chore(deps): bump the production-dependencies group across 1 directory with 22 updates by dependabot[bot] · Pull Request #97 · LAF-US/THE-GEMSTONE

dependabot · 2026-11-06T04:45:31Z

Bumps the production-dependencies group with 22 updates in the / directory:

Package	From	To
chokidar	`5.0.0`	`6.0.0`
esbuild-sass-plugin	`3.6.0`	`3.7.0`
hast-util-to-html	`9.0.5`	`9.0.6`
hast-util-to-jsx-runtime	`2.3.6`	`2.3.7`
js-yaml	`5.4.2`	`5.5.0`
mdast-util-find-and-replace	`3.0.2`	`3.0.4`
minimatch	`10.2.6`	`11.0.4`
pixi.js	`8.21.0`	`8.22.0`
preact	`10.29.8`	`11.1.1`
preact-render-to-string	`6.7.0`	`6.8.2`
pretty-bytes	`7.1.3`	`7.2.0`
satori	`0.19.1`	`0.63.2`
sharp	`0.35.4`	`0.35.5`
shiki	`4.4.3`	`4.6.0`
toml	`5.0.0`	`5.0.1`
unist-util-visit	`5.1.0`	`5.2.0`
ws	`8.21.3`	`8.22.1`
@types/ws	`8.18.1`	`8.18.2`
@types/node	`26.6.2`	`26.6.6`
@types/ws	`8.18.1`	`8.18.2`
esbuild	`0.27.2`	`0.27.7`
prettier	`3.8.1`	`3.9.10`
typescript	`5.9.3`	`7.0.2`

Updates chokidar from 5.0.0 to 6.0.0

Release notes

Sourced from chokidar's releases.

6.0.0

High-level changes

Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.

Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.

Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).

Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.

Required Node.js 22.22 or later.

API changes

Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.

usePolling: true remains as a deprecated alias for backend: 'polling'.

Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.

The old names remain as deprecated aliases; the new names win when both are given.

Changed the atomic default to false with polling. An explicit value is preserved.

Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.

Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.

Emitted errors from add() as error events instead of unhandled rejections (#1378).

Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.

Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).

Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).

Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).

Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).

Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).

Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).

Fixed false change events on Windows when many sibling files are written (#1466).

Fixed duplicate add events for unchanged files under directory activity (#1465).

Fixed replacing a watched directory with a file of the same name hanging the process (#1464).

Fixed persistent watching stopping after a watched directory was removed (#1463).

Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.

Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).

Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).

Fixed files not being detected when their directory did not exist before watching (#1422).

Fixed removed files being reported as unlinkDir instead of unlink (#1421).

Fixed ignored files and directories still being watched in WSL (#1418).

Fixed change being reported for every file when one file changed under Deno (#1417).

Fixed changes not being detected after the second save (#1399).

Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).

Fixed re-watching a path not honoring ignoreInitial (#1386).

Fixed EISDIR errors during the initial scan of network drives (#1376).

Fixed watching an array of absolute file paths (#1366).

Fixed unwatching a deleted watched directory on Windows, contributed by @sapphi-red in [pull request #1467](paulmillr/chokidar#1467).

Documented that unwatched paths stay ignored until they are added again (#1439).

Misc

... (truncated)

Changelog

Sourced from chokidar's changelog.

6.0.0 (2026-10-19)

High-level changes

Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.

Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.

Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).

Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.

Required Node.js 22.22 or later.

API changes

Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.

usePolling: true remains as a deprecated alias for backend: 'polling'.

Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.

The old names remain as deprecated aliases; the new names win when both are given.

Changed the atomic default to false with polling. An explicit value is preserved.

Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.

Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.

Emitted errors from add() as error events instead of unhandled rejections (#1378).

Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.

Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).

Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).

Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).

Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).

Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).

Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).

Fixed false change events on Windows when many sibling files are written (#1466).

Fixed duplicate add events for unchanged files under directory activity (#1465).

Fixed replacing a watched directory with a file of the same name hanging the process (#1464).

Fixed persistent watching stopping after a watched directory was removed (#1463).

Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.

Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).

Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).

Fixed files not being detected when their directory did not exist before watching (#1422).

Fixed removed files being reported as unlinkDir instead of unlink (#1421).

Fixed ignored files and directories still being watched in WSL (#1418).

Fixed change being reported for every file when one file changed under Deno (#1417).

Fixed changes not being detected after the second save (#1399).

Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).

Fixed re-watching a path not honoring ignoreInitial (#1386).

Fixed EISDIR errors during the initial scan of network drives (#1376).

Fixed watching an array of absolute file paths (#1366).

Fixed unwatching a deleted watched directory on Windows, contributed by @sapphi-red in [pull request #1467](paulmillr/chokidar#1467).

Documented that unwatched paths stay ignored until they are added again (#1439).

... (truncated)

Commits

4130839 Release 6.0.0.
53f3256 Bump devdeps
11ad48f More fixes
b6812dd Change date
706ef2c Merge pull request #1492 from paulmillr/jg/private-public
d85f4cc chore: expose tested members
97e1b93 Add changelog
8d5c07d More v6 fixes
7af52df Bump ci release.yml
a0b05d9 Merge pull request #1478 from paulmillr/jg/sponsors
Additional commits viewable in compare view

Updates esbuild-sass-plugin from 3.6.0 to 3.7.0

Release notes

Sourced from esbuild-sass-plugin's releases.

v3.7.0 Hasta la vista

Commits

See full diff in compare view

Updates hast-util-to-html from 9.0.5 to 9.0.6

Release notes

Sourced from hast-util-to-html's releases.

9.0.6

Fix

b2b5a3e Fix HTML in SVG for desc, foreignObject, title

233ac97 Fix p closing tag omission in custom elements

Full Changelog: syntax-tree/hast-util-to-html@9.0.5...9.0.6

Commits

9c68912 9.0.6
b2b5a3e Fix HTML in SVG for desc, foreignObject, title
233ac97 Fix p closing tag omission in custom elements
14078ed Fix link in jsdoc
8e56b54 Add prepack script
70e624f Fix typos
4272500 Update actions
c264eb1 Update dev-dependencies
See full diff in compare view

Updates hast-util-to-jsx-runtime from 2.3.6 to 2.3.7

Release notes

Sourced from hast-util-to-jsx-runtime's releases.

2.3.7

Fix

b29735c Fix casing of style properties, specially variables

Dependencies

5fc8d17 Update style-to-js

Full Changelog: syntax-tree/hast-util-to-jsx-runtime@2.3.6...2.3.7

Commits

0086256 2.3.7
b4c88ee Refactor .prettierignore
562b1b5 Update node in actions
47f49d4 Remove deno
b29735c Fix casing of style properties, specially variables
40ec5e6 Update preact in example
0494bb2 Update react in example
940871c Remove skipLibCheck from tsconfig.json
5fc8d17 Update style-to-js
60af4ad Update dev-dependencies
Additional commits viewable in compare view

Updates js-yaml from 5.4.2 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

Updated argparse to v3.

Updated development dependencies.

Fixed

Correct percent-encoding of shorthand and verbatim tags.

Reject ,, ], and } at the start of block plain scalars, #801.

Report the exact position of non-printable characters in errors, #801.

[5.4.3] - 2026-10-06

Fixed

Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

Commits

cb62b2d 5.5.0 released
87aed90 Deps bump
3aec511 Fix error positions for non-printable characters, #801
11aa483 Reject flow indicators at the start of block plain scalars, #801
339d8e0 Refactor tag encoder and decoder to match the YAML specification
7832624 5.4.3 released
0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
30108cc Parse the first block mapping key once (#800)
See full diff in compare view

Updates mdast-util-find-and-replace from 3.0.2 to 3.0.4

Release notes

Sourced from mdast-util-find-and-replace's releases.

3.0.4

2870b11 Refactor to improve performance

Full Changelog: syntax-tree/mdast-util-find-and-replace@3.0.3...3.0.4

3.0.3

d65a2ad Fix merging adjacent text nodes

Full Changelog: syntax-tree/mdast-util-find-and-replace@3.0.2...3.0.3

Commits

fad9bd5 3.0.4
bc5d2a9 Add test for text as a root` node
b435e6c Remove unneeded @ts-expect-error
312079b Fix wrong parameter description
9b622de Fix type in doc
dbe507a Remove no longer applicable doc comment
2870b11 Refactor to improve performance
6c4850c 3.0.3
a1fc3d3 Update output in readme.md
d65a2ad Fix merging adjacent text nodes
Additional commits viewable in compare view

Updates minimatch from 10.2.6 to 11.0.4

Changelog

Sourced from minimatch's changelog.

change log

11.0

Match each path portion with Matcher from @isaacs/nonrecursive-glob-match, in place of a RegExp. Items in Minimatch.set are now strings, Matcher objects, or GLOBSTAR.

Remove makeRe(), Minimatch#regexp, and the MMRegExp type.

Remove the AST class.

Remove the maxExtglobRecursion option.

An empty path portion, such as the last one in a/b/, only matches an empty pattern portion. So a/b/ no longer matches a/b/?(x) or a/b/*(x), the same as a/b/*.

Add the normalize option, to normalize unicode in the pattern and in each portion of the tested path.

Remove the debug option and the debug() method.

Remove the matchOne(), slashSplit(), and levelTwoFileOptimize() methods. They are internal now.

Fix patterns with more than one ** and sections of different lengths between them, such as **/a/b/c/**/d/**, which failed to match some paths since 10.2.3.

Fix partial matching of patterns with **, which since 10.2.3 matched some paths under a dot portion that ** can not walk, and did not match some paths that end in the pattern's last portion.

partial matching of patterns with many ** no longer takes exponential time.

On Windows, a .. no longer removes the drive letter, or the host and share of a UNC path, at the start of a pattern or (at optimization level 2) a path. So C:/a/../../x no longer matches x or /x.

On Windows, compare the host and share of UNC paths like //host/share/... case-insensitively, the same as drive letters.

On Windows, long UNC paths like //?/UNC/host/share/... match //host/share/... and vice versa, the same as //?/c:/... and c:/....

At optimization level 2, throw a RangeError if splitting **/.. portions would make more than braceExpandMax patterns, or add more than 1,000,000 path portions. Before, a short pattern could take minutes to compile.

At optimization level 2, dedupe patterns without comparing each pair, so that a large set is deduped in about linear time. Fix {**/x,x/y}, which was deduped to **/x, so x/y did not match.

Match a numeric brace range of 100 or more values, such as {0..999}, as one pattern portion, in place of one pattern for each value. For a glob walk, this is one directory read, in place of a stat for each value. hasMagic() is true for these

... (truncated)

Commits

f24eba9 11.0.4
a0b9404 drop support for node 18, wasn't installable anyway
b0c2aa8 11.0.3
293267a perf: cache matchers more aggressively by postponing creation
52d2aec cache 256 patterns
4380455 11.0.2
322feb1 update @isaacs/nonrecursive-glob-match
96cad78 ci: exclude windows from testing node 22 and 24
47afe88 11.0.1
77a0f5c limit **/.. optimization pass to avoid quadratic explosion
Additional commits viewable in compare view

Updates pixi.js from 8.21.0 to 8.22.0

Release notes

Sourced from pixi.js's releases.

v8.22.0

💾 Download

Installation:
npm install pixi.js@8.22.0
Development Build:

https://cdn.jsdelivr.net/npm/pixi.js@8.22.0/dist/pixi.js

https://cdn.jsdelivr.net/npm/pixi.js@8.22.0/dist/pixi.mjs

Production Build:

https://cdn.jsdelivr.net/npm/pixi.js@8.22.0/dist/pixi.min.js

https://cdn.jsdelivr.net/npm/pixi.js@8.22.0/dist/pixi.min.mjs

Documentation:

https://pixijs.download/v8.22.0/docs/index.html

Changed

pixijs/pixijs@v8.21.0...v8.22.0

🚨 Behavior Change
fix: tab cannot activate the accessibility layer on a fresh page by @synath in pixijs/pixijs#12220

Pressing Tab now activates the accessibility layer on a fresh page when activateOnTab is left at its default of true. This restores the documented default, which regressed in v8.14.0. To keep Tab from activating it:
await app.init({ accessibilityOptions: { activateOnTab: false } });
fix: apply accessibleText to button and recycled accessible elements by @synath in pixijs/pixijs#12221

accessibleText now applies to the default button type and to accessible elements recycled from the pool.
🎁 Added
feat: add a federated contextmenu event by @Zyie in pixijs/pixijs#12250

Containers now receive contextmenu and contextmenucapture events, also available as the oncontextmenu handler property. The event is a FederatedPointerEvent that PixiJS hit-tests and propagates like pointerdown, and eventFeatures.click gates it.
sprite.eventMode = 'static';
sprite.on('contextmenu', (event) =>
{
    event.preventDefault(); // keeps the browser menu closed
    openMenuAt(event.global);
});
feat: sRGB view formats and transient MSAA colour on WebGPU by @GoodBoyDigital in pixijs/pixijs#12225

New transient renderer option (WebGPU, with antialias) discards the canvas's multisample depth/stencil buffer at the end of each pass, and its color buffer too on GPUs that aren't tile-based.
await app.init({ preference: 'webgpu', antialias: true, transient: true });
feat: 3D textures, storage textures and 3D mipmaps by @GoodBoyDigital in pixijs/pixijs#12248

feat: partial uploads for BufferImageSource via update(start, end) by @GoodBoyDigital in pixijs/pixijs#12227

... (truncated)

Commits

5b41ee3 v8.22.0
9dc976d fix: skip the unread-attribute warning when the attribute has a format (#12267)
1289ab7 docs: correct TilingSprite texture, width and height defaults (#12269)
b96fb4e fix: nested filters crash after renderer resize (#12257)
082128a fix: blend filter backdrop when every parent filter is skipped (#12263)
f3d96db feat: add a federated contextmenu event (#12250)
8dbbeb9 feat: 3D textures, storage textures and 3D mipmaps (#12248)
ef0c0a7 feat: sRGB view formats and transient MSAA colour on WebGPU (#12225)
27071aa fix: integer texture formats on WebGL and WebGPU (#12230)
0f8983f fix: declare accessibilityOptions on the public renderer options (#12222)
Additional commits viewable in compare view

Updates preact from 10.29.8 to 11.1.1

Commits

cad3d26 Merge pull request #5340 from preactjs/release/11.1.1
bdf1a5f 11.1.1
4e5c63c Merge pull request #5339 from preactjs/fix/template-namespace-content
9ecf719 Fix template in alternative namespaces
2788c12 Merge pull request #5338 from b84330808/fix/template-shadowroot-types
9069f5a test: remove the type tests again
4ab827e test: drop the template shadow root type tests
3151183 Drop the type tests, per review
39d2920 fix(types): add declarative shadow DOM attributes to <template>
66b6e56 Merge pull request #5336 from preactjs/release/11.1.0
Additional commits viewable in compare view

Updates preact-render-to-string from 6.7.0 to 6.8.2

Release notes

Sourced from preact-render-to-string's releases.

v6.8.2

Patch Changes

#485 2dd9a3a Thanks @JoviDeCroock! - Fix renderToStringAsync stringifying suspended children inside precompiled JSX templates

#489 7be3108 Thanks @JoviDeCroock! - Use Preact's VNode recognition across renderers.

v6.8.1

Patch Changes

#482 a4b9e49 Thanks @JoviDeCroock! - Encode attribute values after string coercion so arrays and objects are serialized consistently with string attributes.

Changelog

Sourced from preact-render-to-string's changelog.

6.8.2

Patch Changes

#485 2dd9a3a Thanks @JoviDeCroock! - Fix renderToStringAsync stringifying suspended children inside precompiled JSX templates

#489 7be3108 Thanks @JoviDeCroock! - Use Preact's VNode recognition across renderers.

6.8.1

Patch Changes

#482 a4b9e49 Thanks @JoviDeCroock! - Encode attribute values after string coercion so arrays and objects are serialized consistently with string attributes.

6.8.0

Minor Changes

#472 2dff53d Thanks @jacob-ebey! - Replaces the second context argument in our streaming functions with an options object, the context moves to the third position.

Streaming is considered alpha so we're making this breaking change deliberately as part of a minor.

Patch Changes

#464 455daf5 Thanks @JoviDeCroock! - Call options._root before the render-to-string invocation

#475 4e92059 Thanks @JoviDeCroock! - Use Node's Writable type for renderToPipeableStream destinations.

#444 e5ff19f Thanks @dsherret! - fix: use cjs types instead of esm for jsx export to fix default export from esm

#477 4b80672 Thanks @JoviDeCroock! - Preserve client-rendered content when delayed streaming chunks arrive after hydration.

#471 0ce2b84 Thanks @JoviDeCroock! - Keep Preact option hooks isolated for the lifetime of asynchronous renders.

#476 5b1d509 Thanks @JoviDeCroock! - Replace streamed Suspense fallbacks when the resolved content is empty.

Commits

dc7d06b Merge pull request #486 from preactjs/changeset-release/main
a927b46 Version Packages
6d233e7 Merge pull request #489 from preactjs/harden-vnode-recognition
7be3108 Harden vnode recognition
1647315 Merge pull request #485 from preactjs/test/async-template-suspense
2dd9a3a fix: resolve suspended children in precompiled templates
0519dc8 Merge pull request #483 from preactjs/changeset-release/main
7277e10 Version Packages
75291f2 Merge pull request #482 from preactjs/fix/escape-coerced-attribute-values
a4b9e49 fix: encode attribute values after string coercion
Additional commits viewable in compare view

Updates pretty-bytes from 7.1.3 to 7.2.0

Release notes

Sourced from pretty-bytes's releases.

v7.2.0

Fix formatting edge cases and validate options 4e800a3

sindresorhus/pretty-bytes@v7.1.3...v7.2.0

Commits

a35ed21 7.2.0
4e800a3 Fix formatting edge cases and validate options
1d517bb Meta tweaks
See full diff in compare view

Updates satori from 0.19.1 to 0.63.2

Release notes

Sourced from satori's releases.

0.63.2

0.63.2 (2026-10-20)

Bug Fixes

Report invalid sizes, insets and margins like other invalid values (#950) (074f0b3)

0.63.1

0.63.1 (2026-10-20)

Bug Fixes

Honor emoji and text presentation selectors (#948) (e1aa7be), closes #533 #665 #533

0.63.0

0.63.0 (2026-10-19)

Bug Fixes

Render variable fonts as their default instance (#946) (b9e5af5)

Features

Render selects and their options like Chrome (#947) (c66082d)

0.62.0

0.62.0 (2026-10-16)

Bug Fixes

Don't make lines of white space between blocks (#945) (7e8efab)

Hide closed dialogs, and draw open ones like browsers (#944) (5ae3a69)

Size SVGs without width and height like browsers (#942) (f725edd), closes #940 #939

Support -webkit-flex and -webkit-inline-flex (#941) (b7e86d9)

Features

Render the labels of button inputs (#943) (b46e5ad)

0.61.0

0.61.0 (2026-10-16)

Bug Fixes

... (truncated)

Commits

074f0b3 fix: Report invalid sizes, insets and margins like other invalid values (#950)
e1aa7be fix: Honor emoji and text presentation selectors (#948)
5a9e32a docs(playground): Use the srcset sources browsers would use in screenshots (#...
c66082d feat: Render selects and their options like Chrome (#947)
b9e5af5 fix: Render variable fonts as their default instance (#946)
f725edd fix: Size SVGs without width and height like browsers (#942)
7e8efab fix: Don't make lines of white space between blocks (#945)
5ae3a69 fix: Hide closed dialogs, and draw open ones like browsers (#944)
b46e5ad feat: Render the labels of button inputs (#943)
b7e86d9 fix: Support -webkit-flex and -webkit-inline-flex (#941)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for satori since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

Add upper bounds check on length of linear and GIF delay arrays.

Improve error handing when WebAssembly fallback also fails. #4593 @lazerg

TypeScript: Allow multi-frame options for JXL output. #4602 @ramin-010

TypeScript: Remove non-existent named export. #4604

Increase accepted dimensions when extending an image. #4605

Improve gain map support for extract and rotate operations. #4606

Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

Add upper bounds check on length of linear and GIF delay arrays.

Improve error handing when WebAssembly fallback also fails. #4593 @lazerg

TypeScript: Allow multi-frame options for JXL output. #4602 @ramin-010

TypeScript: Remove non-existent named export. #4604

Increase accepted dimensions when extending an image. #4605

Improve gain map support for extract operation. #4606

... (truncated)

Commits

51a990f Release v0.35.5
96de105 Upgrade to sharp-libvips v1.3.4
3a61390 CI: Configure Dependabot with all package.json locations
4940c50 Improve gain map support for rotate/flip/flop ops
20654aa Prerelease...
Description has been truncated

Summary by cubic

Bumps the production-dependencies group, updating 22 packages to their latest versions. Most are patch and minor releases; this also includes several major-version upgrades with potential breaking changes.

Migration
- chokidar 6.0.0 requires Node.js 22.22+ and rewrites the watch pipeline; usePolling, interval, and binaryInterval remain as deprecated aliases.
- minimatch 11.0.0 removes makeRe(), the AST class, and the debug option.
- preact 11 and typescript 7.0.2 are major-version upgrades that may require code adjustments.
^{Written for commit dc262d1. Summary will update on new commits.}

…y with 22 updates Bumps the production-dependencies group with 22 updates in the / directory: | Package | From | To | | --- | --- | --- | | [chokidar](https://github.com/paulmillr/chokidar) | `5.0.0` | `6.0.0` | | [esbuild-sass-plugin](https://github.com/glromeo/esbuild-sass-plugin) | `3.6.0` | `3.7.0` | | [hast-util-to-html](https://github.com/syntax-tree/hast-util-to-html) | `9.0.5` | `9.0.6` | | [hast-util-to-jsx-runtime](https://github.com/syntax-tree/hast-util-to-jsx-runtime) | `2.3.6` | `2.3.7` | | [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.2` | `5.5.0` | | [mdast-util-find-and-replace](https://github.com/syntax-tree/mdast-util-find-and-replace) | `3.0.2` | `3.0.4` | | [minimatch](https://github.com/isaacs/minimatch) | `10.2.6` | `11.0.4` | | [pixi.js](https://github.com/pixijs/pixijs) | `8.21.0` | `8.22.0` | | [preact](https://github.com/preactjs/preact) | `10.29.8` | `11.1.1` | | [preact-render-to-string](https://github.com/preactjs/preact-render-to-string) | `6.7.0` | `6.8.2` | | [pretty-bytes](https://github.com/sindresorhus/pretty-bytes) | `7.1.3` | `7.2.0` | | [satori](https://github.com/vercel/satori) | `0.19.1` | `0.63.2` | | [sharp](https://github.com/lovell/sharp) | `0.35.4` | `0.35.5` | | [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `4.4.3` | `4.6.0` | | [toml](https://github.com/BinaryMuse/toml-node) | `5.0.0` | `5.0.1` | | [unist-util-visit](https://github.com/syntax-tree/unist-util-visit) | `5.1.0` | `5.2.0` | | [ws](https://github.com/websockets/ws) | `8.21.3` | `8.22.1` | | [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.6` | | [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` | | [esbuild](https://github.com/evanw/esbuild) | `0.27.2` | `0.27.7` | | [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.9.10` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` | Updates `chokidar` from 5.0.0 to 6.0.0 - [Release notes](https://github.com/paulmillr/chokidar/releases) - [Changelog](https://github.com/paulmillr/chokidar/blob/main/CHANGELOG.md) - [Commits](paulmillr/chokidar@5.0.0...6.0.0) Updates `esbuild-sass-plugin` from 3.6.0 to 3.7.0 - [Release notes](https://github.com/glromeo/esbuild-sass-plugin/releases) - [Commits](https://github.com/glromeo/esbuild-sass-plugin/commits/v3.7.0) Updates `hast-util-to-html` from 9.0.5 to 9.0.6 - [Release notes](https://github.com/syntax-tree/hast-util-to-html/releases) - [Commits](syntax-tree/hast-util-to-html@9.0.5...9.0.6) Updates `hast-util-to-jsx-runtime` from 2.3.6 to 2.3.7 - [Release notes](https://github.com/syntax-tree/hast-util-to-jsx-runtime/releases) - [Commits](syntax-tree/hast-util-to-jsx-runtime@2.3.6...2.3.7) Updates `js-yaml` from 5.4.2 to 5.5.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.4.2...5.5.0) Updates `mdast-util-find-and-replace` from 3.0.2 to 3.0.4 - [Release notes](https://github.com/syntax-tree/mdast-util-find-and-replace/releases) - [Commits](syntax-tree/mdast-util-find-and-replace@3.0.2...3.0.4) Updates `minimatch` from 10.2.6 to 11.0.4 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v10.2.6...v11.0.4) Updates `pixi.js` from 8.21.0 to 8.22.0 - [Release notes](https://github.com/pixijs/pixijs/releases) - [Commits](pixijs/pixijs@v8.21.0...v8.22.0) Updates `preact` from 10.29.8 to 11.1.1 - [Commits](preactjs/preact@10.29.8...11.1.1) Updates `preact-render-to-string` from 6.7.0 to 6.8.2 - [Release notes](https://github.com/preactjs/preact-render-to-string/releases) - [Changelog](https://github.com/preactjs/preact-render-to-string/blob/main/CHANGELOG.md) - [Commits](preactjs/preact-render-to-string@v6.7.0...v6.8.2) Updates `pretty-bytes` from 7.1.3 to 7.2.0 - [Release notes](https://github.com/sindresorhus/pretty-bytes/releases) - [Commits](sindresorhus/pretty-bytes@v7.1.3...v7.2.0) Updates `satori` from 0.19.1 to 0.63.2 - [Release notes](https://github.com/vercel/satori/releases) - [Commits](vercel/satori@0.19.1...0.63.2) Updates `sharp` from 0.35.4 to 0.35.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.4...v0.35.5) Updates `shiki` from 4.4.3 to 4.6.0 - [Release notes](https://github.com/shikijs/shiki/releases) - [Commits](https://github.com/shikijs/shiki/commits/v4.6.0/packages/shiki) Updates `toml` from 5.0.0 to 5.0.1 - [Changelog](https://github.com/BinaryMuse/toml-node/blob/main/CHANGELOG.md) - [Commits](BinaryMuse/toml-node@v5.0.0...v5.0.1) Updates `unist-util-visit` from 5.1.0 to 5.2.0 - [Release notes](https://github.com/syntax-tree/unist-util-visit/releases) - [Commits](syntax-tree/unist-util-visit@5.1.0...5.2.0) Updates `ws` from 8.21.3 to 8.22.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.21.3...8.22.1) Updates `@types/ws` from 8.18.1 to 8.18.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws) Updates `@types/node` from 26.6.2 to 26.6.6 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/ws` from 8.18.1 to 8.18.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws) Updates `esbuild` from 0.27.2 to 0.27.7 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md) - [Commits](evanw/esbuild@v0.27.2...v0.27.7) Updates `prettier` from 3.8.1 to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.1...3.9.10) Updates `typescript` from 5.9.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v7.0.2) --- updated-dependencies: - dependency-name: chokidar dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: esbuild-sass-plugin dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: hast-util-to-html dependency-version: 9.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: hast-util-to-jsx-runtime dependency-version: 2.3.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: js-yaml dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: mdast-util-find-and-replace dependency-version: 3.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: minimatch dependency-version: 11.0.4 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: pixi.js dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: preact dependency-version: 11.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: preact-render-to-string dependency-version: 6.8.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: pretty-bytes dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: satori dependency-version: 0.63.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: sharp dependency-version: 0.35.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: shiki dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: toml dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: unist-util-visit dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: ws dependency-version: 8.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@types/ws" dependency-version: 8.18.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@types/node" dependency-version: 26.6.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@types/ws" dependency-version: 8.18.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: esbuild dependency-version: 0.27.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

gitnotebooks · 2026-11-06T04:45:41Z

Review these changes at https://app.gitnotebooks.com/LAF-US/THE-GEMSTONE/pull/97

code-genius-code-coverage · 2026-11-06T04:45:41Z

The files' contents are under analysis for test generation.

codereviewbot-ai · 2026-11-06T04:45:42Z

🤖 Review skipped: reviews for bot-created pull requests are not allowed on free accounts. Upgrade to a paid plan to enable bot reviews.

semanticdiff-com · 2026-11-06T04:45:42Z

Review changes with

Changed Files

File	Status
package-lock.json	37% smaller
package.json	0% smaller

gitginie

@dependabot[bot]
Thank you for your contribution to this repository! We appreciate your effort in opening pull request.
Happy coding!

codesherlock-ai · 2026-11-06T04:45:44Z

We could not run your PR Review. We noticed that you are part of an Org. We require everyone who is part of an Org to SignUp via GitHub so we can track your individual usage and maximize on your usage capacity. Enroll into CodeSherlock system by signing up via GitHub using the SignUp link. Also, please note — every user pays for their own usage.

codeant-ai · 2026-11-06T04:45:45Z

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

coderabbitai · 2026-11-06T04:45:46Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 97f906bb-382f-417e-9eac-e50ba86df5da

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

precogs-ai · 2026-11-06T04:45:48Z

✅ Precogs scan complete — No security issues found

_{Commit dc262d1 on dependabot/npm_and_yarn/production-dependencies-538ba69f03 · 2 files scanned}

🔴 Critical	🟠 High	🔵 Medium	🟢 Low	🎯 Risk Score
0	0	0	0	0.0

✅ All clear. We scanned for SQL injection, XSS, hardcoded secrets, vulnerable dependencies, IaC misconfigurations, and PII exposure. No security vulnerabilities were detected in this PR.

✅ Passed checks (3)

Check	Status	Details
Code scan (SAST)	✅ Passed	No vulnerabilities detected
Secrets scan	✅ Passed	No hardcoded credentials found
Dependency audit	✅ Passed	No known CVEs

_{💬 @precogs-ai help for commands · 🔗 View report}

_{Precogs.ai · Detect. Fix. Merge.}

zaxion-governance · 2026-11-06T04:45:48Z

🛡️ Zaxion Policy Status: 🟡 WARN

Gateway Warning

📋 View Full Governance Report

Status: 🟡 WARN
Risk Analysis: 🟢 Safe
Changes: 2 files

Visit the Full Report for detailed metrics, findings, and interactive remediation.

coderifts · 2026-11-06T04:45:49Z

🔍 CodeRifts / issuer

No OpenAPI schemas found in this repository.

This App's check is CodeRifts / issuer; the contract-gate Action's is CodeRifts / contract-gate. A protected branch requires both. A required check still pinned to the old name CodeRifts — API Contract Check is posted by neither, so it waits until you re-pin it.

While no schema is found, this check completes neutral, which GitHub treats as non-blocking — so if CodeRifts is a required status check, it is not currently blocking anything on this branch.

To get started, either:

Name your OpenAPI schema file openapi.yaml (or openapi.json, swagger.yaml, etc.)
Or add a .coderifts.yml to specify the path:

schema:
  - path/to/your/openapi.yaml

📖 Documentation · 💬 Get help

☁️ You're on the Free plan. Everything is included during the public beta, at no cost and with nothing to upgrade.

inspect-review

inspect review

Triage: 2 entities analyzed | 0 critical, 0 high, 2 medium, 0 low
Verdict: standard_review

Findings (0)

Reviewed by inspect | Entity-level triage found 0 high-risk changes

secuarden-ai · 2026-11-06T04:45:50Z

Invalid command format

To invoke the bot, use:

@secuarden-ai /command [arguments]

Available commands:

@secuarden-ai /fix SEC_ID - Generate a fix for a finding
@secuarden-ai /explain - Explain why this finding matters
@secuarden-ai /ignore SEC_ID [reason] - Suppress a finding
@secuarden-ai /rerun - Re-scan this PR
@secuarden-ai /review - Submit per-finding reassessment feedback (see review format below)

seoguard · 2026-11-06T04:45:50Z

✅ SEO Review - no issues introduced by this PR

This PR introduces no SEO issues. 20 pre-existing issues on main are folded below for reference - not caused by this PR.

📋 20 pre-existing issues on `main` - not from this PR (🔴 5 · 🟡 7 · 🔵 8)

🔴 Critical (5)

File	Issue	Fix
`quartz/components/Head.tsx`	Missing <h1> tag _{Every page must have exactly one <h1> tag. It signals the primary topic of the page to search engines.}	Add exactly one <h1>Your Primary Topic</h1> tag to the page
`quartz/components/renderPage.tsx`	Missing <title> tag _{Every page must have a unique <title> tag. This is the primary signal search engines use to understand page topic and d…}	Add <title>Your Page Title (50-60 chars)</title> inside <head>
`quartz/components/renderPage.tsx`	Missing meta description _{Meta descriptions are used as SERP snippets. Without one, Google auto-generates one from page content, which is typical…}	Add <meta name="description" content="Your description here (150-160 chars)" /> inside <head>
`quartz/components/renderPage.tsx`	Missing <h1> tag _{Every page must have exactly one <h1> tag. It signals the primary topic of the page to search engines.}	Add exactly one <h1>Your Primary Topic</h1> tag to the page
`quartz/components/renderPage.tsx`	Missing viewport meta tag _{Without a viewport meta tag, mobile browsers render the page at desktop width, causing poor mobile UX and hurting mobil…}	Add <meta name="viewport" content="width=device-width, initial-scale=1" /> inside <head>

🟡 Warnings (7)

File	Issue	Fix
`quartz/components/Head.tsx`	Missing canonical tag _{Without a canonical tag, search engines may index duplicate versions of your page (e.g., with/without trailing slash, w…}	Add <link rel="canonical" href="https://yourdomain.com/this-page" /> inside <head>. Use absolute URLs. For JavaScript pages, ensure this matches the canonical in the pre-rendered HTML.
`quartz/components/renderPage.tsx`	Missing og:title _{Open Graph title is required for proper social sharing previews on Facebook, LinkedIn, Slack, and others.}	Add <meta property="og:title" content="Your Page Title" /> inside <head>
`quartz/components/renderPage.tsx`	Missing og:description _{Open Graph description is displayed when pages are shared on social platforms.}	Add <meta property="og:description" content="Your description" /> inside <head>
`quartz/components/renderPage.tsx`	Missing og:image _{Social shares without og:image show no image, severely reducing engagement. Image should be at least 1200x630px. Google…}	Add <meta property="og:image" content="https://yourdomain.com/og-image.jpg" /> inside <head>. Recommended size: 1200x630px.
`quartz/components/renderPage.tsx`	Missing twitter:card _{Without twitter:card, X (Twitter) will not show a rich preview when your page is shared.}	Add <meta name="twitter:card" content="summary_large_image" /> inside <head>
`quartz/components/renderPage.tsx`	Missing charset declaration _{Without a charset declaration, browsers may misinterpret the page encoding, causing garbled text.}	Add <meta charset="UTF-8" /> as the first tag inside <head>
`quartz/components/renderPage.tsx`	Missing canonical tag _{Without a canonical tag, search engines may index duplicate versions of your page (e.g., with/without trailing slash, w…}	Add <link rel="canonical" href="https://yourdomain.com/this-page" /> inside <head>. Use absolute URLs. For JavaScript pages, ensure this matches the canonical in the pre-rendered HTML.

🔵 Info (8)

File	Issue	Fix
`quartz/components/Footer.tsx` (line 18)	External link missing rel="noopener" _{External links without rel="noopener noreferrer" expose users to tab-napping attacks and leak referrer information. Lin…}	Add rel="noopener noreferrer" to <a href="https://quartz.jzhao.xyz/">
`quartz/components/Head.tsx`	No structured data (JSON-LD) found _{Structured data helps search engines understand your content and can unlock rich results (star ratings, breadcrumbs, et…}	Add a JSON-LD script block: <script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","name":"Page Title"}</script>
`quartz/components/renderPage.tsx`	Missing og:url _{og:url sets the canonical URL for social sharing, preventing duplicate content issues on social platforms.}	Add <meta property="og:url" content="https://yourdomain.com/page" /> inside <head>
`quartz/components/renderPage.tsx`	Missing og:type _{og:type tells social platforms what kind of content this is (website, article, product, etc.).}	Add <meta property="og:type" content="website" /> inside <head>. Use 'article' for blog posts.
`quartz/components/renderPage.tsx`	Missing twitter:title _{twitter:title overrides og:title specifically for X (Twitter) cards.}	Add <meta name="twitter:title" content="Your Title" /> inside <head>
`quartz/components/renderPage.tsx`	Missing twitter:image _{twitter:image is shown in X (Twitter) card previews. Recommended minimum 1200x628px.}	Add <meta name="twitter:image" content="https://yourdomain.com/twitter-image.jpg" /> inside <head>
`quartz/components/renderPage.tsx`	Missing favicon _{A favicon improves brand recognition in browser tabs and bookmarks. Google displays favicons in SERPs. Google requires …}	Add <link rel="icon" href="/favicon.ico" type="image/x-icon" /> inside <head>. Ensure the favicon has a 1:1 aspect ratio and is at least 48x48px. Confirm Googlebot can crawl both the favicon file (via Googlebot-Image) and your home page (via Googlebot).
`quartz/components/renderPage.tsx`	No structured data (JSON-LD) found _{Structured data helps search engines understand your content and can unlock rich results (star ratings, breadcrumbs, et…}	Add a JSON-LD script block: <script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","name":"Page Title"}</script>

✅ 915 checks passed

image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
missing-title
title-too-long
title-too-short
missing-meta-description
meta-description-too-long
meta-description-too-short
missing-og-title
missing-og-description
missing-og-image
missing-og-url
missing-og-type
missing-og-locale
missing-twitter-card
missing-twitter-title
missing-twitter-image
multiple-h1
heading-hierarchy
empty-heading
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
missing-viewport
missing-charset
accidental-noindex
missing-favicon
invalid-json-ld
missing-preload-lcp
faq-schema-deprecated
back-button-hijacking
robots-meta-outside-head
noindex-in-javascript
canonical-javascript-best-practice
favicon-aspect-ratio
inp-core-web-vital
image-preferred-source-metadata
breadcrumbs-desktop-only
video-transparency
structured-data-javascript-initial-html
mobile-version-links
review-snippet-requires-comment
practice-problem-schema-deprecated
special-announcement-schema-deprecated
missing-hreflang
json-ld-recommended-format
read-more-deeplink
javascript-non-200-rendering
javascript-paywall-detection
hreflang-no-combined-attributes
review-no-multiple-reviewed-entities
merchant-shipping-policy-schema
video-indexing-criteria
avif-image-format-supported
c2pa-metadata
ai-mode-search-console
loyalty-program-schema
merchant-return-policy-schema
product-structured-data-single-product
url-parameters-best-practice
safe-search-explicit-tagging
organization-markup
site-name-schema
preferred-sources-feature
event-structured-data-requirements
dataset-schema-phased-out
generative-ai-optimization
spam-policies-apply-to-ai-responses
follow-feature-removed
sitelinks-searchbox-removed
googlebot-file-size-limits
recipe-thumbnail-property
core-updates-continuous
south-africa-carousel-structured-data
llms-txt-not-required
ai-features-snippet-eligibility
agent-friendly-website
speakable-schema-deprecated
schema-org-shipping-vocabulary-updated
faq-rich-result-documentation-removed
html-standard-for-seo
oai-searchbot-crawl-eligibility
markdown-content-no-seo-advantage
google-video-schema-creator-property
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
canonical-relative-url
canonical-multiple
robots-meta-conflicting-directives
image-missing-dimensions
iframe-missing-title
mixed-content-http-resources
hreflang-x-default-missing
article-dates-missing
article-author-missing
og-image-alt-missing
twitter-description-missing
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
title-too-long
title-too-short
meta-description-too-long
meta-description-too-short
missing-og-locale
multiple-h1
heading-hierarchy
empty-heading
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
accidental-noindex
invalid-json-ld
missing-preload-lcp
faq-schema-deprecated
back-button-hijacking
robots-meta-outside-head
noindex-in-javascript
canonical-javascript-best-practice
favicon-aspect-ratio
inp-core-web-vital
image-preferred-source-metadata
breadcrumbs-desktop-only
video-transparency
structured-data-javascript-initial-html
mobile-version-links
review-snippet-requires-comment
practice-problem-schema-deprecated
special-announcement-schema-deprecated
missing-hreflang
json-ld-recommended-format
read-more-deeplink
javascript-non-200-rendering
javascript-paywall-detection
hreflang-no-combined-attributes
review-no-multiple-reviewed-entities
merchant-shipping-policy-schema
video-indexing-criteria
avif-image-format-supported
c2pa-metadata
ai-mode-search-console
loyalty-program-schema
merchant-return-policy-schema
product-structured-data-single-product
url-parameters-best-practice
safe-search-explicit-tagging
organization-markup
site-name-schema
preferred-sources-feature
event-structured-data-requirements
dataset-schema-phased-out
generative-ai-optimization
spam-policies-apply-to-ai-responses
follow-feature-removed
sitelinks-searchbox-removed
googlebot-file-size-limits
recipe-thumbnail-property
core-updates-continuous
south-africa-carousel-structured-data
llms-txt-not-required
ai-features-snippet-eligibility
agent-friendly-website
speakable-schema-deprecated
schema-org-shipping-vocabulary-updated
faq-rich-result-documentation-removed
html-standard-for-seo
oai-searchbot-crawl-eligibility
markdown-content-no-seo-advantage
google-video-schema-creator-property
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
canonical-relative-url
canonical-multiple
robots-meta-conflicting-directives
image-missing-dimensions
iframe-missing-title
mixed-content-http-resources
hreflang-x-default-missing
article-dates-missing
article-author-missing
og-image-alt-missing
twitter-description-missing
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions

SEOCode · Docs & troubleshooting

ℹ️ SEOCode reviewed 40 of 51 files in this repository. For full coverage of larger repositories, contact support@seocode.io.

qwed-security · 2026-11-06T04:45:52Z

QWED Security Verification Report

Engines

dependency_scan: ✅
entropy_scan: ✅
lockfile_scan: ✅
pattern_scan: ✅
secret_scan: ✅

Verified Files

package-lock.json
package.json

Verified by QWED — deterministic security verification. No LLM used.

Verification Context v1.0

{
  "spec_version": "1.0",
  "object": {
    "formal_statement": "LAF-US/THE-GEMSTONE@dc262d10 (PR #97) is safe to merge"
  },
  "context": {
    "interpretation": {
      "theory": "deterministic security verification",
      "logic": "evidence-context-policy pipeline"
    },
    "proof": {
      "verifier": "QWED Security",
      "verifier_version": "qwed-security-ruleset/14",
      "configuration": {
        "repo": "LAF-US/THE-GEMSTONE",
        "head_sha": "dc262d108f000bb3ca6c6e7881db6a379730d477",
        "files_scanned": 2
      },
      "theory_scope": "PR security scan against QWED deterministic rule set",
      "trusted_dependencies": [
        "qwed-security"
      ],
      "outcome_treatment": "unknown/timeout/error resolve to UNVERIFIABLE or BLOCKED"
    },
    "evidence": {
      "evidence": {
        "status": "VERIFIED",
        "agent_message": "VERIFIED against the QWED deterministic rule set: no security boundary violations detected in the scanned files. This attests to the absence of known-pattern violations for this rule set and commit \u2014 it is not a guarantee that the code is free of all vulnerabilities.",
        "developer_fields": {
          "total_findings": 0,
          "advisory_checks": []
        },
        "is_authoritative": true,
        "proof_ref": "sha256:21166abbfd6b8e5f1b73202b64286665135b27467c0a5f1e6e5a7cef2707b2b0",
        "scan_evidence": {
          "repo": "LAF-US/THE-GEMSTONE",
          "head_sha": "dc262d108f000bb3ca6c6e7881db6a379730d477",
          "pr_number": 97,
          "files_scanned": 2,
          "engine_results": 5,
          "conclusion": "success",
          "rule_set": "qwed-security-ruleset/14",
          "engines": [
            "dependency_scan",
            "entropy_scan",
            "lockfile_scan",
            "pattern_scan",
            "secret_scan"
          ]
        },
        "repo": "LAF-US/THE-GEMSTONE",
        "head_sha": "dc262d108f000bb3ca6c6e7881db6a379730d477",
        "files_scanned": 2
      },
      "proof_ref": "sha256:1cb851c8095b060577d0dd5199bd2b3a73e90cd08bda6a87572bbe7ceb772710"
    },
    "decision": {
      "admission": "ADMIT"
    }
  },
  "verdict": "VERIFIED"
}

Attestation (signed, binds the Verification Context above)

{
  "envelope": "qwed-security-attestation/1",
  "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjU2NWFkMDg2NGY3NWJkYmIiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiIyNzU5NTA0IiwiYXVkIjoicXdlZC1hdHRlc3RhdGlvbiIsImlhdCI6MTc5Mzk0MDM0OSwiZXhwIjoxNzkzOTQwNjQ5LCJxd2VkIjp7InJlc3VsdCI6eyJzdGF0dXMiOiJWRVJJRklFRCIsImFnZW50X21lc3NhZ2UiOiJWRVJJRklFRCBhZ2FpbnN0IHRoZSBRV0VEIGRldGVybWluaXN0aWMgcnVsZSBzZXQ6IG5vIHNlY3VyaXR5IGJvdW5kYXJ5IHZpb2xhdGlvbnMgZGV0ZWN0ZWQgaW4gdGhlIHNjYW5uZWQgZmlsZXMuIFRoaXMgYXR0ZXN0cyB0byB0aGUgYWJzZW5jZSBvZiBrbm93bi1wYXR0ZXJuIHZpb2xhdGlvbnMgZm9yIHRoaXMgcnVsZSBzZXQgYW5kIGNvbW1pdCBcdTIwMTQgaXQgaXMgbm90IGEgZ3VhcmFudGVlIHRoYXQgdGhlIGNvZGUgaXMgZnJlZSBvZiBhbGwgdnVsbmVyYWJpbGl0aWVzLiIsImlzX2F1dGhvcml0YXRpdmUiOnRydWV9LCJwcm9vZl9oYXNoIjoic2hhMjU2OjIxMTY2YWJiZmQ2YjhlNWYxYjczMjAyYjY0Mjg2NjY1MTM1YjI3NDY3YzBhNWYxZTZlNWE3Y2VmMjcwN2IyYjAiLCJib3VuZGFyeSI6bnVsbCwiZW52ZWxvcGUiOiJxd2VkLXNlY3VyaXR5LWF0dGVzdGF0aW9uLzEiLCJqdGkiOiIwZGIxM2VhZmVmNzg2MjYxNjljNjk5N2RhOGYyMmE5ZiIsInZlcmlmaWNhdGlvbl9jb250ZXh0Ijp7InNwZWNfdmVyc2lvbiI6IjEuMCIsImZvcm1hbF9zdGF0ZW1lbnQiOiJMQUYtVVMvVEhFLUdFTVNUT05FQGRjMjYyZDEwIChQUiAjOTcpIGlzIHNhZmUgdG8gbWVyZ2UiLCJ2ZXJkaWN0IjoiVkVSSUZJRUQiLCJhZG1pc3Npb24iOiJBRE1JVCIsInZlcmlmaWVyIjoiUVdFRCBTZWN1cml0eSIsInZlcmlmaWVyX3ZlcnNpb24iOiJxd2VkLXNlY3VyaXR5LXJ1bGVzZXQvMTQiLCJwcm9vZl9yZWYiOiJzaGEyNTY6MWNiODUxYzgwOTViMDYwNTc3ZDBkZDUxOTliZDJiM2E3M2U5MGNkMDhiZGE2YTg3NTcyYmJlN2NlYjc3MjcxMCJ9fX0.j2k2bb9uwyha2PjXNQaMD_fiaCldH2LGwORo8PyIQivJGNfYyIvsyxmoIVcw-KqeKYm9NU5y4WIzphbwf_BtOLn9y3U-5AzgpqTk5p7hgTuzYpf6bmPvMHiH-2754KNYwtjJP_OUdzUFNdKShOjkLABPZtSqp7WxQXBylqeGrUIzXzm0vAtYjqNd62AVMEnTVmMOor_Zj7StJBgRc-6AxqF6pnUZnDbOnU3pRn6r__8AdZiMs7GqgofJ4HDNyUIjsY_EOMRqoHHNu03dS-Xjxpkgu8B6EB6-4420O4saq4ONFPiW7vInmn2HTE36T07CMFR0y2FmZ215trpitfwEYA",
  "fingerprint": "192987c8761944d9",
  "jwks_url": "https://qwed-security-334760594829.us-central1.run.app/.well-known/jwks.json",
  "kid": "565ad0864f75bdbb"
}

sieve-by-fendora · 2026-11-06T04:45:53Z

Sieve Security Scan ✅

No likely vulnerabilities found in changed files.

0 real · 0 suppressed · 0 FP · 0 total

secuarden-ai · 2026-11-06T04:46:42Z

        "remark-smartypants": "^3.0.3",
        "rfdc": "^1.4.1",
-        "satori": "^0.19.1",
+        "satori": "^0.63.2",


⚠️ High: Suspicious Major Version Jump in satori

🎟️ Issue Explanation

satori is bumped from ^0.19.1 to ^0.63.2 — a jump of more than 40 minor/major semver steps in a single diff. Jumps of this magnitude in a lock file (especially for a rendering/SVG library) are unusual and warrant verification that the resolved package on npmjs.org is the legitimate satori package and not a dependency confusion or typosquatting artifact. The package is used in what appears to be a documentation/static-site generator, but if it processes user-supplied content it could introduce XSS or SSRF through malicious rendering logic.

🛠️ Actions

@secuarden-ai /fix - Generate remediation code for this issue

@secuarden-ai /explain - Learn why this matters and potential impact

@secuarden-ai /ignore [reason] - Dismiss this finding

@secuarden-ai /review - Submit a reasoned assessment and request a rescan

🔐 Secuarden Security Review • Finding: SEC_a1af72536cf7

secuarden-ai · 2026-11-06T04:46:43Z

    "remark-smartypants": "^3.0.3",
    "rfdc": "^1.4.1",
-    "satori": "^0.19.1",
+    "satori": "^0.63.2",


⚠️ High: Suspicious Major Version Jump in Dependency (satori)

🎟️ Issue Explanation

satori is bumped from ^0.19.1 to ^0.63.2 — a jump of over 40 minor versions. This is highly anomalous for a semver-following package and may indicate a typosquat, a dependency confusion attack, or an accidental reference to a different package that happens to occupy that version space on npm. The ^ range means npm will resolve up to but not including 1.0.0, so any version 0.63.x–0.x.x could be installed. If a malicious actor published versions in this range the project would silently pull them in. Satori is used for server-side image/SVG generation, so a compromised version would have full Node.js process access at build and potentially at runtime.

🛠️ Actions

@secuarden-ai /fix - Generate remediation code for this issue

@secuarden-ai /explain - Learn why this matters and potential impact

@secuarden-ai /ignore [reason] - Dismiss this finding

@secuarden-ai /review - Submit a reasoned assessment and request a rescan

🔐 Secuarden Security Review • Finding: SEC_12a6060f68b9

codacy-production · 2026-11-06T04:46:44Z

Not up to standards ⛔

🔴 Issues 1 high · 1 medium

Alerts:
⚠ 2 issues (≤ 0 issues of at least minor severity)

Results:
2 new issues

Category Results

Security 1 medium
1 high

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

secuarden-ai · 2026-11-06T04:46:44Z

+        "prettier": "^3.9.10",
        "tsx": "^4.23.15",
-        "typescript": "^5.9.3"
+        "typescript": "^7.0.2"


🟡 Medium: TypeScript Major Version Jump (5.x → 7.x)

🎟️ Issue Explanation

typescript is bumped from ^5.9.3 to ^7.0.2. As of the repository's last-updated date (2026-08-16) TypeScript 7 may be a legitimate release, but a two-major-version jump in a single diff is unusual. TypeScript itself is a devDependency and does not ship to production, so direct runtime risk is low. However, TypeScript 7 may introduce new type-checking behaviors that mask type errors in auth or payment code paths (tagged as high-risk in this repository), potentially allowing unsafe code to pass the build without type errors catching logic flaws.

🛠️ Actions

@secuarden-ai /fix - Generate remediation code for this issue

@secuarden-ai /explain - Learn why this matters and potential impact

@secuarden-ai /ignore [reason] - Dismiss this finding

@secuarden-ai /review - Submit a reasoned assessment and request a rescan

🔐 Secuarden Security Review • Finding: SEC_f55ca1517fd1

secuarden-ai · 2026-11-06T04:46:45Z

-    "pretty-bytes": "^7.1.3",
+    "minimatch": "^11.0.4",
+    "pixi.js": "^8.22.0",
+    "preact": "^11.1.1",


🟡 Medium: Major Version Bump to Preact 11 with Unverified Security Posture

🎟️ Issue Explanation

preact is bumped from ^10.29.8 to ^11.1.1, a major version upgrade. Major version bumps can introduce changed security boundaries, new APIs, or removal of mitigations present in prior versions (e.g., XSS sanitisation behaviour in JSX rendering). Combined with the corresponding preact-render-to-string bump (^6.7.0 → ^6.8.2), changes to server-side rendering escape logic could introduce XSS if output is rendered without downstream sanitisation. The repository already flags auth and payment risk areas.

🛠️ Actions

@secuarden-ai /fix - Generate remediation code for this issue

@secuarden-ai /explain - Learn why this matters and potential impact

@secuarden-ai /ignore [reason] - Dismiss this finding

@secuarden-ai /review - Submit a reasoned assessment and request a rescan

🔐 Secuarden Security Review • Finding: SEC_5b2f86282c92

secuarden-ai · 2026-11-06T04:46:46Z

+    "prettier": "^3.9.10",
    "tsx": "^4.23.15",
-    "typescript": "^5.9.3"
+    "typescript": "^7.0.2"


🟡 Medium: Suspicious Major Version Jump in DevDependency (typescript)

🎟️ Issue Explanation

TypeScript is bumped from ^5.9.3 to ^7.0.2, skipping an entire major version (6.x). As of the knowledge cutoff, TypeScript's latest stable release is in the 5.x line. A 7.0.2 entry does not correspond to any publicly documented TypeScript release, which is a strong indicator of either a typosquatted package, a dependency confusion artefact, or a pre-release/internal build reference. While TypeScript is a devDependency and not shipped to end users, a compromised compiler can inject malicious code into the build output, affecting the runtime artefacts deployed to production (including auth and payment flows flagged in the repository context).

🛠️ Actions

@secuarden-ai /fix - Generate remediation code for this issue

@secuarden-ai /explain - Learn why this matters and potential impact

@secuarden-ai /ignore [reason] - Dismiss this finding

@secuarden-ai /review - Submit a reasoned assessment and request a rescan

🔐 Secuarden Security Review • Finding: SEC_345434fa509d

secuarden-ai · 2026-11-06T04:46:47Z

CVE-2022-3517

-        "preact": "^10.29.8",
-        "preact-render-to-string": "^6.7.0",
-        "pretty-bytes": "^7.1.3",
+        "minimatch": "^11.0.4",


🟢 Low: minimatch Major Version Bump (10 → 11)

🎟️ Issue Explanation

minimatch is bumped from ^10.2.6 to ^11.0.4. Historically minimatch has had ReDoS vulnerabilities (CVE-2022-3517). A major version bump should be reviewed to confirm the new release does not reintroduce glob-matching patterns that are vulnerable to ReDoS if attacker-controlled glob patterns are accepted anywhere in the application.

🛠️ Actions

@secuarden-ai /fix - Generate remediation code for this issue

@secuarden-ai /explain - Learn why this matters and potential impact

@secuarden-ai /ignore [reason] - Dismiss this finding

@secuarden-ai /review - Submit a reasoned assessment and request a rescan

🔐 Secuarden Security Review • Finding: SEC_ce7eb0b0dc34

secuarden-ai · 2026-11-06T04:46:48Z

-    "preact": "^10.29.8",
-    "preact-render-to-string": "^6.7.0",
-    "pretty-bytes": "^7.1.3",
+    "minimatch": "^11.0.4",


🟢 Low: Major Version Bump in minimatch (10 → 11)

🎟️ Issue Explanation

minimatch is bumped from ^10.2.6 to ^11.0.4. Major version bumps in path-globbing libraries have historically introduced or fixed ReDoS (Regular Expression Denial of Service) vulnerabilities. Depending on how minimatch is used (e.g., filtering user-supplied file paths), a regression in the new major version could reintroduce a ReDoS vector.

🛠️ Actions

@secuarden-ai /fix - Generate remediation code for this issue

@secuarden-ai /explain - Learn why this matters and potential impact

@secuarden-ai /ignore [reason] - Dismiss this finding

@secuarden-ai /review - Submit a reasoned assessment and request a rescan

🔐 Secuarden Security Review • Finding: SEC_8216dc685e19

dependabot · 2026-11-13T04:44:11Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

gitginie

@dependabot[bot]
Thank you for your contribution to this repository! We appreciate your effort in closing pull request.
Happy coding!

devactivity-app · 2026-11-13T04:44:31Z

Pull Request Summary by devActivity

Metrics

null

secuarden-ai · 2026-11-13T04:44:37Z

Invalid command format

To invoke the bot, use:

@secuarden-ai /command [arguments]

Available commands:

@secuarden-ai /fix SEC_ID - Generate a fix for a finding
@secuarden-ai /explain - Explain why this finding matters
@secuarden-ai /ignore SEC_ID [reason] - Suppress a finding
@secuarden-ai /rerun - Re-scan this PR
@secuarden-ai /review - Submit per-finding reassessment feedback (see review format below)

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 6, 2026

pull-request-size Bot added the size/M label Nov 6, 2026

gitginie Bot reviewed Nov 6, 2026

View reviewed changes

inspect-review Bot reviewed Nov 6, 2026

View reviewed changes

secuarden-ai Bot reviewed Nov 6, 2026

View reviewed changes

dependabot Bot closed this Nov 13, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-538ba69f03 branch November 13, 2026 04:44

gitginie Bot reviewed Nov 13, 2026

View reviewed changes

Conversation

dependabot Bot commented on behalf of github Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

6.0.0

High-level changes

API changes

Fixes

Misc

6.0.0 (2026-10-19)

High-level changes

API changes

Fixes

v3.7.0 Hasta la vista

9.0.6

Fix

2.3.7

Fix

Dependencies

[5.5.0] - 2026-10-16

Changed

Fixed

[5.4.3] - 2026-10-06

Fixed

3.0.4

3.0.3

change log

11.0

v8.22.0

💾 Download

Changed

🚨 Behavior Change

🎁 Added

v6.8.2

Patch Changes

v6.8.1

Patch Changes

6.8.2

Patch Changes

6.8.1

Patch Changes

6.8.0

Minor Changes

Patch Changes

v7.2.0

0.63.2

0.63.2 (2026-10-20)

Bug Fixes

0.63.1

0.63.1 (2026-10-20)

Bug Fixes

0.63.0

0.63.0 (2026-10-19)

Bug Fixes

Features

0.62.0

0.62.0 (2026-10-16)

Bug Fixes

Features

0.61.0

0.61.0 (2026-10-16)

Bug Fixes

v0.35.5

v0.35.5-rc.1

Summary by cubic

Uh oh!

gitnotebooks Bot commented Nov 6, 2026

Uh oh!

code-genius-code-coverage Bot commented Nov 6, 2026

Uh oh!

codereviewbot-ai Bot commented Nov 6, 2026

Uh oh!

semanticdiff-com Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitginie Bot left a comment

Choose a reason for hiding this comment

Uh oh!

codesherlock-ai Bot commented Nov 6, 2026

Uh oh!

codeant-ai Bot commented Nov 6, 2026

dependabot Bot commented on behalf of github Nov 6, 2026 •

edited

Loading

semanticdiff-com Bot commented Nov 6, 2026 •

edited

Loading

precogs-ai Bot commented Nov 6, 2026 •

edited

Loading

zaxion-governance Bot commented Nov 6, 2026 •

edited

Loading