From 317a5f7cafda5a1d62b457b93174caa52fa092a8 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Thu, 15 Oct 2026 11:14:11 -0400 Subject: [PATCH 01/33] force tmp to 0.2.7 Merges the 0.0.28, 0.0.33, 0.1.0 and 0.2.3 copies into 0.2.7, which fixes CVE-2025-54798, CVE-2026-44705 and CVE-2026-49982. All dependents are dev/build tooling and only use APIs still present in 0.2.x. Co-Authored-By: Claude Sonnet 5.5 --- package.json | 3 ++- yarn.lock | 30 ++---------------------------- 2 files changed, 4 insertions(+), 29 deletions(-) diff --git a/package.json b/package.json index 513a952f5..bbb41906e 100644 --- a/package.json +++ b/package.json @@ -55,7 +55,8 @@ "ember-a11y-testing/ember-auto-import": "^2.10.0", "**/ember-try-config/ember-source-channel-url": "^3.0.0", "@babel/plugin-transform-modules-systemjs": "^7.29.4", - "browserslist": "^4.28.7" + "browserslist": "^4.28.7", + "tmp": "^0.2.7" }, "dependencies": { "@ember/render-modifiers": "^2.1.0", diff --git a/yarn.lock b/yarn.lock index a3e794587..10b9e55dc 100644 --- a/yarn.lock +++ b/yarn.lock @@ -8843,7 +8843,7 @@ os-homedir@^1.0.0: resolved "https://registry.yarnpkg.com/os-homedir/-/os-homedir-1.0.2.tgz#ffbc4988336e0e833de0c168c7ef152121aa7fb3" integrity sha512-B5JU3cabzk8c67mRRd3ECmROafjYMXbuzlwtqdM8IbS8ktlTix8aFGb2bAGKrSRIlnfKwovGUUr72JUPyOb6kQ== -os-tmpdir@^1.0.0, os-tmpdir@~1.0.1, os-tmpdir@~1.0.2: +os-tmpdir@^1.0.0: version "1.0.2" resolved "https://registry.yarnpkg.com/os-tmpdir/-/os-tmpdir-1.0.2.tgz#bbe67406c79aa85c5cfec766fe5734555dfa1274" integrity sha512-D2FR03Vir7FIu45XBY20mTb+/ZSWB00sjU9jdQXt83gDrI4Ztz5Fs7/yy74g2N5SVQY4xY1qDr4rNddwYRVX0g== @@ -10903,33 +10903,7 @@ tmp-sync@^1.0.0: fs-sync "^1.0.4" osenv "^0.1.0" -tmp@0.0.28: - version "0.0.28" - resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.0.28.tgz#172735b7f614ea7af39664fa84cf0de4e515d120" - integrity sha512-c2mmfiBmND6SOVxzogm1oda0OJ1HZVIk/5n26N59dDTh80MUeavpiCls4PGAdkX1PFkKokLpcf7prSjCeXLsJg== - dependencies: - os-tmpdir "~1.0.1" - -tmp@^0.0.33: - version "0.0.33" - resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.0.33.tgz#6d34335889768d21b2bcda0aa277ced3b1bfadf9" - integrity sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw== - dependencies: - os-tmpdir "~1.0.2" - -tmp@^0.1.0: - version "0.1.0" - resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.1.0.tgz#ee434a4e22543082e294ba6201dcc6eafefa2877" - integrity sha512-J7Z2K08jbGcdA1kkQpJSqLF6T0tdQqpR2pnSUXsIchbPdTI9v3e85cLW0d6WDhwuAleOV71j2xWs8qMPfK7nKw== - dependencies: - rimraf "^2.6.3" - -tmp@^0.2.1: - version "0.2.3" - resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.3.tgz#eb783cc22bc1e8bebd0671476d46ea4eb32a79ae" - integrity sha512-nZD7m9iCPC5g0pYmcaxogYKggSfLsdxl8of3Q/oIbqCqLLIO9IAF0GWjX1z9NZRHPiXv8Wex4yDCaZsgEw0Y8w== - -tmp@^0.2.5: +tmp@0.0.28, tmp@^0.0.33, tmp@^0.1.0, tmp@^0.2.1, tmp@^0.2.5, tmp@^0.2.7: version "0.2.7" resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.7.tgz#26f4db11d1601ce8012dcb8a798ece1c06a99059" integrity sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw== From 3af9a87cc15b78b78507160d708d6730ebc2c9f8 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 10:30:35 -0400 Subject: [PATCH 02/33] SCF-2415: normalize tmp resolution key in yarn.lock The tmp resolution is "^0.2.7", but the lockfile recorded it as "tmp@0.2.7". Running yarn install rewrites the key; no resolved version changes. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/yarn.lock b/yarn.lock index 10b9e55dc..f487676c1 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1,7 +1,6 @@ # THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY. # yarn lockfile v1 - "@babel/code-frame@7.12.11": version "7.12.11" resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.12.11.tgz#f4ad435aa263db935b8f10f2c552d23fb716a63f" @@ -10903,11 +10902,6 @@ tmp-sync@^1.0.0: fs-sync "^1.0.4" osenv "^0.1.0" -tmp@0.0.28, tmp@^0.0.33, tmp@^0.1.0, tmp@^0.2.1, tmp@^0.2.5, tmp@^0.2.7: - version "0.2.7" - resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.7.tgz#26f4db11d1601ce8012dcb8a798ece1c06a99059" - integrity sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw== - tmpl@1.0.5: version "1.0.5" resolved "https://registry.yarnpkg.com/tmpl/-/tmpl-1.0.5.tgz#8683e0b902bb9c20c4f726e3c0b69f36518c07cc" @@ -11830,3 +11824,8 @@ yocto-queue@^0.1.0: version "0.1.0" resolved "https://registry.yarnpkg.com/yocto-queue/-/yocto-queue-0.1.0.tgz#0294eb3dee05028d31ee1a5fa2c556a6aaf10a1b" integrity sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q== + +tmp@0.0.28, tmp@^0.0.33, tmp@^0.1.0, tmp@^0.2.1, tmp@^0.2.5, tmp@^0.2.7: + version "0.2.7" + resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.7.tgz#26f4db11d1601ce8012dcb8a798ece1c06a99059" + integrity sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw== From 97f9ee5e42b9d03f304ca7ceb1369381d6c8eada Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 10:33:31 -0400 Subject: [PATCH 03/33] SCF-2415: force brace-expansion to 1.1.21 brace-expansion 1.1.12 -> 1.1.21 (forced via resolutions). Pulled in through minimatch 3.x. Fixes CVE-2026-13149, CVE-2026-14257, CVE-2026-33750 and CVE-2026-69152 (COMP-10025..10028), plus CVE-2026-102276, CVE-2026-102277 and CVE-2026-102278. Co-Authored-By: Claude Opus 5.5 --- package.json | 3 ++- yarn.lock | 16 ++++++++-------- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/package.json b/package.json index bbb41906e..012d3679e 100644 --- a/package.json +++ b/package.json @@ -56,7 +56,8 @@ "**/ember-try-config/ember-source-channel-url": "^3.0.0", "@babel/plugin-transform-modules-systemjs": "^7.29.4", "browserslist": "^4.28.7", - "tmp": "^0.2.7" + "tmp": "^0.2.7", + "brace-expansion": "^1.1.21" }, "dependencies": { "@ember/render-modifiers": "^2.1.0", diff --git a/yarn.lock b/yarn.lock index f487676c1..daabe77c7 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2603,14 +2603,6 @@ bower-endpoint-parser@0.2.2: resolved "https://registry.yarnpkg.com/bower-endpoint-parser/-/bower-endpoint-parser-0.2.2.tgz#00b565adbfab6f2d35addde977e97962acbcb3f6" integrity sha512-YWZHhWkPdXtIfH3VRu3QIV95sa75O9vrQWBOHjexWCLBCTy5qJvRr36LXTqFwTchSXVlzy5piYJOjzHr7qhsNg== -brace-expansion@^1.1.7: - version "1.1.12" - resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.12.tgz#ab9b454466e5a8cc3a187beaad580412a9c5b843" - integrity sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg== - dependencies: - balanced-match "^1.0.0" - concat-map "0.0.1" - braces@^2.3.1: version "2.3.2" resolved "https://registry.yarnpkg.com/braces/-/braces-2.3.2.tgz#5979fd3f14cd531565e5fa2df1abfff1dfaee729" @@ -11829,3 +11821,11 @@ tmp@0.0.28, tmp@^0.0.33, tmp@^0.1.0, tmp@^0.2.1, tmp@^0.2.5, tmp@^0.2.7: version "0.2.7" resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.7.tgz#26f4db11d1601ce8012dcb8a798ece1c06a99059" integrity sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw== + +brace-expansion@^1.1.21, brace-expansion@^1.1.7: + version "1.1.21" + resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.21.tgz#edf4fab5c64d051aea5a8def49aba1c7522279f3" + integrity sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw== + dependencies: + balanced-match "^1.0.0" + concat-map "0.0.1" From b0c1cecb5e93dd643066308b355f1426d8cc4814 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 10:36:22 -0400 Subject: [PATCH 04/33] SCF-2415: force minimatch to 3.1.5 minimatch 3.1.2 -> 3.1.5 and mocha's exact 3.0.4 pin -> 3.1.5 (forced via resolutions). Fixes CVE-2026-26996, CVE-2026-27903 and CVE-2026-27904 (COMP-10014..10016), plus CVE-2022-3517 on 3.0.4. The floor stays on 3.x: the lockfile also resolves "minimatch@*", which would otherwise jump to a major that needs Node >= 20. Co-Authored-By: Claude Opus 5.5 --- package.json | 3 ++- yarn.lock | 21 +++++++-------------- 2 files changed, 9 insertions(+), 15 deletions(-) diff --git a/package.json b/package.json index 012d3679e..883a7e041 100644 --- a/package.json +++ b/package.json @@ -57,7 +57,8 @@ "@babel/plugin-transform-modules-systemjs": "^7.29.4", "browserslist": "^4.28.7", "tmp": "^0.2.7", - "brace-expansion": "^1.1.21" + "brace-expansion": "^1.1.21", + "minimatch": "^3.1.5" }, "dependencies": { "@ember/render-modifiers": "^2.1.0", diff --git a/yarn.lock b/yarn.lock index daabe77c7..cec050996 100644 --- a/yarn.lock +++ b/yarn.lock @@ -8343,20 +8343,6 @@ mini-css-extract-plugin@^2.5.2: schema-utils "^4.0.0" tapable "^2.2.1" -minimatch@*, "minimatch@2 || 3", minimatch@^3.0.0, minimatch@^3.0.2, minimatch@^3.0.4, minimatch@^3.1.1: - version "3.1.2" - resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-3.1.2.tgz#19cd194bfd3e428f049a70817c038d89ab4be35b" - integrity sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw== - dependencies: - brace-expansion "^1.1.7" - -minimatch@3.0.4: - version "3.0.4" - resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-3.0.4.tgz#5166e286457f03306064be5497e8dbb0c3d32083" - integrity sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA== - dependencies: - brace-expansion "^1.1.7" - minimist@^0.2.1: version "0.2.4" resolved "https://registry.yarnpkg.com/minimist/-/minimist-0.2.4.tgz#0085d5501e29033748a2f2a4da0180142697a475" @@ -11829,3 +11815,10 @@ brace-expansion@^1.1.21, brace-expansion@^1.1.7: dependencies: balanced-match "^1.0.0" concat-map "0.0.1" + +minimatch@*, "minimatch@2 || 3", minimatch@3.0.4, minimatch@^3.0.0, minimatch@^3.0.2, minimatch@^3.0.4, minimatch@^3.1.1, minimatch@^3.1.5: + version "3.1.5" + resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-3.1.5.tgz#580c88f8d5445f2bd6aa8f3cadefa0de79fbd69e" + integrity sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w== + dependencies: + brace-expansion "^1.1.7" From 6922a1a549ef49e06f6d04847ed28ff90bc8a700 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 10:38:49 -0400 Subject: [PATCH 05/33] SCF-2415: force picomatch to 2.3.2 picomatch 2.3.1 -> 2.3.2 (forced via resolutions). Pulled in through micromatch, anymatch and readdirp. Fixes CVE-2026-33671 and CVE-2026-33672 (COMP-10009, COMP-10010). Co-Authored-By: Claude Opus 5.5 --- package.json | 3 ++- yarn.lock | 8 ++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index 883a7e041..185780f58 100644 --- a/package.json +++ b/package.json @@ -58,7 +58,8 @@ "browserslist": "^4.28.7", "tmp": "^0.2.7", "brace-expansion": "^1.1.21", - "minimatch": "^3.1.5" + "minimatch": "^3.1.5", + "picomatch": "^2.3.2" }, "dependencies": { "@ember/render-modifiers": "^2.1.0", diff --git a/yarn.lock b/yarn.lock index cec050996..14bf03f40 100644 --- a/yarn.lock +++ b/yarn.lock @@ -9076,10 +9076,10 @@ picocolors@^1.0.0, picocolors@^1.1.1: resolved "https://registry.yarnpkg.com/picocolors/-/picocolors-1.1.1.tgz#3d321af3eab939b083c8f929a1d12cda81c26b6b" integrity sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA== -picomatch@^2.0.4, picomatch@^2.2.1, picomatch@^2.3.1: - version "2.3.1" - resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-2.3.1.tgz#3ba3833733646d9d3e4995946c1365a67fb07a42" - integrity sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA== +picomatch@^2.0.4, picomatch@^2.2.1, picomatch@^2.3.1, picomatch@^2.3.2: + version "2.3.2" + resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-2.3.2.tgz#5a942915e26b372dc0f0e6753149a16e6b1c5601" + integrity sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA== pidtree@^0.3.0: version "0.3.1" From 47be990e8581a65238fb7baec54c1d0ff23ac2c6 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:05:56 -0400 Subject: [PATCH 06/33] force braces to 3.0.3 The last braces 2.3.2 copies (high) came from micromatch 3 under ember-cli's sane watcher and its anymatch. micromatch 3 only calls braces(pattern, options) and uses the returned array, which braces 3 still provides. Comparing micromatch 3 before and after over brace-heavy globs: every positive pattern (lists, ranges, nested, extensions) matches the same files. Negated brace globs such as `!{a,b}/**` now compile to an extglob and match differently, but sane only ever receives brace-free patterns here (its default `**/*` and broccoli's `/**` ignore), and micromatch skips braces entirely for those. `ember serve` still detects a touched component and rebuilds. Audit: high 56 -> 52. Co-Authored-By: Claude Opus 5.5 --- package.json | 3 +- yarn.lock | 108 +++++++++++---------------------------------------- 2 files changed, 24 insertions(+), 87 deletions(-) diff --git a/package.json b/package.json index 185780f58..1f86b1e47 100644 --- a/package.json +++ b/package.json @@ -59,7 +59,8 @@ "tmp": "^0.2.7", "brace-expansion": "^1.1.21", "minimatch": "^3.1.5", - "picomatch": "^2.3.2" + "picomatch": "^2.3.2", + "braces": "^3.0.3" }, "dependencies": { "@ember/render-modifiers": "^2.1.0", diff --git a/yarn.lock b/yarn.lock index 14bf03f40..eb55d36ec 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1,6 +1,7 @@ # THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY. # yarn lockfile v1 + "@babel/code-frame@7.12.11": version "7.12.11" resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.12.11.tgz#f4ad435aa263db935b8f10f2c552d23fb716a63f" @@ -2120,11 +2121,6 @@ arr-diff@^4.0.0: resolved "https://registry.yarnpkg.com/arr-diff/-/arr-diff-4.0.0.tgz#d6461074febfec71e7e15235761a329a5dc7c520" integrity sha512-YVIQ82gZPGBebQV/a8dar4AitzCQs0jjXwMPZllpXMaGjXPYVUawSxQrRsjhjupyVxEvbHgUmIhKVlND+j02kA== -arr-flatten@^1.1.0: - version "1.1.0" - resolved "https://registry.yarnpkg.com/arr-flatten/-/arr-flatten-1.1.0.tgz#36048bbff4e7b47e136644316c99669ea5ae91f1" - integrity sha512-L3hKV5R/p5o81R7O02IGnwpDmkp6E982XhtbuwSe3O4qOtMMMtodicASA1Cny2U+aCXcNpml+m4dPsvsJ3jatg== - arr-union@^3.1.0: version "3.1.0" resolved "https://registry.yarnpkg.com/arr-union/-/arr-union-3.1.0.tgz#e39b09aea9def866a8f206e288af63919bae39c4" @@ -2603,23 +2599,15 @@ bower-endpoint-parser@0.2.2: resolved "https://registry.yarnpkg.com/bower-endpoint-parser/-/bower-endpoint-parser-0.2.2.tgz#00b565adbfab6f2d35addde977e97962acbcb3f6" integrity sha512-YWZHhWkPdXtIfH3VRu3QIV95sa75O9vrQWBOHjexWCLBCTy5qJvRr36LXTqFwTchSXVlzy5piYJOjzHr7qhsNg== -braces@^2.3.1: - version "2.3.2" - resolved "https://registry.yarnpkg.com/braces/-/braces-2.3.2.tgz#5979fd3f14cd531565e5fa2df1abfff1dfaee729" - integrity sha512-aNdbnj9P8PjdXU4ybaWLK2IF3jc/EoDYbC7AazW6to3TRsfXxscC9UXOB5iDiEQrkyIbWp2SLQda4+QAa7nc3w== +brace-expansion@^1.1.21, brace-expansion@^1.1.7: + version "1.1.21" + resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.21.tgz#edf4fab5c64d051aea5a8def49aba1c7522279f3" + integrity sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw== dependencies: - arr-flatten "^1.1.0" - array-unique "^0.3.2" - extend-shallow "^2.0.1" - fill-range "^4.0.0" - isobject "^3.0.1" - repeat-element "^1.1.2" - snapdragon "^0.8.1" - snapdragon-node "^2.0.1" - split-string "^3.0.2" - to-regex "^3.0.1" + balanced-match "^1.0.0" + concat-map "0.0.1" -braces@^3.0.3, braces@~3.0.2: +braces@^2.3.1, braces@^3.0.3, braces@~3.0.2: version "3.0.3" resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.3.tgz#490332f40919452272d55a8480adc0c441358789" integrity sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA== @@ -5906,16 +5894,6 @@ filesize@^6.1.0: resolved "https://registry.yarnpkg.com/filesize/-/filesize-6.4.0.tgz#914f50471dd66fdca3cefe628bd0cde4ef769bcd" integrity sha512-mjFIpOHC4jbfcTfoh4rkWpI31mF7viw9ikj/JyLoKzqlwG/YsefKfvYlYhdYdg/9mtK2z1AzgN/0LvVQ3zdlSQ== -fill-range@^4.0.0: - version "4.0.0" - resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-4.0.0.tgz#d544811d428f98eb06a63dc402d2403c328c38f7" - integrity sha512-VcpLTWqWDiTerugjj8e3+esbg+skS3M9e54UuR3iCeIDMXCLTsAH8hTSzDQU/X6/6t3eYkOKoZSef2PlU6U1XQ== - dependencies: - extend-shallow "^2.0.1" - is-number "^3.0.0" - repeat-string "^1.6.1" - to-regex-range "^2.1.0" - fill-range@^7.1.1: version "7.1.1" resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.1.1.tgz#44265d3cac07e3ea7dc247516380643754a05292" @@ -7693,7 +7671,7 @@ keyv@^4.5.3: dependencies: json-buffer "3.0.1" -kind-of@^3.0.2, kind-of@^3.0.3, kind-of@^3.2.0: +kind-of@^3.0.2, kind-of@^3.0.3: version "3.2.2" resolved "https://registry.yarnpkg.com/kind-of/-/kind-of-3.2.2.tgz#31ea21a734bab9bbb0f32466d893aea51e4a3c64" integrity sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ== @@ -8343,6 +8321,13 @@ mini-css-extract-plugin@^2.5.2: schema-utils "^4.0.0" tapable "^2.2.1" +minimatch@*, "minimatch@2 || 3", minimatch@3.0.4, minimatch@^3.0.0, minimatch@^3.0.2, minimatch@^3.0.4, minimatch@^3.1.1, minimatch@^3.1.5: + version "3.1.5" + resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-3.1.5.tgz#580c88f8d5445f2bd6aa8f3cadefa0de79fbd69e" + integrity sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w== + dependencies: + brace-expansion "^1.1.7" + minimist@^0.2.1: version "0.2.4" resolved "https://registry.yarnpkg.com/minimist/-/minimist-0.2.4.tgz#0085d5501e29033748a2f2a4da0180142697a475" @@ -9603,16 +9588,6 @@ remove-trailing-separator@^1.0.1: resolved "https://registry.yarnpkg.com/remove-trailing-separator/-/remove-trailing-separator-1.1.0.tgz#c24bce2a283adad5bc3f58e0d48249b92379d8ef" integrity sha512-/hS+Y0u3aOfIETiaiirUFwDBDzmXPvO+jAfKTitUngIPzdKc6Z0LoFjM/CK5PL4C+eKwHohlHAb6H0VFfmmUsw== -repeat-element@^1.1.2: - version "1.1.4" - resolved "https://registry.yarnpkg.com/repeat-element/-/repeat-element-1.1.4.tgz#be681520847ab58c7568ac75fbfad28ed42d39e9" - integrity sha512-LFiNfRcSu7KK3evMyYOuCzv3L10TW7yC1G2/+StMjK8Y6Vqd2MG7r/Qjw4ghtuCOjFvlnms/iMmLqpvW/ES/WQ== - -repeat-string@^1.6.1: - version "1.6.1" - resolved "https://registry.yarnpkg.com/repeat-string/-/repeat-string-1.6.1.tgz#8dcae470e1c88abc2d600fff4a776286da75e637" - integrity sha512-PV0dzCYDNfRi1jCDbJzpW7jNNDRuCOG/jI5ctQcGKt/clZD+YcPS3yIlWuTJMmESC8aevCFmWJy5wjAFgNqN6w== - require-directory@^2.1.1: version "2.1.1" resolved "https://registry.yarnpkg.com/require-directory/-/require-directory-2.1.1.tgz#8c64ad5fd30dab1c976e2344ffe7f792a6a6df42" @@ -10203,22 +10178,6 @@ snake-case@^3.0.3: dot-case "^3.0.4" tslib "^2.0.3" -snapdragon-node@^2.0.1: - version "2.1.1" - resolved "https://registry.yarnpkg.com/snapdragon-node/-/snapdragon-node-2.1.1.tgz#6c175f86ff14bdb0724563e8f3c1b021a286853b" - integrity sha512-O27l4xaMYt/RSQ5TR3vpWCAB5Kb/czIcqUFOM/C4fYcLnbZUc1PkjTAMjof2pBWaSTwOUd6qUHcFGVGj7aIwnw== - dependencies: - define-property "^1.0.0" - isobject "^3.0.0" - snapdragon-util "^3.0.1" - -snapdragon-util@^3.0.1: - version "3.0.1" - resolved "https://registry.yarnpkg.com/snapdragon-util/-/snapdragon-util-3.0.1.tgz#f956479486f2acd79700693f6f7b805e45ab56e2" - integrity sha512-mbKkMdQKsjX4BAL4bRYTj21edOf8cN7XHdYUJEe+Zn99hVEYcMvKPct1IqNe7+AZPirn8BCDOQBHQZknqmKlZQ== - dependencies: - kind-of "^3.2.0" - snapdragon@^0.8.1: version "0.8.2" resolved "https://registry.yarnpkg.com/snapdragon/-/snapdragon-0.8.2.tgz#64922e7c565b0e14204ba1aa7d6964278d25182d" @@ -10371,7 +10330,7 @@ spdx-license-ids@^3.0.0: resolved "https://registry.yarnpkg.com/spdx-license-ids/-/spdx-license-ids-3.0.21.tgz#6d6e980c9df2b6fc905343a3b2d702a6239536c3" integrity sha512-Bvg/8F5XephndSK3JffaRqdT+gyhfqIPwDHpX80tJrF8QQRYMo8sNMeaZ2Dp5+jhwKnUmIOyFFQfHRkjJm5nXg== -split-string@^3.0.1, split-string@^3.0.2: +split-string@^3.0.1: version "3.1.0" resolved "https://registry.yarnpkg.com/split-string/-/split-string-3.1.0.tgz#7cb09dda3a86585705c64b39a6466038682e8fe2" integrity sha512-NzNVhJDYpwceVVii8/Hu6DKfD2G+NrQHlS/V/qgv763EYudVwEcMQNxd2lh+0VrUByXN/oJkl5grOhYWvQUYiw== @@ -10880,6 +10839,11 @@ tmp-sync@^1.0.0: fs-sync "^1.0.4" osenv "^0.1.0" +tmp@0.0.28, tmp@^0.0.33, tmp@^0.1.0, tmp@^0.2.1, tmp@^0.2.5, tmp@^0.2.7: + version "0.2.7" + resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.7.tgz#26f4db11d1601ce8012dcb8a798ece1c06a99059" + integrity sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw== + tmpl@1.0.5: version "1.0.5" resolved "https://registry.yarnpkg.com/tmpl/-/tmpl-1.0.5.tgz#8683e0b902bb9c20c4f726e3c0b69f36518c07cc" @@ -10892,14 +10856,6 @@ to-object-path@^0.3.0: dependencies: kind-of "^3.0.2" -to-regex-range@^2.1.0: - version "2.1.1" - resolved "https://registry.yarnpkg.com/to-regex-range/-/to-regex-range-2.1.1.tgz#7c80c17b9dfebe599e27367e0d4dd5590141db38" - integrity sha512-ZZWNfCjUokXXDGXFpZehJIkZqq91BcULFq/Pi7M5i4JnxXdhMKAK682z8bCW3o8Hj1wuuzoKcW3DfVzaP6VuNg== - dependencies: - is-number "^3.0.0" - repeat-string "^1.6.1" - to-regex-range@^5.0.1: version "5.0.1" resolved "https://registry.yarnpkg.com/to-regex-range/-/to-regex-range-5.0.1.tgz#1648c44aae7c8d988a326018ed72f5b4dd0392e4" @@ -11802,23 +11758,3 @@ yocto-queue@^0.1.0: version "0.1.0" resolved "https://registry.yarnpkg.com/yocto-queue/-/yocto-queue-0.1.0.tgz#0294eb3dee05028d31ee1a5fa2c556a6aaf10a1b" integrity sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q== - -tmp@0.0.28, tmp@^0.0.33, tmp@^0.1.0, tmp@^0.2.1, tmp@^0.2.5, tmp@^0.2.7: - version "0.2.7" - resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.7.tgz#26f4db11d1601ce8012dcb8a798ece1c06a99059" - integrity sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw== - -brace-expansion@^1.1.21, brace-expansion@^1.1.7: - version "1.1.21" - resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.21.tgz#edf4fab5c64d051aea5a8def49aba1c7522279f3" - integrity sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw== - dependencies: - balanced-match "^1.0.0" - concat-map "0.0.1" - -minimatch@*, "minimatch@2 || 3", minimatch@3.0.4, minimatch@^3.0.0, minimatch@^3.0.2, minimatch@^3.0.4, minimatch@^3.1.1, minimatch@^3.1.5: - version "3.1.5" - resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-3.1.5.tgz#580c88f8d5445f2bd6aa8f3cadefa0de79fbd69e" - integrity sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w== - dependencies: - brace-expansion "^1.1.7" From 5151df02c2336248525be3da59af43eb84d35cc5 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 10:41:20 -0400 Subject: [PATCH 07/33] SCF-2415: force fast-uri to 3.1.9 fast-uri 3.0.6 -> 3.1.9 (forced via resolutions). Pulled in through ajv 8 (schema-utils, eslint's table). Fixes CVE-2026-6321, CVE-2026-6322, CVE-2026-13676, CVE-2026-16221, CVE-2026-18446, CVE-2026-75975 and CVE-2026-76172 (COMP-10038..10042, COMP-10047, COMP-10051), plus CVE-2026-84292, CVE-2026-86472, CVE-2026-110095, CVE-2026-110306 and CVE-2026-110725. Co-Authored-By: Claude Opus 5.5 --- package.json | 3 ++- yarn.lock | 11 +++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index 1f86b1e47..332032907 100644 --- a/package.json +++ b/package.json @@ -60,7 +60,8 @@ "brace-expansion": "^1.1.21", "minimatch": "^3.1.5", "picomatch": "^2.3.2", - "braces": "^3.0.3" + "braces": "^3.0.3", + "fast-uri": "^3.1.9" }, "dependencies": { "@ember/render-modifiers": "^2.1.0", diff --git a/yarn.lock b/yarn.lock index eb55d36ec..dc05bf6c4 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1,7 +1,6 @@ # THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY. # yarn lockfile v1 - "@babel/code-frame@7.12.11": version "7.12.11" resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.12.11.tgz#f4ad435aa263db935b8f10f2c552d23fb716a63f" @@ -5800,11 +5799,6 @@ fast-sourcemap-concat@^2.1.0: source-map "^0.4.2" source-map-url "^0.3.0" -fast-uri@^3.0.1: - version "3.0.6" - resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.0.6.tgz#88f130b77cfaea2378d56bf970dea21257a68748" - integrity sha512-Atfo14OibSv5wAp4VWNsFYE1AchQRTv9cBGWET4pZWHzYshFSS9NQI6I57rdKn9croWVMbYFbLhJ+yJvmZIIHw== - fastboot-express-middleware@4.1.2: version "4.1.2" resolved "https://registry.yarnpkg.com/fastboot-express-middleware/-/fastboot-express-middleware-4.1.2.tgz#6a383c282fdc07ee3f90039701bb0dab11129179" @@ -11758,3 +11752,8 @@ yocto-queue@^0.1.0: version "0.1.0" resolved "https://registry.yarnpkg.com/yocto-queue/-/yocto-queue-0.1.0.tgz#0294eb3dee05028d31ee1a5fa2c556a6aaf10a1b" integrity sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q== + +fast-uri@^3.0.1, fast-uri@^3.1.9: + version "3.1.9" + resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.9.tgz#f1deba822b1d6ac79da2f860e872a63470cff203" + integrity sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ== From 05042c2aac4c498c42607240e6c5829b0b8b0d2a Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 10:49:48 -0400 Subject: [PATCH 08/33] SCF-2415: force nanoid to 3.3.20 mocha 8 pins nanoid 3.1.20 exactly; forcing it via resolutions merges it with postcss's 3.3.20. Fixes CVE-2026-67213, CVE-2026-67214 and CVE-2026-73086 (COMP-10021, COMP-10022, COMP-10046), plus CVE-2021-23566 and CVE-2024-55565 on 3.1.20. Dev-only: postcss's copy, the one that ships through runtime dependencies, was already patched. Co-Authored-By: Claude Opus 5.5 --- package.json | 3 ++- yarn.lock | 15 +++++---------- 2 files changed, 7 insertions(+), 11 deletions(-) diff --git a/package.json b/package.json index 332032907..ecc5fe1d1 100644 --- a/package.json +++ b/package.json @@ -61,7 +61,8 @@ "minimatch": "^3.1.5", "picomatch": "^2.3.2", "braces": "^3.0.3", - "fast-uri": "^3.1.9" + "fast-uri": "^3.1.9", + "nanoid": "^3.3.18" }, "dependencies": { "@ember/render-modifiers": "^2.1.0", diff --git a/yarn.lock b/yarn.lock index dc05bf6c4..a3dfe13d4 100644 --- a/yarn.lock +++ b/yarn.lock @@ -8447,16 +8447,6 @@ mute-stream@0.0.8: resolved "https://registry.yarnpkg.com/mute-stream/-/mute-stream-0.0.8.tgz#1630c42b2251ff81e2a283de96a5497ea92e5e0d" integrity sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA== -nanoid@3.1.20: - version "3.1.20" - resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.1.20.tgz#badc263c6b1dcf14b71efaa85f6ab4c1d6cfc788" - integrity sha512-a1cQNyczgKbLX9jwbS/+d7W8fX/RfgYR7lVWwWOGIPNgK2m0MWvrGF6/m4kk6U3QcFMnZf3RIhL0v2Jgh/0Uxw== - -nanoid@^3.3.19: - version "3.3.20" - resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.20.tgz#dfd4444d85aa10111ef66ba85ed72e08ba0855d8" - integrity sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ== - nanomatch@^1.2.9: version "1.2.13" resolved "https://registry.yarnpkg.com/nanomatch/-/nanomatch-1.2.13.tgz#b87a8aa4fc0de8fe6be88895b38983ff265bd119" @@ -11757,3 +11747,8 @@ fast-uri@^3.0.1, fast-uri@^3.1.9: version "3.1.9" resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.9.tgz#f1deba822b1d6ac79da2f860e872a63470cff203" integrity sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ== + +nanoid@3.1.20, nanoid@^3.3.18, nanoid@^3.3.19: + version "3.3.20" + resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.20.tgz#dfd4444d85aa10111ef66ba85ed72e08ba0855d8" + integrity sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ== From c4f0123126dc996c90d8d7df9dd4bf1d0f81d14b Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 12:57:37 -0400 Subject: [PATCH 09/33] force markdown-it to 14.3.3 ember-cli 3.28 (12.3.2) and its markdown-it-terminal (8.4.2) pulled two old markdown-it copies, each with high advisories, plus linkify-it 2 and 3. markdown-it 14 still ships a CommonJS build and keeps the md().use(plugin).render() API that ember-cli's MarkdownColor relies on; linkify-it 5 comes with it. `ember help generate` and a MarkdownColor render of headings, emphasis, code, links, lists, fences and ember-cli's color tokens produce byte-identical output before and after. Audit: high 62 -> 56. Co-Authored-By: Claude Opus 5.5 --- package.json | 3 +- yarn.lock | 100 ++++++++++++++++++++++----------------------------- 2 files changed, 44 insertions(+), 59 deletions(-) diff --git a/package.json b/package.json index ecc5fe1d1..24406132a 100644 --- a/package.json +++ b/package.json @@ -62,7 +62,8 @@ "picomatch": "^2.3.2", "braces": "^3.0.3", "fast-uri": "^3.1.9", - "nanoid": "^3.3.18" + "nanoid": "^3.3.18", + "markdown-it": "^14.3.3" }, "dependencies": { "@ember/render-modifiers": "^2.1.0", diff --git a/yarn.lock b/yarn.lock index a3dfe13d4..6a7734992 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1,6 +1,7 @@ # THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY. # yarn lockfile v1 + "@babel/code-frame@7.12.11": version "7.12.11" resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.12.11.tgz#f4ad435aa263db935b8f10f2c552d23fb716a63f" @@ -5164,15 +5165,10 @@ entities@^2.0.0: resolved "https://registry.yarnpkg.com/entities/-/entities-2.2.0.tgz#098dc90ebb83d8dffa089d55256b351d34c4da55" integrity sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A== -entities@~1.1.1: - version "1.1.2" - resolved "https://registry.yarnpkg.com/entities/-/entities-1.1.2.tgz#bdfa735299664dfafd34529ed4f8522a275fea56" - integrity sha512-f2LZMYl1Fzu7YSBKg+RoROelpOaNrcGmE9AZubeDfrCEia483oW4MI4VyFd5VNHIgQ/7qm1I0wUHK1eJnn2y2w== - -entities@~2.1.0: - version "2.1.0" - resolved "https://registry.yarnpkg.com/entities/-/entities-2.1.0.tgz#992d3129cf7df6870b96c57858c249a120f8b8b5" - integrity sha512-hCx1oky9PFrJ611mf0ifBLBRW8lUUVRlFolb5gWRfIELabBlbp9xZvrqZLZAs+NxFnbfQoeGd8wDkygjg7U85w== +entities@^4.5.0: + version "4.5.0" + resolved "https://registry.yarnpkg.com/entities/-/entities-4.5.0.tgz#5d268ea5e7113ec74c4d033b79ea5a35a488fb48" + integrity sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw== errlop@^2.0.0: version "2.2.0" @@ -5799,6 +5795,11 @@ fast-sourcemap-concat@^2.1.0: source-map "^0.4.2" source-map-url "^0.3.0" +fast-uri@^3.0.1, fast-uri@^3.1.9: + version "3.1.9" + resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.9.tgz#f1deba822b1d6ac79da2f860e872a63470cff203" + integrity sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ== + fastboot-express-middleware@4.1.2: version "4.1.2" resolved "https://registry.yarnpkg.com/fastboot-express-middleware/-/fastboot-express-middleware-4.1.2.tgz#6a383c282fdc07ee3f90039701bb0dab11129179" @@ -7728,19 +7729,12 @@ lines-and-columns@^1.1.6: resolved "https://registry.yarnpkg.com/lines-and-columns/-/lines-and-columns-1.2.4.tgz#eca284f75d2965079309dc0ad9255abb2ebc1632" integrity sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg== -linkify-it@^2.0.0: - version "2.2.0" - resolved "https://registry.yarnpkg.com/linkify-it/-/linkify-it-2.2.0.tgz#e3b54697e78bf915c70a38acd78fd09e0058b1cf" - integrity sha512-GnAl/knGn+i1U/wjBz3akz2stz+HrHLsxMwHQGofCDfPvlf+gDKN58UtfmUquTY4/MXeE2x7k19KQmeoZi94Iw== - dependencies: - uc.micro "^1.0.1" - -linkify-it@^3.0.1: - version "3.0.3" - resolved "https://registry.yarnpkg.com/linkify-it/-/linkify-it-3.0.3.tgz#a98baf44ce45a550efb4d49c769d07524cc2fa2e" - integrity sha512-ynTsyrFSdE5oZ/O9GEf00kPngmOfVwazR5GKDq6EYfhlpFug3J2zybX56a2PRRpc9P+FuSoGNAwjlbDs9jJBPQ== +linkify-it@^5.0.2: + version "5.0.2" + resolved "https://registry.yarnpkg.com/linkify-it/-/linkify-it-5.0.2.tgz#d3be0a693af3da9df3883f1e346a0e97461a8c19" + integrity sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q== dependencies: - uc.micro "^1.0.1" + uc.micro "^2.0.0" lint-staged@^11.0.0: version "11.2.6" @@ -8119,27 +8113,17 @@ markdown-it-terminal@0.2.1: lodash.merge "^4.6.2" markdown-it "^8.3.1" -markdown-it@^12.0.4: - version "12.3.2" - resolved "https://registry.yarnpkg.com/markdown-it/-/markdown-it-12.3.2.tgz#bf92ac92283fe983fe4de8ff8abfb5ad72cd0c90" - integrity sha512-TchMembfxfNVpHkbtriWltGWc+m3xszaRD0CZup7GFFhzIgQqxIfn3eGj1yZpfuflzPvfkt611B2Q/Bsk1YnGg== +markdown-it@^12.0.4, markdown-it@^14.3.3, markdown-it@^8.3.1: + version "14.3.3" + resolved "https://registry.yarnpkg.com/markdown-it/-/markdown-it-14.3.3.tgz#15e6e145d20b1499a7b323bb14e21062690132d8" + integrity sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg== dependencies: argparse "^2.0.1" - entities "~2.1.0" - linkify-it "^3.0.1" - mdurl "^1.0.1" - uc.micro "^1.0.5" - -markdown-it@^8.3.1: - version "8.4.2" - resolved "https://registry.yarnpkg.com/markdown-it/-/markdown-it-8.4.2.tgz#386f98998dc15a37722aa7722084f4020bdd9b54" - integrity sha512-GcRz3AWTqSUphY3vsUqQSFMbgR38a4Lh3GWlHRh/7MRwz8mcu9n2IO7HOh+bXHrR9kOPDl5RNCaEsrneb+xhHQ== - dependencies: - argparse "^1.0.7" - entities "~1.1.1" - linkify-it "^2.0.0" - mdurl "^1.0.1" - uc.micro "^1.0.5" + entities "^4.5.0" + linkify-it "^5.0.2" + mdurl "^2.0.0" + punycode.js "^2.3.1" + uc.micro "^2.1.0" matcher-collection@^1.0.0, matcher-collection@^1.1.1: version "1.1.2" @@ -8173,10 +8157,10 @@ mdn-data@2.0.30: resolved "https://registry.yarnpkg.com/mdn-data/-/mdn-data-2.0.30.tgz#ce4df6f80af6cfbe218ecd5c552ba13c4dfa08cc" integrity sha512-GaqWWShW4kv/G9IEucWScBx9G1/vsFZZJUO+tD26M8J8z3Kw5RDQjaoZe03YAClgeS/SWPOcb4nkFBTEi5DUEA== -mdurl@^1.0.1: - version "1.0.1" - resolved "https://registry.yarnpkg.com/mdurl/-/mdurl-1.0.1.tgz#fe85b2ec75a59037f2adfec100fd6c601761152e" - integrity sha512-/sKlQJCBYVY9Ers9hqzKou4H6V5UWc/M59TH2dvkt+84itfnq7uFOMLpOiOS4ujvHP4etln18fmIxA5R5fll0g== +mdurl@^2.0.0: + version "2.1.0" + resolved "https://registry.yarnpkg.com/mdurl/-/mdurl-2.1.0.tgz#d711d3f7bce7f22c487c91be78545f356fa96573" + integrity sha512-1+HBaOx0zi/dQWht8rNv9MYf9qqpqL/kxI0hXImU6Y547zM6Sni8BQibt7ifgMcYtQg41ao3Ivd6cnSM86inpg== media-typer@0.3.0: version "0.3.0" @@ -8447,6 +8431,11 @@ mute-stream@0.0.8: resolved "https://registry.yarnpkg.com/mute-stream/-/mute-stream-0.0.8.tgz#1630c42b2251ff81e2a283de96a5497ea92e5e0d" integrity sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA== +nanoid@3.1.20, nanoid@^3.3.18, nanoid@^3.3.19: + version "3.3.20" + resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.20.tgz#dfd4444d85aa10111ef66ba85ed72e08ba0855d8" + integrity sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ== + nanomatch@^1.2.9: version "1.2.13" resolved "https://registry.yarnpkg.com/nanomatch/-/nanomatch-1.2.13.tgz#b87a8aa4fc0de8fe6be88895b38983ff265bd119" @@ -9281,6 +9270,11 @@ pump@^3.0.0: end-of-stream "^1.1.0" once "^1.3.1" +punycode.js@^2.3.1: + version "2.3.1" + resolved "https://registry.yarnpkg.com/punycode.js/-/punycode.js-2.3.1.tgz#6b53e56ad75588234e79f4affa90972c7dd8cdb7" + integrity sha512-uxFIHU0YlHYhDQtV4R9J6a52SLx28BCjT+4ieh7IGbgwVJWO+km431c4yRlREUAsAmt/uMjQUyQHNEPf0M39CA== + punycode@^2.1.0, punycode@^2.1.1, punycode@^2.3.1: version "2.3.1" resolved "https://registry.yarnpkg.com/punycode/-/punycode-2.3.1.tgz#027422e2faec0b25e1549c3e1bd8309b9133b6e5" @@ -11041,10 +11035,10 @@ typescript-memoize@^1.0.0-alpha.3, typescript-memoize@^1.0.1: resolved "https://registry.yarnpkg.com/typescript-memoize/-/typescript-memoize-1.1.1.tgz#02737495d5df6ebf72c07ba0d002e8f4cf5ccfa0" integrity sha512-GQ90TcKpIH4XxYTI2F98yEQYZgjNMOGPpOgdjIBhaLaWji5HPWlRnZ4AeA1hfBxtY7bCGDJsqDDHk/KaHOl5bA== -uc.micro@^1.0.1, uc.micro@^1.0.5: - version "1.0.6" - resolved "https://registry.yarnpkg.com/uc.micro/-/uc.micro-1.0.6.tgz#9c411a802a409a91fc6cf74081baba34b24499ac" - integrity sha512-8Y75pvTYkLJW2hWQHXxoqRgV7qb9B+9vFEtidML+7koHUFapnVJAZ6cKs+Qjz5Aw3aZWHMC6u0wJE3At+nSGwA== +uc.micro@^2.0.0, uc.micro@^2.1.0: + version "2.1.0" + resolved "https://registry.yarnpkg.com/uc.micro/-/uc.micro-2.1.0.tgz#f8d3f7d0ec4c3dea35a7e3c8efa4cb8b45c9e7ee" + integrity sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A== uglify-js@^3.1.4: version "3.19.3" @@ -11742,13 +11736,3 @@ yocto-queue@^0.1.0: version "0.1.0" resolved "https://registry.yarnpkg.com/yocto-queue/-/yocto-queue-0.1.0.tgz#0294eb3dee05028d31ee1a5fa2c556a6aaf10a1b" integrity sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q== - -fast-uri@^3.0.1, fast-uri@^3.1.9: - version "3.1.9" - resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.9.tgz#f1deba822b1d6ac79da2f860e872a63470cff203" - integrity sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ== - -nanoid@3.1.20, nanoid@^3.3.18, nanoid@^3.3.19: - version "3.3.20" - resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.20.tgz#dfd4444d85aa10111ef66ba85ed72e08ba0855d8" - integrity sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ== From 6eab1d84cf65e4ab66177529c63bbddbf9b6e2bb Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:09:48 -0400 Subject: [PATCH 10/33] force lodash.template to 4.18.1 ember-cli 3.28 depends on lodash.template ^4.5.0 for blueprint rendering and its initial-commit message; 4.5.0 has high advisories. 4.18.1 is in the same major and clears all of them. All 49 files of ember-cli's app and addon blueprints render identically through ember-cli's processTemplate before and after. Audit: high 52 -> 50. Co-Authored-By: Claude Opus 5.5 --- package.json | 3 ++- yarn.lock | 17 ++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package.json b/package.json index 24406132a..0b10b3158 100644 --- a/package.json +++ b/package.json @@ -63,7 +63,8 @@ "braces": "^3.0.3", "fast-uri": "^3.1.9", "nanoid": "^3.3.18", - "markdown-it": "^14.3.3" + "markdown-it": "^14.3.3", + "lodash.template": "^4.18.1" }, "dependencies": { "@ember/render-modifiers": "^2.1.0", diff --git a/yarn.lock b/yarn.lock index 6a7734992..59c92adac 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1,7 +1,6 @@ # THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY. # yarn lockfile v1 - "@babel/code-frame@7.12.11": version "7.12.11" resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.12.11.tgz#f4ad435aa263db935b8f10f2c552d23fb716a63f" @@ -7962,14 +7961,6 @@ lodash.restparam@^3.0.0: resolved "https://registry.yarnpkg.com/lodash.restparam/-/lodash.restparam-3.6.1.tgz#936a4e309ef330a7645ed4145986c85ae5b20805" integrity sha512-L4/arjjuq4noiUJpt3yS6KIKDtJwNe2fIYgMqyYYKoeIfV1iEqvPwhCx23o+R9dzouGihDAPN1dTIRWa7zk8tw== -lodash.template@^4.5.0: - version "4.5.0" - resolved "https://registry.yarnpkg.com/lodash.template/-/lodash.template-4.5.0.tgz#f976195cf3f347d0d5f52483569fe8031ccce8ab" - integrity sha512-84vYFxIkmidUiFxidA/KjjH9pAycqW+h980j7Fuz5qxRtO9pgB7MDFTdys1N7A5mcucRiDyEq4fusljItR1T/A== - dependencies: - lodash._reinterpolate "^3.0.0" - lodash.templatesettings "^4.0.0" - lodash.templatesettings@^4.0.0: version "4.2.0" resolved "https://registry.yarnpkg.com/lodash.templatesettings/-/lodash.templatesettings-4.2.0.tgz#e481310f049d3cf6d47e912ad09313b154f0fb33" @@ -11736,3 +11727,11 @@ yocto-queue@^0.1.0: version "0.1.0" resolved "https://registry.yarnpkg.com/yocto-queue/-/yocto-queue-0.1.0.tgz#0294eb3dee05028d31ee1a5fa2c556a6aaf10a1b" integrity sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q== + +lodash.template@^4.18.1, lodash.template@^4.5.0: + version "4.18.1" + resolved "https://registry.yarnpkg.com/lodash.template/-/lodash.template-4.18.1.tgz#9968d00568070d03e358505b5a28b0cbd8fbfd5f" + integrity sha512-5urZrLnV/VD6zHK5KsVtZgt7H19v51mIzoS0aBNH8yp3I8tbswrEjOABOPY8m8uB7NuibubLrMX+Y0PXsU9X+w== + dependencies: + lodash._reinterpolate "^3.0.0" + lodash.templatesettings "^4.0.0" From 7c84bf52b922e1f5ff7531da123ee58de858ffba Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:34:53 -0400 Subject: [PATCH 11/33] force ansi-html to 0.0.9 ansi-html 0.0.7 (high) is pinned by broccoli's ^0.0.7 range, which on a 0.0.x version allows no other release, so it needs a resolution. 0.0.9 renders broccoli's ANSI-colored build-error page identically. Co-Authored-By: Claude Opus 5.5 --- package.json | 3 ++- yarn.lock | 10 +++++----- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index 0b10b3158..e8b4785c7 100644 --- a/package.json +++ b/package.json @@ -64,7 +64,8 @@ "fast-uri": "^3.1.9", "nanoid": "^3.3.18", "markdown-it": "^14.3.3", - "lodash.template": "^4.18.1" + "lodash.template": "^4.18.1", + "ansi-html": "0.0.9" }, "dependencies": { "@ember/render-modifiers": "^2.1.0", diff --git a/yarn.lock b/yarn.lock index 59c92adac..4915446f7 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2018,11 +2018,6 @@ ansi-escapes@^4.2.1, ansi-escapes@^4.3.0: dependencies: type-fest "^0.21.3" -ansi-html@^0.0.7: - version "0.0.7" - resolved "https://registry.yarnpkg.com/ansi-html/-/ansi-html-0.0.7.tgz#813584021962a9e9e6fd039f940d12f56ca7859e" - integrity sha512-JoAxEa1DfP9m2xfB/y2r/aKcwXNlltr4+0QSBC4TrLfcxyvepX2Pv0t/xpgGV5bGsDzCYV8SzjWgyCW0T9yYbA== - ansi-regex@^2.0.0: version "2.1.1" resolved "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-2.1.1.tgz#c3b33ab5ee360d86e0e628f0468ae7ef27d654df" @@ -11735,3 +11730,8 @@ lodash.template@^4.18.1, lodash.template@^4.5.0: dependencies: lodash._reinterpolate "^3.0.0" lodash.templatesettings "^4.0.0" + +ansi-html@0.0.9, ansi-html@^0.0.7: + version "0.0.9" + resolved "https://registry.yarnpkg.com/ansi-html/-/ansi-html-0.0.9.tgz#6512d02342ae2cc68131952644a129cb734cd3f0" + integrity sha512-ozbS3LuenHVxNRh/wdnN16QapUHzauqSomAl1jwwJRRsGwFwtj644lIhxfWu0Fy0acCij2+AEgHvjscq3dlVXg== From 3d675cd3ee92e751d476a08706ee2007ca9f04d8 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:38:49 -0400 Subject: [PATCH 12/33] refresh express to 4.22.3 and body-parser to 1.20.9 express 4.21.2 pinned body-parser 1.20.3 and path-to-regexp 0.1.12 exactly (both high). express 4.22.3, within ember-cli's and testem's ^4 ranges, takes body-parser ~1.20.5 and path-to-regexp ~0.1.13; the caret body-parser ranges from ember-a11y-testing and @scalvert/ember-setup-middleware-reporter are refreshed onto the same 1.20.9. Lockfile refresh only. testem serves the test run through express. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 280 +++++++++++++++++++++++++++++------------------------- 1 file changed, 148 insertions(+), 132 deletions(-) diff --git a/yarn.lock b/yarn.lock index 4915446f7..dceadb85b 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1,6 +1,7 @@ # THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY. # yarn lockfile v1 + "@babel/code-frame@7.12.11": version "7.12.11" resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.12.11.tgz#f4ad435aa263db935b8f10f2c552d23fb716a63f" @@ -2018,6 +2019,11 @@ ansi-escapes@^4.2.1, ansi-escapes@^4.3.0: dependencies: type-fest "^0.21.3" +ansi-html@0.0.9, ansi-html@^0.0.7: + version "0.0.9" + resolved "https://registry.yarnpkg.com/ansi-html/-/ansi-html-0.0.9.tgz#6512d02342ae2cc68131952644a129cb734cd3f0" + integrity sha512-ozbS3LuenHVxNRh/wdnN16QapUHzauqSomAl1jwwJRRsGwFwtj644lIhxfWu0Fy0acCij2+AEgHvjscq3dlVXg== + ansi-regex@^2.0.0: version "2.1.1" resolved "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-2.1.1.tgz#c3b33ab5ee360d86e0e628f0468ae7ef27d654df" @@ -2530,23 +2536,23 @@ blueimp-md5@^2.10.0: resolved "https://registry.yarnpkg.com/blueimp-md5/-/blueimp-md5-2.19.0.tgz#b53feea5498dcb53dc6ec4b823adb84b729c4af0" integrity sha512-DRQrD6gJyy8FbiE4s+bDoXS9hiW3Vbx5uCdwvcCf3zLHL+Iv7LtGHLpr+GZV8rHG8tK766FGYBwRbu8pELTt+w== -body-parser@1.20.3, body-parser@^1.17.0, body-parser@^1.19.0, body-parser@^1.20.0: - version "1.20.3" - resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.20.3.tgz#1953431221c6fb5cd63c4b36d53fab0928e548c6" - integrity sha512-7rAxByjUMqQ3/bHJy7D6OGXvx/MMc4IqBn/X0fcM1QUcAItpZrBEYhWGem+tzXH90c+G01ypMcYJBO9Y30203g== +body-parser@^1.17.0, body-parser@^1.19.0, body-parser@^1.20.0, body-parser@~1.20.5: + version "1.20.9" + resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.20.9.tgz#b64358a113b4d200d7484752cd154b66933e2009" + integrity sha512-FISIQxV5u91Y9gvuFq3q/tA/qTqLJn3AhRcEvyozyhJTh5OBFFtv827AdHU7Rbyct4r+Ba1/99oFa1Y3yuFsdw== dependencies: - bytes "3.1.2" + bytes "~3.1.2" content-type "~1.0.5" debug "2.6.9" depd "2.0.0" - destroy "1.2.0" - http-errors "2.0.0" - iconv-lite "0.4.24" - on-finished "2.4.1" - qs "6.13.0" - raw-body "2.5.2" + destroy "~1.2.0" + http-errors "~2.0.1" + iconv-lite "~0.4.24" + on-finished "~2.4.1" + qs "~6.16.0" + raw-body "~2.5.3" type-is "~1.6.18" - unpipe "1.0.0" + unpipe "~1.0.0" body@^5.1.0: version "5.1.0" @@ -3164,7 +3170,7 @@ bytes@1: resolved "https://registry.yarnpkg.com/bytes/-/bytes-1.0.0.tgz#3569ede8ba34315fab99c3e92cb04c7220de1fa8" integrity sha512-/x68VkHLeTl3/Ll8IvxdwzhrT+IyKc52e/oyHhA2RwqPqswSnjVbSddfPRwAsJtbilMAPSRWwAlpxdYsSWOTKQ== -bytes@3.1.2: +bytes@3.1.2, bytes@~3.1.2: version "3.1.2" resolved "https://registry.yarnpkg.com/bytes/-/bytes-3.1.2.tgz#8b0beeb98605adf1b128fa4386403c009e0221a5" integrity sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg== @@ -3704,7 +3710,7 @@ consolidate@^0.16.0: dependencies: bluebird "^3.7.2" -content-disposition@0.5.4: +content-disposition@~0.5.4: version "0.5.4" resolved "https://registry.yarnpkg.com/content-disposition/-/content-disposition-0.5.4.tgz#8b82b4efac82512a02bb0b1dcec9d2c5e8eb5bfe" integrity sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ== @@ -3731,22 +3737,17 @@ convert-source-map@^2.0.0: resolved "https://registry.yarnpkg.com/convert-source-map/-/convert-source-map-2.0.0.tgz#4b560f649fc4e918dd0ab75cf4961e8bc882d82a" integrity sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg== -cookie-signature@1.0.6: - version "1.0.6" - resolved "https://registry.yarnpkg.com/cookie-signature/-/cookie-signature-1.0.6.tgz#e303a882b342cc3ee8ca513a79999734dab3ae2c" - integrity sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ== - -cookie@0.7.1: - version "0.7.1" - resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.7.1.tgz#2f73c42142d5d5cf71310a74fc4ae61670e5dbc9" - integrity sha512-6DnInpx7SJ2AK3+CTUE/ZM0vWTUboZCegxhC2xiIydHR9jNuTAASBrfEpHhiGOZw/nX51bHt6YQl8jsGo4y/0w== +cookie-signature@~1.0.6: + version "1.0.7" + resolved "https://registry.yarnpkg.com/cookie-signature/-/cookie-signature-1.0.7.tgz#ab5dd7ab757c54e60f37ef6550f481c426d10454" + integrity sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA== cookie@^0.4.1: version "0.4.2" resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.4.2.tgz#0e41f24de5ecf317947c82fc789e06a884824432" integrity sha512-aSWTXFzaKWkvHO1Ny/s+ePFpvKsPnjc551iI41v3ny/ow6tBG5Vd+FuqGNhh1LxOmVzOlGUriIlOaokOvhaStA== -cookie@~0.7.2: +cookie@~0.7.1, cookie@~0.7.2: version "0.7.2" resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.7.2.tgz#556369c472a2ba910f2979891b526b3436237ed7" integrity sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w== @@ -4088,7 +4089,7 @@ depd@~1.1.2: resolved "https://registry.yarnpkg.com/depd/-/depd-1.1.2.tgz#9bcd52e14c097763e749b274c4346ed2e560b5a9" integrity sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ== -destroy@1.2.0: +destroy@1.2.0, destroy@~1.2.0: version "1.2.0" resolved "https://registry.yarnpkg.com/destroy/-/destroy-1.2.0.tgz#4803735509ad8be552934c67df614f94e66fa015" integrity sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg== @@ -5654,38 +5655,38 @@ expand-tilde@^2.0.0, expand-tilde@^2.0.2: homedir-polyfill "^1.0.1" express@^4.10.7, express@^4.17.1: - version "4.21.2" - resolved "https://registry.yarnpkg.com/express/-/express-4.21.2.tgz#cf250e48362174ead6cea4a566abef0162c1ec32" - integrity sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA== + version "4.22.3" + resolved "https://registry.yarnpkg.com/express/-/express-4.22.3.tgz#e8f898d3c17582b1e311dd2c5cd6d8deff84724b" + integrity sha512-Bdcs4+3qlpVlx2NRn6fgX2Ue2/gGRaPeawebgclM0ERSCqDpA+owF1fdPwjJUTAJWMTuAaxjDf+hzb0/4eKvvw== dependencies: accepts "~1.3.8" array-flatten "1.1.1" - body-parser "1.20.3" - content-disposition "0.5.4" + body-parser "~1.20.5" + content-disposition "~0.5.4" content-type "~1.0.4" - cookie "0.7.1" - cookie-signature "1.0.6" + cookie "~0.7.1" + cookie-signature "~1.0.6" debug "2.6.9" depd "2.0.0" encodeurl "~2.0.0" escape-html "~1.0.3" etag "~1.8.1" - finalhandler "1.3.1" - fresh "0.5.2" - http-errors "2.0.0" + finalhandler "~1.3.1" + fresh "~0.5.2" + http-errors "~2.0.0" merge-descriptors "1.0.3" methods "~1.1.2" - on-finished "2.4.1" + on-finished "~2.4.1" parseurl "~1.3.3" - path-to-regexp "0.1.12" + path-to-regexp "~0.1.13" proxy-addr "~2.0.7" - qs "6.13.0" + qs "~6.16.0" range-parser "~1.2.1" safe-buffer "5.2.1" - send "0.19.0" - serve-static "1.16.2" + send "~0.19.0" + serve-static "~1.16.2" setprototypeof "1.2.0" - statuses "2.0.1" + statuses "~2.0.1" type-is "~1.6.18" utils-merge "1.0.1" vary "~1.1.2" @@ -5903,17 +5904,17 @@ finalhandler@1.1.2: statuses "~1.5.0" unpipe "~1.0.0" -finalhandler@1.3.1: - version "1.3.1" - resolved "https://registry.yarnpkg.com/finalhandler/-/finalhandler-1.3.1.tgz#0c575f1d1d324ddd1da35ad7ece3df7d19088019" - integrity sha512-6BN9trH7bp3qvnrRyzsBz+g3lZxTNZTbVO2EV1CS0WIcDbawYVdYvGflME/9QP0h0pYlCDBCTjYa9nZzMDpyxQ== +finalhandler@~1.3.1: + version "1.3.2" + resolved "https://registry.yarnpkg.com/finalhandler/-/finalhandler-1.3.2.tgz#1ebc2228fc7673aac4a472c310cc05b77d852b88" + integrity sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg== dependencies: debug "2.6.9" encodeurl "~2.0.0" escape-html "~1.0.3" - on-finished "2.4.1" + on-finished "~2.4.1" parseurl "~1.3.3" - statuses "2.0.1" + statuses "~2.0.2" unpipe "~1.0.0" find-babel-config@^1.1.0, find-babel-config@^1.2.0: @@ -6109,7 +6110,7 @@ fragment-cache@^0.2.1: dependencies: map-cache "^0.2.2" -fresh@0.5.2: +fresh@~0.5.2: version "0.5.2" resolved "https://registry.yarnpkg.com/fresh/-/fresh-0.5.2.tgz#3d8cadd90d976569fa835ab1f8e4b23a105605a7" integrity sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q== @@ -6803,17 +6804,6 @@ html-encoding-sniffer@^3.0.0: dependencies: whatwg-encoding "^2.0.0" -http-errors@2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/http-errors/-/http-errors-2.0.0.tgz#b7774a1486ef73cf7667ac9ae0858c012c57b9d3" - integrity sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ== - dependencies: - depd "2.0.0" - inherits "2.0.4" - setprototypeof "1.2.0" - statuses "2.0.1" - toidentifier "1.0.1" - http-errors@~1.6.2: version "1.6.3" resolved "https://registry.yarnpkg.com/http-errors/-/http-errors-1.6.3.tgz#8b55680bb4be283a0b5bf4ea2e38580be1d9320d" @@ -6824,6 +6814,17 @@ http-errors@~1.6.2: setprototypeof "1.1.0" statuses ">= 1.4.0 < 2" +http-errors@~2.0.0, http-errors@~2.0.1: + version "2.0.1" + resolved "https://registry.yarnpkg.com/http-errors/-/http-errors-2.0.1.tgz#36d2f65bc909c8790018dd36fb4d93da6caae06b" + integrity sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ== + dependencies: + depd "~2.0.0" + inherits "~2.0.4" + setprototypeof "~1.2.0" + statuses "~2.0.2" + toidentifier "~1.0.1" + http-parser-js@>=0.5.1: version "0.5.10" resolved "https://registry.yarnpkg.com/http-parser-js/-/http-parser-js-0.5.10.tgz#b3277bd6d7ed5588e20ea73bf724fcbe44609075" @@ -6894,13 +6895,6 @@ husky@^4.3.8: slash "^3.0.0" which-pm-runs "^1.0.0" -iconv-lite@0.4.24, iconv-lite@^0.4.13, iconv-lite@^0.4.24: - version "0.4.24" - resolved "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.4.24.tgz#2022b4b25fbddc21d2f524974a474aafe733908b" - integrity sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA== - dependencies: - safer-buffer ">= 2.1.2 < 3" - iconv-lite@0.6.3: version "0.6.3" resolved "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.6.3.tgz#a52f80bf38da1952eb5c681790719871a1a72501" @@ -6908,6 +6902,13 @@ iconv-lite@0.6.3: dependencies: safer-buffer ">= 2.1.2 < 3.0.0" +iconv-lite@^0.4.13, iconv-lite@^0.4.24, iconv-lite@~0.4.24: + version "0.4.24" + resolved "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.4.24.tgz#2022b4b25fbddc21d2f524974a474aafe733908b" + integrity sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA== + dependencies: + safer-buffer ">= 2.1.2 < 3" + icss-utils@^5.0.0, icss-utils@^5.1.0: version "5.1.0" resolved "https://registry.yarnpkg.com/icss-utils/-/icss-utils-5.1.0.tgz#c6be6858abd013d768e98366ae47e25d5887b1ae" @@ -6959,7 +6960,7 @@ inflight@^1.0.4: once "^1.3.0" wrappy "1" -inherits@2, inherits@2.0.4, inherits@^2.0.1, inherits@^2.0.3, inherits@^2.0.4, inherits@~2.0.1: +inherits@2, inherits@^2.0.1, inherits@^2.0.3, inherits@^2.0.4, inherits@~2.0.1, inherits@~2.0.4: version "2.0.4" resolved "https://registry.yarnpkg.com/inherits/-/inherits-2.0.4.tgz#0fa2c64f932917c3433a0ded55363aae37416b7c" integrity sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ== @@ -7956,6 +7957,14 @@ lodash.restparam@^3.0.0: resolved "https://registry.yarnpkg.com/lodash.restparam/-/lodash.restparam-3.6.1.tgz#936a4e309ef330a7645ed4145986c85ae5b20805" integrity sha512-L4/arjjuq4noiUJpt3yS6KIKDtJwNe2fIYgMqyYYKoeIfV1iEqvPwhCx23o+R9dzouGihDAPN1dTIRWa7zk8tw== +lodash.template@^4.18.1, lodash.template@^4.5.0: + version "4.18.1" + resolved "https://registry.yarnpkg.com/lodash.template/-/lodash.template-4.18.1.tgz#9968d00568070d03e358505b5a28b0cbd8fbfd5f" + integrity sha512-5urZrLnV/VD6zHK5KsVtZgt7H19v51mIzoS0aBNH8yp3I8tbswrEjOABOPY8m8uB7NuibubLrMX+Y0PXsU9X+w== + dependencies: + lodash._reinterpolate "^3.0.0" + lodash.templatesettings "^4.0.0" + lodash.templatesettings@^4.0.0: version "4.2.0" resolved "https://registry.yarnpkg.com/lodash.templatesettings/-/lodash.templatesettings-4.2.0.tgz#e481310f049d3cf6d47e912ad09313b154f0fb33" @@ -8675,13 +8684,6 @@ object.pick@^1.3.0: dependencies: isobject "^3.0.1" -on-finished@2.4.1: - version "2.4.1" - resolved "https://registry.yarnpkg.com/on-finished/-/on-finished-2.4.1.tgz#58c8c44116e54845ad57f14ab10b03533184ac3f" - integrity sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg== - dependencies: - ee-first "1.1.1" - on-finished@~2.3.0: version "2.3.0" resolved "https://registry.yarnpkg.com/on-finished/-/on-finished-2.3.0.tgz#20f1336481b083cd75337992a16971aa2d906947" @@ -8689,6 +8691,13 @@ on-finished@~2.3.0: dependencies: ee-first "1.1.1" +on-finished@~2.4.1: + version "2.4.2" + resolved "https://registry.yarnpkg.com/on-finished/-/on-finished-2.4.2.tgz#6932b04b95bf6a4828201db10af75fe5c9c38b73" + integrity sha512-ATWUv387i+nLD49EiDoOft5scf32Vsdz3ktrQJG9bi7jRFmaXTssvyvj1EmeKVVgvesbqUtvQQvaS2TpTukAZQ== + dependencies: + ee-first "1.1.1" + on-headers@~1.0.2: version "1.0.2" resolved "https://registry.yarnpkg.com/on-headers/-/on-headers-1.0.2.tgz#772b0ae6aaa525c399e489adfad90c403eb3c28f" @@ -8979,11 +8988,6 @@ path-root@^0.1.1: dependencies: path-root-regex "^0.1.0" -path-to-regexp@0.1.12: - version "0.1.12" - resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.12.tgz#d5e1a12e478a976d432ef3c58d534b9923164bb7" - integrity sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ== - path-to-regexp@^1.7.0: version "1.9.0" resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-1.9.0.tgz#5dc0753acbf8521ca2e0f137b4578b917b10cf24" @@ -8991,6 +8995,11 @@ path-to-regexp@^1.7.0: dependencies: isarray "0.0.1" +path-to-regexp@~0.1.13: + version "0.1.13" + resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.13.tgz#9b22ec16bc3ab88d05a0c7e369869421401ab17d" + integrity sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA== + path-type@^3.0.0: version "3.0.0" resolved "https://registry.yarnpkg.com/path-type/-/path-type-3.0.0.tgz#cef31dc8e0a1a3bb0d105c0cd97cf3bf47f4e36f" @@ -9266,13 +9275,6 @@ punycode@^2.1.0, punycode@^2.1.1, punycode@^2.3.1: resolved "https://registry.yarnpkg.com/punycode/-/punycode-2.3.1.tgz#027422e2faec0b25e1549c3e1bd8309b9133b6e5" integrity sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg== -qs@6.13.0: - version "6.13.0" - resolved "https://registry.yarnpkg.com/qs/-/qs-6.13.0.tgz#6ca3bd58439f7e245655798997787b0d88a51906" - integrity sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg== - dependencies: - side-channel "^1.0.6" - qs@^6.4.0: version "6.14.0" resolved "https://registry.yarnpkg.com/qs/-/qs-6.14.0.tgz#c63fa40680d2c5c941412a0e899c89af60c0a930" @@ -9280,6 +9282,14 @@ qs@^6.4.0: dependencies: side-channel "^1.1.0" +qs@~6.16.0: + version "6.16.2" + resolved "https://registry.yarnpkg.com/qs/-/qs-6.16.2.tgz#f7f5a606730f013f4f4ea62a8025f37be0f8c09c" + integrity sha512-VYdnB5S7/0IeXzBacUtwNAaM6d7Y/PgYnNC7bJCI6meqA/OgnsQbZMtVW8Dt2D1PHgbHGtYmhSoEIgvt7xZ2ZA== + dependencies: + es-define-property "^1.0.1" + side-channel "^1.1.1" + querystringify@^2.1.1: version "2.2.0" resolved "https://registry.yarnpkg.com/querystringify/-/querystringify-2.2.0.tgz#3345941b4153cb9d082d8eee4cda2016a9aef7f6" @@ -9338,16 +9348,6 @@ range-parser@~1.2.1: resolved "https://registry.yarnpkg.com/range-parser/-/range-parser-1.2.1.tgz#3cf37023d199e1c24d1a55b84800c2f3e6468031" integrity sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg== -raw-body@2.5.2: - version "2.5.2" - resolved "https://registry.yarnpkg.com/raw-body/-/raw-body-2.5.2.tgz#99febd83b90e08975087e8f1f9419a149366b68a" - integrity sha512-8zGqypfENjCIqGhgXToC8aB2r7YrBX+AQAfIPs/Mlk+BtPTztOvTS01NRW/3Eh60J+a48lt8qsCzirQ6loCVfA== - dependencies: - bytes "3.1.2" - http-errors "2.0.0" - iconv-lite "0.4.24" - unpipe "1.0.0" - raw-body@~1.1.0: version "1.1.7" resolved "https://registry.yarnpkg.com/raw-body/-/raw-body-1.1.7.tgz#1d027c2bfa116acc6623bca8f00016572a87d425" @@ -9356,6 +9356,16 @@ raw-body@~1.1.0: bytes "1" string_decoder "0.10" +raw-body@~2.5.3: + version "2.5.3" + resolved "https://registry.yarnpkg.com/raw-body/-/raw-body-2.5.3.tgz#11c6650ee770a7de1b494f197927de0c923822e2" + integrity sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA== + dependencies: + bytes "~3.1.2" + http-errors "~2.0.1" + iconv-lite "~0.4.24" + unpipe "~1.0.0" + rc@^1.0.1, rc@^1.1.6: version "1.2.8" resolved "https://registry.yarnpkg.com/rc/-/rc-1.2.8.tgz#cd924bf5200a075b83c188cd6b9e211b7fc0d3ed" @@ -9898,24 +9908,24 @@ semver@^7.2.1, semver@^7.3.2, semver@^7.3.4, semver@^7.3.5, semver@^7.3.8: resolved "https://registry.yarnpkg.com/semver/-/semver-7.7.2.tgz#67d99fdcd35cec21e6f8b87a7fd515a33f982b58" integrity sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA== -send@0.19.0: - version "0.19.0" - resolved "https://registry.yarnpkg.com/send/-/send-0.19.0.tgz#bbc5a388c8ea6c048967049dbeac0e4a3f09d7f8" - integrity sha512-dW41u5VfLXu8SJh5bwRmyYUbAoSB3c9uQh6L8h/KtsFREPWpbX1lrljJo186Jc4nmci/sGUZ9a0a0J2zgfq2hw== +send@~0.19.0, send@~0.19.1: + version "0.19.2" + resolved "https://registry.yarnpkg.com/send/-/send-0.19.2.tgz#59bc0da1b4ea7ad42736fd642b1c4294e114ff29" + integrity sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg== dependencies: debug "2.6.9" depd "2.0.0" destroy "1.2.0" - encodeurl "~1.0.2" + encodeurl "~2.0.0" escape-html "~1.0.3" etag "~1.8.1" - fresh "0.5.2" - http-errors "2.0.0" + fresh "~0.5.2" + http-errors "~2.0.1" mime "1.6.0" ms "2.1.3" - on-finished "2.4.1" + on-finished "~2.4.1" range-parser "~1.2.1" - statuses "2.0.1" + statuses "~2.0.2" serialize-javascript@5.0.1: version "5.0.1" @@ -9931,15 +9941,15 @@ serialize-javascript@^6.0.2: dependencies: randombytes "^2.1.0" -serve-static@1.16.2: - version "1.16.2" - resolved "https://registry.yarnpkg.com/serve-static/-/serve-static-1.16.2.tgz#b6a5343da47f6bdd2673848bf45754941e803296" - integrity sha512-VqpjJZKadQB/PEbEwvFdO43Ax5dFBZ2UECszz8bQ7pi7wt//PWe1P6MN7eCnjsatYtBT6EuiClbjSWP2WrIoTw== +serve-static@~1.16.2: + version "1.16.3" + resolved "https://registry.yarnpkg.com/serve-static/-/serve-static-1.16.3.tgz#a97b74d955778583f3862a4f0b841eb4d5d78cf9" + integrity sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA== dependencies: encodeurl "~2.0.0" escape-html "~1.0.3" parseurl "~1.3.3" - send "0.19.0" + send "~0.19.1" set-blocking@^2.0.0: version "2.0.0" @@ -9992,7 +10002,7 @@ setprototypeof@1.1.0: resolved "https://registry.yarnpkg.com/setprototypeof/-/setprototypeof-1.1.0.tgz#d0bd85536887b6fe7c0d818cb962d9d91c54e656" integrity sha512-BvE/TwpZX4FXExxOxZyRGQQv651MSwmWKZGqvmPcRIjDqWub67kTKuIMx43cZZrS/cBBzwBcNDWoFxt2XEFIpQ== -setprototypeof@1.2.0: +setprototypeof@1.2.0, setprototypeof@~1.2.0: version "1.2.0" resolved "https://registry.yarnpkg.com/setprototypeof/-/setprototypeof-1.2.0.tgz#66c9a24a73f9fc28cbe66b09fed3d33dcaf1b424" integrity sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw== @@ -10039,6 +10049,14 @@ side-channel-list@^1.0.0: es-errors "^1.3.0" object-inspect "^1.13.3" +side-channel-list@^1.0.1: + version "1.0.1" + resolved "https://registry.yarnpkg.com/side-channel-list/-/side-channel-list-1.0.1.tgz#c2e0b5a14a540aebee3bbc6c3f8666cc9b509127" + integrity sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w== + dependencies: + es-errors "^1.3.0" + object-inspect "^1.13.4" + side-channel-map@^1.0.1: version "1.0.1" resolved "https://registry.yarnpkg.com/side-channel-map/-/side-channel-map-1.0.1.tgz#d6bb6b37902c6fef5174e5f533fab4c732a26f42" @@ -10060,7 +10078,7 @@ side-channel-weakmap@^1.0.2: object-inspect "^1.13.3" side-channel-map "^1.0.1" -side-channel@^1.0.6, side-channel@^1.1.0: +side-channel@^1.1.0: version "1.1.0" resolved "https://registry.yarnpkg.com/side-channel/-/side-channel-1.1.0.tgz#c3fcff9c4da932784873335ec9765fa94ff66bc9" integrity sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw== @@ -10071,6 +10089,17 @@ side-channel@^1.0.6, side-channel@^1.1.0: side-channel-map "^1.0.1" side-channel-weakmap "^1.0.2" +side-channel@^1.1.1: + version "1.1.1" + resolved "https://registry.yarnpkg.com/side-channel/-/side-channel-1.1.1.tgz#ea02c62e05dc4bea67d4442f0fb71ee192f8e0ab" + integrity sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ== + dependencies: + es-errors "^1.3.0" + object-inspect "^1.13.4" + side-channel-list "^1.0.1" + side-channel-map "^1.0.1" + side-channel-weakmap "^1.0.2" + signal-exit@^3.0.0, signal-exit@^3.0.2, signal-exit@^3.0.3, signal-exit@^3.0.7: version "3.0.7" resolved "https://registry.yarnpkg.com/signal-exit/-/signal-exit-3.0.7.tgz#a9a1767f8af84155114eaabd73f99273c8f59ad9" @@ -10338,16 +10367,16 @@ static-extend@^0.1.1: define-property "^0.2.5" object-copy "^0.1.0" -statuses@2.0.1: - version "2.0.1" - resolved "https://registry.yarnpkg.com/statuses/-/statuses-2.0.1.tgz#55cb000ccf1d48728bd23c685a063998cf1a1b63" - integrity sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ== - "statuses@>= 1.4.0 < 2", statuses@~1.5.0: version "1.5.0" resolved "https://registry.yarnpkg.com/statuses/-/statuses-1.5.0.tgz#161c7dac177659fd9811f43771fa99381478628c" integrity sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA== +statuses@~2.0.1, statuses@~2.0.2: + version "2.0.2" + resolved "https://registry.yarnpkg.com/statuses/-/statuses-2.0.2.tgz#8f75eecef765b5e1cfcdc080da59409ed424e382" + integrity sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw== + stop-iteration-iterator@^1.1.0: version "1.1.0" resolved "https://registry.yarnpkg.com/stop-iteration-iterator/-/stop-iteration-iterator-1.1.0.tgz#f481ff70a548f6124d0312c3aa14cbfa7aa542ad" @@ -10842,7 +10871,7 @@ to-utf8@0.0.1: resolved "https://registry.yarnpkg.com/to-utf8/-/to-utf8-0.0.1.tgz#d17aea72ff2fba39b9e43601be7b3ff72e089852" integrity sha512-zks18/TWT1iHO3v0vFp5qLKOG27m67ycq/Y7a7cTiRuUNlc4gf3HGnkRgMv0NyhnfTamtkYBJl+YeD1/j07gBQ== -toidentifier@1.0.1: +toidentifier@~1.0.1: version "1.0.1" resolved "https://registry.yarnpkg.com/toidentifier/-/toidentifier-1.0.1.tgz#3be34321a88a820ed1bd80dfaa33e479fbb8dd35" integrity sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA== @@ -11114,7 +11143,7 @@ universalify@^2.0.0: resolved "https://registry.yarnpkg.com/universalify/-/universalify-2.0.1.tgz#168efc2180964e6386d061e094df61afe239b18d" integrity sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw== -unpipe@1.0.0, unpipe@~1.0.0: +unpipe@~1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/unpipe/-/unpipe-1.0.0.tgz#b2bf4ee8514aae6165b4817829d21b2ef49904ec" integrity sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ== @@ -11722,16 +11751,3 @@ yocto-queue@^0.1.0: version "0.1.0" resolved "https://registry.yarnpkg.com/yocto-queue/-/yocto-queue-0.1.0.tgz#0294eb3dee05028d31ee1a5fa2c556a6aaf10a1b" integrity sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q== - -lodash.template@^4.18.1, lodash.template@^4.5.0: - version "4.18.1" - resolved "https://registry.yarnpkg.com/lodash.template/-/lodash.template-4.18.1.tgz#9968d00568070d03e358505b5a28b0cbd8fbfd5f" - integrity sha512-5urZrLnV/VD6zHK5KsVtZgt7H19v51mIzoS0aBNH8yp3I8tbswrEjOABOPY8m8uB7NuibubLrMX+Y0PXsU9X+w== - dependencies: - lodash._reinterpolate "^3.0.0" - lodash.templatesettings "^4.0.0" - -ansi-html@0.0.9, ansi-html@^0.0.7: - version "0.0.9" - resolved "https://registry.yarnpkg.com/ansi-html/-/ansi-html-0.0.9.tgz#6512d02342ae2cc68131952644a129cb734cd3f0" - integrity sha512-ozbS3LuenHVxNRh/wdnN16QapUHzauqSomAl1jwwJRRsGwFwtj644lIhxfWu0Fy0acCij2+AEgHvjscq3dlVXg== From a90304ee9a403437cfad7a5d6de91441c4472768 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:41:46 -0400 Subject: [PATCH 13/33] refresh compression to 1.8.2 compression 1.8.0 (high) -> 1.8.2, within ember-cli's and testem's ^1.7.4 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/yarn.lock b/yarn.lock index dceadb85b..d6ba2ac07 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3648,15 +3648,16 @@ compressible@~2.0.18: mime-db ">= 1.43.0 < 2" compression@^1.7.4: - version "1.8.0" - resolved "https://registry.yarnpkg.com/compression/-/compression-1.8.0.tgz#09420efc96e11a0f44f3a558de59e321364180f7" - integrity sha512-k6WLKfunuqCYD3t6AsuPGvQWaKwuLLh2/xHNcX4qE+vIfDNXpSqnrhwA7O53R7WVQUnt8dVAIW+YHr7xTgOgGA== + version "1.8.2" + resolved "https://registry.yarnpkg.com/compression/-/compression-1.8.2.tgz#781397127ae2da00c0c5f7c76bda5b2a9b32a49f" + integrity sha512-o8vI5RE5A6EVVOd9o41jKp41aJom+QTEO/Bx8MYNjexMo/Bv2WOjUfZr+aL0WnYSgymUy6zeguqLTsIhV0gMvQ== dependencies: bytes "3.1.2" compressible "~2.0.18" debug "2.6.9" + destroy "1.2.0" negotiator "~0.6.4" - on-headers "~1.0.2" + on-headers "~1.1.0" safe-buffer "5.2.1" vary "~1.1.2" @@ -8703,6 +8704,11 @@ on-headers@~1.0.2: resolved "https://registry.yarnpkg.com/on-headers/-/on-headers-1.0.2.tgz#772b0ae6aaa525c399e489adfad90c403eb3c28f" integrity sha512-pZAE+FJLoyITytdqK0U5s+FIpjN0JP3OzFi/u8Rx+EV5/W+JTWGXG8xFzevE7AjBfDqHv/8vL8qQsIhHnqRkrA== +on-headers@~1.1.0: + version "1.1.0" + resolved "https://registry.yarnpkg.com/on-headers/-/on-headers-1.1.0.tgz#59da4f91c45f5f989c6e4bcedc5a3b0aed70ff65" + integrity sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A== + once@^1.3.0, once@^1.3.1, once@^1.4.0: version "1.4.0" resolved "https://registry.yarnpkg.com/once/-/once-1.4.0.tgz#583b1aa775961d4b113ac17d9c50baef9dd76bd1" From e0804962fd64eb04aa7f1e4c096f3ce67092325e Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:44:53 -0400 Subject: [PATCH 14/33] refresh engine.io to 6.6.11 engine.io 6.6.4 (high) -> 6.6.11, within socket.io's ~6.6.0 range. It brings its own ws ~8.21.0 (8.21.3). testem talks to the browser over socket.io. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/yarn.lock b/yarn.lock index d6ba2ac07..72f22a35c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1736,6 +1736,13 @@ resolved "https://registry.yarnpkg.com/@types/symlink-or-copy/-/symlink-or-copy-1.2.2.tgz#51b1c00b516a5774ada5d611e65eb123f988ef8d" integrity sha512-MQ1AnmTLOncwEf9IVU+B2e4Hchrku5N67NkgcAHW0p3sdzPe0FNMANxEm6OJUzPniEQGkeT3OROLlCwZJLWFZA== +"@types/ws@^8.5.12": + version "8.18.2" + resolved "https://registry.yarnpkg.com/@types/ws/-/ws-8.18.2.tgz#25d6321b30ef0fddf6cc7052b4eef9ce4e412b6e" + integrity sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w== + dependencies: + "@types/node" "*" + "@ungap/promise-all-settled@1.1.2": version "1.1.2" resolved "https://registry.yarnpkg.com/@ungap/promise-all-settled/-/promise-all-settled-1.1.2.tgz#aa58042711d6e3275dd37dc597e5d31e8c290a44" @@ -2460,7 +2467,7 @@ base64-js@^1.3.1: resolved "https://registry.yarnpkg.com/base64-js/-/base64-js-1.5.1.tgz#1b1b440160a5bf7ad40b650f095963481903930a" integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA== -base64id@2.0.0, base64id@~2.0.0: +base64id@~2.0.0: version "2.0.0" resolved "https://registry.yarnpkg.com/base64id/-/base64id-2.0.0.tgz#2770ac6bc47d312af97a8bf9a634342e0cd25cb6" integrity sha512-lGe34o6EHj9y3Kts9R4ZYs/Gr+6N7MCaMlIFA3F1R2O5/m7K06AxfSeO5530PEERE6/WyEg3lsuyw4GHlPZHog== @@ -3965,7 +3972,7 @@ debug@^3.0.1, debug@^3.1.0: dependencies: ms "^2.1.1" -debug@^4.4.3: +debug@^4.4.3, debug@~4.4.1: version "4.4.3" resolved "https://registry.yarnpkg.com/debug/-/debug-4.4.3.tgz#c6ae432d9bd9662582fce08709b038c58e9e3d6a" integrity sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA== @@ -5121,19 +5128,19 @@ engine.io-parser@~5.2.1: integrity sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q== engine.io@~6.6.0: - version "6.6.4" - resolved "https://registry.yarnpkg.com/engine.io/-/engine.io-6.6.4.tgz#0a89a3e6b6c1d4b0c2a2a637495e7c149ec8d8ee" - integrity sha512-ZCkIjSYNDyGn0R6ewHDtXgns/Zre/NT6Agvq1/WobF7JXgFff4SeDroKiCO3fNJreU9YG429Sc81o4w5ok/W5g== + version "6.6.11" + resolved "https://registry.yarnpkg.com/engine.io/-/engine.io-6.6.11.tgz#05203f76be9c63489cdf52aadab4200a201315fd" + integrity sha512-z34mGpLoY/82ZbkX1LqGMIaf3wjVMPL6gVC681QDqnmzJ26synI8qAE32P+a7UazmpJZ8UGrFIeAavgRfXzYrg== dependencies: "@types/cors" "^2.8.12" "@types/node" ">=10.0.0" + "@types/ws" "^8.5.12" accepts "~1.3.4" - base64id "2.0.0" cookie "~0.7.2" cors "~2.8.5" - debug "~4.3.1" + debug "~4.4.1" engine.io-parser "~5.2.1" - ws "~8.17.1" + ws "~8.21.0" enhanced-resolve@^5.17.1: version "5.18.1" @@ -11642,6 +11649,11 @@ ws@~8.17.1: resolved "https://registry.yarnpkg.com/ws/-/ws-8.17.1.tgz#9293da530bb548febc95371d90f9c878727d919b" integrity sha512-6XQFvXTkbfUOZOKKILFG1PDK2NDQs4azKQl26T0YS5CxqWLgXajbPZ+h4gZekJyRqFU8pvnbAbbs/3TgRPy+GQ== +ws@~8.21.0: + version "8.21.3" + resolved "https://registry.yarnpkg.com/ws/-/ws-8.21.3.tgz#660b4faddb6a3e575c86e078126919961f4de4fc" + integrity sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw== + xdg-basedir@^4.0.0: version "4.0.0" resolved "https://registry.yarnpkg.com/xdg-basedir/-/xdg-basedir-4.0.0.tgz#4bc8d9984403696225ef83a1573cbbcb4e79db13" From 5f5dd519c6164ee309f38863eefa27d7f55a21e0 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:48:17 -0400 Subject: [PATCH 15/33] refresh socket.io-parser to 4.2.7 socket.io-parser 4.2.4 (high) -> 4.2.7, within socket.io's ~4.2.4 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/yarn.lock b/yarn.lock index 72f22a35c..1d5b3eb0d 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3979,7 +3979,7 @@ debug@^4.4.3, debug@~4.4.1: dependencies: ms "^2.1.3" -debug@~4.3.1, debug@~4.3.2, debug@~4.3.4: +debug@~4.3.2, debug@~4.3.4: version "4.3.7" resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.7.tgz#87945b4151a011d76d95a198d7111c865c360a52" integrity sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ== @@ -10207,12 +10207,12 @@ socket.io-adapter@~2.5.2: ws "~8.17.1" socket.io-parser@~4.2.4: - version "4.2.4" - resolved "https://registry.yarnpkg.com/socket.io-parser/-/socket.io-parser-4.2.4.tgz#c806966cf7270601e47469ddeec30fbdfda44c83" - integrity sha512-/GbIKmo8ioc+NIWIhwdecY0ge+qVBSMdgxGygevmdHj24bsfgtCmcUUcQ5ZzcylGFHsN3k4HB4Cgkl96KVnuew== + version "4.2.7" + resolved "https://registry.yarnpkg.com/socket.io-parser/-/socket.io-parser-4.2.7.tgz#679e51fe24d1c81df90fc5f7efe4a5f432fe99c0" + integrity sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg== dependencies: "@socket.io/component-emitter" "~3.1.0" - debug "~4.3.1" + debug "~4.4.1" socket.io@^4.5.4: version "4.8.1" From 538755c2f8c8d1d3e7dd5c8a04d797feb0af8ac5 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 14:08:21 -0400 Subject: [PATCH 16/33] refresh ws to 8.21.3/8.22.0 ws 8.17.1 and 8.18.2 (both high) remained after the engine.io refresh: - jsdom's ^8.2.3 range refreshes to 8.22.0. - socket.io-adapter 2.5.5 pinned ws ~8.17.1; socket.io-adapter 2.5.8, within socket.io's ~2.5.2 range, takes ~8.21.0 (8.21.3), the same copy engine.io already uses. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) diff --git a/yarn.lock b/yarn.lock index 1d5b3eb0d..36b508d74 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3979,7 +3979,7 @@ debug@^4.4.3, debug@~4.4.1: dependencies: ms "^2.1.3" -debug@~4.3.2, debug@~4.3.4: +debug@~4.3.2: version "4.3.7" resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.7.tgz#87945b4151a011d76d95a198d7111c865c360a52" integrity sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ== @@ -10199,12 +10199,12 @@ snapdragon@^0.8.1: use "^3.1.0" socket.io-adapter@~2.5.2: - version "2.5.5" - resolved "https://registry.yarnpkg.com/socket.io-adapter/-/socket.io-adapter-2.5.5.tgz#c7a1f9c703d7756844751b6ff9abfc1780664082" - integrity sha512-eLDQas5dzPgOWCk9GuuJC2lBqItuhKI4uxGgo9aIV7MYbk2h9Q6uULEh8WBzThoI7l+qU9Ast9fVUmkqPP9wYg== + version "2.5.8" + resolved "https://registry.yarnpkg.com/socket.io-adapter/-/socket.io-adapter-2.5.8.tgz#c9fcabf602dbd5b09258ca98e5ec6a7ae4360698" + integrity sha512-6Oy52pbg+kvdCVvjcN+FnY7BvxZ7cIHNScbvztT/It5d0vbwoJoVZmF2gjJmnV0/4WlXRfG15zc45ySk9Ah8bw== dependencies: - debug "~4.3.4" - ws "~8.17.1" + debug "~4.4.1" + ws "~8.21.0" socket.io-parser@~4.2.4: version "4.2.7" @@ -11640,14 +11640,9 @@ write-file-atomic@^3.0.0: typedarray-to-buffer "^3.1.5" ws@^8.2.3: - version "8.18.2" - resolved "https://registry.yarnpkg.com/ws/-/ws-8.18.2.tgz#42738b2be57ced85f46154320aabb51ab003705a" - integrity sha512-DMricUmwGZUVr++AEAe2uiVM7UoO9MAVZMDu05UQOaUII0lp+zOzLLU4Xqh/JvTqklB1T4uELaaPBKyjE1r4fQ== - -ws@~8.17.1: - version "8.17.1" - resolved "https://registry.yarnpkg.com/ws/-/ws-8.17.1.tgz#9293da530bb548febc95371d90f9c878727d919b" - integrity sha512-6XQFvXTkbfUOZOKKILFG1PDK2NDQs4azKQl26T0YS5CxqWLgXajbPZ+h4gZekJyRqFU8pvnbAbbs/3TgRPy+GQ== + version "8.22.0" + resolved "https://registry.yarnpkg.com/ws/-/ws-8.22.0.tgz#40f16e1d7588ac0575041be5c49b8eb261c28e73" + integrity sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg== ws@~8.21.0: version "8.21.3" From 4c878d0d6169f1e1d3c07959092e490d6cf6048e Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:22:31 -0400 Subject: [PATCH 17/33] refresh websocket-driver to 0.7.5 websocket-driver 0.7.4 (critical) -> 0.7.5, within faye-websocket's >=0.5.1 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 36b508d74..0462f97a9 100644 --- a/yarn.lock +++ b/yarn.lock @@ -11418,9 +11418,9 @@ webpack@^5.56.1: webpack-sources "^3.2.3" websocket-driver@>=0.5.1: - version "0.7.4" - resolved "https://registry.yarnpkg.com/websocket-driver/-/websocket-driver-0.7.4.tgz#89ad5295bbf64b480abcba31e4953aca706f5760" - integrity sha512-b17KeDIQVjvb0ssuSDF2cYXSg2iztliJ4B9WdsuB6J952qCPKmnVq4DyW5motImXHDC1cBT/1UezrJVsKw5zjg== + version "0.7.5" + resolved "https://registry.yarnpkg.com/websocket-driver/-/websocket-driver-0.7.5.tgz#569d22764ab21f2de20af0e74b411e8ae5a0fa46" + integrity sha512-ZL2+3c7kMBdIRCMz6l8jQMHyGVxj+UL+xVk74Ombiciboca8rHa15L86B19E5oh1pL9Ii/uj54gtsIrZGMo6zA== dependencies: http-parser-js ">=0.5.1" safe-buffer ">=5.1.0" From 617be53f74a569220308c9b173aac0559602c79e Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:19:19 -0400 Subject: [PATCH 18/33] refresh proxy-addr to 2.0.8 proxy-addr 2.0.7 (critical) -> 2.0.8, within express's ~2.0.7 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 0462f97a9..71cd1fadf 100644 --- a/yarn.lock +++ b/yarn.lock @@ -9249,9 +9249,9 @@ propagate@^2.0.0: integrity sha512-vGrhOavPSTz4QVNuBNdcNXePNdNMaO1xj9yBeH1ScQPjk/rhg9sSlCXPhMkFuaNNW/syTvYqsnbIJxMBfRbbag== proxy-addr@~2.0.7: - version "2.0.7" - resolved "https://registry.yarnpkg.com/proxy-addr/-/proxy-addr-2.0.7.tgz#f19fe69ceab311eeb94b42e70e8c2070f9ba1025" - integrity sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg== + version "2.0.8" + resolved "https://registry.yarnpkg.com/proxy-addr/-/proxy-addr-2.0.8.tgz#624e760fd8ab06b1b8320c2f8506d4422cf8e932" + integrity sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ== dependencies: forwarded "0.2.0" ipaddr.js "1.9.1" From 80d18f1f1da8549f2135bea293f8f1b031f9627c Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:14:46 -0400 Subject: [PATCH 19/33] refresh terser-webpack-plugin to 5.6.1 webpack 5's terser-webpack-plugin 5.3.14 depended on serialize-javascript 6.0.2 (high; the fix, 7.x, needs Node >= 20). 5.6.1, still inside webpack's ^5.3.11 range, no longer depends on serialize-javascript at all. Lockfile refresh only. The production build bundles the same modules and identifiers; only webpack's numeric module ids in the two ember-auto-import chunks (and so their content hashes and the references in index.html) change. Audit: high 50 -> 49. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/yarn.lock b/yarn.lock index 71cd1fadf..e55f7e24d 100644 --- a/yarn.lock +++ b/yarn.lock @@ -9947,13 +9947,6 @@ serialize-javascript@5.0.1: dependencies: randombytes "^2.1.0" -serialize-javascript@^6.0.2: - version "6.0.2" - resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-6.0.2.tgz#defa1e055c83bf6d59ea805d8da862254eb6a6c2" - integrity sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g== - dependencies: - randombytes "^2.1.0" - serve-static@~1.16.2: version "1.16.3" resolved "https://registry.yarnpkg.com/serve-static/-/serve-static-1.16.3.tgz#a97b74d955778583f3862a4f0b841eb4d5d78cf9" @@ -10718,14 +10711,13 @@ temp@0.9.4: rimraf "~2.6.2" terser-webpack-plugin@^5.3.11: - version "5.3.14" - resolved "https://registry.yarnpkg.com/terser-webpack-plugin/-/terser-webpack-plugin-5.3.14.tgz#9031d48e57ab27567f02ace85c7d690db66c3e06" - integrity sha512-vkZjpUjb6OMS7dhV+tILUW6BhpDR7P2L/aQSAv+Uwk+m8KATX9EccViHTJR2qDtACKPIYndLGCyl3FMo+r2LMw== + version "5.6.1" + resolved "https://registry.yarnpkg.com/terser-webpack-plugin/-/terser-webpack-plugin-5.6.1.tgz#47bc41bd8b8fab8383b62ec763b7394829097e7b" + integrity sha512-201R5j+sJpK8nFWwKVyNfZot8FaJbLZDq5evriVzbV1wDtSXDjRUDRfJzHpAaxFDMEhsZL1QkeqM61wgsS3KaQ== dependencies: "@jridgewell/trace-mapping" "^0.3.25" jest-worker "^27.4.5" schema-utils "^4.3.0" - serialize-javascript "^6.0.2" terser "^5.31.1" terser@^5.31.1, terser@^5.7.0: From 1e10ea8bb4aa27de46db537c8592fe327d91689f Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:25:30 -0400 Subject: [PATCH 20/33] refresh shell-quote to 1.12.0 shell-quote 1.8.3 (critical, high) -> 1.12.0, within npm-run-all's ^1.6.1 range. npm-run-all drives `yarn lint`, which still runs all its tasks. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index e55f7e24d..ede4b58ce 100644 --- a/yarn.lock +++ b/yarn.lock @@ -10038,9 +10038,9 @@ shebang-regex@^3.0.0: integrity sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A== shell-quote@^1.6.1: - version "1.8.3" - resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.8.3.tgz#55e40ef33cf5c689902353a3d8cd1a6725f08b4b" - integrity sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw== + version "1.12.0" + resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.12.0.tgz#e98fdfd2e921d8a58ae2820f4fc0f75c39f09675" + integrity sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q== shellwords@^0.1.1: version "0.1.1" From fb57ffdbbf5ce1943b80ad14ba8d30c9c10aa153 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:28:27 -0400 Subject: [PATCH 21/33] refresh form-data to 4.0.6 form-data 4.0.3 (critical, high) -> 4.0.6, within jsdom's ^4.0.0 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/yarn.lock b/yarn.lock index ede4b58ce..d3706744a 100644 --- a/yarn.lock +++ b/yarn.lock @@ -6096,15 +6096,15 @@ for-in@^1.0.2: integrity sha512-7EwmXrOjyL+ChxMhmG5lnW9MPt1aIeZEwKhQzoBUdTV0N3zuwWDZYVJatDvZ2OyzPUvdIAZDsCetk3coyMfcnQ== form-data@^4.0.0: - version "4.0.3" - resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.3.tgz#608b1b3f3e28be0fccf5901fc85fb3641e5cf0ae" - integrity sha512-qsITQPfmvMOSAdeyZ+12I1c+CKSstAFAwu+97zrnWAbIr5u8wfsExUzCesVLC8NgHuRUqNN4Zy6UPWUTRGslcA== + version "4.0.6" + resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.6.tgz#28e864e1b786dbebb68db1f452f9635278665827" + integrity sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ== dependencies: asynckit "^0.4.0" combined-stream "^1.0.8" es-set-tostringtag "^2.1.0" - hasown "^2.0.2" - mime-types "^2.1.12" + hasown "^2.0.4" + mime-types "^2.1.35" forwarded@0.2.0: version "0.2.0" @@ -8267,7 +8267,7 @@ mime-db@1.52.0: resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.54.0.tgz#cddb3ee4f9c64530dff640236661d42cb6a314f5" integrity sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ== -mime-types@^2.1.12, mime-types@^2.1.18, mime-types@^2.1.26, mime-types@^2.1.27, mime-types@~2.1.24, mime-types@~2.1.34: +mime-types@^2.1.18, mime-types@^2.1.26, mime-types@^2.1.27, mime-types@^2.1.35, mime-types@~2.1.24, mime-types@~2.1.34: version "2.1.35" resolved "https://registry.yarnpkg.com/mime-types/-/mime-types-2.1.35.tgz#381a871b62a734450660ae3deee44813f70d959a" integrity sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw== From 7221bd3ddb6c3ecc3b0ad784fa27704393b800b4 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:31:35 -0400 Subject: [PATCH 22/33] refresh @xmldom/xmldom to 0.8.15 @xmldom/xmldom 0.8.10 (13 high findings) -> 0.8.15, within testem's ^0.8.0 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index d3706744a..d90cf2df6 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1870,9 +1870,9 @@ "@xtuc/long" "4.2.2" "@xmldom/xmldom@^0.8.0": - version "0.8.10" - resolved "https://registry.yarnpkg.com/@xmldom/xmldom/-/xmldom-0.8.10.tgz#a1337ca426aa61cef9fe15b5b28e340a72f6fa99" - integrity sha512-2WALfTl4xo2SkGCYRt6rDTFfk9R1czmBvUQy12gK2KuRKIpWEhcbbzy8EZXtz/jkRqHX8bFEc6FC1HjX4TUWYw== + version "0.8.15" + resolved "https://registry.yarnpkg.com/@xmldom/xmldom/-/xmldom-0.8.15.tgz#71ebf80729e4e95221d519ac9b1e1eaea7784907" + integrity sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA== "@xtuc/ieee754@^1.2.0": version "1.2.0" From 4c1dd507a1760d6caf569a14028c5f6a46eab3d6 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 14:11:09 -0400 Subject: [PATCH 23/33] refresh flatted to 3.4.4 flatted 3.3.3 (high) -> 3.4.4, within flat-cache's ^3.2.9 range (eslint's cache, exercised by `yarn lint`). Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index d90cf2df6..a892f44a7 100644 --- a/yarn.lock +++ b/yarn.lock @@ -6067,9 +6067,9 @@ flat@^5.0.2: integrity sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ== flatted@^3.2.9: - version "3.3.3" - resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.3.3.tgz#67c8fad95454a7c7abebf74bb78ee74a44023358" - integrity sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg== + version "3.4.4" + resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.4.4.tgz#aeeca2a506303f0cee61c59e6c9f2a88d2f29fc6" + integrity sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q== focus-trap@^6.7.1: version "6.9.4" From a60344f597eca323da98f33f3037b82bfb95e1b7 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 14:14:49 -0400 Subject: [PATCH 24/33] refresh js-yaml to 3.15.2 and force mocha's copy to 4.3.2 js-yaml 3.14.1 (ember-cli, testem, tap-parser) and 4.0.0 (mocha) both have high advisories. - The ^3 ranges refresh to 3.15.2 (lockfile only). - mocha 8 pins js-yaml 4.0.0 exactly, so a resolution scoped to mocha moves it to 4.3.2 (same major). mocha uses it to read YAML config; loading a .mocharc.yml through it still runs all node tests. Co-Authored-By: Claude Opus 5.5 --- package.json | 3 ++- yarn.lock | 14 +++++++------- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/package.json b/package.json index e8b4785c7..9b2b7284a 100644 --- a/package.json +++ b/package.json @@ -65,7 +65,8 @@ "nanoid": "^3.3.18", "markdown-it": "^14.3.3", "lodash.template": "^4.18.1", - "ansi-html": "0.0.9" + "ansi-html": "0.0.9", + "mocha/js-yaml": "^4.3.2" }, "dependencies": { "@ember/render-modifiers": "^2.1.0", diff --git a/yarn.lock b/yarn.lock index a892f44a7..7a2e07a43 100644 --- a/yarn.lock +++ b/yarn.lock @@ -7513,17 +7513,17 @@ js-tokens@^4.0.0: resolved "https://registry.yarnpkg.com/js-tokens/-/js-tokens-4.0.0.tgz#19203fb59991df98e3a287050d4647cdeaf32499" integrity sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ== -js-yaml@4.0.0: - version "4.0.0" - resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.0.0.tgz#f426bc0ff4b4051926cd588c71113183409a121f" - integrity sha512-pqon0s+4ScYUvX30wxQi3PogGFAlUyH0awepWvwkj4jD4v+ova3RiYw8bmA6x2rDrEaj8i/oWKoRxpVNW+Re8Q== +js-yaml@4.0.0, js-yaml@^4.3.2: + version "4.3.2" + resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.2.tgz#8e44fb14a2643c59726bb15787b5f1512cb3d3fb" + integrity sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA== dependencies: argparse "^2.0.1" js-yaml@^3.13.1, js-yaml@^3.14.0, js-yaml@^3.2.5, js-yaml@^3.2.7: - version "3.14.1" - resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.14.1.tgz#dae812fdb3825fa306609a8717383c50c36a0537" - integrity sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g== + version "3.15.2" + resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.15.2.tgz#3f83823ac6be17f570f23b2ecdef3777ff5ea364" + integrity sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w== dependencies: argparse "^1.0.7" esprima "^4.0.0" From 33d259159749cc25df89377e36729f145e90bcd6 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 14:17:47 -0400 Subject: [PATCH 25/33] refresh source-map-js to 1.2.2 source-map-js 1.2.1 (high) -> 1.2.2, within css-tree's ^1.0.1 range (eslint-plugin-ember). It merges with the 1.2.2 copy already in the tree. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/yarn.lock b/yarn.lock index 7a2e07a43..2fa07b0ba 100644 --- a/yarn.lock +++ b/yarn.lock @@ -10237,12 +10237,7 @@ sort-package-json@^1.49.0: is-plain-obj "2.1.0" sort-object-keys "^1.1.3" -source-map-js@^1.0.1: - version "1.2.1" - resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.1.tgz#1ce5650fddd87abc099eda37dcff024c2667ae46" - integrity sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA== - -source-map-js@^1.2.2: +source-map-js@^1.0.1, source-map-js@^1.2.2: version "1.2.2" resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.2.tgz#79fb88d97535a21cb27162cb05d211b67acea4ab" integrity sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw== From fa369d583efb56200202a6db2c12bef6bc8126b6 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 14:20:18 -0400 Subject: [PATCH 26/33] refresh underscore to 1.13.8 underscore 1.13.7 (high) -> 1.13.8, within backbone's >=1.8.3 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 2fa07b0ba..f2406188c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -11079,9 +11079,9 @@ underscore.string@^3.2.2, underscore.string@~3.3.4: util-deprecate "^1.0.2" underscore@>=1.8.3: - version "1.13.7" - resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.13.7.tgz#970e33963af9a7dda228f17ebe8399e5fbe63a10" - integrity sha512-GMXzWtsc57XAtguZgaQViUOzs0KTkk8ojr3/xAxXLITqf/3EMwxC0inyETfDFjH/Krbhuep0HNbbjI9i/q3F3g== + version "1.13.8" + resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.13.8.tgz#a93a21186c049dbf0e847496dba72b7bd8c1e92b" + integrity sha512-DXtD3ZtEQzc7M8m4cXotyHR+FAS18C64asBYY5vqZexfYryNNnDc02W4hKg3rdQuqOYas1jkseX0+nZXjTXnvQ== undici-types@~7.8.0: version "7.8.0" From 9ec9243dcc59fef083fc11da78e39c9ac23327ff Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Thu, 29 Oct 2026 06:42:21 -0400 Subject: [PATCH 27/33] SCF-2415: bump version to 4.10.3 Co-Authored-By: Claude Opus 5.5 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 9b2b7284a..1974f3567 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "ember-bootstrap", - "version": "4.10.2", + "version": "4.10.3", "description": "Bootstrap components for Ember.js", "keywords": [ "ember-addon", From b4f43a5cb329469a7370a7a20d5b3a8a8f201000 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Tue, 3 Nov 2026 08:08:10 -0500 Subject: [PATCH 28/33] SCF-2415: run CI on push only for scf_master and tags With push on every branch and pull_request on every base branch, each push to a branch with an open PR ran the full matrix twice. PRs are still covered by the pull_request trigger, which uses '**' so stacked PRs on gaurav/chore/... bases run (b057803b). Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 348976a2c..f4a825a48 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,7 +3,7 @@ name: CI on: push: branches: - - '*' + - scf_master tags: - '*' pull_request: From 4b70cb2f773e770454ca775f13252b8017e3e85c Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Tue, 3 Nov 2026 08:07:58 -0500 Subject: [PATCH 29/33] SCF-2415: make the modal footer's submit button a submit button via the type attribute Since f005cd0c the default submit button set its type with @buttonType="submit", which only BsButton understands. A custom @buttonComponent that renders - + {{else}} {{/if}} diff --git a/tests/integration/components/bs-modal/footer-test.js b/tests/integration/components/bs-modal/footer-test.js index 4e8e9b74e..b22ce9c72 100644 --- a/tests/integration/components/bs-modal/footer-test.js +++ b/tests/integration/components/bs-modal/footer-test.js @@ -1,3 +1,5 @@ +import { setComponentTemplate } from '@ember/component'; +import templateOnly from '@ember/component/template-only'; import { module } from 'qunit'; import { setupRenderingTest } from 'ember-qunit'; import { click, render } from '@ember/test-helpers'; @@ -64,6 +66,38 @@ module('Integration | Component | bs-modal/footer', function (hooks) { assert.true(defaultPrevented, 'Native form submission is prevented.'); }); + module('native form submission', function (hooks) { + hooks.beforeEach(function () { + this.defaultPrevented = undefined; + this.listener = (event) => { + this.defaultPrevented = event.defaultPrevented; + // never let the test runner page navigate + event.preventDefault(); + }; + window.addEventListener('submit', this.listener); + }); + + hooks.afterEach(function () { + window.removeEventListener('submit', this.listener); + }); + + test('a custom buttonComponent submits the footer', async function (assert) { + let submitCount = 0; + this.set('submit', () => submitCount++); + this.CustomButton = setComponentTemplate( + hbs``, + templateOnly() + ); + await render( + hbs`` + ); + await click('.modal-footer button:last-child'); + + assert.strictEqual(submitCount, 1, 'onSubmit is called once.'); + assert.true(this.defaultPrevented, 'Native form submission is prevented.'); + }); + }); + test('Footer can have a custom submitButtonType', async function (assert) { await render(hbs``); assert.dom('.modal-footer button:last-child').hasClass('btn-danger', 'Submit button is a danger button.'); From 4614a42a8ee1ab5bbcc3b5401ec9a959fb5d5ff2 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Tue, 3 Nov 2026 08:07:58 -0500 Subject: [PATCH 30/33] SCF-2415: keep the modal footer's native submission unless onSubmit handles it 6c23b4c9 made the footer
always call preventDefault() on submit, to stop the page reload when its submit button calls @onSubmit. That also blocked native submission where it used to happen: a standalone footer without @onSubmit, and a footer given an action attribute (e.g. ). Only prevent the default when @onSubmit is given and the form has no action attribute. That still covers the reload in BsModal, where the footer always gets onSubmit and no action. Co-Authored-By: Claude Opus 5.5 --- addon/components/bs-modal/footer.js | 12 +++++++++--- .../components/bs-modal/footer-test.js | 19 +++++++++++++++++++ 2 files changed, 28 insertions(+), 3 deletions(-) diff --git a/addon/components/bs-modal/footer.js b/addon/components/bs-modal/footer.js index 729eb115f..db033fd66 100644 --- a/addon/components/bs-modal/footer.js +++ b/addon/components/bs-modal/footer.js @@ -70,8 +70,14 @@ import { action } from '@ember/object'; export default class ModalFooter extends Component { @action handleSubmit(event) { - // the footer is a , so prevent the browser's native submission (and the page reload that comes with it) - event.preventDefault(); - this.args.onSubmit?.(); + if (!this.args.onSubmit) { + return; + } + // the footer is a , so prevent the browser's native submission (and the page reload that comes with it), + // unless an `action` attribute asks for it + if (!event.target.hasAttribute('action')) { + event.preventDefault(); + } + this.args.onSubmit(); } } diff --git a/tests/integration/components/bs-modal/footer-test.js b/tests/integration/components/bs-modal/footer-test.js index b22ce9c72..af7aceb89 100644 --- a/tests/integration/components/bs-modal/footer-test.js +++ b/tests/integration/components/bs-modal/footer-test.js @@ -81,6 +81,25 @@ module('Integration | Component | bs-modal/footer', function (hooks) { window.removeEventListener('submit', this.listener); }); + test('it is not prevented without onSubmit', async function (assert) { + await render(hbs``); + await click('.modal-footer button:last-child'); + + assert.false(this.defaultPrevented, 'Native form submission is not prevented.'); + }); + + test('it is not prevented when the footer has an action attribute', async function (assert) { + let submitCount = 0; + this.set('submit', () => submitCount++); + await render( + hbs`` + ); + await click('.modal-footer button:last-child'); + + assert.strictEqual(submitCount, 1, 'onSubmit is called once.'); + assert.false(this.defaultPrevented, 'Native form submission is not prevented.'); + }); + test('a custom buttonComponent submits the footer', async function (assert) { let submitCount = 0; this.set('submit', () => submitCount++); From 52be6925ad57865705296c34440e7f2a04db2bb4 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Tue, 3 Nov 2026 08:08:10 -0500 Subject: [PATCH 31/33] SCF-2415: hide BsAlert for @visible={{null}} again 8945d07c (upstream #2027) replaced `@arg visible = true` with `this._visible ?? true`, so @visible={{null}} (e.g. an unset model attribute) now shows the alert. @arg only falls back to its default for undefined, so null used to hide it. Fall back for undefined only. Co-Authored-By: Claude Opus 5.5 --- addon/components/bs-alert.js | 2 +- tests/integration/components/bs-alert-test.js | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/addon/components/bs-alert.js b/addon/components/bs-alert.js index e483c607e..411d5f521 100644 --- a/addon/components/bs-alert.js +++ b/addon/components/bs-alert.js @@ -86,7 +86,7 @@ export default class Alert extends Component { * @public */ get visible() { - return this._visible ?? true; + return this._visible !== undefined ? this._visible : true; } /** diff --git a/tests/integration/components/bs-alert-test.js b/tests/integration/components/bs-alert-test.js index f250917a1..d9de0242b 100644 --- a/tests/integration/components/bs-alert-test.js +++ b/tests/integration/components/bs-alert-test.js @@ -141,6 +141,22 @@ module('Integration | Component | bs-alert', function (hooks) { assert.dom('*').hasText('', 'alert has no content'); }); + test('alert is initially hidden when visible=null', async function (assert) { + await render(hbs`Test`); + + assert.dom('.alert').doesNotExist('alert has no alert class'); + assert.dom('*').hasText('', 'alert has no content'); + }); + + test('alert can be hidden by setting visible=null', async function (assert) { + this.set('visible', true); + await render(hbs`Test`); + this.set('visible', null); + await settled(); + + assert.dom('.alert').doesNotExist('alert has no alert class'); + }); + test('alert can be made visible when setting visible=true', async function (assert) { this.set('visible', false); await render(hbs`Test`); From ad6dd684bc38abcaf1f7612ba16677dfbbc70409 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Tue, 3 Nov 2026 08:08:10 -0500 Subject: [PATCH 32/33] SCF-2415: follow BsAlert's @visible in the same render 8945d07c copied @visible into the tracked _visible from a {{did-update this.updateVisibility @visible}} modifier. Writing it during modifier commit schedules a second render, and only that render runs {{did-update this.showOrHide this._visible}}, so each @visible change took an extra render pass before the fade started. Resolve visibility in the visible getter instead. A dismissal records how often @visible had changed at the time (_dismissedAt), and holds until @visible changes again, which the getter counts in untracked fields. That keeps #2027's behavior (dismiss doesn't touch @visible, and setting @visible to false and back to true shows the alert again) without writing tracked state while rendering, which is what broke @localCopy on Ember canary. showOrHide's did-update now reads @visible itself, so without a fade onDismissed is called from the afterRender queue instead of from the modifier: a handler that sets @visible (as in #2027's test) would otherwise update a value that render has already used. With a fade it was already called later, from a timer. Co-Authored-By: Claude Opus 5.5 --- addon/components/bs-alert.hbs | 3 +-- addon/components/bs-alert.js | 40 +++++++++++++++++++++++++---------- 2 files changed, 30 insertions(+), 13 deletions(-) diff --git a/addon/components/bs-alert.hbs b/addon/components/bs-alert.hbs index e192d07fb..ed8b27fbb 100644 --- a/addon/components/bs-alert.hbs +++ b/addon/components/bs-alert.hbs @@ -1,8 +1,7 @@
{{#unless this.hidden}} {{#if this.dismissible}} diff --git a/addon/components/bs-alert.js b/addon/components/bs-alert.js index 411d5f521..bbad72857 100644 --- a/addon/components/bs-alert.js +++ b/addon/components/bs-alert.js @@ -1,7 +1,7 @@ import { action } from '@ember/object'; import Component from '@glimmer/component'; import { tracked } from '@glimmer/tracking'; -import { later } from '@ember/runloop'; +import { later, schedule } from '@ember/runloop'; import usesTransition from 'ember-bootstrap/utils/decorators/uses-transition'; import deprecateSubclassing from 'ember-bootstrap/utils/deprecate-subclassing'; import arg from 'ember-bootstrap/utils/decorators/arg'; @@ -86,15 +86,33 @@ export default class Alert extends Component { * @public */ get visible() { - return this._visible !== undefined ? this._visible : true; + let visible = this.args.visible; + if (visible !== this._visibleArg) { + // untracked bookkeeping, so the alert can be shown again after being dismissed once `@visible` changes + // eslint-disable-next-line ember/no-side-effects + this._visibleArg = visible; + this._visibleArgChanges++; + } + if (this._dismissedAt === this._visibleArgChanges) { + return false; + } + return visible !== undefined ? visible : true; } /** - * @property _visible + * `@visible` as last seen by `visible`, and how often it has changed. These are untracked, as `visible` updates them + * while rendering. + * @private + */ + _visibleArg = this.args.visible; + _visibleArgChanges = 0; + + /** + * The value of `_visibleArgChanges` when the alert was dismissed, so the alert stays hidden until `@visible` changes. * @private */ @tracked - _visible = this.args.visible; + _dismissedAt = -1; /** * Set to false to disable the fade out animation when hiding the alert. @@ -163,7 +181,7 @@ export default class Alert extends Component { @action dismiss() { if (this.args.onDismiss?.() !== false) { - this._visible = false; + this._dismissedAt = this._visibleArgChanges; } } @@ -202,7 +220,12 @@ export default class Alert extends Component { ); } else { this.hidden = true; - this.args.onDismissed?.(); + // hide() runs while rendering, and onDismissed may set @visible, which that render has already read + schedule('afterRender', this, function () { + if (!this.isDestroyed) { + this.args.onDismissed?.(); + } + }); } } @@ -214,9 +237,4 @@ export default class Alert extends Component { this.hide(); } } - - @action - updateVisibility() { - this._visible = this.args.visible; - } } From ee88a0fc06e331d2428fb742720921bae8fad4ba Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Tue, 3 Nov 2026 08:08:10 -0500 Subject: [PATCH 33/33] SCF-2415: skip the "does not catch errors thrown by onSubmit" test only under Embroider 7b53aa7a skipped it everywhere for an Embroider-only failure (kaliber5/ember-bootstrap#1682), so classic builds stopped checking that BsForm doesn't swallow errors thrown by @onSubmit. Skip it only when @embroider/core is installed, the check @embroider/test-setup's maybeEmbroider uses to build with Embroider. Co-Authored-By: Claude Opus 5.5 --- tests/integration/components/bs-form-test.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/integration/components/bs-form-test.js b/tests/integration/components/bs-form-test.js index 0e06ce531..dc912aad5 100644 --- a/tests/integration/components/bs-form-test.js +++ b/tests/integration/components/bs-form-test.js @@ -33,6 +33,10 @@ import setupNoDeprecations from '../../helpers/setup-no-deprecations'; import a11yAudit from 'ember-a11y-testing/test-support/audit'; import sinon from 'sinon'; import Ember from 'ember'; +import { dependencySatisfies, macroCondition } from '@embroider/macros'; + +// see https://github.com/kaliber5/ember-bootstrap/issues/1682 +const testUnlessEmbroider = macroCondition(dependencySatisfies('@embroider/core', '*')) ? skip : test; const nextRunloop = function () { return new Promise((resolve) => { @@ -241,7 +245,7 @@ module('Integration | Component | bs-form', function (hooks) { assert.dom(`.${formFeedbackClass()}`).hasText('There is an error'); }); - skip('it does not catch errors thrown by onSubmit action', async function (assert) { + testUnlessEmbroider('it does not catch errors thrown by onSubmit action', async function (assert) { let onErrorStub = sinon.stub(); let expectedError = new Error();