From b8a7830f1c61234755eeab53522302b17b0508b7 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Tue, 20 Oct 2026 23:29:17 -0700 Subject: [PATCH 01/12] quest(m1): claim audit-deps Co-Authored-By: Claude Opus 5.5 From ae92f6912edb35bfabbe7188e05c2ff97879c6fd Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Tue, 20 Oct 2026 23:32:00 -0700 Subject: [PATCH 02/12] fix(deps): take the rustls-webpki and webpki-roots emSign fixes RUSTSEC-2026-0381, 0382, and 0383: rustls-webpki 0.103.16 rejects the distrusted emSign intermediates, and webpki-roots / webpki-root-certs 1.0.10 drop the emSign ECC root. Security fixes bypass the cooldown. Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index a51cdadcec9..fec7d957116 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1959,7 +1959,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c54e03a951783e8b327515db3f2a2fd0e3bed362a96b066f341ce66ed49b4ead" dependencies = [ "data-encoding", - "syn 3.0.6", + "syn 1.0.109", ] [[package]] @@ -3863,7 +3863,7 @@ dependencies = [ "tokio-websockets", "tracing", "url", - "webpki-roots 1.0.9", + "webpki-roots 1.0.10", "ws_stream_wasm", ] @@ -5368,7 +5368,7 @@ dependencies = [ "web-transport-iroh", "web-transport-proto", "web-transport-trait", - "webpki-roots 1.0.9", + "webpki-roots 1.0.10", "x509-parser", ] @@ -5602,7 +5602,7 @@ dependencies = [ "tokio", "tokio-rustls", "tracing", - "webpki-roots 1.0.9", + "webpki-roots 1.0.10", ] [[package]] @@ -8195,7 +8195,7 @@ dependencies = [ "serde", "serde_json", "thiserror 2.0.21", - "webpki-roots 1.0.9", + "webpki-roots 1.0.10", "x509-parser", ] @@ -8250,9 +8250,9 @@ checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -9626,7 +9626,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.3", + "getrandom 0.3.4", "once_cell", "rustix 1.1.5", "windows-sys 0.61.2", @@ -11128,9 +11128,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] @@ -11141,14 +11141,14 @@ version = "0.26.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" dependencies = [ - "webpki-roots 1.0.9", + "webpki-roots 1.0.10", ] [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] From f4380c80f5a1b3c501626f868028a415c81d20d2 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Tue, 20 Oct 2026 23:33:17 -0700 Subject: [PATCH 03/12] fix(infra): refresh the nix Worker lock past the sharp advisory infra/nix pinned wrangler 4.147 and its miniflare's sharp 0.35.4 (GHSA-wq5f-xc86-pv6w). Resolved with a 7-day minimum release age, matching the Dependabot cooldown. Co-Authored-By: Claude Opus 5.5 --- infra/nix/bun.lock | 130 ++++++++++++++++++++++----------------------- 1 file changed, 65 insertions(+), 65 deletions(-) diff --git a/infra/nix/bun.lock b/infra/nix/bun.lock index c360c1dc66d..24d4dc24169 100644 --- a/infra/nix/bun.lock +++ b/infra/nix/bun.lock @@ -16,131 +16,131 @@ "@cloudflare/unenv-preset": ["@cloudflare/unenv-preset@2.16.2", "", { "peerDependencies": { "unenv": "2.0.0-rc.24", "workerd": ">1.20260305.0 <2.0.0-0" }, "optionalPeers": ["workerd"] }, "sha512-JBP1+Z7ZSNG/d4mRP+y8VC5dka3tZVMLEZRvS+rzQ4DGV1EoxRFQckcJTTkXbHSQiTj0DtNI01Zwb/V2fX0mvQ=="], - "@cloudflare/workerd-darwin-64": ["@cloudflare/workerd-darwin-64@1.20261001.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-4cgSgDf28JSw/P5Dj5GCS59hzVqS5XnmGAWNkvYHLI6ODU9idGaMMNEuhJXDkEG/lsABmlVlnCgsdh2VbKWepw=="], + "@cloudflare/workerd-darwin-64": ["@cloudflare/workerd-darwin-64@1.20261012.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-dkTL9aY3V4D40b+jBpGPCistWUPFQ/M61wlWi6i1o8MvHFFgEw7EQkcaYEv6Yd3bkPDD/3TFT4hRsMb2xVZSwQ=="], - "@cloudflare/workerd-darwin-arm64": ["@cloudflare/workerd-darwin-arm64@1.20261001.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-8ulAWruEVouNmEIsQsy9WSSCS9zkLu93W2MTwp5esiFyoPp05BNSVFIFsYSPi1pkFmBBd7fsnwMpbLkaJLaVPQ=="], + "@cloudflare/workerd-darwin-arm64": ["@cloudflare/workerd-darwin-arm64@1.20261012.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-2/nVGcKXjNNI+DhxKSepTKvFng9H7aN2WXv6Zu67iqgI6JrxypNt5kTPv4ZHosxrcfyKMci/2RfN7GIrN0BitQ=="], - "@cloudflare/workerd-linux-64": ["@cloudflare/workerd-linux-64@1.20261001.1", "", { "os": "linux", "cpu": "x64" }, "sha512-kZbTZJGrhsMOdqZ2BIybjaBRLZjYsRLWj7mcNw/6Y3hodOhp5MrNzcz4iWGwNVWwyIV+7Pl+/LX5VcgnRqdHOg=="], + "@cloudflare/workerd-linux-64": ["@cloudflare/workerd-linux-64@1.20261012.1", "", { "os": "linux", "cpu": "x64" }, "sha512-uMe7ONHnLxStD1Ye0YFHBO36uj4cStv5P53rW+5GVWXFT8BRjqVixlH0IqCAHe1Pmcwyd1+7fVoGde89MZSCJg=="], - "@cloudflare/workerd-linux-arm64": ["@cloudflare/workerd-linux-arm64@1.20261001.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-oOk3Zj6k/8oP0FJgZBWDn7+BqbsqIMEMaV95pulHPVbwVu4wYoLfQq2hp0vkbCNsCFLqZb7cqixXdrwD54ZIow=="], + "@cloudflare/workerd-linux-arm64": ["@cloudflare/workerd-linux-arm64@1.20261012.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-I0VMdcXk7ygG5vYDce0ePTBFdnBXC0i9WiBY5mWiv0iTinbfea6/rHqSQ7B1UMpjgrYVs9E0m4bZ9ufsk5GCFA=="], - "@cloudflare/workerd-windows-64": ["@cloudflare/workerd-windows-64@1.20261001.1", "", { "os": "win32", "cpu": "x64" }, "sha512-uRxm5W4VyBkoSaoP1BfOuH0873tE+vxsknF4sab6/5YIRvIAufChq3QDp+zlAn67PuGPGcn7W8QraA0t4ucmOQ=="], + "@cloudflare/workerd-windows-64": ["@cloudflare/workerd-windows-64@1.20261012.1", "", { "os": "win32", "cpu": "x64" }, "sha512-c5hQvNx574UEoknaCFvMa/NdLrrYiALNbe6sx1okW8uOiRYWxrFuA8WpXFnBJ5XJypm0TEAHYaUTGv3rRLpY7Q=="], - "@cloudflare/workers-types": ["@cloudflare/workers-types@5.20261004.1", "", {}, "sha512-K9D4/Y6bSIDNYFzjqzFMNoWK99pLgfgFxqSa76kfW++3VCkTSzJbzsQRffir366G3kmNyjoigC6ekp7DxIkxkw=="], + "@cloudflare/workers-types": ["@cloudflare/workers-types@5.20261014.1", "", {}, "sha512-eGvDG17vu/BmQPOGWFgG1M7iPnW3c17Ykf2qi80JBkPI9f/GYl+5IC2XnZfrwf/CQXZICFgyX/l0+pc1bLbp+g=="], "@cspotcode/source-map-support": ["@cspotcode/source-map-support@0.8.1", "", { "dependencies": { "@jridgewell/trace-mapping": "0.3.9" } }, "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw=="], "@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="], - "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.1", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ=="], + "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.2", "", { "os": "aix", "cpu": "ppc64" }, "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ=="], - "@esbuild/android-arm": ["@esbuild/android-arm@0.28.1", "", { "os": "android", "cpu": "arm" }, "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ=="], + "@esbuild/android-arm": ["@esbuild/android-arm@0.28.2", "", { "os": "android", "cpu": "arm" }, "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg=="], - "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.1", "", { "os": "android", "cpu": "arm64" }, "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg=="], + "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.2", "", { "os": "android", "cpu": "arm64" }, "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A=="], - "@esbuild/android-x64": ["@esbuild/android-x64@0.28.1", "", { "os": "android", "cpu": "x64" }, "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng=="], + "@esbuild/android-x64": ["@esbuild/android-x64@0.28.2", "", { "os": "android", "cpu": "x64" }, "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q=="], - "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q=="], + "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw=="], - "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ=="], + "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw=="], - "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.1", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw=="], + "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.2", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw=="], - "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.1", "", { "os": "freebsd", "cpu": "x64" }, "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ=="], + "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg=="], - "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.1", "", { "os": "linux", "cpu": "arm" }, "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ=="], + "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.2", "", { "os": "linux", "cpu": "arm" }, "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w=="], - "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g=="], + "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug=="], - "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.1", "", { "os": "linux", "cpu": "ia32" }, "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w=="], + "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.2", "", { "os": "linux", "cpu": "ia32" }, "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ=="], - "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg=="], + "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ=="], - "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ=="], + "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA=="], - "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ=="], + "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ=="], - "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ=="], + "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.2", "", { "os": "linux", "cpu": "none" }, "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA=="], - "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.1", "", { "os": "linux", "cpu": "s390x" }, "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag=="], + "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg=="], - "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.1", "", { "os": "linux", "cpu": "x64" }, "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA=="], + "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.2", "", { "os": "linux", "cpu": "x64" }, "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ=="], - "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.1", "", { "os": "none", "cpu": "arm64" }, "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw=="], + "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.2", "", { "os": "none", "cpu": "arm64" }, "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw=="], - "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.1", "", { "os": "none", "cpu": "x64" }, "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg=="], + "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.2", "", { "os": "none", "cpu": "x64" }, "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw=="], - "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.1", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q=="], + "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.2", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ=="], - "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.1", "", { "os": "openbsd", "cpu": "x64" }, "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw=="], + "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.2", "", { "os": "openbsd", "cpu": "x64" }, "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw=="], - "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.1", "", { "os": "none", "cpu": "arm64" }, "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg=="], + "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.2", "", { "os": "none", "cpu": "arm64" }, "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q=="], - "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.1", "", { "os": "sunos", "cpu": "x64" }, "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ=="], + "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.2", "", { "os": "sunos", "cpu": "x64" }, "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g=="], - "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA=="], + "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ=="], - "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.1", "", { "os": "win32", "cpu": "ia32" }, "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg=="], + "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.2", "", { "os": "win32", "cpu": "ia32" }, "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA=="], - "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.1", "", { "os": "win32", "cpu": "x64" }, "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A=="], + "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.2", "", { "os": "win32", "cpu": "x64" }, "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g=="], "@img/colour": ["@img/colour@1.1.0", "", {}, "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ=="], - "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.3.3" }, "os": "darwin", "cpu": "arm64" }, "sha512-Uhfl4V4lhP2nbUVF9+hyH1+luj86f1gUFeo8ALYxFoULoU+G87D43BfeMP8XHsk9boxAnCY/bf2EHwhA7MuGsA=="], + "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.3.4" }, "os": "darwin", "cpu": "arm64" }, "sha512-QRUlFQ0WxvdWyqqG/WtI3iupfD5rBzmCHXSdPsY91sAtVtTo7Q4cb6zOccZ3gqEqkr0f1As1ehLqmEpDsRf+lg=="], - "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.3.3" }, "os": "darwin", "cpu": "x64" }, "sha512-hWniXY3bG5qKpkKrAwPe4y+VTPmf086YQAnkxWh7uA1YrlRouWGa0M0Mxj3ZjnXFkv7/TD1bTy9lGUK26vRvWw=="], + "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.3.4" }, "os": "darwin", "cpu": "x64" }, "sha512-+BR255RhDlpygUpOc/Jdt1nT6DQ3XG/ERo5wbcdOf5Q320dKtPCKPLR1LJs9VGXRaMa8l1uUa0tkCNOXiAxZUw=="], - "@img/sharp-freebsd-wasm32": ["@img/sharp-freebsd-wasm32@0.35.4", "", { "dependencies": { "@img/sharp-wasm32": "0.35.4" }, "os": "freebsd" }, "sha512-lIsKw/BU+kjB4eZjxrYrZmwOJYi3Ajrv66iAlBmUPyKc3HpnloevB1g3wxGD9P/5BbQ1brBGl65VRRrCvQDEqA=="], + "@img/sharp-freebsd-wasm32": ["@img/sharp-freebsd-wasm32@0.35.5", "", { "dependencies": { "@img/sharp-wasm32": "0.35.5" }, "os": "freebsd" }, "sha512-Y/z91nEZ4uIBX5X3nfTovjU9lHNKFYbL2lpHCLVNmXQK03VIZvXBBt0KxbPGp2SdGSF+2mQU4e+hQaWOt86iAw=="], - "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.3.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-suTBPTDGrI9WodccaDdwZItTSaBYASlBk1NSfElSHrUfzu3szG6lvIF58+WiFvnfzuK8ZBFS5zE00PxqxnRiPg=="], + "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.3.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-5R89nBYiRdUlSWJxPhO+GVtaXzXSxKnRu/xqMn3KTA3L9EB9Oy/P+Nn2f2vlhPuUdy/Zusb2DarbyTpGCfEDuw=="], - "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.3.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-FVJZ5mITMobmXIz/hPDTw0EintTW5H3WfrxwLqEqjiIihlu+hVRyGrFQ60xl0Lxn7Bt3zdpevPaQi0HEzqz9fw=="], + "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.3.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-iR2OKH80yi0U+dUplyh3/xdpFvps6YkCwsXenIJxqxR1v9o+xtKTGbS9H7cps+2Vxjc8B1j96p75NmTGjIhtpQ=="], - "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.3.3", "", { "os": "linux", "cpu": "arm" }, "sha512-3rbU4vqXXc3hY/OiXdl52xZvT0F1yEngWfvqudtPJg/KkyiaQw2DRsFrNzpmLvfavbwOq3qXn36GP8obHRULQA=="], + "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.3.4", "", { "os": "linux", "cpu": "arm" }, "sha512-LmRtTsOHuvM2+wlO2Db37dx5MiZhB0FvSunciw48YjdOkZz9KAiRbm8ujeMOA1INqmei5NapFxYEK1D1ZSidmw=="], - "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A=="], + "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.3.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-Y3dgX/6lE2QhQb+Gxy0WZxfg9MEm/JBjamZpS2IklP7xIQoKN4hzAm7KcMVGtaVDt3neE9OKBC7vAfonA/Lr1A=="], - "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.3.3", "", { "os": "linux", "cpu": "ppc64" }, "sha512-cdn1OvUBwsXhbC0zSzJnNzf5MZ/mTrobawDvNXBTxe8VtqKAm0sRuEY2Evzovb/w9JMk4TvRxqt1mekSuJz64w=="], + "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.3.4", "", { "os": "linux", "cpu": "ppc64" }, "sha512-Le6boB8Tai0Nis+gIxIpKx68UDVVIqdR8Tin5Yf1z2LJJQLDJvCDRqRu+jC2qCoD+eIomonmOwB4smBRxfVpYQ=="], - "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.3.3", "", { "os": "linux", "cpu": "none" }, "sha512-HjPVx7yKz+0lqdhDlTw1tt90wamBoxhiXpvl1XZpJLiHH4RCJ5yDTqH+VlYPv2fwFs89JFw4c1IexYOcQUi4IQ=="], + "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.3.4", "", { "os": "linux", "cpu": "none" }, "sha512-aHkkIEHPRdQEegJN20MLmGtxYD9R2wQr3Cwpddnu5+YKMt6Uzax7S9h5gpZTo8wyrGuZSlfQ63OevL5mTyOC7Q=="], - "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.3.3", "", { "os": "linux", "cpu": "s390x" }, "sha512-neWLh+3yCNThxnfy3c4BbVBeGgt9aftno+XbT56iK28RgeDs3UOFWviLWlUu0bArYVYJaFDK+RRohbicUNCm8Q=="], + "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.3.4", "", { "os": "linux", "cpu": "s390x" }, "sha512-ra/mB6MikESDUO7Yg+Mi95bFBb9GsObURuhnOv3OqknjGe9sZrG8tCe9q0xSIGrtLgvgw0gKnFWcK4blSgQOuQ=="], - "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA=="], + "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.3.4", "", { "os": "linux", "cpu": "x64" }, "sha512-GJ//SSXbnwSDes02umB3nDJLFcQzw8a18V8fyhqr6tV515tOEMdImjjxj1AoafMRz56F3PHgftnj1QEKSU1zkw=="], - "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-Y9kQaLMuNoB0bPYOOdcZMaseNrFpPodIWWMrx+CZyydf2xn68j9WYc6sWWRrDwNkzCQjKYfc68L7jKjGlHMibw=="], + "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.3.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-hvulFwtjUcagsis6BBxHwGFwWoNZjgYmULGVrZcyfNbjA8hKILbRxGg15/7w5HDyXHXUos/j6baAWqnCyQ2DWA=="], - "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-fj8Mv0HHfD1Rr+4I68+3agJynxDWtBFgicTbSOb9Bke6pIwzGcJ+RX/yHjmiEGFMCavY/dxvem7MyNaJF+wDiw=="], + "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.3.4", "", { "os": "linux", "cpu": "x64" }, "sha512-6zXKeE/p39I1AmA3cJG35eyBGNqNddLnUXjhwBnsGjFPWqf5VKkDBEqaEkPDoTEtkxwi2vv8Tcr2mDyP4So7Fg=="], - "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.3.3" }, "os": "linux", "cpu": "arm" }, "sha512-7OAS8gI0EReKGVN2HssHlM6umJgxF5VI3xN0p9FA91p/YO+ou5hiNghLdZ5BEHztwaaK5+bLKRf8x/o2L2nk9A=="], + "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.3.4" }, "os": "linux", "cpu": "arm" }, "sha512-LEaXK2WdXVK5ykcw0buWyPMsmLLL2vpHLD6yrNSW+JGEL3BZPA4tpKN6iaMc4AxTTAoaX/sU1rOL51lcIz48ZQ=="], - "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.3.3" }, "os": "linux", "cpu": "arm64" }, "sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ=="], + "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.3.4" }, "os": "linux", "cpu": "arm64" }, "sha512-LYVx5JTsOM2CBzmxreh+nl64/3H6Xb09iSLknqH47z2T2DFFxDeFLP5y4dJwe6H7uGQlHPyEEtIqyo3DYsRwdQ=="], - "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.3.3" }, "os": "linux", "cpu": "ppc64" }, "sha512-2oYZJeIl4kCcMGk4ouZVjnkCtFrpQFlNEtJ6GbxzhHQchwH0NH/qEb9ykmOl29dqwMq+JhFdZn+1ak2FKhI9fQ=="], + "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.3.4" }, "os": "linux", "cpu": "ppc64" }, "sha512-QVxAAq8evVRI9ia2vqgwrmWucn5Dfv+JdWzj75pD8omHLPSP7f8p20O8jxzjCcuCEQEOtYOZUmX1hkiZ0kdevA=="], - "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.3.3" }, "os": "linux", "cpu": "none" }, "sha512-cPbNChoRURAWdebDIHSenxRpgEdy7JkPydSnUxRm9VvKD7m0/xVaR/8Fzlu81pk5nHEvHH87UZUA7cTtwnbJSA=="], + "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.3.4" }, "os": "linux", "cpu": "none" }, "sha512-LtdreXguaavKODPIfzJ4kffx7UNt1omwtK0rch4EBbbSTXPnxWmYSayXdLJw0fJzQ97kHt1gL/yh4tvU+nCyRQ=="], - "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.3.3" }, "os": "linux", "cpu": "s390x" }, "sha512-RY0JFY8Fd6RonCBtHz+DvadaPkXDSI1AUn6yWL9TipqkZ1vY8w8evqdgyDFnkm4/K1ve1TvZiaePP5oSd4+WVQ=="], + "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.3.4" }, "os": "linux", "cpu": "s390x" }, "sha512-UZasTOFiYzotTsGOCu42BfUzP6Tu6Do/947iRm1RsLKvlllxwGcn4RN27LibGWceix4Y+Pmw3jsnTcCQIgWjqA=="], - "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.3.3" }, "os": "linux", "cpu": "x64" }, "sha512-9qvvEAuk8k89TfWUoX2htWjbAMX8p+NxCppjpcg5k6xMsjhBQPTsoIh36h9Qde4WRuGpJeYnOjdosDn/cnv+OA=="], + "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.3.4" }, "os": "linux", "cpu": "x64" }, "sha512-SxFtLTeJInhAA9Q836kux2vZNeOBQEx658qvbboZScr0wIARym3IcGmW7KpVD5sbVg0Ojy+udFQdayYIZyoNog=="], - "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.3.3" }, "os": "linux", "cpu": "arm64" }, "sha512-KB5jxpfWQTr0nc3xdHtWChdbifHrBGsd2SM62Eyxrl8afikm+f5qGBU75SJIZBT/S1MC8XyacdlXBMSWq6OURA=="], + "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.3.4" }, "os": "linux", "cpu": "arm64" }, "sha512-9HbMclmI1zlNkFRs3z9/eBtDjfD0sGlrX1z6b1qwmiFY5ElDLh4BC0LPBdVp7z1DXFiKlIcznf+ZlsuZzLxQqg=="], - "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.3.3" }, "os": "linux", "cpu": "x64" }, "sha512-f+eZJZIQNEEd26RPSW+76chwOf1XtA2Y/O+5ocVyLliHkeih3e+jhLVBdNTd2rS3IbNXK8+ug93Vf5ZXtF5Lxg=="], + "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.35.5", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.3.4" }, "os": "linux", "cpu": "x64" }, "sha512-4KOphqB035HrVdqLZfCgMzzERrQkkzOwRhl4OAkRO1YCldbaFjySXMaK534Mo0V+LndnlJk+sbUyLeU0ULyD1A=="], - "@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.4", "", { "dependencies": { "@emnapi/runtime": "^1.11.3" } }, "sha512-zQnl4Kwp7Q6NHsENtU2T/00Zi+w3AQNwz3+UaTyVBy2FpXrzXzGjndpK61onhZjRtRpQXxCTeqw19bVyXOh7jA=="], + "@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.5", "", { "dependencies": { "@emnapi/runtime": "^1.11.3" } }, "sha512-Ptsga1su4tQx+LLF1ECS9U6nz5kmrXKo6XVbtR48Ke3ZRxxgaWBu7IDtEe1quo8hiupwm6WFqxVlXaSf7IINGQ=="], - "@img/sharp-webcontainers-wasm32": ["@img/sharp-webcontainers-wasm32@0.35.4", "", { "dependencies": { "@img/sharp-wasm32": "0.35.4" }, "cpu": "none" }, "sha512-ESfNkywmCfPNyaZjxooddJQiQ+l/nTpGEOGthxiLnIHXC/CmcBixnfwUleX9mCz9ovrUUvKMap/pm8RYbzfwaA=="], + "@img/sharp-webcontainers-wasm32": ["@img/sharp-webcontainers-wasm32@0.35.5", "", { "dependencies": { "@img/sharp-wasm32": "0.35.5" }, "cpu": "none" }, "sha512-hfhF/FmoQyTUkA0bIKFOtw536BQSeBMe6BF6QyWlrPxT754+TFLaZ7sKKTfvvM0yJgKgaYTwnFCIZ/GuDw5SUA=="], - "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.35.4", "", { "os": "win32", "cpu": "arm64" }, "sha512-iNdlBX9gLVvqe2I3uIJSIKTq6wckP/DYxZtcqxm09x5Gi24DnFBmPAWZmr60ZyYMG0xlzo6goG3670ar+RXvRw=="], + "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.35.5", "", { "os": "win32", "cpu": "arm64" }, "sha512-X4t7g+7ZA5DKblCBEXGjUqqemj4vczING/5viFwAL8h4N3qYeyjwdCvRLHi4EdOUI+2Z7UFlp1VM+p/AuEtm6Q=="], - "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.35.4", "", { "os": "win32", "cpu": "ia32" }, "sha512-kqRsbaa5CS6KHlpxnN7WhE6vAAugXyZButpRdvDWetlv6Qv4N9WTcrWzF7tXfB9T7MsoadqdI8hmwLq6UlLvtw=="], + "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.35.5", "", { "os": "win32", "cpu": "ia32" }, "sha512-5Zm82LoBc43nhwNybZlG7Y1KO//Zhsn306fQl29ZOuStHLGTo3BWL83q3cznX0poxSAMuYL1On/BHBxkBeKr6A=="], - "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.35.4", "", { "os": "win32", "cpu": "x64" }, "sha512-XtmnYhBcrORsJ4XJngyzr/EWP0hRZLAZRFaApdKuviyqF78+ylxh2y06ZmtULAMOnObJ3ucpN0AcwSWnMowTRg=="], + "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.35.5", "", { "os": "win32", "cpu": "x64" }, "sha512-x76eH0vEiHlcMQu8Y8IenntaACtddpT6W0wmXtWrnKcnKI7ME5DdgqhAD6SEWOEl1v2zDvkZDhFA9KnURwpfqg=="], "@jridgewell/resolve-uri": ["@jridgewell/resolve-uri@3.1.2", "", {}, "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw=="], - "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.5", "", {}, "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og=="], + "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.6.0", "", {}, "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw=="], "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.9", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.0.3", "@jridgewell/sourcemap-codec": "^1.4.10" } }, "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ=="], @@ -152,7 +152,7 @@ "@sindresorhus/is": ["@sindresorhus/is@7.2.0", "", {}, "sha512-P1Cz1dWaFfR4IR+U13mqqiGsLFf1KbayybWwdd2vfctdV6hDpUkgCY0nKOLLTMSoRd/jJNjtbqzf13K8DCCXQw=="], - "@speed-highlight/core": ["@speed-highlight/core@1.2.15", "", {}, "sha512-BMq1K3DsElxDWawkX6eLg9+CKJrTVGCBAWVuHXVUV2u0s2711qiChLSId6ikYPfxhdYocLNt3wWwSvDiTvFabw=="], + "@speed-highlight/core": ["@speed-highlight/core@1.2.24", "", {}, "sha512-qeW2e1l78afw8VhRPfPQ1Gjj+KU5XFQ/OFV5ti6eTa9bruO7mJyZtA4vw0ofqmA3tKCkROE9xLk3VZoeRc98nw=="], "@typescript/typescript-aix-ppc64": ["@typescript/typescript-aix-ppc64@7.0.2", "", { "os": "aix", "cpu": "ppc64" }, "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ=="], @@ -202,13 +202,13 @@ "error-stack-parser-es": ["error-stack-parser-es@1.0.5", "", {}, "sha512-5qucVt2XcuGMcEGgWI7i+yZpmpByQ8J1lHhcL7PwqCwu9FPP3VUXzT4ltHe5i2z9dePwEHcDVOAfSnHsOlCXRA=="], - "esbuild": ["esbuild@0.28.1", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.1", "@esbuild/android-arm": "0.28.1", "@esbuild/android-arm64": "0.28.1", "@esbuild/android-x64": "0.28.1", "@esbuild/darwin-arm64": "0.28.1", "@esbuild/darwin-x64": "0.28.1", "@esbuild/freebsd-arm64": "0.28.1", "@esbuild/freebsd-x64": "0.28.1", "@esbuild/linux-arm": "0.28.1", "@esbuild/linux-arm64": "0.28.1", "@esbuild/linux-ia32": "0.28.1", "@esbuild/linux-loong64": "0.28.1", "@esbuild/linux-mips64el": "0.28.1", "@esbuild/linux-ppc64": "0.28.1", "@esbuild/linux-riscv64": "0.28.1", "@esbuild/linux-s390x": "0.28.1", "@esbuild/linux-x64": "0.28.1", "@esbuild/netbsd-arm64": "0.28.1", "@esbuild/netbsd-x64": "0.28.1", "@esbuild/openbsd-arm64": "0.28.1", "@esbuild/openbsd-x64": "0.28.1", "@esbuild/openharmony-arm64": "0.28.1", "@esbuild/sunos-x64": "0.28.1", "@esbuild/win32-arm64": "0.28.1", "@esbuild/win32-ia32": "0.28.1", "@esbuild/win32-x64": "0.28.1" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw=="], + "esbuild": ["esbuild@0.28.2", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.2", "@esbuild/android-arm": "0.28.2", "@esbuild/android-arm64": "0.28.2", "@esbuild/android-x64": "0.28.2", "@esbuild/darwin-arm64": "0.28.2", "@esbuild/darwin-x64": "0.28.2", "@esbuild/freebsd-arm64": "0.28.2", "@esbuild/freebsd-x64": "0.28.2", "@esbuild/linux-arm": "0.28.2", "@esbuild/linux-arm64": "0.28.2", "@esbuild/linux-ia32": "0.28.2", "@esbuild/linux-loong64": "0.28.2", "@esbuild/linux-mips64el": "0.28.2", "@esbuild/linux-ppc64": "0.28.2", "@esbuild/linux-riscv64": "0.28.2", "@esbuild/linux-s390x": "0.28.2", "@esbuild/linux-x64": "0.28.2", "@esbuild/netbsd-arm64": "0.28.2", "@esbuild/netbsd-x64": "0.28.2", "@esbuild/openbsd-arm64": "0.28.2", "@esbuild/openbsd-x64": "0.28.2", "@esbuild/openharmony-arm64": "0.28.2", "@esbuild/sunos-x64": "0.28.2", "@esbuild/win32-arm64": "0.28.2", "@esbuild/win32-ia32": "0.28.2", "@esbuild/win32-x64": "0.28.2" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA=="], "fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="], "kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="], - "miniflare": ["miniflare@5.20261001.0-alpha", "", { "dependencies": { "@cspotcode/source-map-support": "0.8.1", "sharp": "0.35.4", "undici": "7.29.1", "workerd": "1.20261001.1", "ws": "8.21.0", "youch": "4.1.0-beta.10" } }, "sha512-GaimS5mSIOMyvd16ga+e1/QkI8cmp3z35QPHFex0DktqNQf2RVZQwMPQXdyoUreUiFP/0Gpe2MoQInTyMAD5xA=="], + "miniflare": ["miniflare@5.20261012.0-beta", "", { "dependencies": { "@cspotcode/source-map-support": "0.8.1", "sharp": "0.35.5", "undici": "7.29.1", "workerd": "1.20261012.1", "ws": "8.21.0", "youch": "4.1.0-beta.10" } }, "sha512-Cjrs+vHHQ7krLO4HYELYpYBJBuMhcnNZD/Z5z/UcQSnFqWSQY3DhtTCFalXgI1/yO1iK+YrRKK8EYkumrEopxg=="], "path-to-regexp": ["path-to-regexp@6.3.0", "", {}, "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ=="], @@ -216,7 +216,7 @@ "semver": ["semver@7.8.5", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA=="], - "sharp": ["sharp@0.35.4", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.5" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.4", "@img/sharp-darwin-x64": "0.35.4", "@img/sharp-freebsd-wasm32": "0.35.4", "@img/sharp-libvips-darwin-arm64": "1.3.3", "@img/sharp-libvips-darwin-x64": "1.3.3", "@img/sharp-libvips-linux-arm": "1.3.3", "@img/sharp-libvips-linux-arm64": "1.3.3", "@img/sharp-libvips-linux-ppc64": "1.3.3", "@img/sharp-libvips-linux-riscv64": "1.3.3", "@img/sharp-libvips-linux-s390x": "1.3.3", "@img/sharp-libvips-linux-x64": "1.3.3", "@img/sharp-libvips-linuxmusl-arm64": "1.3.3", "@img/sharp-libvips-linuxmusl-x64": "1.3.3", "@img/sharp-linux-arm": "0.35.4", "@img/sharp-linux-arm64": "0.35.4", "@img/sharp-linux-ppc64": "0.35.4", "@img/sharp-linux-riscv64": "0.35.4", "@img/sharp-linux-s390x": "0.35.4", "@img/sharp-linux-x64": "0.35.4", "@img/sharp-linuxmusl-arm64": "0.35.4", "@img/sharp-linuxmusl-x64": "0.35.4", "@img/sharp-webcontainers-wasm32": "0.35.4", "@img/sharp-win32-arm64": "0.35.4", "@img/sharp-win32-ia32": "0.35.4", "@img/sharp-win32-x64": "0.35.4" }, "peerDependencies": { "@types/node": "*" }, "optionalPeers": ["@types/node"] }, "sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA=="], + "sharp": ["sharp@0.35.5", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.5" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.5", "@img/sharp-darwin-x64": "0.35.5", "@img/sharp-freebsd-wasm32": "0.35.5", "@img/sharp-libvips-darwin-arm64": "1.3.4", "@img/sharp-libvips-darwin-x64": "1.3.4", "@img/sharp-libvips-linux-arm": "1.3.4", "@img/sharp-libvips-linux-arm64": "1.3.4", "@img/sharp-libvips-linux-ppc64": "1.3.4", "@img/sharp-libvips-linux-riscv64": "1.3.4", "@img/sharp-libvips-linux-s390x": "1.3.4", "@img/sharp-libvips-linux-x64": "1.3.4", "@img/sharp-libvips-linuxmusl-arm64": "1.3.4", "@img/sharp-libvips-linuxmusl-x64": "1.3.4", "@img/sharp-linux-arm": "0.35.5", "@img/sharp-linux-arm64": "0.35.5", "@img/sharp-linux-ppc64": "0.35.5", "@img/sharp-linux-riscv64": "0.35.5", "@img/sharp-linux-s390x": "0.35.5", "@img/sharp-linux-x64": "0.35.5", "@img/sharp-linuxmusl-arm64": "0.35.5", "@img/sharp-linuxmusl-x64": "0.35.5", "@img/sharp-webcontainers-wasm32": "0.35.5", "@img/sharp-win32-arm64": "0.35.5", "@img/sharp-win32-ia32": "0.35.5", "@img/sharp-win32-x64": "0.35.5" }, "peerDependencies": { "@types/node": "*" }, "optionalPeers": ["@types/node"] }, "sha512-Ywn4OnzGukp7CDMrp08RQ50YKmuwG47brZgIVPTvBaaAfQlRlygrRqSrxdCiL9M+LlzLBiJ68IR1QqvzHyjC7g=="], "supports-color": ["supports-color@10.2.2", "", {}, "sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g=="], @@ -228,9 +228,9 @@ "unenv": ["unenv@2.0.0-rc.24", "", { "dependencies": { "pathe": "^2.0.3" } }, "sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw=="], - "workerd": ["workerd@1.20261001.1", "", { "optionalDependencies": { "@cloudflare/workerd-darwin-64": "1.20261001.1", "@cloudflare/workerd-darwin-arm64": "1.20261001.1", "@cloudflare/workerd-linux-64": "1.20261001.1", "@cloudflare/workerd-linux-arm64": "1.20261001.1", "@cloudflare/workerd-windows-64": "1.20261001.1" }, "bin": { "workerd": "bin/workerd" } }, "sha512-d/SIYHFO0PT/wiFZg8in4NpRIxYuFwslX1HdylOtWkBIIUmSpkGFhK820cV84XACFylwJ48xuRoWW/8DWDPsPQ=="], + "workerd": ["workerd@1.20261012.1", "", { "optionalDependencies": { "@cloudflare/workerd-darwin-64": "1.20261012.1", "@cloudflare/workerd-darwin-arm64": "1.20261012.1", "@cloudflare/workerd-linux-64": "1.20261012.1", "@cloudflare/workerd-linux-arm64": "1.20261012.1", "@cloudflare/workerd-windows-64": "1.20261012.1" }, "bin": { "workerd": "bin/workerd" } }, "sha512-tEHoMPsMga0seVjxfsR8Pd3f8IRqYwkq++dTUKI5Gdgj6zuSDluYwisydq+dn90SsIACwBquJUQ1nBpcOqaWTA=="], - "wrangler": ["wrangler@4.147.0", "", { "dependencies": { "@cloudflare/kv-asset-handler": "0.5.0", "@cloudflare/unenv-preset": "2.16.2", "blake3-wasm": "2.1.5", "esbuild": "0.28.1", "miniflare": "5.20261001.0-alpha", "path-to-regexp": "6.3.0", "unenv": "2.0.0-rc.24", "workerd": "1.20261001.1" }, "optionalDependencies": { "fsevents": "2.3.3" }, "peerDependencies": { "@cloudflare/workers-types": "^5.20261001.1" }, "optionalPeers": ["@cloudflare/workers-types"], "bin": { "wrangler": "bin/wrangler.js", "wrangler2": "bin/wrangler.js", "cf-wrangler": "bin/cf-wrangler.js" } }, "sha512-pQYRoiq8PTAxphaG69z8+GC1DkSGd19EDZehQ8zxjo/Ko3mRB6Qs1mTrd8ZuKAarLklIjTqr1lUdCK9r4q2hUg=="], + "wrangler": ["wrangler@4.151.0", "", { "dependencies": { "@cloudflare/kv-asset-handler": "0.5.0", "@cloudflare/unenv-preset": "2.16.2", "blake3-wasm": "2.1.5", "esbuild": "0.28.2", "miniflare": "5.20261012.0-beta", "path-to-regexp": "6.3.0", "unenv": "2.0.0-rc.24", "workerd": "1.20261012.1" }, "optionalDependencies": { "fsevents": "2.3.3" }, "peerDependencies": { "@cloudflare/workers-types": "^5.20261006.1" }, "optionalPeers": ["@cloudflare/workers-types"], "bin": { "wrangler": "bin/wrangler.js", "wrangler2": "bin/wrangler.js", "cf-wrangler": "bin/cf-wrangler.js" } }, "sha512-ra8MpzSR+ClkbGofu9S+AmAKjytS60MqSuayXKpa1CAYIzP+NIc8q6EiF55Gz5PS3lxT4qcvMuPHihCNhTPpDg=="], "ws": ["ws@8.21.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g=="], From 9964a1148be2667e90887bf574cddc9755f035da Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Tue, 20 Oct 2026 23:33:18 -0700 Subject: [PATCH 04/12] ci(deps): audit and update every Worker lockfile infra/mbx and infra/nix landed with their own Bun lockfiles but no Dependabot entry and no `just js audit` coverage, the same drift infra/moq-sh had. Dependabot now globs infra/*, and the audit walks every tracked bun.lock. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 6 +++--- sh/js/audit.sh | 4 +++- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ae8041e377c..893b3d417fe 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -52,11 +52,11 @@ updates: versions: [">=0.33"] - package-ecosystem: "bun" + # Every infra/ directory is a standalone Worker with its own lockfile; the + # glob keeps a new one from going unupdated. directories: - "/" - - "/infra/apt" - - "/infra/rpm" - - "/infra/moq-sh" + - "/infra/*" - "/demo/pub" schedule: interval: "weekly" diff --git a/sh/js/audit.sh b/sh/js/audit.sh index fbf15028987..4f0fad3a984 100644 --- a/sh/js/audit.sh +++ b/sh/js/audit.sh @@ -4,8 +4,10 @@ set -euo pipefail cd "$(git rev-parse --show-toplevel)" +# Every tracked lockfile, so a new Worker can't fall out of the audit. status=0 -for project in . infra/apt infra/rpm infra/moq-sh demo/pub; do +for lock in $(git ls-files '*bun.lock'); do + project=$(dirname "$lock") echo "Auditing $project" ( cd "$project" From 86c67422151ce459c0cedbbb75bafec13bd5fe82 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Tue, 20 Oct 2026 23:33:42 -0700 Subject: [PATCH 05/12] fix(doc): take markdown-it 14.3.3 for its parsing DoS fixes GHSA-vfgh-jcmw-g37q and GHSA-gfr2-rv44-r23c, reached through vitepress-plugin-llms. Bun has no transitive-only update, so the lock entry is bumped in place; a frozen install verifies its integrity. Co-Authored-By: Claude Opus 5.5 --- bun.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bun.lock b/bun.lock index 2885a56a6cc..b27d9b3cbd2 100644 --- a/bun.lock +++ b/bun.lock @@ -1413,7 +1413,7 @@ "markdown-extensions": ["markdown-extensions@2.0.0", "", {}, "sha512-o5vL7aDWatOTX8LzaS1WMoaoxIiLRQJuIKKe2wAw6IeULDHaqbiqiggmx+pKvZDb1Sj+pE46Sn1T7lCqfFtg1Q=="], - "markdown-it": ["markdown-it@14.3.2", "", { "dependencies": { "argparse": "^2.0.1", "entities": "^4.5.0", "linkify-it": "^5.0.2", "mdurl": "^2.0.0", "punycode.js": "^2.3.1", "uc.micro": "^2.1.0" }, "bin": { "markdown-it": "bin/markdown-it.mjs" } }, "sha512-sHHjZ5fJKlgrG4qns2YwVcdNep35h5fERrfkD2YNsb9UFk0UIHarbiTaHKVMlPuWAoiilyK8Fv/jAm11slsY7Q=="], + "markdown-it": ["markdown-it@14.3.3", "", { "dependencies": { "argparse": "^2.0.1", "entities": "^4.5.0", "linkify-it": "^5.0.2", "mdurl": "^2.0.0", "punycode.js": "^2.3.1", "uc.micro": "^2.1.0" }, "bin": { "markdown-it": "bin/markdown-it.mjs" } }, "sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg=="], "markdown-title": ["markdown-title@1.0.2", "", {}, "sha512-MqIQVVkz+uGEHi3TsHx/czcxxCbRIL7sv5K5DnYw/tI+apY54IbPefV/cmgxp6LoJSEx/TqcHdLs/298afG5QQ=="], From 0318f98b3c1bfed4b150a841136de1f82b760ce8 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Tue, 20 Oct 2026 23:37:30 -0700 Subject: [PATCH 06/12] feat(gst)!: move moq-gst to gstreamer 0.25 gstreamer-rs 0.25 needs Rust 1.92, so moq-gst declares its own rust-version like moq-relay and moq-cli, leaving the 1.91 workspace floor for the libraries. The unreleased MIGRATE entry now names 0.25 and glib 0.22. libspa still holds system-deps 7, so system-deps is a new duplicate until pipewire-rs moves. Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 73 ++++++++++++++++++++++--------------------- rs/moq-gst/Cargo.toml | 6 ++-- rs/moq-gst/MIGRATE.md | 6 ++-- 3 files changed, 45 insertions(+), 40 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index fec7d957116..6d0da638477 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1959,7 +1959,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c54e03a951783e8b327515db3f2a2fd0e3bed362a96b066f341ce66ed49b4ead" dependencies = [ "data-encoding", - "syn 1.0.109", + "syn 3.0.6", ] [[package]] @@ -2865,14 +2865,14 @@ checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7" [[package]] name = "gio-sys" -version = "0.21.5" +version = "0.22.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0071fe88dba8e40086c8ff9bbb62622999f49628344b1d1bf490a48a29d80f22" +checksum = "6c28739f914c15b87a9856000bed9cbd5b3a8afbca5e982d9a299e1601422cb5" dependencies = [ "glib-sys", "gobject-sys", "libc", - "system-deps", + "system-deps 9.0.0", "windows-sys 0.61.2", ] @@ -2889,9 +2889,9 @@ dependencies = [ [[package]] name = "glib" -version = "0.21.5" +version = "0.22.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "16de123c2e6c90ce3b573b7330de19be649080ec612033d397d72da265f1bd8b" +checksum = "e4cf9e5bd8713f1990a92c422998826e0fb34824277b46bc59757373483c6694" dependencies = [ "bitflags 2.13.2", "futures-channel", @@ -2910,25 +2910,24 @@ dependencies = [ [[package]] name = "glib-macros" -version = "0.21.5" +version = "0.22.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cf59b675301228a696fe01c3073974643365080a76cc3ed5bc2cbc466ad87f17" +checksum = "c9597c68fa7bdf4154a3079642cd21c4dccac0b0bdd2897d82861523bf91e7b9" dependencies = [ "heck", - "proc-macro-crate", "proc-macro2", "quote", - "syn 2.0.119", + "syn 3.0.6", ] [[package]] name = "glib-sys" -version = "0.21.5" +version = "0.22.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2d95e1a3a19ae464a7286e14af9a90683c64d70c02532d88d87ce95056af3e6c" +checksum = "99b38907e67e40dec9b60f858bcada952598719cb512a13eb13d6cdcd16f8295" dependencies = [ "libc", - "system-deps", + "system-deps 9.0.0", ] [[package]] @@ -2972,13 +2971,13 @@ dependencies = [ [[package]] name = "gobject-sys" -version = "0.21.5" +version = "0.22.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2dca35da0d19a18f4575f3cb99fe1c9e029a2941af5662f326f738a21edaf294" +checksum = "07595c9ba696bd9819cb6a8df39f08078f3dd679508fe052dd558492c2053834" dependencies = [ "glib-sys", "libc", - "system-deps", + "system-deps 9.0.0", ] [[package]] @@ -3029,9 +3028,9 @@ dependencies = [ [[package]] name = "gstreamer" -version = "0.24.5" +version = "0.25.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e8251db223ca38d9aefaf3d19f6f11581a9123cd12dacebd8b9e182da965023" +checksum = "f4237e2066a25ecb7e54be6c066409e30615920265b9799b8d560ef8ac9857c6" dependencies = [ "cfg-if", "futures-channel", @@ -3039,7 +3038,7 @@ dependencies = [ "futures-util", "glib", "gstreamer-sys", - "itertools 0.14.0", + "itertools 0.15.0", "kstring", "libc", "muldiv", @@ -3054,15 +3053,15 @@ dependencies = [ [[package]] name = "gstreamer-sys" -version = "0.24.5" +version = "0.25.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b5d37c1a599ae57b8186948bd5699f2dbfc044baea9d400228b489a85bcf2759" +checksum = "436d9532847489a8285d57b8c3670762c12a18f777fdc2ab159b52e0e6f521b9" dependencies = [ "cfg-if", "glib-sys", "gobject-sys", "libc", - "system-deps", + "system-deps 9.0.0", ] [[package]] @@ -3895,15 +3894,6 @@ dependencies = [ "either", ] -[[package]] -name = "itertools" -version = "0.14.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285" -dependencies = [ - "either", -] - [[package]] name = "itertools" version = "0.15.0" @@ -4264,7 +4254,7 @@ dependencies = [ "libspa-sys", "nom 8.0.0", "rustix 1.1.5", - "system-deps", + "system-deps 7.0.8", ] [[package]] @@ -4275,7 +4265,7 @@ checksum = "3b6e17bdaf63ed0d5e4144022624032b41fd9733112e8c74ac26fc9bf1291924" dependencies = [ "bindgen 0.72.1", "cc", - "system-deps", + "system-deps 7.0.8", ] [[package]] @@ -7171,7 +7161,7 @@ checksum = "9ce653f53e63e5b93853218092ee9a8906a5d082c92f3f1db26316955dd63ce0" dependencies = [ "bindgen 0.72.1", "libspa-sys", - "system-deps", + "system-deps 7.0.8", ] [[package]] @@ -9601,6 +9591,19 @@ dependencies = [ "version-compare", ] +[[package]] +name = "system-deps" +version = "9.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8a0dae2cbca1f0ff93795713cfe0a4c02f760e3c0b8ae2ab4ec4045808ff429f" +dependencies = [ + "cfg-expr", + "heck", + "pkg-config", + "toml 1.1.6+spec-1.1.0", + "version-compare", +] + [[package]] name = "tagptr" version = "0.2.0" @@ -9626,7 +9629,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.3.4", + "getrandom 0.4.3", "once_cell", "rustix 1.1.5", "windows-sys 0.61.2", diff --git a/rs/moq-gst/Cargo.toml b/rs/moq-gst/Cargo.toml index a63a6cdb28d..f1a3cee0081 100644 --- a/rs/moq-gst/Cargo.toml +++ b/rs/moq-gst/Cargo.toml @@ -7,7 +7,9 @@ license = "MIT OR Apache-2.0" version = "0.4.12" edition = "2024" -rust-version.workspace = true +# gstreamer 0.25 needs 1.92, above the 1.91 workspace floor. moq-gst is a +# plugin, not a library other crates build on, so the bump stays per-crate. +rust-version = "1.92" publish = true [lib] @@ -18,7 +20,7 @@ crate-type = ["cdylib", "rlib"] anyhow = { workspace = true, features = ["backtrace"] } bytes = { workspace = true } -gst = { package = "gstreamer", version = "0.24" } +gst = { package = "gstreamer", version = "0.25" } hang = { workspace = true } moq-mux = { workspace = true } moq-net = { workspace = true } diff --git a/rs/moq-gst/MIGRATE.md b/rs/moq-gst/MIGRATE.md index a625961e568..b20dc8cd68e 100644 --- a/rs/moq-gst/MIGRATE.md +++ b/rs/moq-gst/MIGRATE.md @@ -4,11 +4,11 @@ How to update your pipelines for each breaking change, newest first. ## Unreleased -### Rust embedders move to gstreamer 0.24 (#6053) +### Rust embedders move to gstreamer 0.25 Only Rust code that links `gstmoq` as a library is affected; pipelines and the loadable plugin are not. -`plugin_init`, `plugin_register_static`, and the `glib::Enum` impls on `ConnectionStatus` and `MediaContainer` now use gstreamer 0.24 and glib 0.21 types. -Bump your own `gstreamer` dependency to 0.24 (and `glib` to 0.21) so the `gst::Plugin`, `glib::BoolError`, and `glib::Value` types match. +`plugin_init`, `plugin_register_static`, and the `glib::Enum` impls on `ConnectionStatus` and `MediaContainer` now use gstreamer 0.25 and glib 0.22 types, which need Rust 1.92. +Bump your own `gstreamer` dependency to 0.25 (and `glib` to 0.22) so the `gst::Plugin`, `glib::BoolError`, and `glib::Value` types match. ### Key logging is opt-in (#5907) From 2c5a70415175adc2f7e82170a42a37faabe95251 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Tue, 20 Oct 2026 23:39:53 -0700 Subject: [PATCH 07/12] chore(js): move the DOM typings to @types/web 0.0.358 The packages alias @typescript/lib-dom to npm:@types/web@^0.0.350, which pins one 0.0.x release, and Dependabot never proposed a newer one: 0.0.350 shipped in June. 0.0.358 is the newest outside the 7-day cooldown, and every package type-checks and builds on it. Co-Authored-By: Claude Opus 5.5 --- bun.lock | 20 ++++++++++---------- js/hang/package.json | 2 +- js/net/package.json | 2 +- js/p2p/package.json | 2 +- js/publish/package.json | 2 +- js/room/package.json | 2 +- js/video/package.json | 2 +- js/watch/package.json | 2 +- test/p2p/package.json | 2 +- test/video/package.json | 2 +- 10 files changed, 19 insertions(+), 19 deletions(-) diff --git a/bun.lock b/bun.lock index b27d9b3cbd2..28098bc6d05 100644 --- a/bun.lock +++ b/bun.lock @@ -182,7 +182,7 @@ }, "devDependencies": { "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "rimraf": "^6.1.3", "typescript": "7.0.2", }, @@ -269,7 +269,7 @@ "devDependencies": { "@types/bun": "^1.4.3", "@types/node": "^26.6.4", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "rimraf": "^6.1.3", "typescript": "7.0.2", }, @@ -286,7 +286,7 @@ }, "devDependencies": { "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "rimraf": "^6.1.3", "typescript": "7.0.2", }, @@ -315,7 +315,7 @@ "devDependencies": { "@types/audioworklet": "^0.0.100", "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "rimraf": "^6.1.3", "rolldown": "^1.2.13", "typescript": "7.0.2", @@ -337,7 +337,7 @@ "devDependencies": { "@types/audioworklet": "^0.0.100", "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "rimraf": "^6.1.3", "typescript": "7.0.2", "vite": "^8.3.4", @@ -376,7 +376,7 @@ }, "devDependencies": { "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "rimraf": "^6.1.3", "typescript": "7.0.2", }, @@ -401,7 +401,7 @@ "devDependencies": { "@types/audioworklet": "^0.0.100", "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "rimraf": "^6.1.3", "rolldown": "^1.2.13", "typescript": "7.0.2", @@ -471,7 +471,7 @@ }, "devDependencies": { "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "playwright": "^1.64.0", "typescript": "7.0.2", "vite": "^8.3.4", @@ -490,7 +490,7 @@ }, "devDependencies": { "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "playwright": "^1.64.0", "typescript": "7.0.2", "vite": "^8.3.4", @@ -1041,7 +1041,7 @@ "@types/web-bluetooth": ["@types/web-bluetooth@0.0.21", "", {}, "sha512-oIQLCGWtcFZy2JW77j9k8nHzAOpqMHLQejDA48XXMWH6tjCQHz5RCFz1bzsmROyL6PUm+LLnUiI4BCn221inxA=="], - "@typescript/lib-dom": ["@types/web@0.0.350", "", {}, "sha512-XFISASo1wPsKKtI5v1nJ51YuZYkjUE9kduDFpfHCOKEMbHtRLHX0k3V3bpBeQx2L1VvcxTIECHvC3r3Rfmu0YA=="], + "@typescript/lib-dom": ["@types/web@0.0.358", "", {}, "sha512-mNaTgu3PxD0NY0QTpMSFcs+BurApADI/h0oK/sKzkzobGw9F/GpAM4x3Vreul/EAsgm5I8uKzMnuSazZ1qHjgw=="], "@typescript/typescript-aix-ppc64": ["@typescript/typescript-aix-ppc64@7.0.2", "", { "os": "aix", "cpu": "ppc64" }, "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ=="], diff --git a/js/hang/package.json b/js/hang/package.json index 50827d99ace..e92023e42dd 100644 --- a/js/hang/package.json +++ b/js/hang/package.json @@ -37,7 +37,7 @@ }, "devDependencies": { "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "rimraf": "^6.1.3", "typescript": "7.0.2" } diff --git a/js/net/package.json b/js/net/package.json index f933c93cd0a..07ac53bfd21 100644 --- a/js/net/package.json +++ b/js/net/package.json @@ -35,7 +35,7 @@ "devDependencies": { "@types/bun": "^1.4.3", "@types/node": "^26.6.4", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "rimraf": "^6.1.3", "typescript": "7.0.2" } diff --git a/js/p2p/package.json b/js/p2p/package.json index bebcf49a7d0..5d0bd861844 100644 --- a/js/p2p/package.json +++ b/js/p2p/package.json @@ -24,7 +24,7 @@ }, "devDependencies": { "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "rimraf": "^6.1.3", "typescript": "7.0.2" } diff --git a/js/publish/package.json b/js/publish/package.json index bd6380a89d2..73a484df9c6 100644 --- a/js/publish/package.json +++ b/js/publish/package.json @@ -40,7 +40,7 @@ "devDependencies": { "@types/audioworklet": "^0.0.100", "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "rimraf": "^6.1.3", "rolldown": "^1.2.13", "typescript": "7.0.2", diff --git a/js/room/package.json b/js/room/package.json index d44c74fa65b..70b564113c8 100644 --- a/js/room/package.json +++ b/js/room/package.json @@ -31,7 +31,7 @@ "devDependencies": { "@types/audioworklet": "^0.0.100", "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "rimraf": "^6.1.3", "typescript": "7.0.2", "vite": "^8.3.4" diff --git a/js/video/package.json b/js/video/package.json index d0d4cd3935b..b944a0782da 100644 --- a/js/video/package.json +++ b/js/video/package.json @@ -24,7 +24,7 @@ }, "devDependencies": { "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "rimraf": "^6.1.3", "typescript": "7.0.2" } diff --git a/js/watch/package.json b/js/watch/package.json index bd2d6f26536..335ecf2caff 100644 --- a/js/watch/package.json +++ b/js/watch/package.json @@ -41,7 +41,7 @@ "devDependencies": { "@types/audioworklet": "^0.0.100", "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "rimraf": "^6.1.3", "rolldown": "^1.2.13", "typescript": "7.0.2", diff --git a/test/p2p/package.json b/test/p2p/package.json index f6030486895..1add2e29d95 100644 --- a/test/p2p/package.json +++ b/test/p2p/package.json @@ -11,7 +11,7 @@ }, "devDependencies": { "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "playwright": "^1.64.0", "typescript": "7.0.2", "vite": "^8.3.4" diff --git a/test/video/package.json b/test/video/package.json index 40bf8955827..68685bf7ad6 100644 --- a/test/video/package.json +++ b/test/video/package.json @@ -16,7 +16,7 @@ }, "devDependencies": { "@types/bun": "^1.4.3", - "@typescript/lib-dom": "npm:@types/web@^0.0.350", + "@typescript/lib-dom": "npm:@types/web@^0.0.358", "playwright": "^1.64.0", "typescript": "7.0.2", "vite": "^8.3.4" From 2a8f1bb93b0694c0537e5c9f4c723bf2414742b8 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Tue, 20 Oct 2026 23:40:23 -0700 Subject: [PATCH 08/12] ci(deps): keep the smoke toolchain flake under Dependabot test/smoke/flake.lock arrived with the smoke suite (#6046) without update coverage; its nixpkgs dates from May. It gets its own entry so a toolchain bump, which must carry the matching playwright pin, never blocks the root flake. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 893b3d417fe..0b1ac2afd61 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -22,6 +22,20 @@ updates: patterns: - "*" + # The smoke suite's own toolchain flake, kept apart so its PR can carry the + # matching npm playwright pin (test/smoke/freshness.sh fails until it does) + # without holding up the root flake. + - package-ecosystem: "nix" + directory: "/test/smoke" + schedule: + interval: "weekly" + cooldown: + default-days: 7 + groups: + smoke-nix: + patterns: + - "*" + - package-ecosystem: "github-actions" directory: "/" schedule: From 3b7ced32ef61220f9a66a1260f7ed2fb887c902b Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Tue, 20 Oct 2026 23:41:57 -0700 Subject: [PATCH 09/12] ci(infra): validate every Worker lockfile and bundle `just js workers` and its dispatch scope listed four Workers, so infra/nix's bundle and the infra/mbx and infra/nix lockfiles were never checked. Walk every tracked bun.lock outside the workspace, dry-run each one with a wrangler config, and scope the check to all of infra/. Co-Authored-By: Claude Opus 5.5 --- sh/dispatch.sh | 2 +- sh/js/workers.sh | 15 +++++++++++---- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/sh/dispatch.sh b/sh/dispatch.sh index bba969ad532..e0445e4e3dd 100755 --- a/sh/dispatch.sh +++ b/sh/dispatch.sh @@ -58,7 +58,7 @@ declare -A scope=( # demo/pub is a Worker outside the Bun workspace, listed so Biome lints it. [js]='^(js/|bench/browser/|doc/|drafts/|demo/(boy|pub|web|carla/web)/|test/|rs/moq-wasm/|rs/.*\.json$|sh/js/|sh/rs/stats-docs\.py$|package\.json$|bun\.lock(b)?$|biome\.jsonc$)' # Workers with lockfiles outside the Bun workspace. - [workers]='^(infra/apt/|infra/rpm/|infra/moq-sh/|demo/pub/|sh/js/workers\.sh$)' + [workers]='^(infra/|demo/pub/|sh/js/workers\.sh$)' [moq_sh]='^infra/moq-sh/' # sh/rs/select.sh widens to the whole workspace for inputs every crate shares. [rs]='^(rs/|demo/carla/bridge/|sh/rs/|Cargo\.(toml|lock)$|rust-toolchain\.toml$|\.config/nextest\.toml$)' diff --git a/sh/js/workers.sh b/sh/js/workers.sh index 36764974722..502312fa45d 100755 --- a/sh/js/workers.sh +++ b/sh/js/workers.sh @@ -1,16 +1,23 @@ #!/usr/bin/env bash -# Validate each Worker's deploy bundle without publishing or credentials. +# Validate each Worker's lockfile and deploy bundle without publishing or +# credentials. # # These Workers have lockfiles outside the Bun workspace, so `just js check` -# never installs or builds them. +# never installs or builds them. Every tracked lockfile but the workspace's is +# one, so a new Worker can't fall out of the check; infra/mbx only drives +# wrangler's CLI and has no bundle to build. set -euo pipefail cd "$(git rev-parse --show-toplevel)" -for project in infra/apt infra/rpm infra/moq-sh demo/pub; do +for lock in $(git ls-files '*bun.lock'); do + project=$(dirname "$lock") + [[ "$project" == . ]] && continue ( cd "$project" bun install --frozen-lockfile - bun run deploy --dry-run + if [[ -f wrangler.jsonc ]]; then + bun run deploy --dry-run + fi ) done From c77e09d99ed0632bcac3ffc5495e76ec42266e04 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Tue, 20 Oct 2026 23:42:56 -0700 Subject: [PATCH 10/12] quest(m1): finish the dependency audit and schedule the m2 run The m2 successor waits on the release cut and carries this run's baselines, the update kinds Dependabot misses, and what is still waiting on upstream. Co-Authored-By: Claude Opus 5.5 --- quest/m0/audit-compile-time.md | 4 +- quest/m0/ci/audit.md | 2 +- quest/m1/README.md | 1 - quest/m1/audit-ci.md | 2 +- quest/m2/README.md | 1 + quest/{m1 => m2}/audit-deps.md | 88 ++++++++++++++++++++++++---------- 6 files changed, 67 insertions(+), 31 deletions(-) rename quest/{m1 => m2}/audit-deps.md (52%) diff --git a/quest/m0/audit-compile-time.md b/quest/m0/audit-compile-time.md index b7b9a88ef2c..545686b828b 100644 --- a/quest/m0/audit-compile-time.md +++ b/quest/m0/audit-compile-time.md @@ -29,7 +29,7 @@ incremental). The [CI pipeline audit](/quest/m0/ci/audit.md) owns job-level CI cost: cache keys and hits, aws-lc-sys recompiling several times per cold job, both rustls backends in the gate, and `--timings` output in CI. Deduplicating or upgrading dependencies belongs to the -[dependency audit](/quest/m1/audit-deps.md). +[dependency audit](/quest/m2/audit-deps.md). Clean builds used `MBX_DISABLE=1` and a fresh `CARGO_TARGET_DIR`, with registry sources and the Nix shell already present; no cache, compiler, profile, or @@ -107,4 +107,4 @@ Remaining work before completing this run: ## Related - [CI pipeline audit](/quest/m0/ci/audit.md) - owns job-level CI build cost and caching -- [Dependency audit](/quest/m1/audit-deps.md) - owns deduplicating and upgrading dependencies +- [Dependency audit](/quest/m2/audit-deps.md) - owns deduplicating and upgrading dependencies diff --git a/quest/m0/ci/audit.md b/quest/m0/ci/audit.md index 711e0efa078..fa8fed8685c 100644 --- a/quest/m0/ci/audit.md +++ b/quest/m0/ci/audit.md @@ -63,7 +63,7 @@ PRs cannot supply that measurement. 52 crate names are duplicated on aarch64-linux (syn 1, 2 and 3; rand 0.8, 0.9 and 0.10; three toml versions; sha2 and digest 0.10 and 0.11). Cut what the gate doesn't need. Dependency upgrades belong to - [the dependency audit](/quest/m1/audit-deps.md). + [the dependency audit](/quest/m2/audit-deps.md). - **Nightly:** about 1250 runner-minutes and 2 hours of wall time, and the last 5 runs failed (the Features job, plus JS benchmarks cancelled at 60 minutes). With main's optional checks moved to nightly, a red nightly hides diff --git a/quest/m1/README.md b/quest/m1/README.md index 0cec85655e8..421bff32cc6 100644 --- a/quest/m1/README.md +++ b/quest/m1/README.md @@ -121,7 +121,6 @@ lands before the cut. - [moq-net compiles once](/quest/m1/net-erase-transport.md) - the session drivers stop monomorphizing per transport and per crate, saving several MiB of the relay, FFI library, `libmoq` and CLI - [Dead code and API surface audit](/quest/m1/audit-dead-code.md) - repeat the removal audit before the next major release -- [Dependency and alternatives audit](/quest/m1/audit-deps.md) - dependencies are current, deduplicated, needed, and the best maintained option - [Test coverage audit](/quest/m1/audit-test-coverage.md) - repeat the coverage audit against the m0 baselines before the next major release - [Test cost audit](/quest/m1/audit-test-cost.md) - the slowest, flakiest, and least valuable tests are fixed, deleted, or planned - [Interop report](/quest/m1/interop-report.md) - nightly Interop results publish as a color-coded matrix on the Pages site instead of only in logs diff --git a/quest/m1/audit-ci.md b/quest/m1/audit-ci.md index 59b2ced6414..2dd546ae471 100644 --- a/quest/m1/audit-ci.md +++ b/quest/m1/audit-ci.md @@ -71,7 +71,7 @@ Check first (from the test cost audit's m0 run, 2026-10-19): calling it a flake. - Owned elsewhere: [nightly media players](/quest/m1/media-engines-nightly.md), release builds by [release builds link](/quest/m0/release-link.md), and Rust - advisories by [the dependency audit](/quest/m1/audit-deps.md). + advisories by [the dependency audit](/quest/m2/audit-deps.md). - Re-running a single job in place cannot redeploy Pages: the earlier attempt's `github-pages` artifact remains and `deploy-pages` refuses two. Delete the stale artifact first, or wait for the next Nightly. diff --git a/quest/m2/README.md b/quest/m2/README.md index 502885431fa..141238595cb 100644 --- a/quest/m2/README.md +++ b/quest/m2/README.md @@ -176,3 +176,4 @@ ranked just below deterministic TS legs, which it requires. - [Relay metrics through prometheus-client](/quest/m2/relay-prometheus-client.md) - `/metrics` renders through the maintained client with the same series - [Dead routes on IETF name their cause](/quest/m2/js-ietf-dead-route-error.md) - a JS subscription on a dead moq-transport session ends with the session error, not `unauthorized` - [Error cleanups](/quest/m2/error-cleanups.md) - delete the unused `Error::SessionClosed`; raw transport failures already map to `Unroutable` +- [Dependency and alternatives audit](/quest/m2/audit-deps.md) - dependencies are current, deduplicated, needed, and the best maintained option diff --git a/quest/m1/audit-deps.md b/quest/m2/audit-deps.md similarity index 52% rename from quest/m1/audit-deps.md rename to quest/m2/audit-deps.md index ca3ea9ddcc6..a3fe73d7537 100644 --- a/quest/m1/audit-deps.md +++ b/quest/m2/audit-deps.md @@ -10,7 +10,7 @@ replacement. Recurs once per major release (decided 2026-10-19). The PR that finishes this run also adds the next one with the same file name at the end of the next -milestone's `Required` (m0 to m1, m1 to m2). The successor keeps the Goal +milestone's `Required` (m0 to m1, m1 to m2, m2 to m3). The successor keeps the Goal and this paragraph; the rest of its Plan is rewritten with what this run learned: baselines, results, and what to check first. A successor placed in m2 also lists the [release cut](/quest/m2/release/cut.md) under `Required`, so it @@ -22,43 +22,70 @@ follow-up through `/quest-plan`. Research the state of the art for each candidate: compare maintenance, performance, and API fit before planning a swap. Respect Dependabot's 7-day -cooldown for manual bumps too. +cooldown for manual bumps too; security fixes bypass it. ### Check first -Dependabot's grouped weekly PRs only took semver-compatible updates in the m0 -run: tikv-jemallocator 0.7 sat unproposed for five months. List majors (0.x -minors included) for every direct dependency with `--all-features` metadata -against the crates.io index, and every `package.json` range against npm. -Also confirm each Bun lockfile is in `.github/dependabot.yml` (infra/moq-sh -was missing) and that every Dependabot `ignore` still blocks something. - -Majors still open at the end of m0: - -- gstreamer 0.25 needs Rust 1.92; moq-gst is on 0.24 under the 1.91 MSRV. -- vt100 0.17 and 0.18 (moq-cli dev-dependency) were inside the cooldown. -- http-cache-reqwest stays on its 1.0 prerelease until 1.0 ships stable. +Dependabot misses three kinds of update, so list them by hand: + +- Majors and 0.x minors. `cargo upgrade --dry-run --incompatible allow + --pinned allow --ignore-rust-version` lists them for every manifest; + without `--ignore-rust-version` it hides any release above a crate's MSRV. + `bun outdated -r` covers the workspace; run `bun outdated` in each + standalone Bun project too. +- `0.0.x` ranges and `npm:` aliases. `npm:@types/web@^0.0.350` sat for four + months with no proposal. +- Lockfiles Dependabot doesn't know about. Compare `git ls-files '*.lock' + '*flake.lock'` against `.github/dependabot.yml`. The m1 run found infra/mbx, + infra/nix, and test/smoke/flake.lock missing, all added that week. + Bun's coverage is now a `/infra/*` glob, and `just js audit` and + `just js workers` walk every tracked `bun.lock`. + +Deliberately uncovered: `dart/moq` (see the comment in +`.github/dependabot.yml`), `bench/ffi-gen/Cargo.lock` (a one-off BoltFFI +comparison), and `nix/uniffi-dart-Cargo.lock` (pinned with the generator). +The uniffi `>=0.33` ignore blocks nothing until 0.33 ships; keep it, since it +ties uniffi to the Go generator. + +Open at the end of the m1 run: + +- vt100 0.17 and 0.18 (moq-cli dev-dependency) were still inside the + cooldown (published 2026-10-18 and 19). +- web-transport-iroh 0.8.4 takes kio 0.6, removing the kio 0.5 duplicate. + It shipped the day of the run, so Dependabot's cargo group should land it; + confirm. +- The first Dependabot PR for `test/smoke/flake.lock` must also bump the npm + `playwright` pin in `test/smoke/clients/js/package.json` to the flake's + `PLAYWRIGHT_VERSION`, or `freshness.sh` fails it. +- http-cache-reqwest stays on its 1.0 prerelease (alpha.9) until 1.0 ships. Advisories waiting on upstream, with no exceptions or overrides added: - ashpd 0.13 pulls zbus 5 and the unmaintained zvariant, zvariant_derive, and zbus_names (RUSTSEC-2026-0370, 0371, 0372). Upstream's [zbus 6 port](https://github.com/bilelmoussaoui/ashpd/pull/491) is open. -- The root Bun audit has six findings in four packages: VitePress 1.6.4 pins +- basic-toml (RUSTSEC-2026-0374) comes through askama_derive's default + `config` feature in uniffi_bindgen 0.32, which reads its `askama.toml`. + It only reaches the generator-only uniffi fork and never ships. +- The root Bun audit has nine findings in four packages: VitePress 1.6.4 pins Vite 5 and its vulnerable esbuild (VitePress 2 is still alpha), `@tailwindcss/typography` 0.5.20 pins postcss-selector-parser 6, and braces 3.0.3 has no fix for [GHSA-vfj7-8cjw-p6xm](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm). - The four Worker lockfiles audit clean. + The Worker lockfiles audit clean. - paste (RUSTSEC-2024-0436) remains through tikv-jemalloc-ctl and iroh's netlink-packet-core 0.8. tikv-jemallocator's unreleased main drops it. -### Baselines (2026-10-19, end of m0) +### Baselines (2026-10-20, m1 run) + +Count registry packages only: moq-auth and moq-pattern deliberately depend on +their own published versions for compatibility tests, and the uniffi fork is +a git source. -Cargo.lock: 1,079 packages, 91 names with several versions (110 extra). -Root bun.lock: 660 package names, 72 with several versions (81 extra), -counted per name in its `packages` table; the Worker locks have none. Most -duplicates are ecosystem transitions owned upstream: +Cargo.lock: 1,081 packages, 91 registry names with several versions (109 +extra). Root bun.lock: 660 non-workspace package names, 72 with several +versions (81 extra), counted per name in its `packages` table; the Worker +locks have none. Most duplicates are ecosystem transitions owned upstream: - RustCrypto's previous generation (digest 0.10, sha2 0.10, hmac 0.12, der 0.7, pkcs8 0.10): rsa, stun-types, http-auth, srt-protocol, jsonwebtoken. @@ -71,13 +98,14 @@ duplicates are ecosystem transitions owned upstream: - rustls-acme holds rcgen 0.13, pem 3, and async-web-client (thiserror 1, webpki-roots 0.26). winit 0.30 holds rustix 0.38, x11rb 0.13, and objc2 0.5 until 0.31 leaves beta. -- Our own crates: web-transport-iroh 0.8.3 holds kio 0.5 (main already takes - 0.6; iroh is an accepted exception to moq taking no new work in - moq-dev/web-transport, so this lasts until that crate is released on its own), moq-vaapi holds bindgen - 0.70, libloading 0.8, and thiserror 1, and mp4-atom holds thiserror 1. +- gstreamer 0.25 moved to system-deps 9; libspa (PipeWire) still holds 7. +- Our own crates: web-transport-iroh 0.8.3 holds kio 0.5 (see above), + moq-vaapi holds bindgen 0.70, libloading 0.8, and thiserror 1, and mp4-atom + holds thiserror 1. - Bun has no dedupe, so same-major duplicates (`@babel/types`, `@vue/shared`, `minimatch`, `picomatch`, `yaml`) persist until a parent - re-resolves. + re-resolves. A transitive-only security bump means editing the lock entry + (version and integrity) and verifying with `bun install --frozen-lockfile`. ### Kept on purpose @@ -89,6 +117,8 @@ duplicates are ecosystem transitions owned upstream: - assert_matches, cpu-time, stats_alloc: moq-quic stays close to quinn. - unsafe-libopus: the [Opus backend](/quest/m2/audio-opus-backend.md) quest owns the comparison. +- moq-gst declares `rust-version = "1.92"` for gstreamer 0.25, above the + 1.91 workspace floor, the same way moq-relay and moq-cli carry their own. ### Hand-rolled code @@ -101,3 +131,9 @@ hex formatting in moq-auth and moq-hls, the STUN token bucket, the JS deep-equal pair, and duplicated WebVTT stamps and `jwt=` lookups. `js/publish` and `js/watch` carry byte-identical UI helpers (`graph.ts` and near copies), which is duplication rather than a dependency question. +The m1 run came a day after m0's and did not re-review it; check code +added since. + +## Required + +- [Release cut](/quest/m2/release/cut.md) - the breaking release ships before the next run From ec2e936ec631d0598419899e95e1229e9525c63c Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Wed, 21 Oct 2026 00:12:24 -0700 Subject: [PATCH 11/12] docs(gst): link the gstreamer 0.25 migration to its PR Co-Authored-By: Claude Opus 5.5 --- rs/moq-gst/MIGRATE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rs/moq-gst/MIGRATE.md b/rs/moq-gst/MIGRATE.md index b20dc8cd68e..dfaf1ae1f81 100644 --- a/rs/moq-gst/MIGRATE.md +++ b/rs/moq-gst/MIGRATE.md @@ -4,7 +4,7 @@ How to update your pipelines for each breaking change, newest first. ## Unreleased -### Rust embedders move to gstreamer 0.25 +### Rust embedders move to gstreamer 0.25 (#6169) Only Rust code that links `gstmoq` as a library is affected; pipelines and the loadable plugin are not. `plugin_init`, `plugin_register_static`, and the `glib::Enum` impls on `ConnectionStatus` and `MediaContainer` now use gstreamer 0.25 and glib 0.22 types, which need Rust 1.92. From b8dd66a89d4b86ea86556a5c1fcdc7cbfacc223e Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Wed, 21 Oct 2026 00:27:12 -0700 Subject: [PATCH 12/12] test(js): drive the audit test through discovered lockfiles audit.sh now walks `git ls-files '*bun.lock'`, so the fake git answers that query, and the hand-kept project list that guarded coverage goes away: coverage now holds by construction. Co-Authored-By: Claude Opus 5.5 --- sh/js/audit.test.py | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/sh/js/audit.test.py b/sh/js/audit.test.py index 480d5790183..6b82073e7d6 100644 --- a/sh/js/audit.test.py +++ b/sh/js/audit.test.py @@ -7,21 +7,11 @@ import unittest ROOT = Path(__file__).resolve().parents[2] -PROJECTS = [".", "infra/apt", "infra/rpm", "infra/moq-sh", "demo/pub"] +# The script finds projects through `git ls-files`, so these only shape the fixture. +PROJECTS = [".", "demo/pub", "infra/apt", "infra/nix"] class Audit(unittest.TestCase): - def test_every_lockfile_is_covered(self): - lockfiles = subprocess.check_output( - ["git", "ls-files", "--cached", "--others", "--exclude-standard", "*bun.lock"], - cwd=ROOT, - text=True, - ).splitlines() - self.assertEqual( - sorted(str(Path(path).parent) for path in lockfiles if (ROOT / path).exists()), - sorted(PROJECTS), - ) - def run_audit(self, failing): with tempfile.TemporaryDirectory() as directory: root = Path(directory) @@ -30,7 +20,13 @@ def run_audit(self, failing): tools = root / "bin" tools.mkdir() for name, script in { - "git": '#!/bin/sh\nprintf "%s\\n" "$AUDIT_ROOT"\n', + "git": """#!/bin/sh +case "$1" in +rev-parse) printf '%s\\n' "$AUDIT_ROOT" ;; +ls-files) printf '%s\\n' $AUDIT_LOCKS ;; +*) exit 2 ;; +esac +""", "bun": """#!/bin/sh test "$#" = 1 && test "$1" = audit || exit 2 printf '%s\\n' "$PWD" >> "$AUDIT_LOG" @@ -46,6 +42,7 @@ def run_audit(self, failing): **os.environ, "PATH": f"{tools}:{os.environ['PATH']}", "AUDIT_ROOT": str(root), + "AUDIT_LOCKS": " ".join(f"{project}/bun.lock" for project in PROJECTS), "AUDIT_LOG": str(root / "audits"), "AUDIT_FAIL": str(root / failing) if failing else "", },