From 3d675cd3ee92e751d476a08706ee2007ca9f04d8 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:38:49 -0400 Subject: [PATCH 01/22] refresh express to 4.22.3 and body-parser to 1.20.9 express 4.21.2 pinned body-parser 1.20.3 and path-to-regexp 0.1.12 exactly (both high). express 4.22.3, within ember-cli's and testem's ^4 ranges, takes body-parser ~1.20.5 and path-to-regexp ~0.1.13; the caret body-parser ranges from ember-a11y-testing and @scalvert/ember-setup-middleware-reporter are refreshed onto the same 1.20.9. Lockfile refresh only. testem serves the test run through express. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 280 +++++++++++++++++++++++++++++------------------------- 1 file changed, 148 insertions(+), 132 deletions(-) diff --git a/yarn.lock b/yarn.lock index 4915446f7..dceadb85b 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1,6 +1,7 @@ # THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY. # yarn lockfile v1 + "@babel/code-frame@7.12.11": version "7.12.11" resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.12.11.tgz#f4ad435aa263db935b8f10f2c552d23fb716a63f" @@ -2018,6 +2019,11 @@ ansi-escapes@^4.2.1, ansi-escapes@^4.3.0: dependencies: type-fest "^0.21.3" +ansi-html@0.0.9, ansi-html@^0.0.7: + version "0.0.9" + resolved "https://registry.yarnpkg.com/ansi-html/-/ansi-html-0.0.9.tgz#6512d02342ae2cc68131952644a129cb734cd3f0" + integrity sha512-ozbS3LuenHVxNRh/wdnN16QapUHzauqSomAl1jwwJRRsGwFwtj644lIhxfWu0Fy0acCij2+AEgHvjscq3dlVXg== + ansi-regex@^2.0.0: version "2.1.1" resolved "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-2.1.1.tgz#c3b33ab5ee360d86e0e628f0468ae7ef27d654df" @@ -2530,23 +2536,23 @@ blueimp-md5@^2.10.0: resolved "https://registry.yarnpkg.com/blueimp-md5/-/blueimp-md5-2.19.0.tgz#b53feea5498dcb53dc6ec4b823adb84b729c4af0" integrity sha512-DRQrD6gJyy8FbiE4s+bDoXS9hiW3Vbx5uCdwvcCf3zLHL+Iv7LtGHLpr+GZV8rHG8tK766FGYBwRbu8pELTt+w== -body-parser@1.20.3, body-parser@^1.17.0, body-parser@^1.19.0, body-parser@^1.20.0: - version "1.20.3" - resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.20.3.tgz#1953431221c6fb5cd63c4b36d53fab0928e548c6" - integrity sha512-7rAxByjUMqQ3/bHJy7D6OGXvx/MMc4IqBn/X0fcM1QUcAItpZrBEYhWGem+tzXH90c+G01ypMcYJBO9Y30203g== +body-parser@^1.17.0, body-parser@^1.19.0, body-parser@^1.20.0, body-parser@~1.20.5: + version "1.20.9" + resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.20.9.tgz#b64358a113b4d200d7484752cd154b66933e2009" + integrity sha512-FISIQxV5u91Y9gvuFq3q/tA/qTqLJn3AhRcEvyozyhJTh5OBFFtv827AdHU7Rbyct4r+Ba1/99oFa1Y3yuFsdw== dependencies: - bytes "3.1.2" + bytes "~3.1.2" content-type "~1.0.5" debug "2.6.9" depd "2.0.0" - destroy "1.2.0" - http-errors "2.0.0" - iconv-lite "0.4.24" - on-finished "2.4.1" - qs "6.13.0" - raw-body "2.5.2" + destroy "~1.2.0" + http-errors "~2.0.1" + iconv-lite "~0.4.24" + on-finished "~2.4.1" + qs "~6.16.0" + raw-body "~2.5.3" type-is "~1.6.18" - unpipe "1.0.0" + unpipe "~1.0.0" body@^5.1.0: version "5.1.0" @@ -3164,7 +3170,7 @@ bytes@1: resolved "https://registry.yarnpkg.com/bytes/-/bytes-1.0.0.tgz#3569ede8ba34315fab99c3e92cb04c7220de1fa8" integrity sha512-/x68VkHLeTl3/Ll8IvxdwzhrT+IyKc52e/oyHhA2RwqPqswSnjVbSddfPRwAsJtbilMAPSRWwAlpxdYsSWOTKQ== -bytes@3.1.2: +bytes@3.1.2, bytes@~3.1.2: version "3.1.2" resolved "https://registry.yarnpkg.com/bytes/-/bytes-3.1.2.tgz#8b0beeb98605adf1b128fa4386403c009e0221a5" integrity sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg== @@ -3704,7 +3710,7 @@ consolidate@^0.16.0: dependencies: bluebird "^3.7.2" -content-disposition@0.5.4: +content-disposition@~0.5.4: version "0.5.4" resolved "https://registry.yarnpkg.com/content-disposition/-/content-disposition-0.5.4.tgz#8b82b4efac82512a02bb0b1dcec9d2c5e8eb5bfe" integrity sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ== @@ -3731,22 +3737,17 @@ convert-source-map@^2.0.0: resolved "https://registry.yarnpkg.com/convert-source-map/-/convert-source-map-2.0.0.tgz#4b560f649fc4e918dd0ab75cf4961e8bc882d82a" integrity sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg== -cookie-signature@1.0.6: - version "1.0.6" - resolved "https://registry.yarnpkg.com/cookie-signature/-/cookie-signature-1.0.6.tgz#e303a882b342cc3ee8ca513a79999734dab3ae2c" - integrity sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ== - -cookie@0.7.1: - version "0.7.1" - resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.7.1.tgz#2f73c42142d5d5cf71310a74fc4ae61670e5dbc9" - integrity sha512-6DnInpx7SJ2AK3+CTUE/ZM0vWTUboZCegxhC2xiIydHR9jNuTAASBrfEpHhiGOZw/nX51bHt6YQl8jsGo4y/0w== +cookie-signature@~1.0.6: + version "1.0.7" + resolved "https://registry.yarnpkg.com/cookie-signature/-/cookie-signature-1.0.7.tgz#ab5dd7ab757c54e60f37ef6550f481c426d10454" + integrity sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA== cookie@^0.4.1: version "0.4.2" resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.4.2.tgz#0e41f24de5ecf317947c82fc789e06a884824432" integrity sha512-aSWTXFzaKWkvHO1Ny/s+ePFpvKsPnjc551iI41v3ny/ow6tBG5Vd+FuqGNhh1LxOmVzOlGUriIlOaokOvhaStA== -cookie@~0.7.2: +cookie@~0.7.1, cookie@~0.7.2: version "0.7.2" resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.7.2.tgz#556369c472a2ba910f2979891b526b3436237ed7" integrity sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w== @@ -4088,7 +4089,7 @@ depd@~1.1.2: resolved "https://registry.yarnpkg.com/depd/-/depd-1.1.2.tgz#9bcd52e14c097763e749b274c4346ed2e560b5a9" integrity sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ== -destroy@1.2.0: +destroy@1.2.0, destroy@~1.2.0: version "1.2.0" resolved "https://registry.yarnpkg.com/destroy/-/destroy-1.2.0.tgz#4803735509ad8be552934c67df614f94e66fa015" integrity sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg== @@ -5654,38 +5655,38 @@ expand-tilde@^2.0.0, expand-tilde@^2.0.2: homedir-polyfill "^1.0.1" express@^4.10.7, express@^4.17.1: - version "4.21.2" - resolved "https://registry.yarnpkg.com/express/-/express-4.21.2.tgz#cf250e48362174ead6cea4a566abef0162c1ec32" - integrity sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA== + version "4.22.3" + resolved "https://registry.yarnpkg.com/express/-/express-4.22.3.tgz#e8f898d3c17582b1e311dd2c5cd6d8deff84724b" + integrity sha512-Bdcs4+3qlpVlx2NRn6fgX2Ue2/gGRaPeawebgclM0ERSCqDpA+owF1fdPwjJUTAJWMTuAaxjDf+hzb0/4eKvvw== dependencies: accepts "~1.3.8" array-flatten "1.1.1" - body-parser "1.20.3" - content-disposition "0.5.4" + body-parser "~1.20.5" + content-disposition "~0.5.4" content-type "~1.0.4" - cookie "0.7.1" - cookie-signature "1.0.6" + cookie "~0.7.1" + cookie-signature "~1.0.6" debug "2.6.9" depd "2.0.0" encodeurl "~2.0.0" escape-html "~1.0.3" etag "~1.8.1" - finalhandler "1.3.1" - fresh "0.5.2" - http-errors "2.0.0" + finalhandler "~1.3.1" + fresh "~0.5.2" + http-errors "~2.0.0" merge-descriptors "1.0.3" methods "~1.1.2" - on-finished "2.4.1" + on-finished "~2.4.1" parseurl "~1.3.3" - path-to-regexp "0.1.12" + path-to-regexp "~0.1.13" proxy-addr "~2.0.7" - qs "6.13.0" + qs "~6.16.0" range-parser "~1.2.1" safe-buffer "5.2.1" - send "0.19.0" - serve-static "1.16.2" + send "~0.19.0" + serve-static "~1.16.2" setprototypeof "1.2.0" - statuses "2.0.1" + statuses "~2.0.1" type-is "~1.6.18" utils-merge "1.0.1" vary "~1.1.2" @@ -5903,17 +5904,17 @@ finalhandler@1.1.2: statuses "~1.5.0" unpipe "~1.0.0" -finalhandler@1.3.1: - version "1.3.1" - resolved "https://registry.yarnpkg.com/finalhandler/-/finalhandler-1.3.1.tgz#0c575f1d1d324ddd1da35ad7ece3df7d19088019" - integrity sha512-6BN9trH7bp3qvnrRyzsBz+g3lZxTNZTbVO2EV1CS0WIcDbawYVdYvGflME/9QP0h0pYlCDBCTjYa9nZzMDpyxQ== +finalhandler@~1.3.1: + version "1.3.2" + resolved "https://registry.yarnpkg.com/finalhandler/-/finalhandler-1.3.2.tgz#1ebc2228fc7673aac4a472c310cc05b77d852b88" + integrity sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg== dependencies: debug "2.6.9" encodeurl "~2.0.0" escape-html "~1.0.3" - on-finished "2.4.1" + on-finished "~2.4.1" parseurl "~1.3.3" - statuses "2.0.1" + statuses "~2.0.2" unpipe "~1.0.0" find-babel-config@^1.1.0, find-babel-config@^1.2.0: @@ -6109,7 +6110,7 @@ fragment-cache@^0.2.1: dependencies: map-cache "^0.2.2" -fresh@0.5.2: +fresh@~0.5.2: version "0.5.2" resolved "https://registry.yarnpkg.com/fresh/-/fresh-0.5.2.tgz#3d8cadd90d976569fa835ab1f8e4b23a105605a7" integrity sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q== @@ -6803,17 +6804,6 @@ html-encoding-sniffer@^3.0.0: dependencies: whatwg-encoding "^2.0.0" -http-errors@2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/http-errors/-/http-errors-2.0.0.tgz#b7774a1486ef73cf7667ac9ae0858c012c57b9d3" - integrity sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ== - dependencies: - depd "2.0.0" - inherits "2.0.4" - setprototypeof "1.2.0" - statuses "2.0.1" - toidentifier "1.0.1" - http-errors@~1.6.2: version "1.6.3" resolved "https://registry.yarnpkg.com/http-errors/-/http-errors-1.6.3.tgz#8b55680bb4be283a0b5bf4ea2e38580be1d9320d" @@ -6824,6 +6814,17 @@ http-errors@~1.6.2: setprototypeof "1.1.0" statuses ">= 1.4.0 < 2" +http-errors@~2.0.0, http-errors@~2.0.1: + version "2.0.1" + resolved "https://registry.yarnpkg.com/http-errors/-/http-errors-2.0.1.tgz#36d2f65bc909c8790018dd36fb4d93da6caae06b" + integrity sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ== + dependencies: + depd "~2.0.0" + inherits "~2.0.4" + setprototypeof "~1.2.0" + statuses "~2.0.2" + toidentifier "~1.0.1" + http-parser-js@>=0.5.1: version "0.5.10" resolved "https://registry.yarnpkg.com/http-parser-js/-/http-parser-js-0.5.10.tgz#b3277bd6d7ed5588e20ea73bf724fcbe44609075" @@ -6894,13 +6895,6 @@ husky@^4.3.8: slash "^3.0.0" which-pm-runs "^1.0.0" -iconv-lite@0.4.24, iconv-lite@^0.4.13, iconv-lite@^0.4.24: - version "0.4.24" - resolved "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.4.24.tgz#2022b4b25fbddc21d2f524974a474aafe733908b" - integrity sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA== - dependencies: - safer-buffer ">= 2.1.2 < 3" - iconv-lite@0.6.3: version "0.6.3" resolved "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.6.3.tgz#a52f80bf38da1952eb5c681790719871a1a72501" @@ -6908,6 +6902,13 @@ iconv-lite@0.6.3: dependencies: safer-buffer ">= 2.1.2 < 3.0.0" +iconv-lite@^0.4.13, iconv-lite@^0.4.24, iconv-lite@~0.4.24: + version "0.4.24" + resolved "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.4.24.tgz#2022b4b25fbddc21d2f524974a474aafe733908b" + integrity sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA== + dependencies: + safer-buffer ">= 2.1.2 < 3" + icss-utils@^5.0.0, icss-utils@^5.1.0: version "5.1.0" resolved "https://registry.yarnpkg.com/icss-utils/-/icss-utils-5.1.0.tgz#c6be6858abd013d768e98366ae47e25d5887b1ae" @@ -6959,7 +6960,7 @@ inflight@^1.0.4: once "^1.3.0" wrappy "1" -inherits@2, inherits@2.0.4, inherits@^2.0.1, inherits@^2.0.3, inherits@^2.0.4, inherits@~2.0.1: +inherits@2, inherits@^2.0.1, inherits@^2.0.3, inherits@^2.0.4, inherits@~2.0.1, inherits@~2.0.4: version "2.0.4" resolved "https://registry.yarnpkg.com/inherits/-/inherits-2.0.4.tgz#0fa2c64f932917c3433a0ded55363aae37416b7c" integrity sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ== @@ -7956,6 +7957,14 @@ lodash.restparam@^3.0.0: resolved "https://registry.yarnpkg.com/lodash.restparam/-/lodash.restparam-3.6.1.tgz#936a4e309ef330a7645ed4145986c85ae5b20805" integrity sha512-L4/arjjuq4noiUJpt3yS6KIKDtJwNe2fIYgMqyYYKoeIfV1iEqvPwhCx23o+R9dzouGihDAPN1dTIRWa7zk8tw== +lodash.template@^4.18.1, lodash.template@^4.5.0: + version "4.18.1" + resolved "https://registry.yarnpkg.com/lodash.template/-/lodash.template-4.18.1.tgz#9968d00568070d03e358505b5a28b0cbd8fbfd5f" + integrity sha512-5urZrLnV/VD6zHK5KsVtZgt7H19v51mIzoS0aBNH8yp3I8tbswrEjOABOPY8m8uB7NuibubLrMX+Y0PXsU9X+w== + dependencies: + lodash._reinterpolate "^3.0.0" + lodash.templatesettings "^4.0.0" + lodash.templatesettings@^4.0.0: version "4.2.0" resolved "https://registry.yarnpkg.com/lodash.templatesettings/-/lodash.templatesettings-4.2.0.tgz#e481310f049d3cf6d47e912ad09313b154f0fb33" @@ -8675,13 +8684,6 @@ object.pick@^1.3.0: dependencies: isobject "^3.0.1" -on-finished@2.4.1: - version "2.4.1" - resolved "https://registry.yarnpkg.com/on-finished/-/on-finished-2.4.1.tgz#58c8c44116e54845ad57f14ab10b03533184ac3f" - integrity sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg== - dependencies: - ee-first "1.1.1" - on-finished@~2.3.0: version "2.3.0" resolved "https://registry.yarnpkg.com/on-finished/-/on-finished-2.3.0.tgz#20f1336481b083cd75337992a16971aa2d906947" @@ -8689,6 +8691,13 @@ on-finished@~2.3.0: dependencies: ee-first "1.1.1" +on-finished@~2.4.1: + version "2.4.2" + resolved "https://registry.yarnpkg.com/on-finished/-/on-finished-2.4.2.tgz#6932b04b95bf6a4828201db10af75fe5c9c38b73" + integrity sha512-ATWUv387i+nLD49EiDoOft5scf32Vsdz3ktrQJG9bi7jRFmaXTssvyvj1EmeKVVgvesbqUtvQQvaS2TpTukAZQ== + dependencies: + ee-first "1.1.1" + on-headers@~1.0.2: version "1.0.2" resolved "https://registry.yarnpkg.com/on-headers/-/on-headers-1.0.2.tgz#772b0ae6aaa525c399e489adfad90c403eb3c28f" @@ -8979,11 +8988,6 @@ path-root@^0.1.1: dependencies: path-root-regex "^0.1.0" -path-to-regexp@0.1.12: - version "0.1.12" - resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.12.tgz#d5e1a12e478a976d432ef3c58d534b9923164bb7" - integrity sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ== - path-to-regexp@^1.7.0: version "1.9.0" resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-1.9.0.tgz#5dc0753acbf8521ca2e0f137b4578b917b10cf24" @@ -8991,6 +8995,11 @@ path-to-regexp@^1.7.0: dependencies: isarray "0.0.1" +path-to-regexp@~0.1.13: + version "0.1.13" + resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.13.tgz#9b22ec16bc3ab88d05a0c7e369869421401ab17d" + integrity sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA== + path-type@^3.0.0: version "3.0.0" resolved "https://registry.yarnpkg.com/path-type/-/path-type-3.0.0.tgz#cef31dc8e0a1a3bb0d105c0cd97cf3bf47f4e36f" @@ -9266,13 +9275,6 @@ punycode@^2.1.0, punycode@^2.1.1, punycode@^2.3.1: resolved "https://registry.yarnpkg.com/punycode/-/punycode-2.3.1.tgz#027422e2faec0b25e1549c3e1bd8309b9133b6e5" integrity sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg== -qs@6.13.0: - version "6.13.0" - resolved "https://registry.yarnpkg.com/qs/-/qs-6.13.0.tgz#6ca3bd58439f7e245655798997787b0d88a51906" - integrity sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg== - dependencies: - side-channel "^1.0.6" - qs@^6.4.0: version "6.14.0" resolved "https://registry.yarnpkg.com/qs/-/qs-6.14.0.tgz#c63fa40680d2c5c941412a0e899c89af60c0a930" @@ -9280,6 +9282,14 @@ qs@^6.4.0: dependencies: side-channel "^1.1.0" +qs@~6.16.0: + version "6.16.2" + resolved "https://registry.yarnpkg.com/qs/-/qs-6.16.2.tgz#f7f5a606730f013f4f4ea62a8025f37be0f8c09c" + integrity sha512-VYdnB5S7/0IeXzBacUtwNAaM6d7Y/PgYnNC7bJCI6meqA/OgnsQbZMtVW8Dt2D1PHgbHGtYmhSoEIgvt7xZ2ZA== + dependencies: + es-define-property "^1.0.1" + side-channel "^1.1.1" + querystringify@^2.1.1: version "2.2.0" resolved "https://registry.yarnpkg.com/querystringify/-/querystringify-2.2.0.tgz#3345941b4153cb9d082d8eee4cda2016a9aef7f6" @@ -9338,16 +9348,6 @@ range-parser@~1.2.1: resolved "https://registry.yarnpkg.com/range-parser/-/range-parser-1.2.1.tgz#3cf37023d199e1c24d1a55b84800c2f3e6468031" integrity sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg== -raw-body@2.5.2: - version "2.5.2" - resolved "https://registry.yarnpkg.com/raw-body/-/raw-body-2.5.2.tgz#99febd83b90e08975087e8f1f9419a149366b68a" - integrity sha512-8zGqypfENjCIqGhgXToC8aB2r7YrBX+AQAfIPs/Mlk+BtPTztOvTS01NRW/3Eh60J+a48lt8qsCzirQ6loCVfA== - dependencies: - bytes "3.1.2" - http-errors "2.0.0" - iconv-lite "0.4.24" - unpipe "1.0.0" - raw-body@~1.1.0: version "1.1.7" resolved "https://registry.yarnpkg.com/raw-body/-/raw-body-1.1.7.tgz#1d027c2bfa116acc6623bca8f00016572a87d425" @@ -9356,6 +9356,16 @@ raw-body@~1.1.0: bytes "1" string_decoder "0.10" +raw-body@~2.5.3: + version "2.5.3" + resolved "https://registry.yarnpkg.com/raw-body/-/raw-body-2.5.3.tgz#11c6650ee770a7de1b494f197927de0c923822e2" + integrity sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA== + dependencies: + bytes "~3.1.2" + http-errors "~2.0.1" + iconv-lite "~0.4.24" + unpipe "~1.0.0" + rc@^1.0.1, rc@^1.1.6: version "1.2.8" resolved "https://registry.yarnpkg.com/rc/-/rc-1.2.8.tgz#cd924bf5200a075b83c188cd6b9e211b7fc0d3ed" @@ -9898,24 +9908,24 @@ semver@^7.2.1, semver@^7.3.2, semver@^7.3.4, semver@^7.3.5, semver@^7.3.8: resolved "https://registry.yarnpkg.com/semver/-/semver-7.7.2.tgz#67d99fdcd35cec21e6f8b87a7fd515a33f982b58" integrity sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA== -send@0.19.0: - version "0.19.0" - resolved "https://registry.yarnpkg.com/send/-/send-0.19.0.tgz#bbc5a388c8ea6c048967049dbeac0e4a3f09d7f8" - integrity sha512-dW41u5VfLXu8SJh5bwRmyYUbAoSB3c9uQh6L8h/KtsFREPWpbX1lrljJo186Jc4nmci/sGUZ9a0a0J2zgfq2hw== +send@~0.19.0, send@~0.19.1: + version "0.19.2" + resolved "https://registry.yarnpkg.com/send/-/send-0.19.2.tgz#59bc0da1b4ea7ad42736fd642b1c4294e114ff29" + integrity sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg== dependencies: debug "2.6.9" depd "2.0.0" destroy "1.2.0" - encodeurl "~1.0.2" + encodeurl "~2.0.0" escape-html "~1.0.3" etag "~1.8.1" - fresh "0.5.2" - http-errors "2.0.0" + fresh "~0.5.2" + http-errors "~2.0.1" mime "1.6.0" ms "2.1.3" - on-finished "2.4.1" + on-finished "~2.4.1" range-parser "~1.2.1" - statuses "2.0.1" + statuses "~2.0.2" serialize-javascript@5.0.1: version "5.0.1" @@ -9931,15 +9941,15 @@ serialize-javascript@^6.0.2: dependencies: randombytes "^2.1.0" -serve-static@1.16.2: - version "1.16.2" - resolved "https://registry.yarnpkg.com/serve-static/-/serve-static-1.16.2.tgz#b6a5343da47f6bdd2673848bf45754941e803296" - integrity sha512-VqpjJZKadQB/PEbEwvFdO43Ax5dFBZ2UECszz8bQ7pi7wt//PWe1P6MN7eCnjsatYtBT6EuiClbjSWP2WrIoTw== +serve-static@~1.16.2: + version "1.16.3" + resolved "https://registry.yarnpkg.com/serve-static/-/serve-static-1.16.3.tgz#a97b74d955778583f3862a4f0b841eb4d5d78cf9" + integrity sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA== dependencies: encodeurl "~2.0.0" escape-html "~1.0.3" parseurl "~1.3.3" - send "0.19.0" + send "~0.19.1" set-blocking@^2.0.0: version "2.0.0" @@ -9992,7 +10002,7 @@ setprototypeof@1.1.0: resolved "https://registry.yarnpkg.com/setprototypeof/-/setprototypeof-1.1.0.tgz#d0bd85536887b6fe7c0d818cb962d9d91c54e656" integrity sha512-BvE/TwpZX4FXExxOxZyRGQQv651MSwmWKZGqvmPcRIjDqWub67kTKuIMx43cZZrS/cBBzwBcNDWoFxt2XEFIpQ== -setprototypeof@1.2.0: +setprototypeof@1.2.0, setprototypeof@~1.2.0: version "1.2.0" resolved "https://registry.yarnpkg.com/setprototypeof/-/setprototypeof-1.2.0.tgz#66c9a24a73f9fc28cbe66b09fed3d33dcaf1b424" integrity sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw== @@ -10039,6 +10049,14 @@ side-channel-list@^1.0.0: es-errors "^1.3.0" object-inspect "^1.13.3" +side-channel-list@^1.0.1: + version "1.0.1" + resolved "https://registry.yarnpkg.com/side-channel-list/-/side-channel-list-1.0.1.tgz#c2e0b5a14a540aebee3bbc6c3f8666cc9b509127" + integrity sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w== + dependencies: + es-errors "^1.3.0" + object-inspect "^1.13.4" + side-channel-map@^1.0.1: version "1.0.1" resolved "https://registry.yarnpkg.com/side-channel-map/-/side-channel-map-1.0.1.tgz#d6bb6b37902c6fef5174e5f533fab4c732a26f42" @@ -10060,7 +10078,7 @@ side-channel-weakmap@^1.0.2: object-inspect "^1.13.3" side-channel-map "^1.0.1" -side-channel@^1.0.6, side-channel@^1.1.0: +side-channel@^1.1.0: version "1.1.0" resolved "https://registry.yarnpkg.com/side-channel/-/side-channel-1.1.0.tgz#c3fcff9c4da932784873335ec9765fa94ff66bc9" integrity sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw== @@ -10071,6 +10089,17 @@ side-channel@^1.0.6, side-channel@^1.1.0: side-channel-map "^1.0.1" side-channel-weakmap "^1.0.2" +side-channel@^1.1.1: + version "1.1.1" + resolved "https://registry.yarnpkg.com/side-channel/-/side-channel-1.1.1.tgz#ea02c62e05dc4bea67d4442f0fb71ee192f8e0ab" + integrity sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ== + dependencies: + es-errors "^1.3.0" + object-inspect "^1.13.4" + side-channel-list "^1.0.1" + side-channel-map "^1.0.1" + side-channel-weakmap "^1.0.2" + signal-exit@^3.0.0, signal-exit@^3.0.2, signal-exit@^3.0.3, signal-exit@^3.0.7: version "3.0.7" resolved "https://registry.yarnpkg.com/signal-exit/-/signal-exit-3.0.7.tgz#a9a1767f8af84155114eaabd73f99273c8f59ad9" @@ -10338,16 +10367,16 @@ static-extend@^0.1.1: define-property "^0.2.5" object-copy "^0.1.0" -statuses@2.0.1: - version "2.0.1" - resolved "https://registry.yarnpkg.com/statuses/-/statuses-2.0.1.tgz#55cb000ccf1d48728bd23c685a063998cf1a1b63" - integrity sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ== - "statuses@>= 1.4.0 < 2", statuses@~1.5.0: version "1.5.0" resolved "https://registry.yarnpkg.com/statuses/-/statuses-1.5.0.tgz#161c7dac177659fd9811f43771fa99381478628c" integrity sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA== +statuses@~2.0.1, statuses@~2.0.2: + version "2.0.2" + resolved "https://registry.yarnpkg.com/statuses/-/statuses-2.0.2.tgz#8f75eecef765b5e1cfcdc080da59409ed424e382" + integrity sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw== + stop-iteration-iterator@^1.1.0: version "1.1.0" resolved "https://registry.yarnpkg.com/stop-iteration-iterator/-/stop-iteration-iterator-1.1.0.tgz#f481ff70a548f6124d0312c3aa14cbfa7aa542ad" @@ -10842,7 +10871,7 @@ to-utf8@0.0.1: resolved "https://registry.yarnpkg.com/to-utf8/-/to-utf8-0.0.1.tgz#d17aea72ff2fba39b9e43601be7b3ff72e089852" integrity sha512-zks18/TWT1iHO3v0vFp5qLKOG27m67ycq/Y7a7cTiRuUNlc4gf3HGnkRgMv0NyhnfTamtkYBJl+YeD1/j07gBQ== -toidentifier@1.0.1: +toidentifier@~1.0.1: version "1.0.1" resolved "https://registry.yarnpkg.com/toidentifier/-/toidentifier-1.0.1.tgz#3be34321a88a820ed1bd80dfaa33e479fbb8dd35" integrity sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA== @@ -11114,7 +11143,7 @@ universalify@^2.0.0: resolved "https://registry.yarnpkg.com/universalify/-/universalify-2.0.1.tgz#168efc2180964e6386d061e094df61afe239b18d" integrity sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw== -unpipe@1.0.0, unpipe@~1.0.0: +unpipe@~1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/unpipe/-/unpipe-1.0.0.tgz#b2bf4ee8514aae6165b4817829d21b2ef49904ec" integrity sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ== @@ -11722,16 +11751,3 @@ yocto-queue@^0.1.0: version "0.1.0" resolved "https://registry.yarnpkg.com/yocto-queue/-/yocto-queue-0.1.0.tgz#0294eb3dee05028d31ee1a5fa2c556a6aaf10a1b" integrity sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q== - -lodash.template@^4.18.1, lodash.template@^4.5.0: - version "4.18.1" - resolved "https://registry.yarnpkg.com/lodash.template/-/lodash.template-4.18.1.tgz#9968d00568070d03e358505b5a28b0cbd8fbfd5f" - integrity sha512-5urZrLnV/VD6zHK5KsVtZgt7H19v51mIzoS0aBNH8yp3I8tbswrEjOABOPY8m8uB7NuibubLrMX+Y0PXsU9X+w== - dependencies: - lodash._reinterpolate "^3.0.0" - lodash.templatesettings "^4.0.0" - -ansi-html@0.0.9, ansi-html@^0.0.7: - version "0.0.9" - resolved "https://registry.yarnpkg.com/ansi-html/-/ansi-html-0.0.9.tgz#6512d02342ae2cc68131952644a129cb734cd3f0" - integrity sha512-ozbS3LuenHVxNRh/wdnN16QapUHzauqSomAl1jwwJRRsGwFwtj644lIhxfWu0Fy0acCij2+AEgHvjscq3dlVXg== From a90304ee9a403437cfad7a5d6de91441c4472768 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:41:46 -0400 Subject: [PATCH 02/22] refresh compression to 1.8.2 compression 1.8.0 (high) -> 1.8.2, within ember-cli's and testem's ^1.7.4 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/yarn.lock b/yarn.lock index dceadb85b..d6ba2ac07 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3648,15 +3648,16 @@ compressible@~2.0.18: mime-db ">= 1.43.0 < 2" compression@^1.7.4: - version "1.8.0" - resolved "https://registry.yarnpkg.com/compression/-/compression-1.8.0.tgz#09420efc96e11a0f44f3a558de59e321364180f7" - integrity sha512-k6WLKfunuqCYD3t6AsuPGvQWaKwuLLh2/xHNcX4qE+vIfDNXpSqnrhwA7O53R7WVQUnt8dVAIW+YHr7xTgOgGA== + version "1.8.2" + resolved "https://registry.yarnpkg.com/compression/-/compression-1.8.2.tgz#781397127ae2da00c0c5f7c76bda5b2a9b32a49f" + integrity sha512-o8vI5RE5A6EVVOd9o41jKp41aJom+QTEO/Bx8MYNjexMo/Bv2WOjUfZr+aL0WnYSgymUy6zeguqLTsIhV0gMvQ== dependencies: bytes "3.1.2" compressible "~2.0.18" debug "2.6.9" + destroy "1.2.0" negotiator "~0.6.4" - on-headers "~1.0.2" + on-headers "~1.1.0" safe-buffer "5.2.1" vary "~1.1.2" @@ -8703,6 +8704,11 @@ on-headers@~1.0.2: resolved "https://registry.yarnpkg.com/on-headers/-/on-headers-1.0.2.tgz#772b0ae6aaa525c399e489adfad90c403eb3c28f" integrity sha512-pZAE+FJLoyITytdqK0U5s+FIpjN0JP3OzFi/u8Rx+EV5/W+JTWGXG8xFzevE7AjBfDqHv/8vL8qQsIhHnqRkrA== +on-headers@~1.1.0: + version "1.1.0" + resolved "https://registry.yarnpkg.com/on-headers/-/on-headers-1.1.0.tgz#59da4f91c45f5f989c6e4bcedc5a3b0aed70ff65" + integrity sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A== + once@^1.3.0, once@^1.3.1, once@^1.4.0: version "1.4.0" resolved "https://registry.yarnpkg.com/once/-/once-1.4.0.tgz#583b1aa775961d4b113ac17d9c50baef9dd76bd1" From e0804962fd64eb04aa7f1e4c096f3ce67092325e Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:44:53 -0400 Subject: [PATCH 03/22] refresh engine.io to 6.6.11 engine.io 6.6.4 (high) -> 6.6.11, within socket.io's ~6.6.0 range. It brings its own ws ~8.21.0 (8.21.3). testem talks to the browser over socket.io. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/yarn.lock b/yarn.lock index d6ba2ac07..72f22a35c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1736,6 +1736,13 @@ resolved "https://registry.yarnpkg.com/@types/symlink-or-copy/-/symlink-or-copy-1.2.2.tgz#51b1c00b516a5774ada5d611e65eb123f988ef8d" integrity sha512-MQ1AnmTLOncwEf9IVU+B2e4Hchrku5N67NkgcAHW0p3sdzPe0FNMANxEm6OJUzPniEQGkeT3OROLlCwZJLWFZA== +"@types/ws@^8.5.12": + version "8.18.2" + resolved "https://registry.yarnpkg.com/@types/ws/-/ws-8.18.2.tgz#25d6321b30ef0fddf6cc7052b4eef9ce4e412b6e" + integrity sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w== + dependencies: + "@types/node" "*" + "@ungap/promise-all-settled@1.1.2": version "1.1.2" resolved "https://registry.yarnpkg.com/@ungap/promise-all-settled/-/promise-all-settled-1.1.2.tgz#aa58042711d6e3275dd37dc597e5d31e8c290a44" @@ -2460,7 +2467,7 @@ base64-js@^1.3.1: resolved "https://registry.yarnpkg.com/base64-js/-/base64-js-1.5.1.tgz#1b1b440160a5bf7ad40b650f095963481903930a" integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA== -base64id@2.0.0, base64id@~2.0.0: +base64id@~2.0.0: version "2.0.0" resolved "https://registry.yarnpkg.com/base64id/-/base64id-2.0.0.tgz#2770ac6bc47d312af97a8bf9a634342e0cd25cb6" integrity sha512-lGe34o6EHj9y3Kts9R4ZYs/Gr+6N7MCaMlIFA3F1R2O5/m7K06AxfSeO5530PEERE6/WyEg3lsuyw4GHlPZHog== @@ -3965,7 +3972,7 @@ debug@^3.0.1, debug@^3.1.0: dependencies: ms "^2.1.1" -debug@^4.4.3: +debug@^4.4.3, debug@~4.4.1: version "4.4.3" resolved "https://registry.yarnpkg.com/debug/-/debug-4.4.3.tgz#c6ae432d9bd9662582fce08709b038c58e9e3d6a" integrity sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA== @@ -5121,19 +5128,19 @@ engine.io-parser@~5.2.1: integrity sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q== engine.io@~6.6.0: - version "6.6.4" - resolved "https://registry.yarnpkg.com/engine.io/-/engine.io-6.6.4.tgz#0a89a3e6b6c1d4b0c2a2a637495e7c149ec8d8ee" - integrity sha512-ZCkIjSYNDyGn0R6ewHDtXgns/Zre/NT6Agvq1/WobF7JXgFff4SeDroKiCO3fNJreU9YG429Sc81o4w5ok/W5g== + version "6.6.11" + resolved "https://registry.yarnpkg.com/engine.io/-/engine.io-6.6.11.tgz#05203f76be9c63489cdf52aadab4200a201315fd" + integrity sha512-z34mGpLoY/82ZbkX1LqGMIaf3wjVMPL6gVC681QDqnmzJ26synI8qAE32P+a7UazmpJZ8UGrFIeAavgRfXzYrg== dependencies: "@types/cors" "^2.8.12" "@types/node" ">=10.0.0" + "@types/ws" "^8.5.12" accepts "~1.3.4" - base64id "2.0.0" cookie "~0.7.2" cors "~2.8.5" - debug "~4.3.1" + debug "~4.4.1" engine.io-parser "~5.2.1" - ws "~8.17.1" + ws "~8.21.0" enhanced-resolve@^5.17.1: version "5.18.1" @@ -11642,6 +11649,11 @@ ws@~8.17.1: resolved "https://registry.yarnpkg.com/ws/-/ws-8.17.1.tgz#9293da530bb548febc95371d90f9c878727d919b" integrity sha512-6XQFvXTkbfUOZOKKILFG1PDK2NDQs4azKQl26T0YS5CxqWLgXajbPZ+h4gZekJyRqFU8pvnbAbbs/3TgRPy+GQ== +ws@~8.21.0: + version "8.21.3" + resolved "https://registry.yarnpkg.com/ws/-/ws-8.21.3.tgz#660b4faddb6a3e575c86e078126919961f4de4fc" + integrity sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw== + xdg-basedir@^4.0.0: version "4.0.0" resolved "https://registry.yarnpkg.com/xdg-basedir/-/xdg-basedir-4.0.0.tgz#4bc8d9984403696225ef83a1573cbbcb4e79db13" From 5f5dd519c6164ee309f38863eefa27d7f55a21e0 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:48:17 -0400 Subject: [PATCH 04/22] refresh socket.io-parser to 4.2.7 socket.io-parser 4.2.4 (high) -> 4.2.7, within socket.io's ~4.2.4 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/yarn.lock b/yarn.lock index 72f22a35c..1d5b3eb0d 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3979,7 +3979,7 @@ debug@^4.4.3, debug@~4.4.1: dependencies: ms "^2.1.3" -debug@~4.3.1, debug@~4.3.2, debug@~4.3.4: +debug@~4.3.2, debug@~4.3.4: version "4.3.7" resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.7.tgz#87945b4151a011d76d95a198d7111c865c360a52" integrity sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ== @@ -10207,12 +10207,12 @@ socket.io-adapter@~2.5.2: ws "~8.17.1" socket.io-parser@~4.2.4: - version "4.2.4" - resolved "https://registry.yarnpkg.com/socket.io-parser/-/socket.io-parser-4.2.4.tgz#c806966cf7270601e47469ddeec30fbdfda44c83" - integrity sha512-/GbIKmo8ioc+NIWIhwdecY0ge+qVBSMdgxGygevmdHj24bsfgtCmcUUcQ5ZzcylGFHsN3k4HB4Cgkl96KVnuew== + version "4.2.7" + resolved "https://registry.yarnpkg.com/socket.io-parser/-/socket.io-parser-4.2.7.tgz#679e51fe24d1c81df90fc5f7efe4a5f432fe99c0" + integrity sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg== dependencies: "@socket.io/component-emitter" "~3.1.0" - debug "~4.3.1" + debug "~4.4.1" socket.io@^4.5.4: version "4.8.1" From 538755c2f8c8d1d3e7dd5c8a04d797feb0af8ac5 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 14:08:21 -0400 Subject: [PATCH 05/22] refresh ws to 8.21.3/8.22.0 ws 8.17.1 and 8.18.2 (both high) remained after the engine.io refresh: - jsdom's ^8.2.3 range refreshes to 8.22.0. - socket.io-adapter 2.5.5 pinned ws ~8.17.1; socket.io-adapter 2.5.8, within socket.io's ~2.5.2 range, takes ~8.21.0 (8.21.3), the same copy engine.io already uses. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) diff --git a/yarn.lock b/yarn.lock index 1d5b3eb0d..36b508d74 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3979,7 +3979,7 @@ debug@^4.4.3, debug@~4.4.1: dependencies: ms "^2.1.3" -debug@~4.3.2, debug@~4.3.4: +debug@~4.3.2: version "4.3.7" resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.7.tgz#87945b4151a011d76d95a198d7111c865c360a52" integrity sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ== @@ -10199,12 +10199,12 @@ snapdragon@^0.8.1: use "^3.1.0" socket.io-adapter@~2.5.2: - version "2.5.5" - resolved "https://registry.yarnpkg.com/socket.io-adapter/-/socket.io-adapter-2.5.5.tgz#c7a1f9c703d7756844751b6ff9abfc1780664082" - integrity sha512-eLDQas5dzPgOWCk9GuuJC2lBqItuhKI4uxGgo9aIV7MYbk2h9Q6uULEh8WBzThoI7l+qU9Ast9fVUmkqPP9wYg== + version "2.5.8" + resolved "https://registry.yarnpkg.com/socket.io-adapter/-/socket.io-adapter-2.5.8.tgz#c9fcabf602dbd5b09258ca98e5ec6a7ae4360698" + integrity sha512-6Oy52pbg+kvdCVvjcN+FnY7BvxZ7cIHNScbvztT/It5d0vbwoJoVZmF2gjJmnV0/4WlXRfG15zc45ySk9Ah8bw== dependencies: - debug "~4.3.4" - ws "~8.17.1" + debug "~4.4.1" + ws "~8.21.0" socket.io-parser@~4.2.4: version "4.2.7" @@ -11640,14 +11640,9 @@ write-file-atomic@^3.0.0: typedarray-to-buffer "^3.1.5" ws@^8.2.3: - version "8.18.2" - resolved "https://registry.yarnpkg.com/ws/-/ws-8.18.2.tgz#42738b2be57ced85f46154320aabb51ab003705a" - integrity sha512-DMricUmwGZUVr++AEAe2uiVM7UoO9MAVZMDu05UQOaUII0lp+zOzLLU4Xqh/JvTqklB1T4uELaaPBKyjE1r4fQ== - -ws@~8.17.1: - version "8.17.1" - resolved "https://registry.yarnpkg.com/ws/-/ws-8.17.1.tgz#9293da530bb548febc95371d90f9c878727d919b" - integrity sha512-6XQFvXTkbfUOZOKKILFG1PDK2NDQs4azKQl26T0YS5CxqWLgXajbPZ+h4gZekJyRqFU8pvnbAbbs/3TgRPy+GQ== + version "8.22.0" + resolved "https://registry.yarnpkg.com/ws/-/ws-8.22.0.tgz#40f16e1d7588ac0575041be5c49b8eb261c28e73" + integrity sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg== ws@~8.21.0: version "8.21.3" From 4c878d0d6169f1e1d3c07959092e490d6cf6048e Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:22:31 -0400 Subject: [PATCH 06/22] refresh websocket-driver to 0.7.5 websocket-driver 0.7.4 (critical) -> 0.7.5, within faye-websocket's >=0.5.1 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 36b508d74..0462f97a9 100644 --- a/yarn.lock +++ b/yarn.lock @@ -11418,9 +11418,9 @@ webpack@^5.56.1: webpack-sources "^3.2.3" websocket-driver@>=0.5.1: - version "0.7.4" - resolved "https://registry.yarnpkg.com/websocket-driver/-/websocket-driver-0.7.4.tgz#89ad5295bbf64b480abcba31e4953aca706f5760" - integrity sha512-b17KeDIQVjvb0ssuSDF2cYXSg2iztliJ4B9WdsuB6J952qCPKmnVq4DyW5motImXHDC1cBT/1UezrJVsKw5zjg== + version "0.7.5" + resolved "https://registry.yarnpkg.com/websocket-driver/-/websocket-driver-0.7.5.tgz#569d22764ab21f2de20af0e74b411e8ae5a0fa46" + integrity sha512-ZL2+3c7kMBdIRCMz6l8jQMHyGVxj+UL+xVk74Ombiciboca8rHa15L86B19E5oh1pL9Ii/uj54gtsIrZGMo6zA== dependencies: http-parser-js ">=0.5.1" safe-buffer ">=5.1.0" From 617be53f74a569220308c9b173aac0559602c79e Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:19:19 -0400 Subject: [PATCH 07/22] refresh proxy-addr to 2.0.8 proxy-addr 2.0.7 (critical) -> 2.0.8, within express's ~2.0.7 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 0462f97a9..71cd1fadf 100644 --- a/yarn.lock +++ b/yarn.lock @@ -9249,9 +9249,9 @@ propagate@^2.0.0: integrity sha512-vGrhOavPSTz4QVNuBNdcNXePNdNMaO1xj9yBeH1ScQPjk/rhg9sSlCXPhMkFuaNNW/syTvYqsnbIJxMBfRbbag== proxy-addr@~2.0.7: - version "2.0.7" - resolved "https://registry.yarnpkg.com/proxy-addr/-/proxy-addr-2.0.7.tgz#f19fe69ceab311eeb94b42e70e8c2070f9ba1025" - integrity sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg== + version "2.0.8" + resolved "https://registry.yarnpkg.com/proxy-addr/-/proxy-addr-2.0.8.tgz#624e760fd8ab06b1b8320c2f8506d4422cf8e932" + integrity sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ== dependencies: forwarded "0.2.0" ipaddr.js "1.9.1" From 80d18f1f1da8549f2135bea293f8f1b031f9627c Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:14:46 -0400 Subject: [PATCH 08/22] refresh terser-webpack-plugin to 5.6.1 webpack 5's terser-webpack-plugin 5.3.14 depended on serialize-javascript 6.0.2 (high; the fix, 7.x, needs Node >= 20). 5.6.1, still inside webpack's ^5.3.11 range, no longer depends on serialize-javascript at all. Lockfile refresh only. The production build bundles the same modules and identifiers; only webpack's numeric module ids in the two ember-auto-import chunks (and so their content hashes and the references in index.html) change. Audit: high 50 -> 49. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/yarn.lock b/yarn.lock index 71cd1fadf..e55f7e24d 100644 --- a/yarn.lock +++ b/yarn.lock @@ -9947,13 +9947,6 @@ serialize-javascript@5.0.1: dependencies: randombytes "^2.1.0" -serialize-javascript@^6.0.2: - version "6.0.2" - resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-6.0.2.tgz#defa1e055c83bf6d59ea805d8da862254eb6a6c2" - integrity sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g== - dependencies: - randombytes "^2.1.0" - serve-static@~1.16.2: version "1.16.3" resolved "https://registry.yarnpkg.com/serve-static/-/serve-static-1.16.3.tgz#a97b74d955778583f3862a4f0b841eb4d5d78cf9" @@ -10718,14 +10711,13 @@ temp@0.9.4: rimraf "~2.6.2" terser-webpack-plugin@^5.3.11: - version "5.3.14" - resolved "https://registry.yarnpkg.com/terser-webpack-plugin/-/terser-webpack-plugin-5.3.14.tgz#9031d48e57ab27567f02ace85c7d690db66c3e06" - integrity sha512-vkZjpUjb6OMS7dhV+tILUW6BhpDR7P2L/aQSAv+Uwk+m8KATX9EccViHTJR2qDtACKPIYndLGCyl3FMo+r2LMw== + version "5.6.1" + resolved "https://registry.yarnpkg.com/terser-webpack-plugin/-/terser-webpack-plugin-5.6.1.tgz#47bc41bd8b8fab8383b62ec763b7394829097e7b" + integrity sha512-201R5j+sJpK8nFWwKVyNfZot8FaJbLZDq5evriVzbV1wDtSXDjRUDRfJzHpAaxFDMEhsZL1QkeqM61wgsS3KaQ== dependencies: "@jridgewell/trace-mapping" "^0.3.25" jest-worker "^27.4.5" schema-utils "^4.3.0" - serialize-javascript "^6.0.2" terser "^5.31.1" terser@^5.31.1, terser@^5.7.0: From 1e10ea8bb4aa27de46db537c8592fe327d91689f Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:25:30 -0400 Subject: [PATCH 09/22] refresh shell-quote to 1.12.0 shell-quote 1.8.3 (critical, high) -> 1.12.0, within npm-run-all's ^1.6.1 range. npm-run-all drives `yarn lint`, which still runs all its tasks. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index e55f7e24d..ede4b58ce 100644 --- a/yarn.lock +++ b/yarn.lock @@ -10038,9 +10038,9 @@ shebang-regex@^3.0.0: integrity sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A== shell-quote@^1.6.1: - version "1.8.3" - resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.8.3.tgz#55e40ef33cf5c689902353a3d8cd1a6725f08b4b" - integrity sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw== + version "1.12.0" + resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.12.0.tgz#e98fdfd2e921d8a58ae2820f4fc0f75c39f09675" + integrity sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q== shellwords@^0.1.1: version "0.1.1" From fb57ffdbbf5ce1943b80ad14ba8d30c9c10aa153 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:28:27 -0400 Subject: [PATCH 10/22] refresh form-data to 4.0.6 form-data 4.0.3 (critical, high) -> 4.0.6, within jsdom's ^4.0.0 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/yarn.lock b/yarn.lock index ede4b58ce..d3706744a 100644 --- a/yarn.lock +++ b/yarn.lock @@ -6096,15 +6096,15 @@ for-in@^1.0.2: integrity sha512-7EwmXrOjyL+ChxMhmG5lnW9MPt1aIeZEwKhQzoBUdTV0N3zuwWDZYVJatDvZ2OyzPUvdIAZDsCetk3coyMfcnQ== form-data@^4.0.0: - version "4.0.3" - resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.3.tgz#608b1b3f3e28be0fccf5901fc85fb3641e5cf0ae" - integrity sha512-qsITQPfmvMOSAdeyZ+12I1c+CKSstAFAwu+97zrnWAbIr5u8wfsExUzCesVLC8NgHuRUqNN4Zy6UPWUTRGslcA== + version "4.0.6" + resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.6.tgz#28e864e1b786dbebb68db1f452f9635278665827" + integrity sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ== dependencies: asynckit "^0.4.0" combined-stream "^1.0.8" es-set-tostringtag "^2.1.0" - hasown "^2.0.2" - mime-types "^2.1.12" + hasown "^2.0.4" + mime-types "^2.1.35" forwarded@0.2.0: version "0.2.0" @@ -8267,7 +8267,7 @@ mime-db@1.52.0: resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.54.0.tgz#cddb3ee4f9c64530dff640236661d42cb6a314f5" integrity sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ== -mime-types@^2.1.12, mime-types@^2.1.18, mime-types@^2.1.26, mime-types@^2.1.27, mime-types@~2.1.24, mime-types@~2.1.34: +mime-types@^2.1.18, mime-types@^2.1.26, mime-types@^2.1.27, mime-types@^2.1.35, mime-types@~2.1.24, mime-types@~2.1.34: version "2.1.35" resolved "https://registry.yarnpkg.com/mime-types/-/mime-types-2.1.35.tgz#381a871b62a734450660ae3deee44813f70d959a" integrity sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw== From 7221bd3ddb6c3ecc3b0ad784fa27704393b800b4 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 13:31:35 -0400 Subject: [PATCH 11/22] refresh @xmldom/xmldom to 0.8.15 @xmldom/xmldom 0.8.10 (13 high findings) -> 0.8.15, within testem's ^0.8.0 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index d3706744a..d90cf2df6 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1870,9 +1870,9 @@ "@xtuc/long" "4.2.2" "@xmldom/xmldom@^0.8.0": - version "0.8.10" - resolved "https://registry.yarnpkg.com/@xmldom/xmldom/-/xmldom-0.8.10.tgz#a1337ca426aa61cef9fe15b5b28e340a72f6fa99" - integrity sha512-2WALfTl4xo2SkGCYRt6rDTFfk9R1czmBvUQy12gK2KuRKIpWEhcbbzy8EZXtz/jkRqHX8bFEc6FC1HjX4TUWYw== + version "0.8.15" + resolved "https://registry.yarnpkg.com/@xmldom/xmldom/-/xmldom-0.8.15.tgz#71ebf80729e4e95221d519ac9b1e1eaea7784907" + integrity sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA== "@xtuc/ieee754@^1.2.0": version "1.2.0" From 4c1dd507a1760d6caf569a14028c5f6a46eab3d6 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 14:11:09 -0400 Subject: [PATCH 12/22] refresh flatted to 3.4.4 flatted 3.3.3 (high) -> 3.4.4, within flat-cache's ^3.2.9 range (eslint's cache, exercised by `yarn lint`). Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index d90cf2df6..a892f44a7 100644 --- a/yarn.lock +++ b/yarn.lock @@ -6067,9 +6067,9 @@ flat@^5.0.2: integrity sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ== flatted@^3.2.9: - version "3.3.3" - resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.3.3.tgz#67c8fad95454a7c7abebf74bb78ee74a44023358" - integrity sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg== + version "3.4.4" + resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.4.4.tgz#aeeca2a506303f0cee61c59e6c9f2a88d2f29fc6" + integrity sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q== focus-trap@^6.7.1: version "6.9.4" From a60344f597eca323da98f33f3037b82bfb95e1b7 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 14:14:49 -0400 Subject: [PATCH 13/22] refresh js-yaml to 3.15.2 and force mocha's copy to 4.3.2 js-yaml 3.14.1 (ember-cli, testem, tap-parser) and 4.0.0 (mocha) both have high advisories. - The ^3 ranges refresh to 3.15.2 (lockfile only). - mocha 8 pins js-yaml 4.0.0 exactly, so a resolution scoped to mocha moves it to 4.3.2 (same major). mocha uses it to read YAML config; loading a .mocharc.yml through it still runs all node tests. Co-Authored-By: Claude Opus 5.5 --- package.json | 3 ++- yarn.lock | 14 +++++++------- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/package.json b/package.json index e8b4785c7..9b2b7284a 100644 --- a/package.json +++ b/package.json @@ -65,7 +65,8 @@ "nanoid": "^3.3.18", "markdown-it": "^14.3.3", "lodash.template": "^4.18.1", - "ansi-html": "0.0.9" + "ansi-html": "0.0.9", + "mocha/js-yaml": "^4.3.2" }, "dependencies": { "@ember/render-modifiers": "^2.1.0", diff --git a/yarn.lock b/yarn.lock index a892f44a7..7a2e07a43 100644 --- a/yarn.lock +++ b/yarn.lock @@ -7513,17 +7513,17 @@ js-tokens@^4.0.0: resolved "https://registry.yarnpkg.com/js-tokens/-/js-tokens-4.0.0.tgz#19203fb59991df98e3a287050d4647cdeaf32499" integrity sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ== -js-yaml@4.0.0: - version "4.0.0" - resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.0.0.tgz#f426bc0ff4b4051926cd588c71113183409a121f" - integrity sha512-pqon0s+4ScYUvX30wxQi3PogGFAlUyH0awepWvwkj4jD4v+ova3RiYw8bmA6x2rDrEaj8i/oWKoRxpVNW+Re8Q== +js-yaml@4.0.0, js-yaml@^4.3.2: + version "4.3.2" + resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.2.tgz#8e44fb14a2643c59726bb15787b5f1512cb3d3fb" + integrity sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA== dependencies: argparse "^2.0.1" js-yaml@^3.13.1, js-yaml@^3.14.0, js-yaml@^3.2.5, js-yaml@^3.2.7: - version "3.14.1" - resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.14.1.tgz#dae812fdb3825fa306609a8717383c50c36a0537" - integrity sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g== + version "3.15.2" + resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.15.2.tgz#3f83823ac6be17f570f23b2ecdef3777ff5ea364" + integrity sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w== dependencies: argparse "^1.0.7" esprima "^4.0.0" From 33d259159749cc25df89377e36729f145e90bcd6 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 14:17:47 -0400 Subject: [PATCH 14/22] refresh source-map-js to 1.2.2 source-map-js 1.2.1 (high) -> 1.2.2, within css-tree's ^1.0.1 range (eslint-plugin-ember). It merges with the 1.2.2 copy already in the tree. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/yarn.lock b/yarn.lock index 7a2e07a43..2fa07b0ba 100644 --- a/yarn.lock +++ b/yarn.lock @@ -10237,12 +10237,7 @@ sort-package-json@^1.49.0: is-plain-obj "2.1.0" sort-object-keys "^1.1.3" -source-map-js@^1.0.1: - version "1.2.1" - resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.1.tgz#1ce5650fddd87abc099eda37dcff024c2667ae46" - integrity sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA== - -source-map-js@^1.2.2: +source-map-js@^1.0.1, source-map-js@^1.2.2: version "1.2.2" resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.2.tgz#79fb88d97535a21cb27162cb05d211b67acea4ab" integrity sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw== From fa369d583efb56200202a6db2c12bef6bc8126b6 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Wed, 28 Oct 2026 14:20:18 -0400 Subject: [PATCH 15/22] refresh underscore to 1.13.8 underscore 1.13.7 (high) -> 1.13.8, within backbone's >=1.8.3 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 2fa07b0ba..f2406188c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -11079,9 +11079,9 @@ underscore.string@^3.2.2, underscore.string@~3.3.4: util-deprecate "^1.0.2" underscore@>=1.8.3: - version "1.13.7" - resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.13.7.tgz#970e33963af9a7dda228f17ebe8399e5fbe63a10" - integrity sha512-GMXzWtsc57XAtguZgaQViUOzs0KTkk8ojr3/xAxXLITqf/3EMwxC0inyETfDFjH/Krbhuep0HNbbjI9i/q3F3g== + version "1.13.8" + resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.13.8.tgz#a93a21186c049dbf0e847496dba72b7bd8c1e92b" + integrity sha512-DXtD3ZtEQzc7M8m4cXotyHR+FAS18C64asBYY5vqZexfYryNNnDc02W4hKg3rdQuqOYas1jkseX0+nZXjTXnvQ== undici-types@~7.8.0: version "7.8.0" From 9ec9243dcc59fef083fc11da78e39c9ac23327ff Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Thu, 29 Oct 2026 06:42:21 -0400 Subject: [PATCH 16/22] SCF-2415: bump version to 4.10.3 Co-Authored-By: Claude Opus 5.5 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 9b2b7284a..1974f3567 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "ember-bootstrap", - "version": "4.10.2", + "version": "4.10.3", "description": "Bootstrap components for Ember.js", "keywords": [ "ember-addon", From b4f43a5cb329469a7370a7a20d5b3a8a8f201000 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Tue, 3 Nov 2026 08:08:10 -0500 Subject: [PATCH 17/22] SCF-2415: run CI on push only for scf_master and tags With push on every branch and pull_request on every base branch, each push to a branch with an open PR ran the full matrix twice. PRs are still covered by the pull_request trigger, which uses '**' so stacked PRs on gaurav/chore/... bases run (b057803b). Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 348976a2c..f4a825a48 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,7 +3,7 @@ name: CI on: push: branches: - - '*' + - scf_master tags: - '*' pull_request: From 4b70cb2f773e770454ca775f13252b8017e3e85c Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Tue, 3 Nov 2026 08:07:58 -0500 Subject: [PATCH 18/22] SCF-2415: make the modal footer's submit button a submit button via the type attribute Since f005cd0c the default submit button set its type with @buttonType="submit", which only BsButton understands. A custom @buttonComponent that renders - + {{else}} {{/if}} diff --git a/tests/integration/components/bs-modal/footer-test.js b/tests/integration/components/bs-modal/footer-test.js index 4e8e9b74e..b22ce9c72 100644 --- a/tests/integration/components/bs-modal/footer-test.js +++ b/tests/integration/components/bs-modal/footer-test.js @@ -1,3 +1,5 @@ +import { setComponentTemplate } from '@ember/component'; +import templateOnly from '@ember/component/template-only'; import { module } from 'qunit'; import { setupRenderingTest } from 'ember-qunit'; import { click, render } from '@ember/test-helpers'; @@ -64,6 +66,38 @@ module('Integration | Component | bs-modal/footer', function (hooks) { assert.true(defaultPrevented, 'Native form submission is prevented.'); }); + module('native form submission', function (hooks) { + hooks.beforeEach(function () { + this.defaultPrevented = undefined; + this.listener = (event) => { + this.defaultPrevented = event.defaultPrevented; + // never let the test runner page navigate + event.preventDefault(); + }; + window.addEventListener('submit', this.listener); + }); + + hooks.afterEach(function () { + window.removeEventListener('submit', this.listener); + }); + + test('a custom buttonComponent submits the footer', async function (assert) { + let submitCount = 0; + this.set('submit', () => submitCount++); + this.CustomButton = setComponentTemplate( + hbs``, + templateOnly() + ); + await render( + hbs`` + ); + await click('.modal-footer button:last-child'); + + assert.strictEqual(submitCount, 1, 'onSubmit is called once.'); + assert.true(this.defaultPrevented, 'Native form submission is prevented.'); + }); + }); + test('Footer can have a custom submitButtonType', async function (assert) { await render(hbs``); assert.dom('.modal-footer button:last-child').hasClass('btn-danger', 'Submit button is a danger button.'); From 4614a42a8ee1ab5bbcc3b5401ec9a959fb5d5ff2 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Tue, 3 Nov 2026 08:07:58 -0500 Subject: [PATCH 19/22] SCF-2415: keep the modal footer's native submission unless onSubmit handles it 6c23b4c9 made the footer
always call preventDefault() on submit, to stop the page reload when its submit button calls @onSubmit. That also blocked native submission where it used to happen: a standalone footer without @onSubmit, and a footer given an action attribute (e.g. ). Only prevent the default when @onSubmit is given and the form has no action attribute. That still covers the reload in BsModal, where the footer always gets onSubmit and no action. Co-Authored-By: Claude Opus 5.5 --- addon/components/bs-modal/footer.js | 12 +++++++++--- .../components/bs-modal/footer-test.js | 19 +++++++++++++++++++ 2 files changed, 28 insertions(+), 3 deletions(-) diff --git a/addon/components/bs-modal/footer.js b/addon/components/bs-modal/footer.js index 729eb115f..db033fd66 100644 --- a/addon/components/bs-modal/footer.js +++ b/addon/components/bs-modal/footer.js @@ -70,8 +70,14 @@ import { action } from '@ember/object'; export default class ModalFooter extends Component { @action handleSubmit(event) { - // the footer is a , so prevent the browser's native submission (and the page reload that comes with it) - event.preventDefault(); - this.args.onSubmit?.(); + if (!this.args.onSubmit) { + return; + } + // the footer is a , so prevent the browser's native submission (and the page reload that comes with it), + // unless an `action` attribute asks for it + if (!event.target.hasAttribute('action')) { + event.preventDefault(); + } + this.args.onSubmit(); } } diff --git a/tests/integration/components/bs-modal/footer-test.js b/tests/integration/components/bs-modal/footer-test.js index b22ce9c72..af7aceb89 100644 --- a/tests/integration/components/bs-modal/footer-test.js +++ b/tests/integration/components/bs-modal/footer-test.js @@ -81,6 +81,25 @@ module('Integration | Component | bs-modal/footer', function (hooks) { window.removeEventListener('submit', this.listener); }); + test('it is not prevented without onSubmit', async function (assert) { + await render(hbs``); + await click('.modal-footer button:last-child'); + + assert.false(this.defaultPrevented, 'Native form submission is not prevented.'); + }); + + test('it is not prevented when the footer has an action attribute', async function (assert) { + let submitCount = 0; + this.set('submit', () => submitCount++); + await render( + hbs`` + ); + await click('.modal-footer button:last-child'); + + assert.strictEqual(submitCount, 1, 'onSubmit is called once.'); + assert.false(this.defaultPrevented, 'Native form submission is not prevented.'); + }); + test('a custom buttonComponent submits the footer', async function (assert) { let submitCount = 0; this.set('submit', () => submitCount++); From 52be6925ad57865705296c34440e7f2a04db2bb4 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Tue, 3 Nov 2026 08:08:10 -0500 Subject: [PATCH 20/22] SCF-2415: hide BsAlert for @visible={{null}} again 8945d07c (upstream #2027) replaced `@arg visible = true` with `this._visible ?? true`, so @visible={{null}} (e.g. an unset model attribute) now shows the alert. @arg only falls back to its default for undefined, so null used to hide it. Fall back for undefined only. Co-Authored-By: Claude Opus 5.5 --- addon/components/bs-alert.js | 2 +- tests/integration/components/bs-alert-test.js | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/addon/components/bs-alert.js b/addon/components/bs-alert.js index e483c607e..411d5f521 100644 --- a/addon/components/bs-alert.js +++ b/addon/components/bs-alert.js @@ -86,7 +86,7 @@ export default class Alert extends Component { * @public */ get visible() { - return this._visible ?? true; + return this._visible !== undefined ? this._visible : true; } /** diff --git a/tests/integration/components/bs-alert-test.js b/tests/integration/components/bs-alert-test.js index f250917a1..d9de0242b 100644 --- a/tests/integration/components/bs-alert-test.js +++ b/tests/integration/components/bs-alert-test.js @@ -141,6 +141,22 @@ module('Integration | Component | bs-alert', function (hooks) { assert.dom('*').hasText('', 'alert has no content'); }); + test('alert is initially hidden when visible=null', async function (assert) { + await render(hbs`Test`); + + assert.dom('.alert').doesNotExist('alert has no alert class'); + assert.dom('*').hasText('', 'alert has no content'); + }); + + test('alert can be hidden by setting visible=null', async function (assert) { + this.set('visible', true); + await render(hbs`Test`); + this.set('visible', null); + await settled(); + + assert.dom('.alert').doesNotExist('alert has no alert class'); + }); + test('alert can be made visible when setting visible=true', async function (assert) { this.set('visible', false); await render(hbs`Test`); From ad6dd684bc38abcaf1f7612ba16677dfbbc70409 Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Tue, 3 Nov 2026 08:08:10 -0500 Subject: [PATCH 21/22] SCF-2415: follow BsAlert's @visible in the same render 8945d07c copied @visible into the tracked _visible from a {{did-update this.updateVisibility @visible}} modifier. Writing it during modifier commit schedules a second render, and only that render runs {{did-update this.showOrHide this._visible}}, so each @visible change took an extra render pass before the fade started. Resolve visibility in the visible getter instead. A dismissal records how often @visible had changed at the time (_dismissedAt), and holds until @visible changes again, which the getter counts in untracked fields. That keeps #2027's behavior (dismiss doesn't touch @visible, and setting @visible to false and back to true shows the alert again) without writing tracked state while rendering, which is what broke @localCopy on Ember canary. showOrHide's did-update now reads @visible itself, so without a fade onDismissed is called from the afterRender queue instead of from the modifier: a handler that sets @visible (as in #2027's test) would otherwise update a value that render has already used. With a fade it was already called later, from a timer. Co-Authored-By: Claude Opus 5.5 --- addon/components/bs-alert.hbs | 3 +-- addon/components/bs-alert.js | 40 +++++++++++++++++++++++++---------- 2 files changed, 30 insertions(+), 13 deletions(-) diff --git a/addon/components/bs-alert.hbs b/addon/components/bs-alert.hbs index e192d07fb..ed8b27fbb 100644 --- a/addon/components/bs-alert.hbs +++ b/addon/components/bs-alert.hbs @@ -1,8 +1,7 @@
{{#unless this.hidden}} {{#if this.dismissible}} diff --git a/addon/components/bs-alert.js b/addon/components/bs-alert.js index 411d5f521..bbad72857 100644 --- a/addon/components/bs-alert.js +++ b/addon/components/bs-alert.js @@ -1,7 +1,7 @@ import { action } from '@ember/object'; import Component from '@glimmer/component'; import { tracked } from '@glimmer/tracking'; -import { later } from '@ember/runloop'; +import { later, schedule } from '@ember/runloop'; import usesTransition from 'ember-bootstrap/utils/decorators/uses-transition'; import deprecateSubclassing from 'ember-bootstrap/utils/deprecate-subclassing'; import arg from 'ember-bootstrap/utils/decorators/arg'; @@ -86,15 +86,33 @@ export default class Alert extends Component { * @public */ get visible() { - return this._visible !== undefined ? this._visible : true; + let visible = this.args.visible; + if (visible !== this._visibleArg) { + // untracked bookkeeping, so the alert can be shown again after being dismissed once `@visible` changes + // eslint-disable-next-line ember/no-side-effects + this._visibleArg = visible; + this._visibleArgChanges++; + } + if (this._dismissedAt === this._visibleArgChanges) { + return false; + } + return visible !== undefined ? visible : true; } /** - * @property _visible + * `@visible` as last seen by `visible`, and how often it has changed. These are untracked, as `visible` updates them + * while rendering. + * @private + */ + _visibleArg = this.args.visible; + _visibleArgChanges = 0; + + /** + * The value of `_visibleArgChanges` when the alert was dismissed, so the alert stays hidden until `@visible` changes. * @private */ @tracked - _visible = this.args.visible; + _dismissedAt = -1; /** * Set to false to disable the fade out animation when hiding the alert. @@ -163,7 +181,7 @@ export default class Alert extends Component { @action dismiss() { if (this.args.onDismiss?.() !== false) { - this._visible = false; + this._dismissedAt = this._visibleArgChanges; } } @@ -202,7 +220,12 @@ export default class Alert extends Component { ); } else { this.hidden = true; - this.args.onDismissed?.(); + // hide() runs while rendering, and onDismissed may set @visible, which that render has already read + schedule('afterRender', this, function () { + if (!this.isDestroyed) { + this.args.onDismissed?.(); + } + }); } } @@ -214,9 +237,4 @@ export default class Alert extends Component { this.hide(); } } - - @action - updateVisibility() { - this._visible = this.args.visible; - } } From ee88a0fc06e331d2428fb742720921bae8fad4ba Mon Sep 17 00:00:00 2001 From: Gaurav Munjal Date: Tue, 3 Nov 2026 08:08:10 -0500 Subject: [PATCH 22/22] SCF-2415: skip the "does not catch errors thrown by onSubmit" test only under Embroider 7b53aa7a skipped it everywhere for an Embroider-only failure (kaliber5/ember-bootstrap#1682), so classic builds stopped checking that BsForm doesn't swallow errors thrown by @onSubmit. Skip it only when @embroider/core is installed, the check @embroider/test-setup's maybeEmbroider uses to build with Embroider. Co-Authored-By: Claude Opus 5.5 --- tests/integration/components/bs-form-test.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/integration/components/bs-form-test.js b/tests/integration/components/bs-form-test.js index 0e06ce531..dc912aad5 100644 --- a/tests/integration/components/bs-form-test.js +++ b/tests/integration/components/bs-form-test.js @@ -33,6 +33,10 @@ import setupNoDeprecations from '../../helpers/setup-no-deprecations'; import a11yAudit from 'ember-a11y-testing/test-support/audit'; import sinon from 'sinon'; import Ember from 'ember'; +import { dependencySatisfies, macroCondition } from '@embroider/macros'; + +// see https://github.com/kaliber5/ember-bootstrap/issues/1682 +const testUnlessEmbroider = macroCondition(dependencySatisfies('@embroider/core', '*')) ? skip : test; const nextRunloop = function () { return new Promise((resolve) => { @@ -241,7 +245,7 @@ module('Integration | Component | bs-form', function (hooks) { assert.dom(`.${formFeedbackClass()}`).hasText('There is an error'); }); - skip('it does not catch errors thrown by onSubmit action', async function (assert) { + testUnlessEmbroider('it does not catch errors thrown by onSubmit action', async function (assert) { let onErrorStub = sinon.stub(); let expectedError = new Error();