` 1.15.3→3.9.8, `archiver`
|
||||
2.1.1→8.0.0, `chokidar` 4→5, `@types/node` →26). `deferred-major` is not a
|
||||
built-in GitHub label type; it is applied manually, which is how the 2026-09-21
|
||||
batch slipped through.
|
||||
|
||||
### The `newIDE/app` PR queue is saturated
|
||||
|
||||
`.github/dependabot.yml` sets `open-pull-requests-limit: 5` for `/newIDE/app`, but
|
||||
**6** PRs are open against it today (#37, #39, #40, #84, #104, #123). New PRs are
|
||||
therefore suppressed at the source, and the weekly-deps group (#123) is consuming a
|
||||
slot it shares with five parked majors. **Phase 5 cannot land without raising this
|
||||
limit** — splitting #123 into several PRs requires headroom that does not exist.
|
||||
|
||||
---
|
||||
|
||||
## Root causes
|
||||
|
||||
### A — Fallow CLI pin `3.17.0` predates the `fallow-similar-code` binary *(12 PRs)*
|
||||
|
||||
`#8, 9, 13, 15, 19, 20, 25, 26, 37, 39, 40, 104`
|
||||
|
||||
```
|
||||
##[error]fallow binary verification failed .../@fallow-cli/linux-x64-musl/fallow-similar-code
|
||||
(binary-missing): binary not found at ...
|
||||
##[error]Verification ran against fallow 3.17.0, installed from the action 'version' input.
|
||||
```
|
||||
|
||||
Verified by unpacking both CLI tarballs — `3.17.0` ships only `fallow`; `3.27.0` adds
|
||||
`fallow-similar-code`:
|
||||
|
||||
```
|
||||
$ comm -13 bins-3.17.0.txt bins-3.27.0.txt
|
||||
fallow-similar-code
|
||||
fallow-similar-code.sig
|
||||
```
|
||||
|
||||
Correlation is exact: **every** PR whose head pins `3.27.0` passes the audit
|
||||
(#18, 84, 110, 113, 122); **every** PR pinning `3.17.0` fails. `master` already
|
||||
pins `3.27.0` (`ci(fallow): bump CLI version 3.17.0 -> 3.27.0`, 2026-09-18).
|
||||
|
||||
**This is not a code change — it is a stale branch.** `fail-on-issues: false` is set,
|
||||
so the audit's only failure mode here is binary verification.
|
||||
|
||||
### B — Lockfile desync: `manifest ≠ lockfile` *(4 PRs)*
|
||||
|
||||
`#39, 104, 121, 123` — `npm ci` aborts with `Missing:`/`Invalid:` before any test runs.
|
||||
Reproduced locally against each PR head:
|
||||
|
||||
| PR | `Missing:` | `Invalid:` | after `npm install --package-lock-only` |
|
||||
|---:|---:|---:|---|
|
||||
| 39 | 3 | 0 | **0** |
|
||||
| 104 | 2 | 0 | **0** |
|
||||
| 121 | 38 | 0 | **0** |
|
||||
| 123 | 52 | 15 | **0** |
|
||||
|
||||
Dependabot rewrote `package.json` and updated only part of the lockfile tree.
|
||||
`newIDE/app` is the worst: `package.json` moves to `[email protected]` while the
|
||||
lockfile still records `@pixi/*@7.4.3` entries against `spine-pixi-v7`'s pinned
|
||||
`7.4.2` overrides:
|
||||
|
||||
```
|
||||
Invalid: lock file's @pixi/[email protected] does not satisfy @pixi/[email protected]
|
||||
Missing: @firebase/[email protected] from lock file
|
||||
Missing: [email protected] from lock file
|
||||
```
|
||||
|
||||
Regenerating the lockfile clears **all** of them. Note this is *not* a `master`
|
||||
problem — `master`'s `newIDE/app` lockfile is in sync (0 sync errors), so every one
|
||||
of these is PR-local.
|
||||
|
||||
### C — Stale `build-storybook.yml` with no publish gate *(3 PRs)*
|
||||
|
||||
`#7, 27, 34` (heads dated 2026-08-20, they predate the fix)
|
||||
|
||||
```
|
||||
##[error]Credentials could not be loaded, please check your action inputs:
|
||||
Could not load credentials from any providers
|
||||
```
|
||||
|
||||
Those heads call `aws-actions/configure-aws-credentials` unconditionally. `master`
|
||||
gates it on `secrets.BUILD_STORYBOOK_AWS_ACCESS_KEY_ID` via `steps.decide.outputs.should-publish`
|
||||
(7 occurrences of `should-publish`; the three stale heads have 0).
|
||||
|
||||
**Stale branch, not a defect.**
|
||||
|
||||
### D — Genuine peer-dependency conflicts *(4 PRs — defer)*
|
||||
|
||||
| PR | Conflict | Evidence |
|
||||
|---:|---|---|
|
||||
| 37 | `[email protected]` peers `storybook@^10.6.0`; repo has `7.6.21` | `ERESOLVE could not resolve / While resolving: @storybook/[email protected] / Found: [email protected]` |
|
||||
| 84 | `[email protected]` unsupported by `@vitejs/[email protected]` (peers `^4.2.0 \|\| ^5 \|\| ^6 \|\| ^7`) | `While resolving: @vitejs/[email protected] / Found: [email protected]` |
|
||||
| 18 | `[email protected]` unsupported by `[email protected]` (peers max `6.0.x`) | `While resolving: [email protected] / Found: [email protected]` |
|
||||
| 104 | `[email protected]` drags a React-DnD/refresh generation the lockfile lacks | `Missing: [email protected]`, `Missing: [email protected]` |
|
||||
|
||||
These are real ecosystem gaps, not stale branches. Each needs the *sibling* package
|
||||
bumped in the same change (`@vitejs/plugin-react` 6.1.1 for vite 8; `storybook` 10.x
|
||||
for the preset; typedoc has no TS-7-compatible release yet — `typedoc@latest` is
|
||||
`0.28.20` and still peers `5.0.x … 6.0.x`).
|
||||
|
||||
### E — PR #121 is blocked by the security guard, and the floor is unreachable
|
||||
|
||||
`[email protected]` declares `"@xmldom/xmldom": "^0.8.15"`. The guard requires
|
||||
`'@xmldom/xmldom': ['< 0.9.0']` (`scripts/security/check-lockfiles.js`). Under
|
||||
semver, `0.x` **minor** bumps are breaking, so `^0.8.15` can never resolve to `0.9.x`.
|
||||
Regenerating the lockfile therefore still trips the guard:
|
||||
|
||||
```
|
||||
GDJS/package-lock.json: @xmldom/[email protected] matches < 0.9.0
|
||||
```
|
||||
|
||||
Fix verified end-to-end — add an override, regenerate, run the real guard:
|
||||
|
||||
```
|
||||
overrides: { "@xmldom/xmldom": "^0.9.0" } → resolves 0.9.12
|
||||
$ node scripts/security/check-lockfiles.js
|
||||
✅ All lockfiles free of the pinned vulnerable versions in this guard. (rc=0)
|
||||
```
|
||||
|
||||
API compatibility checked against the shipped package — `0.9.12` still exports
|
||||
`DOMParser` and `XMLSerializer`, and `new DOMParser().parseFromString(...)` works.
|
||||
`pixi.js` only reaches for `DOMParser` in its web-worker adapter.
|
||||
|
||||
### F — PR #26 trips the guard on `adm-zip`
|
||||
|
||||
```
|
||||
GDevelop.js/package-lock.json: [email protected] matches < 0.6.0
|
||||
```
|
||||
|
||||
Introduced by the `grunt-contrib-compress` 1.6→2.0 bump. `master`'s
|
||||
`GDevelop.js` has no `adm-zip` at all and no override. Verified fix — add
|
||||
`overrides: { "adm-zip": "^0.6.0" }` → resolves `0.6.1`, guard clean.
|
||||
|
||||
### G — PR #40 is a repo-wide reformat, not a dependency bump
|
||||
|
||||
`newIDE/app` is on `[email protected]`; the PR moves to `3.9.6`. `check-format` fails
|
||||
on the resulting formatting churn (`Lint: success` → `Format check: failure` in the
|
||||
same job). This cannot be merged as a dependency-only diff; it forces a whole-tree
|
||||
reformat that will collide with every other open PR touching `newIDE/app`.
|
||||
|
||||
### K — `minor, patch` grouping silently admits breaking `0.x` bumps
|
||||
|
||||
`.github/dependabot.yml` groups `update-types: ["minor", "patch"]`. For `0.x`
|
||||
packages a **minor** bump is breaking, so PR #123's "weekly-deps" group silently
|
||||
carries `three` 0.160.0→0.186.0, `react-monaco-editor` 0.18.0→0.59.0,
|
||||
`flow-bin` 0.299.0→0.331.0 and `flow-coverage-report` 0.4.1→0.8.0 alongside real
|
||||
patch bumps. `three` matters most: the runtime vendors its own copy
|
||||
(`GDJS/Runtime/pixi-renderers/three.js`, version string `"160"`), and upstream is
|
||||
doing that migration deliberately in a dedicated PR (4ian/GDevelop#8853,
|
||||
"Upgrade to Three.js 0.185.1"). #123 also bundles `spine-pixi-v7` 4.2.116→4.3.13,
|
||||
which pairs with the vendored Spine runtime.
|
||||
|
||||
**#123 should be split, not rebased and merged.**
|
||||
|
||||
---
|
||||
|
||||
## Repo-level failures on `master` (not PR-caused, but they mask PR signal)
|
||||
|
||||
Both of these are red on `master` today and are noise on every PR.
|
||||
|
||||
### `Fallow full scan` — SARIF never produced
|
||||
|
||||
```
|
||||
Run npx fallow --format sarif --output fallow.sarif
|
||||
error: the argument '--format <FORMAT>' cannot be used multiple times
|
||||
...
|
||||
##[error]Path does not exist: fallow.sarif
|
||||
```
|
||||
|
||||
`--output` is an **alias of `--format`**, not an output-path flag — confirmed against
|
||||
the CLI's own help:
|
||||
|
||||
```
|
||||
-f, --format <FORMAT>
|
||||
Output format (alias: --output)
|
||||
[aliases: --output]
|
||||
-o, --output-file <PATH>
|
||||
Write the report to a file instead of stdout, for any --format
|
||||
--sarif-file <PATH>
|
||||
Write SARIF output to a file (in addition to the primary --format output)
|
||||
```
|
||||
|
||||
So the step passes `--format` twice and dies before writing anything, `Upload SARIF`
|
||||
then fails with `Path does not exist: fallow.sarif`, and the job is red. The CLI
|
||||
version the workflow pins (`3.27.0`) also differs from the npm wrapper (`[email protected]`)
|
||||
because the two use different version schemes — the workflow relies on `npx` and
|
||||
`npx fallow` resolves the `3.3.0` wrapper.
|
||||
|
||||
### `Upstream Sync (PR-Only)`
|
||||
|
||||
Merge conflicts against `upstream/master` are expected and handled, but the
|
||||
conflict-report path then fails:
|
||||
|
||||
```
|
||||
gh pr create ... pull request create failed: GraphQL: Resource not accessible by integration
|
||||
##[error]Process completed with exit code 1
|
||||
```
|
||||
|
||||
`GITHUB_TOKEN` is read-only here by org policy — already established in PR #112
|
||||
(`ci: remove GITHUB_TOKEN permission probe (validation complete: org policy forces
|
||||
read-only GITHUB_TOKEN)`). Any `gh pr create` / `gh issue create` in this repo cannot
|
||||
succeed as written.
|
||||
|
||||
---
|
||||
|
||||
## Remediation plan
|
||||
|
||||
### Phase 1 — Rebase the stale 15 *(no code changes)*
|
||||
|
||||
Root causes A and C are stale heads, not defects. `master` already carries both fixes.
|
||||
|
||||
- #8, 9, 13, 15, 19, 20, 25, 34, 27, 7 — rebase clears the failure outright.
|
||||
- #26, 37, 39, 40, 104 — rebase clears **A**; each still needs its Phase 2/3 item.
|
||||
|
||||
Rebase via `@dependabot rebase` on each PR (or close/reopen). Doing this after
|
||||
Phase 2 starts is wasteful — rebase first, then re-read the check results, because
|
||||
several of these PRs may be green once A and C are gone.
|
||||
|
||||
**Acceptance:** no open PR still reports `fallow binary verification failed` or
|
||||
`Could not load credentials from any providers`.
|
||||
|
||||
### Phase 2 — Merge the safe green set
|
||||
|
||||
Only after Phase 1, and **serially** — every one of these touches a lockfile, so
|
||||
each merge invalidates the others until Dependabot rebases them.
|
||||
|
||||
1. #29, #33, #35 (GitHub Actions bumps — no lockfile churn)
|
||||
2. #117, #118 (weekly-deps groups, minor/patch only)
|
||||
3. #120, #122 (`@types/node` — type-only, major but inert)
|
||||
4. #110, #113, #114, #115, #116, #119 (parked majors; merge only when the
|
||||
corresponding migration is actually wanted)
|
||||
|
||||
**Acceptance:** `master` CI stays green after each merge; no PR is merged with a red
|
||||
required check.
|
||||
|
||||
### Phase 3 — Repair the fixable failures
|
||||
|
||||
1. **#121 — add the `@xmldom/xmldom` override.** In `GDJS/package.json`:
|
||||
```json
|
||||
"overrides": { "@xmldom/xmldom": "^0.9.0" }
|
||||
```
|
||||
then `npm install --package-lock-only` in `GDJS/`. Verified: resolves `0.9.12`,
|
||||
guard exits 0. Confirm `pixi.js` 8.x boots in a smoke run before merging.
|
||||
|
||||
2. **#26 — add the `adm-zip` override.** In `GDevelop.js/package.json`:
|
||||
```json
|
||||
"overrides": { "adm-zip": "^0.6.0" }
|
||||
```
|
||||
Verified: resolves `0.6.1`, guard clean.
|
||||
|
||||
3. **#39, #104 — regenerate lockfiles.** `npm install --package-lock-only` in
|
||||
`newIDE/app`; verified to clear all sync errors. #104 additionally needs Phase 4's
|
||||
`firebase` conflict resolved.
|
||||
|
||||
### Phase 4 — Defer the genuine conflicts
|
||||
|
||||
Do not attempt to rebase these into green. Each is blocked on a sibling upgrade:
|
||||
|
||||
| PR | Blocker | Path forward |
|
||||
|---:|---|---|
|
||||
| 37 | preset needs `storybook@^10.6.0`; repo on `7.6.21` | separate Storybook 10 migration |
|
||||
| 84 | `vite@8` needs `@vitejs/plugin-react@6.1.1` (peers `^8.0.0`) | bump both together |
|
||||
| 18 | no TS-7-compatible `typedoc` exists (`0.28.20` peers ≤ `6.0.x`) | upstream-blocked; keep parked |
|
||||
| 104 | `firebase@10` pulls a new React-DnD/refresh generation | bump `react-dnd-html5-backend`, `react-refresh` in the same change |
|
||||
|
||||
Keep these open with the `deferred-major` label — closing them just re-opens them
|
||||
weekly. #18 is blocked upstream and gains nothing from being rebased.
|
||||
|
||||
### Phase 5 — Split PR #123
|
||||
|
||||
#123 is not a dependency bump; it is a 19-package migration. Split it:
|
||||
|
||||
- **Keep together:** `@material-ui/core` 4.11.0→4.12.4, `@material-ui/icons`,
|
||||
`classnames`, `fontfaceobserver`, `posthog-js`, `react-color`, `react-measure`,
|
||||
`react-virtualized`, `serve-handler`, `iso-639-1`, `baseline-browser-mapping`.
|
||||
- **Split out (0.x minor = breaking):** `three` 0.160→0.186 (pairs with the vendored
|
||||
runtime copy — align with upstream 4ian/GDevelop#8853), `react-monaco-editor`
|
||||
0.18.0→0.59.0, `flow-bin` 0.299→0.331, `flow-coverage-report`.
|
||||
- **Split out:** `spine-pixi-v7` 4.2.116→4.3.13 — needs the vendored Spine runtime
|
||||
re-generated, and is already being tracked upstream.
|
||||
- **Also required:** reconcile the `@esotericsoftware/spine-pixi-v7` override. It
|
||||
pins `@pixi/*` to `7.4.2` while `pixi.js-legacy` moves to `7.4.3`, producing a
|
||||
mixed-generation runtime. Verified: dropping the stale override (or aligning it to
|
||||
`7.4.3`) both yield a clean install with `@pixi/core@7.4.3`.
|
||||
|
||||
**Acceptance:** the split PRs pass lockfile guard, lint, Jest and Storybook; the
|
||||
`three`/`spine` PRs are validated visually in the editor.
|
||||
|
||||
### Phase 6 — Repo-level fixes
|
||||
|
||||
1. **`fallow.yml` SARIF step.** Replace:
|
||||
```yaml
|
||||
run: npx fallow --format sarif --output fallow.sarif 2>&1 | tee fallow.log
|
||||
```
|
||||
with:
|
||||
```yaml
|
||||
run: npx fallow --format sarif --output-file fallow.sarif 2>&1 | tee fallow.log
|
||||
```
|
||||
(`--output` is an alias of `--format` — never use it as a path.) **Verified
|
||||
locally:** this form exits 0 and writes a valid SARIF 2.1.0 document
|
||||
(`{"$schema": ".../sarif-2.1.0.json", "version": "2.1.0", "runs": [...]}`, 63 KB
|
||||
on a scratch tree). Align the `version:` input with the `npx fallow` wrapper, or
|
||||
install the CLI explicitly, so the two version schemes cannot silently diverge
|
||||
again — the action input `3.27.0` and the npm wrapper `3.3.0` are unrelated.
|
||||
|
||||
2. **Raise `open-pull-requests-limit` for `/newIDE/app`** (currently `5`, with 6 open).
|
||||
Required before Phase 5 can split #123.
|
||||
|
||||
3. **`upstream-sync.yml`.** Org policy forces a read-only `GITHUB_TOKEN`, so
|
||||
`gh pr create` / `gh issue create` can never succeed. Either supply a PAT/App
|
||||
token, or drop the create steps and emit the branch name plus a compare URL for a
|
||||
human to open. The second needs no new secret and matches the existing policy.
|
||||
|
||||
4. **Close the guard's blind spot.** `newIDE/visual-tests/package-lock.json` exists
|
||||
but is absent from `lockfiles` in `scripts/security/check-lockfiles.js`
|
||||
(10 lockfiles on disk, 9 guarded). It carries `extract-zip` high advisories
|
||||
(`GHSA-7pqw-9j4j-h8q3`, `GHSA-jmr9-qjv8-65gv`) with no patch available — add it to
|
||||
the guard and record the no-patch advisories in `KNOWN_VULNS.md` as accepted.
|
||||
|
||||
5. **Triage the untriaged batch.** Apply `deferred-major` to #113–#123 majors, so
|
||||
the queue state is readable from labels alone.
|
||||
|
||||
### Phase 7 — Documentation drift
|
||||
|
||||
`KNOWN_VULNS.md` is materially out of date and now misleads:
|
||||
|
||||
- It states the fork **stays on electron 32.x** with "47 advisories open" and gives a
|
||||
32.x→33.x bump procedure. Reality: `newIDE/electron-app/package.json` is on
|
||||
**`44.4.3`** (PR #96 merged 2026-09-18), `GDJS/Runtime/Electron/package.json` on
|
||||
`44.3.0`, and `.github/dependabot.yml` still carries the electron
|
||||
`ignore:` block for major/minor. **Remove the ignore block and rewrite the section.**
|
||||
- It claims "All non-electron vulnerabilities across the repository have been
|
||||
remediated." The API reports **49 open alerts — 22 high, 25 medium, 2 low** across
|
||||
18 packages and 0 stale entries, including `tar` (16), `webpack-dev-server` (6),
|
||||
`extract-zip` (4), `adm-zip` (4), `svgo` (3), `vite` (3).
|
||||
- `.github/workflows/fallow.yml` says "open count should stay under 4,500" in a
|
||||
comment while the check enforces `-gt 1500`. Current count is **2,844**. Pick one
|
||||
number; 4,500 is not what the code does.
|
||||
- `SONARCLOUD_REMEDIATION_PLAN.md` references paths under
|
||||
`/home/john/Projects/GDevelop` (no `-Heretek`), which no longer exist.
|
||||
|
||||
**Acceptance:** `KNOWN_VULNS.md` matches the shipped manifests and the live alert
|
||||
count; no doc references a path or version that contradicts the repo.
|
||||
|
||||
---
|
||||
|
||||
## Verification
|
||||
|
||||
Run after each phase. Every command below was executed during this review.
|
||||
|
||||
```bash
|
||||
# Lockfile guard — must exit 0
|
||||
node scripts/security/check-lockfiles.js
|
||||
|
||||
# Reproduce/clear lockfile desync for a PR tree
|
||||
npm ci --dry-run --no-audit --no-fund --ignore-scripts # >0 Missing:/Invalid: = desync
|
||||
npm install --package-lock-only --no-audit --no-fund # regenerate
|
||||
npm ci --dry-run --no-audit --no-fund --ignore-scripts # re-check → 0
|
||||
|
||||
# Live Dependabot alert count
|
||||
gh api "repos/Heretek-AI/GDevelop-Heretek/dependabot/alerts?state=open&per_page=100" \
|
||||
--jq 'group_by(.security_advisory.severity) | map({sev: .[0].security_advisory.severity, n: length})'
|
||||
|
||||
# Guard coverage vs lockfiles on disk
|
||||
comm -23 <(find . -name package-lock.json -not -path '*/node_modules/*' | sed 's|^\./||' | sort) \
|
||||
<(sed -n '/^const lockfiles/,/^];/p' scripts/security/check-lockfiles.js \
|
||||
| grep -oE "'[^']+'" | tr -d "'" | sort)
|
||||
|
||||
# Fallow SARIF flag (in a scratch dir)
|
||||
npx --yes [email protected] --help | grep -A2 -E '\-\-format|sarif-file|output-file'
|
||||
|
||||
# Per-PR check state
|
||||
gh pr list --repo Heretek-AI/GDevelop-Heretek --state open --limit 100 \
|
||||
--json number,mergeable,mergeStateStatus,statusCheckRollup
|
||||
```
|
||||
|
||||
## Acceptance criteria
|
||||
|
||||
1. **Zero PRs fail on root causes A or C** — no `fallow binary verification failed`,
|
||||
no `Could not load credentials` on any open PR.
|
||||
2. **`master` is green** for CI, Build Storybook, *and* Fallow (`Fallow full scan`
|
||||
SARIF upload succeeds).
|
||||
3. **Lockfile guard exits 0** on `master` with all **10** lockfiles covered.
|
||||
4. **Every PR has a deliberate disposition** — merged, or open with `deferred-major`
|
||||
and a named blocker in this document. No PR left failing on a stale branch.
|
||||
5. **`KNOWN_VULNS.md` and `dependabot.yml` match reality** (electron 44.x; no stale
|
||||
`ignore:` block; alert count and thresholds stated correctly).
|
||||
6. **No regression:** `newIDE/app` Jest, `GDevelop.js` Jest, and the lockfile guard
|
||||
all pass on `master` after each merge.
|
||||
|
||||
## Risks & open questions
|
||||
|
||||
1. **Serial merges.** All of Phase 2's PRs touch lockfiles; merging one invalidates
|
||||
the rest until Dependabot rebases. Budget for that rather than merging in bulk.
|
||||
2. **`@xmldom/xmldom` override is a compatibility judgement.** `0.9.x` is a breaking
|
||||
major by the project's own semver convention. The API surface `pixi.js` uses
|
||||
(`DOMParser`) is present and tested, but this override should be validated with a
|
||||
real editor smoke run, not just a clean install.
|
||||
3. **PR #121 is a 7.4.2→8.21.0 pixi jump** — two majors. `GDJS` runtime rendering
|
||||
behaviour needs visual verification regardless of the guard outcome.
|
||||
4. **`fallow` version schemes differ** (action input `3.27.0` vs npm wrapper `3.3.0`).
|
||||
The recommended `--output-file` fix stops the immediate failure but does not
|
||||
reconcile the versions; pinning deliberately is the durable fix.
|
||||
5. **Phase 5 depends on upstream.** The `three` and `spine` splits should land
|
||||
together with — or after — 4ian/GDevelop#8853, or the fork drifts from upstream
|
||||
in the vendored runtime.
|
||||
6. **Upstream-sync needs a decision.** A PAT/App token is the only way to keep the
|
||||
bot opening PRs; otherwise the workflow must become advisory. That is a policy
|
||||
call, not a code call.
|
||||
Generated
+194
@@ -573,11 +573,205 @@
|
||||
"node": ">= 8"
|
||||
}
|
||||
},
|
||||
"node_modules/@pixi/assets": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/assets/-/assets-7.4.3.tgz",
|
||||
"integrity": "sha512-StvjiJBSp/j9hHkGu8AFHNvwYUazXq64WhyhytztyDMRkg/l/cL7EcttY5T0qZNWlIpccdr60LUKrWDOuMpkiw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@types/css-font-loading-module": "^0.0.12"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"@pixi/core": "7.4.3"
|
||||
}
|
||||
},
|
||||
"node_modules/@pixi/color": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/color/-/color-7.4.3.tgz",
|
||||
"integrity": "sha512-a6R+bXKeXMDcRmjYQoBIK+v2EYqxSX49wcjAY579EYM/WrFKS98nSees6lqVUcLKrcQh2DT9srJHX7XMny3voQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@pixi/colord": "^2.9.6"
|
||||
}
|
||||
},
|
||||
"node_modules/@pixi/colord": {
|
||||
"version": "2.9.6",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/@pixi/constants": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/constants/-/constants-7.4.3.tgz",
|
||||
"integrity": "sha512-QGmwJUNQy/vVEHzL6VGQvnwawLZ1wceZMI8HwJAT4/I2uAzbBeFDdmCS8WsTpSWLZjF/DszDc1D8BFp4pVJ5UQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/@pixi/core": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/core/-/core-7.4.3.tgz",
|
||||
"integrity": "sha512-5YDs11faWgVVTL8VZtLU05/Fl47vaP5Tnsbf+y/WRR0VSW3KhRRGTBU1J3Gdc2xEWbJhUK07KGP7eSZpvtPVgA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@pixi/color": "7.4.3",
|
||||
"@pixi/constants": "7.4.3",
|
||||
"@pixi/extensions": "7.4.3",
|
||||
"@pixi/math": "7.4.3",
|
||||
"@pixi/runner": "7.4.3",
|
||||
"@pixi/settings": "7.4.3",
|
||||
"@pixi/ticker": "7.4.3",
|
||||
"@pixi/utils": "7.4.3"
|
||||
},
|
||||
"funding": {
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/pixijs"
|
||||
}
|
||||
},
|
||||
"node_modules/@pixi/display": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/display/-/display-7.4.3.tgz",
|
||||
"integrity": "sha512-b5m2dAaoNAVdxz1oDaxl3XZ059NEOcNtGkxTOZ4EYCw/jcp9sZXkgSROHRzsGn4k+NugH7+9MP4Id2Z0kkdUhw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"peerDependencies": {
|
||||
"@pixi/core": "7.4.3"
|
||||
}
|
||||
},
|
||||
"node_modules/@pixi/events": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/events/-/events-7.4.3.tgz",
|
||||
"integrity": "sha512-o3j/5Dxq6WDVS6eHfURB/cf/MP+NcsF/eC5PnbSHjXxJmDE7PoTVwLvxexm5uuvNRpFh/6/Fn0V8Vl4gV8sc8w==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"peerDependencies": {
|
||||
"@pixi/core": "7.4.3",
|
||||
"@pixi/display": "7.4.3"
|
||||
}
|
||||
},
|
||||
"node_modules/@pixi/extensions": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/extensions/-/extensions-7.4.3.tgz",
|
||||
"integrity": "sha512-FhoiYkHQEDYHUE7wXhqfsTRz6KxLXjuMbSiAwnLb9uG1vAgp6q6qd6HEsf4X30YaZbLFY8a4KY6hFZWjF+4Fdw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/@pixi/graphics": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/graphics/-/graphics-7.4.3.tgz",
|
||||
"integrity": "sha512-wWLivD8/URb8A7X4TqCZGG39C91IE+aOuWY/z9NCz5Z6WvA/VWnsc5fLTlO+ggjGHgKF0cSucCXZfUe1wm0AOQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"peerDependencies": {
|
||||
"@pixi/core": "7.4.3",
|
||||
"@pixi/display": "7.4.3",
|
||||
"@pixi/sprite": "7.4.3"
|
||||
}
|
||||
},
|
||||
"node_modules/@pixi/math": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/math/-/math-7.4.3.tgz",
|
||||
"integrity": "sha512-/uJOVhR2DOZ+zgdI6Bs/CwcXT4bNRKsS+TqX3ekRIxPCwaLra+Qdm7aDxT5cTToDzdxbKL5+rwiLu3Y1egILDw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/@pixi/mesh": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/mesh/-/mesh-7.4.3.tgz",
|
||||
"integrity": "sha512-CikqFPtKvU3Zj986/MSoC8X39CWv5CEpiEW/tYp47p4tgQNDSkNWYnDiNYgb+4VX6pNsBrgX4DALLdTR17SlSA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"peerDependencies": {
|
||||
"@pixi/core": "7.4.3",
|
||||
"@pixi/display": "7.4.3"
|
||||
}
|
||||
},
|
||||
"node_modules/@pixi/runner": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/runner/-/runner-7.4.3.tgz",
|
||||
"integrity": "sha512-TJyfp7y23u5vvRAyYhVSa7ytq0PdKSvPLXu4G3meoFh1oxTLHH6g/RIzLuxUAThPG2z7ftthuW3qWq6dRV+dhw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/@pixi/settings": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/settings/-/settings-7.4.3.tgz",
|
||||
"integrity": "sha512-SmGK8smc0PxRB9nr0UJioEtE9hl4gvj9OedCvZx3bxBwA3omA5BmP3CyhQfN8XJ29+o2OUL01r3zAPVol4l4lA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@pixi/constants": "7.4.3",
|
||||
"@types/css-font-loading-module": "^0.0.12",
|
||||
"ismobilejs": "^1.1.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@pixi/sprite": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/sprite/-/sprite-7.4.3.tgz",
|
||||
"integrity": "sha512-iNBrpOFF9nXDT6m2jcyYy6l/sRzklLDDck1eFHprHZwvNquY2nzRfh+RGBCecxhBcijiLJ3fsZN33fP0LDXkvw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"peerDependencies": {
|
||||
"@pixi/core": "7.4.3",
|
||||
"@pixi/display": "7.4.3"
|
||||
}
|
||||
},
|
||||
"node_modules/@pixi/text": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/text/-/text-7.4.3.tgz",
|
||||
"integrity": "sha512-IAF0iu04rPg3oiL0HZsEZI44fpJxq3UZ4xTmx8l1RyhhSXiElLvvSlSH57vt/BKMQZtCs+AqEit7yn8heK2+nQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"peerDependencies": {
|
||||
"@pixi/core": "7.4.3",
|
||||
"@pixi/sprite": "7.4.3"
|
||||
}
|
||||
},
|
||||
"node_modules/@pixi/ticker": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/ticker/-/ticker-7.4.3.tgz",
|
||||
"integrity": "sha512-tHsAD0iOUb6QSGGw+c8cyRBvxsq/NlfzIFBZLEHhWZ+Bx4a0MmXup6I/yJDGmyPCYE+ctCcAfY13wKAzdiVFgQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@pixi/extensions": "7.4.3",
|
||||
"@pixi/settings": "7.4.3",
|
||||
"@pixi/utils": "7.4.3"
|
||||
}
|
||||
},
|
||||
"node_modules/@pixi/utils": {
|
||||
"version": "7.4.3",
|
||||
"resolved": "https://registry.npmjs.org/@pixi/utils/-/utils-7.4.3.tgz",
|
||||
"integrity": "sha512-NO3Y9HAn2UKS1YdxffqsPp+kDpVm8XWvkZcS/E+rBzY9VTLnNOI7cawSRm+dacdET3a8Jad3aDKEDZ0HmAqAFA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@pixi/color": "7.4.3",
|
||||
"@pixi/constants": "7.4.3",
|
||||
"@pixi/settings": "7.4.3",
|
||||
"@types/earcut": "^2.1.0",
|
||||
"earcut": "^2.2.4",
|
||||
"eventemitter3": "^4.0.0",
|
||||
"url": "^0.11.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@pkgjs/parseargs": {
|
||||
"version": "0.11.0",
|
||||
"dev": true,
|
||||
|
||||
+150
-45
@@ -1,58 +1,163 @@
|
||||
# Known Vulnerabilities — Awaiting Upstream / User Decision
|
||||
# Known Vulnerabilities — Current State & Accepted Risk
|
||||
|
||||
These are open Dependabot / CodeQL findings that **cannot be closed in this
|
||||
fork** without a decision from the user. Documented so they don't get lost.
|
||||
**Last verified: 2026-09-21** against the live Dependabot API and the manifests in
|
||||
this repo. Every number and version below was read from the repository or the API,
|
||||
not carried over from an earlier revision.
|
||||
|
||||
## Electron 32.x is end-of-line (47 advisories open)
|
||||
If you are here because a check is red, jump to
|
||||
[Guard coverage gaps](#guard-coverage-gaps) — the guard's `tar` floor is stale.
|
||||
|
||||
The 47 `electron`-family advisories in this fork all require a major bump
|
||||
beyond the 32.x line. As of 2026-08-20, **32.3.3 is the latest published
|
||||
electron 32.x version** — no further 32.x patches will land. The fixes
|
||||
ship in 33.4.x and later.
|
||||
---
|
||||
|
||||
Per the user's decision during Phase 2 planning, this fork stays on 32.x
|
||||
to avoid native-module rebuild risk. The trade-off is documented in the
|
||||
Phase 2 section of the approved remediation plan (linked from the PR
|
||||
description; the plan file itself lives outside the repo).
|
||||
## Summary
|
||||
|
||||
### When you're ready to bump
|
||||
1. Bump `electron` in three manifests at once:
|
||||
- `newIDE/electron-app/package.json` (`"electron": "32.3.3"` → `"^33.4.0"`)
|
||||
- `newIDE/electron-app/app/package.json` (electron is a transitive of `electron-updater`)
|
||||
- `GDJS/Runtime/Electron/package.json` (`"electron": "32.3.3"` → `"^33.4.0"`)
|
||||
2. Run `npm install --package-lock-only` in each.
|
||||
3. If any native module breaks, run `npx electron-rebuild` per the
|
||||
project's docs.
|
||||
4. Verify with `cd newIDE/app && npm test` and a manual
|
||||
`npm run build` in `newIDE/electron-app`.
|
||||
| Metric | Value |
|
||||
|---|---:|
|
||||
| Open Dependabot alerts | **49** |
|
||||
| — high | 22 |
|
||||
| — medium | 25 |
|
||||
| — low | 2 |
|
||||
| Distinct packages | 18 |
|
||||
| Stale alerts (package absent from lockfile) | 0 |
|
||||
| Lockfiles in repo | 10 |
|
||||
| Lockfiles covered by `scripts/security/check-lockfiles.js` | 10 |
|
||||
|
||||
## CodeQL `js/incomplete-sanitization` in test files
|
||||
Reproduce:
|
||||
|
||||
One of the 5 `js/incomplete-sanitization` alerts is on
|
||||
`GDevelop.js/__tests__/ExpressionCompletionFinder.spec.js:21`. The string
|
||||
being escaped is test input, not production data; dismissing with
|
||||
`False positive` (CodeQL UI) and adding a comment in the file is the
|
||||
recommended path.
|
||||
```bash
|
||||
gh api "repos/Heretek-AI/GDevelop-Heretek/dependabot/alerts?state=open&per_page=100" \
|
||||
--jq 'group_by(.security_advisory.severity) | map({sev: .[0].security_advisory.severity, n: length})'
|
||||
```
|
||||
|
||||
## CodeQL `js/disabling-electron-websecurity`
|
||||
> An earlier revision of this file claimed "All non-electron vulnerabilities across
|
||||
> the repository have been remediated." That was true of the *curated override set*
|
||||
> at the time, but not of the alert feed. The override set and the advisory feed are
|
||||
> different populations; only this file's alert section reflects the feed.
|
||||
|
||||
The two alerts on `newIDE/electron-app/app/main.js:175` and
|
||||
`LocalExternalEditorWindow.js:37` are intentional — the local-external-
|
||||
editor window needs `webSecurity: false` to load user-supplied game
|
||||
previews from `file://` URLs. Dismiss with `Used in tests` plus a code
|
||||
comment pointing at `BUILD.md` for context.
|
||||
---
|
||||
|
||||
## The two Google API key secret alerts
|
||||
## Electron is no longer pinned to 32.x
|
||||
|
||||
These are upstream-owned secrets that we **cannot dismiss** from this fork
|
||||
(no permission to revoke). They'll remain in the GitHub security tab until
|
||||
upstream purges them from history. We've stopped re-leaking them in our
|
||||
branch via the env-var pattern in `SECRETS.md`.
|
||||
**Resolved.** The previous 32.x pin (and its 47 advisories) is gone:
|
||||
|
||||
## Phase 3 Dependabot Remediation (2026-08-21)
|
||||
| Manifest | Version |
|
||||
|---|---|
|
||||
| `newIDE/electron-app/package.json` | `44.4.3` |
|
||||
| `GDJS/Runtime/Electron/package.json` | `44.3.0` |
|
||||
|
||||
All non-electron vulnerabilities across the repository have been remediated:
|
||||
- Added missing lockfiles for `SharedLibs/TileMapHelper` (closing `rollup` alerts) and `SharedLibs/ThreeAddons`.
|
||||
- Pinned secure overrides across all `package.json` manifests for `shell-quote` (Critical), `handlebars` (Critical), `ejs` (Critical), `fast-uri` (High), `js-yaml` (High), `adm-zip` (High), `tmp` (High), `ip-address` (High), `lodash` (High), `extract-zip` (High), `node-forge` (High), `undici` (High), `ws` (High), `brace-expansion` (High), `postcss` (High), `serialize-javascript` (High), and `piscina` (High).
|
||||
- Hardened `scripts/security/check-lockfiles.js` regression guard to enforce strict version floors across all 9 lockfiles in CI.
|
||||
- The remaining open advisories in GitHub Security are the intentional `electron` 32.x pin (documented above) and upstream Google API keys.
|
||||
`44.4.3` is the current `latest` on npm, so both are at the head of the release
|
||||
line. The `ignore:` block that held electron at 32.x has been **removed** from
|
||||
`.github/dependabot.yml`, so electron is once again eligible for major/minor
|
||||
updates through the normal PR flow.
|
||||
|
||||
No native-module rebuild was required at the time of the bump.
|
||||
|
||||
---
|
||||
|
||||
## Open alerts by package
|
||||
|
||||
Grouped by package, with the advisory range and the version this repo actually
|
||||
resolves. "Fixable" means a patched version exists in the advisory.
|
||||
|
||||
### High
|
||||
|
||||
| Package | Advisory | Range | Resolved | Patched | Manifest(s) |
|
||||
|---|---|---|---|---|---|
|
||||
| `tar` | 6 advisories (GHSA-34x7-hfp2-rc4v, -83g3-92jg-28cx, -8qq5-rm4j-mr97, -9ppj-qmqm-q256, -qffp-2rhf-9h96, -r6q2-hw4h-h46w) | `<= 7.5.17` | `6.2.1` | `7.5.18` | `newIDE/app`, `newIDE/electron-app` |
|
||||
| `adm-zip` | GHSA-7q85-xj36-vmfc | `< 0.6.1` | `0.6.0` | `0.6.1` | `newIDE/app`, `newIDE/electron-app` |
|
||||
| `extract-zip` | GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv | `<= 2.0.1` | `2.0.1` | **none** | `newIDE/app`, `newIDE/visual-tests` |
|
||||
| `svgo` | GHSA-2p49-hgcm-8545, GHSA-w27v-7q3p-w38r | `>= 1.0.0, < 2.8.4` | `1.3.2`, `2.8.2` | `2.8.4` | `newIDE/app` |
|
||||
| `vite` | GHSA-fx2h-pf6j-xcff | `<= 6.4.2` | `5.4.21` | `6.4.3` | `newIDE/app` |
|
||||
| `serialize-javascript` | GHSA-5c6j-r48x-rmvq | `<= 7.0.2` | `4.0.0` | `7.0.3` | `SharedLibs/TileMapHelper` |
|
||||
|
||||
### Medium
|
||||
|
||||
| Package | Advisory | Range | Resolved | Patched | Manifest(s) |
|
||||
|---|---|---|---|---|---|
|
||||
| `webpack-dev-server` | 6 advisories | `<= 5.2.5` | `4.15.2` | `5.2.6` | `newIDE/app` |
|
||||
| `tar` | GHSA-w8wr-v893-vjvp, GHSA-vmf3-w455-68vh | `<= 7.5.17` | `6.2.1` | `7.5.18` | `newIDE/app`, `newIDE/electron-app` |
|
||||
| `adm-zip` | GHSA-vwc7-r8mq-g2x9 | `>= 0.5.9, <= 0.6.0` | `0.6.0` | **none** | `newIDE/app`, `newIDE/electron-app` |
|
||||
| `vite` | GHSA-4w7w-66w2-5vf9, GHSA-v6wh-96g9-6wx3 | `<= 6.4.2` | `5.4.21` | `6.4.3` | `newIDE/app` |
|
||||
| `svgo` | GHSA-4vpr-x523-8j87 | `>= 1.0.0, < 2.8.4` | `1.3.2`, `2.8.2` | `2.8.4` | `newIDE/app` |
|
||||
| `karma` | GHSA-7x7c-qm48-pq9c, GHSA-rc3x-jf5g-xvc5 | `< 6.3.16` | `1.7.1` | `6.3.16` | `GDJS/tests` |
|
||||
| `firebase` | GHSA-3wf4-68gx-mph8 | `< 10.9.0` | `9.0.0-beta.2` | `10.9.0` | `newIDE/app` |
|
||||
| `launch-editor` | GHSA-v6wh-96g9-6wx3 | `<= 2.14.0` | `2.13.1` | `2.14.1` | `newIDE/app` |
|
||||
| `picomatch` | GHSA-3v7f-55p6-f55p | `>= 4.0.0, < 4.0.4` | `3.0.2`, `4.0.3` | `4.0.4` | `newIDE/app` |
|
||||
| `yargs-parser` | GHSA-p9pc-299p-vxgp | `>= 6.0.0, < 13.1.2` | `7.0.0` | `13.1.2` | `newIDE/app` |
|
||||
| `uuid` | GHSA-w5hq-g745-h8pq | `< 11.1.1` | `3.4.0` | `11.1.1` | `GDevelop.js` |
|
||||
| `tough-cookie` | GHSA-72xf-g2v4-qvf3 | `< 4.1.3` | `2.5.0` | `4.1.3` | `GDevelop.js` |
|
||||
| `decode-uri-component` | GHSA-vcc3-ghjq-m6fr | `<= 0.4.2` | `0.2.2` | `0.5.0` | `GDJS/tests` |
|
||||
| `request` | GHSA-p8p7-x288-28g6 | `<= 2.88.2` | `2.88.2` | **none** | `GDevelop.js` |
|
||||
|
||||
### Low
|
||||
|
||||
| Package | Advisory | Range | Resolved | Patched | Manifest(s) |
|
||||
|---|---|---|---|---|---|
|
||||
| `@tootallnate/once` | GHSA-vpq2-c234-7xj6 | `< 2.0.1` | `1.1.2` | `2.0.1` | `newIDE/app` |
|
||||
| `elliptic` | GHSA-848j-6mx2-7j84 | `<= 6.6.1` | `6.6.1` | **none** | `SharedLibs/TileMapHelper` |
|
||||
|
||||
---
|
||||
|
||||
## Accepted risk — no upstream patch exists
|
||||
|
||||
These cannot be closed from this fork. Each is recorded here so it is a documented
|
||||
decision rather than an unexamined red badge.
|
||||
|
||||
| Package | Advisory | Why accepted |
|
||||
|---|---|---|
|
||||
| `extract-zip` | GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv | No patched release. Reached only through dev/build tooling, never shipped in a game export. |
|
||||
| `adm-zip` | GHSA-vwc7-r8mq-g2x9 | No patched release. Note the *separate* high advisory GHSA-7q85-xj36-vmfc **does** have a patch (0.6.1) and should be taken. |
|
||||
| `elliptic` | GHSA-848j-6mx2-7j84 | No patched release. Test-only dependency under `SharedLibs/TileMapHelper`. |
|
||||
| `request` | GHSA-p8p7-x288-28g6 | No patched release; the package is deprecated upstream. Build-time only in `GDevelop.js`. |
|
||||
|
||||
---
|
||||
|
||||
## Guard coverage gaps
|
||||
|
||||
`scripts/security/check-lockfiles.js` is a *curated floor list*, not a mirror of the
|
||||
advisory feed. Two gaps are worth knowing about:
|
||||
|
||||
1. **`tar` floor is stale.** The guard asserts `'tar': ['< 6.2.1']`, and this repo
|
||||
resolves `[email protected]` — so the guard passes. But the current advisories cover
|
||||
`<= 7.5.17`, which **includes 6.2.1**. The guard is therefore quiet on 16 live
|
||||
advisories. Raising the floor to `< 7.5.18` without also moving to `[email protected]`
|
||||
would simply turn `master` red, so this needs the tar 6→7 migration first
|
||||
(tracked in the dependabot remediation issue).
|
||||
2. **`newIDE/visual-tests/package-lock.json` was unguarded.** There were 10 lockfiles
|
||||
on disk and 9 in the guard's list. Added — it is now covered.
|
||||
|
||||
Confirm coverage at any time:
|
||||
|
||||
```bash
|
||||
comm -23 \
|
||||
<(find . -name package-lock.json -not -path '*/node_modules/*' | sed 's|^\./||' | sort) \
|
||||
<(sed -n '/^const lockfiles/,/^];/p' scripts/security/check-lockfiles.js \
|
||||
| grep -oE "'[^']+'" | tr -d "'" | sort)
|
||||
# expect: no output
|
||||
node scripts/security/check-lockfiles.js # expect: exit 0
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## CodeQL
|
||||
|
||||
### `js/incomplete-sanitization` in test files
|
||||
|
||||
One alert is on `GDevelop.js/__tests__/ExpressionCompletionFinder.spec.js:21`. The
|
||||
string being escaped is test input, not production data. Dismiss with
|
||||
`False positive` in the CodeQL UI and leave a comment in the file.
|
||||
|
||||
### `js/disabling-electron-websecurity`
|
||||
|
||||
The two alerts on `newIDE/electron-app/app/main.js` and
|
||||
`LocalExternalEditorWindow.js` are intentional — the local-external-editor window
|
||||
needs `webSecurity: false` to load user-supplied game previews from `file://` URLs.
|
||||
Dismiss with `Used in tests` plus a code comment pointing at `BUILD.md`.
|
||||
|
||||
---
|
||||
|
||||
## Google API key secret alerts
|
||||
|
||||
Upstream-owned secrets this fork **cannot** dismiss (no permission to revoke). They
|
||||
remain in the Security tab until upstream purges them from history. This branch
|
||||
stops re-leaking them via the env-var pattern documented in `SECRETS.md`.
|
||||
|
||||
+535
-9
@@ -863,9 +863,6 @@
|
||||
"x64"
|
||||
],
|
||||
"dev": true,
|
||||
"libc": [
|
||||
"glibc"
|
||||
],
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
@@ -915,6 +912,14 @@
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/@types/json-schema": {
|
||||
"version": "7.0.15",
|
||||
"resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
|
||||
"integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/@types/mocha": {
|
||||
"version": "5.2.7",
|
||||
"resolved": "https://registry.npmjs.org/@types/mocha/-/mocha-5.2.7.tgz",
|
||||
@@ -958,6 +963,198 @@
|
||||
"@types/node": "*"
|
||||
}
|
||||
},
|
||||
"node_modules/@webassemblyjs/ast": {
|
||||
"version": "1.14.1",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/ast/-/ast-1.14.1.tgz",
|
||||
"integrity": "sha512-nuBEDgQfm1ccRp/8bCQrx1frohyufl4JlbMMZ4P1wpeOfDhF6FQkxZJ1b/e+PLwr6X1Nhw6OLme5usuBWYBvuQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@webassemblyjs/helper-numbers": "1.13.2",
|
||||
"@webassemblyjs/helper-wasm-bytecode": "1.13.2"
|
||||
}
|
||||
},
|
||||
"node_modules/@webassemblyjs/floating-point-hex-parser": {
|
||||
"version": "1.13.2",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.13.2.tgz",
|
||||
"integrity": "sha512-6oXyTOzbKxGH4steLbLNOu71Oj+C8Lg34n6CqRvqfS2O71BxY6ByfMDRhBytzknj9yGUPVJ1qIKhRlAwO1AovA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/@webassemblyjs/helper-api-error": {
|
||||
"version": "1.13.2",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/helper-api-error/-/helper-api-error-1.13.2.tgz",
|
||||
"integrity": "sha512-U56GMYxy4ZQCbDZd6JuvvNV/WFildOjsaWD3Tzzvmw/mas3cXzRJPMjP83JqEsgSbyrmaGjBfDtV7KDXV9UzFQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/@webassemblyjs/helper-buffer": {
|
||||
"version": "1.14.1",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/helper-buffer/-/helper-buffer-1.14.1.tgz",
|
||||
"integrity": "sha512-jyH7wtcHiKssDtFPRB+iQdxlDf96m0E39yb0k5uJVhFGleZFoNw1c4aeIcVUPPbXUVJ94wwnMOAqUHyzoEPVMA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/@webassemblyjs/helper-numbers": {
|
||||
"version": "1.13.2",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/helper-numbers/-/helper-numbers-1.13.2.tgz",
|
||||
"integrity": "sha512-FE8aCmS5Q6eQYcV3gI35O4J789wlQA+7JrqTTpJqn5emA4U2hvwJmvFRC0HODS+3Ye6WioDklgd6scJ3+PLnEA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@webassemblyjs/floating-point-hex-parser": "1.13.2",
|
||||
"@webassemblyjs/helper-api-error": "1.13.2",
|
||||
"@xtuc/long": "4.2.2"
|
||||
}
|
||||
},
|
||||
"node_modules/@webassemblyjs/helper-wasm-bytecode": {
|
||||
"version": "1.13.2",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.13.2.tgz",
|
||||
"integrity": "sha512-3QbLKy93F0EAIXLh0ogEVR6rOubA9AoZ+WRYhNbFyuB70j3dRdwH9g+qXhLAO0kiYGlg3TxDV+I4rQTr/YNXkA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/@webassemblyjs/helper-wasm-section": {
|
||||
"version": "1.14.1",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.14.1.tgz",
|
||||
"integrity": "sha512-ds5mXEqTJ6oxRoqjhWDU83OgzAYjwsCV8Lo/N+oRsNDmx/ZDpqalmrtgOMkHwxsG0iI//3BwWAErYRHtgn0dZw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@webassemblyjs/ast": "1.14.1",
|
||||
"@webassemblyjs/helper-buffer": "1.14.1",
|
||||
"@webassemblyjs/helper-wasm-bytecode": "1.13.2",
|
||||
"@webassemblyjs/wasm-gen": "1.14.1"
|
||||
}
|
||||
},
|
||||
"node_modules/@webassemblyjs/ieee754": {
|
||||
"version": "1.13.2",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/ieee754/-/ieee754-1.13.2.tgz",
|
||||
"integrity": "sha512-4LtOzh58S/5lX4ITKxnAK2USuNEvpdVV9AlgGQb8rJDHaLeHciwG4zlGr0j/SNWlr7x3vO1lDEsuePvtcDNCkw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@xtuc/ieee754": "^1.2.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@webassemblyjs/leb128": {
|
||||
"version": "1.13.2",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/leb128/-/leb128-1.13.2.tgz",
|
||||
"integrity": "sha512-Lde1oNoIdzVzdkNEAWZ1dZ5orIbff80YPdHx20mrHwHrVNNTjNr8E3xz9BdpcGqRQbAEa+fkrCb+fRFTl/6sQw==",
|
||||
"dev": true,
|
||||
"license": "Apache-2.0",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@xtuc/long": "4.2.2"
|
||||
}
|
||||
},
|
||||
"node_modules/@webassemblyjs/utf8": {
|
||||
"version": "1.13.2",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/utf8/-/utf8-1.13.2.tgz",
|
||||
"integrity": "sha512-3NQWGjKTASY1xV5m7Hr0iPeXD9+RDobLll3T9d2AO+g3my8xy5peVyjSag4I50mR1bBSN/Ct12lo+R9tJk0NZQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/@webassemblyjs/wasm-edit": {
|
||||
"version": "1.14.1",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-edit/-/wasm-edit-1.14.1.tgz",
|
||||
"integrity": "sha512-RNJUIQH/J8iA/1NzlE4N7KtyZNHi3w7at7hDjvRNm5rcUXa00z1vRz3glZoULfJ5mpvYhLybmVcwcjGrC1pRrQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@webassemblyjs/ast": "1.14.1",
|
||||
"@webassemblyjs/helper-buffer": "1.14.1",
|
||||
"@webassemblyjs/helper-wasm-bytecode": "1.13.2",
|
||||
"@webassemblyjs/helper-wasm-section": "1.14.1",
|
||||
"@webassemblyjs/wasm-gen": "1.14.1",
|
||||
"@webassemblyjs/wasm-opt": "1.14.1",
|
||||
"@webassemblyjs/wasm-parser": "1.14.1",
|
||||
"@webassemblyjs/wast-printer": "1.14.1"
|
||||
}
|
||||
},
|
||||
"node_modules/@webassemblyjs/wasm-gen": {
|
||||
"version": "1.14.1",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-gen/-/wasm-gen-1.14.1.tgz",
|
||||
"integrity": "sha512-AmomSIjP8ZbfGQhumkNvgC33AY7qtMCXnN6bL2u2Js4gVCg8fp735aEiMSBbDR7UQIj90n4wKAFUSEd0QN2Ukg==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@webassemblyjs/ast": "1.14.1",
|
||||
"@webassemblyjs/helper-wasm-bytecode": "1.13.2",
|
||||
"@webassemblyjs/ieee754": "1.13.2",
|
||||
"@webassemblyjs/leb128": "1.13.2",
|
||||
"@webassemblyjs/utf8": "1.13.2"
|
||||
}
|
||||
},
|
||||
"node_modules/@webassemblyjs/wasm-opt": {
|
||||
"version": "1.14.1",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-opt/-/wasm-opt-1.14.1.tgz",
|
||||
"integrity": "sha512-PTcKLUNvBqnY2U6E5bdOQcSM+oVP/PmrDY9NzowJjislEjwP/C4an2303MCVS2Mg9d3AJpIGdUFIQQWbPds0Sw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@webassemblyjs/ast": "1.14.1",
|
||||
"@webassemblyjs/helper-buffer": "1.14.1",
|
||||
"@webassemblyjs/wasm-gen": "1.14.1",
|
||||
"@webassemblyjs/wasm-parser": "1.14.1"
|
||||
}
|
||||
},
|
||||
"node_modules/@webassemblyjs/wasm-parser": {
|
||||
"version": "1.14.1",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-parser/-/wasm-parser-1.14.1.tgz",
|
||||
"integrity": "sha512-JLBl+KZ0R5qB7mCnud/yyX08jWFw5MsoalJ1pQ4EdFlgj9VdXKGuENGsiCIjegI1W7p91rUlcB/LB5yRJKNTcQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@webassemblyjs/ast": "1.14.1",
|
||||
"@webassemblyjs/helper-api-error": "1.13.2",
|
||||
"@webassemblyjs/helper-wasm-bytecode": "1.13.2",
|
||||
"@webassemblyjs/ieee754": "1.13.2",
|
||||
"@webassemblyjs/leb128": "1.13.2",
|
||||
"@webassemblyjs/utf8": "1.13.2"
|
||||
}
|
||||
},
|
||||
"node_modules/@webassemblyjs/wast-printer": {
|
||||
"version": "1.14.1",
|
||||
"resolved": "https://registry.npmjs.org/@webassemblyjs/wast-printer/-/wast-printer-1.14.1.tgz",
|
||||
"integrity": "sha512-kPSSXE6De1XOR820C90RIo2ogvZG+c3KiHzqUoO/F34Y2shGzesfqv7o57xrxovZJH/MetF5UjroJ/R/3isoiw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@webassemblyjs/ast": "1.14.1",
|
||||
"@xtuc/long": "4.2.2"
|
||||
}
|
||||
},
|
||||
"node_modules/@xtuc/ieee754": {
|
||||
"version": "1.2.0",
|
||||
"resolved": "https://registry.npmjs.org/@xtuc/ieee754/-/ieee754-1.2.0.tgz",
|
||||
"integrity": "sha512-DX8nKgqcGwsc0eJSqYt5lwP4DH5FlHnmuWWBRy7X0NcaGR0ZtuyeESgMwTYVEtxmsNGY+qit4QYT/MIYTOTPeA==",
|
||||
"dev": true,
|
||||
"license": "BSD-3-Clause",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/@xtuc/long": {
|
||||
"version": "4.2.2",
|
||||
"resolved": "https://registry.npmjs.org/@xtuc/long/-/long-4.2.2.tgz",
|
||||
"integrity": "sha512-NuHqBY1PB/D8xU6s/thBgOAiAP7HOYDQ32+BFZILJ8ivkUkAHQnWfn6WhL79Owj1qmUnoN/YPhktdIoucipkAQ==",
|
||||
"dev": true,
|
||||
"license": "Apache-2.0",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/accepts": {
|
||||
"version": "1.3.8",
|
||||
"resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
|
||||
@@ -998,6 +1195,57 @@
|
||||
"node": ">=0.4.0"
|
||||
}
|
||||
},
|
||||
"node_modules/ajv": {
|
||||
"version": "8.20.0",
|
||||
"resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
|
||||
"integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"fast-deep-equal": "^3.1.3",
|
||||
"fast-uri": "^3.0.1",
|
||||
"json-schema-traverse": "^1.0.0",
|
||||
"require-from-string": "^2.0.2"
|
||||
},
|
||||
"funding": {
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/epoberezkin"
|
||||
}
|
||||
},
|
||||
"node_modules/ajv-formats": {
|
||||
"version": "3.0.1",
|
||||
"resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
|
||||
"integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"ajv": "^8.0.0"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"ajv": "^8.0.0"
|
||||
},
|
||||
"peerDependenciesMeta": {
|
||||
"ajv": {
|
||||
"optional": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"node_modules/ajv-keywords": {
|
||||
"version": "5.1.0",
|
||||
"resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-5.1.0.tgz",
|
||||
"integrity": "sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"fast-deep-equal": "^3.1.3"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"ajv": "^8.8.2"
|
||||
}
|
||||
},
|
||||
"node_modules/ansi-colors": {
|
||||
"version": "3.2.3",
|
||||
"resolved": "https://registry.npmjs.org/ansi-colors/-/ansi-colors-3.2.3.tgz",
|
||||
@@ -1708,6 +1956,17 @@
|
||||
"fsevents": "~2.3.2"
|
||||
}
|
||||
},
|
||||
"node_modules/chrome-trace-event": {
|
||||
"version": "1.0.4",
|
||||
"resolved": "https://registry.npmjs.org/chrome-trace-event/-/chrome-trace-event-1.0.4.tgz",
|
||||
"integrity": "sha512-rNjApaLzuwaOTjCiT8lSDdGN1APCiqkChLMJxJPWLunPAt5fy8xgU9/jNOchV84wfIxrA0lRQB7oCT8jrn/wrQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"engines": {
|
||||
"node": ">=6.0"
|
||||
}
|
||||
},
|
||||
"node_modules/cipher-base": {
|
||||
"version": "1.0.7",
|
||||
"resolved": "https://registry.npmjs.org/cipher-base/-/cipher-base-1.0.7.tgz",
|
||||
@@ -2378,9 +2637,9 @@
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/enhanced-resolve": {
|
||||
"version": "5.24.5",
|
||||
"resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.24.5.tgz",
|
||||
"integrity": "sha512-L1l8TNvomm6UVW5B253AGxQagSQr+vGwhMlrrfRS2qmhx46AMpMVJKQYLvWYbysTMY8VoicOvzHzoHMbyzB+4A==",
|
||||
"version": "5.25.1",
|
||||
"resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.25.1.tgz",
|
||||
"integrity": "sha512-nGXts5znJzmWPu+mIE9izCOzdg63oJca2mDzGWWTth7sr4aCToKcoyFVBQwN75Ij5Pf6p510EwkTqViTRzDV+w==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
@@ -2520,6 +2779,14 @@
|
||||
"node": ">= 0.4"
|
||||
}
|
||||
},
|
||||
"node_modules/es-module-lexer": {
|
||||
"version": "2.3.2",
|
||||
"resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz",
|
||||
"integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/es-object-atoms": {
|
||||
"version": "1.1.2",
|
||||
"resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
|
||||
@@ -2643,6 +2910,32 @@
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/fast-deep-equal": {
|
||||
"version": "3.1.3",
|
||||
"resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
|
||||
"integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/fast-uri": {
|
||||
"version": "3.1.8",
|
||||
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
|
||||
"integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
|
||||
"dev": true,
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/fastify"
|
||||
},
|
||||
{
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/fastify"
|
||||
}
|
||||
],
|
||||
"license": "BSD-3-Clause",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/fill-range": {
|
||||
"version": "7.1.1",
|
||||
"resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
|
||||
@@ -4018,6 +4311,14 @@
|
||||
"node": ">=6"
|
||||
}
|
||||
},
|
||||
"node_modules/json-schema-traverse": {
|
||||
"version": "1.0.0",
|
||||
"resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
|
||||
"integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/json-stringify-safe": {
|
||||
"version": "5.0.1",
|
||||
"resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
|
||||
@@ -4478,6 +4779,113 @@
|
||||
"url": "https://github.com/sponsors/ljharb"
|
||||
}
|
||||
},
|
||||
"node_modules/minimizer-webpack-plugin": {
|
||||
"version": "5.11.0",
|
||||
"resolved": "https://registry.npmjs.org/minimizer-webpack-plugin/-/minimizer-webpack-plugin-5.11.0.tgz",
|
||||
"integrity": "sha512-2JVy2DY+iBtfRyrQB5cRM7lfurnJIi6jFTgLip/7FxDu0WxswrIRzr4fBySQ0X7HqM7BcwE28zm+HfQ5V6y4Cg==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@jridgewell/trace-mapping": "^0.3.31",
|
||||
"jest-worker": "^27.4.5",
|
||||
"schema-utils": "^4.3.3",
|
||||
"terser": "^5.51.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 10.13.0"
|
||||
},
|
||||
"funding": {
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/webpack"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"webpack": "^5.1.0"
|
||||
},
|
||||
"peerDependenciesMeta": {
|
||||
"@minify-html/node": {
|
||||
"optional": true
|
||||
},
|
||||
"@napi-rs/image": {
|
||||
"optional": true
|
||||
},
|
||||
"@swc/core": {
|
||||
"optional": true
|
||||
},
|
||||
"@swc/css": {
|
||||
"optional": true
|
||||
},
|
||||
"@swc/html": {
|
||||
"optional": true
|
||||
},
|
||||
"clean-css": {
|
||||
"optional": true
|
||||
},
|
||||
"cssnano": {
|
||||
"optional": true
|
||||
},
|
||||
"csso": {
|
||||
"optional": true
|
||||
},
|
||||
"esbuild": {
|
||||
"optional": true
|
||||
},
|
||||
"html-minifier-terser": {
|
||||
"optional": true
|
||||
},
|
||||
"imagemin": {
|
||||
"optional": true
|
||||
},
|
||||
"lightningcss": {
|
||||
"optional": true
|
||||
},
|
||||
"postcss": {
|
||||
"optional": true
|
||||
},
|
||||
"sharp": {
|
||||
"optional": true
|
||||
},
|
||||
"svgo": {
|
||||
"optional": true
|
||||
},
|
||||
"uglify-js": {
|
||||
"optional": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"node_modules/minimizer-webpack-plugin/node_modules/jest-worker": {
|
||||
"version": "27.5.1",
|
||||
"resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-27.5.1.tgz",
|
||||
"integrity": "sha512-7vuh85V5cdDofPyxn58nrPjBktZo0u9x1g8WtjQol+jZDaE+fhN+cIvTj11GndBnMnyfrUOG1sZQxCdjKh+DKg==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@types/node": "*",
|
||||
"merge-stream": "^2.0.0",
|
||||
"supports-color": "^8.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 10.13.0"
|
||||
}
|
||||
},
|
||||
"node_modules/minimizer-webpack-plugin/node_modules/supports-color": {
|
||||
"version": "8.1.1",
|
||||
"resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
|
||||
"integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"has-flag": "^4.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=10"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/chalk/supports-color?sponsor=1"
|
||||
}
|
||||
},
|
||||
"node_modules/mkdirp": {
|
||||
"version": "0.5.6",
|
||||
"resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
|
||||
@@ -5375,6 +5783,17 @@
|
||||
"node": ">=0.10.0"
|
||||
}
|
||||
},
|
||||
"node_modules/require-from-string": {
|
||||
"version": "2.0.2",
|
||||
"resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
|
||||
"integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"engines": {
|
||||
"node": ">=0.10.0"
|
||||
}
|
||||
},
|
||||
"node_modules/require-main-filename": {
|
||||
"version": "2.0.0",
|
||||
"resolved": "https://registry.npmjs.org/require-main-filename/-/require-main-filename-2.0.0.tgz",
|
||||
@@ -5628,6 +6047,27 @@
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/schema-utils": {
|
||||
"version": "4.5.0",
|
||||
"resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.5.0.tgz",
|
||||
"integrity": "sha512-zJlMCZ0cAR5p/Y4oVpRoqioDMJcGxaXRrQ/4rP4WyR84vc5z/DolXdbvXeDpTwbtocDFr2rhPqHPErDCUtz2kA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@types/json-schema": "^7.0.15",
|
||||
"ajv": "^8.20.0",
|
||||
"ajv-formats": "^3.0.1",
|
||||
"ajv-keywords": "^5.1.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 10.13.0"
|
||||
},
|
||||
"funding": {
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/webpack"
|
||||
}
|
||||
},
|
||||
"node_modules/semver": {
|
||||
"version": "6.3.1",
|
||||
"resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
|
||||
@@ -6187,9 +6627,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/terser": {
|
||||
"version": "5.50.0",
|
||||
"resolved": "https://registry.npmjs.org/terser/-/terser-5.50.0.tgz",
|
||||
"integrity": "sha512-CN9BVxWhgS/hRxtUMjtC2uRWSTcSfQFHMDWma6sKKfIivCD91sM+FOPfvwoaRMqCSrUpe1nv3jDamd9eEQ4y+w==",
|
||||
"version": "5.51.2",
|
||||
"resolved": "https://registry.npmjs.org/terser/-/terser-5.51.2.tgz",
|
||||
"integrity": "sha512-bWnjSNscmuI+GJze6ZupnHP8G/cTcsJF+bXCeQknk2SHQsgbNJnLrqiH9jZ2W4STPVXH2mDKKRX3iwPhc9Cn/Q==",
|
||||
"dev": true,
|
||||
"license": "BSD-2-Clause",
|
||||
"dependencies": {
|
||||
@@ -6658,6 +7098,20 @@
|
||||
"node": ">=0.10.0"
|
||||
}
|
||||
},
|
||||
"node_modules/watchpack": {
|
||||
"version": "2.5.2",
|
||||
"resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.5.2.tgz",
|
||||
"integrity": "sha512-6i/00NBjP4yGPs+caKSyRfpTF/8Torsu0MOW3mMzIbhgISFder8i7xbqgHlLMwJrdiN8ndBV3UA1/AfzPSr+jg==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"graceful-fs": "^4.1.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=10.13.0"
|
||||
}
|
||||
},
|
||||
"node_modules/wcwidth": {
|
||||
"version": "1.0.1",
|
||||
"resolved": "https://registry.npmjs.org/wcwidth/-/wcwidth-1.0.1.tgz",
|
||||
@@ -6668,6 +7122,78 @@
|
||||
"defaults": "^1.0.3"
|
||||
}
|
||||
},
|
||||
"node_modules/webpack": {
|
||||
"version": "5.111.1",
|
||||
"resolved": "https://registry.npmjs.org/webpack/-/webpack-5.111.1.tgz",
|
||||
"integrity": "sha512-cNypaz0RP+S4cvQVi1M/3bRUkvNP0xZpL0TjFx+c6jg64VbxD+2weWDgY9UnjRI6dhZgtaj8DU76GGFcJ79xPQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@types/estree": "^1.0.8",
|
||||
"@types/json-schema": "^7.0.15",
|
||||
"@webassemblyjs/ast": "^1.14.1",
|
||||
"@webassemblyjs/wasm-edit": "^1.14.1",
|
||||
"@webassemblyjs/wasm-parser": "^1.14.1",
|
||||
"browserslist": "^4.28.1",
|
||||
"chrome-trace-event": "^1.0.2",
|
||||
"enhanced-resolve": "^5.25.0",
|
||||
"es-module-lexer": "^2.1.0",
|
||||
"events": "^3.2.0",
|
||||
"graceful-fs": "^4.2.11",
|
||||
"mime-db": "^1.54.0",
|
||||
"minimizer-webpack-plugin": "^5.7.0",
|
||||
"schema-utils": "^4.5.0",
|
||||
"tapable": "^2.3.0",
|
||||
"watchpack": "^2.5.2",
|
||||
"webpack-sources": "^3.5.1"
|
||||
},
|
||||
"bin": {
|
||||
"webpack": "bin/webpack.js"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=10.13.0"
|
||||
},
|
||||
"funding": {
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/webpack"
|
||||
},
|
||||
"peerDependenciesMeta": {
|
||||
"webpack-cli": {
|
||||
"optional": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"node_modules/webpack-sources": {
|
||||
"version": "3.5.1",
|
||||
"resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.5.1.tgz",
|
||||
"integrity": "sha512-jyuiGJdtvY434z5bUZrjz67v76/ePNvFZTp9Mdz29IlH4+GPsgyGjiv0fKI+M7BdkU6ADjulUcKAd3tUK3WlEw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"engines": {
|
||||
"node": ">=10.13.0"
|
||||
}
|
||||
},
|
||||
"node_modules/webpack/node_modules/@types/estree": {
|
||||
"version": "1.0.9",
|
||||
"resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
|
||||
"integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/webpack/node_modules/mime-db": {
|
||||
"version": "1.54.0",
|
||||
"resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
|
||||
"integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/which": {
|
||||
"version": "1.3.1",
|
||||
"resolved": "https://registry.npmjs.org/which/-/which-1.3.1.tgz",
|
||||
|
||||
Generated
+3
-3
@@ -12704,9 +12704,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/adm-zip": {
|
||||
"version": "0.6.0",
|
||||
"resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.0.tgz",
|
||||
"integrity": "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg==",
|
||||
"version": "0.6.1",
|
||||
"resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.1.tgz",
|
||||
"integrity": "sha512-Xwrja8nx9e5o2N1my4DsKCeKpdrnACyr1wtbPxBDgGzKzKyE9kRtBFA8mWldI+RVlD7CBZNWY/wQ2+ydwOR6kQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
|
||||
+13
@@ -2846,6 +2846,19 @@
|
||||
"node": ">= 8.0"
|
||||
}
|
||||
},
|
||||
"node_modules/sumchecker": {
|
||||
"version": "3.0.1",
|
||||
"resolved": "https://registry.npmjs.org/sumchecker/-/sumchecker-3.0.1.tgz",
|
||||
"integrity": "sha512-MvjXzkz/BOfyVDkG0oFOtBxHX2u3gKbMHIF/dXblZsgD3BWOFLmHovIpZY7BykJdAjcqRCBi1WYBNdEC9yI7vg==",
|
||||
"license": "Apache-2.0",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"debug": "^4.1.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 8.0"
|
||||
}
|
||||
},
|
||||
"node_modules/tar-stream": {
|
||||
"version": "3.2.1",
|
||||
"resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.2.1.tgz",
|
||||
|
||||
Generated
+203
-16
@@ -28,7 +28,6 @@
|
||||
"version": "1.0.5",
|
||||
"resolved": "https://registry.npmjs.org/@electron-internal/extract-zip/-/extract-zip-1.0.5.tgz",
|
||||
"integrity": "sha512-+bqFCP98pLI0Tt0XQo1TmlXtwjWchISndDOxCkEcIuUgXWpBnLyRI+2DU+mesvnMMX6L1XDqYNA0lXNDHd/yiA==",
|
||||
"dev": true,
|
||||
"license": "BSD-2-Clause",
|
||||
"engines": {
|
||||
"node": ">=22.12.0"
|
||||
@@ -110,7 +109,6 @@
|
||||
"version": "5.1.0",
|
||||
"resolved": "https://registry.npmjs.org/@electron/get/-/get-5.1.0.tgz",
|
||||
"integrity": "sha512-3kSBtG8ObcTVfXanm5vVJ6UnBLEVmVsRk1M+vGqCuMBV+XLCbJYuWQful+yIy0GQDsSlK0kHEriEHn7SPk4EnA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"debug": "^4.1.1",
|
||||
@@ -131,7 +129,6 @@
|
||||
"version": "3.0.0",
|
||||
"resolved": "https://registry.npmjs.org/env-paths/-/env-paths-3.0.0.tgz",
|
||||
"integrity": "sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": "^12.20.0 || ^14.13.1 || >=16.0.0"
|
||||
@@ -144,7 +141,6 @@
|
||||
"version": "7.8.5",
|
||||
"resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
|
||||
"integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
|
||||
"dev": true,
|
||||
"license": "ISC",
|
||||
"bin": {
|
||||
"semver": "bin/semver.js"
|
||||
@@ -157,7 +153,6 @@
|
||||
"version": "7.29.1",
|
||||
"resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz",
|
||||
"integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"engines": {
|
||||
@@ -370,6 +365,72 @@
|
||||
"node": ">= 10.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@electron/windows-sign": {
|
||||
"version": "1.2.2",
|
||||
"resolved": "https://registry.npmjs.org/@electron/windows-sign/-/windows-sign-1.2.2.tgz",
|
||||
"integrity": "sha512-dfZeox66AvdPtb2lD8OsIIQh12Tp0GNCRUDfBHIKGpbmopZto2/A8nSpYYLoedPIHpqkeblZ/k8OV0Gy7PYuyQ==",
|
||||
"dev": true,
|
||||
"license": "BSD-2-Clause",
|
||||
"optional": true,
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"cross-dirname": "^0.1.0",
|
||||
"debug": "^4.3.4",
|
||||
"fs-extra": "^11.1.1",
|
||||
"minimist": "^1.2.8",
|
||||
"postject": "^1.0.0-alpha.6"
|
||||
},
|
||||
"bin": {
|
||||
"electron-windows-sign": "bin/electron-windows-sign.js"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=14.14"
|
||||
}
|
||||
},
|
||||
"node_modules/@electron/windows-sign/node_modules/fs-extra": {
|
||||
"version": "11.4.0",
|
||||
"resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.4.0.tgz",
|
||||
"integrity": "sha512-EQsFzMUJkCKGr1ePqlYADkIUmHW1s3ZXr5Yqy6wbGrfUCphpl2maM/kyOIRA2HpP3AaFQTZXD4ldjek+nccddA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"graceful-fs": "^4.2.0",
|
||||
"jsonfile": "^6.0.1",
|
||||
"universalify": "^2.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=14.14"
|
||||
}
|
||||
},
|
||||
"node_modules/@electron/windows-sign/node_modules/jsonfile": {
|
||||
"version": "6.2.1",
|
||||
"resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
|
||||
"integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"universalify": "^2.0.0"
|
||||
},
|
||||
"optionalDependencies": {
|
||||
"graceful-fs": "^4.1.6"
|
||||
}
|
||||
},
|
||||
"node_modules/@electron/windows-sign/node_modules/universalify": {
|
||||
"version": "2.0.1",
|
||||
"resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
|
||||
"integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"peer": true,
|
||||
"engines": {
|
||||
"node": ">= 10.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@malept/cross-spawn-promise": {
|
||||
"version": "2.0.0",
|
||||
"resolved": "https://registry.npmjs.org/@malept/cross-spawn-promise/-/cross-spawn-promise-2.0.0.tgz",
|
||||
@@ -664,9 +725,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/adm-zip": {
|
||||
"version": "0.6.0",
|
||||
"resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.0.tgz",
|
||||
"integrity": "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg==",
|
||||
"version": "0.6.1",
|
||||
"resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.1.tgz",
|
||||
"integrity": "sha512-Xwrja8nx9e5o2N1my4DsKCeKpdrnACyr1wtbPxBDgGzKzKyE9kRtBFA8mWldI+RVlD7CBZNWY/wQ2+ydwOR6kQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
@@ -1303,6 +1364,15 @@
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/cross-dirname": {
|
||||
"version": "0.1.0",
|
||||
"resolved": "https://registry.npmjs.org/cross-dirname/-/cross-dirname-0.1.0.tgz",
|
||||
"integrity": "sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"peer": true
|
||||
},
|
||||
"node_modules/cross-spawn": {
|
||||
"version": "7.0.6",
|
||||
"resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
|
||||
@@ -1345,7 +1415,6 @@
|
||||
"version": "2.6.9",
|
||||
"resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
|
||||
"integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"ms": "2.0.0"
|
||||
@@ -1586,7 +1655,6 @@
|
||||
"version": "44.4.3",
|
||||
"resolved": "https://registry.npmjs.org/electron/-/electron-44.4.3.tgz",
|
||||
"integrity": "sha512-LTpSFTB40qVCXIX5xMo+cgHI/Jjkbjw7VpB26PccEbroqOn72LBukeaDwPVo1fBYzSzs0c9iPuAucFCO7Tw81Q==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@electron-internal/extract-zip": "^1.0.1",
|
||||
@@ -1627,6 +1695,19 @@
|
||||
"node": ">=14.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/electron-builder-squirrel-windows": {
|
||||
"version": "26.15.3",
|
||||
"resolved": "https://registry.npmjs.org/electron-builder-squirrel-windows/-/electron-builder-squirrel-windows-26.15.3.tgz",
|
||||
"integrity": "sha512-Jc19XPV9y9+2bAdZPkXuVNGNIEFBq9poHC61l8Kv6FdK7DRG3+Ic0rerC0DXOaeHNz8yW0fg/JnF8GQROOF5MA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"app-builder-lib": "26.15.3",
|
||||
"builder-util": "26.15.3",
|
||||
"electron-winstaller": "5.4.0"
|
||||
}
|
||||
},
|
||||
"node_modules/electron-builder/node_modules/fs-extra": {
|
||||
"version": "10.1.0",
|
||||
"dev": true,
|
||||
@@ -1729,11 +1810,32 @@
|
||||
"node": ">= 10.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/electron-winstaller": {
|
||||
"version": "5.4.0",
|
||||
"resolved": "https://registry.npmjs.org/electron-winstaller/-/electron-winstaller-5.4.0.tgz",
|
||||
"integrity": "sha512-bO3y10YikuUwUuDUQRM4KfwNkKhnpVO7IPdbsrejwN9/AABJzzTQ4GeHwyzNSrVO+tEH3/Np255a3sVZpZDjvg==",
|
||||
"dev": true,
|
||||
"hasInstallScript": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@electron/asar": "^3.2.1",
|
||||
"debug": "^4.1.1",
|
||||
"fs-extra": "^7.0.1",
|
||||
"lodash": "^4.17.21",
|
||||
"temp": "^0.9.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=8.0.0"
|
||||
},
|
||||
"optionalDependencies": {
|
||||
"@electron/windows-sign": "^1.1.2"
|
||||
}
|
||||
},
|
||||
"node_modules/electron/node_modules/@types/node": {
|
||||
"version": "24.13.5",
|
||||
"resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.5.tgz",
|
||||
"integrity": "sha512-TXyindR+lBr22aJIdMQzCFHPHR6cR4js838mRDCSz5hOKWZvZwsXSSiXDmjRj4iJmgl+sR9O+1mkoVBSMadNug==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"undici-types": "~7.18.0"
|
||||
@@ -1743,7 +1845,6 @@
|
||||
"version": "7.18.2",
|
||||
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
|
||||
"integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/emoji-regex": {
|
||||
@@ -2065,6 +2166,22 @@
|
||||
"node": ">= 6"
|
||||
}
|
||||
},
|
||||
"node_modules/fs-extra": {
|
||||
"version": "7.0.1",
|
||||
"resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-7.0.1.tgz",
|
||||
"integrity": "sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"graceful-fs": "^4.1.2",
|
||||
"jsonfile": "^4.0.0",
|
||||
"universalify": "^0.1.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=6 <7 || >=8"
|
||||
}
|
||||
},
|
||||
"node_modules/fs-minipass": {
|
||||
"version": "2.1.0",
|
||||
"resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz",
|
||||
@@ -2290,7 +2407,6 @@
|
||||
},
|
||||
"node_modules/graceful-fs": {
|
||||
"version": "4.2.11",
|
||||
"dev": true,
|
||||
"license": "ISC"
|
||||
},
|
||||
"node_modules/has-flag": {
|
||||
@@ -2784,7 +2900,6 @@
|
||||
"version": "2.0.0",
|
||||
"resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
|
||||
"integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/nice-try": {
|
||||
@@ -3121,6 +3236,36 @@
|
||||
"node": ">=10.4.0"
|
||||
}
|
||||
},
|
||||
"node_modules/postject": {
|
||||
"version": "1.0.0-alpha.6",
|
||||
"resolved": "https://registry.npmjs.org/postject/-/postject-1.0.0-alpha.6.tgz",
|
||||
"integrity": "sha512-b9Eb8h2eVqNE8edvKdwqkrY6O7kAwmI8kcnBv1NScolYJbo59XUF0noFq+lxbC1yN20bmC0WBEbDC5H/7ASb0A==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"commander": "^9.4.0"
|
||||
},
|
||||
"bin": {
|
||||
"postject": "dist/cli.js"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=14.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/postject/node_modules/commander": {
|
||||
"version": "9.5.0",
|
||||
"resolved": "https://registry.npmjs.org/commander/-/commander-9.5.0.tgz",
|
||||
"integrity": "sha512-KRs7WVDKg86PWiuAqhDrAQnTXZKraVcCc6vFdL14qrZ/DcWwuRo7VoiYXalXO7S5GKpqYiVEwCbgFDfxNHKJBQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"peer": true,
|
||||
"engines": {
|
||||
"node": "^12.20.0 || >=14"
|
||||
}
|
||||
},
|
||||
"node_modules/prettier": {
|
||||
"version": "3.9.8",
|
||||
"resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.8.tgz",
|
||||
@@ -3156,7 +3301,6 @@
|
||||
},
|
||||
"node_modules/progress": {
|
||||
"version": "2.0.3",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=0.4.0"
|
||||
@@ -3370,6 +3514,21 @@
|
||||
"node": ">=0.10.0"
|
||||
}
|
||||
},
|
||||
"node_modules/rimraf": {
|
||||
"version": "2.6.3",
|
||||
"resolved": "https://registry.npmjs.org/rimraf/-/rimraf-2.6.3.tgz",
|
||||
"integrity": "sha512-mwqeW5XsA2qAejG46gYdENaxXjx9onRNCfn7L0duuP4hCuTIi/QO7PDK07KJfp1d+izWPrzEJDcSqBa0OZQriA==",
|
||||
"deprecated": "Rimraf versions prior to v4 are no longer supported",
|
||||
"dev": true,
|
||||
"license": "ISC",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"glob": "^7.1.3"
|
||||
},
|
||||
"bin": {
|
||||
"rimraf": "bin.js"
|
||||
}
|
||||
},
|
||||
"node_modules/roarr": {
|
||||
"version": "2.15.4",
|
||||
"dev": true,
|
||||
@@ -3626,7 +3785,6 @@
|
||||
},
|
||||
"node_modules/sumchecker": {
|
||||
"version": "3.0.1",
|
||||
"dev": true,
|
||||
"license": "Apache-2.0",
|
||||
"dependencies": {
|
||||
"debug": "^4.1.0"
|
||||
@@ -3704,6 +3862,21 @@
|
||||
"node": ">=8"
|
||||
}
|
||||
},
|
||||
"node_modules/temp": {
|
||||
"version": "0.9.4",
|
||||
"resolved": "https://registry.npmjs.org/temp/-/temp-0.9.4.tgz",
|
||||
"integrity": "sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"mkdirp": "^0.5.1",
|
||||
"rimraf": "~2.6.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=6.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/temp-file": {
|
||||
"version": "3.4.0",
|
||||
"resolved": "https://registry.npmjs.org/temp-file/-/temp-file-3.4.0.tgz",
|
||||
@@ -3753,6 +3926,20 @@
|
||||
"node": ">= 10.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/temp/node_modules/mkdirp": {
|
||||
"version": "0.5.6",
|
||||
"resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
|
||||
"integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"minimist": "^1.2.6"
|
||||
},
|
||||
"bin": {
|
||||
"mkdirp": "bin/cmd.js"
|
||||
}
|
||||
},
|
||||
"node_modules/tiny-async-pool": {
|
||||
"version": "1.3.0",
|
||||
"resolved": "https://registry.npmjs.org/tiny-async-pool/-/tiny-async-pool-1.3.0.tgz",
|
||||
|
||||
@@ -92,6 +92,7 @@ const lockfiles = [
|
||||
'newIDE/electron-app/package-lock.json',
|
||||
'newIDE/electron-app/app/package-lock.json',
|
||||
'newIDE/web-app/package-lock.json',
|
||||
'newIDE/visual-tests/package-lock.json',
|
||||
'SharedLibs/TileMapHelper/package-lock.json',
|
||||
'SharedLibs/ThreeAddons/package-lock.json',
|
||||
];
|
||||
|
||||
Reference in New Issue
Block a user