diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 68b457899..a0b66fd19 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -13,6 +13,7 @@ overrides: qs: ^6.16.0 basic-ftp: ^6.2.1 shell-quote: ^1.11.0 + web-ext>@devicefarmer/adbkit: '-' patchedDependencies: '@stryker-mutator/vitest-runner@10.0.0': c5d635178da5a48e07051030a6d2eb3f33f4b31a71f4232c05f099e8e90f3dc2 @@ -341,19 +342,6 @@ packages: '@cacheable/utils@2.5.0': resolution: {integrity: sha512-buipgOVDkkPXNR5+xBpDw7Zk2n1EvU7qBJCNUcL7rhQ//kfpOXPAvQ511Os0vpLYJ1pZnvudNytkQt2hst3wqA==} - '@devicefarmer/adbkit-logcat@2.1.3': - resolution: {integrity: sha512-yeaGFjNBc/6+svbDeul1tNHtNChw6h8pSHAt5D+JsedUrMTN7tla7B15WLDyekxsuS2XlZHRxpuC6m92wiwCNw==} - engines: {node: '>= 4'} - - '@devicefarmer/adbkit-monkey@1.2.1': - resolution: {integrity: sha512-ZzZY/b66W2Jd6NHbAhLyDWOEIBWC11VizGFk7Wx7M61JZRz7HR9Cq5P+65RKWUU7u6wgsE8Lmh9nE4Mz+U2eTg==} - engines: {node: '>= 0.10.4'} - - '@devicefarmer/adbkit@3.3.9': - resolution: {integrity: sha512-AYxk5G/b2BPEfubcuxVEZEOpsLf0isqrPNJnnwAlUjZAiLdFg/uvLNRDuBhsC/Ar62X+rUhVlvlL+tKp9HCjfQ==} - engines: {node: '>= 0.10.4'} - hasBin: true - '@esbuild/aix-ppc64@0.28.2': resolution: {integrity: sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==} engines: {node: '>=18'} @@ -1675,9 +1663,6 @@ packages: bcp-47-match@2.0.3: resolution: {integrity: sha512-JtTezzbAibu8G0R9op9zb3vcWZd9JF6M0xOYGPn0fNCd7wOpRB1mU2mH9T8gaBGbAAyIIVgB2G7xG0GP98zMAQ==} - bluebird@3.7.2: - resolution: {integrity: sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==} - boolbase@1.0.0: resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==} @@ -1893,15 +1878,6 @@ packages: debounce@1.2.1: resolution: {integrity: sha512-XRRe6Glud4rd/ZGQfiV1ruXSfbvfJedlV9Y6zOlP+2K04vBYiJEte6stfFkCP03aMnY5tsipamumUjL14fofug==} - debug@4.3.7: - resolution: {integrity: sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==} - engines: {node: '>=6.0'} - peerDependencies: - supports-color: '*' - peerDependenciesMeta: - supports-color: - optional: true - debug@4.4.3: resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==} engines: {node: '>=6.0'} @@ -2982,10 +2958,6 @@ packages: natural-compare@1.4.0: resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==} - node-forge@1.4.0: - resolution: {integrity: sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==} - engines: {node: '>= 6.13.0'} - node-releases@2.0.57: resolution: {integrity: sha512-kQK9LGGFiHtrWiNhZtA7Qbw17AQz+dmsEKODRIVTXA9+e5MS/2gZEBhYJt13GrAz5/IOZKddH/0Z3TP/Zgo+yw==} engines: {node: '>=18'} @@ -3407,9 +3379,6 @@ packages: resolution: {integrity: sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==} engines: {node: '>= 10.x'} - split@1.0.1: - resolution: {integrity: sha512-mTyOoPbrivtXnwnIxZRFYRrPNtEFKlpB2fvjSnCQUiAA6qAZzqwna5envK4uk6OIeP17CsdF3rSBGYVBsU0Tkg==} - stack-utils@2.0.6: resolution: {integrity: sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ==} engines: {node: '>=10'} @@ -3509,9 +3478,6 @@ packages: resolution: {integrity: sha512-e2zZ96wSChazBsbENf/Pcm/4swHt2cEKQ92rhUjkL9GCKiTDJIaTBenjE/m9DXi0QBmTMDkFDdOomUy20A1tDQ==} engines: {node: '>=20'} - through@2.3.8: - resolution: {integrity: sha512-w89qg7PI8wAdvX60bMDP+bFoD5Dvhm9oLheFp5O4a2QF0cSBGsBX4qZmadPMvVqlLJBBci+WqGGOAPvcDeNSVg==} - tinybench@6.1.4: resolution: {integrity: sha512-9APumHG7r4yOk4X4WlkmE71aZcv1gvin1czO3OQ1U9iJcFA5Ja/ygyb0vPOVHTthFozUYs8CLoLUlM8grb2lTQ==} engines: {node: '>=20.0.0'} @@ -4159,22 +4125,6 @@ snapshots: hashery: 1.5.1 keyv: 5.6.0 - '@devicefarmer/adbkit-logcat@2.1.3': {} - - '@devicefarmer/adbkit-monkey@1.2.1': {} - - '@devicefarmer/adbkit@3.3.9(supports-color@8.1.1)': - dependencies: - '@devicefarmer/adbkit-logcat': 2.1.3 - '@devicefarmer/adbkit-monkey': 1.2.1 - bluebird: 3.7.2 - commander: 9.5.0 - debug: 4.3.7(supports-color@8.1.1) - node-forge: 1.4.0 - split: 1.0.1 - transitivePeerDependencies: - - supports-color - '@esbuild/aix-ppc64@0.28.2': optional: true @@ -5449,8 +5399,6 @@ snapshots: bcp-47-match@2.0.3: {} - bluebird@3.7.2: {} - boolbase@1.0.0: {} boxen@8.0.1: @@ -5716,12 +5664,6 @@ snapshots: debounce@1.2.1: {} - debug@4.3.7(supports-color@8.1.1): - dependencies: - ms: 2.1.3 - optionalDependencies: - supports-color: 8.1.1 - debug@4.4.3(supports-color@8.1.1): dependencies: ms: 2.1.3 @@ -6809,8 +6751,6 @@ snapshots: natural-compare@1.4.0: {} - node-forge@1.4.0: {} - node-releases@2.0.57: {} normalize-package-data@6.0.2: @@ -7230,10 +7170,6 @@ snapshots: split2@4.2.0: {} - split@1.0.1: - dependencies: - through: 2.3.8 - stack-utils@2.0.6: dependencies: escape-string-regexp: 2.0.0 @@ -7351,8 +7287,6 @@ snapshots: dependencies: real-require: 1.0.0 - through@2.3.8: {} - tinybench@6.1.4: {} tinyexec@1.3.0: {} @@ -7536,7 +7470,6 @@ snapshots: web-ext@10.7.0(jiti@2.7.0)(supports-color@8.1.1): dependencies: '@babel/runtime': 8.0.5 - '@devicefarmer/adbkit': 3.3.9(supports-color@8.1.1) addons-linter: 10.13.0(jiti@2.7.0)(supports-color@8.1.1) camelcase: 8.0.0 chrome-launcher: 1.2.0(supports-color@8.1.1) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 8c10465d5..be78caef6 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -36,6 +36,15 @@ overrides: # 1.6.0 (its newest) pins exactly 1.10.0. fx-runner calls only parse(), on a binary-args # string that nothing here passes; 1.11/1.12 only add parse support for rarer syntax. shell-quote: ^1.11.0 + # Dependabot #60, issue #301 (high, GHSA-86w9-cpqp-85rv): node-forge <= 1.4.0 accepts a + # forged RSA PKCS#1 v1.5 signature, and no release fixes it (2026-10-11: four outside fix + # PRs, no word from its maintainer since June). It comes only through web-ext -> + # @devicefarmer/adbkit, which web-ext loads only to run an extension on Firefox for Android + # (extension-runners/index.js imports firefox-android.js, util/adb.js's only importer, + # when that is the target). build, lint, sign, the desktop run and util/submit-addon never + # reach it. Removing adbkit removes node-forge; `web-ext run -t firefox-android`, which + # nothing here does, is what goes with it. + 'web-ext>@devicefarmer/adbkit': '-' allowBuilds: geckodriver: true esbuild: true