diff --git a/.npmrc b/.npmrc index a6453b569..15d2d4607 100644 --- a/.npmrc +++ b/.npmrc @@ -1,8 +1,3 @@ save-exact=true manage-package-manager-versions=true - -# Here in npmrc, because this flag looks like not working in pnpm-workspace -# 86400 (minutes) is 60 days -# Set, because old packages in npm do not have trust policy -# Once time passes and packages are newer, we should remove this flag -trust-policy-ignore-after=86400 \ No newline at end of file +frozen-lockfile=true diff --git a/README.md b/README.md index 65e57d841..1d0e4bc64 100644 --- a/README.md +++ b/README.md @@ -85,6 +85,15 @@ pnpm dlx turbo login pnpm dlx turbo link ``` +### Installing new packages + +This has following requirements for improved supply chain security: + +- Packages must be older than 21 days +- Added packages must use exact version (no `^` or `~`) +- Packages versions cannot have a downgraded provenance security +- All installs are using froze lockfile to prevent unintended changes in transitive dependencies, to update packages anyway, you must use: `pnpm install --no-frozen-lockfile` + ## ADR This repository uses [architecture decision records](https://cognitect.com/blog/2011/11/15/documenting-architecture-decisions) to document architectural decisions. You can find them in the `adr` directory. diff --git a/apps/avatax/bruno/package.json b/apps/avatax/bruno/package.json index 9a0f23b99..4eacd10ef 100644 --- a/apps/avatax/bruno/package.json +++ b/apps/avatax/bruno/package.json @@ -2,14 +2,14 @@ "name": "bruno", "version": "1.0.0", "description": "", + "keywords": [], + "license": "(BSD-3-Clause AND CC-BY-4.0)", + "author": "", "main": "index.js", "scripts": { "test": "echo \"Error: no test specified\" && exit 1" }, - "keywords": [], - "author": "", - "license": "ISC", "dependencies": { - "@faker-js/faker": "^8.4.1" + "@faker-js/faker": "8.4.1" } } diff --git a/apps/avatax/package.json b/apps/avatax/package.json index 7cd1ee02e..12a680523 100644 --- a/apps/avatax/package.json +++ b/apps/avatax/package.json @@ -54,13 +54,13 @@ "@trpc/react-query": "catalog:", "@trpc/server": "catalog:", "@vercel/otel": "catalog:", - "avatax": "^23.7.0", + "avatax": "23.7.0", "decimal.js-light": "catalog:", "dotenv": "catalog:", "dynamodb-toolbox": "catalog:", "graphql": "catalog:", "graphql-tag": "catalog:", - "jotai": "^2.4.2", + "jotai": "2.4.2", "jsdom": "catalog:", "modern-errors": "catalog:", "modern-errors-serialize": "catalog:", @@ -75,9 +75,9 @@ "zod": "catalog:" }, "devDependencies": { - "@faker-js/faker": "^8.4.1", + "@faker-js/faker": "8.4.1", "@graphql-codegen/cli": "catalog:", - "@graphql-codegen/import-types-preset": "^3.0.0", + "@graphql-codegen/import-types-preset": "3.0.0", "@graphql-codegen/introspection": "catalog:", "@graphql-codegen/schema-ast": "4.0.2", "@graphql-codegen/typed-document-node": "catalog:", @@ -101,8 +101,8 @@ "eslint-plugin-n": "catalog:", "graphql-codegen-typescript-operation-types": "catalog:", "graphql-config": "5.0.3", - "pactum": "^3.6.0", - "pactum-matchers": "^1.1.6", + "pactum": "3.6.0", + "pactum-matchers": "1.1.6", "tsx": "catalog:", "typescript": "catalog:", "vite": "catalog:", diff --git a/apps/cms/package.json b/apps/cms/package.json index 6fc2701b3..84fd9d178 100644 --- a/apps/cms/package.json +++ b/apps/cms/package.json @@ -78,7 +78,7 @@ "@graphql-typed-document-node/core": "catalog:", "@saleor/eslint-config-apps": "workspace:*", "@saleor/typescript-config-apps": "workspace:*", - "@types/qs": "^6.9.7", + "@types/qs": "6.9.7", "@types/react": "18.2.5", "@types/react-dom": "18.2.5", "@vitest/coverage-v8": "catalog:", diff --git a/apps/klaviyo/package.json b/apps/klaviyo/package.json index 7913180ab..605764fcf 100644 --- a/apps/klaviyo/package.json +++ b/apps/klaviyo/package.json @@ -40,10 +40,10 @@ "graphql": "catalog:", "graphql-tag": "catalog:", "next": "catalog:", - "node-fetch": "^3.2.6", + "node-fetch": "3.2.6", "react": "catalog:", "react-dom": "catalog:", - "react-helmet": "^6.1.0", + "react-helmet": "6.1.0", "urql": "catalog:", "usehooks-ts": "catalog:", "vite": "catalog:", @@ -63,15 +63,15 @@ "@types/node": "catalog:", "@types/react": "18.2.5", "@types/react-dom": "18.2.5", - "autoprefixer": "^10.4.7", - "clean-publish": "^4.0.1", + "autoprefixer": "10.4.7", + "clean-publish": "4.0.1", "eslint": "catalog:", "eslint-plugin-n": "catalog:", "graphql-codegen-typescript-operation-types": "catalog:", "graphql-config": "5.0.3", "jsdom": "catalog:", - "postcss": "^8.4.14", - "pretty-quick": "^3.1.3", + "postcss": "8.4.14", + "pretty-quick": "3.1.3", "tsx": "catalog:", "typescript": "5.8.2" } diff --git a/apps/products-feed/package.json b/apps/products-feed/package.json index 3a3bd1ea9..9cc185087 100644 --- a/apps/products-feed/package.json +++ b/apps/products-feed/package.json @@ -17,7 +17,7 @@ }, "dependencies": { "@aws-sdk/client-dynamodb": "catalog:", - "@aws-sdk/client-s3": "^3.332.0", + "@aws-sdk/client-s3": "3.332.0", "@aws-sdk/lib-dynamodb": "catalog:", "@aws-sdk/s3-request-presigner": "3.332.0", "@aws-sdk/util-dynamodb": "catalog:", @@ -51,10 +51,10 @@ "@vitejs/plugin-react": "catalog:", "dotenv": "catalog:", "dynamodb-toolbox": "catalog:", - "fast-xml-parser": "^4.0.15", + "fast-xml-parser": "4.0.15", "graphql": "catalog:", "graphql-tag": "catalog:", - "handlebars": "^4.7.9", + "handlebars": "4.7.9", "handlebars-helpers": "0.10.0", "jsdom": "catalog:", "neverthrow": "catalog:", @@ -81,7 +81,7 @@ "@saleor/typescript-config-apps": "workspace:*", "@testing-library/dom": "10.4.0", "@testing-library/react": "16.2.0", - "@types/handlebars-helpers": "^0.5.6", + "@types/handlebars-helpers": "0.5.6", "@types/react": "18.2.5", "@types/react-dom": "18.2.5", "@vitest/coverage-v8": "catalog:", diff --git a/apps/search/package.json b/apps/search/package.json index bba9e879d..a3516891a 100644 --- a/apps/search/package.json +++ b/apps/search/package.json @@ -49,8 +49,8 @@ "@trpc/server": "catalog:", "@vercel/otel": "catalog:", "algoliasearch": "4.23.3", - "clsx": "^1.2.1", - "debug": "^4.3.4", + "clsx": "1.2.1", + "debug": "4.3.4", "dotenv": "catalog:", "dynamodb-toolbox": "catalog:", "graphql": "catalog:", @@ -58,7 +58,7 @@ "next": "catalog:", "react": "catalog:", "react-dom": "catalog:", - "react-helmet": "^6.1.0", + "react-helmet": "6.1.0", "react-hook-form": "catalog:", "urql": "catalog:", "zod": "catalog:" diff --git a/apps/smtp/package.json b/apps/smtp/package.json index b315cdc8e..d7ef7a459 100644 --- a/apps/smtp/package.json +++ b/apps/smtp/package.json @@ -25,7 +25,7 @@ "@aws-sdk/lib-dynamodb": "catalog:", "@aws-sdk/util-dynamodb": "catalog:", "@hookform/resolvers": "catalog:", - "@monaco-editor/react": "^4.4.6", + "@monaco-editor/react": "4.4.6", "@opentelemetry/api": "catalog:", "@opentelemetry/api-logs": "catalog:", "@opentelemetry/instrumentation": "catalog:", @@ -57,16 +57,16 @@ "dynamodb-toolbox": "catalog:", "graphql": "catalog:", "graphql-tag": "catalog:", - "handlebars": "^4.7.9", + "handlebars": "4.7.9", "handlebars-helpers": "0.10.0", - "html-to-text": "^9.0.3", + "html-to-text": "9.0.3", "jsdom": "catalog:", "mjml": "4.15.3", "modern-errors": "catalog:", "modern-errors-serialize": "catalog:", "neverthrow": "catalog:", "next": "catalog:", - "nodemailer": "^6.9.1", + "nodemailer": "6.9.1", "react": "catalog:", "react-dom": "catalog:", "react-hook-form": "catalog:", @@ -87,10 +87,10 @@ "@graphql-typed-document-node/core": "catalog:", "@saleor/eslint-config-apps": "workspace:*", "@saleor/typescript-config-apps": "workspace:*", - "@types/handlebars-helpers": "^0.5.6", - "@types/html-to-text": "^9.0.0", + "@types/handlebars-helpers": "0.5.6", + "@types/html-to-text": "9.0.0", "@types/mjml": "4.7.4", - "@types/nodemailer": "^6.4.7", + "@types/nodemailer": "6.4.7", "@types/react": "18.2.5", "@types/react-dom": "18.2.5", "@vitest/coverage-v8": "catalog:", diff --git a/package.json b/package.json index 3ec1ec111..46fd5fa69 100644 --- a/package.json +++ b/package.json @@ -31,7 +31,7 @@ } }, "devDependencies": { - "@changesets/cli": "^2.30.0", + "@changesets/cli": "2.30.0", "@cspell/cspell-types": "8.17.5", "@saleor/app-sdk": "catalog:", "cspell": "8.17.5", diff --git a/packages/handlebars/package.json b/packages/handlebars/package.json index f5f987aa6..de45364c9 100644 --- a/packages/handlebars/package.json +++ b/packages/handlebars/package.json @@ -16,10 +16,10 @@ "devDependencies": { "@saleor/eslint-config-apps": "workspace:*", "@saleor/typescript-config-apps": "workspace:*", - "@types/handlebars-helpers": "^0.5.6", + "@types/handlebars-helpers": "0.5.6", "@vitest/coverage-v8": "catalog:", "eslint": "catalog:", - "handlebars": "^4.7.9", + "handlebars": "4.7.9", "handlebars-helpers": "0.10.0", "typescript": "catalog:", "vite": "catalog:", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index dbfa666a3..359f50234 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -220,7 +220,7 @@ importers: .: devDependencies: '@changesets/cli': - specifier: ^2.30.0 + specifier: 2.30.0 version: 2.30.0(@types/node@22.13.10) '@cspell/cspell-types': specifier: 8.17.5 @@ -326,7 +326,7 @@ importers: version: 1.77.3 '@sentry/nextjs': specifier: 'catalog:' - version: 9.8.0(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/instrumentation@0.57.2(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.0))(next@15.2.8(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react@18.2.0)(webpack@5.82.1) + version: 9.8.0(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/instrumentation@0.57.2(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.0))(next@15.2.8(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react@18.2.0)(webpack@5.82.1) '@t3-oss/env-nextjs': specifier: 'catalog:' version: 0.11.1(typescript@5.8.2)(zod@3.21.4) @@ -335,7 +335,7 @@ importers: version: 10.45.3(@trpc/server@10.45.3) '@trpc/next': specifier: 'catalog:' - version: 10.45.3(@tanstack/react-query@4.29.19(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(@trpc/client@10.45.3(@trpc/server@10.45.3))(@trpc/react-query@10.45.3(@tanstack/react-query@4.29.19(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(@trpc/client@10.45.3(@trpc/server@10.45.3))(@trpc/server@10.45.3)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(@trpc/server@10.45.3)(next@15.2.8(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react-dom@18.2.0(react@18.2.0))(react@18.2.0) + version: 10.45.3(@tanstack/react-query@4.29.19(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(@trpc/client@10.45.3(@trpc/server@10.45.3))(@trpc/react-query@10.45.3(@tanstack/react-query@4.29.19(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(@trpc/client@10.45.3(@trpc/server@10.45.3))(@trpc/server@10.45.3)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(@trpc/server@10.45.3)(next@15.2.8(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react-dom@18.2.0(react@18.2.0))(react@18.2.0) '@trpc/react-query': specifier: 'catalog:' version: 10.45.3(@tanstack/react-query@4.29.19(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(@trpc/client@10.45.3(@trpc/server@10.45.3))(@trpc/server@10.45.3)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) @@ -346,7 +346,7 @@ importers: specifier: 'catalog:' version: 1.10.1(@opentelemetry/api-logs@0.57.2)(@opentelemetry/api@1.9.0)(@opentelemetry/instrumentation@0.57.2(@opentelemetry/api@1.9.0))(@opentelemetry/resources@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-logs@0.57.2(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-metrics@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.0)) avatax: - specifier: ^23.7.0 + specifier: 23.7.0 version: 23.7.0 decimal.js-light: specifier: 'catalog:' @@ -364,7 +364,7 @@ importers: specifier: 'catalog:' version: 2.12.6(graphql@16.7.1) jotai: - specifier: ^2.4.2 + specifier: 2.4.2 version: 2.4.2(@types/react@18.2.5)(react@18.2.0) jsdom: specifier: 'catalog:' @@ -380,7 +380,7 @@ importers: version: 6.2.1 next: specifier: 'catalog:' - version: 15.2.8(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) + version: 15.2.8(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) react: specifier: 'catalog:' version: 18.2.0 @@ -404,13 +404,13 @@ importers: version: 3.21.4 devDependencies: '@faker-js/faker': - specifier: ^8.4.1 + specifier: 8.4.1 version: 8.4.1 '@graphql-codegen/cli': specifier: 'catalog:' version: 5.0.2(@types/node@22.13.10)(enquirer@2.4.1)(graphql@16.7.1)(typescript@5.8.2) '@graphql-codegen/import-types-preset': - specifier: ^3.0.0 + specifier: 3.0.0 version: 3.0.0(graphql@16.7.1) '@graphql-codegen/introspection': specifier: 'catalog:' @@ -482,10 +482,10 @@ importers: specifier: 5.0.3 version: 5.0.3(@types/node@22.13.10)(graphql@16.7.1)(typescript@5.8.2) pactum: - specifier: ^3.6.0 + specifier: 3.6.0 version: 3.6.0 pactum-matchers: - specifier: ^1.1.6 + specifier: 1.1.6 version: 1.1.6 tsx: specifier: 'catalog:' @@ -684,7 +684,7 @@ importers: specifier: workspace:* version: link:../../packages/typescript-config '@types/qs': - specifier: ^6.9.7 + specifier: 6.9.7 version: 6.9.7 '@types/react': specifier: 18.2.5 @@ -798,7 +798,7 @@ importers: specifier: 'catalog:' version: 15.2.8(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) node-fetch: - specifier: ^3.2.6 + specifier: 3.2.6 version: 3.2.6 react: specifier: 'catalog:' @@ -807,7 +807,7 @@ importers: specifier: 'catalog:' version: 18.2.0(react@18.2.0) react-helmet: - specifier: ^6.1.0 + specifier: 6.1.0 version: 6.1.0(react@18.2.0) urql: specifier: 'catalog:' @@ -862,10 +862,10 @@ importers: specifier: 18.2.5 version: 18.2.5 autoprefixer: - specifier: ^10.4.7 + specifier: 10.4.7 version: 10.4.7(postcss@8.4.14) clean-publish: - specifier: ^4.0.1 + specifier: 4.0.1 version: 4.0.1 eslint: specifier: 'catalog:' @@ -883,10 +883,10 @@ importers: specifier: 'catalog:' version: 20.0.3 postcss: - specifier: ^8.4.14 + specifier: 8.4.14 version: 8.4.14 pretty-quick: - specifier: ^3.1.3 + specifier: 3.1.3 version: 3.1.3(prettier@3.5.3) tsx: specifier: 'catalog:' @@ -1127,7 +1127,7 @@ importers: specifier: 'catalog:' version: 3.1004.0 '@aws-sdk/client-s3': - specifier: ^3.332.0 + specifier: 3.332.0 version: 3.332.0 '@aws-sdk/lib-dynamodb': specifier: 'catalog:' @@ -1229,7 +1229,7 @@ importers: specifier: 'catalog:' version: 2.8.0(@aws-sdk/client-dynamodb@3.1004.0)(@aws-sdk/lib-dynamodb@3.1004.0(@aws-sdk/client-dynamodb@3.1004.0)) fast-xml-parser: - specifier: ^4.0.15 + specifier: 4.0.15 version: 4.0.15 graphql: specifier: 'catalog:' @@ -1314,7 +1314,7 @@ importers: specifier: 16.2.0 version: 16.2.0(@testing-library/dom@10.4.0)(@types/react-dom@18.2.5)(@types/react@18.2.5)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) '@types/handlebars-helpers': - specifier: ^0.5.6 + specifier: 0.5.6 version: 0.5.6 '@types/react': specifier: 18.2.5 @@ -1446,10 +1446,10 @@ importers: specifier: 4.23.3 version: 4.23.3 clsx: - specifier: ^1.2.1 + specifier: 1.2.1 version: 1.2.1 debug: - specifier: ^4.3.4 + specifier: 4.3.4 version: 4.3.4 dotenv: specifier: 'catalog:' @@ -1473,7 +1473,7 @@ importers: specifier: 'catalog:' version: 18.2.0(react@18.2.0) react-helmet: - specifier: ^6.1.0 + specifier: 6.1.0 version: 6.1.0(react@18.2.0) react-hook-form: specifier: 'catalog:' @@ -1793,7 +1793,7 @@ importers: specifier: 'catalog:' version: 3.3.1(react-hook-form@7.43.9(react@18.2.0)) '@monaco-editor/react': - specifier: ^4.4.6 + specifier: 4.4.6 version: 4.4.6(monaco-editor@0.47.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) '@opentelemetry/api': specifier: 'catalog:' @@ -1851,7 +1851,7 @@ importers: version: 1.77.3 '@sentry/nextjs': specifier: 'catalog:' - version: 9.8.0(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/instrumentation@0.57.2(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.0))(next@15.2.8(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react@18.2.0)(webpack@5.82.1) + version: 9.8.0(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/instrumentation@0.57.2(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.0))(next@15.2.8(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react@18.2.0)(webpack@5.82.1) '@t3-oss/env-nextjs': specifier: 'catalog:' version: 0.11.1(typescript@5.8.2)(zod@3.21.4) @@ -1863,7 +1863,7 @@ importers: version: 10.45.3(@trpc/server@10.45.3) '@trpc/next': specifier: 'catalog:' - version: 10.45.3(@tanstack/react-query@4.29.19(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(@trpc/client@10.45.3(@trpc/server@10.45.3))(@trpc/react-query@10.45.3(@tanstack/react-query@4.29.19(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(@trpc/client@10.45.3(@trpc/server@10.45.3))(@trpc/server@10.45.3)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(@trpc/server@10.45.3)(next@15.2.8(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react-dom@18.2.0(react@18.2.0))(react@18.2.0) + version: 10.45.3(@tanstack/react-query@4.29.19(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(@trpc/client@10.45.3(@trpc/server@10.45.3))(@trpc/react-query@10.45.3(@tanstack/react-query@4.29.19(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(@trpc/client@10.45.3(@trpc/server@10.45.3))(@trpc/server@10.45.3)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(@trpc/server@10.45.3)(next@15.2.8(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(react-dom@18.2.0(react@18.2.0))(react@18.2.0) '@trpc/react-query': specifier: 'catalog:' version: 10.45.3(@tanstack/react-query@4.29.19(react-dom@18.2.0(react@18.2.0))(react@18.2.0))(@trpc/client@10.45.3(@trpc/server@10.45.3))(@trpc/server@10.45.3)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) @@ -1895,7 +1895,7 @@ importers: specifier: 0.10.0 version: 0.10.0 html-to-text: - specifier: ^9.0.3 + specifier: 9.0.3 version: 9.0.3 jsdom: specifier: 'catalog:' @@ -1914,9 +1914,9 @@ importers: version: 6.2.1 next: specifier: 'catalog:' - version: 15.2.8(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) + version: 15.2.8(@opentelemetry/api@1.9.0)(@playwright/test@1.52.0)(react-dom@18.2.0(react@18.2.0))(react@18.2.0) nodemailer: - specifier: ^6.9.1 + specifier: 6.9.1 version: 6.9.1 react: specifier: 'catalog:' @@ -1974,16 +1974,16 @@ importers: specifier: workspace:* version: link:../../packages/typescript-config '@types/handlebars-helpers': - specifier: ^0.5.6 + specifier: 0.5.6 version: 0.5.6 '@types/html-to-text': - specifier: ^9.0.0 + specifier: 9.0.0 version: 9.0.0 '@types/mjml': specifier: 4.7.4 version: 4.7.4 '@types/nodemailer': - specifier: ^6.4.7 + specifier: 6.4.7 version: 6.4.7 '@types/react': specifier: 18.2.5 @@ -2513,7 +2513,7 @@ importers: specifier: workspace:* version: link:../typescript-config '@types/handlebars-helpers': - specifier: ^0.5.6 + specifier: 0.5.6 version: 0.5.6 '@vitest/coverage-v8': specifier: 'catalog:' @@ -3367,10 +3367,6 @@ packages: resolution: {integrity: sha512-wFBW4yciDfzQBSFmWNaEvHShnSGLMxSu9Lls6EUf6xDMavxSB36bsrVRX6CyAo/W0NeIIyEOW1LclGPgJV1okg==} engines: {node: '>=14.0.0'} - '@aws-sdk/types@3.840.0': - resolution: {integrity: sha512-xliuHaUFZxEx1NSXeLLZ9Dyu6+EJVQKEoD+yM+zqUo3YDZ7medKJWY6fIOKiPX/N7XbLdBYwajb15Q7IL8KkeA==} - engines: {node: '>=18.0.0'} - '@aws-sdk/types@3.973.5': resolution: {integrity: sha512-hl7BGwDCWsjH8NkZfx+HgS7H2LyM2lTMAI7ba9c8O0KqdBLTdNJivsHpqjg9rNlAlPyREb6DeDRXUl0s8uFdmQ==} engines: {node: '>=20.0.0'} @@ -3910,15 +3906,9 @@ packages: '@bundled-es-modules/tough-cookie@0.1.6': resolution: {integrity: sha512-dvMHbL464C0zI+Yqxbz6kZ5TOEp7GLW+pry/RWndAR8MJQAXZ2rPmIs8tziTZjeIyhSNZgZbCePtfSbdWqStJw==} - '@changesets/apply-release-plan@7.0.10': - resolution: {integrity: sha512-wNyeIJ3yDsVspYvHnEz1xQDq18D9ifed3lI+wxRQRK4pArUcuHgCTrHv0QRnnwjhVCQACxZ+CBih3wgOct6UXw==} - '@changesets/apply-release-plan@7.1.0': resolution: {integrity: sha512-yq8ML3YS7koKQ/9bk1PqO0HMzApIFNwjlwCnwFEXMzNe8NpzeeYYKCmnhWJGkN8g7E51MnWaSbqRcTcdIxUgnQ==} - '@changesets/assemble-release-plan@6.0.6': - resolution: {integrity: sha512-Frkj8hWJ1FRZiY3kzVCKzS0N5mMwWKwmv9vpam7vt8rZjLL1JMthdh6pSDVSPumHPshTTkKZ0VtNbE0cJHZZUg==} - '@changesets/assemble-release-plan@6.0.9': resolution: {integrity: sha512-tPgeeqCHIwNo8sypKlS3gOPmsS3wP0zHt67JDuL20P4QcXiw/O4Hl7oXiuLnP9yg+rXLQ2sScdV1Kkzde61iSQ==} @@ -3933,9 +3923,6 @@ packages: resolution: {integrity: sha512-5D3Nk2JPqMI1wK25pEymeWRSlSMdo5QOGlyfrKg0AOufrUcjEE3RQgaCpHoBiM31CSNrtSgdJ0U6zL1rLDDfBA==} hasBin: true - '@changesets/config@3.1.1': - resolution: {integrity: sha512-bd+3Ap2TKXxljCggI0mKPfzCQKeV/TU4yO2h2C6vAihIo8tzseAn2e7klSuiyYYXvgu53zMN1OeYMIQkaQoWnA==} - '@changesets/config@3.1.3': resolution: {integrity: sha512-vnXjcey8YgBn2L1OPWd3ORs0bGC4LoYcK/ubpgvzNVr53JXV5GiTVj7fWdMRsoKUH7hhhMAQnsJUqLr21EncNw==} @@ -3948,33 +3935,21 @@ packages: '@changesets/get-release-plan@4.0.15': resolution: {integrity: sha512-Q04ZaRPuEVZtA+auOYgFaVQQSA98dXiVe/yFaZfY7hoSmQICHGvP0TF4u3EDNHWmmCS4ekA/XSpKlSM2PyTS2g==} - '@changesets/get-release-plan@4.0.8': - resolution: {integrity: sha512-MM4mq2+DQU1ZT7nqxnpveDMTkMBLnwNX44cX7NSxlXmr7f8hO6/S2MXNiXG54uf/0nYnefv0cfy4Czf/ZL/EKQ==} - '@changesets/get-version-range-type@0.4.0': resolution: {integrity: sha512-hwawtob9DryoGTpixy1D3ZXbGgJu1Rhr+ySH2PvTLHvkZuQ7sRT4oQwMh0hbqZH1weAooedEjRsbrWcGLCeyVQ==} - '@changesets/git@3.0.2': - resolution: {integrity: sha512-r1/Kju9Y8OxRRdvna+nxpQIsMsRQn9dhhAZt94FLDeu0Hij2hnOozW8iqnHBgvu+KdnJppCveQwK4odwfw/aWQ==} - '@changesets/git@3.0.4': resolution: {integrity: sha512-BXANzRFkX+XcC1q/d27NKvlJ1yf7PSAgi8JG6dt8EfbHFHi4neau7mufcSca5zRhwOL8j9s6EqsxmT+s+/E6Sw==} '@changesets/logger@0.1.1': resolution: {integrity: sha512-OQtR36ZlnuTxKqoW4Sv6x5YIhOmClRd5pWsjZsddYxpWs517R0HkyiefQPIytCVh4ZcC5x9XaG8KTdd5iRQUfg==} - '@changesets/parse@0.4.1': - resolution: {integrity: sha512-iwksMs5Bf/wUItfcg+OXrEpravm5rEd9Bf4oyIPL4kVTmJQ7PNDSd6MDYkpSJR1pn7tz/k8Zf2DhTCqX08Ou+Q==} - '@changesets/parse@0.4.3': resolution: {integrity: sha512-ZDmNc53+dXdWEv7fqIUSgRQOLYoUom5Z40gmLgmATmYR9NbL6FJJHwakcCpzaeCy+1D0m0n7mT4jj2B/MQPl7A==} '@changesets/pre@2.0.2': resolution: {integrity: sha512-HaL/gEyFVvkf9KFg6484wR9s0qjAXlZ8qWPDkTyKF6+zqjBe/I2mygg3MbpZ++hdi0ToqNUF8cjj7fBy0dg8Ug==} - '@changesets/read@0.6.3': - resolution: {integrity: sha512-9H4p/OuJ3jXEUTjaVGdQEhBdqoT2cO5Ts95JTFsQyawmKzpL8FnIeJSyhTDPW1MBRDnwZlHFEM9SpPwJDY5wIg==} - '@changesets/read@0.6.7': resolution: {integrity: sha512-D1G4AUYGrBEk8vj8MGwf75k9GpN6XL3wg8i42P2jZZwFLXnlr2Pn7r9yuQNbaMCarP7ZQWNJbV6XLeysAIMhTA==} @@ -6284,10 +6259,6 @@ packages: resolution: {integrity: sha512-COuLsZILbbQsdrwKQpkkpyep7lCsByxwj7m0Mg5v66/ZTyenlfBc40/QFQ5chO0YN/PNEH1Bi3fGtfXPnYNeDw==} engines: {node: '>=18.0.0'} - '@smithy/types@4.3.1': - resolution: {integrity: sha512-UqKOQBL2x6+HWl3P+3QqFD4ncKq0I8Nuz9QItGv5WuKuMHuuwlhvqcZCoXGfc+P1QmfJE7VieykoYYmrOoFJxA==} - engines: {node: '>=18.0.0'} - '@smithy/url-parser@4.2.11': resolution: {integrity: sha512-oTAGGHo8ZYc5VZsBREzuf5lf2pAurJQsccMusVZ85wDkX66ojEc/XauiGjzCj50A61ObFTPe6d7Pyt6UBYaing==} engines: {node: '>=18.0.0'} @@ -7332,11 +7303,6 @@ packages: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} engines: {node: '>=8'} - browserslist@4.21.9: - resolution: {integrity: sha512-M0MFoZzbUrRU4KNfCrDLnvyE7gub+peetoTid3TBIqtunaDJyXlwhakT+/VkvSXcfIzFfK/nkCs4nmyTmxdNSg==} - engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} - hasBin: true - browserslist@4.24.4: resolution: {integrity: sha512-KDi1Ny1gSePi1vm0q4oxSF8b4DR44GF4BbmS2YdhPLOEqd8pDviZOGH/GsmRwoWJ2+5Lr085X7naowMwKHDG1A==} engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} @@ -7400,9 +7366,6 @@ packages: resolution: {integrity: sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==} engines: {node: '>=6'} - caniuse-lite@1.0.30001503: - resolution: {integrity: sha512-Sf9NiF+wZxPfzv8Z3iS0rXM1Do+iOy2Lxvib38glFX+08TCYYYGR5fRJXk4d77C4AYwhUjgYgMsMudbh2TqCKw==} - caniuse-lite@1.0.30001707: resolution: {integrity: sha512-3qtRjw/HQSMlDWf+X79N206fepf4SOOU6SQLMaq/0KkZLmSjPxAkBOQQ+FxbHKfHmYLZFfdWsO3KA90ceHPSnw==} @@ -7673,10 +7636,6 @@ packages: resolution: {integrity: sha512-Pcw1JTvZLSJH83iiGWt6fRcT+BjZlCDRVwYLbUcHzv/CRpB7r0MlSrGbIyQvVSNyGnbt7G4AXuyCiDR3POvZ1A==} engines: {node: '>=16.0.0'} - cross-spawn@7.0.3: - resolution: {integrity: sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==} - engines: {node: '>= 8'} - cross-spawn@7.0.6: resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==} engines: {node: '>= 8'} @@ -8040,9 +7999,6 @@ packages: resolution: {integrity: sha512-M9wIMFx96vq0R4F+gRpY3o2exzb8hEj/n9S8unZtHSvYjibBp/iMufSzvmOcV/laG0ZtuTVGtiJggPOSW2r93g==} hasBin: true - electron-to-chromium@1.4.482: - resolution: {integrity: sha512-h+UqpfmEr1Qkk0zp7ej/jid7CXoq4m4QzW6wNTb0ELJ/BZCpA4wgUylBIMGCe621tnr4l5VmoHjdoSx2lbnNJA==} - electron-to-chromium@1.5.129: resolution: {integrity: sha512-JlXUemX4s0+9f8mLqib/bHH8gOHf5elKS6KeWG3sk3xozb/JTq/RLXIv8OKUWiK4Ah00Wm88EFj5PYkFr4RUPA==} @@ -8400,10 +8356,6 @@ packages: resolution: {integrity: sha512-V7/RktU11J3I36Nwq2JnZEM7tNm17eBJz+u25qdxBZeCKiX6BkVSZQjwWIr+IobgnZy+ag73tTZgZi7tr0LrBw==} engines: {node: '>=6.0.0'} - fast-glob@3.2.12: - resolution: {integrity: sha512-DVj4CQIYYow0BlaelwK1pHl5n5cRSJfM60UA0zK891sVInoPri2Ekj7+e1CT3/3qxXenpI+nBBmQAcJPJgaj4w==} - engines: {node: '>=8.6.0'} - fast-glob@3.3.1: resolution: {integrity: sha512-kNFPyjhh5cKjrUltxs+wFx+ZkbRaxxmZ+X0ZU31SOsxCEtP9VPgtq2teZw1DebupL5GmDaNQ6yKMMVcM41iqDg==} engines: {node: '>=8.6.0'} @@ -8992,10 +8944,6 @@ packages: ieee754@1.2.1: resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==} - ignore@5.2.4: - resolution: {integrity: sha512-MAb38BcSbH0eHNBxn7ql2NH/kX33OkB3lZ1BNdh7ENeRChHTYsTvWrMubiIAMNS2llXEEgZ1MUOBtXChP3kaFQ==} - engines: {node: '>= 4'} - ignore@5.3.2: resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==} engines: {node: '>= 4'} @@ -9738,10 +9686,6 @@ packages: resolution: {integrity: sha512-MWikgl9n9M3w+bpsY3He8L+w9eF9338xRl8IAO5viDizwSzziFEyUzo2xrrloB64ADbTf8uA8vRqqttDTOmccg==} engines: {node: '>=0.10.0'} - micromatch@4.0.5: - resolution: {integrity: sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==} - engines: {node: '>=8.6'} - micromatch@4.0.8: resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==} engines: {node: '>=8.6'} @@ -9983,11 +9927,6 @@ packages: resolution: {integrity: sha512-WWdIxpyjEn+FhQJQQv9aQAYlHoNVdzIzUySNV1gHUPDSdZJ3yZn7pAAbQcV7B56Mvu881q9FZV+0Vx2xC44VWA==} engines: {node: ^18.17.0 || >=20.5.0} - nanoid@3.3.6: - resolution: {integrity: sha512-BGcqMMJuToF7i1rt+2PWSNVnWIkGCU78jBG3RxO/bZlnZPK2Cmi2QaffxGO/2RvWi9sL+FAiRiXMgsyxQ1DIDA==} - engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} - hasBin: true - nanoid@3.3.8: resolution: {integrity: sha512-WNLf5Sd8oZxOm+TzppcYk8gVOgP+l58xNy58D0nbUnOxOWRWvlcCV4kUF7ltmI6PsrLl/BgKEyS4mqsGChFN0w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} @@ -10079,9 +10018,6 @@ packages: '@types/node': optional: true - node-releases@2.0.13: - resolution: {integrity: sha512-uYr7J37ae/ORWdZeQ1xxMJe3NtdmqMC/JZK+geofDrkLUApKRHPd18/TxtBOJ4A0/+uUIliorNrfYV6s1b02eQ==} - node-releases@2.0.19: resolution: {integrity: sha512-xxOWJsBKtzAq7DY0J+DTzuz58K8e7sJbdgwkbMWQe8UYB6ekmsQ45q0M/tJDsGaZmbC+l7n57UV8Hl5tHxO9uw==} @@ -10406,9 +10342,6 @@ packages: engines: {node: '>= 8'} deprecated: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info. - picocolors@1.0.0: - resolution: {integrity: sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ==} - picocolors@1.1.1: resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==} @@ -11089,10 +11022,6 @@ packages: resolution: {integrity: sha512-vfZWx4DnFNB8R9Vg4Dnx21s20auNzWH15ZaCBfADAiyrCwemRmhWstTgvLjMek1DW3+MHcNaqkp86giCF24rMA==} hasBin: true - source-map-js@1.0.2: - resolution: {integrity: sha512-R0XvVJ9WusLiqTCEiGCmICCMplcCkIwwR11mOSD9CR5u+IXYdiseeEuXCVAjS54zqwkLcPNnmU4OeJ6tUrWhDw==} - engines: {node: '>=0.10.0'} - source-map-js@1.2.1: resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} engines: {node: '>=0.10.0'} @@ -11465,9 +11394,6 @@ packages: tslib@2.4.1: resolution: {integrity: sha512-tGyy4dAjRIEwI7BzsB0lynWgOpfqjUdq91XXAlIWD2OwKBH7oCl/GZG/HT4BOHrTlPMOASlMQ7veyTqpmRcrNA==} - tslib@2.5.3: - resolution: {integrity: sha512-mSxlJJwl3BMEQCUNnxXBU9jP4JBktcEGhURcPR6VQVlnP0FdDEsIaz0C35dXNGLyRfrATNofF0F5p2KPxQgB+w==} - tslib@2.6.2: resolution: {integrity: sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q==} @@ -11648,12 +11574,6 @@ packages: resolution: {integrity: sha512-PcA2tsuGSF9cnySLHTLSh2qrQiJ70mn+r+Glzxv2TWZblxsxCC52BDlZoPCsz7STd9pN7EZetkWZBAvk4cgZdQ==} engines: {node: '>=0.10.0'} - update-browserslist-db@1.0.11: - resolution: {integrity: sha512-dCwEFf0/oT85M1fHBg4F0jtLwJrutGoHSQXCh7u4o2t1drG+c0a9Flnqww6XUKSfQMPpJBRjU8d4RXB09qtvaA==} - hasBin: true - peerDependencies: - browserslist: '>= 4.21.0' - update-browserslist-db@1.1.3: resolution: {integrity: sha512-UxhIZQ+QInVdunkDAaiazvvT/+fXL5Osr0JZlJulepYu6Jd7qJtDZjlur0emRlT71EN3ScPoE7gvsuIKKNavKw==} hasBin: true @@ -11866,10 +11786,6 @@ packages: resolution: {integrity: sha512-kfqDxt5dTB1JhqsCUQVFDj0rmY+4HLwGQIsLPbyrsN9y9WV/1oFDSx3BQ4GfCv9X+jVeQ7rouTqwK53rA/7t8A==} engines: {node: '>=10.0.0'} - web-streams-polyfill@3.2.1: - resolution: {integrity: sha512-e0MO3wdXWKrLbL0DgGnUV7WHVuw9OUvL4hjgnPkIeEvESk74gAITi5G606JtZPp39cd8HA9VQzCIvA49LpPN5Q==} - engines: {node: '>= 8'} - web-streams-polyfill@3.3.3: resolution: {integrity: sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==} engines: {node: '>= 8'} @@ -12225,13 +12141,13 @@ snapshots: '@aws-crypto/crc32@3.0.0': dependencies: '@aws-crypto/util': 3.0.0 - '@aws-sdk/types': 3.840.0 + '@aws-sdk/types': 3.973.5 tslib: 1.14.1 '@aws-crypto/crc32c@3.0.0': dependencies: '@aws-crypto/util': 3.0.0 - '@aws-sdk/types': 3.840.0 + '@aws-sdk/types': 3.973.5 tslib: 1.14.1 '@aws-crypto/ie11-detection@3.0.0': @@ -12243,7 +12159,7 @@ snapshots: '@aws-crypto/ie11-detection': 3.0.0 '@aws-crypto/supports-web-crypto': 3.0.0 '@aws-crypto/util': 3.0.0 - '@aws-sdk/types': 3.840.0 + '@aws-sdk/types': 3.973.5 '@aws-sdk/util-locate-window': 3.310.0 '@aws-sdk/util-utf8-browser': 3.259.0 tslib: 1.14.1 @@ -12254,7 +12170,7 @@ snapshots: '@aws-crypto/sha256-js': 3.0.0 '@aws-crypto/supports-web-crypto': 3.0.0 '@aws-crypto/util': 3.0.0 - '@aws-sdk/types': 3.840.0 + '@aws-sdk/types': 3.973.5 '@aws-sdk/util-locate-window': 3.310.0 '@aws-sdk/util-utf8-browser': 3.259.0 tslib: 1.14.1 @@ -12272,7 +12188,7 @@ snapshots: '@aws-crypto/sha256-js@3.0.0': dependencies: '@aws-crypto/util': 3.0.0 - '@aws-sdk/types': 3.840.0 + '@aws-sdk/types': 3.973.5 tslib: 1.14.1 '@aws-crypto/sha256-js@5.2.0': @@ -12291,7 +12207,7 @@ snapshots: '@aws-crypto/util@3.0.0': dependencies: - '@aws-sdk/types': 3.840.0 + '@aws-sdk/types': 3.973.5 '@aws-sdk/util-utf8-browser': 3.259.0 tslib: 1.14.1 @@ -12412,7 +12328,7 @@ snapshots: '@aws-sdk/util-waiter': 3.329.0 '@aws-sdk/xml-builder': 3.310.0 fast-xml-parser: 4.1.2 - tslib: 2.5.3 + tslib: 2.8.1 transitivePeerDependencies: - '@aws-sdk/signature-v4-crt' - aws-crt @@ -13131,11 +13047,6 @@ snapshots: dependencies: tslib: 2.8.1 - '@aws-sdk/types@3.840.0': - dependencies: - '@smithy/types': 4.3.1 - tslib: 2.8.1 - '@aws-sdk/types@3.973.5': dependencies: '@smithy/types': 4.13.0 @@ -13333,7 +13244,7 @@ snapshots: '@babel/traverse': 7.27.0 '@babel/types': 7.27.0 convert-source-map: 2.0.0 - debug: 4.4.3 + debug: 4.3.4 gensync: 1.0.0-beta.2 json5: 2.2.3 semver: 6.3.1 @@ -13353,7 +13264,7 @@ snapshots: '@babel/types': 7.28.6 '@jridgewell/remapping': 2.3.5 convert-source-map: 2.0.0 - debug: 4.4.3 + debug: 4.3.4 gensync: 1.0.0-beta.2 json5: 2.2.3 semver: 6.3.1 @@ -13760,7 +13671,7 @@ snapshots: '@babel/parser': 7.27.0 '@babel/template': 7.27.0 '@babel/types': 7.27.0 - debug: 4.4.3 + debug: 4.3.4 globals: 11.12.0 transitivePeerDependencies: - supports-color @@ -13773,7 +13684,7 @@ snapshots: '@babel/parser': 7.28.6 '@babel/template': 7.28.6 '@babel/types': 7.28.6 - debug: 4.4.3 + debug: 4.3.4 transitivePeerDependencies: - supports-color @@ -13802,22 +13713,6 @@ snapshots: '@types/tough-cookie': 4.0.5 tough-cookie: 4.1.4 - '@changesets/apply-release-plan@7.0.10': - dependencies: - '@changesets/config': 3.1.1 - '@changesets/get-version-range-type': 0.4.0 - '@changesets/git': 3.0.2 - '@changesets/should-skip-package': 0.1.2 - '@changesets/types': 6.1.0 - '@manypkg/get-packages': 1.1.3 - detect-indent: 6.1.0 - fs-extra: 7.0.1 - lodash.startcase: 4.4.0 - outdent: 0.5.0 - prettier: 2.8.8 - resolve-from: 5.0.0 - semver: 7.7.4 - '@changesets/apply-release-plan@7.1.0': dependencies: '@changesets/config': 3.1.3 @@ -13834,15 +13729,6 @@ snapshots: resolve-from: 5.0.0 semver: 7.7.4 - '@changesets/assemble-release-plan@6.0.6': - dependencies: - '@changesets/errors': 0.2.0 - '@changesets/get-dependents-graph': 2.1.3 - '@changesets/should-skip-package': 0.1.2 - '@changesets/types': 6.1.0 - '@manypkg/get-packages': 1.1.3 - semver: 7.7.4 - '@changesets/assemble-release-plan@6.0.9': dependencies: '@changesets/errors': 0.2.0 @@ -13858,17 +13744,17 @@ snapshots: '@changesets/cli@2.28.1': dependencies: - '@changesets/apply-release-plan': 7.0.10 - '@changesets/assemble-release-plan': 6.0.6 + '@changesets/apply-release-plan': 7.1.0 + '@changesets/assemble-release-plan': 6.0.9 '@changesets/changelog-git': 0.2.1 - '@changesets/config': 3.1.1 + '@changesets/config': 3.1.3 '@changesets/errors': 0.2.0 '@changesets/get-dependents-graph': 2.1.3 - '@changesets/get-release-plan': 4.0.8 - '@changesets/git': 3.0.2 + '@changesets/get-release-plan': 4.0.15 + '@changesets/git': 3.0.4 '@changesets/logger': 0.1.1 '@changesets/pre': 2.0.2 - '@changesets/read': 0.6.3 + '@changesets/read': 0.6.7 '@changesets/should-skip-package': 0.1.2 '@changesets/types': 6.1.0 '@changesets/write': 0.4.0 @@ -13918,16 +13804,6 @@ snapshots: transitivePeerDependencies: - '@types/node' - '@changesets/config@3.1.1': - dependencies: - '@changesets/errors': 0.2.0 - '@changesets/get-dependents-graph': 2.1.3 - '@changesets/logger': 0.1.1 - '@changesets/types': 6.1.0 - '@manypkg/get-packages': 1.1.3 - fs-extra: 7.0.1 - micromatch: 4.0.8 - '@changesets/config@3.1.3': dependencies: '@changesets/errors': 0.2.0 @@ -13959,25 +13835,8 @@ snapshots: '@changesets/types': 6.1.0 '@manypkg/get-packages': 1.1.3 - '@changesets/get-release-plan@4.0.8': - dependencies: - '@changesets/assemble-release-plan': 6.0.6 - '@changesets/config': 3.1.1 - '@changesets/pre': 2.0.2 - '@changesets/read': 0.6.3 - '@changesets/types': 6.1.0 - '@manypkg/get-packages': 1.1.3 - '@changesets/get-version-range-type@0.4.0': {} - '@changesets/git@3.0.2': - dependencies: - '@changesets/errors': 0.2.0 - '@manypkg/get-packages': 1.1.3 - is-subdir: 1.2.0 - micromatch: 4.0.8 - spawndamnit: 3.0.1 - '@changesets/git@3.0.4': dependencies: '@changesets/errors': 0.2.0 @@ -13990,11 +13849,6 @@ snapshots: dependencies: picocolors: 1.1.1 - '@changesets/parse@0.4.1': - dependencies: - '@changesets/types': 6.1.0 - js-yaml: 3.14.1 - '@changesets/parse@0.4.3': dependencies: '@changesets/types': 6.1.0 @@ -14007,16 +13861,6 @@ snapshots: '@manypkg/get-packages': 1.1.3 fs-extra: 7.0.1 - '@changesets/read@0.6.3': - dependencies: - '@changesets/git': 3.0.2 - '@changesets/logger': 0.1.1 - '@changesets/parse': 0.4.1 - '@changesets/types': 6.1.0 - fs-extra: 7.0.1 - p-filter: 2.1.0 - picocolors: 1.1.1 - '@changesets/read@0.6.7': dependencies: '@changesets/git': 3.0.4 @@ -14479,7 +14323,7 @@ snapshots: '@eslint/config-array@0.19.2': dependencies: '@eslint/object-schema': 2.1.6 - debug: 4.4.3 + debug: 4.3.4 minimatch: 3.1.2 transitivePeerDependencies: - supports-color @@ -14493,7 +14337,7 @@ snapshots: '@eslint/eslintrc@3.3.1': dependencies: ajv: 6.12.6 - debug: 4.4.3 + debug: 4.3.4 espree: 10.3.0 globals: 14.0.0 ignore: 5.3.2 @@ -14790,7 +14634,7 @@ snapshots: '@graphql-tools/code-file-loader': 8.1.1(graphql@16.11.0) '@graphql-tools/graphql-tag-pluck': 8.3.19(graphql@16.11.0) '@graphql-tools/utils': 10.0.13(graphql@16.11.0) - debug: 4.4.0 + debug: 4.3.4 eslint: 9.23.0(jiti@2.4.2) fast-glob: 3.3.3 graphql: 16.11.0 @@ -15147,7 +14991,7 @@ snapshots: '@types/json-stable-stringify': 1.0.36 '@whatwg-node/fetch': 0.9.16 chalk: 4.1.2 - debug: 4.4.3 + debug: 4.3.4 dotenv: 16.3.1 graphql: 16.7.1 graphql-request: 6.1.0(graphql@16.7.1) @@ -17026,10 +16870,6 @@ snapshots: dependencies: tslib: 2.8.1 - '@smithy/types@4.3.1': - dependencies: - tslib: 2.8.1 - '@smithy/url-parser@4.2.11': dependencies: '@smithy/querystring-parser': 4.2.11 @@ -17456,7 +17296,7 @@ snapshots: dependencies: '@typescript-eslint/typescript-estree': 8.29.0(typescript@5.8.2) '@typescript-eslint/utils': 8.29.0(eslint@9.23.0(jiti@2.4.2))(typescript@5.8.2) - debug: 4.4.3 + debug: 4.3.4 eslint: 9.23.0(jiti@2.4.2) ts-api-utils: 2.1.0(typescript@5.8.2) typescript: 5.8.2 @@ -17485,7 +17325,7 @@ snapshots: dependencies: '@typescript-eslint/types': 8.28.0 '@typescript-eslint/visitor-keys': 8.28.0 - debug: 4.4.3 + debug: 4.3.4 fast-glob: 3.3.3 is-glob: 4.0.3 minimatch: 9.0.5 @@ -17499,7 +17339,7 @@ snapshots: dependencies: '@typescript-eslint/types': 8.29.0 '@typescript-eslint/visitor-keys': 8.29.0 - debug: 4.4.3 + debug: 4.3.4 fast-glob: 3.3.3 is-glob: 4.0.3 minimatch: 9.0.5 @@ -17906,13 +17746,13 @@ snapshots: agent-base@6.0.2: dependencies: - debug: 4.4.3 + debug: 4.3.4 transitivePeerDependencies: - supports-color agent-base@7.1.0: dependencies: - debug: 4.4.3 + debug: 4.3.4 transitivePeerDependencies: - supports-color @@ -18245,11 +18085,11 @@ snapshots: autoprefixer@10.4.7(postcss@8.4.14): dependencies: - browserslist: 4.21.9 - caniuse-lite: 1.0.30001503 + browserslist: 4.24.4 + caniuse-lite: 1.0.30001707 fraction.js: 4.2.0 normalize-range: 0.1.2 - picocolors: 1.0.0 + picocolors: 1.1.1 postcss: 8.4.14 postcss-value-parser: 4.2.0 @@ -18384,13 +18224,6 @@ snapshots: dependencies: fill-range: 7.1.1 - browserslist@4.21.9: - dependencies: - caniuse-lite: 1.0.30001707 - electron-to-chromium: 1.4.482 - node-releases: 2.0.13 - update-browserslist-db: 1.0.11(browserslist@4.21.9) - browserslist@4.24.4: dependencies: caniuse-lite: 1.0.30001707 @@ -18473,8 +18306,6 @@ snapshots: camelcase@5.3.1: {} - caniuse-lite@1.0.30001503: {} - caniuse-lite@1.0.30001707: {} capital-case@1.0.4: @@ -18606,10 +18437,10 @@ snapshots: clean-publish@4.0.1: dependencies: - cross-spawn: 7.0.3 - fast-glob: 3.2.12 + cross-spawn: 7.0.6 + fast-glob: 3.3.3 lilconfig: 2.1.0 - micromatch: 4.0.5 + micromatch: 4.0.8 clean-stack@2.2.0: {} @@ -18799,12 +18630,6 @@ snapshots: dependencies: tslib: 2.8.1 - cross-spawn@7.0.3: - dependencies: - path-key: 3.1.1 - shebang-command: 2.0.0 - which: 2.0.2 - cross-spawn@7.0.6: dependencies: path-key: 3.1.1 @@ -19176,8 +19001,6 @@ snapshots: semver: 5.7.2 sigmund: 1.0.1 - electron-to-chromium@1.4.482: {} - electron-to-chromium@1.5.129: {} emoji-regex@10.4.0: {} @@ -19608,7 +19431,7 @@ snapshots: execa@4.1.0: dependencies: - cross-spawn: 7.0.3 + cross-spawn: 7.0.6 get-stream: 5.2.0 human-signals: 1.1.1 is-stream: 2.0.1 @@ -19690,14 +19513,6 @@ snapshots: fast-equals@5.2.2: {} - fast-glob@3.2.12: - dependencies: - '@nodelib/fs.stat': 2.0.5 - '@nodelib/fs.walk': 1.2.8 - glob-parent: 5.1.2 - merge2: 1.4.1 - micromatch: 4.0.8 - fast-glob@3.3.1: dependencies: '@nodelib/fs.stat': 2.0.5 @@ -19774,7 +19589,7 @@ snapshots: fetch-blob@3.2.0: dependencies: node-domexception: 1.0.0 - web-streams-polyfill: 3.2.1 + web-streams-polyfill: 3.3.3 figures@3.2.0: dependencies: @@ -20346,28 +20161,28 @@ snapshots: dependencies: '@tootallnate/once': 2.0.0 agent-base: 6.0.2 - debug: 4.4.3 + debug: 4.3.4 transitivePeerDependencies: - supports-color http-proxy-agent@7.0.2: dependencies: agent-base: 7.1.0 - debug: 4.4.3 + debug: 4.3.4 transitivePeerDependencies: - supports-color https-proxy-agent@5.0.1: dependencies: agent-base: 6.0.2 - debug: 4.4.3 + debug: 4.3.4 transitivePeerDependencies: - supports-color https-proxy-agent@7.0.4: dependencies: agent-base: 7.1.0 - debug: 4.4.3 + debug: 4.3.4 transitivePeerDependencies: - supports-color @@ -20393,8 +20208,6 @@ snapshots: ieee754@1.2.1: {} - ignore@5.2.4: {} - ignore@5.3.2: {} ignore@7.0.5: {} @@ -20709,7 +20522,7 @@ snapshots: istanbul-lib-source-maps@5.0.6: dependencies: '@jridgewell/trace-mapping': 0.3.31 - debug: 4.4.3 + debug: 4.3.4 istanbul-lib-coverage: 3.2.2 transitivePeerDependencies: - supports-color @@ -20948,7 +20761,7 @@ snapshots: dependencies: chalk: 5.4.1 commander: 13.1.0 - debug: 4.4.0 + debug: 4.4.3 execa: 8.0.1 lilconfig: 3.1.3 listr2: 8.2.5 @@ -21172,11 +20985,6 @@ snapshots: transitivePeerDependencies: - supports-color - micromatch@4.0.5: - dependencies: - braces: 3.0.3 - picomatch: 2.3.1 - micromatch@4.0.8: dependencies: braces: 3.0.3 @@ -21611,8 +21419,6 @@ snapshots: mute-stream@2.0.0: {} - nanoid@3.3.6: {} - nanoid@3.3.8: {} nanomatch@1.2.13: @@ -21773,8 +21579,6 @@ snapshots: optionalDependencies: '@types/node': 22.13.10 - node-releases@2.0.13: {} - node-releases@2.0.19: {} nodemailer@6.9.1: {} @@ -22108,8 +21912,6 @@ snapshots: dependencies: centra: 2.6.0 - picocolors@1.0.0: {} - picocolors@1.1.1: {} picomatch@2.3.1: {} @@ -22143,9 +21945,9 @@ snapshots: postcss@8.4.14: dependencies: - nanoid: 3.3.6 - picocolors: 1.0.0 - source-map-js: 1.0.2 + nanoid: 3.3.8 + picocolors: 1.1.1 + source-map-js: 1.2.1 postcss@8.4.31: dependencies: @@ -22194,7 +21996,7 @@ snapshots: chalk: 3.0.0 execa: 4.1.0 find-up: 4.1.0 - ignore: 5.2.4 + ignore: 5.3.2 mri: 1.2.0 multimatch: 4.0.0 prettier: 3.5.3 @@ -22668,7 +22470,7 @@ snapshots: dependencies: color: 4.2.3 detect-libc: 2.0.3 - semver: 7.7.3 + semver: 7.7.4 optionalDependencies: '@img/sharp-darwin-arm64': 0.33.5 '@img/sharp-darwin-x64': 0.33.5 @@ -22862,8 +22664,6 @@ snapshots: sort-object-keys: 1.1.3 tinyglobby: 0.2.12 - source-map-js@1.0.2: {} - source-map-js@1.2.1: {} source-map-resolve@0.5.3: @@ -23233,8 +23033,6 @@ snapshots: tslib@2.4.1: {} - tslib@2.5.3: {} - tslib@2.6.2: {} tslib@2.8.1: {} @@ -23407,12 +23205,6 @@ snapshots: has-value: 0.3.1 isobject: 3.0.1 - update-browserslist-db@1.0.11(browserslist@4.21.9): - dependencies: - browserslist: 4.21.9 - escalade: 3.2.0 - picocolors: 1.1.1 - update-browserslist-db@1.1.3(browserslist@4.24.4): dependencies: browserslist: 4.24.4 @@ -23618,8 +23410,6 @@ snapshots: transitivePeerDependencies: - encoding - web-streams-polyfill@3.2.1: {} - web-streams-polyfill@3.3.3: {} web-streams-polyfill@4.0.0-beta.3: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index fef950fba..751c609f1 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,8 +1,28 @@ blockExoticSubdeps: true -minimumReleaseAge: 1440 # 24h +# Requires versions to be older than 21 days +# Follows recommendations from https://snyk.io/articles/npm-security-best-practices-shai-hulud-attack/ +minimumReleaseAge: 30240 # in minutes +minimumReleaseAgeExclude: + - "@saleor/app-sdk" + - "@saleor/macaw-ui" + # Security fix for CVE-2026-33938 + - "handlebars@4.7.9" +# Requires installing versions only with provenance (published via CI, not npm token) +# Allows installing "downgraded" deps, if they are older than 30 days +# This happens if package releases a patch for older major version, +# that might be missing release workflow which was added in future versions trustPolicy: no-downgrade +trustPolicyIgnoreAfter: 43200 # 30 days (in minutes) + +mergeGitBranchLockfilesBranchPattern: + - main + +# We only allow pinned dependencies +saveExact: true +savePrefix: "" +cleanupUnusedCatalogs: true packages: - apps/* @@ -24,9 +44,6 @@ overrides: # handlebars-helpers uses old version, fixed in 4.7.9: CVE-2026-33938 handlebars: 4.7.9 -minimumReleaseAgeExclude: - - "@saleor/app-sdk" - catalog: "node-mocks-http": 1.16.1 "@opentelemetry/api": 1.9.0