chore(deps): bump the production-dependencies group across 1 directory with 26 updates by dependabot[bot] · Pull Request #98 · LAF-US/THE-GEMSTONE

dependabot · 2026-11-13T04:45:22Z

Bumps the production-dependencies group with 26 updates in the / directory:

Package	From	To
@clack/prompts	`1.8.1`	`1.9.0`
chokidar	`5.0.0`	`6.0.0`
d3	`7.9.0`	`7.9.2`
esbuild-sass-plugin	`3.6.0`	`3.7.0`
hast-util-to-html	`9.0.5`	`9.0.6`
hast-util-to-jsx-runtime	`2.3.6`	`2.3.7`
js-yaml	`5.4.2`	`5.5.0`
mdast-util-find-and-replace	`3.0.2`	`3.0.4`
minimatch	`10.2.6`	`11.0.5`
pixi.js	`8.21.0`	`8.22.0`
preact	`10.29.8`	`11.2.0`
preact-render-to-string	`6.7.0`	`6.8.2`
pretty-bytes	`7.1.3`	`7.2.0`
rehype-pretty-code	`0.14.5`	`0.14.6`
satori	`0.19.1`	`0.63.2`
serve-handler	`6.1.7`	`6.1.8`
sharp	`0.35.4`	`0.35.5`
shiki	`4.4.3`	`4.6.0`
toml	`5.0.0`	`5.0.1`
unist-util-visit	`5.1.0`	`5.2.0`
ws	`8.21.3`	`8.22.2`
@types/ws	`8.18.1`	`8.18.2`
@types/node	`26.6.2`	`26.6.6`
@types/ws	`8.18.1`	`8.18.2`
esbuild	`0.27.2`	`0.27.7`
prettier	`3.8.1`	`3.9.10`
typescript	`5.9.3`	`7.0.2`

Updates @clack/prompts from 1.8.1 to 1.9.0

Release notes

Sourced from @clack/prompts's releases.

@clack/prompts@1.9.0

Minor Changes

#596 cbeefcb Thanks @dreyfus92! - Add accessible mode to spinner: when enabled via the accessible option, the global setting, or the ACCESSIBLE env var, the spinner emits static, append-only, screen-reader friendly output, a plain start line, a "still working" heartbeat every 30 seconds, and a plain final line. Instead of animated in-place repaints.

#614 5ac9e73 Thanks @btea! - Allow multiselect to accept readonly option arrays, e.g. options declared with as const. The Value type parameter is now inferred as a literal union ('a' | 'b') from such arrays, and initialValues also accepts readonly arrays.

#622 1835f41 Thanks @btea! - Add support for disabled selectKey options: they are rendered dimmed, cannot be selected by keypress, and are ignored when set as the initial value.

Patch Changes

#610 be35482 Thanks @43081j! - Update sisteransi to 2.x (ESM only).

#618 3e0bffd Thanks @btea! - Use an explicit undefined check when forwarding autocomplete initialValue so 0, false, and empty strings remain selectable instead of falling back to the first option.

#631 9053625 Thanks @43081j! - Account for escape sequences in prefixes during line wrapping. Very narrow outputs will now render correctly.

#616 f325a53 Thanks @btea! - Fix that isCancelled returned after calling cancel and start methods in progress does not refresh.

#627 34976a7 Thanks @b84330808! - Fix the path prompt in directory mode on Windows: typing a trailing \ after a directory now lists its children instead of showing no matches.

#628 85f6aff Thanks @imharjot! - Render falsy primitive options through the limitOptions style callback instead of leaving blank rows.

Updated dependencies [be35482, 9053625, f2bc46b, f325a53, 5ac9e73, e66ab12, 1835f41]:

@clack/core@1.6.0

Changelog

Sourced from @clack/prompts's changelog.

1.9.0

Minor Changes

#596 cbeefcb Thanks @dreyfus92! - Add accessible mode to spinner: when enabled via the accessible option, the global setting, or the ACCESSIBLE env var, the spinner emits static, append-only, screen-reader friendly output, a plain start line, a "still working" heartbeat every 30 seconds, and a plain final line. Instead of animated in-place repaints.

#614 5ac9e73 Thanks @btea! - Allow multiselect to accept readonly option arrays, e.g. options declared with as const. The Value type parameter is now inferred as a literal union ('a' | 'b') from such arrays, and initialValues also accepts readonly arrays.

#622 1835f41 Thanks @btea! - Add support for disabled selectKey options: they are rendered dimmed, cannot be selected by keypress, and are ignored when set as the initial value.

Patch Changes

#610 be35482 Thanks @43081j! - Update sisteransi to 2.x (ESM only).

#618 3e0bffd Thanks @btea! - Use an explicit undefined check when forwarding autocomplete initialValue so 0, false, and empty strings remain selectable instead of falling back to the first option.

#631 9053625 Thanks @43081j! - Account for escape sequences in prefixes during line wrapping. Very narrow outputs will now render correctly.

#616 f325a53 Thanks @btea! - Fix that isCancelled returned after calling cancel and start methods in progress does not refresh.

#627 34976a7 Thanks @b84330808! - Fix the path prompt in directory mode on Windows: typing a trailing \ after a directory now lists its children instead of showing no matches.

#628 85f6aff Thanks @imharjot! - Render falsy primitive options through the limitOptions style callback instead of leaving blank rows.

Updated dependencies [be35482, 9053625, f2bc46b, f325a53, 5ac9e73, e66ab12, 1835f41]:

@clack/core@1.6.0

Commits

50c8ea0 [ci] release (#611)
9053625 fix: account for escape sequences in prefixes (#631)
e66ab12 fix: respect the prompt output stream width (#630)
34976a7 fix(prompts): handle trailing backslash in path prompt directory mode (#627)
3e0bffd fix(prompts): preserve falsy autocomplete initial values (#618)
85f6aff fix(prompts): render falsy options in limitOptions (#628)
1835f41 fix(core, prompts): correctly render the disabled options of selectKey (#622)
f325a53 fix(progress): the progress returns isCancelled without real-time refresh (#616)
5ac9e73 feat(prompts): support readonly options in multiselect (#614)
cbeefcb feat(prompts): add accessible mode to spinner (#596)
Additional commits viewable in compare view

Updates chokidar from 5.0.0 to 6.0.0

Release notes

Sourced from chokidar's releases.

6.0.0

High-level changes

Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.

Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.

Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).

Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.

Required Node.js 22.22 or later.

API changes

Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.

usePolling: true remains as a deprecated alias for backend: 'polling'.

Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.

The old names remain as deprecated aliases; the new names win when both are given.

Changed the atomic default to false with polling. An explicit value is preserved.

Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.

Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.

Emitted errors from add() as error events instead of unhandled rejections (#1378).

Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.

Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).

Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).

Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).

Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).

Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).

Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).

Fixed false change events on Windows when many sibling files are written (#1466).

Fixed duplicate add events for unchanged files under directory activity (#1465).

Fixed replacing a watched directory with a file of the same name hanging the process (#1464).

Fixed persistent watching stopping after a watched directory was removed (#1463).

Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.

Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).

Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).

Fixed files not being detected when their directory did not exist before watching (#1422).

Fixed removed files being reported as unlinkDir instead of unlink (#1421).

Fixed ignored files and directories still being watched in WSL (#1418).

Fixed change being reported for every file when one file changed under Deno (#1417).

Fixed changes not being detected after the second save (#1399).

Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).

Fixed re-watching a path not honoring ignoreInitial (#1386).

Fixed EISDIR errors during the initial scan of network drives (#1376).

Fixed watching an array of absolute file paths (#1366).

Fixed unwatching a deleted watched directory on Windows, contributed by @sapphi-red in [pull request #1467](paulmillr/chokidar#1467).

Documented that unwatched paths stay ignored until they are added again (#1439).

Misc

... (truncated)

Changelog

Sourced from chokidar's changelog.

6.0.0 (2026-10-19)

High-level changes

Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.

Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.

Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).

Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.

Required Node.js 22.22 or later.

API changes

Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.

usePolling: true remains as a deprecated alias for backend: 'polling'.

Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.

The old names remain as deprecated aliases; the new names win when both are given.

Changed the atomic default to false with polling. An explicit value is preserved.

Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.

Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.

Emitted errors from add() as error events instead of unhandled rejections (#1378).

Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.

Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).

Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).

Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).

Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).

Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).

Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).

Fixed false change events on Windows when many sibling files are written (#1466).

Fixed duplicate add events for unchanged files under directory activity (#1465).

Fixed replacing a watched directory with a file of the same name hanging the process (#1464).

Fixed persistent watching stopping after a watched directory was removed (#1463).

Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.

Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).

Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).

Fixed files not being detected when their directory did not exist before watching (#1422).

Fixed removed files being reported as unlinkDir instead of unlink (#1421).

Fixed ignored files and directories still being watched in WSL (#1418).

Fixed change being reported for every file when one file changed under Deno (#1417).

Fixed changes not being detected after the second save (#1399).

Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).

Fixed re-watching a path not honoring ignoreInitial (#1386).

Fixed EISDIR errors during the initial scan of network drives (#1376).

Fixed watching an array of absolute file paths (#1366).

Fixed unwatching a deleted watched directory on Windows, contributed by @sapphi-red in [pull request #1467](paulmillr/chokidar#1467).

Documented that unwatched paths stay ignored until they are added again (#1439).

... (truncated)

Commits

4130839 Release 6.0.0.
53f3256 Bump devdeps
11ad48f More fixes
b6812dd Change date
706ef2c Merge pull request #1492 from paulmillr/jg/private-public
d85f4cc chore: expose tested members
97e1b93 Add changelog
8d5c07d More v6 fixes
7af52df Bump ci release.yml
a0b05d9 Merge pull request #1478 from paulmillr/jg/sponsors
Additional commits viewable in compare view

Updates d3 from 7.9.0 to 7.9.2

Release notes

Sourced from d3's releases.

v7.9.2

Revert d3-delaunay’s fix for collinear diagrams.

v7.9.1

Update dependencies.

Adopt pnpm and vitest.

Adopt npm trusted publishing.

Publish an ES module bundle instead of separate source files.

Commits

db118c9 7.9.2
374c4b3 fix docs build
78db499 7.9.1 (#4149)
3d1a90c Fix Bruls paper external URL in treemap.md (#4147)
ca958d4 docs: Incorrect alt text copied from the Observable Framework repository; it ...
42ccb63 fix broken link (#4084)
66bfe8c Fix external edge bundling references (#4039)
ab22394 fix: support links on d3js.org are outdated (#4015)
a10166c Update CHANGES.md
844b75a Update getting-started.md link to Svelte example (#3962)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for d3 since your current version.

Updates esbuild-sass-plugin from 3.6.0 to 3.7.0

Release notes

Sourced from esbuild-sass-plugin's releases.

v3.7.0 Hasta la vista

Commits

See full diff in compare view

Updates hast-util-to-html from 9.0.5 to 9.0.6

Release notes

Sourced from hast-util-to-html's releases.

9.0.6

Fix

b2b5a3e Fix HTML in SVG for desc, foreignObject, title

233ac97 Fix p closing tag omission in custom elements

Full Changelog: syntax-tree/hast-util-to-html@9.0.5...9.0.6

Commits

9c68912 9.0.6
b2b5a3e Fix HTML in SVG for desc, foreignObject, title
233ac97 Fix p closing tag omission in custom elements
14078ed Fix link in jsdoc
8e56b54 Add prepack script
70e624f Fix typos
4272500 Update actions
c264eb1 Update dev-dependencies
See full diff in compare view

Updates hast-util-to-jsx-runtime from 2.3.6 to 2.3.7

Release notes

Sourced from hast-util-to-jsx-runtime's releases.

2.3.7

Fix

b29735c Fix casing of style properties, specially variables

Dependencies

5fc8d17 Update style-to-js

Full Changelog: syntax-tree/hast-util-to-jsx-runtime@2.3.6...2.3.7

Commits

0086256 2.3.7
b4c88ee Refactor .prettierignore
562b1b5 Update node in actions
47f49d4 Remove deno
b29735c Fix casing of style properties, specially variables
40ec5e6 Update preact in example
0494bb2 Update react in example
940871c Remove skipLibCheck from tsconfig.json
5fc8d17 Update style-to-js
60af4ad Update dev-dependencies
Additional commits viewable in compare view

Updates js-yaml from 5.4.2 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

Updated argparse to v3.

Updated development dependencies.

Fixed

Correct percent-encoding of shorthand and verbatim tags.

Reject ,, ], and } at the start of block plain scalars, #801.

Report the exact position of non-printable characters in errors, #801.

[5.4.3] - 2026-10-06

Fixed

Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

Commits

cb62b2d 5.5.0 released
87aed90 Deps bump
3aec511 Fix error positions for non-printable characters, #801
11aa483 Reject flow indicators at the start of block plain scalars, #801
339d8e0 Refactor tag encoder and decoder to match the YAML specification
7832624 5.4.3 released
0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
30108cc Parse the first block mapping key once (#800)
See full diff in compare view

Updates mdast-util-find-and-replace from 3.0.2 to 3.0.4

Release notes

Sourced from mdast-util-find-and-replace's releases.

3.0.4

2870b11 Refactor to improve performance

Full Changelog: syntax-tree/mdast-util-find-and-replace@3.0.3...3.0.4

3.0.3

d65a2ad Fix merging adjacent text nodes

Full Changelog: syntax-tree/mdast-util-find-and-replace@3.0.2...3.0.3

Commits

fad9bd5 3.0.4
bc5d2a9 Add test for text as a root` node
b435e6c Remove unneeded @ts-expect-error
312079b Fix wrong parameter description
9b622de Fix type in doc
dbe507a Remove no longer applicable doc comment
2870b11 Refactor to improve performance
6c4850c 3.0.3
a1fc3d3 Update output in readme.md
d65a2ad Fix merging adjacent text nodes
Additional commits viewable in compare view

Updates minimatch from 10.2.6 to 11.0.5

Changelog

Sourced from minimatch's changelog.

change log

11.0

Match each path portion with Matcher from @isaacs/nonrecursive-glob-match, in place of a RegExp. Items in Minimatch.set are now strings, Matcher objects, or GLOBSTAR.

Remove makeRe(), Minimatch#regexp, and the MMRegExp type.

Remove the AST class.

Remove the maxExtglobRecursion option.

An empty path portion, such as the last one in a/b/, only matches an empty pattern portion. So a/b/ no longer matches a/b/?(x) or a/b/*(x), the same as a/b/*.

Add the normalize option, to normalize unicode in the pattern and in each portion of the tested path.

Remove the debug option and the debug() method.

Remove the matchOne(), slashSplit(), and levelTwoFileOptimize() methods. They are internal now.

Fix patterns with more than one ** and sections of different lengths between them, such as **/a/b/c/**/d/**, which failed to match some paths since 10.2.3.

Fix partial matching of patterns with **, which since 10.2.3 matched some paths under a dot portion that ** can not walk, and did not match some paths that end in the pattern's last portion.

partial matching of patterns with many ** no longer takes exponential time.

On Windows, a .. no longer removes the drive letter, or the host and share of a UNC path, at the start of a pattern or (at optimization level 2) a path. So C:/a/../../x no longer matches x or /x.

On Windows, compare the host and share of UNC paths like //host/share/... case-insensitively, the same as drive letters.

On Windows, long UNC paths like //?/UNC/host/share/... match //host/share/... and vice versa, the same as //?/c:/... and c:/....

At optimization level 2, throw a RangeError if splitting **/.. portions would make more than braceExpandMax patterns, or add more than 1,000,000 path portions. Before, a short pattern could take minutes to compile.

At optimization level 2, dedupe patterns without comparing each pair, so that a large set is deduped in about linear time. Fix {**/x,x/y}, which was deduped to **/x, so x/y did not match.

Match a numeric brace range of 100 or more values, such as {0..999}, as one pattern portion, in place of one pattern for each value. For a glob walk, this is one directory read, in place of a stat for each value. hasMagic() is true for these

... (truncated)

Commits

ea0a4a6 11.0.5
e83fdf3 match large numeric brace ranges without expanding them
85d681c fixup! ci: update github actions to latest major versions
a675e79 ci: update github actions to latest major versions
70f442d dedupe level 2 patterns without a pairwise compare
b2d7c28 ci: increase timeout on test
2d5578b throw when **/.. pattern expansion goes above the limit
9c6ebb1 fix: reject incomplete glob split expansions
73f0e1b fix: bound total cells added by the glob split pass
f24eba9 11.0.4
Additional commits viewable in compare view

Updates pixi.js from 8.21.0 to 8.22.0

Release notes

Sourced from pixi.js's releases.

v8.22.0

💾 Download

Installation:
npm install pixi.js@8.22.0
Development Build:

https://cdn.jsdelivr.net/npm/pixi.js@8.22.0/dist/pixi.js

https://cdn.jsdelivr.net/npm/pixi.js@8.22.0/dist/pixi.mjs

Production Build:

https://cdn.jsdelivr.net/npm/pixi.js@8.22.0/dist/pixi.min.js

https://cdn.jsdelivr.net/npm/pixi.js@8.22.0/dist/pixi.min.mjs

Documentation:

https://pixijs.download/v8.22.0/docs/index.html

Changed

pixijs/pixijs@v8.21.0...v8.22.0

🚨 Behavior Change
fix: tab cannot activate the accessibility layer on a fresh page by @synath in pixijs/pixijs#12220

Pressing Tab now activates the accessibility layer on a fresh page when activateOnTab is left at its default of true. This restores the documented default, which regressed in v8.14.0. To keep Tab from activating it:
await app.init({ accessibilityOptions: { activateOnTab: false } });
fix: apply accessibleText to button and recycled accessible elements by @synath in pixijs/pixijs#12221

accessibleText now applies to the default button type and to accessible elements recycled from the pool.
🎁 Added
feat: add a federated contextmenu event by @Zyie in pixijs/pixijs#12250

Containers now receive contextmenu and contextmenucapture events, also available as the oncontextmenu handler property. The event is a FederatedPointerEvent that PixiJS hit-tests and propagates like pointerdown, and eventFeatures.click gates it.
sprite.eventMode = 'static';
sprite.on('contextmenu', (event) =>
{
    event.preventDefault(); // keeps the browser menu closed
    openMenuAt(event.global);
});
feat: sRGB view formats and transient MSAA colour on WebGPU by @GoodBoyDigital in pixijs/pixijs#12225

New transient renderer option (WebGPU, with antialias) discards the canvas's multisample depth/stencil buffer at the end of each pass, and its color buffer too on GPUs that aren't tile-based.
await app.init({ preference: 'webgpu', antialias: true, transient: true });
feat: 3D textures, storage textures and 3D mipmaps by @GoodBoyDigital in pixijs/pixijs#12248

feat: partial uploads for BufferImageSource via update(start, end) by @GoodBoyDigital in pixijs/pixijs#12227

... (truncated)

Commits

5b41ee3 v8.22.0
9dc976d fix: skip the unread-attribute warning when the attribute has a format (#12267)
1289ab7 docs: correct TilingSprite texture, width and height defaults (#12269)
b96fb4e fix: nested filters crash after renderer resize (#12257)
082128a fix: blend filter backdrop when every parent filter is skipped (#12263)
f3d96db feat: add a federated contextmenu event (#12250)
8dbbeb9 feat: 3D textures, storage textures and 3D mipmaps (#12248)
ef0c0a7 feat: sRGB view formats and transient MSAA colour on WebGPU (#12225)
27071aa fix: integer texture formats on WebGL and WebGPU (#12230)
0f8983f fix: declare accessibilityOptions on the public renderer options (#12222)
Additional commits viewable in compare view

Updates preact from 10.29.8 to 11.2.0

Release notes

Sourced from preact's releases.

11.2.0

Features

Support scoped custom element registries when rendering into shadow roots (#5342, thanks @JoviDeCroock)

Fixes

Ignore non-function values for on* props instead of registering invalid event handlers (#5345, thanks @JoviDeCroock)

Pass a thrown null or undefined to error boundaries without replacing it with a TypeError (#5347, thanks @jonkwheeler)

Preserve event handlers on unmounted nodes so events already bubbling can finish (#5349, thanks @JoviDeCroock)

Performance

Reduce bundle size across core, hooks, and compat (#5343, thanks @JoviDeCroock)

11.1.1

Fixes

Fix rendering, updating, and hydrating \<template> elements in SVG and MathML namespaces (#5339, thanks @JoviDeCroock)

Types

Add declarative shadow DOM attributes to \<template>, including their camelCase forms (#5338, thanks @b84330808)

11.1.0

Features

Add preact/compat/compiler-runtime for apps compiled with React Compiler (#5323, thanks @JoviDeCroock)

Fixes

Harden VNode recognition with a shared symbol marker (#5335, thanks @JoviDeCroock)

Isolate layout-effect errors to the throwing component so unrelated effects and lifecycle callbacks still run (#5321, thanks @JoviDeCroock)

Stop appending px to unitless SVG paint and aspect-ratio values in compat (#5233, thanks @dylanpulver)

Types

Allow the list attribute on all valid input types (#5331, thanks @playlikeboy)

Compatibility

The new VNode marker requires @preact/signals 2.11.4 or later and preact-render-to-string 6.8.2 or later when using those packages.

11.0.2

Fixes

Keep queued components updating and finish act() cleanup after an uncaught render error (#5265, thanks @JoviDeCroock)

Correct the browser ESM entry point for preact/compat/server (#5304, thanks @rschristian)

Retain deferred hydration ranges through suspension, resumption, and unmounting (#5315, thanks @JoviDeCroock)

Leave non-plain style objects untouched in compat, preserving string-valued signal styles (#5318, thanks @JoviDeCroock)

... (truncated)

Commits

c95929d Merge pull request #5350 from preactjs/release/11.2.0

…y with 26 updates Bumps the production-dependencies group with 26 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts) | `1.8.1` | `1.9.0` | | [chokidar](https://github.com/paulmillr/chokidar) | `5.0.0` | `6.0.0` | | [d3](https://github.com/d3/d3) | `7.9.0` | `7.9.2` | | [esbuild-sass-plugin](https://github.com/glromeo/esbuild-sass-plugin) | `3.6.0` | `3.7.0` | | [hast-util-to-html](https://github.com/syntax-tree/hast-util-to-html) | `9.0.5` | `9.0.6` | | [hast-util-to-jsx-runtime](https://github.com/syntax-tree/hast-util-to-jsx-runtime) | `2.3.6` | `2.3.7` | | [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.2` | `5.5.0` | | [mdast-util-find-and-replace](https://github.com/syntax-tree/mdast-util-find-and-replace) | `3.0.2` | `3.0.4` | | [minimatch](https://github.com/isaacs/minimatch) | `10.2.6` | `11.0.5` | | [pixi.js](https://github.com/pixijs/pixijs) | `8.21.0` | `8.22.0` | | [preact](https://github.com/preactjs/preact) | `10.29.8` | `11.2.0` | | [preact-render-to-string](https://github.com/preactjs/preact-render-to-string) | `6.7.0` | `6.8.2` | | [pretty-bytes](https://github.com/sindresorhus/pretty-bytes) | `7.1.3` | `7.2.0` | | [rehype-pretty-code](https://github.com/rehype-pretty/rehype-pretty-code/tree/HEAD/packages/core) | `0.14.5` | `0.14.6` | | [satori](https://github.com/vercel/satori) | `0.19.1` | `0.63.2` | | [serve-handler](https://github.com/vercel/serve-handler) | `6.1.7` | `6.1.8` | | [sharp](https://github.com/lovell/sharp) | `0.35.4` | `0.35.5` | | [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `4.4.3` | `4.6.0` | | [toml](https://github.com/BinaryMuse/toml-node) | `5.0.0` | `5.0.1` | | [unist-util-visit](https://github.com/syntax-tree/unist-util-visit) | `5.1.0` | `5.2.0` | | [ws](https://github.com/websockets/ws) | `8.21.3` | `8.22.2` | | [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.6` | | [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` | | [esbuild](https://github.com/evanw/esbuild) | `0.27.2` | `0.27.7` | | [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.9.10` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` | Updates `@clack/prompts` from 1.8.1 to 1.9.0 - [Release notes](https://github.com/bombshell-dev/clack/releases) - [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md) - [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.9.0/packages/prompts) Updates `chokidar` from 5.0.0 to 6.0.0 - [Release notes](https://github.com/paulmillr/chokidar/releases) - [Changelog](https://github.com/paulmillr/chokidar/blob/main/CHANGELOG.md) - [Commits](paulmillr/chokidar@5.0.0...6.0.0) Updates `d3` from 7.9.0 to 7.9.2 - [Release notes](https://github.com/d3/d3/releases) - [Changelog](https://github.com/d3/d3/blob/main/CHANGES.md) - [Commits](d3/d3@v7.9.0...v7.9.2) Updates `esbuild-sass-plugin` from 3.6.0 to 3.7.0 - [Release notes](https://github.com/glromeo/esbuild-sass-plugin/releases) - [Commits](https://github.com/glromeo/esbuild-sass-plugin/commits/v3.7.0) Updates `hast-util-to-html` from 9.0.5 to 9.0.6 - [Release notes](https://github.com/syntax-tree/hast-util-to-html/releases) - [Commits](syntax-tree/hast-util-to-html@9.0.5...9.0.6) Updates `hast-util-to-jsx-runtime` from 2.3.6 to 2.3.7 - [Release notes](https://github.com/syntax-tree/hast-util-to-jsx-runtime/releases) - [Commits](syntax-tree/hast-util-to-jsx-runtime@2.3.6...2.3.7) Updates `js-yaml` from 5.4.2 to 5.5.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.4.2...5.5.0) Updates `mdast-util-find-and-replace` from 3.0.2 to 3.0.4 - [Release notes](https://github.com/syntax-tree/mdast-util-find-and-replace/releases) - [Commits](syntax-tree/mdast-util-find-and-replace@3.0.2...3.0.4) Updates `minimatch` from 10.2.6 to 11.0.5 - [Release notes](https://github.com/isaacs/minimatch/releases) - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v10.2.6...v11.0.5) Updates `pixi.js` from 8.21.0 to 8.22.0 - [Release notes](https://github.com/pixijs/pixijs/releases) - [Commits](pixijs/pixijs@v8.21.0...v8.22.0) Updates `preact` from 10.29.8 to 11.2.0 - [Release notes](https://github.com/preactjs/preact/releases) - [Commits](preactjs/preact@10.29.8...11.2.0) Updates `preact-render-to-string` from 6.7.0 to 6.8.2 - [Release notes](https://github.com/preactjs/preact-render-to-string/releases) - [Changelog](https://github.com/preactjs/preact-render-to-string/blob/main/CHANGELOG.md) - [Commits](preactjs/preact-render-to-string@v6.7.0...v6.8.2) Updates `pretty-bytes` from 7.1.3 to 7.2.0 - [Release notes](https://github.com/sindresorhus/pretty-bytes/releases) - [Commits](sindresorhus/pretty-bytes@v7.1.3...v7.2.0) Updates `rehype-pretty-code` from 0.14.5 to 0.14.6 - [Release notes](https://github.com/rehype-pretty/rehype-pretty-code/releases) - [Changelog](https://github.com/rehype-pretty/rehype-pretty-code/blob/master/packages/core/CHANGELOG.md) - [Commits](https://github.com/rehype-pretty/rehype-pretty-code/commits/rehype-pretty-code@0.14.6/packages/core) Updates `satori` from 0.19.1 to 0.63.2 - [Release notes](https://github.com/vercel/satori/releases) - [Commits](vercel/satori@0.19.1...0.63.2) Updates `serve-handler` from 6.1.7 to 6.1.8 - [Release notes](https://github.com/vercel/serve-handler/releases) - [Commits](https://github.com/vercel/serve-handler/commits) Updates `sharp` from 0.35.4 to 0.35.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.4...v0.35.5) Updates `shiki` from 4.4.3 to 4.6.0 - [Release notes](https://github.com/shikijs/shiki/releases) - [Commits](https://github.com/shikijs/shiki/commits/v4.6.0/packages/shiki) Updates `toml` from 5.0.0 to 5.0.1 - [Changelog](https://github.com/BinaryMuse/toml-node/blob/main/CHANGELOG.md) - [Commits](BinaryMuse/toml-node@v5.0.0...v5.0.1) Updates `unist-util-visit` from 5.1.0 to 5.2.0 - [Release notes](https://github.com/syntax-tree/unist-util-visit/releases) - [Commits](syntax-tree/unist-util-visit@5.1.0...5.2.0) Updates `ws` from 8.21.3 to 8.22.2 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.21.3...8.22.2) Updates `@types/ws` from 8.18.1 to 8.18.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws) Updates `@types/node` from 26.6.2 to 26.6.6 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/ws` from 8.18.1 to 8.18.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws) Updates `esbuild` from 0.27.2 to 0.27.7 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md) - [Commits](evanw/esbuild@v0.27.2...v0.27.7) Updates `prettier` from 3.8.1 to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.1...3.9.10) Updates `typescript` from 5.9.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v7.0.2) --- updated-dependencies: - dependency-name: "@clack/prompts" dependency-version: 1.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: chokidar dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: d3 dependency-version: 7.9.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: esbuild-sass-plugin dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: hast-util-to-html dependency-version: 9.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: hast-util-to-jsx-runtime dependency-version: 2.3.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: js-yaml dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: mdast-util-find-and-replace dependency-version: 3.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: minimatch dependency-version: 11.0.5 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: pixi.js dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: preact dependency-version: 11.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: preact-render-to-string dependency-version: 6.8.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: pretty-bytes dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: rehype-pretty-code dependency-version: 0.14.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: satori dependency-version: 0.63.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: serve-handler dependency-version: 6.1.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: sharp dependency-version: 0.35.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: shiki dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: toml dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: unist-util-visit dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: ws dependency-version: 8.22.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@types/ws" dependency-version: 8.18.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@types/node" dependency-version: 26.6.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@types/ws" dependency-version: 8.18.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: esbuild dependency-version: 0.27.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

semanticdiff-com · 2026-11-13T04:45:32Z

Review changes with

Changed Files

File	Status
package-lock.json	45% smaller
package.json	0% smaller

gitnotebooks · 2026-11-13T04:45:33Z

Review these changes at https://app.gitnotebooks.com/LAF-US/THE-GEMSTONE/pull/98

code-genius-code-coverage · 2026-11-13T04:45:33Z

The files' contents are under analysis for test generation.

codereviewbot-ai · 2026-11-13T04:45:33Z

🤖 Review skipped: reviews for bot-created pull requests are not allowed on free accounts. Upgrade to a paid plan to enable bot reviews.

gitginie

@dependabot[bot]
Thank you for your contribution to this repository! We appreciate your effort in opening pull request.
Happy coding!

codeant-ai · 2026-11-13T04:45:36Z

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

coderabbitai · 2026-11-13T04:45:36Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: a89984c0-cc60-47d9-ac0e-893b97431990

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

zaxion-governance · 2026-11-13T04:45:39Z

🛡️ Zaxion Policy Status: 🟢 PASS

Gateway Passed

📋 View Full Governance Report

Status: 🟢 PASS
Risk Analysis: 🟢 Safe
Changes: 2 files

Visit the Full Report for detailed metrics, findings, and interactive remediation.

precogs-ai · 2026-11-13T04:45:39Z

✅ Precogs scan complete — No security issues found

_{Commit baeebf7 on dependabot/npm_and_yarn/production-dependencies-61e8766396 · 2 files scanned}

🔴 Critical	🟠 High	🔵 Medium	🟢 Low	🎯 Risk Score
0	0	0	0	0.0

✅ All clear. We scanned for SQL injection, XSS, hardcoded secrets, vulnerable dependencies, IaC misconfigurations, and PII exposure. No security vulnerabilities were detected in this PR.

✅ Passed checks (3)

Check	Status	Details
Code scan (SAST)	✅ Passed	No vulnerabilities detected
Secrets scan	✅ Passed	No hardcoded credentials found
Dependency audit	✅ Passed	No known CVEs

_{💬 @precogs-ai help for commands · 🔗 View report}

_{Precogs.ai · Detect. Fix. Merge.}

rams-design-review · 2026-11-13T04:45:40Z

Rams skipped this PR — Free reviews one repository at a time, and your active repository is LAF-US/IDAHO-VAULT.

Upgrade to Solo — $39/mo to add this repo, or free the slot by removing Rams from that repo via GitHub app settings.

coderifts · 2026-11-13T04:45:41Z

🔍 CodeRifts / issuer

No OpenAPI schemas found in this repository.

This App's check is CodeRifts / issuer; the contract-gate Action's is CodeRifts / contract-gate. A protected branch requires both. A required check still pinned to the old name CodeRifts — API Contract Check is posted by neither, so it waits until you re-pin it.

While no schema is found, this check completes neutral, which GitHub treats as non-blocking — so if CodeRifts is a required status check, it is not currently blocking anything on this branch.

To get started, either:

Name your OpenAPI schema file openapi.yaml (or openapi.json, swagger.yaml, etc.)
Or add a .coderifts.yml to specify the path:

schema:
  - path/to/your/openapi.yaml

📖 Documentation · 💬 Get help

☁️ You're on the Free plan. Everything is included during the public beta, at no cost and with nothing to upgrade.

seoguard · 2026-11-13T04:45:41Z

✅ SEO Review - no issues introduced by this PR

This PR introduces no SEO issues. 20 pre-existing issues on main are folded below for reference - not caused by this PR.

📋 20 pre-existing issues on `main` - not from this PR (🔴 5 · 🟡 7 · 🔵 8)

🔴 Critical (5)

File	Issue	Fix
`quartz/components/Head.tsx`	Missing <h1> tag _{Every page must have exactly one <h1> tag. It signals the primary topic of the page to search engines.}	Add exactly one <h1>Your Primary Topic</h1> tag to the page
`quartz/components/renderPage.tsx`	Missing <title> tag _{Every page must have a unique <title> tag. This is the primary signal search engines use to understand page topic and d…}	Add <title>Your Page Title (50-60 chars)</title> inside <head>
`quartz/components/renderPage.tsx`	Missing meta description _{Meta descriptions are used as SERP snippets. Without one, Google auto-generates one from page content, which is typical…}	Add <meta name="description" content="Your description here (150-160 chars)" /> inside <head>
`quartz/components/renderPage.tsx`	Missing <h1> tag _{Every page must have exactly one <h1> tag. It signals the primary topic of the page to search engines.}	Add exactly one <h1>Your Primary Topic</h1> tag to the page
`quartz/components/renderPage.tsx`	Missing viewport meta tag _{Without a viewport meta tag, mobile browsers render the page at desktop width, causing poor mobile UX and hurting mobil…}	Add <meta name="viewport" content="width=device-width, initial-scale=1" /> inside <head>

🟡 Warnings (7)

File	Issue	Fix
`quartz/components/Head.tsx`	Missing canonical tag _{Without a canonical tag, search engines may index duplicate versions of your page (e.g., with/without trailing slash, w…}	Add <link rel="canonical" href="https://yourdomain.com/this-page" /> inside <head>. Use absolute URLs. For JavaScript pages, ensure this matches the canonical in the pre-rendered HTML.
`quartz/components/renderPage.tsx`	Missing og:title _{Open Graph title is required for proper social sharing previews on Facebook, LinkedIn, Slack, and others.}	Add <meta property="og:title" content="Your Page Title" /> inside <head>
`quartz/components/renderPage.tsx`	Missing og:description _{Open Graph description is displayed when pages are shared on social platforms.}	Add <meta property="og:description" content="Your description" /> inside <head>
`quartz/components/renderPage.tsx`	Missing og:image _{Social shares without og:image show no image, severely reducing engagement. Image should be at least 1200x630px. Google…}	Add <meta property="og:image" content="https://yourdomain.com/og-image.jpg" /> inside <head>. Recommended size: 1200x630px.
`quartz/components/renderPage.tsx`	Missing twitter:card _{Without twitter:card, X (Twitter) will not show a rich preview when your page is shared.}	Add <meta name="twitter:card" content="summary_large_image" /> inside <head>
`quartz/components/renderPage.tsx`	Missing charset declaration _{Without a charset declaration, browsers may misinterpret the page encoding, causing garbled text.}	Add <meta charset="UTF-8" /> as the first tag inside <head>
`quartz/components/renderPage.tsx`	Missing canonical tag _{Without a canonical tag, search engines may index duplicate versions of your page (e.g., with/without trailing slash, w…}	Add <link rel="canonical" href="https://yourdomain.com/this-page" /> inside <head>. Use absolute URLs. For JavaScript pages, ensure this matches the canonical in the pre-rendered HTML.

🔵 Info (8)

File	Issue	Fix
`quartz/components/Footer.tsx` (line 18)	External link missing rel="noopener" _{External links without rel="noopener noreferrer" expose users to tab-napping attacks and leak referrer information. Lin…}	Add rel="noopener noreferrer" to <a href="https://quartz.jzhao.xyz/">
`quartz/components/Head.tsx`	No structured data (JSON-LD) found _{Structured data helps search engines understand your content and can unlock rich results (star ratings, breadcrumbs, et…}	Add a JSON-LD script block: <script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","name":"Page Title"}</script>
`quartz/components/renderPage.tsx`	Missing og:url _{og:url sets the canonical URL for social sharing, preventing duplicate content issues on social platforms.}	Add <meta property="og:url" content="https://yourdomain.com/page" /> inside <head>
`quartz/components/renderPage.tsx`	Missing og:type _{og:type tells social platforms what kind of content this is (website, article, product, etc.).}	Add <meta property="og:type" content="website" /> inside <head>. Use 'article' for blog posts.
`quartz/components/renderPage.tsx`	Missing twitter:title _{twitter:title overrides og:title specifically for X (Twitter) cards.}	Add <meta name="twitter:title" content="Your Title" /> inside <head>
`quartz/components/renderPage.tsx`	Missing twitter:image _{twitter:image is shown in X (Twitter) card previews. Recommended minimum 1200x628px.}	Add <meta name="twitter:image" content="https://yourdomain.com/twitter-image.jpg" /> inside <head>
`quartz/components/renderPage.tsx`	Missing favicon _{A favicon improves brand recognition in browser tabs and bookmarks. Google displays favicons in SERPs. Google requires …}	Add <link rel="icon" href="/favicon.ico" type="image/x-icon" /> inside <head>. Ensure the favicon has a 1:1 aspect ratio and is at least 48x48px. Confirm Googlebot can crawl both the favicon file (via Googlebot-Image) and your home page (via Googlebot).
`quartz/components/renderPage.tsx`	No structured data (JSON-LD) found _{Structured data helps search engines understand your content and can unlock rich results (star ratings, breadcrumbs, et…}	Add a JSON-LD script block: <script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","name":"Page Title"}</script>

✅ 925 checks passed

image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
missing-title
title-too-long
title-too-short
missing-meta-description
meta-description-too-long
meta-description-too-short
missing-og-title
missing-og-description
missing-og-image
missing-og-url
missing-og-type
missing-og-locale
missing-twitter-card
missing-twitter-title
missing-twitter-image
multiple-h1
heading-hierarchy
empty-heading
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
missing-viewport
missing-charset
accidental-noindex
missing-favicon
invalid-json-ld
missing-preload-lcp
faq-schema-deprecated
back-button-hijacking
robots-meta-outside-head
noindex-in-javascript
canonical-javascript-best-practice
favicon-aspect-ratio
inp-core-web-vital
image-preferred-source-metadata
breadcrumbs-desktop-only
video-transparency
structured-data-javascript-initial-html
mobile-version-links
review-snippet-requires-comment
practice-problem-schema-deprecated
special-announcement-schema-deprecated
missing-hreflang
json-ld-recommended-format
read-more-deeplink
javascript-non-200-rendering
javascript-paywall-detection
hreflang-no-combined-attributes
review-no-multiple-reviewed-entities
merchant-shipping-policy-schema
video-indexing-criteria
avif-image-format-supported
c2pa-metadata
ai-mode-search-console
loyalty-program-schema
merchant-return-policy-schema
product-structured-data-single-product
url-parameters-best-practice
safe-search-explicit-tagging
organization-markup
site-name-schema
preferred-sources-feature
event-structured-data-requirements
dataset-schema-phased-out
generative-ai-optimization
spam-policies-apply-to-ai-responses
follow-feature-removed
sitelinks-searchbox-removed
googlebot-file-size-limits
recipe-thumbnail-property
core-updates-continuous
south-africa-carousel-structured-data
llms-txt-not-required
ai-features-snippet-eligibility
agent-friendly-website
speakable-schema-deprecated
schema-org-shipping-vocabulary-updated
faq-rich-result-documentation-removed
html-standard-for-seo
oai-searchbot-crawl-eligibility
markdown-content-no-seo-advantage
google-video-schema-creator-property
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
canonical-relative-url
canonical-multiple
robots-meta-conflicting-directives
image-missing-dimensions
iframe-missing-title
mixed-content-http-resources
hreflang-x-default-missing
article-dates-missing
article-author-missing
og-image-alt-missing
twitter-description-missing
nextjs-route-no-title
nextjs-route-no-description
remix-route-no-title
remix-route-no-description
discussion-forum-markup-additional-properties
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
title-too-long
title-too-short
meta-description-too-long
meta-description-too-short
missing-og-locale
multiple-h1
heading-hierarchy
empty-heading
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
accidental-noindex
invalid-json-ld
missing-preload-lcp
faq-schema-deprecated
back-button-hijacking
robots-meta-outside-head
noindex-in-javascript
canonical-javascript-best-practice
favicon-aspect-ratio
inp-core-web-vital
image-preferred-source-metadata
breadcrumbs-desktop-only
video-transparency
structured-data-javascript-initial-html
mobile-version-links
review-snippet-requires-comment
practice-problem-schema-deprecated
special-announcement-schema-deprecated
missing-hreflang
json-ld-recommended-format
read-more-deeplink
javascript-non-200-rendering
javascript-paywall-detection
hreflang-no-combined-attributes
review-no-multiple-reviewed-entities
merchant-shipping-policy-schema
video-indexing-criteria
avif-image-format-supported
c2pa-metadata
ai-mode-search-console
loyalty-program-schema
merchant-return-policy-schema
product-structured-data-single-product
url-parameters-best-practice
safe-search-explicit-tagging
organization-markup
site-name-schema
preferred-sources-feature
event-structured-data-requirements
dataset-schema-phased-out
generative-ai-optimization
spam-policies-apply-to-ai-responses
follow-feature-removed
sitelinks-searchbox-removed
googlebot-file-size-limits
recipe-thumbnail-property
core-updates-continuous
south-africa-carousel-structured-data
llms-txt-not-required
ai-features-snippet-eligibility
agent-friendly-website
speakable-schema-deprecated
schema-org-shipping-vocabulary-updated
faq-rich-result-documentation-removed
html-standard-for-seo
oai-searchbot-crawl-eligibility
markdown-content-no-seo-advantage
google-video-schema-creator-property
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
canonical-relative-url
canonical-multiple
robots-meta-conflicting-directives
image-missing-dimensions
iframe-missing-title
mixed-content-http-resources
hreflang-x-default-missing
article-dates-missing
article-author-missing
og-image-alt-missing
twitter-description-missing
nextjs-route-no-title
nextjs-route-no-description
remix-route-no-title
remix-route-no-description
discussion-forum-markup-additional-properties
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions
image-missing-alt
image-empty-alt
image-missing-lazy-loading
image-url-consistency
vague-link-text
external-link-no-rel
image-preferred-source-metadata
video-transparency
avif-image-format-supported
c2pa-metadata
geo-robots-ai-agents
schema-nested-graph
schema-entity-sameas
geo-ssr-hydration
schema-faqpage-completeness
geo-bluf-structure
geo-passage-containment
geo-unanchored-stats
image-missing-dimensions

SEOCode · Docs & troubleshooting

ℹ️ SEOCode reviewed 40 of 51 files in this repository. For full coverage of larger repositories, contact support@seocode.io.

inspect-review

inspect review

Triage: 2 entities analyzed | 0 critical, 0 high, 2 medium, 0 low
Verdict: standard_review

Findings (0)

Reviewed by inspect | Entity-level triage found 0 high-risk changes

secuarden-ai · 2026-11-13T04:45:43Z

Invalid command format

To invoke the bot, use:

@secuarden-ai /command [arguments]

Available commands:

@secuarden-ai /fix SEC_ID - Generate a fix for a finding
@secuarden-ai /explain - Explain why this finding matters
@secuarden-ai /ignore SEC_ID [reason] - Suppress a finding
@secuarden-ai /rerun - Re-scan this PR
@secuarden-ai /review - Submit per-finding reassessment feedback (see review format below)

qwed-security · 2026-11-13T04:45:44Z

QWED Security Verification Report

Engines

dependency_scan: ✅
entropy_scan: ✅
lockfile_scan: ✅
pattern_scan: ✅
secret_scan: ✅

Verified Files

package-lock.json
package.json

Verified by QWED — deterministic security verification. No LLM used.

Verification Context v1.0

{
  "spec_version": "1.0",
  "object": {
    "formal_statement": "LAF-US/THE-GEMSTONE@baeebf75 (PR #98) is safe to merge"
  },
  "context": {
    "interpretation": {
      "theory": "deterministic security verification",
      "logic": "evidence-context-policy pipeline"
    },
    "proof": {
      "verifier": "QWED Security",
      "verifier_version": "qwed-security-ruleset/15",
      "configuration": {
        "repo": "LAF-US/THE-GEMSTONE",
        "head_sha": "baeebf756eb542bdafc91a48e023dfcc5c0cde6d",
        "files_scanned": 2
      },
      "theory_scope": "PR security scan against QWED deterministic rule set",
      "trusted_dependencies": [
        "qwed-security"
      ],
      "outcome_treatment": "unknown/timeout/error resolve to UNVERIFIABLE or BLOCKED"
    },
    "evidence": {
      "evidence": {
        "status": "VERIFIED",
        "agent_message": "VERIFIED against the QWED deterministic rule set: no security boundary violations detected in the scanned files. This attests to the absence of known-pattern violations for this rule set and commit \u2014 it is not a guarantee that the code is free of all vulnerabilities.",
        "developer_fields": {
          "total_findings": 0,
          "advisory_checks": []
        },
        "is_authoritative": true,
        "proof_ref": "sha256:5bd617d90c911a03f6e152fa921a0c381375cfd1e77ff39407580c511c2bd0fc",
        "scan_evidence": {
          "repo": "LAF-US/THE-GEMSTONE",
          "head_sha": "baeebf756eb542bdafc91a48e023dfcc5c0cde6d",
          "pr_number": 98,
          "files_scanned": 2,
          "engine_results": 5,
          "conclusion": "success",
          "rule_set": "qwed-security-ruleset/15",
          "engines": [
            "dependency_scan",
            "entropy_scan",
            "lockfile_scan",
            "pattern_scan",
            "secret_scan"
          ]
        },
        "repo": "LAF-US/THE-GEMSTONE",
        "head_sha": "baeebf756eb542bdafc91a48e023dfcc5c0cde6d",
        "files_scanned": 2
      },
      "proof_ref": "sha256:cc2370cdb472c7167af7e4052f16d11ea5d3aac74347f8854418fd3112b028c8"
    },
    "decision": {
      "admission": "ADMIT"
    }
  },
  "verdict": "VERIFIED"
}

Attestation (signed, binds the Verification Context above)

{
  "envelope": "qwed-security-attestation/1",
  "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjU2NWFkMDg2NGY3NWJkYmIiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiIyNzU5NTA0IiwiYXVkIjoicXdlZC1hdHRlc3RhdGlvbiIsImlhdCI6MTc5NDU0NTE0MCwiZXhwIjoxNzk0NTQ1NDQwLCJxd2VkIjp7InJlc3VsdCI6eyJzdGF0dXMiOiJWRVJJRklFRCIsImFnZW50X21lc3NhZ2UiOiJWRVJJRklFRCBhZ2FpbnN0IHRoZSBRV0VEIGRldGVybWluaXN0aWMgcnVsZSBzZXQ6IG5vIHNlY3VyaXR5IGJvdW5kYXJ5IHZpb2xhdGlvbnMgZGV0ZWN0ZWQgaW4gdGhlIHNjYW5uZWQgZmlsZXMuIFRoaXMgYXR0ZXN0cyB0byB0aGUgYWJzZW5jZSBvZiBrbm93bi1wYXR0ZXJuIHZpb2xhdGlvbnMgZm9yIHRoaXMgcnVsZSBzZXQgYW5kIGNvbW1pdCBcdTIwMTQgaXQgaXMgbm90IGEgZ3VhcmFudGVlIHRoYXQgdGhlIGNvZGUgaXMgZnJlZSBvZiBhbGwgdnVsbmVyYWJpbGl0aWVzLiIsImlzX2F1dGhvcml0YXRpdmUiOnRydWV9LCJwcm9vZl9oYXNoIjoic2hhMjU2OjViZDYxN2Q5MGM5MTFhMDNmNmUxNTJmYTkyMWEwYzM4MTM3NWNmZDFlNzdmZjM5NDA3NTgwYzUxMWMyYmQwZmMiLCJib3VuZGFyeSI6bnVsbCwiZW52ZWxvcGUiOiJxd2VkLXNlY3VyaXR5LWF0dGVzdGF0aW9uLzEiLCJqdGkiOiIwN2ZkN2YzZWJiYmQyODQwZTcyNDM0M2IzZDE2YTIzNSIsInZlcmlmaWNhdGlvbl9jb250ZXh0Ijp7InNwZWNfdmVyc2lvbiI6IjEuMCIsImZvcm1hbF9zdGF0ZW1lbnQiOiJMQUYtVVMvVEhFLUdFTVNUT05FQGJhZWViZjc1IChQUiAjOTgpIGlzIHNhZmUgdG8gbWVyZ2UiLCJ2ZXJkaWN0IjoiVkVSSUZJRUQiLCJhZG1pc3Npb24iOiJBRE1JVCIsInZlcmlmaWVyIjoiUVdFRCBTZWN1cml0eSIsInZlcmlmaWVyX3ZlcnNpb24iOiJxd2VkLXNlY3VyaXR5LXJ1bGVzZXQvMTUiLCJwcm9vZl9yZWYiOiJzaGEyNTY6Y2MyMzcwY2RiNDcyYzcxNjdhZjdlNDA1MmYxNmQxMWVhNWQzYWFjNzQzNDdmODg1NDQxOGZkMzExMmIwMjhjOCJ9fX0.m1eh4DWL3je2f_58KiydfHNH7KjFc0XUETdTRB9U6SZnloBVitBiKSz4ZQgs6XwWApsz6iBYCsQCdDBeCJdmrdRnt2wcFguklqm1hokYjDgUixdgCdMKI9Vd1b27ZZBNG4tZk2NV9VVMUPjxxOmKi-p-Pe_1-E6W3KlXJtl9E4Nx_54A6z_y14gvXkElk3A2R1tjYUk-aIEILiGLOozZ5ZmWIhAgj439LqdXA_w3rSDhSdWs3_mEFHAE2LWwfxraIm3wDm7uWf5_4XYAQq8s0am_HQFLEyxppYn0d-iIhcU_0R4X0-Yzw-woNhJtcurMtBirRM6_kToMWdRs2sOMCA",
  "fingerprint": "9620d7e35cf143b8",
  "jwks_url": "https://qwed-security-334760594829.us-central1.run.app/.well-known/jwks.json",
  "kid": "565ad0864f75bdbb"
}

sieve-by-fendora · 2026-11-13T04:45:44Z

Sieve Security Scan ✅

No likely vulnerabilities found in changed files.

0 real · 0 suppressed · 0 FP · 0 total

secuarden-ai · 2026-11-13T04:45:56Z

-    "pretty-bytes": "^7.1.3",
+    "minimatch": "^11.0.5",
+    "pixi.js": "^8.22.0",
+    "preact": "^11.2.0",


🟡 Medium: Major version bump with insufficient vetting — preact ^11.2.0

🎟️ Issue Explanation

The dependency 'preact' is bumped from ^10.x to ^11.x, a major version change. Major version bumps can introduce breaking changes or new APIs that alter security-relevant behaviors (e.g., XSS sanitization, rendering escaping logic). Preact is used for server-side rendering (preact-render-to-string is also bumped), and regressions in HTML escaping or hydration security in a major release could introduce XSS vectors. As of the diff date, preact v11 is a relatively new major release whose security posture has not been broadly battle-tested.

🛠️ Actions

@secuarden-ai /fix - Generate remediation code for this issue

@secuarden-ai /explain - Learn why this matters and potential impact

@secuarden-ai /ignore [reason] - Dismiss this finding

@secuarden-ai /review - Submit a reasoned assessment and request a rescan

🔐 Secuarden Security Review • Finding: SEC_6d368111228f

secuarden-ai · 2026-11-13T04:45:57Z

+    "prettier": "^3.9.10",
    "tsx": "^4.23.15",
-    "typescript": "^5.9.3"
+    "typescript": "^7.0.2"


🟡 Medium: Major version bump with insufficient vetting — typescript ^7.0.2

🎟️ Issue Explanation

TypeScript is bumped from ^5.x to ^7.x, skipping an entire major version. While TypeScript is a devDependency and does not ship to production directly, the TypeScript compiler and language services are sometimes used in build pipelines that process untrusted input (e.g., user-supplied content types). More importantly, rapid major version jumps in build tooling have historically introduced supply-chain risks when the ecosystem around a new major version is immature. The gap from 5.x to 7.x (skipping 6.x entirely) is unusual and warrants verification that this is an intentional, vetted upgrade to a legitimate release rather than a dependency confusion or typosquatting artifact.

🛠️ Actions

@secuarden-ai /fix - Generate remediation code for this issue

@secuarden-ai /explain - Learn why this matters and potential impact

@secuarden-ai /ignore [reason] - Dismiss this finding

@secuarden-ai /review - Submit a reasoned assessment and request a rescan

🔐 Secuarden Security Review • Finding: SEC_601027b9d7b7

secuarden-ai · 2026-11-13T04:45:58Z

-    "serve-handler": "^6.1.6",
-    "sharp": "^0.35.4",
-    "shiki": "^4.4.3",
+    "satori": "^0.63.2",


🟢 Low: New dependency introduction — satori ^0.63.2

🎟️ Issue Explanation

A previously absent dependency 'satori' is added. Satori is a library that converts HTML/CSS to SVG, and it processes markup that may originate from user-supplied content (e.g., OG image generation). If unsanitized user input is passed to satori, it could lead to SVG injection or server-side resource exhaustion. The addition of an entirely new dependency also expands the supply-chain attack surface.

🛠️ Actions

@secuarden-ai /fix - Generate remediation code for this issue

@secuarden-ai /explain - Learn why this matters and potential impact

@secuarden-ai /ignore [reason] - Dismiss this finding

@secuarden-ai /review - Submit a reasoned assessment and request a rescan

🔐 Secuarden Security Review • Finding: SEC_1c80cd5ea890

fix-sense · 2026-11-13T04:45:59Z

FixSense — no test report found

@loganfinney27 — you installed FixSense on this repository, so this one is for you.

Reminder 2 — this repository still has no test report for FixSense to read.

FixSense saw this run fail, but the run didn't publish a test report, so there was nothing to analyse. No analysis was used from your quota.

To get analyses on this repo, have your test command emit JUnit XML and upload it as a CI artifact.

Playwright, in playwright.config.ts:

reporter: [
  ['junit', { outputFile: 'test-results/results.xml' }],
  ['html'],              // keep whatever you already use
],

Then publish it:

- name: Upload test results
  if: always()            # keep the report even when tests fail
  uses: actions/upload-artifact@v4
  with:
    name: test-results
    path: test-results/

if: always() (or when: always) is the part people miss — without it the upload is skipped on exactly the runs that matter, because a failed test step ends the job first.

Cypress, Jest, Vitest, Mocha and pytest all have JUnit reporters too, and FixSense reads any of them.

_{At most one note a month per repository, and none once a report is published. Setup guide · FixSense}

secuarden-ai · 2026-11-13T04:46:05Z

Invalid command format

To invoke the bot, use:

@secuarden-ai /command [arguments]

Available commands:

@secuarden-ai /fix SEC_ID - Generate a fix for a finding
@secuarden-ai /explain - Explain why this finding matters
@secuarden-ai /ignore SEC_ID [reason] - Suppress a finding
@secuarden-ai /rerun - Re-scan this PR
@secuarden-ai /review - Submit per-finding reassessment feedback (see review format below)

codacy-production · 2026-11-13T04:46:33Z

Not up to standards ⛔

🔴 Issues 1 medium

Alerts:
⚠ 1 issue (≤ 0 issues of at least minor severity)

Results:
1 new issue

Category Results

Security 1 medium

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

llamapreview

LlamaPReview — Blocking issues found

TypeScript 7 makes the existing check fail because node module resolution was removed.

Exact-head CI remains unresolved (2 failed, 2 action required, 1 pending); no CI-dependent merge-safety claim is made.

Owner action: Update the module-resolution configuration for TypeScript 7 and address resulting compatibility issues, or keep TypeScript on a compatible version; then rerun the check and tests.

1 further item in details.

Review details and evidence

Priority	File	Finding	Evidence
P1	`package.json`	TypeScript 7 makes the existing check fail because `node` module resolution was removed.	confirmed

Material unknowns

The complete changed lockfile was unavailable, so the other claimed resolved-version updates—especially esbuild—could not be confirmed. The manifest updates most declared ranges, but the unresolved lockfile entries prevent confirming all claimed resolved versions. This does not change the request-changes posture because the compiler incompatibility independently blocks the PR.
- Check: Inspect the complete lockfile and verify the claimed resolved-version updates, especially esbuild.

LlamaPReview checks

Reviewed changed regions in package.json.
Read the complete PR-head file package.json.
Read bounded PR-head context from tsconfig.json.
Read the complete PR-head file .github/workflows/test.yml.
Reviewed changed regions in package-lock.json.
Read bounded PR-head context from package-lock.json.

Still coding alone? Open CarbonChat, a chat room right inside Codex.

llamapreview · 2026-11-13T04:51:01Z

+    "prettier": "^3.9.10",
    "tsx": "^4.23.15",
-    "typescript": "^5.9.3"
+    "typescript": "^7.0.2"


P1 | Confidence: High

The PR upgrades TypeScript but leaves tsconfig.json set to moduleResolution: "node". The exact-head test run installs dependencies, then npm run check fails with TS5108 because moduleResolution=node10 has been removed. The check runs tsc --noEmit first, so formatting is not checked and the workflow does not reach its test step. This is a compiler-configuration incompatibility introduced by the upgrade, not merely an unattributed CI failure.

Conceptual guidance (not a committable GitHub suggestion):

Update the module-resolution configuration for TypeScript 7 and address resulting compatibility issues, or retain a compatible TypeScript version.

Evidence: changed region in package.json; PR-head read of package.json; bounded PR-head context from tsconfig.json; test check diagnostic.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 13, 2026

pull-request-size Bot added the size/M label Nov 13, 2026

gitginie Bot reviewed Nov 13, 2026

View reviewed changes

inspect-review Bot reviewed Nov 13, 2026

View reviewed changes

secuarden-ai Bot reviewed Nov 13, 2026

View reviewed changes

llamapreview Bot reviewed Nov 13, 2026

View reviewed changes

Conversation

dependabot Bot commented on behalf of github Nov 13, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​clack/prompts@​1.9.0

Minor Changes

Patch Changes

1.9.0

Minor Changes

Patch Changes

6.0.0

High-level changes

API changes

Fixes

Misc

6.0.0 (2026-10-19)

High-level changes

API changes

Fixes

v7.9.2

v7.9.1

v3.7.0 Hasta la vista

9.0.6

Fix

2.3.7

Fix

Dependencies

[5.5.0] - 2026-10-16

Changed

Fixed

[5.4.3] - 2026-10-06

Fixed

3.0.4

3.0.3

change log

11.0

v8.22.0

💾 Download

Changed

🚨 Behavior Change

🎁 Added

11.2.0

Features

Fixes

Performance

11.1.1

Fixes

Types

11.1.0

Features

Fixes

Types

Compatibility

11.0.2

Fixes

Uh oh!

semanticdiff-com Bot commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitnotebooks Bot commented Nov 13, 2026

Uh oh!

code-genius-code-coverage Bot commented Nov 13, 2026

Uh oh!

codereviewbot-ai Bot commented Nov 13, 2026

Uh oh!

gitginie Bot left a comment

Choose a reason for hiding this comment

Uh oh!

codeant-ai Bot commented Nov 13, 2026

Uh oh!

coderabbitai Bot commented Nov 13, 2026

Review skipped

Uh oh!

zaxion-governance Bot commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛡️ Zaxion Policy Status: 🟢 PASS

Gateway Passed

Uh oh!

precogs-ai Bot commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Precogs scan complete — No security issues found

dependabot Bot commented on behalf of github Nov 13, 2026 •

edited by cubic-dev-ai Bot

Loading

`@clack/prompts@1`.9.0

semanticdiff-com Bot commented Nov 13, 2026 •

edited

Loading

zaxion-governance Bot commented Nov 13, 2026 •

edited

Loading

precogs-ai Bot commented Nov 13, 2026 •

edited

Loading